diff --git a/Gruntfile.js b/Gruntfile.js
index b9619dfc0..b5a462bf7 100644
--- a/Gruntfile.js
+++ b/Gruntfile.js
@@ -30,14 +30,14 @@
 
 /*
  * Overview
- * ---
+ * --------
  * Based on the specified version in package.json, we build a matching version folder in /versions
  * for each of the machine simulations; each of those folders in turn receives compiled versions of
  * the corresponding machine simulation scripts (c1p*.js and pc*.js), along with copies of both the
  * shared and machine-specific CSS and XSL stylesheets that the scripts rely on.
  *
  * Usage
- * ---
+ * -----
  *      grunt [task[:target] ...] [--rebuild]
  *
  * If no tasks are specified, the "default" task alias will be run.  If --rebuild is present,
@@ -53,7 +53,7 @@
  * it's also possible I didn't have it configured properly at the time.
  *
  * Utility Tasks
- * ---
+ * -------------
  *      grunt compile:      runs "closureCompiler" to produce compiled c1p*.js and pc*.js scripts
  *      grunt nocompile:    runs "concat" to produce uncompiled c1p*.js and pc*.js scripts
  *      grunt promote:      runs "replace" to promote all machine XML files to the current version
@@ -62,13 +62,13 @@
  * a final "grunt compile" (or "grunt --rebuild") and retest before pushing out a new release.
  *
  * The "manifester" Task
- * ---
+ * ---------------------
  * I added the "manifester" task to process manifest.xml files, which I use to record the existence
  * application archives.  "manifester" walks all the manifests and verifies that they're still valid,
  * and optionally fetches local copies of everything described.
  *
  * The "prepjs" Task
- * ---
+ * -----------------
  * I added the "prepjs" task to perform the same constant inlining that my old PHP script "inline.php"
  * used to do as part of the old "jsmachines.net" build process.  Unfortunately, Grunt appears to be
  * a real memory hog, and so "prepjs" had to be disabled until I could resolve that issue (see my notes
@@ -120,11 +120,11 @@ module.exports = function(grunt) {
      */
     var pkg = grunt.file.readJSON("package.json");
 
-    var tmpC1Pjs  = "./tmp/c1pjs/"  + pkg.version + "/c1p.js";
-    var tmpPCx86  = "./tmp/pcx86/"  + pkg.version + "/pcx86.js";
-    var tmpPC8080 = "./tmp/pc8080/" + pkg.version + "/pc8080.js";
-    var tmpPDP10  = "./tmp/pdpjs/"  + pkg.version + "/pdp10.js";
-    var tmpPDP11  = "./tmp/pdpjs/"  + pkg.version + "/pdp11.js";
+    var tmpC1Pjs  = "./versions/c1pjs/"  + pkg.version + "/c1p-uncompiled.js";
+    var tmpPCx86  = "./versions/pcx86/"  + pkg.version + "/pcx86-uncompiled.js";
+    var tmpPC8080 = "./versions/pc8080/" + pkg.version + "/pc8080-uncompiled.js";
+    var tmpPDP10  = "./versions/pdpjs/"  + pkg.version + "/pdp10-uncompiled.js";
+    var tmpPDP11  = "./versions/pdpjs/"  + pkg.version + "/pdp11-uncompiled.js";
 
     grunt.initConfig({
         pkg: pkg,               // pass the "package.json" object to initConfig() as a property, too
@@ -380,11 +380,11 @@ module.exports = function(grunt) {
                  * If/when that issue is fixed, this feature may be removed.
                  */
                 TEMPcompilerOpts: {
-                    // create_source_map: "./tmp/c1pjs/"  + pkg.version + "/c1p.map",
+                    create_source_map: "./versions/c1pjs/"  + pkg.version + "/c1p.map",
                     define: ["\"APPVERSION='" + pkg.version + "'\"", "DEBUGGER=false",
                              "\"SITEHOST='www.pcjs.org'\"", "COMPILED=true", "DEBUG=false"],
-                    // output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/tmp/c1pjs/" + pkg.version + "/c1p.map\""
-                    output_wrapper: "\"(function(){%output%})();\""
+                    output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/versions/c1pjs/" + pkg.version + "/c1p.map\""
+                 // output_wrapper: "\"(function(){%output%})();\""
                 },
                 // src: pkg.c1pJSFiles,
                 src: tmpC1Pjs,
@@ -392,11 +392,11 @@ module.exports = function(grunt) {
             },
             "c1p-dbg.js": {
                 TEMPcompilerOpts: {
-                    // create_source_map: "./tmp/c1pjs/"  + pkg.version + "/c1p-dbg.map",
+                    create_source_map: "./versions/c1pjs/"  + pkg.version + "/c1p-dbg.map",
                     define: ["\"APPVERSION='" + pkg.version + "'\"",
                              "\"SITEHOST='www.pcjs.org'\"", "COMPILED=true", "DEBUG=false"],
-                    // output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/tmp/c1pjs/" + pkg.version + "/c1p-dbg.map\""
-                    output_wrapper: "\"(function(){%output%})();\""
+                    output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/versions/c1pjs/" + pkg.version + "/c1p-dbg.map\""
+                 // output_wrapper: "\"(function(){%output%})();\""
                 },
                 // src: pkg.c1pJSFiles,
                 src: tmpC1Pjs,
@@ -404,11 +404,11 @@ module.exports = function(grunt) {
             },
             "pcx86.js": {
                 TEMPcompilerOpts: {
-                    // create_source_map: "./tmp/pcx86/"  + pkg.version + "/pcx86.map",
+                    create_source_map: "./versions/pcx86/"  + pkg.version + "/pcx86.map",
                     define: ["\"APPVERSION='" + pkg.version + "'\"", "DEBUGGER=false",
                              "\"SITEHOST='www.pcjs.org'\"", "COMPILED=true", "DEBUG=false", "BACKTRACK=false", "I386=true"],
-                    // output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/tmp/pcx86/" + pkg.version + "/pcx86.map\""
-                    output_wrapper: "\"(function(){%output%})();\""
+                    output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/versions/pcx86/" + pkg.version + "/pcx86.map\""
+                 // output_wrapper: "\"(function(){%output%})();\""
                 },
                 // src: pkg.pcX86Files,
                 src: tmpPCx86,
@@ -419,11 +419,11 @@ module.exports = function(grunt) {
                  * Technically, this is the one case we don't need to override the default 'define' settings, but maybe it's best to be explicit.
                  */
                 TEMPcompilerOpts: {
-                    // create_source_map: "./tmp/pcx86/"  + pkg.version + "/pcx86-dbg.map",
+                    create_source_map: "./versions/pcx86/"  + pkg.version + "/pcx86-dbg.map",
                     define: ["\"APPVERSION='" + pkg.version + "'\"",
                              "\"SITEHOST='www.pcjs.org'\"", "COMPILED=true", "DEBUG=false", "BACKTRACK=false", "I386=true"],
-                    // output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/tmp/pcx86/" + pkg.version + "/pcx86-dbg.map\""
-                    output_wrapper: "\"(function(){%output%})();\""
+                    output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/versions/pcx86/" + pkg.version + "/pcx86-dbg.map\""
+                 // output_wrapper: "\"(function(){%output%})();\""
                 },
                 // src: pkg.pcX86Files,
                 src: tmpPCx86,
@@ -431,11 +431,11 @@ module.exports = function(grunt) {
             },
             "pc8080.js": {
                 TEMPcompilerOpts: {
-                    // create_source_map: "./tmp/pc8080/"  + pkg.version + "/pc8080.map",
+                    create_source_map: "./versions/pc8080/"  + pkg.version + "/pc8080.map",
                     define: ["\"APPVERSION='" + pkg.version + "'\"",
                              "\"SITEHOST='www.pcjs.org'\"", "COMPILED=true", "DEBUG=false", "DEBUGGER=false"],
-                    // output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/tmp/pc8080/" + pkg.version + "/pc8080.map\""
-                    output_wrapper: "\"(function(){%output%})();\""
+                    output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/versions/pc8080/" + pkg.version + "/pc8080.map\""
+                 // output_wrapper: "\"(function(){%output%})();\""
                 },
                 // src: pkg.pc8080Files,
                 src: tmpPC8080,
@@ -446,11 +446,11 @@ module.exports = function(grunt) {
                  * Technically, this is the one case we don't need to override the default 'define' settings, but maybe it's best to be explicit.
                  */
                 TEMPcompilerOpts: {
-                    // create_source_map: "./tmp/pc8080/"  + pkg.version + "/pc8080-dbg.map",
+                    create_source_map: "./versions/pc8080/"  + pkg.version + "/pc8080-dbg.map",
                     define: ["\"APPVERSION='" + pkg.version + "'\"",
                              "\"SITEHOST='www.pcjs.org'\"", "COMPILED=true", "DEBUG=false", "DEBUGGER=true"],
-                    // output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/tmp/pc8080/" + pkg.version + "/pc8080-dbg.map\""
-                    output_wrapper: "\"(function(){%output%})();\""
+                    output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/versions/pc8080/" + pkg.version + "/pc8080-dbg.map\""
+                 // output_wrapper: "\"(function(){%output%})();\""
                 },
                 // src: pkg.pc8080Files,
                 src: tmpPC8080,
@@ -458,11 +458,11 @@ module.exports = function(grunt) {
             },
             "pdp10.js": {
                 TEMPcompilerOpts: {
-                    create_source_map: "./tmp/pdpjs/"  + pkg.version + "/pdp10.map",
+                    create_source_map: "./versions/pdpjs/"  + pkg.version + "/pdp10.map",
                     define: ["\"APPVERSION='" + pkg.version + "'\"",
                         "\"SITEHOST='www.pcjs.org'\"", "COMPILED=true", "DEBUG=false", "DEBUGGER=false"],
-                    output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/tmp/pdpjs/" + pkg.version + "/pdp10.map\""
-                    // output_wrapper: "\"(function(){%output%})();\""
+                    output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/versions/pdpjs/" + pkg.version + "/pdp10.map\""
+                 // output_wrapper: "\"(function(){%output%})();\""
                 },
                 // src: pkg.pdp10Files,
                 src: tmpPDP10,
@@ -473,11 +473,11 @@ module.exports = function(grunt) {
                  * Technically, this is the one case we don't need to override the default 'define' settings, but maybe it's best to be explicit.
                  */
                 TEMPcompilerOpts: {
-                    create_source_map: "./tmp/pdpjs/"  + pkg.version + "/pdp10-dbg.map",
+                    create_source_map: "./versions/pdpjs/"  + pkg.version + "/pdp10-dbg.map",
                     define: ["\"APPVERSION='" + pkg.version + "'\"",
                         "\"SITEHOST='www.pcjs.org'\"", "COMPILED=true", "DEBUG=false", "DEBUGGER=true"],
-                    output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/tmp/pdpjs/" + pkg.version + "/pdp10-dbg.map\""
-                    // output_wrapper: "\"(function(){%output%})();\""
+                    output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/versions/pdpjs/" + pkg.version + "/pdp10-dbg.map\""
+                 // output_wrapper: "\"(function(){%output%})();\""
                 },
                 // src: pkg.pdp10Files,
                 src: tmpPDP10,
@@ -485,11 +485,11 @@ module.exports = function(grunt) {
             },
             "pdp11.js": {
                 TEMPcompilerOpts: {
-                    create_source_map: "./tmp/pdpjs/"  + pkg.version + "/pdp11.map",
+                    create_source_map: "./versions/pdpjs/"  + pkg.version + "/pdp11.map",
                     define: ["\"APPVERSION='" + pkg.version + "'\"",
                              "\"SITEHOST='www.pcjs.org'\"", "COMPILED=true", "DEBUG=false", "DEBUGGER=false"],
-                    output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/tmp/pdpjs/" + pkg.version + "/pdp11.map\""
-                    // output_wrapper: "\"(function(){%output%})();\""
+                    output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/versions/pdpjs/" + pkg.version + "/pdp11.map\""
+                 // output_wrapper: "\"(function(){%output%})();\""
                 },
                 // src: pkg.pdp11Files,
                 src: tmpPDP11,
@@ -500,11 +500,11 @@ module.exports = function(grunt) {
                  * Technically, this is the one case we don't need to override the default 'define' settings, but maybe it's best to be explicit.
                  */
                 TEMPcompilerOpts: {
-                    create_source_map: "./tmp/pdpjs/"  + pkg.version + "/pdp11-dbg.map",
+                    create_source_map: "./versions/pdpjs/"  + pkg.version + "/pdp11-dbg.map",
                     define: ["\"APPVERSION='" + pkg.version + "'\"",
                              "\"SITEHOST='www.pcjs.org'\"", "COMPILED=true", "DEBUG=false", "DEBUGGER=true"],
-                    output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/tmp/pdpjs/" + pkg.version + "/pdp11-dbg.map\""
-                    // output_wrapper: "\"(function(){%output%})();\""
+                    output_wrapper: "\"(function(){%output%})();//# sourceMappingURL=/versions/pdpjs/" + pkg.version + "/pdp11-dbg.map\""
+                 // output_wrapper: "\"(function(){%output%})();\""
                 },
                 // src: pkg.pdp11Files,
                 src: tmpPDP11,
@@ -713,16 +713,16 @@ module.exports = function(grunt) {
         replace: {
             "fix-source-maps": {
                 src: [
-                    "./tmp/c1pjs/" + pkg.version + "/c1p*.map",
-                    "./tmp/pcx86/" + pkg.version + "/pc*.map",
-                    "./tmp/pcx8008/" + pkg.version + "/pc*.map",
-                    "./tmp/pdpjs/" + pkg.version + "/pdp*.map"
+                    "./versions/c1pjs/" + pkg.version + "/c1p*.map",
+                    "./versions/pcx86/" + pkg.version + "/pc*.map",
+                    "./versions/pcx8008/" + pkg.version + "/pc*.map",
+                    "./versions/pdpjs/" + pkg.version + "/pdp*.map"
                 ],
                 overwrite: true,
                 replacements: [
                     {
-                        from: /"sources":\s*\["\.\/tmp\//g,
-                        to: '"sources":["/tmp/'
+                        from: /"sources":\s*\["\.\/versions\//g,
+                        to: '"sources":["/versions/'
                     }
                 ]
             },
diff --git a/_posts/2017-06-15-adventures-in-archiving.md b/_posts/2017-06-15-adventures-in-archiving.md
index e4ed7011f..417108fba 100644
--- a/_posts/2017-06-15-adventures-in-archiving.md
+++ b/_posts/2017-06-15-adventures-in-archiving.md
@@ -12,7 +12,7 @@ machines:
         path: /disks/pcx86/dos/ibm/1.00/PCDOS100.json
       B:
         path: /apps/pcx86/1983/adventmath/ADVENTMATH100.json
-    autoType: 8-10-81\\rb:\\ra:basica castle\\r
+    autoType: 8-10-81\rb:\ra:basica castle\r
 ---
 
 In October 1983, IBM released a game called "Adventures in Math", which apparently tried to make mathematics as
diff --git a/apps/pcx86/1981/visicalc/README.md b/apps/pcx86/1981/visicalc/README.md
index a3eb5e631..c796eba48 100644
--- a/apps/pcx86/1981/visicalc/README.md
+++ b/apps/pcx86/1981/visicalc/README.md
@@ -12,7 +12,7 @@ machines:
         path: /disks/pcx86/dos/ibm/1.00/PCDOS100.json
       B:
         path: /apps/pcx86/1981/visicalc/VISICALC1981.json
-    autoType: 8-10-81\\rb:\\rvc\\r
+    autoType: 8-10-81\rb:\rvc\r
 ---
 
 VisiCalc (1981)
diff --git a/apps/pcx86/1982/ratbas/README.md b/apps/pcx86/1982/ratbas/README.md
index 0c273470f..3cf388908 100644
--- a/apps/pcx86/1982/ratbas/README.md
+++ b/apps/pcx86/1982/ratbas/README.md
@@ -4,14 +4,14 @@ title: "RatBas (1982)"
 permalink: /apps/pcx86/1982/ratbas/
 machines:
   - type: pcx86
-    id: ibm5150
+    id: ibm5150-ratbas
     config: /devices/pcx86/machine/5150/cga/256kb/machine.xml
     autoMount:
       A:
         path: /disks/pcx86/dos/ibm/1.10/PCDOS110.json
       B:
         path: /apps/pcx86/1982/ratbas/RATBAS213.json
-    autoType: \\r\\rb:\\rrt\\r\\xff\\xf0test;\\r
+    autoType: \r\rb:\rrt\r\xff\xf0test;\r
 ---
 
 RatBas (1982)
@@ -30,7 +30,7 @@ We have archived it as [RatBas 2.13](#directory-listing-of-ratbas-213).  It has
 the machine below, which is running [PC-DOS 1.10](/disks/pcx86/dos/ibm/1.10/), the most recent version of PC-DOS
 at the time of this RatBas release.
 
-{% include machine.html id="ibm5150" %}
+{% include machine.html id="ibm5150-ratbas" %}
 
 Directory Listing of RatBas 2.13
 --------------------------------
diff --git a/apps/pcx86/1983/adventmath/README.md b/apps/pcx86/1983/adventmath/README.md
index 729fa5958..d38de2ac6 100644
--- a/apps/pcx86/1983/adventmath/README.md
+++ b/apps/pcx86/1983/adventmath/README.md
@@ -11,7 +11,7 @@ machines:
         path: /disks/pcx86/dos/ibm/1.00/PCDOS100.json
       B:
         path: /apps/pcx86/1983/adventmath/ADVENTMATH100.json
-    autoType: 8-10-81\\rb:\\ra:basica castle\\r
+    autoType: 8-10-81\rb:\ra:basica castle\r
 ---
 
 Adventures in Math (1983)
@@ -186,7 +186,7 @@ have been tested with PC-DOS 2.00 on a 64Kb machine, but perhaps it wasn't.
 
 The machine on this page is configured with the following "autoType" sequence:
  
-	autoType: 8-10-81\\rb:\\ra:basica castle\\r
+	autoType: 8-10-81\rb:\ra:basica castle\r
 
 which translates to:
 
diff --git a/devices/pcx86/machine/5150/cga/256kb/machine.xml b/devices/pcx86/machine/5150/cga/256kb/machine.xml
index 1bf512b0a..ec9675195 100644
--- a/devices/pcx86/machine/5150/cga/256kb/machine.xml
+++ b/devices/pcx86/machine/5150/cga/256kb/machine.xml
@@ -2,13 +2,17 @@
 <?xml-stylesheet type="text/xsl" href="/versions/pcx86/1.35.0/machine.xsl"?>
 <machine id="ibm5150" type="pcx86" border="1" pos="center" background="white">
 	<name pos="center">IBM PC (Model 5150), CGA, 256K</name>
-	<computer id="pc-cga-256k" name="IBM PC" resume="1"/>
-	<cpu id="cpu8088" model="8088"/>
+	<computer id="pc-cga-256k" name="IBM PC"/>
 	<ram id="ramLow" addr="0x00000" test="false" comment="no memory test"/>
 	<rom id="romBASIC" addr="0xf6000" size="0x8000" file="/devices/pcx86/rom/5150/basic/BASIC100.json"/>
 	<rom id="romBIOS" addr="0xfe000" size="0x2000" file="/devices/pcx86/rom/5150/1981-04-24/PCBIOS-REV1.json"/>
 	<video ref="/devices/pcx86/video/ibm/cga/ibm-cga.xml"/>
 	<fdc ref="/disks/pcx86/compiled/library.xml"/>
+	<cpu id="cpu8088" model="8088" autostart="true" pos="left" padLeft="8px" padBottom="8px">
+		<control type="button" binding="run">Run</control>
+		<control type="button" binding="reset">Reset</control>
+		<control type="button" binding="setSpeed">Speed</control>
+	</cpu>
 	<keyboard ref="/devices/pcx86/keyboard/us83-buttons-minimal.xml"/>
 	<chipset id="chipset" model="5150" sw1="01001001" sw2="10011000"/>
 </machine>
diff --git a/disks/pcx86/apps/ibm/topview/1.01/README.md b/disks/pcx86/apps/ibm/topview/1.01/README.md
index e5a867576..8af383845 100644
--- a/disks/pcx86/apps/ibm/topview/1.01/README.md
+++ b/disks/pcx86/apps/ibm/topview/1.01/README.md
@@ -11,10 +11,20 @@ machines:
         path: /disks/pcx86/dos/ibm/2.00/PCDOS200-DISK1.json
       B:
         path: /disks/pcx86/apps/ibm/topview/1.01/TOPVIEW101-PROGRAM.json
+    autoType: \r\rb:\rtv\r
 ---
 
 TopView 1.01
----
+------------
+
+NOTE: Even though we've made every effort to mark all PCjs pages as English, Google's Chrome web browser (v59)
+mistakenly thinks this page is in French and will attempt to translate it to English.  That translation process
+interferes with elements of the machine; for example, it may change the name of the first diskette drive from
+"A:" to "AT:".
+
+So, if you notice any rendering problems, check the top of your web browser, and if you see the message *This page
+has been translated from French to English*, click **Show Original**.  Ironically, the addition of these two
+paragraphs of English text will likely eliminate the problem.
 
 {% include machine.html id="ibm5160" %}
 
diff --git a/docs/pcx86/examples/pcx86-dbg.js b/docs/pcx86/examples/pcx86-dbg.js
index 65ab7e752..124e8b65d 100644
--- a/docs/pcx86/examples/pcx86-dbg.js
+++ b/docs/pcx86/examples/pcx86-dbg.js
@@ -893,4 +893,4 @@ window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==ty
 function uC(a,b,c,d){if(!c&&b){d.push(b);a=pb[d[0]];b=null;for(var e in a)if(wa(e,"components.xsl")){b=e.replace(".xsl",".css");break}b?Ka(b,null,!0,function(a,b){vC(b,d)}):vC(null,d)}else gb("Error ("+c+") requesting "+a)}
 function vC(a,b){var c,d,e,f=b[0],g=b[1];c=b[4];c=c.match(/^(\s*\(function\(\)\{)([\s\S]*)(}\)\(\);\s*)$/);var h=pb[f],k={},m;for(m in h){var p=h[m],v=va(m);if("xml"==v){for(v=/[ \t]*<disk [^>]*path=(['"])(.*?)\1.*?<\/disk>\n?/g;d=v.exec(h[m]);){var u=d[2];u&&(h[u]||(p=p.replace(d[0],"")))}d=m=ta(m)}else"xsl"==v&&(e=m=ta(m));k[m]=p}a&&(k[m="css"]=a);b[2]&&(k[m="parms"]=b[2]);b[3]&&(k[m="state"]=b[3]);d&&e?(a=JSON.stringify(k),g+=".js",c=c[1]+"var resources="+a+";"+c[2]+c[3],c=c.replace(/\u00A9/g,
 "&#xA9;"),a=Wa(c,"javascript",!1,g),a=a+(', copy it to your web server as "'+g+'", and then add the following to your web page:\n\n')+('<div id="'+f+'"></div>\n')+"...\n",a=a+('<script type="text/javascript" src="'+g+'">\x3c/script>\n')+('<script type="text/javascript">embedPC("'+f+'","'+d+'","'+e+'");\x3c/script>\n\n')+"The machine should appear where the <div> is located.",gb(a)):gb("Missing XML/XSL resources")}
-window.savePC=function(a,b,c){var d=ub("Computer",a),e=ub("Debugger",a);if(d){var f=lB(d,!0),g=d.J?JSON.stringify(d.J):null;b||(b="/versions/pcx86/1.35.0/pcx86"+(e?"-dbg":"")+".js");if(c&&c({state:f,Pk:g}))return!0;Ka(b,null,!0,function(c,d,e){uC(c,d,e,[a,ta(b,!0),g,f])});return!0}gb("Unable to identify machine '"+a+"'");return!1};})();
+window.savePC=function(a,b,c){var d=ub("Computer",a),e=ub("Debugger",a);if(d){var f=lB(d,!0),g=d.J?JSON.stringify(d.J):null;b||(b="/versions/pcx86/1.35.0/pcx86"+(e?"-dbg":"")+".js");if(c&&c({state:f,Pk:g}))return!0;Ka(b,null,!0,function(c,d,e){uC(c,d,e,[a,ta(b,!0),g,f])});return!0}gb("Unable to identify machine '"+a+"'");return!1};})();//# sourceMappingURL=/versions/pcx86/1.35.0/pcx86-dbg.map
diff --git a/docs/pcx86/examples/pcx86.js b/docs/pcx86/examples/pcx86.js
index 30404c49a..52bdf0708 100644
--- a/docs/pcx86/examples/pcx86.js
+++ b/docs/pcx86/examples/pcx86.js
@@ -696,4 +696,4 @@ window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==ty
 function pv(a,b,c,d){if(!c&&b){d.push(b);a=Wa[d[0]];b=null;for(var e in a)if(ra(e,"components.xsl")){b=e.replace(".xsl",".css");break}b?Ba(b,null,!0,function(a,b){qv(b,d)}):qv(null,d)}else r("Error ("+c+") requesting "+a)}
 function qv(a,b){var c,d,e,f=b[0],g=b[1];c=b[4];c=c.match(/^(\s*\(function\(\)\{)([\s\S]*)(}\)\(\);\s*)$/);var h=Wa[f],l={},m;for(m in h){var q=h[m],y=qa(m);if("xml"==y){for(y=/[ \t]*<disk [^>]*path=(['"])(.*?)\1.*?<\/disk>\n?/g;d=y.exec(h[m]);){var w=d[2];w&&(h[w]||(q=q.replace(d[0],"")))}d=m=pa(m)}else"xsl"==y&&(e=m=pa(m));l[m]=q}a&&(l[m="css"]=a);b[2]&&(l[m="parms"]=b[2]);b[3]&&(l[m="state"]=b[3]);d&&e?(a=JSON.stringify(l),g+=".js",c=c[1]+"var resources="+a+";"+c[2]+c[3],c=c.replace(/\u00A9/g,
 "&#xA9;"),a=Ka(c,"javascript",!1,g),a=a+(', copy it to your web server as "'+g+'", and then add the following to your web page:\n\n')+('<div id="'+f+'"></div>\n')+"...\n",a=a+('<script type="text/javascript" src="'+g+'">\x3c/script>\n')+('<script type="text/javascript">embedPC("'+f+'","'+d+'","'+e+'");\x3c/script>\n\n')+"The machine should appear where the <div> is located.",r(a)):r("Missing XML/XSL resources")}
-window.savePC=function(a,b,c){var d=ab("Computer",a),e=ab("Debugger",a);if(d){var f=bv(d,!0),g=d.I?JSON.stringify(d.I):null;b||(b="/versions/pcx86/1.35.0/pcx86"+(e?"-dbg":"")+".js");if(c&&c({state:f,Ij:g}))return!0;Ba(b,null,!0,function(c,d,e){pv(c,d,e,[a,pa(b,!0),g,f])});return!0}r("Unable to identify machine '"+a+"'");return!1};})();
+window.savePC=function(a,b,c){var d=ab("Computer",a),e=ab("Debugger",a);if(d){var f=bv(d,!0),g=d.I?JSON.stringify(d.I):null;b||(b="/versions/pcx86/1.35.0/pcx86"+(e?"-dbg":"")+".js");if(c&&c({state:f,Ij:g}))return!0;Ba(b,null,!0,function(c,d,e){pv(c,d,e,[a,pa(b,!0),g,f])});return!0}r("Unable to identify machine '"+a+"'");return!1};})();//# sourceMappingURL=/versions/pcx86/1.35.0/pcx86.map
diff --git a/modules/markout/lib/markout.js b/modules/markout/lib/markout.js
index 4a0d627db..613a7676c 100644
--- a/modules/markout/lib/markout.js
+++ b/modules/markout/lib/markout.js
@@ -455,12 +455,7 @@ MarkOut.prototype.convertMD = function(sIndent)
                         if (sName == 'automount') sName = 'autoMount';  // for backward compatibility
                         if (sName == 'autotype') {
                             sName = 'autoType';
-                            /*
-                             * To maintain parity with Jekyll, autoType sequences must continue to use double backslashes,
-                             * so my attempt to automatically "double" any backslashes in autoType sequences was for naught.
-                             *
-                             *      sValue = sValue.replace(/\\/g, "&#92;");
-                             */
+                            sValue = sValue.replace(/\\/g, "&#92;");    // automatically "double" any backslashes
                         }
                         if (!id && sName == 'id') {
                             id = sValue;
diff --git a/versions/c1pjs/1.35.0/c1p-dbg.js b/versions/c1pjs/1.35.0/c1p-dbg.js
index f816929af..d71aaacbb 100644
--- a/versions/c1pjs/1.35.0/c1p-dbg.js
+++ b/versions/c1pjs/1.35.0/c1p-dbg.js
@@ -192,4 +192,4 @@ a=a.replace(d[0],h);Sb(a,b,c)}})}else c(a,null)}
 function Tb(a,b,c){function d(a){if(void 0===h){var b=g&&G(g,"machine-warning");h=b&&b[0]||g}h&&(h.innerHTML=ja(a))}function e(a){d("Error: "+a);l&&(--Ob||B(!0));l=!1}var g,h,l=!0;Ob++;L[a]={};try{if(g=document.getElementById(a)){var k;if("object"==typeof resources&&(k=resources.css)){var m=document.head||document.getElementsByTagName("head")[0],n=document.createElement("style");n.type="text/css";n.styleSheet?n.styleSheet.cssText=k:n.appendChild(document.createTextNode(k));m.appendChild(n)}c||(c=
 "/versions/c1pjs/1.35.0/components.xsl");k=function(h,k){k?Pb(c,null,null,!1,d,function(h,l){l?(L[a]&&c&&(L[a][c]=h),d("Processing "+b+"..."),window.ActiveXObject||"ActiveXObject"in window?(l=k.transformNode(l))?(g.outerHTML=l,--Ob||B(!0)):e("transformNodeToObject failed"):document.implementation&&document.implementation.createDocument?(h=new XSLTProcessor,h.importStylesheet(l),(l=h.transformToFragment(k,document))?g.parentNode?(g.parentNode.replaceChild(l,g),--Ob||B(!0)):e("invalid machine element: "+
 a):e("transformToFragment failed")):e("unable to transform XML: unsupported browser")):e(h)}):e(h)};"<"!=b.charAt(0)?Pb(b,a,void 0,!0,d,k):Rb(b,null,a,void 0,!1,d,k)}else e("missing machine element: "+a)}catch(r){e(r.message)}return l}window.embedC1P=function(a,b,c){B(!1);return Tb(a,b,c)};window.findMachineComponent=function(a,b){return wa(b,a+".machine")};
-window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==typeof b&&!ya[a]){for(var c=!0,d=ya,e=a,g=b.length,h=[],l=[],k="",m=null,n=0;n<g;n++){var r=b[n];if('"'==r||"'"==r)m&&r!=m?k+=r:(m?m=null:m=r,k&&(l.push(k),k=""));else{if(!m){if("\r"==r||"\n"==r)r=";";if(" "==r||"\t"==r||";"==r){k&&(l.push(k),k="");";"==r&&l.length&&(h.push(l),l=[]);continue}}k+=r}}k&&l.push(k);l.length&&h.push(l);d[e]=h;xa(a)||(c=!1)}return c};window.enableEvents=B;window.sendEvent=sa;})();
+window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==typeof b&&!ya[a]){for(var c=!0,d=ya,e=a,g=b.length,h=[],l=[],k="",m=null,n=0;n<g;n++){var r=b[n];if('"'==r||"'"==r)m&&r!=m?k+=r:(m?m=null:m=r,k&&(l.push(k),k=""));else{if(!m){if("\r"==r||"\n"==r)r=";";if(" "==r||"\t"==r||";"==r){k&&(l.push(k),k="");";"==r&&l.length&&(h.push(l),l=[]);continue}}k+=r}}k&&l.push(k);l.length&&h.push(l);d[e]=h;xa(a)||(c=!1)}return c};window.enableEvents=B;window.sendEvent=sa;})();//# sourceMappingURL=/versions/c1pjs/1.35.0/c1p-dbg.map
diff --git a/versions/c1pjs/1.35.0/c1p-uncompiled.js b/versions/c1pjs/1.35.0/c1p-uncompiled.js
new file mode 100644
index 000000000..64abce0c5
--- /dev/null
+++ b/versions/c1pjs/1.35.0/c1p-uncompiled.js
@@ -0,0 +1,14262 @@
+"use strict";
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/defines.js (C) Jeff Parsons 2012-2017
+ */
+
+/**
+ * @define {string}
+ */
+var APPVERSION = "1.x.x";       // this @define is overridden by the Closure Compiler with the version in package.json
+
+var XMLVERSION = null;          // this is set in non-COMPILED builds by embedMachine() if a version number was found in the machine XML
+
+var COPYRIGHT = "Copyright © 2012-2017 Jeff Parsons <Jeff@pcjs.org>";
+
+var LICENSE = "License: GPL version 3 or later <http://gnu.org/licenses/gpl.html>";
+
+var CSSCLASS = "pcjs";
+
+/**
+ * @define {string}
+ */
+var SITEHOST = "localhost:8088";// this @define is overridden by the Closure Compiler with "www.pcjs.org"
+
+/**
+ * @define {boolean}
+ */
+var COMPILED = false;           // this @define is overridden by the Closure Compiler (to true)
+
+/**
+ * @define {boolean}
+ */
+var DEBUG = true;               // this @define is overridden by the Closure Compiler (to false) to remove DEBUG-only code
+
+/**
+ * @define {boolean}
+ */
+var MAXDEBUG = false;           // this @define is overridden by the Closure Compiler (to false) to remove MAXDEBUG-only code
+
+/**
+ * @define {boolean}
+ */
+var PRIVATE = false;            // this @define is overridden by the Closure Compiler (to false) to enable PRIVATE code
+
+/*
+ * RS-232 DB-25 Pin Definitions, mapped to bits 1-25 in a 32-bit status value.
+ *
+ * SerialPorts in PCjs machines are considered DTE (Data Terminal Equipment), which means they should be "virtually"
+ * connected to each other via a null-modem cable, which assumes the following cross-wiring:
+ *
+ *     G       1  <->  1        G       (Ground)
+ *     TD      2  <->  3        RD      (Received Data)
+ *     RD      3  <->  2        TD      (Transmitted Data)
+ *     RTS     4  <->  5        CTS     (Clear To Send)
+ *     CTS     5  <->  4        RTS     (Request To Send)
+ *     DSR   6+8  <->  20       DTR     (Data Terminal Ready)
+ *     SG      7  <->  7        SG      (Signal Ground)
+ *     DTR    20  <->  6+8      DSR     (Data Set Ready + Carrier Detect)
+ *     RI     22  <->  22       RI      (Ring Indicator)
+ *
+ * TODO: Move these definitions to a more appropriate shared file at some point.
+ */
+var RS232 = {
+    RTS: {
+        PIN:  4,
+        MASK: 0x00000010
+    },
+    CTS: {
+        PIN:  5,
+        MASK: 0x00000020
+    },
+    DSR: {
+        PIN:  6,
+        MASK: 0x00000040
+    },
+    CD: {
+        PIN:  8,
+        MASK: 0x00000100
+    },
+    DTR: {
+        PIN:  20,
+        MASK: 0x00100000
+    },
+    RI: {
+        PIN:  22,
+        MASK: 0x00400000
+    }
+};
+
+/*
+ * NODE should be true if we're running under NodeJS (eg, command-line), false if not (eg, web browser)
+ */
+var NODE = false;
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/dumpapi.js (C) Jeff Parsons 2012-2017
+ */
+
+/*
+ * Our "DiskDump API", such as it was, used to look like:
+ *
+ *      http://jsmachines.net/bin/convdisk.php?disk=/disks/pc/dos/ibm/2.00/PCDOS200-DISK1.json&format=img
+ *
+ * To make it (a bit) more "REST-like", the above request now looks like:
+ *
+ *      http://www.pcjs.org/api/v1/dump?disk=/disks/pc/dos/ibm/2.00/PCDOS200-DISK1.json&format=img
+ *
+ * Similarly, our "FileDump API" used to look like:
+ *
+ *      http://jsmachines.net/bin/convrom.php?rom=/devices/pc/rom/5150/1981-04-24/PCBIOS-REV1.rom&format=json
+ *
+ * and that request now looks like:
+ *
+ *      http://www.pcjs.org/api/v1/dump?file=/devices/pc/rom/5150/1981-04-24/PCBIOS-REV1.rom&format=json
+ *
+ * I don't think it makes sense to avoid "query" parameters, because blending the path of a disk image with the
+ * the rest of the URL would be (a) confusing, and (b) more work to parse.
+ */
+var DumpAPI = {
+    ENDPOINT:       "/api/v1/dump",
+    QUERY: {
+        DIR:        "dir",      // value is path of a directory (DiskDump only)
+        DISK:       "disk",     // value is path of a disk image (DiskDump only)
+        FILE:       "file",     // value is path of a ROM image file (FileDump only)
+        IMG:        "img",      // alias for DISK
+        PATH:       "path",     // value is path of a one or more files (DiskDump only)
+        FORMAT:     "format",   // value is one of FORMAT values below
+        COMMENTS:   "comments", // value is either "true" or "false"
+        DECIMAL:    "decimal",  // value is either "true" to force all numbers to decimal, "false" or undefined otherwise
+        MBHD:       "mbhd",     // value is hard drive size in Mb (formerly "mbsize") (DiskDump only) (DEPRECATED)
+        SIZE:       "size"      // value is target disk size in Kb (supersedes "mbhd") (DiskDump only)
+    },
+    FORMAT: {
+        JSON:       "json",     // default
+        JSON_GZ:    "gz",       // gzip is currently used ONLY for compressed JSON
+        DATA:       "data",     // same as "json", but built without JSON.stringify() (DiskDump only)
+        HEX:        "hex",      // deprecated
+        OCTAL:      "octal",    // displays data as octal words
+        BYTES:      "bytes",    // displays data as hex bytes; normally used only when comments are enabled
+        WORDS:      "words",    // displays data as hex words; normally used only when comments are enabled
+        LONGS:      "longs",    // displays data as dwords
+        IMG:        "img",      // returns the raw disk data (ie, using a Buffer object) (DiskDump only)
+        ROM:        "rom"       // returns the raw file data (ie, using a Buffer object) (FileDump only)
+    }
+};
+
+/*
+ * Because we use an overloaded API endpoint (ie, one that's shared with the FileDump module), we must
+ * also provide a list of commands which, when combined with the endpoint, define a unique request.
+ */
+DumpAPI.asDiskCommands = [DumpAPI.QUERY.DIR, DumpAPI.QUERY.DISK, DumpAPI.QUERY.PATH];
+DumpAPI.asFileCommands = [DumpAPI.QUERY.FILE];
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/reportapi.js (C) Jeff Parsons 2012-2017
+ */
+
+var ReportAPI = {
+    ENDPOINT:       "/api/v1/report",
+    QUERY: {
+        APP:        "app",
+        VER:        "ver",
+        URL:        "url",
+        USER:       "user",
+        TYPE:       "type",
+        DATA:       "data"
+    },
+    TYPE: {
+        BUG:        "bug"
+    },
+    RES: {
+        OK:         "Thank you"
+    }
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/strlib.js (C) Jeff Parsons 2012-2017
+ */
+
+class Str {
+    /**
+     * isValidInt(s, base)
+     *
+     * The built-in parseInt() function has the annoying feature of returning a partial value (ie,
+     * up to the point where it encounters an invalid character); eg, parseInt("foo", 16) returns 0xf.
+     *
+     * So it's best to use our own Str.parseInt() function, which will in turn use this function to
+     * validate the entire string.
+     *
+     * @param {string} s is the string representation of some number
+     * @param {number} [base] is the radix to use (default is 10); only 2, 8, 10 and 16 are supported
+     * @return {boolean} true if valid, false if invalid (or the specified base isn't supported)
+     */
+    static isValidInt(s, base)
+    {
+        if (!base || base == 10) return s.match(/^-?[0-9]+$/) !== null;
+        if (base == 16) return s.match(/^-?[0-9a-f]+$/i) !== null;
+        if (base == 8) return s.match(/^-?[0-7]+$/) !== null;
+        if (base == 2) return s.match(/^-?[01]+$/) !== null;
+        return false;
+    }
+
+    /**
+     * parseInt(s, base)
+     *
+     * This is a wrapper around the built-in parseInt() function.  Our wrapper recognizes certain prefixes
+     * ('$' or "0x" for hex, '#' or "0o" for octal) and suffixes ('.' for decimal, 'h' for hex, 'y' for
+     * binary), and then calls isValidInt() to ensure we don't convert strings that contain partial values;
+     * see isValidInt() for details.
+     *
+     * The use of multiple prefix/suffix combinations is undefined (although for the record, we process
+     * prefixes first).  We do NOT support the "0b" prefix to indicate binary UNLESS one or more commas are
+     * also present (because "0b" is also a valid hex sequence), and we do NOT support a single leading zero
+     * to indicate octal (because such a number could also be decimal or hex).  Any number of commas are
+     * allowed; we remove them all before calling the built-in parseInt().
+     *
+     * More recently, we've added support for "^D", "^O", and "^B" prefixes to accommodate the base overrides
+     * that the PDP-10's MACRO-10 assembly language supports (decimal, octal, and binary, respectively).
+     * If this support turns out to adversely affect other debuggers, then it will have to be "conditionalized".
+     * Similarly, we've added support for "K", "M", and "G" MACRO-10-style suffixes that add 3, 6, or 9 zeros
+     * to the value to be parsed, respectively.
+     *
+     * @param {string} s is the string representation of some number
+     * @param {number} [base] is the radix to use (default is 10); can be overridden by prefixes/suffixes
+     * @return {number|undefined} corresponding value, or undefined if invalid
+     */
+    static parseInt(s, base)
+    {
+        var value;
+
+        if (s) {
+            if (!base) base = 10;
+
+            var ch, chPrefix, chSuffix;
+            var fCommas = (s.indexOf(',') > 0);
+            if (fCommas) s = s.replace(/,/g, '');
+
+            ch = chPrefix = s.charAt(0);
+            if (chPrefix == '#') {
+                base = 8;
+                chPrefix = '';
+            }
+            else if (chPrefix == '$') {
+                base = 16;
+                chPrefix = '';
+            }
+            if (ch != chPrefix) {
+                s = s.substr(1);
+            }
+            else {
+                ch = chPrefix = s.substr(0, 2);
+                if (chPrefix == '0b' && fCommas || chPrefix == '^B') {
+                    base = 2;
+                    chPrefix = '';
+                }
+                else if (chPrefix == '0o' || chPrefix == '^O') {
+                    base = 8;
+                    chPrefix = '';
+                }
+                else if (chPrefix == '^D') {
+                    base = 10;
+                    chPrefix = '';
+                }
+                else if (chPrefix == '0x') {
+                    base = 16;
+                    chPrefix = '';
+                }
+                if (ch != chPrefix) s = s.substr(2);
+            }
+            ch = chSuffix = s.slice(-1);
+            if (chSuffix == 'Y' || chSuffix == 'y') {
+                base = 2;
+                chSuffix = '';
+            }
+            else if (chSuffix == '.') {
+                base = 10;
+                chSuffix = '';
+            }
+            else if (chSuffix == 'H' || chSuffix == 'h') {
+                base = 16;
+                chSuffix = '';
+            }
+            else if (chSuffix == 'K') {
+                chSuffix = '000';
+            }
+            else if (chSuffix == 'M') {
+                chSuffix = '000000';
+            }
+            else if (chSuffix == 'G') {
+                chSuffix = '000000000';
+            }
+            if (ch != chSuffix) s = s.slice(0, -1) + chSuffix;
+            /*
+             * This adds support for the MACRO-10 binary shifting (Bn) suffix, which must be stripped from the
+             * number before parsing, and then applied to the value after parsing.  If n is omitted, 35 is assumed,
+             * which is a net shift of zero.  If n < 35, then a left shift of (35 - n) is required; if n > 35, then
+             * a right shift of -(35 - n) is required.
+             */
+            var v, shift = 0;
+            if (base <= 10) {
+                var match = s.match(/(-?[0-9]+)B([0-9]*)/);
+                if (match) {
+                    s = match[1];
+                    shift = 35 - ((match[2] || 35) & 0xff);
+                }
+            }
+            if (Str.isValidInt(s, base) && !isNaN(v = parseInt(s, base))) {
+                /*
+                 * With the need to support larger (eg, 36-bit) integers, truncating to 32 bits is no longer helpful.
+                 *
+                 *      value = v|0;
+                 */
+                if (shift) {
+                    /*
+                     * Since binary shifting is a logical operation, and since shifting by division only works properly
+                     * with positive numbers, we must convert a negative value to a positive value, by computing the two's
+                     * complement.
+                     */
+                    if (v < 0) v += Math.pow(2, 36);
+                    if (shift > 0) {
+                        v *= Math.pow(2, shift);
+                    } else {
+                        v = Math.trunc(v / Math.pow(2, -shift));
+                    }
+                }
+                value = v;
+            }
+        }
+        return value;
+    }
+
+    /**
+     * toBase(n, radix, cch, sPrefix, nGrouping)
+     *
+     * Displays the given number as an unsigned integer using the specified radix and number of digits.
+     *
+     * @param {number|null|undefined} n
+     * @param {number} radix (ie, the base)
+     * @param {number} cch (the desired number of digits)
+     * @param {string} [sPrefix] (default is none)
+     * @param {number} [nGrouping]
+     * @return {string}
+     */
+    static toBase(n, radix, cch, sPrefix = "", nGrouping = 0)
+    {
+        /*
+         * An initial "falsey" check for null takes care of both null and undefined;
+         * we can't rely entirely on isNaN(), because isNaN(null) returns false, oddly enough.
+         *
+         * Alternatively, we could mask and shift n regardless of whether it's null/undefined/NaN,
+         * since JavaScript coerces such operands to zero, but I think there's "value" in seeing those
+         * values displayed differently.
+         */
+        var s = "";
+        if (isNaN(n)) {
+            n = null;
+        } else if (n != null) {
+            /*
+             * Callers that produced an input by dividing by a power of two rather than shifting (in order
+             * to access more than 32 bits) may produce a fractional result, which ordinarily we would simply
+             * ignore, but if the integer portion is zero and the sign is negative, we should probably treat
+             * this value as a sign-extension.
+             */
+            if (n < 0 && n > -1) n = -1;
+            /*
+             * Negative values should be two's complemented according to the number of digits; for example,
+             * 12 octal digits implies an upper limit 8^12.
+             */
+            if (n < 0) {
+                n += Math.pow(radix, cch);
+            }
+            if (n >= Math.pow(radix, cch)) {
+                cch = Math.ceil(Math.log(n) / Math.log(radix));
+            }
+        }
+        var g = nGrouping || -1;
+        while (cch-- > 0) {
+            if (!g) {
+                s = ',' + s;
+                g = nGrouping;
+            }
+            if (n == null) {
+                s = '?' + s;
+            } else {
+                var d = n % radix;
+                d += (d >= 0 && d <= 9? 0x30 : 0x41 - 10);
+                s = String.fromCharCode(d) + s;
+                n = Math.trunc(n / radix);
+            }
+            g--;
+        }
+        return sPrefix + s;
+    }
+
+    /**
+     * toBin(n, cch, nGrouping)
+     *
+     * Converts an integer to binary, with the specified number of digits (up to a maximum of 36).
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of binary digits (0 or undefined for default of either 8, 18, or 36)
+     * @param {number} [nGrouping]
+     * @return {string} the binary representation of n
+     */
+    static toBin(n, cch, nGrouping)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.LN2) || 1;
+            var v = Math.abs(n);
+            if (v <= 0b11111111) {
+                cch = 8;
+            } else if (v <= 0b111111111111111111) {
+                cch = 18;
+            } else {
+                cch = 36;
+            }
+        } else if (cch > 36) cch = 36;
+        return Str.toBase(n, 2, cch, "", nGrouping);
+    }
+
+    /**
+     * toBinBytes(n, cb, fPrefix)
+     *
+     * Converts an integer to binary, with the specified number of bytes (up to the default of 4).
+     *
+     * @param {number|null|undefined} n (interpreted as a 32-bit value)
+     * @param {number} [cb] is the desired number of binary bytes (4 is both the default and the maximum)
+     * @param {boolean} [fPrefix]
+     * @return {string} the binary representation of n
+     */
+    static toBinBytes(n, cb, fPrefix)
+    {
+        var s = "";
+        if (!cb || cb > 4) cb = 4;
+        for (var i = 0; i < cb; i++) {
+            if (s) s = ',' + s;
+            s = Str.toBin(n & 0xff, 8) + s;
+            n >>= 8;
+        }
+        return (fPrefix? "0b" : "") + s;
+    }
+
+    /**
+     * toOct(n, cch, fPrefix)
+     *
+     * Converts an integer to octal, with the specified number of digits (default of 6; max of 12)
+     *
+     * You might be tempted to use the built-in n.toString(8) instead, but it doesn't zero-pad and it
+     * doesn't properly convert negative values.  Moreover, if n is undefined, n.toString() will throw
+     * an exception, whereas this function will return '?' characters.
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of octal digits (0 or undefined for default of either 6, 8, or 12)
+     * @param {boolean} [fPrefix]
+     * @return {string} the octal representation of n
+     */
+    static toOct(n, cch, fPrefix)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.log(8)) || 1;
+            var v = Math.abs(n);
+            if (v <= 0o777777) {
+                cch = 6;
+            } else if (v <= 0o77777777) {
+                cch = 8;
+            } else {
+                cch = 12;
+            }
+        } else if (cch > 12) cch = 12;
+        return Str.toBase(n, 8, cch, fPrefix? "0o" : "");
+    }
+
+    /**
+     * toDec(n, cch)
+     *
+     * Converts an integer to decimal, with the specified number of digits (default of 5; max of 11)
+     *
+     * You might be tempted to use the built-in n.toString(10) instead, but it doesn't zero-pad and it
+     * doesn't properly convert negative values.  Moreover, if n is undefined, n.toString() will throw
+     * an exception, whereas this function will return '?' characters.
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of decimal digits (0 or undefined for default of either 5 or 11)
+     * @return {string} the decimal representation of n
+     */
+    static toDec(n, cch)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.LN10) || 1;
+            var v = Math.abs(n);
+            if (v <= 99999) {
+                cch = 5;
+            } else {
+                cch = 11;
+            }
+        } else if (cch > 11) cch = 11;
+        return Str.toBase(n, 10, cch);
+    }
+
+    /**
+     * toHex(n, cch, fPrefix)
+     *
+     * Converts an integer to hex, with the specified number of digits (default of 4 or 8, max of 9).
+     *
+     * You might be tempted to use the built-in n.toString(16) instead, but it doesn't zero-pad and it
+     * doesn't properly convert negative values; for example, if n is -2147483647, then n.toString(16)
+     * will return "-7fffffff" instead of "80000001".  Moreover, if n is undefined, n.toString() will
+     * throw an exception, whereas this function will return '?' characters.
+     *
+     * NOTE: The following work-around (adapted from code found on StackOverflow) would be another solution,
+     * taking care of negative values, zero-padding, and upper-casing, but not null/undefined/NaN values:
+     *
+     *      s = (n < 0? n + 0x100000000 : n).toString(16);
+     *      s = "00000000".substr(0, 8 - s.length) + s;
+     *      s = s.substr(0, cch).toUpperCase();
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of hex digits (0 or undefined for default of either 4, 8, or 9)
+     * @param {boolean} [fPrefix]
+     * @return {string} the hex representation of n
+     */
+    static toHex(n, cch, fPrefix)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.log(16)) || 1;
+            var v = Math.abs(n);
+            if (v <= 0xffff) {
+                cch = 4;
+            } else if (v <= 0xffffffff) {
+                cch = 8;
+            } else {
+                cch = 9;
+            }
+        } else if (cch > 9) cch = 9;
+        return Str.toBase(n, 16, cch, fPrefix? "0x" : "");
+    }
+
+    /**
+     * toHexByte(b)
+     *
+     * Alias for Str.toHex(b, 2, true)
+     *
+     * @param {number|null|undefined} b is a byte value
+     * @return {string} the hex representation of b
+     */
+    static toHexByte(b)
+    {
+        return Str.toHex(b, 2, true);
+    }
+
+    /**
+     * toHexWord(w)
+     *
+     * Alias for Str.toHex(w, 4, true)
+     *
+     * @param {number|null|undefined} w is a word (16-bit) value
+     * @return {string} the hex representation of w
+     */
+    static toHexWord(w)
+    {
+        return Str.toHex(w, 4, true);
+    }
+
+    /**
+     * toHexLong(l)
+     *
+     * Alias for Str.toHex(l, 8, true)
+     *
+     * @param {number|null|undefined} l is a dword (32-bit) value
+     * @return {string} the hex representation of w
+     */
+    static toHexLong(l)
+    {
+        return Str.toHex(l, 8, true);
+    }
+
+    /**
+     * getBaseName(sFileName, fStripExt)
+     *
+     * This is a poor-man's version of Node's path.basename(), which Node-only components should use instead.
+     *
+     * Note that if fStripExt is true, this strips ANY extension, whereas path.basename() strips the extension only
+     * if it matches the second parameter (eg, path.basename("/foo/bar/baz/asdf/quux.html", ".html") returns "quux").
+     *
+     * @param {string} sFileName
+     * @param {boolean} [fStripExt]
+     * @return {string}
+     */
+    static getBaseName(sFileName, fStripExt)
+    {
+        var sBaseName = sFileName;
+
+        var i = sFileName.lastIndexOf('/');
+        if (i >= 0) sBaseName = sFileName.substr(i + 1);
+
+        /*
+         * This next bit is a kludge to clean up names that are part of a URL that includes unsightly query parameters.
+         */
+        i = sBaseName.indexOf('&');
+        if (i > 0) sBaseName = sBaseName.substr(0, i);
+
+        if (fStripExt) {
+            i = sBaseName.lastIndexOf(".");
+            if (i > 0) {
+                sBaseName = sBaseName.substring(0, i);
+            }
+        }
+        return sBaseName;
+    }
+
+    /**
+     * getExtension(sFileName)
+     *
+     * This is a poor-man's version of Node's path.extname(), which Node-only components should use instead.
+     *
+     * Note that we EXCLUDE the period from the returned extension, whereas path.extname() includes it.
+     *
+     * @param {string} sFileName
+     * @return {string} the filename's extension (in lower-case and EXCLUDING the "."), or an empty string
+     */
+    static getExtension(sFileName)
+    {
+        var sExtension = "";
+        var i = sFileName.lastIndexOf(".");
+        if (i >= 0) {
+            sExtension = sFileName.substr(i + 1).toLowerCase();
+        }
+        return sExtension;
+    }
+
+    /**
+     * endsWith(s, sSuffix)
+     *
+     * @param {string} s
+     * @param {string} sSuffix
+     * @return {boolean} true if s ends with sSuffix, false if not
+     */
+    static endsWith(s, sSuffix)
+    {
+        return s.indexOf(sSuffix, s.length - sSuffix.length) !== -1;
+    }
+
+    /**
+     * escapeHTML(sHTML)
+     *
+     * @param {string} sHTML
+     * @return {string} with HTML entities "escaped", similar to PHP's htmlspecialchars()
+     */
+    static escapeHTML(sHTML)
+    {
+        return sHTML.replace(/[&<>"']/g, function(m)
+        {
+            return Str.aHTMLEscapeMap[m];
+        });
+    }
+
+    /**
+     * replaceAll(sFind, sReplace, s)
+     *
+     * @param {string} sFind
+     * @param {string} sReplace
+     * @param {string} s
+     * @return {string}
+     */
+    static replaceAll(sFind, sReplace, s)
+    {
+        var a = {};
+        a[sFind] = sReplace;
+        return Str.replaceArray(a, s);
+    }
+
+    /**
+     * replaceArray(a, s)
+     *
+     * @param {Object} a
+     * @param {string} s
+     * @return {string}
+     */
+    static replaceArray(a, s)
+    {
+        var sMatch = "";
+        for (var k in a) {
+            /*
+             * As noted in:
+             *
+             *      http://www.regexguru.com/2008/04/escape-characters-only-when-necessary/
+             *
+             * inside character classes, only backslash, caret, hyphen and the closing bracket need to be
+             * escaped.  And in fact, if you ensure that the closing bracket is first, the caret is not first,
+             * and the hyphen is last, you can avoid escaping those as well.
+             */
+            k = k.replace(/([\\[\]*{}().+?])/g, "\\$1");
+            sMatch += (sMatch? '|' : '') + k;
+        }
+        return s.replace(new RegExp('(' + sMatch + ')', "g"), function(m)
+        {
+            return a[m];
+        });
+    }
+
+    /**
+     * pad(s, cch, fPadLeft)
+     *
+     * NOTE: the maximum amount of padding currently supported is 40 spaces.
+     *
+     * @param {string} s is a string
+     * @param {number} cch is desired length
+     * @param {boolean} [fPadLeft] (default is padding on the right)
+     * @return {string} the original string (s) with spaces padding it to the specified length
+     */
+    static pad(s, cch, fPadLeft)
+    {
+        var sPadding = "                                        ";
+        return fPadLeft? (sPadding + s).slice(-cch) : (s + sPadding).slice(0, cch);
+    }
+
+    /**
+     * stripLeadingZeros(s, fPad)
+     *
+     * @param {string} s
+     * @param {boolean} [fPad]
+     * @return {string}
+     */
+    static stripLeadingZeros(s, fPad)
+    {
+        var cch = s.length;
+        s = s.replace(/^0+([0-9A-F]+)$/i, "$1");
+        if (fPad) s = Str.pad(s, cch, true);
+        return s;
+    }
+
+    /**
+     * trim(s)
+     *
+     * @param {string} s
+     * @return {string}
+     */
+    static trim(s)
+    {
+        if (String.prototype.trim) {
+            return s.trim();
+        }
+        return s.replace(/^\s+|\s+$/g, "");
+    }
+
+    /**
+     * toASCIICode(b)
+     *
+     * @param {number} b
+     * @return {string}
+     */
+    static toASCIICode(b)
+    {
+        var s;
+        if (b != Str.ASCII.CR && b != Str.ASCII.LF) {
+            s = Str.aASCIICodes[b];
+        }
+        if (s) {
+            s = '<' + s + '>';
+        } else {
+            s = String.fromCharCode(b);
+        }
+        return s;
+    }
+}
+
+Str.aHTMLEscapeMap = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#039;'
+};
+
+/*
+ * Future home of a general-purpose ASCII table.  TODO: Flesh it out.
+ */
+Str.ASCII = {
+    LF:     0x0A,
+    CR:     0x0D
+};
+
+/*
+ * Table for converting "unprintable" ASCII codes into mnemonics, to more clearly see what's being printed.
+ */
+Str.aASCIICodes = {
+    0x00:   "NUL",
+    0x01:   "SOH",      // (CTRL_A) Start of Heading
+    0x02:   "STX",      // (CTRL_B) Start of Text
+    0x03:   "ETX",      // (CTRL_C) End of Text
+    0x04:   "EOT",      // (CTRL_D) End of Transmission
+    0x05:   "ENQ",      // (CTRL_E) Enquiry
+    0x06:   "ACK",      // (CTRL_F) Acknowledge
+    0x07:   "BEL",      // (CTRL_G) Bell
+    0x08:   "BS",       // (CTRL_H) Backspace
+    0x09:   "TAB",      // (CTRL_I) Horizontal Tab
+    0x0A:   "LF",       // (CTRL_J) Line Feed (New Line)
+    0x0B:   "VT",       // (CTRL_K) Vertical Tab
+    0x0C:   "FF",       // (CTRL_L) Form Feed (New Page)
+    0x0D:   "CR",       // (CTRL_M) Carriage Return
+    0x0E:   "SO",       // (CTRL_N) Shift Out
+    0x0F:   "SI",       // (CTRL_O) Shift In
+    0x10:   "DLE",      // (CTRL_P) Data Link Escape
+    0x11:   "XON",      // (CTRL_Q) Device Control 1 (aka DC1)
+    0x12:   "DC2",      // (CTRL_R) Device Control 2
+    0x13:   "XOFF",     // (CTRL_S) Device Control 3 (aka DC3)
+    0x14:   "DC4",      // (CTRL_T) Device Control 4
+    0x15:   "NAK",      // (CTRL_U) Negative Acknowledge
+    0x16:   "SYN",      // (CTRL_V) Synchronous Idle
+    0x17:   "ETB",      // (CTRL_W) End of Transmission Block
+    0x18:   "CAN",      // (CTRL_X) Cancel
+    0x19:   "EM",       // (CTRL_Y) End of Medium
+    0x1A:   "SUB",      // (CTRL_Z) Substitute
+    0x1B:   "ESC",      // Escape
+    0x1C:   "FS",       // File Separator
+    0x1D:   "GS",       // Group Separator
+    0x1E:   "RS",       // Record Separator
+    0x1F:   "US"        // Unit Separator
+};
+
+Str.TYPES = {
+    NULL:       0,
+    BYTE:       1,
+    WORD:       2,
+    DWORD:      3,
+    NUMBER:     4,
+    STRING:     5,
+    BOOLEAN:    6,
+    OBJECT:     7,
+    ARRAY:      8
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/usrlib.js (C) Jeff Parsons 2012-2017
+ */
+
+/**
+ * @typedef {{
+ *  mask:       number,
+ *  shift:      number
+ * }}
+ */
+var BitField;
+
+/**
+ * @typedef {Object.<BitField>}
+ */
+var BitFields;
+
+class Usr {
+    /**
+     * binarySearch(a, v, fnCompare)
+     *
+     * @param {Array} a is an array
+     * @param {number|string|Array|Object} v
+     * @param {function((number|string|Array|Object), (number|string|Array|Object))} [fnCompare]
+     * @return {number} the index of matching entry if non-negative, otherwise the index of the insertion point
+     */
+    static binarySearch(a, v, fnCompare)
+    {
+        var left = 0;
+        var right = a.length;
+        var found = 0;
+        if (fnCompare === undefined) {
+            fnCompare = function(a, b)
+            {
+                return a > b ? 1 : a < b ? -1 : 0;
+            };
+        }
+        while (left < right) {
+            var middle = (left + right) >> 1;
+            var compareResult;
+            compareResult = fnCompare(v, a[middle]);
+            if (compareResult > 0) {
+                left = middle + 1;
+            } else {
+                right = middle;
+                found = !compareResult;
+            }
+        }
+        return found ? left : ~left;
+    }
+
+    /**
+     * binaryInsert(a, v, fnCompare)
+     *
+     * If element v already exists in array a, the array is unchanged (we don't allow duplicates); otherwise, the
+     * element is inserted into the array at the appropriate index.
+     *
+     * @param {Array} a is an array
+     * @param {number|string|Array|Object} v is the value to insert
+     * @param {function((number|string|Array|Object), (number|string|Array|Object))} [fnCompare]
+     */
+    static binaryInsert(a, v, fnCompare)
+    {
+        var index = Usr.binarySearch(a, v, fnCompare);
+        if (index < 0) {
+            a.splice(-(index + 1), 0, v);
+        }
+    }
+
+    /**
+     * getTimestamp()
+     *
+     * @return {string} timestamp containing the current date and time ("yyyy-mm-dd hh:mm:ss")
+     */
+    static getTimestamp()
+    {
+        var date = new Date();
+        var padNum = function(n)
+        {
+            return (n < 10 ? "0" : "") + n;
+        };
+        return date.getFullYear() + "-" + padNum(date.getMonth() + 1) + "-" + padNum(date.getDate()) + " " + padNum(date.getHours()) + ":" + padNum(date.getMinutes()) + ":" + padNum(date.getSeconds());
+    }
+
+    /**
+     * getMonthDays(nMonth, nYear)
+     *
+     * Note that if we're being called on behalf of the RTC, its year is always truncated to two digits (mod 100),
+     * so we have no idea what century the year 0 might refer to.  When using the normal leap-year formula, 0 fails
+     * the mod 100 test but passes the mod 400 test, so as far as the RTC is concerned, every century year is a leap
+     * year.  Since we're most likely dealing with the year 2000, that's fine, since 2000 was also a leap year.
+     *
+     * TODO: There IS a separate CMOS byte that's supposed to be set to CMOS_ADDR.CENTURY_DATE; it's always BCD,
+     * so theoretically it will contain values like 0x19 or 0x20 (for the 20th and 21st centuries, respectively), and
+     * we could add that as another parameter to this function, to improve the accuracy, but that would go beyond what
+     * a real RTC actually does.
+     *
+     * @param {number} nMonth (1-12)
+     * @param {number} nYear (normally a 4-digit year, but it may also be mod 100)
+     * @return {number} the maximum (1-based) day allowed for the specified month and year
+     */
+    static getMonthDays(nMonth, nYear)
+    {
+        var nDays = Usr.aMonthDays[nMonth - 1];
+        if (nDays == 28) {
+            if ((nYear % 4) === 0 && ((nYear % 100) || (nYear % 400) === 0)) {
+                nDays++;
+            }
+        }
+        return nDays;
+    }
+
+    /**
+     * formatDate(sFormat, date)
+     *
+     * @param {string} sFormat (eg, "F j, Y", "Y-m-d H:i:s")
+     * @param {Date} [date] (default is the current time)
+     * @return {string}
+     *
+     * Supported identifiers in sFormat include:
+     *
+     *      a:  lowercase ante meridiem and post meridiem (am or pm)
+     *      d:  day of the month, 2 digits with leading zeros (01,...,31)
+     *      g:  hour in 12-hour format, without leading zeros (1,...,12)
+     *      i:  minutes, with leading zeros (00,...,59)
+     *      j:  day of the month, without leading zeros (1,...,31)
+     *      l:  day of the week ("Sunday",...,"Saturday")
+     *      m:  month, with leading zeros (01,...,12)
+     *      s:  seconds, with leading zeros (00,...,59)
+     *      F:  month ("January",...,"December")
+     *      H:  hour in 24-hour format, with leading zeros (00,...,23)
+     *      Y:  year (eg, 2014)
+     *
+     * For more inspiration, see: http://php.net/manual/en/function.date.php
+     */
+    static formatDate(sFormat, date)
+    {
+        var sDate = "";
+        if (!date) date = new Date();
+        var iHour = date.getHours();
+        var iDay = date.getDate();
+        var iMonth = date.getMonth() + 1;
+        for (var i = 0; i < sFormat.length; i++) {
+            var ch;
+            switch ((ch = sFormat.charAt(i))) {
+            case 'a':
+                sDate += (iHour < 12 ? "am" : "pm");
+                break;
+            case 'd':
+                sDate += ('0' + iDay).slice(-2);
+                break;
+            case 'g':
+                sDate += (!iHour ? 12 : (iHour > 12 ? iHour - 12 : iHour));
+                break;
+            case 'i':
+                sDate += ('0' + date.getMinutes()).slice(-2);
+                break;
+            case 'j':
+                sDate += iDay;
+                break;
+            case 'l':
+                sDate += Usr.asDays[date.getDay()];
+                break;
+            case 'm':
+                sDate += ('0' + iMonth).slice(-2);
+                break;
+            case 's':
+                sDate += ('0' + date.getSeconds()).slice(-2);
+                break;
+            case 'F':
+                sDate += Usr.asMonths[iMonth - 1];
+                break;
+            case 'H':
+                sDate += ('0' + iHour).slice(-2);
+                break;
+            case 'Y':
+                sDate += date.getFullYear();
+                break;
+            default:
+                sDate += ch;
+                break;
+            }
+        }
+        return sDate;
+    }
+
+    /**
+     * defineBitFields(bfs)
+     *
+     * Prepares a bit field definition for use with getBitField() and setBitField(); eg:
+     *
+     *      var bfs = Usr.defineBitFields({num:20, count:8, btmod:1, type:3});
+     *
+     * The above defines a set of bit fields containing four fields: num (bits 0-19), count (bits 20-27), btmod (bit 28), and type (bits 29-31).
+     *
+     *      Usr.setBitField(bfs.num, n, 1);
+     *
+     * The above set bit field "bfs.num" in numeric variable "n" to the value 1.
+     *
+     * @param {Object} bfs
+     * @return {BitFields}
+     */
+    static defineBitFields(bfs)
+    {
+        var bit = 0;
+        for (var f in bfs) {
+            var width = bfs[f];
+            var mask = ((1 << width) - 1) << bit;
+            bfs[f] = {mask: mask, shift: bit};
+            bit += width;
+        }
+        return bfs;
+    }
+
+    /**
+     * initBitFields(bfs, ...)
+     *
+     * @param {BitFields} bfs
+     * @param {...number} var_args
+     * @return {number} a value containing all supplied bit fields
+     */
+    static initBitFields(bfs, var_args)
+    {
+        var v = 0, i = 1;
+        for (var f in bfs) {
+            if (i >= arguments.length) break;
+            v = Usr.setBitField(bfs[f], v, arguments[i++]);
+        }
+        return v;
+    }
+
+    /**
+     * getBitField(bf, v)
+     *
+     * @param {BitField} bf
+     * @param {number} v is a value containing bit fields
+     * @return {number} the value of the bit field in v defined by bf
+     */
+    static getBitField(bf, v)
+    {
+        return (v & bf.mask) >> bf.shift;
+    }
+
+    /**
+     * setBitField(bf, v, n)
+     *
+     * @param {BitField} bf
+     * @param {number} v is a value containing bit fields
+     * @param {number} n is a value to store in v in the bit field defined by bf
+     * @return {number} updated v
+     */
+    static setBitField(bf, v, n)
+    {
+        return (v & ~bf.mask) | ((n << bf.shift) & bf.mask);
+    }
+
+    /**
+     * indexOf(a, t, i)
+     *
+     * Use this instead of Array.prototype.indexOf() if you can't be sure the browser supports it.
+     *
+     * @param {Array} a
+     * @param {*} t
+     * @param {number} [i]
+     * @returns {number}
+     */
+    static indexOf(a, t, i)
+    {
+        if (Array.prototype.indexOf) {
+            return a.indexOf(t, i);
+        }
+        i = i || 0;
+        if (i < 0) i += a.length;
+        if (i < 0) i = 0;
+        for (var n = a.length; i < n; i++) {
+            if (i in a && a[i] === t) return i;
+        }
+        return -1;
+    }
+}
+
+Usr.asDays = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
+Usr.asMonths = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
+Usr.aMonthDays = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+
+/**
+ * getTime()
+ *
+ * @return {number} the current time, in milliseconds
+ */
+Usr.getTime = Date.now || function() { return +new Date(); };
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/weblib.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * According to http://www.w3schools.com/jsref/jsref_obj_global.asp, these are the *global* properties
+ * and functions of JavaScript-in-the-Browser:
+ *
+ * Property             Description
+ * ---
+ * Infinity             A numeric value that represents positive/negative infinity
+ * NaN                  "Not-a-Number" value
+ * undefined            Indicates that a variable has not been assigned a value
+ *
+ * Function             Description
+ * ---
+ * decodeURI()          Decodes a URI
+ * decodeURIComponent() Decodes a URI component
+ * encodeURI()          Encodes a URI
+ * encodeURIComponent() Encodes a URI component
+ * escape()             Deprecated in version 1.5. Use encodeURI() or encodeURIComponent() instead
+ * eval()               Evaluates a string and executes it as if it was script code
+ * isFinite()           Determines whether a value is a finite, legal number
+ * isNaN()              Determines whether a value is an illegal number
+ * Number()             Converts an object's value to a number
+ * parseFloat()         Parses a string and returns a floating point number
+ * parseInt()           Parses a string and returns an integer
+ * String()             Converts an object's value to a string
+ * unescape()           Deprecated in version 1.5. Use decodeURI() or decodeURIComponent() instead
+ *
+ * And according to http://www.w3schools.com/jsref/obj_window.asp, these are the properties and functions
+ * of the *window* object.
+ *
+ * Property             Description
+ * ---
+ * closed               Returns a Boolean value indicating whether a window has been closed or not
+ * defaultStatus        Sets or returns the default text in the statusbar of a window
+ * document             Returns the Document object for the window (See Document object)
+ * frames               Returns an array of all the frames (including iframes) in the current window
+ * history              Returns the History object for the window (See History object)
+ * innerHeight          Returns the inner height of a window's content area
+ * innerWidth           Returns the inner width of a window's content area
+ * length               Returns the number of frames (including iframes) in a window
+ * location             Returns the Location object for the window (See Location object)
+ * name                 Sets or returns the name of a window
+ * navigator            Returns the Navigator object for the window (See Navigator object)
+ * opener               Returns a reference to the window that created the window
+ * outerHeight          Returns the outer height of a window, including toolbars/scrollbars
+ * outerWidth           Returns the outer width of a window, including toolbars/scrollbars
+ * pageXOffset          Returns the pixels the current document has been scrolled (horizontally) from the upper left corner of the window
+ * pageYOffset          Returns the pixels the current document has been scrolled (vertically) from the upper left corner of the window
+ * parent               Returns the parent window of the current window
+ * screen               Returns the Screen object for the window (See Screen object)
+ * screenLeft           Returns the x coordinate of the window relative to the screen
+ * screenTop            Returns the y coordinate of the window relative to the screen
+ * screenX              Returns the x coordinate of the window relative to the screen
+ * screenY              Returns the y coordinate of the window relative to the screen
+ * self                 Returns the current window
+ * status               Sets or returns the text in the statusbar of a window
+ * top                  Returns the topmost browser window
+ *
+ * Method               Description
+ * ---
+ * alert()              Displays an alert box with a message and an OK button
+ * atob()               Decodes a base-64 encoded string
+ * blur()               Removes focus from the current window
+ * btoa()               Encodes a string in base-64
+ * clearInterval()      Clears a timer set with setInterval()
+ * clearTimeout()       Clears a timer set with setTimeout()
+ * close()              Closes the current window
+ * confirm()            Displays a dialog box with a message and an OK and a Cancel button
+ * createPopup()        Creates a pop-up window
+ * focus()              Sets focus to the current window
+ * moveBy()             Moves a window relative to its current position
+ * moveTo()             Moves a window to the specified position
+ * open()               Opens a new browser window
+ * print()              Prints the content of the current window
+ * prompt()             Displays a dialog box that prompts the visitor for input
+ * resizeBy()           Resizes the window by the specified pixels
+ * resizeTo()           Resizes the window to the specified width and height
+ * scroll()             This method has been replaced by the scrollTo() method.
+ * scrollBy()           Scrolls the content by the specified number of pixels
+ * scrollTo()           Scrolls the content to the specified coordinates
+ * setInterval()        Calls a function or evaluates an expression at specified intervals (in milliseconds)
+ * setTimeout()         Calls a function or evaluates an expression after a specified number of milliseconds
+ * stop()               Stops the window from loading
+ */
+
+class Web {
+    /**
+     * log(s, type)
+     *
+     * For diagnostic output only.  DEBUG must be true (or "--debug" specified via the command-line)
+     * for Component.log() to display anything.
+     *
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     */
+    static log(s, type)
+    {
+        Component.log(s, type);
+    }
+
+    /**
+     * notice(s, fPrintOnly, id)
+     *
+     * @param {string} s is the message text
+     * @param {boolean} [fPrintOnly]
+     * @param {string} [id] is the caller's ID, if any
+     */
+    static notice(s, fPrintOnly, id)
+    {
+        Component.notice(s, fPrintOnly, id);
+    }
+
+    /**
+     * getResource(sURL, dataPost, fAsync, done)
+     *
+     * Request the specified resource (sURL), and once the request is complete, notify done().
+     *
+     * If fAsync is true, a done() callback should ALWAYS be supplied; otherwise, you'll have no
+     * idea when the request is complete or what the response was.  done() is passed three parameters:
+     *
+     *      done(sURL, sResource, nErrorCode)
+     *
+     * If nErrorCode is zero, sResource should contain the requested data; otherwise, an error occurred.
+     *
+     * If dataPost is set to a string, that string can be used to control the response format;
+     * by default, the response format is plain text, but you can specify "bytes" to request arbitrary
+     * binary data, which should come back as a string of bytes.
+     *
+     * TODO: The "bytes" option works by calling overrideMimeType(), which was never a best practice.
+     * Instead, we should implement supported response types ("text" and "arraybuffer", at a minimum)
+     * by setting xmlHTTP.responseType to one of those values before calling xmlHTTP.send().
+     *
+     * @param {string} sURL
+     * @param {string|Object|null} [dataPost] for a POST request (default is a GET request)
+     * @param {boolean} [fAsync] is true for an asynchronous request
+     * @param {function(string,string,number)} [done]
+     * @return {Array|null} Array containing [sResource, nErrorCode], or null if no response yet
+     */
+    static getResource(sURL, dataPost, fAsync = false, done)
+    {
+        var nErrorCode = 0, sResource = null, response = null;
+
+        if (typeof resources == 'object' && (sResource = resources[sURL])) {
+            if (done) done(sURL, sResource, nErrorCode);
+            return [sResource, nErrorCode];
+        }
+        else if (fAsync && typeof resources == 'function') {
+            resources(sURL, function(sResource, nErrorCode)
+            {
+                if (done) done(sURL, sResource, nErrorCode);
+            });
+            return response;
+        }
+
+        if (DEBUG) {
+            /*
+             * The larger resources we put on archive.pcjs.org should also be available locally...
+             */
+            sURL = sURL.replace(/^http:\/\/archive.pcjs.org(\/.*)\/([^\/]*)$/, "$1/archive/$2");
+        }
+
+
+        var xmlHTTP = (window.XMLHttpRequest? new window.XMLHttpRequest() : new window.ActiveXObject("Microsoft.XMLHTTP"));
+        if (fAsync) {
+            xmlHTTP.onreadystatechange = function()
+            {
+                if (xmlHTTP.readyState === 4) {
+                    /*
+                     * The following line was recommended for WebKit, as a work-around to prevent the handler firing multiple
+                     * times when debugging.  Unfortunately, that's not the only XMLHttpRequest problem that occurs when
+                     * debugging, so I think the WebKit problem is deeper than that.  When we have multiple XMLHttpRequests
+                     * pending, any debugging activity means most of them simply get dropped on floor, so what may actually be
+                     * happening are mis-notifications rather than redundant notifications.
+                     *
+                     *      xmlHTTP.onreadystatechange = undefined;
+                     */
+                    sResource = xmlHTTP.responseText;
+                    /*
+                     * The normal "success" case is an HTTP status code of 200, but when testing with files loaded
+                     * from the local file system (ie, when using the "file:" protocol), we have to be a bit more "flexible".
+                     */
+                    if (xmlHTTP.status == 200 || !xmlHTTP.status && sResource.length && Web.getHostProtocol() == "file:") {
+                        if (MAXDEBUG) Web.log("xmlHTTP.onreadystatechange(" + sURL + "): returned " + sResource.length + " bytes");
+                    }
+                    else {
+                        nErrorCode = xmlHTTP.status || -1;
+                        Web.log("xmlHTTP.onreadystatechange(" + sURL + "): error code " + nErrorCode);
+                    }
+                    if (done) done(sURL, sResource, nErrorCode);
+                }
+            };
+        }
+
+        if (dataPost && typeof dataPost == "object") {
+            var sDataPost = "";
+            for (var p in dataPost) {
+                if (!dataPost.hasOwnProperty(p)) continue;
+                if (sDataPost) sDataPost += "&";
+                sDataPost += p + '=' + encodeURIComponent(dataPost[p]);
+            }
+            sDataPost = sDataPost.replace(/%20/g, '+');
+            if (MAXDEBUG) Web.log("Web.getResource(POST " + sURL + "): " + sDataPost.length + " bytes");
+            xmlHTTP.open("POST", sURL, fAsync);     // ensure that fAsync is a valid boolean (Internet Explorer xmlHTTP functions insist on it)
+            xmlHTTP.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
+            xmlHTTP.send(sDataPost);
+        } else {
+            if (MAXDEBUG) Web.log("Web.getResource(GET " + sURL + ")");
+            xmlHTTP.open("GET", sURL, fAsync);      // ensure that fAsync is a valid boolean (Internet Explorer xmlHTTP functions insist on it)
+            if (dataPost == "bytes") {
+                xmlHTTP.overrideMimeType("text/plain; charset=x-user-defined");
+            }
+            xmlHTTP.send();
+        }
+
+        if (!fAsync) {
+            sResource = xmlHTTP.responseText;
+            if (xmlHTTP.status == 200) {
+                if (MAXDEBUG) Web.log("Web.getResource(" + sURL + "): returned " + sResource.length + " bytes");
+            } else {
+                nErrorCode = xmlHTTP.status || -1;
+                Web.log("Web.getResource(" + sURL + "): error code " + nErrorCode);
+            }
+            if (done) done(sURL, sResource, nErrorCode);
+            response = [sResource, nErrorCode];
+        }
+        return response;
+    }
+
+    /**
+     * parseMemoryResource(sURL, sData)
+     *
+     * This converts a variety of JSON-style data streams into an Object with the following properties:
+     *
+     *      aBytes
+     *      aSymbols
+     *      addrLoad
+     *      addrExec
+     *
+     * If the source data contains a 'bytes' array, it's passed through to 'aBytes'; alternatively, if
+     * it contains a 'words' array, the values are converted from 16-bit to 8-bit and stored in 'aBytes',
+     * and if it contains a 'longs' array, the values are converted from 32-bit longs into bytes and
+     * stored in 'aBytes'.
+     *
+     * Alternatively, if the source data contains a 'data' array, we simply pass that through to the output
+     * object as:
+     *
+     *      aData
+     *
+     * @param {string} sURL
+     * @param {string} sData
+     * @return {Object|null} (resource)
+     */
+    static parseMemoryResource(sURL, sData)
+    {
+        var i;
+        var resource = {
+            aBytes: null,
+            aSymbols: null,
+            addrLoad: null,
+            addrExec: null
+        };
+
+        if (sData.charAt(0) == "[" || sData.charAt(0) == "{") {
+            try {
+                var a, ib, data;
+
+                if (sData.substr(0, 1) == "<") {    // if the "data" begins with a "<"...
+                    /*
+                     * Early server configs reported an error (via the nErrorCode parameter) if a tape URL was invalid,
+                     * but more recent server configs now display a somewhat friendlier HTML error page.  The downside,
+                     * however, is that the original error has been buried, and we've received "data" that isn't actually
+                     * tape data.  So if the data we've received appears to be "HTML-like", we treat it as an error message.
+                     */
+                    throw new Error(sData);
+                }
+
+                /*
+                 * TODO: IE9 is rather unfriendly and restrictive with regard to how much data it's willing to
+                 * eval().  In particular, the 10Mb disk image we use for the Windows 1.01 demo config fails in
+                 * IE9 with an "Out of memory" exception.  One work-around would be to chop the data into chunks
+                 * (perhaps one track per chunk, using regular expressions) and then manually re-assemble it.
+                 *
+                 * However, it turns out that using JSON.parse(sDiskData) instead of eval("(" + sDiskData + ")")
+                 * is a much easier fix. The only drawback is that we must first quote any unquoted property names
+                 * and remove any comments, because while eval() was cool with them, JSON.parse() is more particular;
+                 * the following RegExp replacements take care of those requirements.
+                 *
+                 * The use of hex values is something else that eval() was OK with, but JSON.parse() is not, and
+                 * while I've stopped using hex values in DumpAPI responses (at least when "format=json" is specified),
+                 * I can't guarantee they won't show up in "legacy" images, and there's no simple RegExp replacement
+                 * for transforming hex values into decimal values, so I cop out and fall back to eval() if I detect
+                 * any hex prefixes ("0x") in the sequence.  Ditto for error messages, which appear like so:
+                 *
+                 *      ["unrecognized disk path: test.img"]
+                 */
+                if (sData.indexOf("0x") < 0 && sData.indexOf("0o") < 0 && sData.substr(0, 2) != '["') {
+                    data = JSON.parse(sData.replace(/([a-z]+):/gm, '"$1":').replace(/\/\/[^\n]*/gm, ""));
+                } else {
+                    data = eval("(" + sData + ")");
+                }
+
+                resource.addrLoad = data['load'];
+                resource.addrExec = data['exec'];
+
+                if (a = data['bytes']) {
+                    resource.aBytes = a;
+                }
+                else if (a = data['words']) {
+                    /*
+                     * Convert all words into bytes
+                     */
+                    resource.aBytes = new Array(a.length * 2);
+                    for (i = 0, ib = 0; i < a.length; i++) {
+                        resource.aBytes[ib++] = a[i] & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 8) & 0xff;
+
+                    }
+                }
+                else if (a = data['longs']) {
+                    /*
+                     * Convert all dwords (longs) into bytes
+                     */
+                    resource.aBytes = new Array(a.length * 4);
+                    for (i = 0, ib = 0; i < a.length; i++) {
+                        resource.aBytes[ib++] = a[i] & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 8) & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 16) & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 24) & 0xff;
+                    }
+                }
+                else if (a = data['data']) {
+                    resource.aData = a;
+                }
+                else {
+                    resource.aBytes = data;
+                }
+
+                if (resource.aBytes) {
+                    if (!resource.aBytes.length) {
+                        Component.error("Empty resource: " + sURL);
+                        resource = null;
+                    }
+                    else if (resource.aBytes.length == 1) {
+                        Component.error(resource.aBytes[0]);
+                        resource = null;
+                    }
+                }
+                resource.aSymbols = data['symbols'];
+
+            } catch (e) {
+                Component.error("Resource data error (" + sURL + "): " + e.message);
+                resource = null;
+            }
+        }
+        else {
+            /*
+             * Parse the data manually; we assume it's a series of hex byte-values separated by whitespace.
+             */
+            var ab = [];
+            var sHexData = sData.replace(/\n/gm, " ").replace(/ +$/, "");
+            var asHexData = sHexData.split(" ");
+            for (i = 0; i < asHexData.length; i++) {
+                var n = parseInt(asHexData[i], 16);
+                if (isNaN(n)) {
+                    Component.error("Resource data error (" + sURL + "): invalid hex byte (" + asHexData[i] + ")");
+                    break;
+                }
+                ab.push(n & 0xff);
+            }
+            if (i == asHexData.length) resource.aBytes = ab;
+        }
+        return resource;
+    }
+
+    /**
+     * sendReport(sApp, sVer, sURL, sUser, sType, sReport, sHostName)
+     *
+     * Send a report (eg, bug report) to the server.
+     *
+     * @param {string} sApp (eg, "PCjs")
+     * @param {string} sVer (eg, "1.02")
+     * @param {string} sURL (eg, "/devices/pc/machine/5150/mda/64kb/machine.xml")
+     * @param {string} sUser (ie, the user key, if any)
+     * @param {string} sType (eg, "bug"); one of ReportAPI.TYPE.*
+     * @param {string} sReport (eg, unparsed state data)
+     * @param {string} [sHostName] (default is http://SITEHOST)
+     */
+    static sendReport(sApp, sVer, sURL, sUser, sType, sReport, sHostName)
+    {
+        var dataPost = {};
+        dataPost[ReportAPI.QUERY.APP] = sApp;
+        dataPost[ReportAPI.QUERY.VER] = sVer;
+        dataPost[ReportAPI.QUERY.URL] = sURL;
+        dataPost[ReportAPI.QUERY.USER] = sUser;
+        dataPost[ReportAPI.QUERY.TYPE] = sType;
+        dataPost[ReportAPI.QUERY.DATA] = sReport;
+        var sReportURL = (sHostName? sHostName : "http://" + SITEHOST) + ReportAPI.ENDPOINT;
+        Web.getResource(sReportURL, dataPost, true);
+    }
+
+    /**
+     * getHost()
+     *
+     * @return {string}
+     */
+    static getHost()
+    {
+        return ("http://" + (window? window.location.host : SITEHOST));
+    }
+
+    /**
+     * getHostURL()
+     *
+     * @return {string|null}
+     */
+    static getHostURL()
+    {
+        return (window? window.location.href : null);
+    }
+
+    /**
+     * getHostProtocol()
+     *
+     * @return {string}
+     */
+    static getHostProtocol()
+    {
+        return (window? window.location.protocol : "file:");
+    }
+
+    /**
+     * getUserAgent()
+     *
+     * @return {string}
+     */
+    static getUserAgent()
+    {
+        return (window? window.navigator.userAgent : "");
+    }
+
+    /**
+     * hasLocalStorage
+     *
+     * true if localStorage support exists, is enabled, and works; false otherwise
+     *
+     * @return {boolean}
+     */
+    static hasLocalStorage()
+    {
+        if (Web.fLocalStorage == null) {
+            var f = false;
+            if (window) {
+                try {
+                    window.localStorage.setItem(Web.sLocalStorageTest, Web.sLocalStorageTest);
+                    f = (window.localStorage.getItem(Web.sLocalStorageTest) == Web.sLocalStorageTest);
+                    window.localStorage.removeItem(Web.sLocalStorageTest);
+                } catch (e) {
+                    Web.logLocalStorageError(e);
+                    f = false;
+                }
+            }
+            Web.fLocalStorage = f;
+        }
+        return Web.fLocalStorage;
+    }
+
+    /**
+     * logLocalStorageError(e)
+     *
+     * @param {Error} e is an exception
+     */
+    static logLocalStorageError(e)
+    {
+        Web.log(e.message, "localStorage error");
+    }
+
+    /**
+     * getLocalStorageItem(sKey)
+     *
+     * Returns the requested key value, or null if the key does not exist, or undefined if localStorage is not available
+     *
+     * @param {string} sKey
+     * @return {string|null|undefined} sValue
+     */
+    static getLocalStorageItem(sKey)
+    {
+        var sValue;
+        if (window) {
+            try {
+                sValue = window.localStorage.getItem(sKey);
+            } catch (e) {
+                Web.logLocalStorageError(e);
+            }
+        }
+        return sValue;
+    }
+
+    /**
+     * setLocalStorageItem(sKey, sValue)
+     *
+     * @param {string} sKey
+     * @param {string} sValue
+     * @return {boolean} true if localStorage is available, false if not
+     */
+    static setLocalStorageItem(sKey, sValue)
+    {
+        try {
+            window.localStorage.setItem(sKey, sValue);
+            return true;
+        } catch (e) {
+            Web.logLocalStorageError(e);
+        }
+        return false;
+    }
+
+    /**
+     * removeLocalStorageItem(sKey)
+     *
+     * @param {string} sKey
+     */
+    static removeLocalStorageItem(sKey)
+    {
+        try {
+            window.localStorage.removeItem(sKey);
+        } catch (e) {
+            Web.logLocalStorageError(e);
+        }
+    }
+
+    /**
+     * getLocalStorageKeys()
+     *
+     * @return {Array}
+     */
+    static getLocalStorageKeys()
+    {
+        var a = [];
+        try {
+            for (var i = 0, c = window.localStorage.length; i < c; i++) {
+                a.push(window.localStorage.key(i));
+            }
+        } catch (e) {
+            Web.logLocalStorageError(e);
+        }
+        return a;
+    }
+
+    /**
+     * reloadPage()
+     */
+    static reloadPage()
+    {
+        if (window) window.location.reload();
+    }
+
+    /**
+     * isUserAgent(s)
+     *
+     * Check the browser's user-agent string for the given substring; "iOS" and "MSIE" are special values you can
+     * use that will match any iOS or MSIE browser, respectively (even IE11, in the case of "MSIE").
+     *
+     * 2013-11-06: In a questionable move, MSFT changed the user-agent reported by IE11 on Windows 8.1, eliminating
+     * the "MSIE" string (which MSDN calls a "version token"; see http://msdn.microsoft.com/library/ms537503.aspx);
+     * they say "public websites should rely on feature detection, rather than browser detection, in order to design
+     * their sites for browsers that don't support the features used by the website." So, in IE11, we get a user-agent
+     * that tries to fool apps into thinking the browser is more like WebKit or Gecko:
+     *
+     *      Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
+     *
+     * That's a nice idea, but in the meantime, they hosed the XSL transform code in embed.js, which contained
+     * some very critical browser-specific code; turning on IE's "Compatibility Mode" didn't help either, because
+     * that's a sledgehammer solution which restores the old user-agent string but also disables other features like
+     * HTML5 canvas support. As an interim solution, I'm treating any "MSIE" check as a check for either "MSIE" or
+     * "Trident".
+     *
+     * UPDATE: I've since found ways to make the code in embed.js more browser-agnostic, so for now, there's isn't
+     * any code that cares about "MSIE", but I've left the change in place, because I wouldn't be surprised if I'll
+     * need more IE-specific code in the future, perhaps for things like copy/paste functionality, or mouse capture.
+     *
+     * @param {string} s is a substring to search for in the user-agent; as noted above, "iOS" and "MSIE" are special values
+     * @return {boolean} is true if the string was found, false if not
+     */
+    static isUserAgent(s)
+    {
+        if (window) {
+            var userAgent = Web.getUserAgent();
+            /*
+             * Here's one case where we have to be careful with Component, because when isUserAgent() is called by
+             * the init code below, component.js hasn't been loaded yet.  The simple solution for now is to remove the call.
+             *
+             *      Web.log("agent: " + userAgent);
+             *
+             * And yes, it would be pointless to use the conditional (?) operator below, if not for the Google Closure
+             * Compiler (v20130823) failing to detect the entire expression as a boolean.
+             */
+            return s == "iOS" && !!userAgent.match(/(iPod|iPhone|iPad)/) && !!userAgent.match(/AppleWebKit/) || s == "MSIE" && !!userAgent.match(/(MSIE|Trident)/) || (userAgent.indexOf(s) >= 0);
+        }
+        return false;
+    }
+
+    /**
+     * isMobile()
+     *
+     * Check the browser's user-agent string for the substring "Mobi", as per Mozilla recommendation:
+     *
+     *      https://developer.mozilla.org/en-US/docs/Browser_detection_using_the_user_agent
+     *
+     * @return {boolean} is true if the browser appears to be a mobile (ie, non-desktop) web browser, false if not
+     */
+    static isMobile()
+    {
+        return Web.isUserAgent("Mobi");
+    }
+
+    /**
+     * getURLParm(sParm)
+     *
+     * @param {string} sParm
+     * @return {string|undefined}
+     */
+    static getURLParm(sParm)
+    {
+        if (!Web.parmsURL) {
+            Web.parmsURL = Web.parseURLParms();
+        }
+        return Web.parmsURL[sParm];
+    }
+
+    /**
+     * parseURLParms(sParms)
+     *
+     * @param {string} [sParms] containing the parameter portion of a URL (ie, after the '?')
+     * @return {Object} containing properties for each parameter found
+     */
+    static parseURLParms(sParms)
+    {
+        var aParms = {};
+        if (window) {       // an alternative to "if (typeof module === 'undefined')" if require("defines") was used
+            if (!sParms) {
+                /*
+                 * Note that window.location.href returns the entire URL, whereas window.location.search
+                 * returns only the parameters, if any (starting with the '?', which we skip over with a substr() call).
+                 */
+                sParms = window.location.search.substr(1);
+            }
+            var match;
+            var pl = /\+/g; // RegExp for replacing addition symbol with a space
+            var search = /([^&=]+)=?([^&]*)/g;
+            var decode = function(s)
+            {
+                return decodeURIComponent(s.replace(pl, " "));
+            };
+
+            while ((match = search.exec(sParms))) {
+                aParms[decode(match[1])] = decode(match[2]);
+            }
+        }
+        return aParms;
+    }
+
+    /**
+     * downloadFile(sData, sType, fBase64, sFileName)
+     *
+     * @param {string} sData
+     * @param {string} sType
+     * @param {boolean} [fBase64]
+     * @param {string} [sFileName]
+     */
+    static downloadFile(sData, sType, fBase64, sFileName)
+    {
+        var link = null, sAlert;
+        var sURI = "data:application/" + sType + (fBase64? ";base64" : "") + ",";
+
+        if (!Web.isUserAgent("Firefox")) {
+            sURI += (fBase64? sData : encodeURI(sData));
+        } else {
+            sURI += (fBase64? sData : encodeURIComponent(sData));
+        }
+        if (sFileName) {
+            link = document.createElement('a');
+            if (typeof link.download != 'string') link = null;
+        }
+        if (link) {
+            link.href = sURI;
+            link.download = sFileName;
+            document.body.appendChild(link);    // Firefox allegedly requires the link to be in the body
+            link.click();
+            document.body.removeChild(link);
+            sAlert = 'Check your Downloads folder for ' + sFileName + '.';
+        } else {
+            window.open(sURI);
+            sAlert = 'Check your browser for a new window/tab containing the requested data' + (sFileName? (' (' + sFileName + ')') : '') + '.';
+        }
+        return sAlert;
+    }
+
+    /**
+     * onCountRepeat(n, fnRepeat, fnComplete, msDelay)
+     *
+     * Call fnRepeat() n times with an msDelay millisecond delay between calls,
+     * then call fnComplete() when n has been exhausted OR fnRepeat() returns false.
+     *
+     * @param {number} n
+     * @param {function()} fnRepeat
+     * @param {function()} fnComplete
+     * @param {number} [msDelay]
+     */
+    static onCountRepeat(n, fnRepeat, fnComplete, msDelay)
+    {
+        var fnTimeout = function doCountRepeat()
+        {
+            n -= 1;
+            if (n >= 0) {
+                if (!fnRepeat()) n = 0;
+            }
+            if (n > 0) {
+                setTimeout(fnTimeout, msDelay || 0);
+                return;
+            }
+            fnComplete();
+        };
+        fnTimeout();
+    }
+
+    /**
+     * onClickRepeat(e, msDelay, msRepeat, fn)
+     *
+     * Repeatedly call fn() with an initial msDelay, and an msRepeat delay thereafter,
+     * as long as HTML control Object e has an active "down" event and fn() returns true.
+     *
+     * @param {Object} e
+     * @param {number} msDelay
+     * @param {number} msRepeat
+     * @param {function(boolean)} fn is passed false on the first call, true on all repeated calls
+     */
+    static onClickRepeat(e, msDelay, msRepeat, fn)
+    {
+        var ms = 0, timer = null, fIgnoreMouseEvents = false;
+
+        var fnRepeat = function doClickRepeat()
+        {
+            if (fn(ms === msRepeat)) {
+                timer = setTimeout(fnRepeat, ms);
+                ms = msRepeat;
+            }
+        };
+        e.onmousedown = function()
+        {
+            // Web.log("onMouseDown()");
+            if (!fIgnoreMouseEvents) {
+                if (!timer) {
+                    ms = msDelay;
+                    fnRepeat();
+                }
+            }
+        };
+        e.ontouchstart = function()
+        {
+            // Web.log("onTouchStart()");
+            if (!timer) {
+                ms = msDelay;
+                fnRepeat();
+            }
+        };
+        e.onmouseup = e.onmouseout = function()
+        {
+            // Web.log("onMouseUp()/onMouseOut()");
+            if (timer) {
+                clearTimeout(timer);
+                timer = null;
+            }
+        };
+        e.ontouchend = e.ontouchcancel = function()
+        {
+            // Web.log("onTouchEnd()/onTouchCancel()");
+            if (timer) {
+                clearTimeout(timer);
+                timer = null;
+            }
+            /*
+             * Devices that generate ontouch* events ALSO generate onmouse* events,
+             * and generally do so immediately after all the touch events are complete,
+             * so unless we want double the action, we need to ignore mouse events.
+             */
+            fIgnoreMouseEvents = true;
+        };
+    }
+
+    /**
+     * onPageEvent(sName, fn)
+     *
+     * For 'onload', 'onunload', and 'onpageshow' events, most callers should NOT use this function, but
+     * instead use Web.onInit(), Web.onShow(), and Web.onExit(), respectively.
+     *
+     * The only components that should still use onPageEvent() are THIS component (see the bottom of this file)
+     * and components that need to capture other events (eg, the 'onresize' event in the Video component).
+     *
+     * This function creates a chain of callbacks, allowing multiple JavaScript modules to define handlers
+     * for the same event, which wouldn't be possible if everyone modified window['onload'], window['onunload'],
+     * etc, themselves.  However, that's less of a concern now, because assuming everyone else is now using
+     * onInit(), onExit(), etc, then there really IS only one component setting the window callback: this one.
+     *
+     * NOTE: It's risky to refer to obscure event handlers with "dot" names, because the Closure Compiler may
+     * erroneously replace them (eg, window.onpageshow is a good example).
+     *
+     * @param {string} sFunc
+     * @param {function()} fn
+     */
+    static onPageEvent(sFunc, fn)
+    {
+        if (window) {
+            var fnPrev = window[sFunc];
+            if (typeof fnPrev !== 'function') {
+                window[sFunc] = fn;
+            } else {
+                /*
+                 * TODO: Determine whether there's any value in receiving/sending the Event object that the
+                 * browser provides when it generates the original event.
+                 */
+                window[sFunc] = function onWindowEvent()
+                {
+                    if (fnPrev) fnPrev();
+                    fn();
+                };
+            }
+        }
+    };
+
+    /**
+     * onInit(fn)
+     *
+     * Use this instead of setting window.onload.  Allows multiple JavaScript modules to define their own 'onload' event handler.
+     *
+     * @param {function()} fn
+     */
+    static onInit(fn)
+    {
+        Web.aPageEventHandlers['init'].push(fn);
+    };
+
+    /**
+     * onShow(fn)
+     *
+     * @param {function()} fn
+     *
+     * Use this instead of setting window.onpageshow.  Allows multiple JavaScript modules to define their own 'onpageshow' event handler.
+     */
+    static onShow(fn)
+    {
+        Web.aPageEventHandlers['show'].push(fn);
+    };
+
+    /**
+     * onExit(fn)
+     *
+     * @param {function()} fn
+     *
+     * Use this instead of setting window.onunload.  Allows multiple JavaScript modules to define their own 'onunload' event handler.
+     */
+    static onExit(fn)
+    {
+        Web.aPageEventHandlers['exit'].push(fn);
+    };
+
+    /**
+     * doPageEvent(afn)
+     *
+     * @param {Array.<function()>} afn
+     */
+    static doPageEvent(afn)
+    {
+        if (Web.fPageEventsEnabled) {
+            try {
+                for (var i = 0; i < afn.length; i++) {
+                    afn[i]();
+                }
+            } catch (e) {
+                Web.notice("An unexpected exception occurred:\n\n" + e.message + "\n\nPlease send this information to support@pcjs.org. Thanks.");
+            }
+        }
+    };
+
+    /**
+     * enablePageEvents(fEnable)
+     *
+     * @param {boolean} fEnable is true to enable page events, false to disable (they're enabled by default)
+     */
+    static enablePageEvents(fEnable)
+    {
+        if (!Web.fPageEventsEnabled && fEnable) {
+            Web.fPageEventsEnabled = true;
+            if (Web.fPageLoaded) Web.sendPageEvent('init');
+            if (Web.fPageShowed) Web.sendPageEvent('show');
+            return;
+        }
+        Web.fPageEventsEnabled = fEnable;
+    }
+
+    /**
+     * sendPageEvent(sEvent)
+     *
+     * This allows us to manually trigger page events.
+     *
+     * @param {string} sEvent (one of 'init', 'show' or 'exit')
+     */
+    static sendPageEvent(sEvent)
+    {
+        if (Web.aPageEventHandlers[sEvent]) {
+            Web.doPageEvent(Web.aPageEventHandlers[sEvent]);
+        }
+    }
+}
+
+Web.parmsURL = null;            // initialized on first call to parseURLParms()
+
+Web.aPageEventHandlers = {
+    'init': [],                 // list of window 'onload' handlers
+    'show': [],                 // list of window 'onpageshow' handlers
+    'exit': []                  // list of window 'onunload' handlers (although we prefer to use 'onbeforeunload' if possible)
+};
+
+Web.fPageLoaded = false;        // set once the page's first 'onload' event has occurred
+Web.fPageShowed = false;        // set once the page's first 'onpageshow' event has occurred
+Web.fPageEventsEnabled = true;  // default is true, set to false (or true) by enablePageEvents()
+
+/**
+ * fLocalStorage
+ *
+ * true if localStorage support exists, is enabled, and works; "falsey" otherwise
+ *
+ * @type {boolean|null}
+ */
+Web.fLocalStorage = null;
+
+/**
+ * TODO: Is there any way to get the Closure Compiler to stop inlining this string?  This isn't cutting it.
+ *
+ * @const {string}
+ */
+Web.sLocalStorageTest = "PCjs.localStorage";
+
+Web.onPageEvent('onload', function onPageLoad() {
+    Web.fPageLoaded = true;
+    Web.doPageEvent(Web.aPageEventHandlers['init']);
+});
+
+Web.onPageEvent('onpageshow', function onPageShow() {
+    Web.fPageShowed = true;
+    Web.doPageEvent(Web.aPageEventHandlers['show']);
+});
+
+Web.onPageEvent(Web.isUserAgent("Opera") || Web.isUserAgent("iOS")? 'onunload' : 'onbeforeunload', function onPageUnload() {
+    Web.doPageEvent(Web.aPageEventHandlers['exit']);
+});
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/component.js (C) Jeff Parsons 2012-2017
+ */
+
+/*
+ * All PCjs components now use JSDoc types, primarily so that Google's Closure Compiler will compile
+ * everything with zero warnings when ADVANCED_OPTIMIZATIONS are enabled.  For more information about
+ * the JSDoc types supported by the Closure Compiler:
+ *
+ *      https://developers.google.com/closure/compiler/docs/js-for-compiler#types
+ *
+ * I also attempted to validate this code with JSLint, but it complained too much; eg, it didn't like
+ * "while (true)", a tried and "true" programming convention for decades, and it wanted me to replace
+ * all "++" and "--" operators with "+= 1" and "-= 1", use "(s || '')" instead of "(s? s : '')", etc.
+ *
+ * I prefer sticking with traditional C-style idioms, in part because they are more portable.  That
+ * does NOT mean I'm trying to write "portable JavaScript," but some of this code was ported from C code
+ * I'd written long ago, so portability is good, and I'm not going to throw that away if there's no need.
+ *
+ * UPDATE: I've since switched from JSLint to JSHint, which seems to have more reasonable defaults.
+ * And for new code, I have adopted some popular JavaScript idioms, like "(s || '')", although the need
+ * for those kinds of expressions will be reduced as I also start adopting some ES6 features, like
+ * default parameters.
+ */
+
+
+/**
+ * Since the Closure Compiler treats ES6 classes as @struct rather than @dict by default,
+ * it deters us from defining named properties on our components; eg:
+ *
+ *      this['exports'] = {...}
+ *
+ * results in an error:
+ *
+ *      Cannot do '[]' access on a struct
+ *
+ * So, in order to define 'exports', we must override the @struct assumption by annotating
+ * the class as @unrestricted (or @dict).  Note that this must be done both here and in the
+ * subclass (eg, SerialPort), because otherwise the Compiler won't allow us to *reference*
+ * the named property either.
+ *
+ * TODO: Consider marking ALL our classes unrestricted, because otherwise it forces us to
+ * define every single property the class uses in its constructor, which results in a fair
+ * bit of redundant initialization, since many properties aren't (and don't need to be) fully
+ * initialized until the appropriate init(), reset(), restore(), etc. function is called.
+ *
+ * The upside, however, may be that since the structure of the class is completely defined by
+ * the constructor, JavaScript engines may be able to optimize and run more efficiently.
+ *
+ * @unrestricted
+ */
+class Component {
+    /**
+     * Component(type, parms, bitsMessage)
+     *
+     * A Component object requires:
+     *
+     *      type: a user-defined type name (eg, "CPU")
+     *
+     * and accepts any or all of the following (parms) properties:
+     *
+     *      id: component ID (default is "")
+     *      name: component name (default is ""; if blank, toString() will use the type name only)
+     *      comment: component comment string (default is undefined)
+     *
+     * Component subclasses will usually have additional (parms) properties.
+     *
+     * @param {string} type
+     * @param {Object} [parms]
+     * @param {number} [bitsMessage] selects message(s) that the component wants to enable (default is 0)
+     */
+    constructor(type, parms, bitsMessage)
+    {
+        this.type = type;
+
+        if (!parms) parms = {'id': "", 'name': ""};
+
+        this.id = parms['id'] || "";
+        this.name = parms['name'];
+        this.comment = parms['comment'];
+        this.parms = parms;
+
+        /*
+         * The following Component properties need to be accessible by other machines and/or command scripts;
+         * well, OK, or we could have exported some new functions to walk the contents of these properties, as we
+         * did with findMachineComponent(), but this works just as well.
+         *
+         * Also, while the double-assignment looks silly (ie, using both dot and bracket property notation), it
+         * resolves a complaint from the Closure Compiler, because if we use ONLY bracket notation here, then the
+         * Compiler wants us to change all the other references to bracket notation as well.
+         */
+        this.exports = this['exports'] = {};
+        this.bindings = this['bindings'] = {};
+
+        var i = this.id.indexOf('.');
+        if (i < 0) {
+            this.idComponent = this.id;
+        } else {
+            this.idMachine = this.id.substr(0, i);
+            this.idComponent = this.id.substr(i + 1);
+        }
+
+        /*
+         * Gather all the various component flags (booleans) into a single "flags" object, and encourage
+         * subclasses to do the same, to reduce the property clutter we have to wade through while debugging.
+         */
+        this.flags = {
+            ready:      false,
+            busy:       false,
+            busyCancel: false,
+            powered:    false,
+            error:      false
+        };
+
+        this.fnReady = null;
+        this.clearError();
+        this.bitsMessage = bitsMessage || 0;
+
+        /** @type {Object|null} controlPrint is the HTML control, if any, that we can print to */
+        this.controlPrint = null;
+
+        this.cmp = null;
+        this.bus = null;
+        this.cpu = null;
+        this.dbg = null;
+
+        /*
+         * TODO: Consider adding another parameter to the Component() constructor that allows components to tell
+         * us if they support single or multiple instances per machine.  For example, there can be multiple SerialPort
+         * components per machine, but only one CPU component (some machines also support an FPU, but that component
+         * is considered separate from the CPU).
+         *
+         * It's not critical, but it would help catch machine configuration errors; for example, a machine that mistakenly
+         * includes two CPU components may, aside from wasting memory, end up with odd side-effects, like unresponsive
+         * CPU controls.
+         */
+        Component.add(this);
+    }
+
+    /**
+     * Component.add(component)
+     *
+     * @param {Component} component
+     */
+    static add(component)
+    {
+        /*
+         * This just generates a lot of useless noise, handy in the early days, not so much these days....
+         *
+         *      if (DEBUG) Component.log("Component.add(" + component.type + "," + component.id + ")");
+         */
+        Component.components.push(component);
+    }
+
+    /**
+     * Component.addMachine(idMachine)
+     *
+     * @param {string} idMachine
+     */
+    static addMachine(idMachine)
+    {
+        Component.machines[idMachine] = {};
+    }
+
+    /**
+     * Component.addMachineResource(idMachine, sName, data)
+     *
+     * @param {string} idMachine
+     * @param {string|null} sName (name of the resource)
+     * @param {*} data
+     */
+    static addMachineResource(idMachine, sName, data)
+    {
+        /*
+         * I used to assert(Component.machines[idMachine]), but when we're running as a Node app, embed.js is not used,
+         * so addMachine() is never called, so resources do not need to be recorded.
+         */
+        if (Component.machines[idMachine] && sName) {
+            Component.machines[idMachine][sName] = data;
+        }
+    }
+
+    /**
+     * Component.getMachineResources(idMachine)
+     *
+     * @param {string} idMachine
+     * @return {Object|undefined}
+     */
+    static getMachineResources(idMachine)
+    {
+        return Component.machines[idMachine];
+    }
+
+    /**
+     * Component.getTime()
+     *
+     * @return {number} the current time, in milliseconds
+     */
+    static getTime()
+    {
+        return Date.now() || +new Date();
+    }
+
+    /**
+     * Component.log(s, type)
+     *
+     * For diagnostic output only.
+     *
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     */
+    static log(s, type)
+    {
+        if (!COMPILED) {
+            if (s) {
+                var sElapsed = "", sMsg = (type? (type + ": ") : "") + s;
+                if (typeof Usr != "undefined") {
+                    if (Component.msStart === undefined) {
+                        Component.msStart = Component.getTime();
+                    }
+                    sElapsed = (Component.getTime() - Component.msStart) + "ms: ";
+                }
+                if (window && window.console) console.log(sElapsed + sMsg.replace(/\n/g, " "));
+            }
+        }
+    }
+
+    /**
+     * Component.assert(f, s)
+     *
+     * Verifies conditions that must be true (for DEBUG builds only).
+     *
+     * The Closure Compiler should automatically remove all references to Component.assert() in non-DEBUG builds.
+     * TODO: Add a task to the build process that "asserts" there are no instances of "assertion failure" in RELEASE builds.
+     *
+     * @param {boolean} f is the expression we are asserting to be true
+     * @param {string} [s] is description of the assertion on failure
+     */
+    static assert(f, s)
+    {
+        if (DEBUG) {
+            if (!f) {
+                if (!s) s = "assertion failure";
+                Component.log(s);
+                throw new Error(s);
+            }
+        }
+    }
+
+    /**
+     * Component.println(s, type, id)
+     *
+     * For non-diagnostic messages, which components may override to control the destination/appearance of their output.
+     *
+     * Components that inherit from this class should use the instance method, this.println(), rather than Component.println(),
+     * because if a Control Panel is loaded, it will override only the instance method, not the class method (overriding the class
+     * method would improperly affect any other machines loaded on the same page).
+     *
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     * @param {string} [id] is the caller's ID, if any
+     */
+    static println(s, type, id)
+    {
+        if (!COMPILED) {
+            Component.log((id? (id + ": ") : "") + (s? ("\"" + s + "\"") : ""), type);
+        }
+    }
+
+    /**
+     * Component.notice(s, fPrintOnly, id)
+     *
+     * notice() is like println() but implies a need for user notification, so we alert() as well.
+     *
+     * @param {string} s is the message text
+     * @param {boolean} [fPrintOnly]
+     * @param {string} [id] is the caller's ID, if any
+     */
+    static notice(s, fPrintOnly, id)
+    {
+        if (!COMPILED) {
+            Component.println(s, "notice", id);
+        }
+        if (!fPrintOnly) Component.alertUser((id? (id + ": ") : "") + s);
+    }
+
+    /**
+     * Component.warning(s)
+     *
+     * @param {string} s describes the warning
+     */
+    static warning(s)
+    {
+        if (!COMPILED) {
+            Component.println(s, "warning");
+        }
+        Component.alertUser(s);
+    }
+
+    /**
+     * Component.error(s)
+     *
+     * @param {string} s describes the error; an alert() is displayed as well
+     */
+    static error(s)
+    {
+        if (!COMPILED) {
+            Component.println(s, "error");
+        }
+        Component.alertUser(s);
+    }
+
+    /**
+     * Component.alertUser(sMessage)
+     *
+     * @param {string} sMessage
+     */
+    static alertUser(sMessage)
+    {
+        if (window) {
+            window.alert(sMessage);
+        } else {
+            Component.log(sMessage);
+        }
+    };
+
+    /**
+     * Component.confirmUser(sPrompt)
+     *
+     * @param {string} sPrompt
+     * @returns {boolean} true if the user clicked OK, false if Cancel/Close
+     */
+    static confirmUser(sPrompt)
+    {
+        var fResponse = false;
+        if (window) {
+            fResponse = window.confirm(sPrompt);
+        }
+        return fResponse;
+    }
+
+    /**
+     * Component.promptUser()
+     *
+     * @param {string} sPrompt
+     * @param {string} [sDefault]
+     * @returns {string|null}
+     */
+    static promptUser(sPrompt, sDefault)
+    {
+        var sResponse = null;
+        if (window) {
+            sResponse = window.prompt(sPrompt, sDefault === undefined? "" : sDefault);
+        }
+        return sResponse;
+    }
+
+    /**
+     * Component.getComponents(idRelated)
+     *
+     * We could store components as properties, using the component's ID, and change
+     * this linear lookup into a property lookup, but some components may have no ID.
+     *
+     * @param {string} [idRelated] of related component
+     * @return {Array} of components
+     */
+    static getComponents(idRelated)
+    {
+        var i;
+        var aComponents = [];
+        /*
+         * getComponentByID(id, idRelated)
+         *
+         * If idRelated is provided, we check it for a machine prefix, and use any
+         * existing prefix to constrain matches to IDs with the same prefix, in order to
+         * avoid matching components belonging to other machines.
+         */
+        if (idRelated) {
+            if ((i = idRelated.indexOf('.')) > 0)
+                idRelated = idRelated.substr(0, i + 1);
+            else
+                idRelated = "";
+        }
+        for (i = 0; i < Component.components.length; i++) {
+            var component = Component.components[i];
+            if (!idRelated || !component.id.indexOf(idRelated)) {
+                aComponents.push(component);
+            }
+        }
+        return aComponents;
+    }
+
+    /**
+     * Component.getComponentByID(id, idRelated)
+     *
+     * We could store components as properties, using the component's ID, and change
+     * this linear lookup into a property lookup, but some components may have no ID.
+     *
+     * @param {string} id of the desired component
+     * @param {string} [idRelated] of related component
+     * @return {Component|null}
+     */
+    static getComponentByID(id, idRelated)
+    {
+        if (id !== undefined) {
+            var i;
+            /*
+             * If idRelated is provided, we check it for a machine prefix, and use any
+             * existing prefix to constrain matches to IDs with the same prefix, in order to
+             * avoid matching components belonging to other machines.
+             */
+            if (idRelated && (i = idRelated.indexOf('.')) > 0) {
+                id = idRelated.substr(0, i + 1) + id;
+            }
+            for (i = 0; i < Component.components.length; i++) {
+                if (Component.components[i].id === id) {
+                    return Component.components[i];
+                }
+            }
+            if (Component.components.length) {
+                Component.log("Component ID '" + id + "' not found", "warning");
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Component.getComponentByType(sType, idRelated, componentPrev)
+     *
+     * @param {string} sType of the desired component
+     * @param {string} [idRelated] of related component
+     * @param {Component|null} [componentPrev] of previously returned component, if any
+     * @return {Component|null}
+     */
+    static getComponentByType(sType, idRelated, componentPrev)
+    {
+        if (sType !== undefined) {
+            var i;
+            /*
+             * If idRelated is provided, we check it for a machine prefix, and use any
+             * existing prefix to constrain matches to IDs with the same prefix, in order to
+             * avoid matching components belonging to other machines.
+             */
+            if (idRelated) {
+                if ((i = idRelated.indexOf('.')) > 0) {
+                    idRelated = idRelated.substr(0, i + 1);
+                } else {
+                    idRelated = "";
+                }
+            }
+            for (i = 0; i < Component.components.length; i++) {
+                if (componentPrev) {
+                    if (componentPrev == Component.components[i]) componentPrev = null;
+                    continue;
+                }
+                if (sType == Component.components[i].type && (!idRelated || !Component.components[i].id.indexOf(idRelated))) {
+                    return Component.components[i];
+                }
+            }
+            Component.log("Component type '" + sType + "' not found", "warning");
+        }
+        return null;
+    }
+
+    /**
+     * Component.getComponentParms(element)
+     *
+     * @param {Object} element from the DOM
+     */
+    static getComponentParms(element)
+    {
+        var parms = null;
+        var sParms = element.getAttribute("data-value");
+        if (sParms) {
+            try {
+                parms = eval("(" + sParms + ")");   // jshint ignore:line
+                /*
+                 * We can no longer invoke removeAttribute() because some components (eg, Panel) need
+                 * to run their initXXX() code more than once, to avoid initialization-order dependencies.
+                 *
+                 *      if (!DEBUG) {
+                 *          element.removeAttribute("data-value");
+                 *      }
+                 */
+            } catch(e) {
+                Component.error(e.message + " (" + sParms + ")");
+            }
+        }
+        return parms;
+    }
+
+    /**
+     * Component.bindExternalControl(component, sControl, sBinding, sType)
+     *
+     * @param {Component} component
+     * @param {string} sControl
+     * @param {string} sBinding
+     * @param {string} [sType] is the external component type
+     */
+    static bindExternalControl(component, sControl, sBinding, sType)
+    {
+        if (sControl) {
+            if (sType === undefined) sType = "Panel";
+            var target = Component.getComponentByType(sType, component.id);
+            if (target) {
+                var eBinding = target.bindings[sControl];
+                if (eBinding) {
+                    component.setBinding(null, sBinding, eBinding);
+                }
+            }
+        }
+    }
+
+    /**
+     * Component.bindComponentControls(component, element, sAppClass)
+     *
+     * @param {Component} component
+     * @param {Object} element from the DOM
+     * @param {string} sAppClass
+     */
+    static bindComponentControls(component, element, sAppClass)
+    {
+        var aeControls = Component.getElementsByClass(element.parentNode, sAppClass + "-control");
+
+        for (var iControl = 0; iControl < aeControls.length; iControl++) {
+
+            var aeChildNodes = aeControls[iControl].childNodes;
+
+            for (var iNode = 0; iNode < aeChildNodes.length; iNode++) {
+                var control = aeChildNodes[iNode];
+                if (control.nodeType !== 1 /* document.ELEMENT_NODE */) {
+                    continue;
+                }
+                var sClass = control.getAttribute("class");
+                if (!sClass) continue;
+                var aClasses = sClass.split(" ");
+                for (var iClass = 0; iClass < aClasses.length; iClass++) {
+                    var parms;
+                    sClass = aClasses[iClass];
+                    switch (sClass) {
+                        case sAppClass + "-binding":
+                            parms = Component.getComponentParms(control);
+                            if (parms && parms['binding']) {
+                                component.setBinding(parms['type'], parms['binding'], control, parms['value']);
+                            } else if (!parms || parms['type'] != "description") {
+                                Component.log("Component '" + component.toString() + "' missing binding" + (parms? " for " + parms['type'] : ""), "warning");
+                            }
+                            iClass = aClasses.length;
+                            break;
+                        default:
+                            // if (DEBUG) Component.log("Component.bindComponentControls(" + component.toString() + "): unrecognized control class \"" + sClass + "\"", "warning");
+                            break;
+                    }
+                }
+            }
+        }
+    }
+
+    /**
+     * Component.getElementsByClass(element, sClass, sObjClass)
+     *
+     * This is a cross-browser helper function, since not all browser's support getElementsByClassName()
+     *
+     * TODO: This should probably be moved into weblib.js at some point, along with the control binding functions above,
+     * to keep all the browser-related code together.
+     *
+     * @param {Object} element from the DOM
+     * @param {string} sClass
+     * @param {string} [sObjClass]
+     * @return {Array|NodeList}
+     */
+    static getElementsByClass(element, sClass, sObjClass)
+    {
+        if (sObjClass) sClass += '-' + sObjClass + "-object";
+        /*
+         * Use the browser's built-in getElementsByClassName() if it appears to be available
+         * (for example, it's not available in IE8, but it should be available in IE9 and up)
+         */
+        if (element.getElementsByClassName) {
+            return element.getElementsByClassName(sClass);
+        }
+        var i, j, ae = [];
+        var aeAll = element.getElementsByTagName("*");
+        var re = new RegExp('(^| )' + sClass + '( |$)');
+        for (i = 0, j = aeAll.length; i < j; i++) {
+            if (re.test(aeAll[i].className)) {
+                ae.push(aeAll[i]);
+            }
+        }
+        if (!ae.length) {
+            Component.log('No elements of class "' + sClass + '" found');
+        }
+        return ae;
+    }
+
+    /**
+     * Component.getScriptCommands(sScript)
+     *
+     * This is a simple parser that breaks sScript into an array of commands, where each command
+     * is an array of tokens, where tokens are sequences of characters separated by any of: tab, space,
+     * carriage-return (CR), line-feed (LF), semicolon, single-quote, or double-quote;  if a quote is
+     * used, all characters up to the next matching quote become part of the token, allowing any of the
+     * other separators to be part of the token.  CR, LF and semicolon also serve to terminate a command,
+     * with semicolon being preferred, because it's 1) more visible, and 2) essential when the entire
+     * script is a multi-line string where all CR/LF were replaced by spaces (which is what Jekyll does,
+     * and since we can't change Jekyll, it's what our own MarkDown Front Matter parser does as well;
+     * see convertMD() in markout.js, where the aCommandDefs array is built).
+     *
+     * Backslash sequences like \n, \r, and \\ have already been converted to LF, CR and backslash
+     * characters, since the entire script string is injected into a JavaScript function call, so any
+     * backslash sequence that JavaScript supports is automatically converted:
+     *
+     *      \0  \'  \"  \\  \n  \r  \v  \t  \b  \f  \uXXXX \xXX
+     *                      ^J  ^M  ^K  ^I  ^H  ^L
+     *
+     * To support any other non-printable 8-bit character, such as ESC, you should use \xXX, where XX
+     * is the ASCII code in hex.  For ESC, that would \x1B.
+     *
+     * @param {string} sScript
+     * @return {Array}
+     */
+    static getScriptCommands(sScript)
+    {
+        var cch = sScript.length;
+        var aCommands = [], aTokens = [], sToken = "", chQuote = null;
+        for (var i = 0; i < cch; i++) {
+            var ch = sScript[i];
+            if (ch == '"' || ch == "'") {
+                if (chQuote && ch != chQuote) {
+                    sToken += ch;
+                    continue;
+                }
+                if (!chQuote) {
+                    chQuote = ch;
+                } else {
+                    chQuote = null;
+                }
+                if (sToken) {
+                    aTokens.push(sToken);
+                    sToken = "";
+                }
+                continue;
+            }
+            if (!chQuote) {
+                if (ch == '\r' || ch == '\n') {
+                    ch = ';';
+                }
+                if (ch == ' ' || ch == '\t' || ch == ';') {
+                    if (sToken) {
+                        aTokens.push(sToken);
+                        sToken = "";
+                    }
+                    if (ch == ';' && aTokens.length) {
+                        aCommands.push(aTokens);
+                        aTokens = [];
+                    }
+                    continue;
+                }
+            }
+            sToken += ch;
+        }
+        if (sToken) {
+            aTokens.push(sToken);
+        }
+        if (aTokens.length) {
+            aCommands.push(aTokens);
+        }
+        return aCommands;
+    }
+
+    /**
+     * Component.processScript(idMachine, sScript)
+     *
+     * @param {string} idMachine
+     * @param {string} sScript
+     * @return {boolean}
+     */
+    static processScript(idMachine, sScript)
+    {
+        var fSuccess = false;
+        idMachine += ".machine";
+        if (typeof sScript == "string" && !Component.commands[idMachine]) {
+            fSuccess = true;
+            Component.commands[idMachine] = Component.getScriptCommands(sScript);
+            if (!Component.processCommands(idMachine)) {
+                fSuccess = false;
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * Component.processCommands(idMachine)
+     *
+     * @param {string} idMachine
+     * @return {boolean}
+     */
+    static processCommands(idMachine)
+    {
+        var fSuccess = true;
+        var aCommands = Component.commands[idMachine];
+
+     // var dbg = Component.getComponentByType("Debugger", idMachine);
+
+        while (aCommands && aCommands.length) {
+
+            var aTokens = aCommands.splice(0, 1)[0];
+            var sCommand = aTokens[0];
+
+            /*
+             * It's possible to route this output to the Debugger window with dbg.println()
+             * instead, but it's a bit too confusing mingling script output in a window that
+             * already mingles Debugger and machine output.
+             */
+            Component.println('script: ' + aTokens.join(' '));
+
+            var fnCallReady = null;
+            if (Component.asyncCommands.indexOf(sCommand) >= 0) {
+                fnCallReady = function processNextCommand() {
+                    return function() {
+                        Component.processCommands(idMachine);
+                    }
+                }();
+            }
+
+            var fnCommand = Component.globalCommands[sCommand];
+            if (fnCommand) {
+                if (!fnCallReady) {
+                    fSuccess = fnCommand(aTokens[1], aTokens[2], aTokens[3]);
+                } else {
+                    if (!fnCommand(fnCallReady, aTokens[1], aTokens[2], aTokens[3])) break;
+                }
+            }
+            else {
+                fSuccess = false;
+                var component = Component.getComponentByType(aTokens[1], idMachine);
+                if (component) {
+                    fnCommand = Component.componentCommands[sCommand];
+                    if (fnCommand) {
+                        fSuccess = fnCommand(component, aTokens[2], aTokens[3]);
+                    }
+                    else {
+                        var exports = component['exports'];
+                        if (exports) {
+                            fnCommand = exports[sCommand];
+                            if (fnCommand) {
+                                fSuccess = true;
+                                if (!fnCallReady) {
+                                    fSuccess = fnCommand.call(component, aTokens[2], aTokens[3]);
+                                } else {
+                                    if (!fnCommand.call(component, fnCallReady, aTokens[2], aTokens[3])) break;
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+
+            if (!fSuccess) {
+                Component.alertUser("Script error: " + sCommand + (fnCommand? " failed" : " unrecognized"));
+                break;
+            }
+        }
+
+        if (aCommands && !aCommands.length) {
+            delete Component.commands[idMachine];
+        }
+
+        return fSuccess;
+    }
+
+    /**
+     * Component.scriptAlert(sMessage)
+     *
+     * @param {string} sMessage
+     * @return {boolean}
+     */
+    static scriptAlert(sMessage)
+    {
+        Component.alertUser(sMessage);
+        return true;
+    }
+
+    /**
+     * Component.scriptSelect(component, sBinding, sValue)
+     *
+     * @param {Component} component
+     * @param {string} sBinding
+     * @param {string} sValue
+     * @return {boolean}
+     */
+    static scriptSelect(component, sBinding, sValue)
+    {
+        var fSuccess = false;
+        var aBindings = component['bindings'];
+        var control = aBindings[sBinding];
+        if (control) {
+            for (var i = 0; i < control.options.length; i++) {
+                if (control.options[i].textContent == sValue) {
+                    if (control.selectedIndex != i) {
+                        control.selectedIndex = i;
+                    }
+                    fSuccess = true;
+                    break;
+                }
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * Component.scriptSleep(fnCallback, sDelay)
+     *
+     * @param {function()} fnCallback
+     * @param {string} sDelay (in milliseconds)
+     * @return {boolean}
+     */
+    static scriptSleep(fnCallback, sDelay)
+    {
+        setTimeout(fnCallback, +sDelay);
+        return false;
+    }
+
+    /**
+     * toString()
+     *
+     * @this {Component}
+     * @return {string}
+     */
+    toString() {
+        return (this.name? this.name : (this.id || this.type));
+    }
+
+    /**
+     * getMachineNum()
+     *
+     * @this {Component}
+     * @return {number} unique machine number
+     */
+    getMachineNum() {
+        var nMachine = 1;
+        if (this.idMachine) {
+            var aDigits = this.idMachine.match(/\d+/);
+            if (aDigits !== null)
+                nMachine = parseInt(aDigits[0], 10);
+        }
+        return nMachine;
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * Component's setBinding() method is intended to be overridden by subclasses.
+     *
+     * @this {Component}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "reset")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue) {
+        switch (sBinding) {
+        case "clear":
+            if (!this.bindings[sBinding]) {
+                this.bindings[sBinding] = control;
+                control.onclick = (function(component) {
+                    return function clearPanel() {
+                        if (component.bindings['print']) {
+                            component.bindings['print'].value = "";
+                        }
+                    };
+                }(this));
+            }
+            return true;
+        case "print":
+            if (!this.bindings[sBinding]) {
+                this.bindings[sBinding] = control;
+                /*
+                 * HACK: Save this particular HTML element so that the Debugger can access it, too
+                 */
+                this.controlPrint = control;
+                /*
+                 * This was added for Firefox (Safari automatically clears the <textarea> on a page reload,
+                 * but Firefox does not).
+                 */
+                control.value = "";
+                this.println = (function(control) {
+                    return function printPanel(s, type) {
+                        s = (type !== undefined? (type + ": ") : "") + (s || "");
+                        /*
+                         * Prevent the <textarea> from getting too large; otherwise, printing becomes slower and slower.
+                         */
+                        if (COMPILED) {
+                            if (control.value.length > 8192) {
+                                control.value = control.value.substr(control.value.length - 4096);
+                            }
+                        }
+                        control.value += s + "\n";
+                        control.scrollTop = control.scrollHeight;
+                        if (!COMPILED && window && window.console) console.log(s);
+                    };
+                }(control));
+                /**
+                 * Override this.notice() with a replacement function that eliminates the Component.alertUser() call
+                 *
+                 * @this {Component}
+                 * @param {string} s
+                 * @param {boolean} [fPrintOnly]
+                 * @param {string} [id]
+                 */
+                this.notice = function noticePanel(s, fPrintOnly, id) {
+                    this.println(s, this.idComponent);
+                };
+            }
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    /**
+     * log(s, type)
+     *
+     * For diagnostic output only.
+     *
+     * WARNING: Even though this function's body is completely wrapped in DEBUG, that won't prevent the Closure Compiler
+     * from including it, so all calls must still be prefixed with "if (DEBUG) ....".  For this reason, the class method,
+     * Component.log(), is preferred, because the compiler IS smart enough to remove those calls.
+     *
+     * @this {Component}
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     */
+    log(s, type) {
+        if (!COMPILED) {
+            Component.log(s, type || this.id || this.type);
+        }
+    }
+
+    /**
+     * assert(f, s)
+     *
+     * Verifies conditions that must be true (for DEBUG builds only).
+     *
+     * WARNING: Make sure you preface all calls to this.assert() with "if (DEBUG)", because unlike Component.assert(),
+     * the Closure Compiler can't be sure that this instance method hasn't been overridden, so it refuses to treat it as
+     * dead code in non-DEBUG builds.
+     *
+     * TODO: Add a task to the build process that "asserts" there are no instances of "assertion failure" in RELEASE builds.
+     *
+     * @this {Component}
+     * @param {boolean|number} f is the expression asserted to be true
+     * @param {string} [s] is a description of the assertion to be displayed or logged on failure
+     */
+    assert(f, s) {
+        if (DEBUG) {
+            if (!f) {
+                s = "assertion failure in " + (this.id || this.type) + (s? ": " + s : "");
+                if (DEBUGGER && this.dbg) {
+                    this.dbg.stopCPU();
+                    /*
+                     * Why do we throw an Error only to immediately catch and ignore it?  Simply to give
+                     * any IDE the opportunity to inspect the application's state.  Even when the IDE has
+                     * control, you should still be able to invoke Debugger commands from the IDE's REPL,
+                     * using the '$' global function that the Debugger constructor defines; eg:
+                     *
+                     *      $('r')
+                     *      $('dw 0:0')
+                     *      $('h')
+                     *      ...
+                     *
+                     * If you have no desire to stop on assertions, consider this a no-op.  However, another
+                     * potential benefit of creating an Error object is that, for browsers like Chrome, we get
+                     * a stack trace, too.
+                     */
+                    try {
+                        throw new Error(s);
+                    } catch(e) {
+                        this.println(e.stack || e.message);
+                    }
+                    return;
+                }
+                this.log(s);
+                throw new Error(s);
+            }
+        }
+    }
+
+    /**
+     * println(s, type)
+     *
+     * For non-diagnostic messages, which components may override to control the destination/appearance of their output.
+     *
+     * Components using this.println() should wait until after their constructor has run to display any messages, because
+     * if a Control Panel has been loaded, its override will not take effect until its own constructor has run.
+     *
+     * @this {Component}
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     * @param {string} [id] is the caller's ID, if any
+     */
+    println(s, type, id) {
+        Component.println(s, type, id || this.id);
+    }
+
+    /**
+     * status(s)
+     *
+     * status() is like println() but it also includes information about the component (ie, the component ID),
+     * which is why there is no corresponding Component.status() function.
+     *
+     * @param {string} s is the message text
+     */
+    status(s) {
+        this.println(this.idComponent + ": " + s);
+    }
+
+    /**
+     * notice(s, fPrintOnly)
+     *
+     * notice() is like println() but implies a need for user notification, so we alert() as well; however, if this.println()
+     * is overridden, this.notice will be replaced with a similar override, on the assumption that the override is taking care
+     * of alerting the user.
+     *
+     * @this {Component}
+     * @param {string} s is the message text
+     * @param {boolean} [fPrintOnly]
+     * @param {string} [id] is the caller's ID, if any
+     */
+    notice(s, fPrintOnly, id) {
+        Component.notice(s, fPrintOnly, id || this.type);
+    }
+
+    /**
+     * setError(s)
+     *
+     * Set a fatal error condition
+     *
+     * @this {Component}
+     * @param {string} s describes a fatal error condition
+     */
+    setError(s) {
+        this.flags.error = true;
+        this.notice(s);         // TODO: Any cases where we should still prefix this string with "Fatal error: "?
+    }
+
+    /**
+     * clearError()
+     *
+     * Clear any fatal error condition
+     *
+     * @this {Component}
+     */
+    clearError() {
+        this.flags.error = false;
+    }
+
+    /**
+     * isError()
+     *
+     * Report any fatal error condition
+     *
+     * @this {Component}
+     * @return {boolean} true if a fatal error condition exists, false if not
+     */
+    isError() {
+        if (this.flags.error) {
+            this.println(this.toString() + " error");
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * isReady(fnReady)
+     *
+     * Return the "ready" state of the component; if the component is not ready, it will queue the optional
+     * notification function, otherwise it will immediately call the notification function, if any, without queuing it.
+     *
+     * NOTE: Since only the Computer component actually cares about the "readiness" of other components, the so-called
+     * "queue" of notification functions supports exactly one function.  This keeps things nice and simple.
+     *
+     * @this {Component}
+     * @param {function()} [fnReady]
+     * @return {boolean} true if the component is in a "ready" state, false if not
+     */
+    isReady(fnReady) {
+        if (fnReady) {
+            if (this.flags.ready) {
+                fnReady();
+            } else {
+                if (MAXDEBUG) this.log("NOT ready");
+                this.fnReady = fnReady;
+            }
+        }
+        return this.flags.ready;
+    }
+
+    /**
+     * setReady(fReady)
+     *
+     * Set the "ready" state of the component to true, and call any queued notification functions.
+     *
+     * @this {Component}
+     * @param {boolean} [fReady] is assumed to indicate "ready" unless EXPLICITLY set to false
+     */
+    setReady(fReady) {
+        if (!this.flags.error) {
+            this.flags.ready = (fReady !== false);
+            if (this.flags.ready) {
+                if (MAXDEBUG /* || this.name */) this.log("ready");
+                var fnReady = this.fnReady;
+                this.fnReady = null;
+                if (fnReady) fnReady();
+            }
+        }
+    }
+
+    /**
+     * isBusy(fCancel)
+     *
+     * Return the "busy" state of the component
+     *
+     * @this {Component}
+     * @param {boolean} [fCancel] is set to true to cancel a "busy" state
+     * @return {boolean} true if "busy", false if not
+     */
+    isBusy(fCancel) {
+        if (this.flags.busy) {
+            if (fCancel) {
+                this.flags.busyCancel = true;
+            } else if (fCancel === undefined) {
+                this.println(this.toString() + " busy");
+            }
+        }
+        return this.flags.busy;
+    }
+
+    /**
+     * setBusy(fBusy)
+     *
+     * Update the current busy state; if a busyCancel request is pending, it will be honored now.
+     *
+     * @this {Component}
+     * @param {boolean} fBusy
+     * @return {boolean}
+     */
+    setBusy(fBusy) {
+        if (this.flags.busyCancel) {
+            this.flags.busy = false;
+            this.flags.busyCancel = false;
+            return false;
+        }
+        if (this.flags.error) {
+            this.println(this.toString() + " error");
+            return false;
+        }
+        this.flags.busy = fBusy;
+        return this.flags.busy;
+    }
+
+    /**
+     * powerUp(fSave)
+     *
+     * @this {Component}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower] is true if this is "repower" notification
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower) {
+        this.flags.powered = true;
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {Component}
+     * @param {boolean} fSave
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown) {
+        if (fShutdown) this.flags.powered = false;
+        return true;
+    }
+
+    /**
+     * messageEnabled(bitsMessage)
+     *
+     * If bitsMessage is not specified, the component's MESSAGE category is used.
+     *
+     * @this {Component}
+     * @param {number} [bitsMessage] is zero or more MESSAGE_* category flag(s)
+     * @return {boolean} true if all specified message enabled, false if not
+     */
+    messageEnabled(bitsMessage) {
+        if (DEBUGGER && this.dbg) {
+            if (this === this.dbg) {
+                bitsMessage |= 0;
+            } else {
+                bitsMessage = bitsMessage || this.bitsMessage;
+            }
+            var bitsEnabled = this.dbg.bitsMessage & bitsMessage;
+            return (!!bitsMessage && bitsEnabled === bitsMessage || !!(bitsEnabled & this.dbg.bitsWarning));
+        }
+        return false;
+    }
+
+    /**
+     * printMessage(sMessage, bitsMessage, fAddress)
+     *
+     * If bitsMessage is not specified, the component's MESSAGE category is used.
+     * If bitsMessage is true, the message is displayed regardless.
+     *
+     * @this {Component}
+     * @param {string} sMessage is any caller-defined message string
+     * @param {number|boolean} [bitsMessage] is zero or more MESSAGE_* category flag(s)
+     * @param {boolean} [fAddress] is true to display the current address
+     */
+    printMessage(sMessage, bitsMessage, fAddress) {
+        if (DEBUGGER && this.dbg) {
+            if (bitsMessage === true || this.messageEnabled(bitsMessage | 0)) {
+                this.dbg.message(sMessage, fAddress);
+            }
+        }
+    }
+
+    /**
+     * printMessageIO(port, bOut, addrFrom, name, bIn, bitsMessage)
+     *
+     * If bitsMessage is not specified, the component's MESSAGE category is used.
+     * If bitsMessage is true, the message is displayed as long as MESSAGE.PORT is enabled.
+     *
+     * @this {Component}
+     * @param {number} port
+     * @param {number|null} bOut if an output operation
+     * @param {number|null} [addrFrom]
+     * @param {string|null} [name] of the port, if any
+     * @param {number|null} [bIn] is the input value, if known, on an input operation
+     * @param {number|boolean} [bitsMessage] is zero or more MESSAGE_* category flag(s)
+     */
+    printMessageIO(port, bOut, addrFrom, name, bIn, bitsMessage) {
+        if (DEBUGGER && this.dbg) {
+            if (bitsMessage === true) {
+                bitsMessage = 0;
+            } else if (bitsMessage == null) {
+                bitsMessage = this.bitsMessage;
+            }
+            this.dbg.messageIO(this, port, bOut, addrFrom, name, bIn, bitsMessage);
+        }
+    }
+}
+
+/*
+ * Every component created on the current page is recorded in this array (see Component.add()),
+ * enabling any component to locate another component by ID (see Component.getComponentByID())
+ * or by type (see Component.getComponentByType()).
+ *
+ * Every machine on the page are now recorded as well, by their machine ID.  We then record the
+ * various resources used by that machine.
+ *
+ * Includes a fallback for non-browser-based environments (ie, Node).  TODO: This will need to be
+ * tailored to Node, probably using the global object instead of the window object, if we ever want
+ * to support multi-machine configs in that environment.
+ */
+if (window) {
+    if (!window['PCjs']) window['PCjs'] = {};
+    if (!window['PCjs']['Machines']) window['PCjs']['Machines'] = {};
+    if (!window['PCjs']['Components']) window['PCjs']['Components'] = [];
+    if (!window['PCjs']['Commands']) window['PCjs']['Commands'] = {};
+}
+Component.machines = window? window['PCjs']['Machines'] : {};
+Component.components = window? window['PCjs']['Components'] : [];
+Component.commands = window? window['PCjs']['Commands'] : {};
+
+Component.asyncCommands = [
+    'hold', 'sleep', 'wait'
+];
+Component.globalCommands = {
+    'alert': Component.scriptAlert,
+    'sleep': Component.scriptSleep
+};
+Component.componentCommands = {
+    'select':   Component.scriptSelect
+};
+
+/*
+ * The following polyfills provide ES5 functionality that's missing in older browsers (eg, IE8),
+ * allowing PCjs apps to run without slamming into exceptions; however, due to the lack of HTML5 canvas
+ * support in those browsers, all you're likely to see are "soft" errors (eg, "Missing <canvas> support").
+ *
+ * Perhaps we can implement a text-only faux video display for a fun retro-browser experience someday.
+ *
+ * TODO: Come up with a better place to put these polyfills.  We will likely have more if we decide to
+ * make the leap from ES5 to ES6 features.
+ */
+
+/*
+ * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/indexOf
+ */
+if (!Array.prototype.indexOf) {
+    Array.prototype.indexOf = function(obj, start) {
+        for (var i = (start || 0), j = this.length; i < j; i++) {
+            if (this[i] === obj) { return i; }
+        }
+        return -1;
+    }
+}
+
+/*
+ * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/isArray
+ */
+if (!Array.isArray) {
+    Array.isArray = function(arg) {
+        return Object.prototype.toString.call(arg) === '[object Array]';
+    };
+}
+
+/*
+ * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/bind
+ */
+if (!Function.prototype.bind) {
+    Function.prototype.bind = function(obj) {
+        if (typeof this != "function") {
+            // Closest thing possible to the ECMAScript 5 internal IsCallable function
+            throw new TypeError("Function.prototype.bind: non-callable object");
+        }
+        var args = Array.prototype.slice.call(arguments, 1);
+        var fToBind = this;
+        var fnNOP = /** @constructor */ (function() {});
+        var fnBound = function() {
+            return fToBind.apply(this instanceof fnNOP && obj? this : obj, args.concat(Array.prototype.slice.call(arguments)));
+        };
+        fnNOP.prototype = this.prototype;
+        fnBound.prototype = new fnNOP();
+        return fnBound;
+    };
+}
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/c1pjs/lib/defines.js (C) Jeff Parsons 2012-2017
+ */
+
+/**
+ * @define {string}
+ */
+var APPCLASS = "c1pjs";         // this @define is the default application class (eg, "pcx86", "c1pjs")
+
+/**
+ * @define {string}
+ */
+var APPNAME = "C1Pjs";          // this @define is the default application name (eg, "PCx86", "C1Pjs")
+
+/**
+ * @define {boolean}
+ *
+ * WARNING: DEBUGGER needs to accurately reflect whether or not the Debugger component is (or will be) loaded.
+ * In the compiled case, we rely on the Closure Compiler to override DEBUGGER as appropriate.  When it's *false*,
+ * nearly all of debugger.js will be conditionally removed by the compiler, reducing it to little more than a
+ * "type skeleton", which also solves some type-related warnings we would otherwise have if we tried to remove
+ * debugger.js from the compilation process altogether.
+ *
+ * However, when we're in "development mode" and running uncompiled code in debugger-less configurations,
+ * I would like to skip loading debugger.js altogether.  When doing that, we must ALSO arrange for an additional file
+ * (nodebugger.js) to be loaded immediately after this file, which *explicitly* overrides DEBUGGER with *false*.
+ */
+var DEBUGGER = true;            // this @define is overridden by the Closure Compiler to remove Debugger-related support
+
+/*
+ * Combine all the shared globals and machine-specific globals into one machine-specific global object,
+ * which all machine components should start using; eg: "if (C1PJS.DEBUG) ..." instead of "if (DEBUG) ...".
+ */
+var C1PJS = {
+    APPCLASS:    APPCLASS,
+    APPNAME:     APPNAME,
+    APPVERSION:  APPVERSION,    // shared
+    COMPILED:    COMPILED,      // shared
+    CSSCLASS:    CSSCLASS,      // shared
+    DEBUG:       DEBUG,         // shared
+    DEBUGGER:    DEBUGGER,
+    MAXDEBUG:    MAXDEBUG,      // shared
+    PRIVATE:     PRIVATE,       // shared
+    SITEHOST:    SITEHOST,      // shared
+    XMLVERSION:  XMLVERSION     // shared
+};
+
+/**
+ * @copyright http://pcjs.org/modules/c1pjs/lib/panel.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class C1PPanel extends Component {
+    /**
+     * C1PPanel(parmsPanel)
+     *
+     * The Panel component has no required (parmsPanel) properties.
+     *
+     * @this {C1PPanel}
+     * @param {Object} parmsPanel
+     */
+    constructor(parmsPanel)
+    {
+        super("C1PPanel", parmsPanel);
+
+        this.flags.powered = false;
+    }
+
+    /**
+     * The Panel doesn't have any bindings of its own; it passes along all binding requests to
+     * the Computer, CPU, Keyboard and Debugger components. The order shouldn't matter, since any
+     * component that doesn't recognize the specified binding should simply ignore it.
+     *
+     * @this {C1PPanel}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "reset")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        if (this.cmp && this.cmp.setBinding(sHTMLType, sBinding, control, sValue)) return true;
+        if (this.cpu && this.cpu.setBinding(sHTMLType, sBinding, control, sValue)) return true;
+        if (this.kbd && this.kbd.setBinding(sHTMLType, sBinding, control, sValue)) return true;
+        if (DEBUGGER && this.dbg && this.dbg.setBinding(sHTMLType, sBinding, control, sValue)) return true;
+        return super.setBinding(sHTMLType, sBinding, control, sValue);
+    }
+
+    /**
+     * @this {C1PPanel}
+     * @param {boolean} fOn
+     * @param {C1PComputer} cmp
+     */
+    setPower(fOn, cmp)
+    {
+        if (fOn && !this.flags.powered) {
+            this.flags.powered = true;
+            this.cmp = cmp;
+            this.cpu = cmp.getComponentByType("cpu");
+            this.kbd = cmp.getComponentByType("keyboard");
+            if (DEBUGGER) this.dbg = cmp.getComponentByType("debugger");
+            C1PPanel.init();
+        }
+    }
+
+    /**
+     * C1PPanel.init()
+     *
+     * This function operates on every HTML element of class "panel", extracting the
+     * JSON-encoded parameters for the C1PPanel constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a C1PPanel component, and then binding
+     * any associated HTML controls to the new component.
+     *
+     * NOTE: Unlike most other component init() functions, this one is designed to be
+     * called multiple times: once at load time, so that we can binding our print()
+     * function to the panel's output control ASAP, and again when the C1PComputer component
+     * is verifying that all components are ready and invoking their setPower() functions.
+     *
+     * Our setPower() method gives us a second opportunity to notify any components that
+     * that might care (eg, C1PCPU, C1PKeyboard, and C1PDebugger) that we have some controls
+     * they might want to use.
+     */
+    static init()
+    {
+        var fReady = false;
+        var aePanels = Component.getElementsByClass(document, C1PJS.APPCLASS, "panel");
+        for (var iPanel=0; iPanel < aePanels.length; iPanel++) {
+            var ePanel = aePanels[iPanel];
+            var parmsPanel = Component.getComponentParms(ePanel);
+            var panel = Component.getComponentByID(parmsPanel['id']);
+            if (!panel) {
+                fReady = true;
+                panel = new C1PPanel(parmsPanel);
+            }
+            Component.bindComponentControls(panel, ePanel, C1PJS.APPCLASS);
+            if (fReady) panel.setReady();
+        }
+    }
+}
+
+/*
+ * Initialize every Panel module on the page.
+ */
+Web.onInit(C1PPanel.init);
+
+/**
+ * @copyright http://pcjs.org/modules/c1pjs/lib/cpu.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class C1PCPU extends Component {
+    /**
+     * C1PCPU(parmsCPU)
+     *
+     * The C1PCPU object has one component-specific initialization property:
+     *
+     *      autoStart: true to automatically start, false to not, or null (default)
+     *      to make the autoStart decision based on whether or not a Debugger is
+     *      installed (if there's no Debugger AND no "Run" button, then auto-start,
+     *      otherwise don't)
+     *
+     * It is hard-coded to simulate a 6502 microprocessor, but it also contains
+     * hooks into other components for communication with the outside world (eg,
+     * Panel and Debugger components). This is a logical simulation, not a physical
+     * simulation, and performance is important, so we take lots of liberties; any
+     * idiosyncrasies of actual 6502 hardware may not be simulated here, unless it
+     * affects the accuracy of the simulation when running actual 6502 software.
+     *
+     * @this {C1PCPU}
+     * @param {Object} parmsCPU
+     */
+    constructor(parmsCPU)
+    {
+        super("C1PCPU", parmsCPU);
+
+        this.clearRegs();
+        this.flags.powered = false;
+        this.flags.running = false;
+        this.fAutoStart = parmsCPU["autoStart"];
+
+        /*
+         * speed is a number from 0 to 2, where 0 means run as close to 1Mhz as possible,
+         * 1 means run at the fastest safe speed, and 2 means run at maximum speed.
+         *
+         * It's updated via the setSpeed() function, which the Debugger's "option" command
+         * uses to adjust the virtual speed (eg, "o slow", "o fast").  There may also
+         * be a button present to control the speed as well (using the "setSpeed" binding).
+         */
+        this.SPEED_SLOW = 0;        // see this.mhzSlow
+        this.SPEED_FAST = 1;        // see this.mhzFast
+        this.SPEED_MAX  = 2;
+        this.speed = this.SPEED_SLOW;
+        this.nCyclesPerSecond = 1000000;
+
+        /*
+         * Additional values that control the overall speed of the simulated hardware,
+         * and the frequency at which various updates should occur.  There are no UI
+         * mechanisms for tweaking these values (yet).
+         *
+         * NOTE: Use of the term "second" below refers to a virtual CPU second, consisting of
+         * 1 million simulated cycles.  The values below are used to divide those 1 million
+         * cycles into intervals of "work", and as long we are limiting the simulation to 1Mhz
+         * per ACTUAL second, then 1 virtual second == 1 real second.
+         *
+         * However, if the setSpeed() function is used to lift the 1Mhz limit, then 1 virtual
+         * second may become much shorter, which is why you may briefly notice the video and/or
+         * status (control panel) updates occurring more frequently. To compensate, calcCycles()
+         * will automatically scale these values if a recent speed recalculation reveals that
+         * we're running significantly faster than 1Mhz.
+         */
+        this.nYieldsPerSecond = 30;
+        this.nVideoUpdatesPerSecond = 30;
+        this.nStatusUpdatesPerSecond = 5;
+        this.mhzSlow = 1;
+        this.mhzFast = 8;
+        this.aSpeeds = ["Slow", "Fast", "Max"];
+        this.aSpeedDescs = ["(" + this.mhzSlow + "Mhz)", "(up to " + this.mhzFast + "Mhz)", "(unlimited)"];
+
+        /*
+         * Lists of notification handlers: aReadNotify and aWriteNotify are lists (ie, Arrays)
+         * of 4-element sub-arrays that, in turn, contain:
+         *
+         *      [0]: starting address of memory range to monitor
+         *      [1]: ending address of memory range to monitor (inclusive)
+         *      [2]: registered component
+         *      [3]: registered function to call for every read/write from/to memory in that range
+         *
+         * The virtual Serial Port and virtual Keyboard components use these handlers to trap
+         * references to their respective memory-based "ports".  Also, the ROM component uses it
+         * to "repair" any writes to its address range, since memory is one big array, and arrays
+         * don't support "write-only" regions.
+         *
+         * NOTE: the Video component does NOT use notification handlers, because video memory
+         * is written (and occasionally read) far too frequently for that to be efficient.  We
+         * just let the CPU pound on it like any other chunk of memory, and then make periodic
+         * calls directly to the Video component to refresh all portions of the video buffer
+         * that have changed since the last refresh. See displayVideo() for more details.
+         *
+         * WARNING: Write notifications currently do not catch STACK writes (ie, BRK, JSR, PHA and
+         * PHP instructions), because I simply haven't added the necessary code.  Besides, JSR is
+         * one of the most-executed instructions, so I'd rather not slow it down. Note that this
+         * STACK write limitation affects both the CPU's write-notification handlers AND the Debugger's
+         * write breakpoints.
+         */
+        this.aReadNotify = [];
+        this.aWriteNotify = [];
+
+        /*
+         * To speed up the processing of read and write notification handlers, we keep track of
+         * lower and upper address bounds for each set.  These variables maintain those bounds.
+         * They are initialized to values outside the accessible range of addresses.
+         */
+        this.addrReadLower = 0x10000;
+        this.addrReadUpper = 0x0;
+        this.addrWriteLower = 0x10000;
+        this.addrWriteUpper = 0x0;
+
+        /*
+         * Processor status register (P) flag masks
+         */
+        this.BIT_PN = 0x80;     // N = sign
+        this.BIT_PV = 0x40;     // V = overflow
+        this.BIT_PB = 0x10;     // B = break
+        this.BIT_PD = 0x08;     // D = decimal
+        this.BIT_PI = 0x04;     // I = interrupt
+        this.BIT_PZ = 0x02;     // Z = zero
+        this.BIT_PC = 0x01;     // C = carry
+
+     // this.VECTOR_NMI     = 0xfffa;
+        this.VECTOR_RESET   = 0xfffc;
+     // this.VECTOR_IRQ     = 0xfffe;
+
+        /*
+         * Popular opcodes
+         */
+        this.OP_JSR         = 0x20;
+
+        /*
+         * opSim operation codes
+         */
+        this.OP_SIM         = 0x02;
+        this.SIMOP_HLT      = 0x00;
+        this.SIMOP_MSG      = 0x01;
+
+        /*
+         * This 256-entry array of opcode functions is at the heart of the CPU engine: step(n).
+         *
+         * It might be worth trying a switch() statement instead, to see how the performance compares,
+         * but I suspect that will vary quite a bit across JavaScript engines; for now, I'm putting my
+         * money on array lookup.
+         */
+        this.aOpcodeFuncs = [
+            this.opBRK,         // 0x00
+            this.opORAindx,     // 0x01
+            this.opSim,         // 0x02
+            this.opUndefined,   // 0x03
+            this.opUndefined,   // 0x04
+            this.opORAzp,       // 0x05
+            this.opASLzp,       // 0x06
+            this.opUndefined,   // 0x07
+            this.opPHP,         // 0x08
+            this.opORAimm,      // 0x09
+            this.opASLacc,      // 0x0a
+            this.opUndefined,   // 0x0b
+            this.opUndefined,   // 0x0c
+            this.opORAabs,      // 0x0d
+            this.opASLabs,      // 0x0e
+            this.opUndefined,   // 0x0f
+            this.opBPL,         // 0x10
+            this.opORAindy,     // 0x11
+            this.opUndefined,   // 0x12
+            this.opUndefined,   // 0x13
+            this.opUndefined,   // 0x14
+            this.opORAzpx,      // 0x15
+            this.opASLzpx,      // 0x16
+            this.opUndefined,   // 0x17
+            this.opCLC,         // 0x18
+            this.opORAabsy,     // 0x19
+            this.opUndefined,   // 0x1a
+            this.opUndefined,   // 0x1b
+            this.opUndefined,   // 0x1c
+            this.opORAabsx,     // 0x1d
+            this.opASLabsx,     // 0x1e
+            this.opUndefined,   // 0x1f
+            this.opJSRabs,      // 0x20
+            this.opANDindx,     // 0x21
+            this.opUndefined,   // 0x22
+            this.opUndefined,   // 0x23
+            this.opBITzp,       // 0x24
+            this.opANDzp,       // 0x25
+            this.opROLzp,       // 0x26
+            this.opUndefined,   // 0x27
+            this.opPLP,         // 0x28
+            this.opANDimm,      // 0x29
+            this.opROLacc,      // 0x2a
+            this.opUndefined,   // 0x2b
+            this.opBITabs,      // 0x2c
+            this.opANDabs,      // 0x2d
+            this.opROLabs,      // 0x2e
+            this.opUndefined,   // 0x2f
+            this.opBMI,         // 0x30
+            this.opANDindy,     // 0x31
+            this.opUndefined,   // 0x32
+            this.opUndefined,   // 0x33
+            this.opUndefined,   // 0x34
+            this.opANDzpx,      // 0x35
+            this.opROLzpx,      // 0x36
+            this.opUndefined,   // 0x37
+            this.opSEC,         // 0x38
+            this.opANDabsy,     // 0x39
+            this.opUndefined,   // 0x3a
+            this.opUndefined,   // 0x3b
+            this.opUndefined,   // 0x3c
+            this.opANDabsx,     // 0x3d
+            this.opROLabsx,     // 0x3e
+            this.opUndefined,   // 0x3f
+            this.opRTI,         // 0x40
+            this.opEORindx,     // 0x41
+            this.opUndefined,   // 0x42
+            this.opUndefined,   // 0x43
+            this.opUndefined,   // 0x44
+            this.opEORzp,       // 0x45
+            this.opLSRzp,       // 0x46
+            this.opUndefined,   // 0x47
+            this.opPHA,         // 0x48
+            this.opEORimm,      // 0x49
+            this.opLSRacc,      // 0x4a
+            this.opUndefined,   // 0x4b
+            this.opJMPimm16,    // 0x4c
+            this.opEORabs,      // 0x4d
+            this.opLSRabs,      // 0x4e
+            this.opUndefined,   // 0x4f
+            this.opBVC,         // 0x50
+            this.opEORindy,     // 0x51
+            this.opUndefined,   // 0x52
+            this.opUndefined,   // 0x53
+            this.opUndefined,   // 0x54
+            this.opEORzpx,      // 0x55
+            this.opLSRzpx,      // 0x56
+            this.opUndefined,   // 0x57
+            this.opCLI,         // 0x58
+            this.opEORabsy,     // 0x59
+            this.opUndefined,   // 0x5a
+            this.opUndefined,   // 0x5b
+            this.opUndefined,   // 0x5c
+            this.opEORabsx,     // 0x5d
+            this.opLSRabsx,     // 0x5e
+            this.opUndefined,   // 0x5f
+            this.opRTS,         // 0x60
+            this.opADCindx,     // 0x61
+            this.opUndefined,   // 0x62
+            this.opUndefined,   // 0x63
+            this.opUndefined,   // 0x64
+            this.opADCzp,       // 0x65
+            this.opRORzp,       // 0x66
+            this.opUndefined,   // 0x67
+            this.opPLA,         // 0x68
+            this.opADCimm,      // 0x69
+            this.opRORacc,      // 0x6a
+            this.opUndefined,   // 0x6b
+            this.opJMPabs16,    // 0x6c
+            this.opADCabs,      // 0x6d
+            this.opRORabs,      // 0x6e
+            this.opUndefined,   // 0x6f
+            this.opBVS,         // 0x70
+            this.opADCindy,     // 0x71
+            this.opUndefined,   // 0x72
+            this.opUndefined,   // 0x73
+            this.opUndefined,   // 0x74
+            this.opADCzpx,      // 0x75
+            this.opRORzpx,      // 0x76
+            this.opUndefined,   // 0x77
+            this.opSEI,         // 0x78
+            this.opADCabsy,     // 0x79
+            this.opUndefined,   // 0x7a
+            this.opUndefined,   // 0x7b
+            this.opUndefined,   // 0x7c
+            this.opADCabsx,     // 0x7d
+            this.opRORabsx,     // 0x7e
+            this.opUndefined,   // 0x7f
+            this.opUndefined,   // 0x80
+            this.opSTAindx,     // 0x81
+            this.opUndefined,   // 0x82
+            this.opUndefined,   // 0x83
+            this.opSTYzp,       // 0x84
+            this.opSTAzp,       // 0x85
+            this.opSTXzp,       // 0x86
+            this.opUndefined,   // 0x87
+            this.opDEY,         // 0x88
+            this.opUndefined,   // 0x89
+            this.opTXA,         // 0x8a
+            this.opUndefined,   // 0x8b
+            this.opSTYabs,      // 0x8c
+            this.opSTAabs,      // 0x8d
+            this.opSTXabs,      // 0x8e
+            this.opUndefined,   // 0x8f
+            this.opBCC,         // 0x90
+            this.opSTAindy,     // 0x91
+            this.opUndefined,   // 0x92
+            this.opUndefined,   // 0x93
+            this.opSTYzpx,      // 0x94
+            this.opSTAzpx,      // 0x95
+            this.opSTXzpy,      // 0x96
+            this.opUndefined,   // 0x97
+            this.opTYA,         // 0x98
+            this.opSTAabsy,     // 0x99
+            this.opTXS,         // 0x9a
+            this.opUndefined,   // 0x9b
+            this.opUndefined,   // 0x9c
+            this.opSTAabsx,     // 0x9d
+            this.opUndefined,   // 0x9e
+            this.opUndefined,   // 0x9f
+            this.opLDYimm,      // 0xa0
+            this.opLDAindx,     // 0xa1
+            this.opLDXimm,      // 0xa2
+            this.opUndefined,   // 0xa3
+            this.opLDYzp,       // 0xa4
+            this.opLDAzp,       // 0xa5
+            this.opLDXzp,       // 0xa6
+            this.opUndefined,   // 0xa7
+            this.opTAY,         // 0xa8
+            this.opLDAimm,      // 0xa9
+            this.opTAX,         // 0xaa
+            this.opUndefined,   // 0xab
+            this.opLDYabs,      // 0xac
+            this.opLDAabs,      // 0xad
+            this.opLDXabs,      // 0xae
+            this.opUndefined,   // 0xaf
+            this.opBCS,         // 0xb0
+            this.opLDAindy,     // 0xb1
+            this.opUndefined,   // 0xb2
+            this.opUndefined,   // 0xb3
+            this.opLDYzpx,      // 0xb4
+            this.opLDAzpx,      // 0xb5
+            this.opLDXzpy,      // 0xb6
+            this.opUndefined,   // 0xb7
+            this.opCLV,         // 0xb8
+            this.opLDAabsy,     // 0xb9
+            this.opTSX,         // 0xba
+            this.opUndefined,   // 0xbb
+            this.opLDYabsx,     // 0xbc
+            this.opLDAabsx,     // 0xbd
+            this.opLDXabsy,     // 0xbe
+            this.opUndefined,   // 0xbf
+            this.opCPYimm,      // 0xc0
+            this.opCMPindx,     // 0xc1
+            this.opUndefined,   // 0xc2
+            this.opUndefined,   // 0xc3
+            this.opCPYzp,       // 0xc4
+            this.opCMPzp,       // 0xc5
+            this.opDECzp,       // 0xc6
+            this.opUndefined,   // 0xc7
+            this.opINY,         // 0xc8
+            this.opCMPimm,      // 0xc9
+            this.opDEX,         // 0xca
+            this.opUndefined,   // 0xcb
+            this.opCPYabs,      // 0xcc
+            this.opCMPabs,      // 0xcd
+            this.opDECabs,      // 0xce
+            this.opUndefined,   // 0xcf
+            this.opBNE,         // 0xd0
+            this.opCMPindy,     // 0xd1
+            this.opUndefined,   // 0xd2
+            this.opUndefined,   // 0xd3
+            this.opUndefined,   // 0xd4
+            this.opCMPzpx,      // 0xd5
+            this.opDECzpx,      // 0xd6
+            this.opUndefined,   // 0xd7
+            this.opCLD,         // 0xd8
+            this.opCMPabsy,     // 0xd9
+            this.opUndefined,   // 0xda
+            this.opUndefined,   // 0xdb
+            this.opUndefined,   // 0xdc
+            this.opCMPabsx,     // 0xdd
+            this.opDECabsx,     // 0xde
+            this.opUndefined,   // 0xdf
+            this.opCPXimm,      // 0xe0
+            this.opSBCindx,     // 0xe1
+            this.opUndefined,   // 0xe2
+            this.opUndefined,   // 0xe3
+            this.opCPXzp,       // 0xe4
+            this.opSBCzp,       // 0xe5
+            this.opINCzp,       // 0xe6
+            this.opUndefined,   // 0xe7
+            this.opINX,         // 0xe8
+            this.opSBCimm,      // 0xe9
+            this.opNOP,         // 0xea
+            this.opUndefined,   // 0xeb
+            this.opCPXabs,      // 0xec
+            this.opSBCabs,      // 0xed
+            this.opINCabs,      // 0xee
+            this.opUndefined,   // 0xef
+            this.opBEQ,         // 0xf0
+            this.opSBCindy,     // 0xf1
+            this.opUndefined,   // 0xf2
+            this.opUndefined,   // 0xf3
+            this.opUndefined,   // 0xf4
+            this.opSBCzpx,      // 0xf5
+            this.opINCzpx,      // 0xf6
+            this.opUndefined,   // 0xf7
+            this.opSED,         // 0xf8
+            this.opSBCabsy,     // 0xf9
+            this.opUndefined,   // 0xfa
+            this.opUndefined,   // 0xfb
+            this.opUndefined,   // 0xfc
+            this.opSBCabsx,     // 0xfd
+            this.opINCabsx,     // 0xfe
+            this.opUndefined    // 0xff
+        ];
+        /*
+         * This is a 256-byte array of cycle counts, indexed by opcode.
+         * Obviously, true cycle counts are a bit more complicated, but this
+         * gets us most of the way to an authentic-feeling simulation.
+         *
+         * NOTE: BCD functions now account for an extra cycle, and branches
+         * now account for an extra cycle whenever the branch is taken.
+         * However, branches still don't add an extra cycle whenever the branch
+         * crosses a page boundary.
+         *
+         * The other gaping hole in our cycle-counting is accounting for all
+         * page-boundary penalties.  Ideally, that's just a matter of checking
+         * MODE_ABSX, MODE_ABSY, and MODE_INDY instructions for EA straddling
+         * a page boundary--but is it more complicated than that? What if the
+         * criteria is not the final EA, but whether the pre-indexing and
+         * post-indexing EAs are in different pages? I also need to confirm
+         * whether any other situations merit checking (eg, when a 2 or 3-byte
+         * instruction straddles a page boundary).
+         */
+        this.aOpcodeCycles = [
+            7,6,0,0,0,3,5,0,3,2,2,0,0,4,6,0,
+            2,5,0,0,0,4,6,0,2,4,0,0,0,4,7,0,
+            3,6,0,0,3,3,5,0,4,2,2,0,4,4,6,0,
+            2,5,0,0,0,4,6,0,2,4,0,0,0,4,7,0,
+            6,6,0,0,0,3,5,0,3,2,2,0,3,4,6,0,
+            2,5,0,0,0,4,6,0,2,4,0,0,0,4,7,0,
+            6,6,0,0,0,3,5,0,4,2,2,0,5,4,6,0,
+            2,5,0,0,0,4,6,0,2,4,0,0,0,4,7,0,
+            0,6,0,0,3,3,3,0,2,0,2,0,4,4,4,0,
+            2,5,0,0,4,4,4,0,2,4,2,0,0,4,0,0,
+            2,6,2,0,3,3,3,0,2,2,2,0,4,4,4,0,
+            2,5,0,0,4,4,4,0,2,4,2,0,4,4,4,0,
+            2,6,0,0,3,3,5,0,2,2,2,0,4,4,6,0,
+            2,5,0,0,0,4,6,0,2,4,0,0,0,4,7,0,
+            2,6,0,0,3,3,5,0,2,2,2,0,4,4,6,0,
+            2,5,0,0,0,4,6,0,2,4,0,0,0,4,7,0
+        ];
+    }
+
+    /**
+     * reset(fPowerOn)
+     *
+     * Note that we follow the same model here as other selected reset() handlers; for example, Video.reset()
+     * accepts an fPowerOn parameter to govern what's initially displayed on the video screen.
+     *
+     * @this {C1PCPU}
+     * @param {boolean|undefined} fPowerOn is true for the initial reset, so that if the Debugger isn't
+     * loaded, we can elect to start running.  Under any other circumstances (such as whenever Computer.reset()
+     * is called), "auto-run" is not a good idea, and can actually introduce bugs (eg, multiple run() timers).
+     */
+    reset(fPowerOn)
+    {
+        if (this.flags.running) {
+            this.halt();
+        }
+        this.clearRegs();
+        this.regPC = this.getWord(this.VECTOR_RESET);
+        this.clearError();              // clear any fatal error/exception
+        /*
+         * If there's a Debugger, notify Debugger.reset(); otherwise, start running
+         */
+        if (DEBUGGER && this.dbg) {
+            this.dbg.reset();
+        }
+        else if (fPowerOn) {
+            if (this.fAutoStart === true || this.fAutoStart === null && (!DEBUGGER || !this.dbg) && this.bindings["run"] === undefined) {
+                this.run();             // start running automatically on the initial power-up, assuming there's no Debugger
+            }
+        }
+    }
+
+    /**
+     * @this {C1PCPU}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "run")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        var fBound = false;
+        switch(sBinding) {
+            case "run":
+                this.bindings[sBinding] = control;
+                control.onclick = function(cpu) {
+                    return function() {
+                        if (!cpu.flags.running) {
+                            cpu.run();
+                        } else {
+                            cpu.halt();
+                        }
+                    };
+                }(this);
+                fBound = true;
+                break;
+            case "A": case "X": case "Y": case "S": case "PC":
+            case "C": case "Z": case "I": case "D": case "B": case "V": case "N":
+            case "speed":
+                this.bindings[sBinding] = control;
+                fBound = true;
+                break;
+            case "setSpeed":
+                this.bindings[sBinding] = control;
+                control.onclick = function(cpu) {
+                    return function() {
+                        var speed = (cpu.speed >= cpu.SPEED_MAX? cpu.SPEED_SLOW : cpu.speed+1);
+                        cpu.setSpeed(speed, true);
+                    };
+                }(this);
+                fBound = true;
+                break;
+            default:
+                break;
+        }
+        return fBound;
+    }
+
+    /**
+     * @this {C1PCPU}
+     * @param {Array} abMemory
+     * @param {number} start
+     * @param {number} end
+     */
+    setBuffer(abMemory, start, end)
+    {
+        this.abMem = abMemory;
+        this.offMem = start;
+        this.cbMem = end - start + 1;
+        this.offLimit = this.offMem + this.cbMem;
+        if (this.offMem) {
+            /*
+             * It's not that we couldn't support an address buffer that starts at a non-zero offset;
+             * we simply have lots of code (eg, all the opcode handlers) that assumes offMem is zero,
+             * and therefore that abMem can be indexed by any of the CPU registers without adding offMem.
+             * All that code would have to be changed (at a slight performance penalty) if we couldn't
+             * make this assumption.
+             */
+            Component.error("unsupported CPU address buffer offset (" + this.offMem + ")");
+            return;
+        }
+        this.setReady();
+    }
+
+    /**
+     * @this {C1PCPU}
+     * @param {boolean} fOn
+     * @param {C1PComputer} cmp
+     */
+    setPower(fOn, cmp)
+    {
+        if (fOn && !this.flags.powered) {
+            this.cmp = cmp;
+            /*
+             * Attach the Debugger, if any, to the CPU, so that the CPU can periodically
+             * notify it as needed (when the CPU starts, stops, and executes instructions)
+             */
+            if (DEBUGGER) {
+                this.dbg = cmp.getComponentByType("debugger");
+                if (this.dbg)
+                    this.dbg.init();
+            }
+            /*
+             * Attach the Video device to the CPU, so that the CPU can periodically update
+             * the video display via displayVideo(), as cycles permit.
+             */
+            var video = cmp.getComponentByType("video");
+            if (video) {
+                this.displayVideo = function(v) {
+                    return function() {
+                        v.updateScreen();
+                    };
+                }(video);
+                this.setFocus = function(v) {
+                    return function() {
+                        v.setFocus();
+                    };
+                }(video);
+            }
+            this.flags.powered = true;
+            this.reset(true);
+            this.update();
+        }
+    }
+
+    /**
+     * Add a memory read-notification handler to the CPU's list of such handlers.
+     *
+     * @this {C1PCPU}
+     * @param {number} start address
+     * @param {number} end address
+     * @param {Component} component
+     * @param {function(number,number)} fn is called with the EA and PC values at the time of the write
+     */
+    addReadNotify(start, end, component, fn)
+    {
+        if (this.findNotify(this.aReadNotify, start, end, component, fn) < 0) {
+            if (this.addrReadLower > start)
+                this.addrReadLower = start;
+            if (this.addrReadUpper < end)
+                this.addrReadUpper = end;
+            this.aReadNotify.push([start, end, component, fn]);
+            if (DEBUG) this.log("addReadNotify(" + Str.toHexWord(start) + "," + Str.toHexWord(end) + "," + component.id + "): new read range: " + Str.toHexWord(this.addrReadLower) + "-" + Str.toHexWord(this.addrReadUpper));
+        }
+    }
+
+    /**
+     * @this {C1PCPU}
+     * @param {number} addrRead is the EA value at the time of the read
+     * @param {number} [addrFrom] is the PC value at the time of the read;
+     * this will be undefined for read notifications triggered by assorted Debugger commands,
+     * so all handlers should be prepared for that as well.
+     */
+    checkReadNotify(addrRead, addrFrom)
+    {
+        for (var i=0; i < this.aReadNotify.length; i++) {
+            if (addrRead >= this.aReadNotify[i][0] && addrRead <= this.aReadNotify[i][1]) {
+                this.aReadNotify[i][3].call(this.aReadNotify[i][2], addrRead, addrFrom);
+            }
+        }
+    }
+
+    /**
+     * Remove a memory read-notification handler from the CPU's list of such handlers.
+     *
+     * @this {C1PCPU}
+     * @param {number} start address
+     * @param {number} end address
+     * @param {Component} component
+     * @param {function(number,number)} fn of previously added handler
+     * @return {boolean} true if remove was successful, false if the handler was not found
+     */
+    removeReadNotify(start, end, component, fn)
+    {
+        var aBounds = this.removeNotify(this.aReadNotify, start, end, component, fn);
+        if (aBounds.length == 4) {
+            this.addrReadLower = aBounds[2];
+            this.addrReadUpper = aBounds[3];
+            if (DEBUG) this.log("removeReadNotify(" + Str.toHexWord(start) + "," + Str.toHexWord(end) + "," + component.id + "): new read range: " + Str.toHexWord(this.addrReadLower) + "-" + Str.toHexWord(this.addrReadUpper));
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * Add a memory write-notification handler to the CPU's list of such handlers.
+     *
+     * @this {C1PCPU}
+     * @param {number} start address
+     * @param {number} end address
+     * @param {Component} component
+     * @param {function(number,number)} fn is called with the EA and PC values at the time of the write
+     */
+    addWriteNotify(start, end, component, fn)
+    {
+        if (this.findNotify(this.aWriteNotify, start, end, component, fn) < 0) {
+            if (this.addrWriteLower > start)
+                this.addrWriteLower = start;
+            if (this.addrWriteUpper < end)
+                this.addrWriteUpper = end;
+            this.aWriteNotify.push([start, end, component, fn]);
+            if (DEBUG) this.log("addWriteNotify(" + Str.toHexWord(start) + "," + Str.toHexWord(end) + "," + component.id + "): new write range: " + Str.toHexWord(this.addrWriteLower) + "-" + Str.toHexWord(this.addrWriteUpper));
+        }
+    }
+
+    /**
+     * @this {C1PCPU}
+     * @param {number} addrWrite is the EA value at the time of the write
+     * @param {number} [addrFrom] is the PC value at the time of the write;
+     * this will be undefined for write notifications triggered by assorted Debugger commands,
+     * so all handlers should be prepared for that as well.
+     */
+    checkWriteNotify(addrWrite, addrFrom)
+    {
+        for (var i=0; i < this.aWriteNotify.length; i++) {
+            if (addrWrite >= this.aWriteNotify[i][0] && addrWrite <= this.aWriteNotify[i][1]) {
+                this.aWriteNotify[i][3].call(this.aWriteNotify[i][2], addrWrite, addrFrom);
+            }
+        }
+    }
+
+    /**
+     * Remove a memory write-notification handler from the CPU's list of such handlers.
+     *
+     * @this {C1PCPU}
+     * @param {number} start address
+     * @param {number} end address
+     * @param {Component} component
+     * @param {function(number,number)} fn of previously added handler
+     * @return {boolean} true if remove was successful, false if the handler was not found
+     */
+    removeWriteNotify(start, end, component, fn)
+    {
+        var aBounds = this.removeNotify(this.aWriteNotify, start, end, component, fn);
+        if (aBounds.length == 4) {
+            this.addrWriteLower = aBounds[2];
+            this.addrWriteUpper = aBounds[3];
+            if (DEBUG) this.log("removeWriteNotify(" + Str.toHexWord(start) + "," + Str.toHexWord(end) + "," + component.id + "): new write range: " + Str.toHexWord(this.addrWriteLower) + "-" + Str.toHexWord(this.addrWriteUpper));
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * Find a memory notification handler from the given array of handlers
+     *
+     * @this {C1PCPU}
+     * @param {Array} aNotify array of handlers
+     * @param {number} start address
+     * @param {number} end address
+     * @param {Component} component
+     * @param {function(number,number)} fn of previously added handler
+     * @return {number} index of the matching handler, or -1 if not found
+     */
+    findNotify(aNotify, start, end, component, fn)
+    {
+        for (var i=0; i < aNotify.length; i++) {
+            if (aNotify[i][0] == start && aNotify[i][1] == end && aNotify[i][2] == component && aNotify[i][3] == fn) {
+                return i;
+            }
+        }
+        return -1;
+    }
+
+    /**
+     * Remove a memory notification handler from the given array of handlers
+     *
+     * @this {C1PCPU}
+     * @param {Array} aNotify array of handlers
+     * @param {number} start address
+     * @param {number} end address
+     * @param {Component} component
+     * @param {function(number,number)} fn of previously added handler
+     * @return {Array} bounds of previous handler ([0] and [1]) and new lower and upper address bounds ([2] and [3])
+     */
+    removeNotify(aNotify, start, end, component, fn)
+    {
+        var aBounds = [];
+        var i = this.findNotify(aNotify, start, end, component, fn);
+        if (i >= 0) {
+            aBounds.push(aNotify[i][0]);
+            aBounds.push(aNotify[i][1]);
+            aNotify.splice(i, 1);
+            var addrLower = 0x10000, addrUpper = 0x0;
+            for (i=0; i < aNotify.length; i++) {
+                if (addrLower > aNotify[i][0])
+                    addrLower = aNotify[i][0];
+                if (addrUpper < aNotify[i][1])
+                    addrUpper = aNotify[i][1];
+            }
+            aBounds.push(addrLower);
+            aBounds.push(addrUpper);
+        }
+        return aBounds;
+    }
+
+    /**
+     * @this {C1PCPU}
+     * @param {number} [speed] is one of: 0 (slow), 1 (fast) or 2 (maximum)
+     * @param {boolean} [fOnClick] is true if called from a click handler that might have stolen focus
+     * @desc Whenever the speed is changed, the running cycle count and corresponding start time must be reset,
+     * so that the next effective speed calculation obtains sensible results.  In fact, when run() initially calls
+     * setSpeed() with no parameters, that's all this function does (it doesn't change the current speed setting).
+     */
+    setSpeed(speed, fOnClick)
+    {
+        if (speed !== undefined) {
+            this.speed = speed;
+            if (this.bindings["setSpeed"])
+                this.bindings["setSpeed"].innerHTML = this.aSpeeds[speed >= 2? 0 : speed+1];
+            this.println("running at " + this.aSpeeds[speed].toLowerCase() + " speed " + this.aSpeedDescs[speed]);
+            if (fOnClick) this.setFocus();
+        }
+        this.nRunCycles = 0;
+        this.msRunStart = Usr.getTime();
+        this.calcCycles();
+    }
+
+    /**
+     * @this {C1PCPU}
+     * @param {number} nCycles
+     * @param {number} msElapsed
+     */
+    calcSpeed(nCycles, msElapsed)
+    {
+        if (msElapsed) {
+            this.mhz = Math.round(nCycles / ( msElapsed * 100)) / 10;
+            if (msElapsed >= 86400000)
+                this.setSpeed();        // reset all our counters once per day so that we never have to worry about overflow
+        }
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    displayVideo()
+    {
+        // Nothing to do until setPower() installs a replacement function
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    setFocus()
+    {
+        // Nothing to do until setPower() installs a replacement function
+    }
+
+    /**
+     * @this {C1PCPU}
+     * @param {string} sReg
+     * @param {number} vReg
+     * @param {number} [len]
+     */
+    displayReg(sReg, vReg, len)
+    {
+        if (this.bindings[sReg] !== undefined) {
+            if (len === undefined) len = 1;
+            var s = "0000" + vReg.toString(16);
+            this.bindings[sReg].innerHTML = s.slice(s.length-len).toUpperCase();
+        }
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    displayStatus()
+    {
+        this.displayReg("A", this.regA, 2);
+        this.displayReg("X", this.regX, 2);
+        this.displayReg("Y", this.regY, 2);
+        var regP = this.getRegP();
+        this.displayReg("C", (regP & this.BIT_PC)? 1 : 0);
+        this.displayReg("Z", (regP & this.BIT_PZ)? 1 : 0);
+        this.displayReg("I", (regP & this.BIT_PI)? 1 : 0);
+        this.displayReg("D", (regP & this.BIT_PD)? 1 : 0);
+        this.displayReg("B", (regP & this.BIT_PB)? 1 : 0);
+        this.displayReg("V", (regP & this.BIT_PV)? 1 : 0);
+        this.displayReg("N", (regP & this.BIT_PN)? 1 : 0);
+        this.displayReg("S", this.regS, 4);
+        this.displayReg("PC", this.regPC, 4);
+        if (this.bindings["speed"] && this.mhz) {
+            this.bindings["speed"].innerHTML = this.mhz.toFixed(1) + "Mhz";
+        }
+    }
+
+    /**
+     * @this {C1PCPU}
+     * @return {boolean}
+     */
+    isRunning()
+    {
+        return this.flags.running;
+    }
+
+    /**
+     * Calculate the number of cycles to process for each "burst" of CPU activity.  The size of a burst
+     * is driven by the following values:
+     *
+     *      nYieldsPerSecond (eg, 30)
+     *      nVideoUpdatesPerSecond (eg, 30)
+     *      nStatusUpdatesPerSecond (eg, 5)
+     *
+     * The largest of the above values forces the size of the burst to its smallest value.  Let's say that
+     * largest value is 30.  Assuming nCyclesPerSecond is 1,000,000, that results in bursts of 33,333 cycles.
+     *
+     * At the end of each burst, we subtract burst cycles from yield, video, and status cycle "threshold"
+     * counters. Whenever the "next yield" cycle counter goes to (or below) zero, we compare elapsed time
+     * to the time we expected the virtual hardware to take (eg, 1000ms/50 or 20ms), and if we still have time
+     * remaining, we sleep the remaining time (or 0ms if there's no remaining time), and then restart run().
+     *
+     * Similarly, whenever the "next video update" cycle counter goes to (or below) zero, we call displayVideo(),
+     * and whenever the "next status update" cycle counter goes to (or below) zero, we call displayStatus().
+     *
+     * @this {C1PCPU}
+     * @param {boolean} [fRecalc] is true if the caller wants to recalculate thresholds based on the
+     * most recent mhz calculation (see calcSpeed)
+     */
+    calcCycles(fRecalc)
+    {
+        /*
+         * Calculate the most cycles we're allowed to execute in a single "burst"
+         */
+        var nMostUpdatesPerSecond = this.nYieldsPerSecond;
+        if (nMostUpdatesPerSecond < this.nVideoUpdatesPerSecond) nMostUpdatesPerSecond = this.nVideoUpdatesPerSecond;
+        if (nMostUpdatesPerSecond < this.nStatusUpdatesPerSecond) nMostUpdatesPerSecond = this.nStatusUpdatesPerSecond;
+
+        /*
+         * Calculate "per" values for the yield, video update, and status update cycle counters
+         */
+        var vMultiplier = 1;
+        if (fRecalc && this.speed > this.SPEED_SLOW && this.mhz) vMultiplier = this.mhz;
+        if (vMultiplier > this.mhzFast && this.speed < this.SPEED_MAX) vMultiplier = this.mhzFast;
+
+        this.msPerYield = Math.round(1000/this.nYieldsPerSecond);
+        this.nCyclesPerBurst = Math.floor(this.nCyclesPerSecond / nMostUpdatesPerSecond * vMultiplier);
+        this.nCyclesPerYield = Math.floor(this.nCyclesPerSecond / this.nYieldsPerSecond * vMultiplier);
+        this.nCyclesPerVideoUpdate = Math.floor(this.nCyclesPerSecond / this.nVideoUpdatesPerSecond * vMultiplier);
+        this.nCyclesPerStatusUpdate = Math.floor(this.nCyclesPerSecond / this.nStatusUpdatesPerSecond * vMultiplier);
+
+        /*
+         * And initialize "next" yield, video update, and status update cycle "threshold" counters to those "per" values
+         */
+        if (!fRecalc) {
+            this.nCyclesNextYield = this.nCyclesPerYield;
+            this.nCyclesNextVideoUpdate = this.nCyclesPerVideoUpdate;
+            this.nCyclesNextStatusUpdate = this.nCyclesPerStatusUpdate;
+        }
+        this.nRecalcCycles = 0;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    calcStartTime()
+    {
+        if (this.nRecalcCycles >= this.nCyclesPerSecond) {
+            this.calcCycles(true);
+        }
+        this.nCyclesThisRun = 0;
+        this.msStartThisRun = Usr.getTime();
+    }
+
+    /**
+     * @this {C1PCPU}
+     * @return {number}
+     */
+    calcRemainingTime()
+    {
+        var msCurrent = Usr.getTime();
+        var msYield = this.msPerYield;
+
+        if (this.nCyclesThisRun) {
+            /*
+             * Normally, we would assume we executed a full quota of work over msPerYield, but since the CPU
+             * now has the option of calling yieldCPU(), that might not be true.  If nCyclesThisRun is correct, then
+             * the ratio of nCyclesThisRun/nCyclesPerYield should represent the percentage of work we performed,
+             * and so applying that percentage to msPerYield should give us a better estimate of work vs. time.
+             */
+            msYield = Math.round(msYield * this.nCyclesThisRun / this.nCyclesPerYield);
+            // if (msYield < this.msPerYield) this.println("scaling msPerYield (" + this.msPerYield + ") to msYield (" + msYield + ")");
+        }
+
+        var msElapsedThisRun = msCurrent - this.msStartThisRun;
+        var msRemainsThisRun = msYield - msElapsedThisRun;
+
+        /*
+         * We could pass only "this run" results to calcSpeed():
+         *
+         *      nCycles = this.nCyclesThisRun;
+         *      msElapsed = msElapsedThisRun;
+         *
+         * but it seems preferable to use longer time periods and hopefully get a more accurate speed.
+         *
+         * Also, if msRemainsThisRun >= 0 && this.speed == this.SPEED_SLOW, we could pass these results instead:
+         *
+         *      nCycles = this.nCyclesThisRun;
+         *      msElapsed = this.msPerYield;
+         *
+         * to insure that we display a smooth, constant 1Mhz.  But the displayed speed seems pretty steady as-is.
+         */
+        var nCycles = this.nRunCycles;
+        var msElapsed = msCurrent - this.msRunStart;
+
+        if (DEBUG && msRemainsThisRun < 0 && this.speed == this.SPEED_FAST) {
+            this.println("warning: updates @" + msElapsedThisRun + "ms (prefer " + Math.round(msYield) + "ms)");
+        }
+
+        this.calcSpeed(nCycles, msElapsed);
+
+        if (msRemainsThisRun < 0) {
+            /*
+             * This is an easy case: it's taking more than 1 second to simulate 1Mhz,
+             * so all we can do is yield for as little time as possible (ie, 0ms) and hope the
+             * simulation is at least usable.
+             */
+            msRemainsThisRun = 0;
+        }
+        else {
+            if (this.speed == this.SPEED_FAST) {
+                /*
+                 * This case requires us to artificially limit the CPU speed.  calcSpeed()
+                 * already cranks up the number of cycles we process per burst, in proportion
+                 * to the effective mhz, so there isn't much to do here except sleep for
+                 * whatever time is in msRemainsThisRun.
+                 *
+                 * The artificial limit was chosen largely because it's not currently possible
+                 * for the keyboard component to inject keys fast enough to avoid duplicate
+                 * keystrokes at higher speeds. Perhaps with future improvements to the keyboard
+                 * component, this limit can be lifted.
+                 */
+                if (this.mhz <= this.mhzFast)
+                    msRemainsThisRun = 0;
+            }
+            else
+            if (this.speed == this.SPEED_MAX) {
+                /*
+                 * This is also an easy case: yield for as little time as possible (ie, 0ms), to execute
+                 * the maximum number of cycles per second.
+                 */
+                msRemainsThisRun = 0;
+            }
+        }
+
+        /*
+         * Last but not least, update nRecalcCycles, so that when run() starts up again and calls calcStartTime(),
+         * it'll be ready to decide if calcCycles() should be called again.
+         */
+        this.nRecalcCycles += this.nCyclesThisRun;
+
+        return msRemainsThisRun;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    run()
+    {
+        if (!this.setBusy(true)) {
+            this.update();
+            if (this.cmp) this.cmp.stop(this.msRunStart, this.nRunCycles);
+            return;
+        }
+        if (!this.flags.running) {
+            /*
+             *  setSpeed() without a speed parameter leaves the selected speed in place, but also resets the
+             *  cycle counter and timestamp for the current series of run() calls, calculates the maximum number
+             *  of cycles for each burst based on the last known effective CPU speed, and resets the nRecalcCycles
+             *  threshold counter.
+             */
+            this.setSpeed();
+            if (this.cmp) this.cmp.start();
+            this.flags.running = true;
+            if (this.bindings["run"]) this.bindings["run"].innerHTML = "Halt";
+            this.setFocus();
+        }
+        /*
+         *  calcStartTime() initializes the cycle counter and timestamp for this run() invocation, and optionally
+         *  recalculates the the maximum number of cycles for each burst if the nRecalcCycles threshold has been reached.
+         */
+        this.calcStartTime();
+        try {
+            do {
+                /*
+                 * NOTE: nCyclesPerBurst is how many cycles we WANT to run each iteration of step(), but that just
+                 * initializes nBurstCycles, which (after subtracting any remaining nStepCycles) is how many cycles
+                 * we ACTUALLY ran.
+                 */
+                this.step(this.nCyclesPerBurst);
+                /*
+                 * nCyclesThisRun is increased by nBurstCycles, plus any additional cycles step() processed after
+                 * its cycle count had reached zero (and conversely, minus any cycles that it still had yet to process);
+                 * ditto for nRunCycles, which is the cycle count since the CPU first started running.
+                 */
+                var nCycles = this.nBurstCycles - this.nStepCycles;
+                this.nRunCycles += nCycles;
+                this.nCyclesThisRun += nCycles;
+                /*
+                 * These step() cycle variables must be zeroed now, so that getCycles() always returns a valid cycle count.
+                 */
+                this.nBurstCycles = this.nStepCycles = 0;
+
+                this.nCyclesNextVideoUpdate -= this.nCyclesPerBurst;
+                if (this.nCyclesNextVideoUpdate <= 0) {
+                    this.nCyclesNextVideoUpdate += this.nCyclesPerVideoUpdate;
+                    this.displayVideo();
+                }
+
+                this.nCyclesNextStatusUpdate -= this.nCyclesPerBurst;
+                if (this.nCyclesNextStatusUpdate <= 0) {
+                    this.nCyclesNextStatusUpdate += this.nCyclesPerStatusUpdate;
+                    this.displayStatus();
+                }
+
+                this.nCyclesNextYield -= this.nCyclesPerBurst;
+                if (this.nCyclesNextYield <= 0) {
+                    this.nCyclesNextYield += this.nCyclesPerYield;
+                    break;
+                }
+            } while (this.flags.running);
+        }
+        catch (e) {
+            this.halt();
+            this.update();
+            this.setBusy(false);
+            this.setError(e.stack || e.message);
+            return;
+        }
+        setTimeout(function(cpu) { return function() {cpu.run();}; }(this), this.calcRemainingTime());
+    }
+
+    /**
+     * @this {C1PCPU}
+     * @param {number} nMinCycles (0 implies a single-step, and therefore breakpoints should be ignored)
+     * @return {boolean|undefined} undefined indicates that the last instruction was not executed (eg,
+     * we hit an execution breakpoint), false implies a post-execution condition was triggered (eg, a write
+     * breakpoint), and true indicates successful completion of all requested cycles.
+     */
+    step(nMinCycles)
+    {
+        /*
+         * The Debugger uses fCompleted to determine if the instruction completed (true) or was interrupted
+         * by a breakpoint or some other exceptional condition (false). NOTE: this does NOT include thrown
+         * exceptions, which step() expects the caller to catch using its own exception handler.
+         *
+         * The CPU relies on the use of halt() rather than fCompleted, because the CPU never single-steps
+         * (ie, nMinCycles is always some large number), whereas the Debugger does.  And conversely, when the
+         * Debugger is single-stepping (even when performing multiple single-steps), fRunning is never set,
+         * so halt() would have no effect as far as the Debugger is concerned.
+         */
+        var fCompleted = true;
+
+        /*
+         * fDebugCheck is true if we need to "check" every instruction with the Debugger.  The Debugger will
+         * call cpu.step(n) with n == 0 if it's executing only ONE instruction (ie, the user just clicked the
+         * "Step" button, or they've issued a "t" or "t1" command).  Otherwise, it will call with n == 1
+         * (ie, the user is holding the "Step" button, or they've issued a "t#" command where # > 1).
+         *
+         * In the first case, we want to ignore (ie, "step over") any breakpoints; otherwise, the Debugger has
+         * no easy way of moving past a breakpoint (other than clearing it, of course).  In the second case,
+         * we want to honor any breakpoints, which in turn will set fCompleted to false and signal the Debugger
+         * to stop.
+         *
+         * Note that as a practical matter, both 0 and 1 are otherwise treated the same when it comes to the
+         * minimum number of cycles to run: one and only one instruction will execute, since every instruction
+         * consumes at least 1 cycle.
+         */
+        this.regEA = this.regEAWrite = -1;
+        var fDebugCheck = (DEBUGGER && nMinCycles && this.dbg && this.dbg.checksEnabled());
+
+        /*
+         * We move the minimum cycle count to nStepCycles (the number of cycles left to run), so that other
+         * methods have the ability to force that number to zero (eg, halt()), and thus we don't have to check
+         * some other criteria just to determine whether we should continue running or not.
+         */
+        this.nBurstCycles = this.nStepCycles = nMinCycles;
+        do {
+            var bOpCode = this.abMem[this.regPC];
+
+            if (fDebugCheck && !this.dbg.checkInstruction(this.regPC, bOpCode)) {
+                fCompleted = undefined;
+                this.halt();
+                break;
+            }
+
+            this.regPC++;
+            this.aOpcodeFuncs[bOpCode].call(this);
+
+            /*
+             * Assert that all register contents remain within their respective ranges.
+             */
+
+
+            /*
+             * WARNING: By making the following read-or-write test exclusive, we're not going to catch
+             * those situations where an instruction does BOTH. For example, JSR pushes the old PC
+             * (which, if we were tracking STACK writes, would set regEAWrite) and then fetches a new PC
+             * (which should set regEA).  However, that's a situation which, except for a peculiar
+             * combination of read and write breakpoints set by the Debugger, is one we simply don't care
+             * about.  Moreover, none of our opcode handlers currently set BOTH regEA and regEAWrite,
+             * so it would be completely pointless to check both conditions here.
+             *
+             * Since READS are FAR more common than WRITES, we check the common case first.  If the
+             * day comes that we implement opcode functions that set both regEA AND regEAWrite, then we'll
+             * want to remove the "else" below and stop making the read and write tests exclusive.
+             * If we don't, then some of those rare/unusual writes will either get missed or delayed.
+             *
+             * It's also worth mentioning here that not all instructions READ or WRITE (eg, INX, INY and
+             * others that are completely flag or register-bound).  It's a bit ironic that those instructions,
+             * which are typically the fastest, have to perform both the READ and WRITE tests below.  But
+             * on the plus side, both tests will fail, so they'll still get out of here faster than any of
+             * the other instructions.
+             */
+            if (this.regEA >= 0) {
+                /*
+                 * Serial emulation requires a read notification handler, and the keyboard may eventually
+                 * want one, too.
+                 */
+                if (this.regEA >= this.addrReadLower && this.regEA <= this.addrReadUpper) {
+                    this.checkReadNotify(this.regEA, this.regPC);
+                }
+                if (fDebugCheck && !this.dbg.checkMemoryRead(this.regEA)) {
+                    fCompleted = false;
+                    this.halt();
+                    break;
+                }
+                this.regEA = -1;
+            }
+            else if (this.regEAWrite >= 0) {
+                /*
+                 * We process the write notification handlers before the write breakpoint handlers,
+                 * because we don't want to leave any ROM (read-only memory) writes in place before we
+                 * (potentially) give up control.  Undoing every write to ROM address space is an essential
+                 * part of simulating the "read-only" behavior of ROM.
+                 *
+                 * Obviously, there are other write notification handlers as well (like the keyboard's),
+                 * which may sometimes do things we'd prefer to intercept first, but let's keep things simple.
+                 */
+                if (this.regEAWrite >= this.addrWriteLower && this.regEAWrite <= this.addrWriteUpper) {
+                    this.checkWriteNotify(this.regEAWrite, this.regPC);
+                }
+                if (fDebugCheck && !this.dbg.checkMemoryWrite(this.regEAWrite, this.abMem[this.regEAWrite])) {
+                    fCompleted = false;
+                    this.halt();
+                    break;
+                }
+                this.regEAWrite = -1;
+            }
+
+            this.nStepCycles -= this.aOpcodeCycles[bOpCode];
+
+        } while (this.nStepCycles > 0);
+
+        return fCompleted;
+    }
+
+    /**
+     * yieldCPU() is similar to halt() with regard to how it resets various cycle countdown values,
+     * but the CPU remains in a "running" state.
+     *
+     * @this {C1PCPU}
+     */
+    yieldCPU()
+    {
+        this.nCyclesNextYield = 0;          // this will break us out of run(), once we break out of step()
+        this.nBurstCycles -= this.nStepCycles;
+        this.nStepCycles = 0;               // this will break us out of step()
+    }
+
+    /**
+     * halt() is similar to yieldCPU(), but it doesn't need to zero nCyclesNextYield to break out of run();
+     * it simply needs to clear fRunning.
+     *
+     * @this {C1PCPU}
+     */
+    halt()
+    {
+        this.isBusy(true);
+        this.nBurstCycles -= this.nStepCycles;
+        this.nStepCycles = 0;
+        if (this.flags.running) {
+            this.flags.running = false;
+            if (this.bindings["run"]) this.bindings["run"].innerHTML = "Run";
+        }
+    }
+
+    /**
+     * @this {C1PCPU}
+     *
+     * This used to be performed at the end of every step(), but run() -- which relies upon step() -- needed to have
+     * more control over when these updates are performed.  However, for other callers of step(), such as the Debugger,
+     * the combination of step() + update() provides the old behavior.
+     */
+    update()
+    {
+        this.displayVideo();
+        this.displayStatus();
+    }
+
+    /**
+     * getCycles() returns the number of cycles executed so far.  Note that we can be called after
+     * a run() OR during a run(), perhaps from a handler triggered during the current run's step(),
+     * so nRunCycles must always be adjusted by number of cycles step() was asked to run (nBurstCycles),
+     * less the number of cycles it has yet to run (nStepCycles).
+     *
+     * nRunCycles is reset whenever the CPU is halted or the CPU speed is changed, so returning 0 when the
+     * CPU is stopped seems perfectly reasonable.  As a result, components that rely on getCycles() returning a
+     * steadily increasing number should also be prepared for a reset at any time (eg, the Keyboard's
+     * updateMemory() function).
+     *
+     * @this {C1PCPU}
+     * @return {number}
+     */
+    getCycles()
+    {
+        return (this.flags.running? this.nRunCycles + this.nBurstCycles - this.nStepCycles : 0);
+    }
+
+    /**
+     * @this {C1PCPU}
+     * @param {number} addr
+     * @return {number}
+     *
+     * Unlike the Debugger versions of these functions, these presume that addr is always valid,
+     * since it's internally generated, not user-supplied. Of course, we could still have internal
+     * bugs, so asserts are included, but they are present in DEBUG code only (automatically
+     * removed from RELEASE code).
+     *
+     * Moreover, it's unlikely we'll use this function much (unless performance becomes secondary
+     * to code size), since all the opCode functions should perform their own fetches, for obvious
+     * performance reasons.
+     */
+    getByte(addr)
+    {
+
+        var b = this.abMem[addr];
+
+        return b;
+    }
+
+    /**
+     * @this {C1PCPU}
+     * @param {number} addr
+     * @return {number}
+     */
+    getWord(addr)
+    {
+
+        var w = this.abMem[addr] | (this.abMem[addr+1] << 8);
+
+        return w;
+    }
+
+    /**
+     * @this {C1PCPU}
+     * @param {number} addr
+     * @param {number} b
+     */
+    setByte(addr, b)
+    {
+
+
+        this.abMem[addr] = b;
+    }
+
+    /**
+     * @this {C1PCPU}
+     * @return {number}
+     */
+    getRegP()
+    {
+        /*
+         *  // C = LAZY_C;
+         *  this.regP = ((this.regP & 0xfe) | ((((this.regRC & 0x0100)))? 0x01 : 0));
+         *  // Z = LAZY_Z;
+         *  this.regP = ((this.regP & 0xfd) | ((((this.regRZ & 0xff) == 0))? 0x02 : 0));
+         *  // V = LAZY_V;
+         *  this.regP = ((this.regP & 0xbf) | (((((((this.regRV & 0xff) ^ this.regRU) ^ (this.regRV >> 1)) & 0x80) != 0))? 0x40 : 0));
+         *  // N = LAZY_N;
+         *  this.regP = ((this.regP & 0x7f) | ((((this.regRN & 0x80)))? 0x80 : 0));
+         */
+        var regP = ((this.regRC & 0x0100)? 0x01 : 0x00);
+        regP |= (!(this.regRZ & 0xff)? 0x02 : 0x00);
+        regP |= (((((this.regRV & 0xff) ^ this.regRU) ^ (this.regRV >> 1)) & 0x80)? 0x40 : 0x00);
+        regP |= ((this.regRN & 0x80)? 0x80 : 0x00);
+        return (this.regP & 0x3C) | regP;
+    }
+
+    /**
+     * @this {C1PCPU}
+     *
+     * Clear the C flag
+     */
+    clearC()
+    {
+        this.regRC = 0x00;
+    }
+
+    /**
+     * @this {C1PCPU}
+     *
+     * Set the C flag
+     */
+    setC()
+    {
+        this.regRC = 0x100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     *
+     * Clear the N bit
+     */
+    clearN()
+    {
+        this.regRN = 0x00;
+    }
+
+    /**
+     * @this {C1PCPU}
+     *
+     * Set the N bit
+     */
+    setN()
+    {
+        this.regRN = 0x80;
+    }
+
+    /**
+     * @this {C1PCPU}
+     *
+     * Clear the V bit
+     */
+    clearV()
+    {
+        this.regRV = 0x00; this.regRU = 0x00;
+    }
+
+    /**
+     * @this {C1PCPU}
+     *
+     * Set the V bit
+     */
+    setV()
+    {
+        this.regRV = 0x00; this.regRU = 0x80;
+    }
+
+    /**
+     * @this {C1PCPU}
+     *
+     * Clear the Z bit
+     */
+    clearZ()
+    {
+        this.regRZ = 0x01;
+    }
+
+    /**
+     * @this {C1PCPU}
+     *
+     * Set the Z bit
+     */
+    setZ()
+    {
+        this.regRZ = 0x00;
+    }
+
+    /**
+     * @this {C1PCPU}
+     *
+     * Set the BCD bit and install the BCD opcode handlers
+     */
+    setBCD()
+    {
+        this.regP |= 0x08;
+        this.aOpcodeFuncs[0x61] = this.opADCindxBCD;
+        this.aOpcodeFuncs[0x65] = this.opADCzpBCD;
+        this.aOpcodeFuncs[0x69] = this.opADCimmBCD;
+        this.aOpcodeFuncs[0x6d] = this.opADCabsBCD;
+        this.aOpcodeFuncs[0x71] = this.opADCindyBCD;
+        this.aOpcodeFuncs[0x75] = this.opADCzpxBCD;
+        this.aOpcodeFuncs[0x79] = this.opADCabsyBCD;
+        this.aOpcodeFuncs[0x7d] = this.opADCabsxBCD;
+        this.aOpcodeFuncs[0xe1] = this.opSBCindxBCD;
+        this.aOpcodeFuncs[0xe5] = this.opSBCzpBCD;
+        this.aOpcodeFuncs[0xe9] = this.opSBCimmBCD;
+        this.aOpcodeFuncs[0xed] = this.opSBCabsBCD;
+        this.aOpcodeFuncs[0xf1] = this.opSBCindyBCD;
+        this.aOpcodeFuncs[0xf5] = this.opSBCzpxBCD;
+        this.aOpcodeFuncs[0xf9] = this.opSBCabsyBCD;
+        this.aOpcodeFuncs[0xfd] = this.opSBCabsxBCD;
+    }
+
+    /**
+     * @this {C1PCPU}
+     *
+     * Clear the BCD bit and remove the BCD opcode handlers
+     */
+    clearBCD()
+    {
+        this.regP &= ~0x08;
+        this.aOpcodeFuncs[0x61] = this.opADCindx;
+        this.aOpcodeFuncs[0x65] = this.opADCzp;
+        this.aOpcodeFuncs[0x69] = this.opADCimm;
+        this.aOpcodeFuncs[0x6d] = this.opADCabs;
+        this.aOpcodeFuncs[0x71] = this.opADCindy;
+        this.aOpcodeFuncs[0x75] = this.opADCzpx;
+        this.aOpcodeFuncs[0x79] = this.opADCabsy;
+        this.aOpcodeFuncs[0x7d] = this.opADCabsx;
+        this.aOpcodeFuncs[0xe1] = this.opSBCindx;
+        this.aOpcodeFuncs[0xe5] = this.opSBCzp;
+        this.aOpcodeFuncs[0xe9] = this.opSBCimm;
+        this.aOpcodeFuncs[0xed] = this.opSBCabs;
+        this.aOpcodeFuncs[0xf1] = this.opSBCindy;
+        this.aOpcodeFuncs[0xf5] = this.opSBCzpx;
+        this.aOpcodeFuncs[0xf9] = this.opSBCabsy;
+        this.aOpcodeFuncs[0xfd] = this.opSBCabsx;
+    }
+
+    /**
+     * @this {C1PCPU}
+     * @param {number} reg
+     * @param {number} mem
+     * @return {number}
+     *
+     * Refer to http://www.6502.org/tutorials/decimal_mode.html for 6502-specific details.
+     * Refer to http://homepage.cs.uiowa.edu/~jones/bcd/bcd.html for optimization tips.
+     */
+    addBCD(reg, mem)
+    {
+        var carry = ((this.regRC & 0x0100)? 1 : 0);
+
+        /*
+         * First add the low nibbles.
+         */
+        var r = (reg & 0x0f) + (mem & 0x0f) + carry;
+
+        /*
+         * Adjust the result. NOTE: The extra AND'ing and ADD'ing isn't necessary if we want to
+         * assume that ONLY valid BCD digits will be added, but we probably shouldn't assume that.
+         * NOTE: We use an OR instead of an ADD at the end because it's logically equivalent and faster.
+         */
+        if (r >= 0x0A) r = ((r + 0x06) & 0x0f) | 0x10;
+
+        /*
+         * Now add the high nibbles.
+         */
+        r += (reg & 0xf0) + (mem & 0xf0);
+
+        /*
+         * Before we do the next adjust, it seems that N and V are dependent on this intermediate
+         * result (however, the meaning of N and V in BCD mode is not well documented).
+         */
+        this.regRU = reg ^ mem; this.regRV = r;
+        this.regRN = (r & 0xff);
+
+        /*
+         * Final adjustment.
+         */
+        if (r >= 0xA0) r += 0x60;
+        /*
+         * NOTE: If the intermediate result was 0x1A0 or more, then adding 0x60 would yield a result
+         * of 0x200 or more, but because the rest of the simulator tests regRC for 0x100, rather than
+         * comparing regRC for values >= 0x100, we'll miss the fact that there was a carry, unless we
+         * scale any value in the 0x200-0x2ff range down to 0x100-0x1ff.  We then assert that the
+         * resulting value is within the proper range.
+         */
+        if (r >= 0x200) r -= 0x100;
+
+
+        /*
+         * In BCD mode, the C flag reflects the decimal result, but the Z flag reflects binary addition.
+         */
+        this.regRC = r;
+        this.regRZ = ((reg + mem + carry) & 0xff);
+
+        /*
+         * Account for an extra cycle in BCD mode as well.
+         */
+        this.nStepCycles--;
+
+        return r & 0xff;
+    }
+
+    /**
+     * @this {C1PCPU}
+     * @param {number} reg
+     * @param {number} mem
+     * @return {number}
+     *
+     * Refer to http://www.6502.org/tutorials/decimal_mode.html for 6502-specific details.
+     * Refer to http://homepage.cs.uiowa.edu/~jones/bcd/bcd.html for optimization tips.
+     */
+    subBCD(reg, mem)
+    {
+        var notcarry = ((this.regRC & 0x0100)? 0 : 1);
+
+        /*
+         * First subtract the low nibbles.
+         */
+        var r = (reg & 0x0f) - (mem & 0x0f) - notcarry;
+
+        /*
+         * Adjust the result. NOTE: The extra AND'ing and SUB'ing isn't necessary if we want to
+         * assume that ONLY valid BCD digits will be added, but we probably shouldn't assume that.
+         */
+        if (r < 0x00) r = ((r - 0x06) & 0x0f) - 0x10;
+
+        /*
+         * Now subtract the high nibbles.
+         */
+        r += (reg & 0xf0) - (mem & 0xf0);
+
+        /*
+         * Final adjustment.
+         */
+        if (r < 0x00) r -= 0x60;
+
+        /*
+         * In BCD mode, the Z -- and C, N and V -- flags are all set as if binary subtraction was performed.
+         */
+        // RC = (A - ML - !LAZY_C); SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = (this.regRC = (reg - mem - notcarry)) & 0xff;
+        // SET_LAZY_OV(A,ML,RC);
+        this.regRU = reg ^ mem; this.regRV = this.regRC;
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+
+        /*
+         * Account for an extra cycle in BCD mode as well.
+         */
+        this.nStepCycles--;
+
+        return r & 0xff;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    clearRegs()
+    {
+        this.regA = 0;
+        this.regX = 0;
+        this.regY = 0;
+        this.regS = 0x100;
+        this.regP = 0;
+        this.regRN = 0;
+        this.regRZ = 0;
+        this.regRU = 0;
+        this.regRV = 0;
+        this.regRC = 0;
+        this.regPC = 0;
+        this.regEA = -1;
+        this.regEAWrite = -1;
+        this.mhz = 0;
+        this.nRunCycles = this.nBurstCycles = this.nStepCycles = 0;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opBRK()
+    {   // opcode 0x00
+        // PC++;
+        this.regPC++;
+        // STACK(S--) = PCH;
+        this.abMem[this.regS--] = (this.regPC >> 8);
+        this.regS |= 0x100;
+        // STACK(S--) = PCL;
+        this.abMem[this.regS--] = (this.regPC & 0xff);
+        this.regS |= 0x100;
+        // B = 1;
+        this.regP |= 0x10;
+        // C = LAZY_C; Z = LAZY_Z; V = LAZY_V; N = LAZY_N;
+        this.regP = this.getRegP();
+        // STACK(S--) = P;
+        this.abMem[this.regS--] = this.regP;
+        this.regS |= 0x100;
+        // B = 0;
+        this.regP &= 0xef;
+        // EA = 0xFFFE;
+        this.regEA = 0xFFFE;
+        // PC = M;
+        this.regPC = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8));
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opORAindx()
+    {   // opcode 0x01
+        // EA = WORD((BYTE(PC++)+X) & 0xff);
+        this.regEA = ((this.abMem[this.regPC++]) + this.regX) & 0xff;
+        this.regEA = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8));
+        // A = A | ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA |= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opORAzp()
+    {   // opcode 0x05
+        // EA = BYTE(PC++);
+        this.regEA = this.abMem[this.regPC++];
+        // A = A | ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA |= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opASLzp()
+    {   // opcode 0x06
+        // EA = BYTE(PC++);
+        this.regEAWrite = this.abMem[this.regPC++];
+        // RC = ML << 1;
+        this.regRC = this.abMem[this.regEAWrite] << 1;
+        // ML = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = (this.regRC & 0xff);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opPHP()
+    {   // opcode 0x08
+        this.regP = this.getRegP();
+        // STACK(S--) = P;
+        this.abMem[this.regS--] = this.regP;
+        this.regS |= 0x100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opORAimm()
+    {   // opcode 0x09
+        // EA = PC++;
+        this.regEA = this.regPC++;
+        // A = A | ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA |= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opASLacc()
+    {   // opcode 0x0a
+        // RC = A << 1;
+        this.regRC = this.regA << 1;
+        // A = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.regA = (this.regRC & 0xff);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opORAabs()
+    {   // opcode 0x0d
+        // EA = WORD(PC); PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // A = A | ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA |= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opASLabs()
+    {   // opcode 0x0e
+        // EA = WORD(PC); PC += 2;
+        this.regEAWrite = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // RC = ML << 1;
+        this.regRC = this.abMem[this.regEAWrite] << 1;
+        // ML = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = (this.regRC & 0xff);
+        // W = 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opBPL()
+    {   // opcode 0x10
+        // PC = PC + (LAZY_N == 0? SBYTE(PC) : 0) + 1;
+        this.regPC += (!(this.regRN & 0x80)? (this.nStepCycles--,((this.abMem[this.regPC] << 24) >> 24)) : 0) + 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opORAindy()
+    {   // opcode 0x11
+        // EA = WORD(BYTE(PC++))+Y;
+        this.regEA = (this.abMem[this.regPC++]);
+        this.regEA = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8)) + this.regY;
+        // A = A | ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA |= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opORAzpx()
+    {   // opcode 0x15
+        // EA = (BYTE(PC++)+X) & 0xff;
+        this.regEA = (this.abMem[this.regPC++]+this.regX) & 0xff;
+        // A = A | ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA |= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opASLzpx()
+    {   // opcode 0x16
+        // EA = (BYTE(PC++)+X) & 0xff;
+        this.regEAWrite = (this.abMem[this.regPC++]+this.regX) & 0xff;
+        // RC = ML << 1;
+        this.regRC = this.abMem[this.regEAWrite] << 1;
+        // ML = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = (this.regRC & 0xff);
+        // W = 1;
+        // NOTE: Consider alternatives for tracking zero-page writes (eg, regEAWriteZP)
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opCLC()
+    {   // opcode 0x18
+        // SET_LAZY_C(0);
+        this.regRC = 0x00;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opORAabsy()
+    {   // opcode 0x19
+        // EA = WORD(PC)+Y; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regY;
+        // A = A | ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = this.regA |= this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opORAabsx()
+    {   // opcode 0x1d
+        // EA = WORD(PC)+X; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regX;
+        // A = A | ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = this.regA |= this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opASLabsx()
+    {   // opcode 0x1e
+        // EA = WORD(PC)+X; PC += 2;
+        this.regEAWrite = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regX;
+        // RC = ML << 1;
+        this.regRC = this.abMem[this.regEAWrite] << 1;
+        // ML = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = (this.regRC & 0xff);
+        // W = 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opJSRabs()
+    {   // opcode 0x20
+        // EA = PC; PC += 1;
+        this.regEA = this.regPC++;
+        // STACK(S--) = PCH;
+        this.abMem[this.regS--] = (this.regPC >> 8);
+        this.regS |= 0x100;
+        // STACK(S--) = PCL;
+        this.abMem[this.regS--] = (this.regPC & 0xff);
+        this.regS |= 0x100;
+        // PC = M;
+        this.regPC = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8));
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opANDindx()
+    {   // opcode 0x21
+        // EA = WORD((BYTE(PC++)+X) & 0xff);
+        this.regEA = ((this.abMem[this.regPC++]) + this.regX) & 0xff;
+        this.regEA = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8));
+        // A = A & ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA &= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opBITzp()
+    {   // opcode 0x24
+        // EA = BYTE(PC++);
+        this.regEA = this.abMem[this.regPC++];
+        // SET_LAZY_Z((A & ML) == 0);
+        this.regRZ = (this.regA & this.abMem[this.regEA]);
+        // SET_LAZY_N(ML7);
+        this.regRN = ((this.regRN & 0x7f) | (this.abMem[this.regEA] & 0x80));
+        // SET_LAZY_V(ML6);
+        this.regRV = 0; this.regRU = ((this.abMem[this.regEA] & 0x40)? 0x80 : 0x00);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opANDzp()
+    {   // opcode 0x25
+        // EA = BYTE(PC++);
+        this.regEA = this.abMem[this.regPC++];
+        // A = A & ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA &= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opROLzp()
+    {   // opcode 0x26
+        // EA = BYTE(PC++);
+        this.regEAWrite = this.abMem[this.regPC++];
+        // RCL = ML;
+        this.regRC = ((this.regRC & 0xff00) | this.abMem[this.regEAWrite]);
+        // RC = RC << 1;
+        this.regRC <<= 1;
+        // RCL0 = RCH1;
+        this.regRC = ((this.regRC & 0xfffe) | (((this.regRC & 0x0200))? 0x0001 : 0));
+        // ML = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = (this.regRC & 0xff);
+        // W = 1;
+        // NOTE: Consider alternatives for tracking zero-page writes (eg, regEAWriteZP)
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opPLP()
+    {   // opcode 0x28
+        // P = STACK(++S);
+        this.regS = ((this.regS+1) & 0xff) | 0x100;
+        this.regP = this.abMem[this.regS];
+        // SET_LAZY_C(C);
+        this.regRC = ((this.regP & 0x01)? 0x0100 : 0);
+        // SET_LAZY_Z(Z);
+        this.regRZ = (!(this.regP & 0x02)? 0x01 : 0);
+        // SET_LAZY_N(N);
+        this.regRN = (this.regP & 0x80);
+        // SET_LAZY_V(V);
+        this.regRV = 0; this.regRU = ((this.regP & 0x40)? 0x80 : 0x00);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opANDimm()
+    {   // opcode 0x29
+        // EA = PC++;
+        this.regEA = this.regPC++;
+        // A = A & ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA &= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opROLacc()
+    {   // opcode 0x2a
+        // RCL =  A;
+        this.regRC = ((this.regRC & 0xff00) | this.regA);
+        // RC = RC << 1;
+        this.regRC <<= 1;
+        // RCL0 = RCH1;
+        this.regRC = ((this.regRC & 0xfffe) | ((this.regRC & 0x0200)? 0x0001 : 0));
+        // A = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.regA = (this.regRC & 0xff);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opBITabs()
+    {   // opcode 0x2c
+        // EA = WORD(PC); PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // SET_LAZY_Z((A & ML) == 0);
+        this.regRZ = (this.regA & this.abMem[this.regEA]);
+        // SET_LAZY_N(ML7);
+        this.regRN = ((this.regRN & 0x7f) | (this.abMem[this.regEA] & 0x80));
+        // SET_LAZY_V(ML6);
+        this.regRV = 0; this.regRU = ((this.abMem[this.regEA] & 0x40)? 0x80 : 0x00);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opANDabs()
+    {   // opcode 0x2d
+        // EA = WORD(PC); PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // A = A & ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA &= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opROLabs()
+    {   // opcode 0x2e
+        // EA = WORD(PC); PC += 2;
+        this.regEAWrite = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // RCL = ML;
+        this.regRC = ((this.regRC & 0xff00) | this.abMem[this.regEAWrite]);
+        // RC = RC << 1;
+        this.regRC <<= 1;
+        // RCL0 = RCH1;
+        this.regRC = ((this.regRC & 0xfffe) | (((this.regRC & 0x0200))? 0x0001 : 0));
+        // ML = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = (this.regRC & 0xff);
+        // W = 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opBMI()
+    {   // opcode 0x30
+        // PC = PC + (LAZY_N != 0? SBYTE(PC) : 0) + 1;
+        this.regPC += ((this.regRN & 0x80)? (this.nStepCycles--,((this.abMem[this.regPC] << 24) >> 24)) : 0) + 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opANDindy()
+    {   // opcode 0x31
+        // EA = WORD(BYTE(PC++))+Y;
+        this.regEA = (this.abMem[this.regPC++]);
+        this.regEA = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8)) + this.regY;
+        // A = A & ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA &= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opANDzpx()
+    {   // opcode 0x35
+        // EA = (BYTE(PC++)+X) & 0xff;
+        this.regEA = (this.abMem[this.regPC++]+this.regX) & 0xff;
+        // A = A & ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA &= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opROLzpx()
+    {   // opcode 0x36
+        // EA = (BYTE(PC++)+X) & 0xff;
+        this.regEAWrite = (this.abMem[this.regPC++]+this.regX) & 0xff;
+        // RCL = ML;
+        this.regRC = ((this.regRC & 0xff00) | this.abMem[this.regEAWrite]);
+        // RC = RC << 1;
+        this.regRC <<= 1;
+        // RCL0 = RCH1;
+        this.regRC = ((this.regRC & 0xfffe) | (((this.regRC & 0x0200))? 0x0001 : 0));
+        // ML = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = (this.regRC & 0xff);
+        // W = 1;
+        // NOTE: Consider alternatives for tracking zero-page writes (eg, regEAWriteZP)
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSEC()
+    {   // opcode 0x38
+        // SET_LAZY_C(1);
+        this.regRC = 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opANDabsy()
+    {   // opcode 0x39
+        // EA = WORD(PC)+Y; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regY;
+        // A = A & ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA &= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opANDabsx()
+    {   // opcode 0x3d
+        // EA = WORD(PC)+X; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regX;
+        // A = A & ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA &= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opROLabsx()
+    {   // opcode 0x3e
+        // EA = WORD(PC)+X; PC += 2;
+        this.regEAWrite = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regX;
+        // RCL = ML;
+        this.regRC = ((this.regRC & 0xff00) | this.abMem[this.regEAWrite]);
+        // RC = RC << 1;
+        this.regRC <<= 1;
+        // RCL0 = RCH1;
+        this.regRC = ((this.regRC & 0xfffe) | (((this.regRC & 0x0200))? 0x0001 : 0));
+        // ML = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = (this.regRC & 0xff);
+        // W = 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opRTI()
+    {   // opcode 0x40
+        // P = STACK(++S);
+        this.regS = ((this.regS+1) & 0xff) | 0x100;
+        this.regP = this.abMem[this.regS];
+        // SET_LAZY_C(C);
+        this.regRC = ((this.regP & 0x01)? 0x0100 : 0);
+        // SET_LAZY_Z(Z);
+        this.regRZ = (!(this.regP & 0x02)? 0x01 : 0);
+        // SET_LAZY_N(N);
+        this.regRN = (this.regP & 0x80);
+        // SET_LAZY_V(V);
+        this.regRV = 0; this.regRU = ((this.regP & 0x40)? 0x80 : 0x00);
+        // PCL = STACK(++S);
+        // PCH = STACK(++S);
+        this.regS = ((this.regS+2) & 0xff) | 0x100;
+        this.regPC = (this.abMem[(this.regS-1) | 0x100]) | (this.abMem[this.regS] << 8);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opEORindx()
+    {   // opcode 0x41
+        // EA = WORD((BYTE(PC++)+X) & 0xff);
+        this.regEA = ((this.abMem[this.regPC++]) + this.regX) & 0xff;
+        this.regEA = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8));
+        // A = A ^ ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA ^= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opEORzp()
+    {   // opcode 0x45
+        // EA = BYTE(PC++);
+        this.regEA = this.abMem[this.regPC++];
+        // A = A ^ ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA ^= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLSRzp()
+    {   // opcode 0x46
+        // EA = BYTE(PC++);
+        this.regEAWrite = this.abMem[this.regPC++];
+        // SET_LAZY_C(ML0);
+        this.regRC = ((this.regRC & 0xfeff) | ((this.abMem[this.regEAWrite] & 0x01)? 0x0100 : 0));
+        // ML = RCL = ML >> 1;
+        this.abMem[this.regEAWrite] = ((this.regRC = ((this.regRC & 0xff00) | (this.abMem[this.regEAWrite] >> 1))) & 0xff);
+        // SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = (this.regRC & 0xff);
+        // W = 1;
+        // NOTE: Consider alternatives for tracking zero-page writes (eg, regEAWriteZP)
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opPHA()
+    {   // opcode 0x48
+        // STACK(S--) = A;
+        this.abMem[this.regS--] = this.regA;
+        this.regS |= 0x100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opEORimm()
+    {   // opcode 0x49
+        // EA = PC++;
+        this.regEA = this.regPC++;
+        // A = A ^ ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA ^= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLSRacc()
+    {   // opcode 0x4a
+        // SET_LAZY_C( A0);
+        this.regRC = ((this.regRC & 0xfeff) | ((this.regA & 0x01)? 0x0100 : 0));
+        // A = RCL =  A >> 1;
+        this.regA = ((this.regRC = ((this.regRC & 0xff00) | (this.regA >> 1))) & 0xff);
+        // SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = (this.regRC & 0xff);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opJMPimm16()
+    {   // opcode 0x4c
+        // EA = PC;
+        this.regEA = this.regPC;
+        // PC += 2;
+        // this.regPC += 2;
+        // PC = M;
+        this.regPC = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8));
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opEORabs()
+    {   // opcode 0x4d
+        // EA = WORD(PC); PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // A = A ^ ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA ^= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLSRabs()
+    {   // opcode 0x4e
+        // EA = WORD(PC); PC += 2;
+        this.regEAWrite = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // SET_LAZY_C(ML0);
+        this.regRC = ((this.regRC & 0xfeff) | ((this.abMem[this.regEAWrite] & 0x01)? 0x0100 : 0));
+        // ML = RCL = ML >> 1;
+        this.abMem[this.regEAWrite] = ((this.regRC = ((this.regRC & 0xff00) | (this.abMem[this.regEAWrite] >> 1))) & 0xff);
+        // SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = (this.regRC & 0xff);
+        // W = 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opBVC()
+    {   // opcode 0x50
+        // PC = PC + (LAZY_V == 0? SBYTE(PC) : 0) + 1;
+        this.regPC += (!((((this.regRV & 0xff) ^ this.regRU) ^ (this.regRV >> 1)) & 0x80)? (this.nStepCycles--,((this.abMem[this.regPC] << 24) >> 24)) : 0) + 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opEORindy()
+    {   // opcode 0x51
+        // EA = WORD(BYTE(PC++))+Y;
+        this.regEA = this.abMem[this.regPC++];
+        this.regEA = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8)) + this.regY;
+        // A = A ^ ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA ^= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opEORzpx()
+    {   // opcode 0x55
+        // EA = (BYTE(PC++)+X) & 0xff;
+        this.regEA = (this.abMem[this.regPC++]+this.regX) & 0xff;
+        // A = A ^ ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA ^= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLSRzpx()
+    {   // opcode 0x56
+        // EA = (BYTE(PC++)+X) & 0xff;
+        this.regEAWrite = (this.abMem[this.regPC++]+this.regX) & 0xff;
+        // SET_LAZY_C(ML0);
+        this.regRC = ((this.regRC & 0xfeff) | ((this.abMem[this.regEAWrite] & 0x01)? 0x0100 : 0));
+        // ML = RCL = ML >> 1;
+        this.abMem[this.regEAWrite] = ((this.regRC = ((this.regRC & 0xff00) | (this.abMem[this.regEAWrite] >> 1))) & 0xff);
+        // SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = (this.regRC & 0xff);
+        // W = 1;
+        // NOTE: Consider alternatives for tracking zero-page writes (eg, regEAWriteZP)
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opCLI()
+    {   // opcode 0x58
+        // I = 0;
+        this.regP &= 0xfb;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opEORabsy()
+    {   // opcode 0x59
+        // EA = WORD(PC)+Y; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regY;
+        // A = A ^ ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = (this.regA ^= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opEORabsx()
+    {   // opcode 0x5d
+        // EA = WORD(PC)+X; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regX;
+        // A = A ^ ML; SET_LAZY_NZ(A)
+        this.regRN = this.regRZ = (this.regA ^= this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLSRabsx()
+    {   // opcode 0x5e
+        // EA = WORD(PC)+X; PC += 2;
+        this.regEAWrite = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regX;
+        // SET_LAZY_C(ML0);
+        this.regRC = ((this.regRC & 0xfeff) | ((this.abMem[this.regEAWrite] & 0x01)? 0x0100 : 0));
+        // ML = RCL = ML >> 1;
+        this.abMem[this.regEAWrite] = ((this.regRC = ((this.regRC & 0xff00) | (this.abMem[this.regEAWrite] >> 1))) & 0xff);
+        // SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = (this.regRC & 0xff);
+        // W = 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opRTS()
+    {   // opcode 0x60
+        // PCL = STACK(++S);
+        // PCH = STACK(++S);
+        // PC++;
+        this.regS = ((this.regS+2) & 0xff) | 0x100;
+        this.regPC = (((this.abMem[(this.regS-1) | 0x100])) | ((this.abMem[this.regS]) << 8)) + 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opADCindx()
+    {   // opcode 0x61
+        // EA = WORD((BYTE(PC++)+X) & 0xff);
+        this.regEA = ((this.abMem[this.regPC++]) + this.regX) & 0xff;
+        this.regEA = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8));
+        // RC = (A + ML + LAZY_C);
+        this.regRC = (this.regA + this.abMem[this.regEA] + ((this.regRC & 0x0100)? 1 : 0));
+        // SET_LAZY_OV(A,ML,RC);
+        this.regRU = this.regA ^ this.abMem[this.regEA]; this.regRV = this.regRC;
+        // A = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.regA = (this.regRC & 0xff);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opADCindxBCD()
+    {   // opcode 0x61
+        // EA = WORD((BYTE(PC++)+X) & 0xff);
+        this.regEA = ((this.abMem[this.regPC++]) + this.regX) & 0xff;
+        this.regEA = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8));
+        // A = this.addBCD(A,ML);
+        this.regA = this.addBCD(this.regA, this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opADCzp()
+    {   // opcode 0x65
+        // EA = BYTE(PC++);
+        this.regEA = this.abMem[this.regPC++];
+        // RC = (A + ML + LAZY_C);
+        this.regRC = (this.regA + this.abMem[this.regEA] + ((this.regRC & 0x0100)? 1 : 0));
+        // SET_LAZY_OV(A,ML,RC);
+        this.regRU = this.regA ^ this.abMem[this.regEA]; this.regRV = this.regRC;
+        // A = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.regA = (this.regRC & 0xff);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opADCzpBCD()
+    {   // opcode 0x65
+        // EA = BYTE(PC++);
+        this.regEA = this.abMem[this.regPC++];
+        // A = this.addBCD(A,ML);
+        this.regA = this.addBCD(this.regA, this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opRORzp()
+    {   // opcode 0x66
+        // EA = BYTE(PC++);
+        this.regEAWrite = this.abMem[this.regPC++];
+        // RCL = ML;
+        this.regRC = ((this.regRC & 0xff00) | this.abMem[this.regEAWrite]);
+        // RCH1 = RCL0;
+        this.regRC = ((this.regRC & 0xfdff) | ((this.regRC & 0x0001)? 0x0200 : 0));
+        // RC = RC >> 1;
+        this.regRC >>= 1;
+        // ML = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = (this.regRC & 0xff);
+        // W = 1;
+        // NOTE: Consider alternatives for tracking zero-page writes (eg, regEAWriteZP)
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opPLA()
+    {   // opcode 0x68
+        // A = STACK(++S); SET_LAZY_NZ(A);
+        this.regS = ((this.regS+1) & 0xff) | 0x100;
+        this.regRN = this.regRZ = this.regA = this.abMem[this.regS];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opADCimm()
+    {   // opcode 0x69
+        // EA = PC++;
+        this.regEA = this.regPC++;
+        // RC = (A + ML + LAZY_C);
+        this.regRC = (this.regA + this.abMem[this.regEA] + ((this.regRC & 0x0100)? 1 : 0));
+        // SET_LAZY_OV(A,ML,RC);
+        this.regRU = this.regA ^ this.abMem[this.regEA]; this.regRV = this.regRC;
+        // A = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.regA = (this.regRC & 0xff);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opADCimmBCD()
+    {   // opcode 0x69
+        // EA = PC++;
+        this.regEA = this.regPC++;
+        // A = this.addBCD(A,ML);
+        this.regA = this.addBCD(this.regA, this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opRORacc()
+    {   // opcode 0x6a
+        // RCL =  A;
+        this.regRC = ((this.regRC & 0xff00) | this.regA);
+        // RCH1 = RCL0;
+        this.regRC = ((this.regRC & 0xfdff) | ((this.regRC & 0x0001)? 0x0200 : 0));
+        // RC = RC >> 1;
+        this.regRC >>= 1;
+        // A = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.regA = (this.regRC & 0xff);
+    }
+
+    /**
+     * @this {C1PCPU}
+     *
+     * NOTE from Wikipedia: "The 6502's memory indirect jump instruction, JMP (<address>), is partially broken.
+     * If <address> is hex xxFF (i.e., any word ending in FF), the processor will not jump to the address stored in xxFF and xxFF+1 as expected,
+     * but rather the one defined by xxFF and xx00. This defect continued through the entire NMOS line, but was corrected in the CMOS derivatives."
+     */
+    opJMPabs16()
+    {   // opcode 0x6c
+        // EA = WORD(PC); PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // PC = M;
+        this.regPC = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8));
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opADCabs()
+    {   // opcode 0x6d
+        // EA = WORD(PC); PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // RC = (A + ML + LAZY_C);
+        this.regRC =(this.regA + this.abMem[this.regEA] + ((this.regRC & 0x0100)? 1 : 0));
+        // SET_LAZY_OV(A,ML,RC);
+        this.regRU = this.regA ^ this.abMem[this.regEA]; this.regRV = this.regRC;
+        // A = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.regA = (this.regRC & 0xff);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opADCabsBCD()
+    {   // opcode 0x6d
+        // EA = WORD(PC); PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // A = this.addBCD(A,ML);
+        this.regA = this.addBCD(this.regA, this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opRORabs()
+    {   // opcode 0x6e
+        // EA = WORD(PC); PC += 2;
+        this.regEAWrite = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // RCL = ML;
+        this.regRC = ((this.regRC & 0xff00) | this.abMem[this.regEAWrite]);
+        // RCH1 = RCL0;
+        this.regRC = ((this.regRC & 0xfdff) | ((this.regRC & 0x0001)? 0x0200 : 0));
+        // RC = RC >> 1;
+        this.regRC >>= 1;
+        // ML = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = (this.regRC & 0xff);
+        // W = 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opBVS()
+    {   // opcode 0x70
+        // PC = PC + (LAZY_V != 0? SBYTE(PC) : 0) + 1;
+        this.regPC += (((((this.regRV & 0xff) ^ this.regRU) ^ (this.regRV >> 1)) & 0x80)? (this.nStepCycles--,((this.abMem[this.regPC] << 24) >> 24)) : 0) + 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opADCindy()
+    {   // opcode 0x71
+        // EA = WORD(BYTE(PC++))+Y;
+        this.regEA = (this.abMem[this.regPC++]);
+        this.regEA = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8)) + this.regY;
+        // RC = (A + ML + LAZY_C);
+        this.regRC = (this.regA + this.abMem[this.regEA] + ((this.regRC & 0x0100)? 1 : 0));
+        // SET_LAZY_OV(A,ML,RC);
+        this.regRU = this.regA ^ this.abMem[this.regEA]; this.regRV = this.regRC;
+        // A = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.regA = (this.regRC & 0xff);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opADCindyBCD()
+    {   // opcode 0x71
+        // EA = WORD(BYTE(PC++))+Y;
+        this.regEA = (this.abMem[this.regPC++]);
+        this.regEA = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8)) + this.regY;
+        // A = this.addBCD(A,ML);
+        this.regA = this.addBCD(this.regA, this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opADCzpx()
+    {   // opcode 0x75
+        // EA = (BYTE(PC++)+X) & 0xff;
+        this.regEA = (this.abMem[this.regPC++]+this.regX) & 0xff;
+        // RC = (A + ML + LAZY_C);
+        this.regRC = (this.regA + this.abMem[this.regEA] + ((this.regRC & 0x0100)? 1 : 0));
+        // SET_LAZY_OV(A,ML,RC);
+        this.regRU = this.regA ^ this.abMem[this.regEA]; this.regRV = this.regRC;
+        // A = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.regA = (this.regRC & 0xff);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opADCzpxBCD()
+    {   // opcode 0x75
+        // EA = (BYTE(PC++)+X) & 0xff;
+        this.regEA = (this.abMem[this.regPC++]+this.regX) & 0xff;
+        // A = this.addBCD(A,ML);
+        this.regA = this.addBCD(this.regA, this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opRORzpx()
+    {   // opcode 0x76
+        // EA = (BYTE(PC++)+X) & 0xff;
+        this.regEAWrite = (this.abMem[this.regPC++]+this.regX) & 0xff;
+        // RCL = ML;
+        this.regRC = ((this.regRC & 0xff00) | this.abMem[this.regEAWrite]);
+        // RCH1 = RCL0;
+        this.regRC = ((this.regRC & 0xfdff) | ((this.regRC & 0x0001)? 0x0200 : 0));
+        // RC = RC >> 1;
+        this.regRC >>= 1;
+        // ML = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = (this.regRC & 0xff);
+        // W = 1;
+        // NOTE: Consider alternatives for tracking zero-page writes (eg, regEAWriteZP)
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSEI()
+    {   // opcode 0x78
+        // I = 1;
+        this.regP |= 0x04;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opADCabsy()
+    {   // opcode 0x79
+        // EA = WORD(PC)+Y; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regY;
+        // RC = (A + ML + LAZY_C);
+        this.regRC = (this.regA + this.abMem[this.regEA] + ((this.regRC & 0x0100)? 1 : 0));
+        // SET_LAZY_OV(A,ML,RC);
+        this.regRU = this.regA ^ this.abMem[this.regEA]; this.regRV = this.regRC;
+        // A = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.regA = (this.regRC & 0xff);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opADCabsyBCD()
+    {   // opcode 0x79
+        // EA = WORD(PC)+Y; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regY;
+        // A = this.addBCD(A,ML);
+        this.regA = this.addBCD(this.regA, this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opADCabsx()
+    {   // opcode 0x7d
+        // EA = WORD(PC)+X; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regX;
+        // RC = (A + ML + LAZY_C);
+        this.regRC = (this.regA + this.abMem[this.regEA] + ((this.regRC & 0x0100)? 1 : 0));
+        // SET_LAZY_OV(A,ML,RC);
+        this.regRU = this.regA ^ this.abMem[this.regEA]; this.regRV = this.regRC;
+        // A = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.regA = (this.regRC & 0xff);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opADCabsxBCD()
+    {   // opcode 0x7d
+        // EA = WORD(PC)+X; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regX;
+        // A = this.addBCD(A,ML);
+        this.regA = this.addBCD(this.regA, this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opRORabsx()
+    {   // opcode 0x7e
+        // EA = WORD(PC)+X; PC += 2;
+        this.regEAWrite = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regX;
+        // RCL = ML;
+        this.regRC = ((this.regRC & 0xff00) | this.abMem[this.regEAWrite]);
+        // RCH1 = RCL0;
+        this.regRC = ((this.regRC & 0xfdff) | ((this.regRC & 0x0001)? 0x0200 : 0));
+        // RC = RC >> 1;
+        this.regRC >>= 1;
+        // ML = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = (this.regRC & 0xff);
+        // W = 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSTAindx()
+    {   // opcode 0x81
+        // EA = WORD((BYTE(PC++)+X) & 0xff);
+        this.regEAWrite = ((this.abMem[this.regPC++]) + this.regX) & 0xff;
+        this.regEAWrite = (this.abMem[this.regEAWrite] | (this.abMem[this.regEAWrite+1] << 8));
+        // ML = A;
+        this.abMem[this.regEAWrite] = this.regA;
+        // W = 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSTYzp()
+    {   // opcode 0x84
+        // EA = BYTE(PC++);
+        this.regEAWrite = this.abMem[this.regPC++];
+        // ML = Y;
+        this.abMem[this.regEAWrite] = this.regY;
+        // W = 1;
+        // NOTE: Consider alternatives for tracking zero-page writes (eg, regEAWriteZP)
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSTAzp()
+    {   // opcode 0x85
+        // EA = BYTE(PC++);
+        this.regEAWrite = this.abMem[this.regPC++];
+        // ML = A;
+        this.abMem[this.regEAWrite] = this.regA;
+        // W = 1;
+        // NOTE: Consider alternatives for tracking zero-page writes (eg, regEAWriteZP)
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSTXzp()
+    {   // opcode 0x86
+        // EA = BYTE(PC++);
+        this.regEAWrite = this.abMem[this.regPC++];
+        // ML = X;
+        this.abMem[this.regEAWrite] = this.regX;
+        // W = 1;
+        // NOTE: Consider alternatives for tracking zero-page writes (eg, regEAWriteZP)
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opDEY()
+    {   // opcode 0x88
+        // Y = ((Y - 1) & 0xff);
+        this.regY = ((this.regY - 1) & 0xff);
+        // SET_LAZY_NZ(Y);
+        this.regRN = this.regRZ = (this.regY);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opTXA()
+    {   // opcode 0x8a
+        // A = X; SET_LAZY_NZ(X);
+        this.regRN = this.regRZ = this.regA = this.regX;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSTYabs()
+    {   // opcode 0x8c
+        // EA = WORD(PC); PC += 2;
+        this.regEAWrite = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // ML = Y;
+        this.abMem[this.regEAWrite] = this.regY;
+        // W = 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSTAabs()
+    {   // opcode 0x8d
+        // EA = WORD(PC); PC += 2;
+        this.regEAWrite = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // ML = A;
+        this.abMem[this.regEAWrite] = this.regA;
+        // W = 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSTXabs()
+    {   // opcode 0x8e
+        // EA = WORD(PC); PC += 2;
+        this.regEAWrite = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // ML = X;
+        this.abMem[this.regEAWrite] = this.regX;
+        // W = 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opBCC()
+    {   // opcode 0x90
+        // PC = PC + (LAZY_C == 0? SBYTE(PC) : 0) + 1;
+        this.regPC += (!(this.regRC & 0x0100)? (this.nStepCycles--,((this.abMem[this.regPC] << 24) >> 24)) : 0) + 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSTAindy()
+    {   // opcode 0x91
+        // EA = WORD(BYTE(PC++))+Y;
+        this.regEAWrite = (this.abMem[this.regPC++]);
+        this.regEAWrite = (this.abMem[this.regEAWrite] | (this.abMem[this.regEAWrite+1] << 8)) + this.regY;
+        // ML = A;
+        this.abMem[this.regEAWrite] = this.regA;
+        // W = 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSTYzpx()
+    {   // opcode 0x94
+        // EA = (BYTE(PC++)+X) & 0xff;
+        this.regEAWrite = (this.abMem[this.regPC++]+this.regX) & 0xff;
+        // ML = Y;
+        this.abMem[this.regEAWrite] = this.regY;
+        // W = 1;
+        // NOTE: Consider alternatives for tracking zero-page writes (eg, regEAWriteZP)
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSTAzpx()
+    {   // opcode 0x95
+        // EA = (BYTE(PC++)+X) & 0xff;
+        this.regEAWrite = (this.abMem[this.regPC++]+this.regX) & 0xff;
+        // ML = A;
+        this.abMem[this.regEAWrite] = this.regA;
+        // W = 1;
+        // NOTE: Consider alternatives for tracking zero-page writes (eg, regEAWriteZP)
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSTXzpy()
+    {   // opcode 0x96
+        // EA = (BYTE(PC++)+Y) & 0xff;
+        this.regEAWrite = (this.abMem[this.regPC++]+this.regY) & 0xff;
+        // ML = X;
+        this.abMem[this.regEAWrite] = this.regX;
+        // W = 1;
+        // NOTE: Consider alternatives for tracking zero-page writes (eg, regEAWriteZP)
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opTYA()
+    {   // opcode 0x98
+        // A = Y; SET_LAZY_NZ(Y);
+        this.regRN = this.regRZ = this.regA = this.regY;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSTAabsy()
+    {   // opcode 0x99
+        // EA = WORD(PC)+Y; PC += 2;
+        this.regEAWrite = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regY;
+        // ML = A;
+        this.abMem[this.regEAWrite] = this.regA;
+        // W = 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opTXS()
+    {   // opcode 0x9a
+        // S = X;
+        this.regS = this.regX | 0x100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSTAabsx()
+    {   // opcode 0x9d
+        // EA = WORD(PC)+X; PC += 2;
+        this.regEAWrite = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regX;
+        // ML = A;
+        this.abMem[this.regEAWrite] = this.regA;
+        // W = 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLDYimm()
+    {   // opcode 0xa0
+        // EA = PC++;
+        this.regEA = this.regPC++;
+        // Y = ML; SET_LAZY_NZ(ML);
+        this.regRN = this.regRZ = this.regY = this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLDAindx()
+    {   // opcode 0xa1
+        // EA = WORD((BYTE(PC++)+X) & 0xff);
+        this.regEA = ((this.abMem[this.regPC++]) + this.regX) & 0xff;
+        this.regEA = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8));
+        // A = ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = this.regA = this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLDXimm()
+    {   // opcode 0xa2
+        // EA = PC++;
+        this.regEA = this.regPC++;
+        // X = ML; SET_LAZY_NZ(ML);
+        this.regRN = this.regRZ = this.regX = this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLDYzp()
+    {   // opcode 0xa4
+        // EA = BYTE(PC++);
+        this.regEA = this.abMem[this.regPC++];
+        // Y = ML; SET_LAZY_NZ(ML);
+        this.regRN = this.regRZ = this.regY = this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLDAzp()
+    {   // opcode 0xa5
+        // EA = BYTE(PC++);
+        this.regEA = this.abMem[this.regPC++];
+        // A = ML; SET_LAZY_NZ(ML);
+        this.regRN = this.regRZ = this.regA = this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLDXzp()
+    {   // opcode 0xa6
+        // EA = BYTE(PC++);
+        this.regEA = this.abMem[this.regPC++];
+        // X = ML; SET_LAZY_NZ(ML);
+        this.regRN = this.regRZ = this.regX = this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opTAY()
+    {   // opcode 0xa8
+        // Y = A; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = this.regY = this.regA;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLDAimm()
+    {   // opcode 0xa9
+        // EA = PC++;
+        this.regEA = this.regPC++;
+        // A = ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = this.regA = this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opTAX()
+    {   // opcode 0xaa
+        // X = A; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = this.regX = this.regA;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLDYabs()
+    {   // opcode 0xac
+        // EA = WORD(PC); PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // Y = ML; SET_LAZY_NZ(ML);
+        this.regRN = this.regRZ = this.regY = this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLDAabs()
+    {   // opcode 0xad
+        // EA = WORD(PC); PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // A = ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = this.regA = this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLDXabs()
+    {   // opcode 0xae
+        // EA = WORD(PC); PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // X = ML; SET_LAZY_NZ(ML);
+        this.regRN = this.regRZ = this.regX = this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opBCS()
+    {   // opcode 0xb0
+        // PC = PC + (LAZY_C != 0? SBYTE(PC) : 0) + 1;
+        this.regPC += ((this.regRC & 0x0100)? (this.nStepCycles--,((this.abMem[this.regPC] << 24) >> 24)) : 0) + 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLDAindy()
+    {   // opcode 0xb1
+        // EA = WORD(BYTE(PC++))+Y;
+        this.regEA = (this.abMem[this.regPC++]);
+        this.regEA = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8)) + this.regY;
+        // A = ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = this.regA = this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLDYzpx()
+    {   // opcode 0xb4
+        // EA = (BYTE(PC++)+X) & 0xff;
+        this.regEA = (this.abMem[this.regPC++]+this.regX) & 0xff;
+        // Y = ML; SET_LAZY_NZ(ML);
+        this.regRN = this.regRZ = this.regY = this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLDAzpx()
+    {   // opcode 0xb5
+        // EA = (BYTE(PC++)+X) & 0xff;
+        this.regEA = (this.abMem[this.regPC++]+this.regX) & 0xff;
+        // A = ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = this.regA = this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLDXzpy()
+    {   // opcode 0xb6
+        // EA = (BYTE(PC++)+Y) & 0xff;
+        this.regEA = (this.abMem[this.regPC++]+this.regY) & 0xff;
+        // X = ML; SET_LAZY_NZ(ML);
+        this.regRN = this.regRZ = this.regX = this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opCLV()
+    {   // opcode 0xb8
+        // SET_LAZY_V(0);
+        this.regRV = 0; this.regRU = 0;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLDAabsy()
+    {   // opcode 0xb9
+        // EA = WORD(PC)+Y; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regY;
+        // A = ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = this.regA = this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opTSX()
+    {   // opcode 0xba
+        // X = S; SET_LAZY_NZ(S);
+        this.regRN = this.regRZ = this.regX = this.regS & 0xff;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLDYabsx()
+    {   // opcode 0xbc
+        // EA = WORD(PC)+X; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regX;
+        // Y = ML; SET_LAZY_NZ(ML);
+        this.regRN = this.regRZ = this.regY = this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLDAabsx()
+    {   // opcode 0xbd
+        // EA = WORD(PC)+X; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regX;
+        // A = ML; SET_LAZY_NZ(A);
+        this.regRN = this.regRZ = this.regA = this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opLDXabsy()
+    {   // opcode 0xbe
+        // EA = WORD(PC)+Y; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regY;
+        // X = ML; SET_LAZY_NZ(ML);
+        this.regRN = this.regRZ = this.regX = this.abMem[this.regEA];
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opCPYimm()
+    {   // opcode 0xc0
+        // EA = PC++;
+        this.regEA = this.regPC++;
+        // RC = Y - ML;
+        this.regRC = this.regY - this.abMem[this.regEA];
+        // SET_LAZY_NZ(RC);
+        this.regRN = this.regRZ = (this.regRC);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opCMPindx()
+    {   // opcode 0xc1
+        // EA = WORD((BYTE(PC++)+X) & 0xff);
+        this.regEA = ((this.abMem[this.regPC++]) + this.regX) & 0xff;
+        this.regEA = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8));
+        // RC = A - ML; SET_LAZY_NZ(RC);
+        this.regRN = this.regRZ = this.regRC = (this.regA - this.abMem[this.regEA]);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opCPYzp()
+    {   // opcode 0xc4
+        // EA = BYTE(PC++);
+        this.regEA = this.abMem[this.regPC++];
+        // RC = Y - ML;
+        this.regRC = this.regY - this.abMem[this.regEA];
+        // SET_LAZY_NZ(RC);
+        this.regRN = this.regRZ = (this.regRC);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opCMPzp()
+    {   // opcode 0xc5
+        // EA = BYTE(PC++);
+        this.regEA = this.abMem[this.regPC++];
+        // RC = A - ML; SET_LAZY_NZ(RC);
+        this.regRN = this.regRZ = this.regRC = (this.regA - this.abMem[this.regEA]);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opDECzp()
+    {   // opcode 0xc6
+        // EA = BYTE(PC++);
+        this.regEAWrite = this.abMem[this.regPC++];
+        // ML = ML - 1; SET_LAZY_NZ(ML);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = ((this.abMem[this.regEAWrite] - 1) & 0xff);
+        // W = 1;
+        // NOTE: Consider alternatives for tracking zero-page writes (eg, regEAWriteZP)
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opINY()
+    {   // opcode 0xc8
+        // Y = ((Y + 1) & 0xff);
+        this.regY = ((this.regY + 1) & 0xff);
+        // SET_LAZY_NZ(Y);
+        this.regRN = this.regRZ = (this.regY);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opCMPimm()
+    {   // opcode 0xc9
+        // EA = PC++;
+        this.regEA = this.regPC++;
+        // RC = A - ML; SET_LAZY_NZ(RC);
+        this.regRN = this.regRZ = this.regRC = (this.regA - this.abMem[this.regEA]);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opDEX()
+    {   // opcode 0xca
+        // X = ((X - 1) & 0xff); SET_LAZY_NZ(X);
+        this.regRN = this.regRZ = this.regX = ((this.regX - 1) & 0xff);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opCPYabs()
+    {   // opcode 0xcc
+        // EA = WORD(PC); PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // RC = Y - ML; SET_LAZY_NZ(RC);
+        this.regRN = this.regRZ = this.regRC = this.regY - this.abMem[this.regEA];
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opCMPabs()
+    {   // opcode 0xcd
+        // EA = WORD(PC); PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // RC = A - ML; SET_LAZY_NZ(RC);
+        this.regRN = this.regRZ = this.regRC = (this.regA - this.abMem[this.regEA]);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opDECabs()
+    {   // opcode 0xce
+        // EA = WORD(PC); PC += 2;
+        this.regEAWrite = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // ML = ML - 1; SET_LAZY_NZ(ML);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = ((this.abMem[this.regEAWrite] - 1) & 0xff);
+        // W = 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opBNE()
+    {   // opcode 0xd0
+        // PC = PC + (LAZY_Z == 0? SBYTE(PC) : 0) + 1;
+        this.regPC += ((this.regRZ & 0xff)? (this.nStepCycles--,((this.abMem[this.regPC] << 24) >> 24)) : 0) + 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opCMPindy()
+    {   // opcode 0xd1
+        // EA = WORD(BYTE(PC++))+Y;
+        this.regEA = (this.abMem[this.regPC++]);
+        this.regEA = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8)) + this.regY;
+        // RC = A - ML; SET_LAZY_NZ(RC);
+        this.regRN = this.regRZ = this.regRC = (this.regA - this.abMem[this.regEA]);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opCMPzpx()
+    {   // opcode 0xd5
+        // EA = (BYTE(PC++)+X) & 0xff;
+        this.regEA = (this.abMem[this.regPC++]+this.regX) & 0xff;
+        // RC = A - ML; SET_LAZY_NZ(RC);
+        this.regRN = this.regRZ = this.regRC = (this.regA - this.abMem[this.regEA]);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opDECzpx()
+    {   // opcode 0xd6
+        // EA = (BYTE(PC++)+X) & 0xff;
+        this.regEAWrite = (this.abMem[this.regPC++]+this.regX) & 0xff;
+        // ML = ML - 1; SET_LAZY_NZ(ML);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = ((this.abMem[this.regEAWrite] - 1) & 0xff);
+        // W = 1;
+        // NOTE: Consider alternatives for tracking zero-page writes (eg, regEAWriteZP)
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opCLD()
+    {   // opcode 0xd8
+        // D = 0;
+        this.clearBCD();
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opCMPabsy()
+    {   // opcode 0xd9
+        // EA = WORD(PC)+Y; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regY;
+        // RC = A - ML; SET_LAZY_NZ(RC);
+        this.regRN = this.regRZ = this.regRC = (this.regA - this.abMem[this.regEA]);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opCMPabsx()
+    {   // opcode 0xdd
+        // EA = WORD(PC)+X; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regX;
+        // RC = A - ML; SET_LAZY_NZ(RC);
+        this.regRN = this.regRZ = this.regRC = (this.regA - this.abMem[this.regEA]);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opDECabsx()
+    {   // opcode 0xde
+        // EA = WORD(PC)+X; PC += 2;
+        this.regEAWrite = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regX;
+        // ML = ML - 1; SET_LAZY_NZ(ML);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = ((this.abMem[this.regEAWrite] - 1) & 0xff);
+        // W = 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opCPXimm()
+    {   // opcode 0xe0
+        // EA = PC++;
+        this.regEA = this.regPC++;
+        // RC = X - ML;
+        this.regRC = this.regX - this.abMem[this.regEA];
+        // SET_LAZY_NZ(RC);
+        this.regRN = this.regRZ = (this.regRC);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSBCindx()
+    {   // opcode 0xe1
+        // EA = WORD((BYTE(PC++)+X) & 0xff);
+        this.regEA = ((this.abMem[this.regPC++]) + this.regX) & 0xff;
+        this.regEA = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8));
+        // RC = (A - ML - !LAZY_C);
+        this.regRC = (this.regA - this.abMem[this.regEA] - ((this.regRC & 0x0100)? 0 : 1));
+        // SET_LAZY_OV(A,ML,RC);
+        this.regRU = this.regA ^ this.abMem[this.regEA]; this.regRV = this.regRC;
+        // A = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.regA = (this.regRC & 0xff);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSBCindxBCD()
+    {   // opcode 0xe1
+        // EA = WORD((BYTE(PC++)+X) & 0xff);
+        this.regEA = ((this.abMem[this.regPC++]) + this.regX) & 0xff;
+        this.regEA = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8));
+        // A = this.subBCD(A,ML);
+        this.regA = this.subBCD(this.regA, this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opCPXzp()
+    {   // opcode 0xe4
+        // EA = BYTE(PC++);
+        this.regEA = this.abMem[this.regPC++];
+        // RC = X - ML;
+        this.regRC = this.regX - this.abMem[this.regEA];
+        // SET_LAZY_NZ(RC);
+        this.regRN = this.regRZ = (this.regRC);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSBCzp()
+    {   // opcode 0xe5
+        // EA = BYTE(PC++);
+        this.regEA = this.abMem[this.regPC++];
+        // RC = (A - ML - !LAZY_C);
+        this.regRC = (this.regA - this.abMem[this.regEA] - ((this.regRC & 0x0100)? 0 : 1));
+        // SET_LAZY_OV(A,ML,RC);
+        this.regRU = this.regA ^ this.abMem[this.regEA]; this.regRV = this.regRC;
+        // A = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.regA = (this.regRC & 0xff);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSBCzpBCD()
+    {   // opcode 0xe5
+        // EA = BYTE(PC++);
+        this.regEA = this.abMem[this.regPC++];
+        // A = this.subBCD(A,ML);
+        this.regA = this.subBCD(this.regA, this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opINCzp()
+    {   // opcode 0xe6
+        // EA = BYTE(PC++);
+        this.regEAWrite = this.abMem[this.regPC++];
+        // ML = ML + 1; SET_LAZY_NZ(ML);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = ((this.abMem[this.regEAWrite] + 1) & 0xff);
+        // W = 1;
+        // NOTE: Consider alternatives for tracking zero-page writes (eg, regEAWriteZP)
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opINX()
+    {   // opcode 0xe8
+        // X = ((X + 1) & 0xff);
+        this.regX = ((this.regX + 1) & 0xff);
+        // SET_LAZY_NZ(X);
+        this.regRN = this.regRZ = (this.regX);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSBCimm()
+    {   // opcode 0xe9
+        // EA = PC++;
+        this.regEA = this.regPC++;
+        // RC = (A - ML - !LAZY_C);
+        this.regRC = (this.regA - this.abMem[this.regEA] - ((this.regRC & 0x0100)? 0 : 1));
+        // SET_LAZY_OV(A,ML,RC);
+        this.regRU = this.regA ^ this.abMem[this.regEA]; this.regRV = this.regRC;
+        // A = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.regA = (this.regRC & 0xff);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSBCimmBCD()
+    {   // opcode 0xe9
+        // EA = PC++;
+        this.regEA = this.regPC++;
+        // A = this.subBCD(A,ML);
+        this.regA = this.subBCD(this.regA, this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opNOP()
+    {   // opcode 0xea
+        //
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opCPXabs()
+    {   // opcode 0xec
+        // EA = WORD(PC); PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // RC = X - ML; SET_LAZY_NZ(RC);
+        this.regRN = this.regRZ = this.regRC = this.regX - this.abMem[this.regEA];
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSBCabs()
+    {   // opcode 0xed
+        // EA = WORD(PC); PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // RC = (A - ML - !LAZY_C);
+        this.regRC = (this.regA - this.abMem[this.regEA] - ((this.regRC & 0x0100)? 0 : 1));
+        // SET_LAZY_OV(A,ML,RC);
+        this.regRU = this.regA ^ this.abMem[this.regEA]; this.regRV = this.regRC;
+        // A = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.regA = (this.regRC & 0xff);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSBCabsBCD()
+    {   // opcode 0xed
+        // EA = WORD(PC); PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // A = this.subBCD(A,ML);
+        this.regA = this.subBCD(this.regA, this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opINCabs()
+    {   // opcode 0xee
+        // EA = WORD(PC); PC += 2;
+        this.regEAWrite = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+        // ML = ML + 1; SET_LAZY_NZ(ML);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = ((this.abMem[this.regEAWrite] + 1) & 0xff);
+        // W = 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opBEQ()
+    {   // opcode 0xf0
+        // PC = PC + (LAZY_Z == 1? SBYTE(PC) : 0) + 1;
+        this.regPC += (!(this.regRZ & 0xff)? (this.nStepCycles--,((this.abMem[this.regPC] << 24) >> 24)) : 0) + 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSBCindy()
+    {   // opcode 0xf1
+        // EA = WORD(BYTE(PC++))+Y;
+        this.regEA = (this.abMem[this.regPC++]);
+        this.regEA = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8)) + this.regY;
+        // RC = (A - ML - !LAZY_C);
+        this.regRC = (this.regA - this.abMem[this.regEA] - ((this.regRC & 0x0100)? 0 : 1));
+        // SET_LAZY_OV(A,ML,RC);
+        this.regRU = this.regA ^ this.abMem[this.regEA]; this.regRV = this.regRC;
+        // A = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.regA = (this.regRC & 0xff);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSBCindyBCD()
+    {   // opcode 0xf1
+        // EA = WORD(BYTE(PC++))+Y;
+        this.regEA = (this.abMem[this.regPC++]);
+        this.regEA = (this.abMem[this.regEA] | (this.abMem[this.regEA+1] << 8)) + this.regY;
+        // A = this.subBCD(A,ML);
+        this.regA = this.subBCD(this.regA, this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSBCzpx()
+    {   // opcode 0xf5
+        // EA = (BYTE(PC++)+X) & 0xff;
+        this.regEA = (this.abMem[this.regPC++]+this.regX) & 0xff;
+        // RC = (A - ML - !LAZY_C);
+        this.regRC = (this.regA - this.abMem[this.regEA] - ((this.regRC & 0x0100)? 0 : 1));
+        // SET_LAZY_OV(A,ML,RC);
+        this.regRU = this.regA ^ this.abMem[this.regEA]; this.regRV = this.regRC;
+        // A = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.regA = (this.regRC & 0xff);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSBCzpxBCD()
+    {   // opcode 0xf5
+        // EA = (BYTE(PC++)+X) & 0xff;
+        this.regEA = (this.abMem[this.regPC++]+this.regX) & 0xff;
+        // A = this.subBCD(A,ML);
+        this.regA = this.subBCD(this.regA, this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opINCzpx()
+    {   // opcode 0xf6
+        // EA = (BYTE(PC++)+X) & 0xff;
+        this.regEAWrite = (this.abMem[this.regPC++]+this.regX) & 0xff;
+        // ML = ML + 1; SET_LAZY_NZ(ML);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = ((this.abMem[this.regEAWrite] + 1) & 0xff);
+        // W = 1;
+        // NOTE: Consider alternatives for tracking zero-page writes (eg, regEAWriteZP)
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSED()
+    {   // opcode 0xf8
+        // D = 1;
+        this.setBCD();
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSBCabsy()
+    {   // opcode 0xf9
+        // EA = WORD(PC)+Y; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regY;
+        // RC = (A - ML - !LAZY_C);
+        this.regRC = (this.regA - this.abMem[this.regEA] - ((this.regRC & 0x0100)? 0 : 1));
+        // SET_LAZY_OV(A,ML,RC);
+        this.regRU = this.regA ^ this.abMem[this.regEA]; this.regRV = this.regRC;
+        // A = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.regA = (this.regRC & 0xff);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSBCabsyBCD()
+    {   // opcode 0xf9
+        // EA = WORD(PC)+Y; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regY;
+        // A = this.subBCD(A,ML);
+        this.regA = this.subBCD(this.regA, this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSBCabsx()
+    {   // opcode 0xfd
+        // EA = WORD(PC)+X; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regX;
+        // RC = (A - ML - !LAZY_C);
+        this.regRC = (this.regA - this.abMem[this.regEA] - ((this.regRC & 0x0100)? 0 : 1));
+        // SET_LAZY_OV(A,ML,RC);
+        this.regRU = this.regA ^ this.abMem[this.regEA]; this.regRV = this.regRC;
+        // A = RCL; SET_LAZY_NZ(RCL);
+        this.regRN = this.regRZ = this.regA = (this.regRC & 0xff);
+        // SET_LAZY_C(!LAZY_C);
+        this.regRC ^= 0x0100;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSBCabsxBCD()
+    {   // opcode 0xfd
+        // EA = WORD(PC)+X; PC += 2;
+        this.regEA = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regX;
+        // A = this.subBCD(A,ML);
+        this.regA = this.subBCD(this.regA, this.abMem[this.regEA]);
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opINCabsx()
+    {   // opcode 0xfe
+        // EA = WORD(PC)+X; PC += 2;
+        this.regEAWrite = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8)) + this.regX;
+        // ML = ML + 1; SET_LAZY_NZ(ML);
+        this.regRN = this.regRZ = this.abMem[this.regEAWrite] = ((this.abMem[this.regEAWrite] + 1) & 0xff);
+        // W = 1;
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opSim()
+    {
+        var addr;
+        var bSimOp = this.abMem[this.regPC++];
+        switch(bSimOp) {
+
+            case this.SIMOP_HLT:
+                this.println("HALT");
+                this.halt();
+                break;
+
+            case this.SIMOP_MSG:
+                addr = this.regPC;                  // currently we're using "inline" strings
+                // addr = (this.abMem[this.regPC++] | (this.abMem[this.regPC++] << 8));
+                var s = "";
+                while (addr < this.abMem.length) {
+                    var b = this.abMem[addr++];
+                    if (!b) break;
+                    s += String.fromCharCode(b);
+                }
+                this.regPC = addr;                  // update regPC as long as we're doing "inline" strings
+                /*
+                 * Before simply printing the string, what kinds of handy substitutions should we provide?
+                 *
+                 *      eg: %A for this.regA, %X for this.regX, etc
+                 */
+                s = s.replace(/%A/g, Str.toHex(this.regA, 2)).replace(/%X/g, Str.toHex(this.regX, 2)).replace(/%Y/g, Str.toHex(this.regY, 2));
+                this.println(s);
+                /*
+                 * To make printing "smoother", let's force a yield
+                 */
+                this.yieldCPU();
+                break;
+
+            default:
+                this.regPC -= 2;
+                this.println("undefined opSim: " + Str.toHexByte(bSimOp) + " at " + Str.toHexWord(this.regPC));
+                this.halt();
+        }
+    }
+
+    /**
+     * @this {C1PCPU}
+     */
+    opUndefined()
+    {
+        var b = this.abMem[--this.regPC];
+        this.println("undefined opcode: " + Str.toHexByte(b) + " at " + Str.toHexWord(this.regPC));
+        this.halt();
+    }
+
+    /**
+     * C1PCPU.init()
+     *
+     * This function operates on every HTML element of class "cpu", extracting the
+     * JSON-encoded parameters for the C1PCPU constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a C1PCPU component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeCPUs = Component.getElementsByClass(document, C1PJS.APPCLASS, "cpu");
+        for (var iCPU=0; iCPU < aeCPUs.length; iCPU++) {
+            var eCPU = aeCPUs[iCPU];
+            var parmsCPU = Component.getComponentParms(eCPU);
+            var cpu = new C1PCPU(parmsCPU);
+            Component.bindComponentControls(cpu, eCPU, C1PJS.APPCLASS);
+        }
+    }
+}
+
+/*
+ * Macro reference (from my original 1998 C source code, preserved in the comments below):
+ *
+ *      #define BYTE(a)  (abMem[(a) & 0xffff])
+ *      #define WORD(a)  (*(word *)&BYTE(a))
+ *      #define SBYTE(a) ((int)(char)BYTE(a))
+ *      #define STACK(a) BYTE(((a) & 0xff)+0x100)
+ *      #define M WORD(EA)
+ *      #define ML BYTE(EA+0)
+ *      #define MH BYTE(EA+1)
+ *      #define A (aRegs[0].value)  // 8 bits
+ *      #define X (aRegs[1].value)  // 8 bits
+ *      #define Y (aRegs[2].value)  // 8 bits
+ *      #define S (aRegs[3].value)  // 8 bits
+ *      #define P (aRegs[4].value)  // 8 bits
+ *      #define RN (aRegs[5].value) // 8 bits
+ *      #define RZ (aRegs[6].value) // 8 bits
+ *      #define RU (aRegs[7].value) // 8 bits
+ *      #define RV (aRegs[8].value) // 16 bits
+ *      #define RC (aRegs[9].value) // 16 bits
+ *      #define EA (aRegs[10].value)// 16 bits
+ *      #define LA (aRegs[11].value)// 16 bits
+ *      #define PC (aRegs[12].value)// 16 bits
+ *      #define EF (aRegs[13].value)// 8 bits
+ *      #define C P0
+ *      #define Z P1
+ *      #define I P2
+ *      #define D P3
+ *      #define B P4
+ *      #define V P6
+ *      #define N P7
+ *      #define W EF0
+ *      #define LAZY_C (RCH0)
+ *      #define SET_LAZY_C(b) (RCH0 = (b))
+ *      #define LAZY_N (RN7)
+ *      #define SET_LAZY_N(b) (RN7 = (b))
+ *      #define SET_LAZY_NZ(v) (RN = RZ = (v))
+ *      #define LAZY_Z ((byte)RZ == 0)
+ *      #define SET_LAZY_Z(b) (RZ = !(b))
+ *      #define LAZY_V ((((RVL ^ RU) ^ (RV >> 1)) & 0x80) != 0)
+ *      #define SET_LAZY_V(b) (RV = 0, RU = ((b)? 0x80 : 0x00))
+ *      #define SET_LAZY_OV(a,b,r) (RU = (a) ^ (b), RV = (r))
+ */
+
+/*
+ * Initialize every CPU module on the page (as IF there's ever going to be more than one ;-))
+ */
+Web.onInit(C1PCPU.init);
+
+/**
+ * @copyright http://pcjs.org/modules/c1pjs/lib/rom.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class C1PROM extends Component {
+    /**
+     * C1PROM(parmsROM)
+     *
+     * The ROM component expects the following (parmsROM) properties:
+     *
+     *      size: amount of ROM, in bytes
+     *      image: name of ROM image file
+     *
+     * NOTE: The final location for the ROM image, once loaded, will be specified
+     * by the Computer object, using the setBuffer() method.
+     *
+     * @this {C1PROM}
+     * @param {Object} parmsROM
+     * @property {function()} convertImage
+     */
+    constructor(parmsROM)
+    {
+        super("C1PROM", parmsROM);
+
+        this.abMem = null;
+        this.abImage = null;
+        this.cbROM = parmsROM['size'];
+        this.sImage = parmsROM['image'];
+        if (this.sImage) {
+            var sFileURL = this.sImage;
+            /**
+             * If the selected ROM image has a ".json" extension, then we assume it's a pre-converted
+             * JSON-encoded ROM image, so we load it as-is; ditto for files with a ".hex" extension. Otherwise,
+             * we ask our server-side ROM image converter to return the corresponding JSON-encoded data,
+             * in compact form (ie, minimal whitespace, no ASCII data comments, etc).
+             */
+            var sFileExt = Str.getExtension(this.sImage);
+            if (sFileExt != DumpAPI.FORMAT.JSON && sFileExt != DumpAPI.FORMAT.HEX) {
+                sFileURL = Web.getHost() + DumpAPI.ENDPOINT + '?' + DumpAPI.QUERY.FILE + '=' + this.sImage + '&' + DumpAPI.QUERY.FORMAT + '=' + DumpAPI.FORMAT.BYTES;
+            }
+            var rom = this;
+            Web.getResource(sFileURL, null, true, function(sURL, sResponse, nErrorCode) {
+                rom.convertImage(sURL, sResponse, nErrorCode);
+            });
+        }
+    }
+
+    /**
+     * @this {C1PROM}
+     * @param {Array} abMemory
+     * @param {number} start
+     * @param {number} end
+     * @param {C1PCPU} cpu
+     */
+    setBuffer(abMemory, start, end, cpu)
+    {
+        this.abMem = abMemory;
+        this.offROM = start;
+        var cbROM = end - start + 1;
+        /*
+         * It's possible that the ROM component didn't specify a size,
+         * in which case just use the size the Computer component has specified.
+         */
+        if (!this.cbROM)
+            this.cbROM = cbROM;
+        if (cbROM != this.cbROM) {
+            this.setError("computer-specified ROM size (" + Str.toHexWord(cbROM) + ") does not match component-specified size (" + Str.toHexWord(this.cbROM) + ")");
+            return;
+        }
+        if (cpu) {
+            this.cpu = cpu;
+            cpu.addWriteNotify(start, end, this, this.setByte);
+        }
+        this.copyImage();
+    }
+
+    /**
+     * @this {C1PROM}
+     * @param {boolean} fOn
+     * @param {C1PComputer} cmp
+     */
+    setPower(fOn, cmp)
+    {
+        if (fOn && !this.flags.powered) {
+            this.flags.powered = true;
+            if (DEBUGGER) this.dbg = cmp.getComponentByType("debugger");
+        }
+    }
+
+    /**
+     * @this {C1PROM}
+     * @param {number} addr
+     * @param {number|undefined} [addrFrom]
+     */
+    setByte(addr, addrFrom)
+    {
+        /*
+         * Beyond reporting this write, we need to "repair" the ROM, using the original image data,
+         * but only if addrFrom is defined (undefined implies this is a write from the Debugger, and
+         * we need to allow the Debugger to modify ROM contents).
+         */
+        if (addrFrom !== undefined) {
+            if (DEBUGGER && this.dbg) this.dbg.messageIO(this, addr, addrFrom, this.dbg.MESSAGE_PORT, true);
+            var offset = (addr - this.offROM);
+
+            if (!this.abImage)
+                this.abMem[this.offROM + offset] = 0;
+            else
+                this.abMem[this.offROM + offset] = this.abImage[offset];
+        }
+    }
+
+    /**
+     * @this {C1PROM}
+     * @param {string} sImageName
+     * @param {string} sImageData
+     * @param {number} nErrorCode (response from server if anything other than 200)
+     */
+    convertImage(sImageName, sImageData, nErrorCode)
+    {
+        if (nErrorCode) {
+            this.println("Error loading ROM \"" + sImageName + "\" (" + nErrorCode + ")");
+            return;
+        }
+        if (sImageData.charAt(0) == "[" || sImageData.charAt(0) == "{") {
+            try {
+                /*
+                 * The most likely source of any exception will be here: parsing the JSON-encoded ROM data.
+                 */
+                var rom = eval("(" + sImageData + ")");
+                var ab = rom['bytes'];
+                if (ab) {
+                    this.abImage = ab;
+                } else {
+                    this.abImage = rom;
+                }
+            } catch (e) {
+                this.println("Error processing ROM \"" + sImageName + "\": " + e.message);
+                return;
+            }
+        }
+        else {
+            /*
+             * Parse the ROM image data manually; we assume it's in "simplified" hex form (a series of hex byte-values separated by whitespace)
+             */
+            var sData = sImageData.replace(/\n/gm, " ").replace(/ +$/, "");
+            var asData = sData.split(" ");
+            this.abImage = new Array(asData.length);
+            for (var i=0; i < asData.length; i++) {
+                this.abImage[i] = parseInt(asData[i], 16);
+            }
+        }
+        this.copyImage();
+    }
+
+    /**
+     * @this {C1PROM}
+     */
+    copyImage()
+    {
+        /*
+         * The Computer object may give us the address of the ROM image before we've finished downloading the image,
+         * so both setBuffer() and convertImage() call copyImage(), which in turn will copy the image ONLY when both
+         * pieces are in place.  At that point, the component becomes "ready", in much the same way that other components
+         * (eg, CPU and Screen) become "ready" when all their prerequisites are satisfied.
+         */
+        if (!this.isReady()) {
+            if (!this.sImage) {
+                this.setReady();
+            }
+            else
+            if (this.abImage && this.abMem) {
+                var cbImage = this.abImage.length;
+                if (cbImage != this.cbROM) {
+                    this.setError("ROM image size (" + Str.toHexWord(cbImage) + ") does not match component-specified size (" + Str.toHexWord(this.cbROM) + ")");
+                    return;
+                }
+                if (DEBUG) this.log("copyImage(): copying ROM to " + Str.toHexWord(this.offROM) + " (" + Str.toHexWord(cbImage) + " bytes)");
+                for (var i=0; i < cbImage; i++) {
+                    this.abMem[this.offROM + i] = this.abImage[i];
+                }
+                this.setReady();
+            }
+        }
+    }
+
+    /**
+     * C1PROM.init()
+     *
+     * This function operates on every HTML element of class "rom", extracting the
+     * JSON-encoded parameters for the C1PROM constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a C1PROM component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeROM = Component.getElementsByClass(document, C1PJS.APPCLASS, "rom");
+        for (var iROM=0; iROM < aeROM.length; iROM++) {
+            var eROM = aeROM[iROM];
+            var parmsROM = Component.getComponentParms(eROM);
+            var rom = new C1PROM(parmsROM);
+            Component.bindComponentControls(rom, eROM, C1PJS.APPCLASS);
+        }
+    }
+}
+
+/*
+ * Initialize all the ROM modules on the page.
+ */
+Web.onInit(C1PROM.init);
+
+/**
+ * @copyright http://pcjs.org/modules/c1pjs/lib/ram.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class C1PRAM extends Component {
+    /**
+     * C1PRAM(parmsRAM)
+     *
+     * The RAM component expects the following (parmsRAM) properties:
+     *
+     *      size: amount of RAM, in bytes
+     *
+     * NOTE: We may make a note of the specified size, but we will not actually allocate
+     * any memory for the RAM; we wait for the Computer object to tell us where our RAM is,
+     * using the setBuffer() method.
+     *
+     * @this {C1PRAM}
+     * @param {Object} parmsRAM
+     */
+    constructor(parmsRAM)
+    {
+        super("C1PRAM", parmsRAM);
+    }
+
+    /**
+     * @this {C1PRAM}
+     * @param {Array} abMemory
+     * @param {number} start
+     * @param {number} end
+     * @param {C1PCPU} cpu
+     */
+    setBuffer(abMemory, start, end, cpu)
+    {
+        this.abMem = abMemory;
+     // this.offRAM = start;
+     // this.cbRAM = end - start + 1;
+        this.setReady();
+    }
+
+    /**
+     * C1PRAM.init()
+     *
+     * This function operates on every HTML element of class "ram", extracting the
+     * JSON-encoded parameters for the C1PRAM constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a C1PRAM component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeRAM = Component.getElementsByClass(document, C1PJS.APPCLASS, "ram");
+        for (var iRAM=0; iRAM < aeRAM.length; iRAM++) {
+            var eRAM = aeRAM[iRAM];
+            var parmsRAM = Component.getComponentParms(eRAM);
+            var ram = new C1PRAM(parmsRAM);
+            Component.bindComponentControls(ram, eRAM, C1PJS.APPCLASS);
+        }
+    }
+}
+
+/*
+ * Initialize all the RAM modules on the page.
+ */
+Web.onInit(C1PRAM.init);
+
+/**
+ * @copyright http://pcjs.org/modules/c1pjs/lib/keyboard.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class C1PKeyboard extends Component {
+    /**
+     * C1PKeyboard(parmsKbd)
+     *
+     * The Keyboard component can be configured with the following (parmsKbd) properties:
+     *
+     *      model: model number (one of: 542 or 600; 600 is the default)
+     *
+     * Its main purpose is to receive binding requests for various keyboard events,
+     * and to use those events to simulate the C1P's keyboard hardware; specifically,
+     * an OSI model 600 board (NOT the model 542).
+     *
+     * Keys on the C1P keyboard that differ from modern keyboards, along with their
+     * closest modern counterpart:
+     *
+     *      C1P      PC
+     *      ---      --
+     *      2"       2@
+     *      6&       6^
+     *      7'       7&
+     *      8(       8*
+     *      9)       9(
+     *      0        0)
+     *      :*       -_
+     *      -=       =+
+     *      ;+       ;:
+     *      LINEFEED CTRL-J
+     *      RETURN   ENTER (or CTRL-M)
+     *      SHIFT-O  DELETE (or CTRL-H)
+     *      SHIFT-N  ^
+     *      SHIFT-P  @ (used by the BASIC-IN-ROM to abandon the current line)
+     *      SHIFT-L  \
+     *      SHIFT-K  [
+     *      SHIFT-M  ]
+     *      CTRL-C   Same (used by the BASIC-IN-ROM to interrupt RUN and LIST, unless disabled with POKE 530,1)
+     *      CTRL-O   Same (used by the BASIC-IN-ROM to suppress output until another CTRL-O is typed)
+     *      RUB-OUT  (no mapping chosen for this key yet)
+     *      REPEAT   (no mapping chosen for this key yet)
+     *
+     * Problems with iOS Devices
+     * -------------------------
+     * The keyboard pops up with the SHIFT key depressed, which is not the initial keyboard state that the C1P expects.
+     * I tried to fix that by adding an 'autocapitalize="off"' attribute alongside the 'contenteditable="true"' attribute
+     * on the <canvas> element, but apparently Safari v5 honors that only inside certain elements (eg, <input>).  The simplest
+     * work-around is to tap the iOS device's SHIFT key before starting to type, but I'd prefer an automatic solution.
+     *
+     * Another work-around might be to NEVER pass the real CAPS-LOCK state to the virtual machine, and whenever CAPS-LOCK is
+     * actually down, automatically "uncapitalize" all letters.
+     *
+     * However, the current work-around is for keyPressSimulate() to ALWAYS convert all alphabetic charCodes to their
+     * lower-case equivalents, and simply let the C1P's own shift-key logic do its thing.  Note that we do this ONLY for
+     * iOS devices, so that on all other devices, you can still use special shifted key combinations like SHIFT-O and SHIFT-P;
+     * this work-around breaks those key combinations for iOS devices, but that seems like a reasonable trade-off.
+     *
+     * Simple C1P Virtual Hardware Test
+     * --------------------------------
+     * Using the following code:
+     *
+     *      10 POKE 530,1
+     *      20 KEY=57088
+     *      25 Q=-1
+     *      30 POKE KEY,64
+     *      40 P=PEEK(KEY)
+     *      50 IF P<>Q THEN PRINT P
+     *      60 Q=P
+     *      70 GOTO 30
+     *
+     * The value 64 (0x40) should have enabled every row except R6.  Here were the results for keys
+     * on row R7:
+     *
+     *        1   2   3   4   5   6   7
+     *      --- --- --- --- --- --- ---
+     *      126 190 222 238 246 250 252
+     *
+     * Sure enough, none of the keys on R6 worked, and all the keys on rows R0-R5 generated the same
+     * values as R7. But why were the values read all EVEN instead of ODD (ie, why was bit 0 cleared as
+     * well?)  Answer: because 0x40 also enables keys on row R0, where the SHIFT-LOCK key resides,
+     * and since the SHIFT-LOCK is normally locked AND also sits in column C0, bit 0 will be clear as well.
+     *
+     * This explains why the "STAR WARS" game (SAMPLE4.BAS) expected values "126,190,222,238,246,250"
+     * for keys 1-6 after POKE'ing 64 into location 57088 (0xdf00), instead of the more typical values
+     * "127,191,223,239,247,251."  This also means that anyone who happened to unlock their SHIFT-LOCK
+     * would have trouble playing that game.
+     *
+     * @this {C1PKeyboard}
+     * @param {Object} parmsKbd
+     */
+    constructor(parmsKbd)
+    {
+        super("C1PKeyboard", parmsKbd);
+
+        this.flags.powered = false;
+        this.nDefaultModel = parmsKbd['model'];
+
+        /*
+         * keyCodes that I must pay particular attention to
+         */
+        this.KEYCODE_DELETE     = 0x08;
+        this.KEYCODE_TAB        = 0x09;
+        this.KEYCODE_LF         = 0x0A;
+        this.KEYCODE_CR         = 0x0D;
+        this.KEYCODE_SHIFT      = 0x10;                 // I map this to CHARCODE_LSHIFT
+        this.KEYCODE_CONTROL    = 0x11;
+        this.KEYCODE_ALT        = 0x12;                 // I map this to CHARCODE_RSHIFT (since the C1P keyboard has no ALT key)
+        this.KEYCODE_CAPSLOCK   = 0x14;
+        this.KEYCODE_ESC        = 0x1B;                 // NOTE: for some reason, this comes in via keyDown/keyUp only, not keyPress
+        this.KEYCODE_COMMAND    = 0x5B;
+
+        /*
+         * The following charCodes are the same as the corresponding keyCodes
+         */
+        this.CHARCODE_DELETE    = this.KEYCODE_DELETE;
+        this.CHARCODE_LF        = this.KEYCODE_LF;
+        this.CHARCODE_CR        = this.KEYCODE_CR;
+        this.CHARCODE_ESC       = this.KEYCODE_ESC;
+
+        /*
+         * The following charCodes are NOT the same as the corresponding keyCodes, hence the bias (PSEUDO_CHARCODE);
+         * I've deliberately chosen a bias that still produces values in the byte range (0x00-0xFF) and will therefore
+         * fit into aCharCodeMap, but which shouldn't conflict with any actual, type-able keys.
+         */
+        this.PSEUDO_CHARCODE    = 0xE0;
+        this.CHARCODE_LSHIFT    = this.KEYCODE_SHIFT    + this.PSEUDO_CHARCODE;
+        this.CHARCODE_CTRL      = this.KEYCODE_CONTROL  + this.PSEUDO_CHARCODE;
+        this.CHARCODE_RSHIFT    = this.KEYCODE_ALT      + this.PSEUDO_CHARCODE;
+        this.CHARCODE_SHIFTLOCK = this.KEYCODE_CAPSLOCK + this.PSEUDO_CHARCODE;
+
+        /*
+         * Other common character codes, pseudo (like the C1P's "BREAK" key, which has no modern analog) or otherwise
+         */
+        this.CHARCODE_BREAK     = 0x00 + this.PSEUDO_CHARCODE;
+        this.CHARCODE_CTRLC     = 0x03;
+        this.CHARCODE_CTRLO     = 0x0F;
+
+        /*
+         * These are "shift key" bits I store in bitsShift, and with the exception of BIT_COMMAND (because
+         * the C1P doesn't have a COMMAND key), they all match the bit position of the corresponding shift key's
+         * column on row 0 (abKbdCols[0]) of the simulated keyboard hardware.
+         *
+         * NOTE: Whenever shift key bits need to be restored from bitsShift to abKbdCols[0] (eg, when restoring
+         * the current shift state at the completion of a simulated key), be sure to mask bitsShift with BITS_SIMULATE
+         * before propagating them.
+         */
+        this.BIT_SHIFTLOCK      = 0x01;
+        this.BIT_RSHIFT         = 0x02;
+        this.BIT_LSHIFT         = 0x04;
+        this.BIT_COMMAND        = 0x08;     // the C1P has no key "wired" to this column, so I can use this bit for COMMAND
+        this.BIT_CTRL           = 0x40;
+        this.BITS_SIMULATE      = (this.BIT_RSHIFT | this.BIT_LSHIFT | this.BIT_CTRL);
+
+        this.SIMCODE_KEYPRESS   = 0;
+        this.SIMCODE_KEYRELEASE = 1;
+        this.SIMCODE_KEYEVENT   = 2;
+        this.SIMCODE_KEYTIMEOUT = 3;
+        this.SIMCODE_AUTOCLEAR  = 4;
+        this.aSimCodeDescs = ["keyPress","keyRelease","keyEvent","keyTimeout","autoClear"];
+
+        /*
+         * From "OSI C1P Technical Report" p.19 regarding the Model 600 Board:
+         *
+         *      "By holding down any key, one will first get one character output, and after approximately
+         *      a half second delay a repeat rate of approximately 5 characters per second."
+         */
+        this.nCyclesThreshold   = 8192;     // number of virtual CPU cycles required before aKbdStates is propagated
+        this.msReleaseDelay     = 250;      // number of milliseconds before a down key is "forced" up (unless we see it go up)
+        this.msReleaseRepeat    = 100;      // number of milliseconds before a held key is "forced" up (assuming auto-repeat)
+        this.msInjectDelay      = 300;      // number of milliseconds between injected keystrokes
+
+        this.aButtonCodeMap = {};
+        this.aButtonCodeMap['break']  = this.CHARCODE_BREAK;
+        this.aButtonCodeMap['esc']    = this.CHARCODE_ESC;
+        this.aButtonCodeMap['ctrl-c'] = this.CHARCODE_CTRLC;
+        this.aButtonCodeMap['ctrl-o'] = this.CHARCODE_CTRLO;
+
+        /*
+         * This array is used by keyEventSimulate() to lookup a given charCode and convert it to the appropriate
+         * row/col bit combination that the C1P requires.  I assign each supported charCode a 16-bit value, where
+         * the high byte contains the row/col pair (in the high and low nibbles, respectively), and the low byte
+         * contains any required shift-key code.
+         *
+         * For example, an apostrophe (0x27) is an unshifted key on a modern keyboard, but it is a SHIFT-7 on the
+         * C1P keyboard, so when I simulate the 7, I must also simulate a SHIFT (I always choose the LEFT shift
+         * key -- CHARCODE_LSHIFT -- but that choice is completely arbitrary).
+         *
+         * Using charCodes (from keyPress events) proved to be more robust than using keyCodes (from keyDown and
+         * keyUp events), in part because of differences between the C1P keyboard's layout and modern keyboards,
+         * and also because of differences in the way browsers generate the keyDown and keyUp events.  For
+         * example, Safari on iOS devices will not generate up/down events for shift keys, and for other keys,
+         * the up/down events are usually generated after the actual press is complete, and in rapid succession,
+         * which doesn't give the slow C1P virtual machine enough time to detect the key.
+         *
+         * There are still a few times that I call keyEventSimulate() from keyEvent(), and for those occasions,
+         * I create a pseudo-charCode value by adding PSEUDO_CHARCODE (0xE0) to the keyCode value, to avoid any
+         * confusion with real charCodes:
+         *
+         *      CHARCODE_LSHIFT     (originally 0x10, which also looks like CTRL-P, so converted to 0xF0)
+         *      CHARCODE_CTRL       (originally 0x11, which also looks like CTRL-Q, so converted to 0xF1)
+         *      CHARCODE_RSHIFT     (originally 0x12, which also looks like CTRL-R, so converted to 0xF2)
+         *      CHARCODE_SHIFTLOCK  (originally 0x14, which also looks like CTRL-T, so converted to 0xF4)
+         *
+         * Again, as things currently stand, iOS devices will never generate the above charCodes, so any C1P software
+         * that relies detecting on shift-key state changes will not work on those devices.
+         *
+         * For reference purposes, I've left some parenthetical references to corresponding keyCodes in the comments
+         * below.  Relying on keyCodes is problematic, which is why I've tried to eliminate most dependencies on them,
+         * but still, they're all you get on keyDown/keyUp events.
+         */
+        this.aCharCodeMap = [];
+        this.aCharCodeMap[0x31] = 0x7700; this.aCharCodeMap[0x21] = 0x7700 + this.CHARCODE_LSHIFT;  // 1 (0x31) ! (0x31)
+        this.aCharCodeMap[0x32] = 0x7600; this.aCharCodeMap[0x22] = 0x7600 + this.CHARCODE_LSHIFT;  // 2 (0x32) " (0xDE)
+        this.aCharCodeMap[0x33] = 0x7500; this.aCharCodeMap[0x23] = 0x7500 + this.CHARCODE_LSHIFT;  // 3 (0x33) # (0x33)
+        this.aCharCodeMap[0x34] = 0x7400; this.aCharCodeMap[0x24] = 0x7400 + this.CHARCODE_LSHIFT;  // 4 (0x34) $ (0x34)
+        this.aCharCodeMap[0x35] = 0x7300; this.aCharCodeMap[0x25] = 0x7300 + this.CHARCODE_LSHIFT;  // 5 (0x35) % (0x35)
+        this.aCharCodeMap[0x36] = 0x7200; this.aCharCodeMap[0x26] = 0x7200 + this.CHARCODE_LSHIFT;  // 6 (0x36) & (0x37)
+        this.aCharCodeMap[0x37] = 0x7100; this.aCharCodeMap[0x27] = 0x7100 + this.CHARCODE_LSHIFT;  // 7 (0x37) ' (0xDE)
+        this.aCharCodeMap[0x38] = 0x6700; this.aCharCodeMap[0x28] = 0x6700 + this.CHARCODE_LSHIFT;  // 8 (0x38) ( (0x39)
+        this.aCharCodeMap[0x39] = 0x6600; this.aCharCodeMap[0x29] = 0x6600 + this.CHARCODE_LSHIFT;  // 9 (0x39) ) (0x30)
+        this.aCharCodeMap[0x30] = 0x6500;   // 0
+        this.aCharCodeMap[0x3A] = 0x6400; this.aCharCodeMap[0x2A] = 0x6400 + this.CHARCODE_LSHIFT;  // : (0xBA) * (0x38)
+        this.aCharCodeMap[0x2D] = 0x6300; this.aCharCodeMap[0x3D] = 0x6300 + this.CHARCODE_LSHIFT;  // - (0xBD) = (0xBB)
+      //this.aCharCodeMap[0x00] = 0x6200;   // RUB-OUT (no mapping chosen for this key yet)
+        this.aCharCodeMap[0x2E] = 0x5700; this.aCharCodeMap[0x3E] = 0x5700 + this.CHARCODE_LSHIFT;  // . (0xBE) > (0xBE)
+        this.aCharCodeMap[0x6C] = 0x5600; this.aCharCodeMap[0x4C] = 0x5600 + this.CHARCODE_LSHIFT; this.aCharCodeMap[0x5C] = 0x5600 + this.CHARCODE_LSHIFT; // l L \
+        this.aCharCodeMap[0x6F] = 0x5500; this.aCharCodeMap[0x4F] = 0x5500 + this.CHARCODE_LSHIFT; this.aCharCodeMap[this.CHARCODE_DELETE] = 0x5500 + this.CHARCODE_LSHIFT; // o O DELETE
+        this.aCharCodeMap[this.CHARCODE_LF] = 0x5400;   // LINE-FEED
+        this.aCharCodeMap[this.CHARCODE_CR] = 0x5300;   // RETURN
+        this.aCharCodeMap[0x77] = 0x4700; this.aCharCodeMap[0x57] = 0x4700 + this.CHARCODE_LSHIFT;  // w W
+        this.aCharCodeMap[0x65] = 0x4600; this.aCharCodeMap[0x45] = 0x4600 + this.CHARCODE_LSHIFT;  // e E
+        this.aCharCodeMap[0x72] = 0x4500; this.aCharCodeMap[0x52] = 0x4500 + this.CHARCODE_LSHIFT;  // r R
+        this.aCharCodeMap[0x74] = 0x4400; this.aCharCodeMap[0x54] = 0x4400 + this.CHARCODE_LSHIFT;  // t T
+        this.aCharCodeMap[0x79] = 0x4300; this.aCharCodeMap[0x59] = 0x4300 + this.CHARCODE_LSHIFT;  // y Y
+        this.aCharCodeMap[0x75] = 0x4200; this.aCharCodeMap[0x55] = 0x4200 + this.CHARCODE_LSHIFT;  // u U
+        this.aCharCodeMap[0x69] = 0x4100; this.aCharCodeMap[0x49] = 0x4100 + this.CHARCODE_LSHIFT;  // i I
+        this.aCharCodeMap[0x73] = 0x3700; this.aCharCodeMap[0x53] = 0x3700 + this.CHARCODE_LSHIFT;  // s S
+        this.aCharCodeMap[0x64] = 0x3600; this.aCharCodeMap[0x44] = 0x3600 + this.CHARCODE_LSHIFT;  // d D
+        this.aCharCodeMap[0x66] = 0x3500; this.aCharCodeMap[0x46] = 0x3500 + this.CHARCODE_LSHIFT;  // f F
+        this.aCharCodeMap[0x67] = 0x3400; this.aCharCodeMap[0x47] = 0x3400 + this.CHARCODE_LSHIFT;  // g G
+        this.aCharCodeMap[0x68] = 0x3300; this.aCharCodeMap[0x48] = 0x3300 + this.CHARCODE_LSHIFT;  // h H
+        this.aCharCodeMap[0x6A] = 0x3200; this.aCharCodeMap[0x4A] = 0x3200 + this.CHARCODE_LSHIFT;  // j J
+        this.aCharCodeMap[0x6B] = 0x3100; this.aCharCodeMap[0x4B] = 0x3100 + this.CHARCODE_LSHIFT; this.aCharCodeMap[0x5B] = 0x3100 + this.CHARCODE_LSHIFT; // k K [
+        this.aCharCodeMap[0x78] = 0x2700; this.aCharCodeMap[0x58] = 0x2700 + this.CHARCODE_LSHIFT;  // x X
+        this.aCharCodeMap[0x63] = 0x2600; this.aCharCodeMap[0x43] = 0x2600 + this.CHARCODE_LSHIFT;  // c C
+        this.aCharCodeMap[0x76] = 0x2500; this.aCharCodeMap[0x56] = 0x2500 + this.CHARCODE_LSHIFT;  // v V
+        this.aCharCodeMap[0x62] = 0x2400; this.aCharCodeMap[0x42] = 0x2400 + this.CHARCODE_LSHIFT;  // b B
+        this.aCharCodeMap[0x6E] = 0x2300; this.aCharCodeMap[0x4E] = 0x2300 + this.CHARCODE_LSHIFT; this.aCharCodeMap[0x5E] = 0x2300 + this.CHARCODE_LSHIFT; // n N ^
+        this.aCharCodeMap[0x6D] = 0x2200; this.aCharCodeMap[0x4D] = 0x2200 + this.CHARCODE_LSHIFT; this.aCharCodeMap[0x5D] = 0x2200 + this.CHARCODE_LSHIFT; // m M ]
+        this.aCharCodeMap[0x2C] = 0x2100; this.aCharCodeMap[0x3C] = 0x2100 + this.CHARCODE_LSHIFT;  // , (0xBC) < (0xBC)
+        this.aCharCodeMap[0x71] = 0x1700; this.aCharCodeMap[0x51] = 0x1700 + this.CHARCODE_LSHIFT;  // q Q
+        this.aCharCodeMap[0x61] = 0x1600; this.aCharCodeMap[0x41] = 0x1600 + this.CHARCODE_LSHIFT;  // a A
+        this.aCharCodeMap[0x7A] = 0x1500; this.aCharCodeMap[0x5A] = 0x1500 + this.CHARCODE_LSHIFT;  // z Z
+        this.aCharCodeMap[0x20] = 0x1400;   // SPACE
+        this.aCharCodeMap[0x2F] = 0x1300; this.aCharCodeMap[0x3F] = 0x1300 + this.CHARCODE_LSHIFT;  // / (0xBF) ? (0xBF)
+        this.aCharCodeMap[0x3B] = 0x1200; this.aCharCodeMap[0x2B] = 0x1200 + this.CHARCODE_LSHIFT;  // ; (0xBA) + (0xBB)
+        this.aCharCodeMap[0x70] = 0x1100; this.aCharCodeMap[0x50] = 0x1100 + this.CHARCODE_LSHIFT; this.aCharCodeMap[0x40] = 0x1100 + this.CHARCODE_LSHIFT; // p P @
+      //this.aCharCodeMap[0x00]                     = 0x0700;   // REPEAT (no mapping chosen for this key yet)
+        this.aCharCodeMap[this.CHARCODE_CTRL]       = 0x0600;   // CTRL
+        this.aCharCodeMap[this.CHARCODE_ESC]        = 0x0500;   // ESC
+        this.aCharCodeMap[this.CHARCODE_LSHIFT]     = 0x0200;   // LEFT-SHIFT
+        this.aCharCodeMap[this.CHARCODE_RSHIFT]     = 0x0100;   // RIGHT-SHIFT
+        this.aCharCodeMap[this.CHARCODE_SHIFTLOCK]  = 0x0000;   // SHIFT-LOCK
+
+        this.reset();
+    }
+
+    /**
+     * @this {C1PKeyboard}
+     */
+    reset()
+    {
+        this.setModel(this.nDefaultModel);
+
+        /*
+         * The physical (not virtual) state of various shift keys,
+         * with the exception of SHIFT-LOCK, which needs to start in the
+         * "locked" position, regardless of the physical CAPS-LOCK state.
+         *
+         * QUESTION: In JavaScript, how do you query initial key states?
+         */
+        this.bitsShift = this.BIT_SHIFTLOCK;
+
+        /*
+         * Every SET bit of bKbdRows represents an enabled row (this convention
+         * is the REVERSE of the C1P hardware, but I prefer it).
+         */
+        this.bKbdRows = 0x00;
+
+        /*
+         * Every SET bit of abKbdCols represents an enabled column; again, this is
+         * the REVERSE of the C1P hardware, but I compensate for that difference with
+         * a quick XOR in updateMemory().
+         *
+         * Like bitsShift, this 8x8 array (8 byte values, each with 8 bits) represents
+         * the physical state of the keyboard, encoded in C1P format; the C1P won't
+         * actually see data this until updateMemory() decides it's time to propagate it.
+         */
+        this.abKbdCols = [this.BIT_SHIFTLOCK,0x00,0x00,0x00,0x00,0x00,0x00,0x00];
+
+        /*
+         * After a new key event has updated abKbdCols, we "push" a copy of that
+         * updated keyboard state onto this array. updateMemory() will then "shift"
+         * the next copy off, update its own copy (abKbdColsLast), and then propagate
+         * that to the C1P's keyboard memory, once the CPU has had enough time to
+         * process the previous event (see nCyclesThreshold).
+         */
+        this.aKbdStates = [];
+
+        /*
+         * When a key "down" is simulated on behalf of some charCode, I save
+         * the timer object responsible for simulating the key "up" here, so that
+         * if I detect the actual key going up sooner, I can cancel the timer and
+         * simulate the "up" immediately.  Similarly, if another press for the same
+         * key arrives before last one expired (eg, auto-repeat), I need to cancel
+         * the previous timer for that key before setting another.
+         *
+         * NOTE: If this is anything other than an initial reset, then we need to
+         * make sure there are no outstanding timers before we blow the array away.
+         */
+        if (this.aKeyTimers) {
+            for (var i in this.aKeyTimers) {
+                if (isNaN(+i)) continue; // ignore any non-numeric properties, if any
+                if (this.aKeyTimers[i]) clearTimeout(this.aKeyTimers[i]);
+            }
+        }
+        this.aKeyTimers = [];
+        this.prevCharDown = 0;
+        this.prevKeyDown = 0;
+
+        /*
+         * These save the last values written to keyboard memory, so that I can
+         * avoid rewriting the memory if the values haven't changed since the last update.
+         */
+        this.bWriteLast = -1;
+        this.abKbdColsLast = this.abKbdCols;
+
+        /*
+         * Due to the way the C1P scans its keyboard rows (from R0 up to R7 *or* to the
+         * highest row for which a "down" key has just been detected), if we get back-to-back
+         * key events for, say, "I" and then "S", the C1P will see only the "S", never the "I",
+         * because "I" is on a higher row.
+         *
+         * That's why we have aKbdStates, which relies on the following CPU activity variables.
+         */
+        this.nReadsSinceLastEvent = 0;
+        this.nWritesSinceLastEvent = 0;
+        this.nCyclesSinceLastEvent = 0;
+
+        /*
+         * Make sure the auto-injection buffer is empty, too (an injection could have been
+         * in progress on any reset after the first).
+         */
+        this.sInjectBuffer = "";
+    }
+
+    /**
+     * @this {C1PKeyboard}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "esc", "ctrl-c")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        /*
+         * I want to bind to the first caller (ie, the Screen), not subsequent ones (eg, the Panel)
+         */
+        if (this.bindings[sBinding] === undefined) {
+            switch(sBinding) {
+            case "keyDown":
+                this.bindings[sBinding] = control;
+                control.onkeydown = function(kbd) {
+                    return function(event) {
+                        return kbd.keyEvent(event, true);
+                    };
+                }(this);
+                return true;
+            case "keyPress":
+                this.bindings[sBinding] = control;
+                control.onkeypress = function(kbd) {
+                    return function(event) {
+                        return kbd.keyPress(event);
+                    };
+                }(this);
+                return true;
+            case "keyUp":
+                this.bindings[sBinding] = control;
+                control.onkeyup = function(kbd) {
+                    return function(event) {
+                        return kbd.keyEvent(event, false);
+                    };
+                }(this);
+                return true;
+            case "break":
+                /*
+                 * The BREAK key is unusual: it requires us forcing the equivalent of someone pressing
+                 * our "Reset" and "Run" buttons.  As things stand, the Computer component is responsible
+                 * for end-user "reset" requests, so we can simply arrange to call this.cmp.reset(true).
+                 *
+                 * NOTE: At the risk of making keyPressSimulate() a bit uglier, I also permit BREAK
+                 * there, in case someone wants to "inject" the BREAK key; however, if it's followed by
+                 * other injected keys, I'll need to avoid clearing the injection buffer on a reset;
+                 * currently, reset() resets everything.
+                 */
+                this.bindings[sBinding] = control;
+                control.onclick = function(kbd) {
+                    return function(event) {
+                        if (DEBUG) kbd.println("keyPressSimulate(break)");
+                        if (kbd.cmp) kbd.cmp.reset(true);
+                    };
+                }(this);
+                return true;
+            default:
+                if (this.aButtonCodeMap[sBinding] !== undefined) {
+                    this.bindings[sBinding] = control;
+                    control.onclick = function(kbd, sButton, charCode) {
+                        return function(event) {
+                            if (DEBUG) kbd.println("keyPressSimulate(" + sButton + ")");
+                            if (kbd.cpu) kbd.cpu.setFocus();
+                            return !kbd.keyPressSimulate(charCode);
+                        };
+                    }(this, sBinding, this.aButtonCodeMap[sBinding]);
+                    return true;
+                }
+                break;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * @this {C1PKeyboard}
+     * @param {Array} abMemory
+     * @param {number} start
+     * @param {number} end
+     * @param {C1PCPU} cpu
+     */
+    setBuffer(abMemory, start, end, cpu)
+    {
+        this.abMem = abMemory;
+        this.offKbd = start;
+        this.cbKbd = end - start + 1;
+        this.offKbdLimit = this.offKbd + this.cbKbd;
+        if (cpu) {
+            this.cpu = cpu;
+            if (DEBUG) cpu.addReadNotify(start, end, this, this.getByte);
+            cpu.addWriteNotify(start, end, this, this.setByte);
+        }
+        this.setReady();
+    }
+
+    /**
+     * @this {C1PKeyboard}
+     * @param {number} nModel
+     */
+    setModel(nModel)
+    {
+        this.nModel = nModel;
+        /*
+         * Default to Model 600 behavior, where the keyboard status lines are inverted
+         * (ie, a zero bit indicates a key press).
+         */
+        this.bInvert = 0xff;
+        if (this.nModel != 600) {
+            /*
+             * No inversion for model 542
+             */
+            this.bInvert = 0x00;
+            this.println("updated keyboard model: " + this.nModel);
+        }
+    }
+
+    /**
+     * @this {C1PKeyboard}
+     * @param {boolean} fOn
+     * @param {C1PComputer} cmp
+     *
+     * We make a note of the Computer component, so that we can invoke its reset() method when our simulated
+     * BREAK key is pressed, and we query the Debugger component so that we can use its info() and halt() functions,
+     * which we use to buffer information without adversely affecting timing and then dump later using the Debugger's
+     * "info" command.
+     */
+    setPower(fOn, cmp)
+    {
+        if (fOn && !this.flags.powered) {
+            this.flags.powered = true;
+            this.cmp = cmp;
+            if (DEBUGGER) this.dbg = cmp.getComponentByType("debugger");
+        }
+    }
+
+    /**
+     * @this {C1PKeyboard}
+     * @param {boolean} [fReady] is assumed to indicate "ready" unless EXPLICITLY set to false
+     */
+    setReady(fReady)
+    {
+        this.iOS = Web.isUserAgent("iOS");
+        this.fMobile = (this.iOS || Web.isUserAgent("Android"));
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(this.dbg.MESSAGE_KBD)) {
+            this.dbg.message("mobile keyboard support: " + (this.fMobile? "true" : "false") + " (" + window.navigator.userAgent + ")");
+        }
+        super.setReady();
+    }
+
+    /**
+     * calcReleaseDelay(fRepeat)
+     *
+     * This attempts to scale our default "release" delay appropriately for the current CPU speed.
+     *
+     * Note that if the effective CPU speed exceeds 16Mhz, it becomes very difficult to rely on timer-driven key events
+     * (even the shortest available timer delay still gives the CPU too much time, so it thinks that even the briefest key
+     * press represents a held key, resulting in multiple keystrokes).  We deal with this by artificially limiting the top
+     * speed in the CPU component (the current limit for "fast" mode is 8Mhz; see CPU.mhzFast)
+     *
+     * @this {C1PKeyboard}
+     * @param {boolean} fRepeat is true if a timeout had already been active for the current key
+     * @return {number}
+     */
+    calcReleaseDelay(fRepeat)
+    {
+        /*
+         * NOTE: This delay affects only the "up" delay, not repeat delay, but it's useful to have an initial
+         * "up" delay that's sufficiently large to ensure the native machine's auto-repeat behavior cooperates
+         * with the virtual machine's auto-repeat behavior. msReleaseDelay is the initial delay, msReleaseRepeat
+         * is the subsequent delay.
+         *
+         * Unfortunately, with a large initial delay, we need to enable the auto-clear code in the keyEvent()
+         * handler, otherwise doing things like pressing ENTER repeatedly will result in sluggish behavior
+         * (because you can generally press/release/repress keys faster than they will auto-repeat).
+         */
+        var msDelay = (fRepeat? this.msReleaseRepeat: this.msReleaseDelay);
+        if (this.cpu && this.cpu.mhz) {
+            msDelay /= this.cpu.mhz;
+        }
+        return msDelay;
+    }
+
+    /**
+     * @this {C1PKeyboard}
+     * @param {number} [notCharCode]
+     */
+    autoClear(notCharCode)
+    {
+        if (this.prevCharDown && (notCharCode === undefined || notCharCode != this.prevCharDown)) {
+            if (DEBUGGER && this.dbg && this.dbg.messageEnabled(this.dbg.MESSAGE_KBD)) {
+                this.dbg.message("autoClear(" + Str.toHexByte(this.prevCharDown) + ")");
+            }
+
+            clearTimeout(this.aKeyTimers[this.prevCharDown]);
+            this.keyEventSimulate(this.prevCharDown, false, this.SIMCODE_AUTOCLEAR);
+        }
+    }
+
+    /**
+     * @this {C1PKeyboard}
+     * @param {string} sKeyCodes
+     * @param {number} [msDelay] is an optional injection delay (default is msInjectDelay)
+     */
+    injectKeys(sKeyCodes, msDelay)
+    {
+        this.sInjectBuffer = sKeyCodes;
+        if (DEBUG) this.log("injectKeys(" + this.sInjectBuffer.split("\n").join("\\n") + ")");
+        this.injectKeysFromBuffer(msDelay || this.msInjectDelay);
+    }
+
+    /**
+     * @this {C1PKeyboard}
+     * @param {number} msDelay is the delay between injected keys
+     */
+    injectKeysFromBuffer(msDelay)
+    {
+        if (this.sInjectBuffer.length > 0) {
+            var ch = this.sInjectBuffer.charCodeAt(0);
+            /*
+             * I could require all callers to supply CRs instead of LFs, but this is friendlier.
+             */
+            if (ch == 0x0a)
+                ch = 0x0d;
+            /*
+             * Also, if upper-case characters are being injected, convert them to lower-case, and rely
+             * on the virtual SHIFT-LOCK remaining locked for the duration; otherwise, we'd have to simulate
+             * SHIFT key presses around every character (or around the entire set of characters) as well.
+             *
+             * UPDATE: Even though keyPressSimulate() currently has some code to do this automatically now,
+             * it's really intended as a work-around for a SHIFT-related problem on iOS devices only, so
+             * we can't rely on that in the general case.
+             */
+            if (ch >= 0x41 && ch <= 0x5A)
+                ch += 0x20;
+            this.sInjectBuffer = this.sInjectBuffer.substr(1);
+            this.keyPressSimulate(ch);
+        }
+        if (this.sInjectBuffer.length > 0) {
+            setTimeout(function(kbd) { return function() {kbd.injectKeysFromBuffer(msDelay);}; }(this), msDelay);
+        }
+    }
+
+    /**
+     * @this {C1PKeyboard}
+     * @param {Object} event
+     * @param {boolean} fDown is true if called for a keyDown event, false if called for a keyUp event
+     * @return {boolean} true to pass the event along, false to consume it
+     */
+    keyEvent(event, fDown)
+    {
+        var fPass;
+        var fAutoClear = !fDown;
+        var keyCode = event.keyCode;
+
+        if (fDown) this.prevKeyDown = keyCode;
+
+        if (keyCode == this.CHARCODE_LSHIFT - this.PSEUDO_CHARCODE) {
+            this.bitsShift &= ~this.BIT_LSHIFT;
+            if (fDown) this.bitsShift |= this.BIT_LSHIFT;
+            keyCode += this.PSEUDO_CHARCODE;
+            fAutoClear = false;
+        }
+        else
+        if (keyCode == this.CHARCODE_RSHIFT - this.PSEUDO_CHARCODE) {
+            this.bitsShift &= ~this.BIT_RSHIFT;
+            if (fDown) this.bitsShift |= this.BIT_RSHIFT;
+            keyCode += this.PSEUDO_CHARCODE;
+            fAutoClear = false;
+        }
+        else
+        if (keyCode == this.CHARCODE_CTRL - this.PSEUDO_CHARCODE) {
+            this.bitsShift &= ~this.BIT_CTRL;
+            if (fDown) this.bitsShift |= this.BIT_CTRL;
+            keyCode += this.PSEUDO_CHARCODE;
+            fAutoClear = false;
+        }
+        else
+        if (keyCode == this.CHARCODE_SHIFTLOCK - this.PSEUDO_CHARCODE) {
+            /*
+             * FYI, this generates a "down" event ONLY when getting locked, and an "up" event ONLY
+             * when getting unlocked--which is exactly what I want, even though that may seem a little
+             * counter-intuitive (since the key itself actually went down AND up for each event).
+             *
+             * Moreover, since most people do NOT have CAPS-LOCK enabled, whereas the C1P needs it
+             * enabled by default, we invert fDown, so that if the user enables CAPS-LOCK for some
+             * reason, we treat is as *disabling* SHIFT-LOCK, and vice versa.
+             */
+            fDown = !fDown;
+            this.bitsShift &= ~this.BIT_SHIFTLOCK;
+            if (fDown) this.bitsShift |= this.BIT_SHIFTLOCK;
+            keyCode += this.PSEUDO_CHARCODE;
+            fAutoClear = false;
+        }
+        else
+        if (keyCode == this.KEYCODE_COMMAND) {
+            /*
+             * Avoid interfering with useful Browser key commands, like COMMAND-Q, COMMAND-T, etc.
+             */
+            this.bitsShift &= ~this.BIT_COMMAND;
+            if (fDown) this.bitsShift |= this.BIT_COMMAND;
+            fAutoClear = false;
+            fPass = true;
+        }
+        else
+        if (keyCode == this.KEYCODE_TAB) {
+            /*
+             * If I don't consume TAB on the "down" event, then that's all I'll see, because the
+             * browser will see it and give focus to the next control. But the "down" side is that
+             * that no "press" event will be generated.  This puts it in the same category as ESC,
+             * which also generates "down" and "up" events (LOTS of "down" events for that matter),
+             * but no "press" event.  However, the C1P has no TAB key, so it's safe to completely ignore.
+             */
+            fPass = fAutoClear = false;
+        }
+        else
+        if (keyCode == this.KEYCODE_ESC || keyCode == this.KEYCODE_DELETE) {
+            /*
+             * I don't get keyPress events for ESC (why?) and I never want the browser to act on DELETE
+             * (which does double-duty as the "Back" button and leaves the current page), so I have to
+             * simulate them now.
+             *
+             * Note that I call the "press" simulate method and NOT the "event" simulate method, because
+             * the former takes care of simulating both individual "down" and "up" events.
+             */
+            if (DEBUG && DEBUGGER && keyCode == this.KEYCODE_ESC && this.dbg) this.dbg.halt();
+            fPass = (fDown? !this.keyPressSimulate(keyCode) : false);
+        }
+        else {
+            /*
+             * Pass on everything else; I'll take care of this key at the keyPress stage, not the
+             * the keyDown or keyUp stage.
+             */
+            fPass = true;
+            /*
+             * At this point, I have a difficult choice to make: leave fAutoClear true for any remaining
+             * "up" events, so that keys will repeat immediately when released/pressed repeatedly (most
+             * noticeable with the Enter key), or set fAutoClear to false to ensure that polling apps have
+             * enough time to see every key press.
+             *
+             * I've decided that the former is more important than the latter, so if polling apps are still
+             * missing keystrokes, then perhaps nCyclesThreshold needs to be supplemented in some way.
+             *
+             *      fAutoClear = false;
+             */
+        }
+
+        if (fAutoClear) {
+            /*
+             * When you use a command like COMMAND-T, I see the COMMAND key going down, but not going up,
+             * so I think the COMMAND key is still down and ignore all input; to easily get out of that state,
+             * I clear our internal BIT_COMMAND whenever I see ANY key go up (well, ALMOST any key; cases
+             * above that explicitly clear fAutoClear -- such as the COMMAND key itself -- are exceptions
+             * to the rule).
+             */
+            this.bitsShift &= ~this.BIT_COMMAND;
+            /*
+             * I don't reliably get keyDown/keyUp events for all keys on all devices, but for those devices that
+             * I DO, it seems like a good idea to cancel any pending key "up" simulation on receipt of the actual
+             * keyUp event.
+             *
+             * However, the following code is problematic for Safari on iOS devices, which as noted above, doesn't
+             * generate keyDown/keyUp events until after the press operation is complete, and then they are generated
+             * in rapid succession, which doesn't give the C1P enough time to detect the key.  So I simply don't do
+             * this on iOS devices.
+             */
+            if (!this.fMobile && keyCode == this.prevKeyDown) this.autoClear();
+        }
+
+        if (fPass === undefined) {
+            fPass = !this.keyEventSimulate(keyCode, fDown, this.SIMCODE_KEYEVENT);
+        }
+
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(this.dbg.MESSAGE_KBD)) {
+            this.dbg.message(/*(fDown?"\n":"") +*/ "key" + (fDown?"Down":"Up") + "(" + Str.toHexByte(keyCode) + "): " + (fPass? "pass" : "consume"));
+        }
+        return fPass;
+    }
+
+    /**
+     * @this {C1PKeyboard}
+     * @param {Object} event
+     * @return {boolean} true to pass the event along, false to consume it
+     *
+     * We've stopped relying on keyPress for keyboard emulation purposes, but it's still handy to hook and monitor
+     * when debugging.
+     */
+    keyPress(event)
+    {
+        var fPass = true;
+        /*
+         * Browser-independent charCode extraction...
+         */
+        event = event || window.event;
+        var charCode = event.which || event.keyCode;
+
+        /*
+         * Let's stop any injection currently in progress, too
+         */
+        this.sInjectBuffer = "";
+
+        if (this.bitsShift & this.BIT_COMMAND)
+            this.bitsShift &= ~this.BIT_COMMAND;
+        else
+            fPass = !this.keyPressSimulate(charCode);
+
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(this.dbg.MESSAGE_KBD)) {
+            this.dbg.message("keyPress(" + Str.toHexByte(charCode) + "): " + (fPass? "pass" : "consume"));
+        }
+        return fPass;
+    }
+
+    /**
+     * @this {C1PKeyboard}
+     * @param {number} charCode
+     * @return {boolean} true if successfully simulated, false if unrecognized/unsupported key
+     */
+    keyPressSimulate(charCode)
+    {
+        var fSimulated = false;
+        if (charCode == this.CHARCODE_BREAK) {
+            /*
+             * The BREAK key is not wired up to the keyboard like the other keys are, but we simulate
+             * it here, so that it can be injected like any other key.
+             */
+            if (this.cmp) {
+                this.cmp.reset(true);
+                fSimulated = true;
+            }
+        }
+        else {
+            /*
+             * WARNING: The next line is why you cannot use SHIFT-N, SHIFT-O, SHIFT-P, etc. But without it,
+             * iOS devices with the annoying "autocapitalization" feature enabled make the keyboard unusable
+             * by default.  The trade-off is: either require all iOS users to first tap the shift key to turn
+             * "autocapitalization" off, or lose the ability to type any of the special shifted alphabetic keys.
+             * I choose the latter, because I have friendlier aliases already defined for those keys (eg,
+             * ^, DELETE, and @).
+             *
+             * Furthermore, by doing this for iOS (and Android) devices ONLY, other platforms retain the ability
+             * to use those special key combos.
+             */
+            if (this.fMobile) {
+                if (charCode >= 0x41 && charCode <= 0x5A)
+                    charCode += 0x20;
+            }
+
+            /*
+             * Auto-clear any previous down key EXCEPT for charCode (because it may be held and repeating).
+             */
+            this.autoClear(charCode);
+
+            if (this.keyEventSimulate(charCode, true, this.SIMCODE_KEYPRESS)) {
+                /*
+                 * If CPU speed is unlimited, then we switch to an alternate approach, which is to immediately
+                 * queue a "release" event as well.  The problem with the original timer-based approach at high
+                 * speeds is that the the CPU may get lucky and execute a LOT of instructions between delivery
+                 * of the keyPress event and the "keyTimeout" event. In that case, even enabling keyboard polling
+                 * detection in updateMemory() won't entirely help -- although we do that, too -- because JavaScript
+                 * events are delivered synchronously, so it may simply take too long for the "keyTimeout" event
+                 * to arrive.
+                 *
+                 * Why don't we ALWAYS do this? Because in the normal case (SPEED_SLOW, and even SPEED_FAST) we want
+                 * to faithfully simulate how long a key is held, so that features like auto-repeat work properly.
+                 * You'll notice in the SPEED_MAX case, holding a key no longer has any effect; even though multiple
+                 * keyPress events WILL arrive, if we simulate a release immediately after each one, then repeat
+                 * is defeated.  Also, the keyboard polling detection code in updateMemory() doesn't work well for
+                 * all apps.
+                 */
+                if (this.cpu.speed == this.cpu.SPEED_MAX) {
+                    this.keyEventSimulate(charCode, false, this.SIMCODE_KEYRELEASE);
+                }
+                else {
+                    var fRepeat = false;
+                    if (this.aKeyTimers[charCode]) {
+                        clearTimeout(this.aKeyTimers[charCode]);
+                        fRepeat = true;
+                    }
+                    var msDelay = this.calcReleaseDelay(fRepeat);
+                    this.aKeyTimers[this.prevCharDown = charCode] = setTimeout(function(kbd) { return function() {kbd.keyEventSimulate(charCode, false, kbd.SIMCODE_KEYTIMEOUT);}; }(this), msDelay);
+                    if (DEBUGGER && this.dbg && this.dbg.messageEnabled(this.dbg.MESSAGE_KBD)) {
+                        this.dbg.message("keyPressSimulate(" + Str.toHexByte(charCode) + "): setTimeout()");
+                    }
+                }
+                fSimulated = true;
+            }
+        }
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(this.dbg.MESSAGE_KBD)) {
+            this.dbg.message("keyPressSimulate(" + Str.toHexByte(charCode) + "): " + (fSimulated? "true" : "false"));
+        }
+        return fSimulated;
+    }
+
+    /**
+     * @this {C1PKeyboard}
+     * @param {number} charCode
+     * @param {boolean} fDown
+     * @param {number} simCode indicates the origin of the event
+     * @return {boolean} true if successfully simulated, false if unrecognized/unsupported key
+     */
+    keyEventSimulate(charCode, fDown, simCode)
+    {
+        var fSimulated = false;
+        if (!fDown) {
+            this.aKeyTimers[charCode] = null;
+            if (this.prevCharDown == charCode) this.prevCharDown = 0;
+        }
+        var bShift = 0;
+        var bCode = this.aCharCodeMap[charCode];
+        if (bCode === undefined) {
+            /*
+             * Perhaps we're dealing with a CTRL variation of an alphabetic key; this won't
+             * affect non-CTRL-key combos like CR or LF, because they're defined in aCharCodeMap,
+             * and this bit of code relieves us from having to explicitly define every CTRL-letter
+             * possibility in aCharCodeMap. However, CTRL-anything-else is a different matter.
+             */
+            if (charCode >= 0x01 && charCode <= 0x1A) {
+                charCode += 0x40;
+                bShift = this.CHARCODE_CTRL;
+            }
+            bCode = this.aCharCodeMap[charCode];
+        }
+        if (bCode !== undefined) {
+            var iRow = bCode >> 12;
+            var iCol = (bCode >> 8) & 0xf;
+            if (!bShift) bShift = bCode & 0xff;
+            if (fDown) {
+                this.abKbdCols[iRow] |= 1 << iCol;
+                if (bShift == this.CHARCODE_CTRL)
+                    this.abKbdCols[0] |= this.BIT_CTRL;
+                else
+                if (bShift == this.CHARCODE_LSHIFT)
+                    this.abKbdCols[0] |= this.BIT_LSHIFT;
+                else
+                if (bShift == this.CHARCODE_RSHIFT)
+                    this.abKbdCols[0] |= this.BIT_RSHIFT;
+                else
+                    this.abKbdCols[0] &= ~this.BITS_SIMULATE;
+            }
+            else {
+                this.abKbdCols[iRow] &= ~(1 << iCol);
+                this.abKbdCols[0] &= ~this.BITS_SIMULATE;
+                this.abKbdCols[0] |= (this.bitsShift & this.BITS_SIMULATE);
+            }
+            var fPropagate = (simCode == this.SIMCODE_KEYPRESS && !this.aKbdStates.length);
+            this.aKbdStates.push(this.abKbdCols.slice());
+            this.updateMemory(fPropagate);
+            fSimulated = true;
+        }
+        if (DEBUG && this.dbg) this.dbg.info("keyEventSimulate(" + Str.toHexByte(charCode) + "," + (fDown?"down":"up") + "," + this.aSimCodeDescs[simCode] + "): " + (fSimulated? "true" : "false"));
+        return fSimulated;
+    }
+
+    /**
+     * @this {C1PKeyboard}
+     * @param {number} addr
+     * @param {number|undefined} addrFrom (not defined whenever the Debugger tries to read the specified addr)
+     *
+     * NOTE: As long as we rely on the CPU processing a certain number of cycles (nCyclesThreshold) before
+     * propagating the next kbd state, and not how many reads and/or writes the CPU has performed, we could
+     * eliminate the overhead of this read-notification handler.
+     *
+     * It's useful for diagnostic purposes, which is why it's still here.
+     */
+    getByte(addr, addrFrom)
+    {
+        /*
+         * Don't trigger any further hardware emulation (beyond what we've already stored in memory) if
+         * the Debugger performed this read (need a special Debugger I/O command if/when you really want to do that).
+         */
+        if (DEBUG) {
+            if (addrFrom !== undefined) {
+                this.nReadsSinceLastEvent++;
+                if (DEBUG && this.dbg) this.dbg.info("reading kbd " + Str.toHexWord(addr) + " @" + this.cpu.getCycles() + " cycles");
+            }
+        }
+    }
+
+    /**
+     * @this {C1PKeyboard}
+     * @param {number} addr
+     * @param {number|undefined} addrFrom (not defined whenever the Debugger tries to write the specified addr)
+     *
+     * NOTE: Ordinarily, I wouldn't allow Debugger writes (addrFrom === undefined) to interfere with the simulated
+     * hardware state, but for now, I find it useful to be able to prod the simulation code directly from the Debugger.
+     */
+    setByte(addr, addrFrom)
+    {
+        var b = this.cpu.getByte(addr);
+        this.bKbdRows = b ^ this.bInvert;
+        this.nWritesSinceLastEvent++;
+        this.updateMemory(false, addr, b);
+    }
+
+    /**
+     * @this {C1PKeyboard}
+     * @param {boolean} fPropagate is true to propagate immediately, false to use normal propagation
+     * @param {number} [addr] is the memory address to update; default is the entire memory range
+     * @param {number} [bWrite] is the value of any immediately preceding write, or undefined if none
+     *
+     * Update emulated keyboard memory.  By updating the keyboard memory whenever it's written to,
+     * as well as whenever a key is pressed or released, I avoid the hit of a read-notification handler.
+     * Besides, read-notification handlers are called only AFTER the read has been performed, so it
+     * would be too late to update the memory at that point.
+     *
+     * WARNING: There is a slight risk of an application reading from a different keyboard memory address
+     * than it just wrote to.  That would be legal, but very odd, and we save valuable time by not updating
+     * every other byte in the entire memory range every time a different keyboard "row" is selected.
+     */
+    updateMemory(fPropagate, addr, bWrite)
+    {
+        /*
+         * First, we determine if it's time for event propagation...
+         */
+        var nCycles = this.cpu.getCycles();
+
+        /*
+         * Monitoring the C1P's keyboard polling activity is problematic, because not all apps monitor
+         * the keyboard in the same way.  It's better to simply wait for a certain amount of CPU activity to
+         * occur (nCyclesThreshold); it's more reliable and it scales well, because it's not affected by
+         * how many cycles we're executing in real time.  The trick is finding a value for nCyclesThreshold
+         * that works well across the board.
+         */
+        if (!fPropagate) {
+            if (this.cpu.speed == this.cpu.SPEED_MAX)
+                fPropagate = (addr !== undefined && this.nWritesSinceLastEvent >= 32);
+            else {
+                /*
+                 * We have to handle the delta being less than zero, in case the user changed the speed, thereby
+                 * resetting the cycle count returned by getCycles().
+                 */
+                var nCycleDelta = nCycles - this.nCyclesSinceLastEvent;
+                fPropagate = (nCycleDelta < 0 || nCycleDelta >= this.nCyclesThreshold);
+            }
+        }
+
+        /*
+         * Next, we propagate any buffered state (in abKbdStates) as appropriate
+         */
+        if (fPropagate) {
+            var abKbdCols = this.aKbdStates.shift();
+            if (abKbdCols !== undefined) {
+                if (DEBUG && this.dbg) this.dbg.info("kbd update @" + nCycles + " cycles, " + this.nWritesSinceLastEvent + " writes");
+                this.abKbdColsLast = abKbdCols;
+            }
+            this.nReadsSinceLastEvent = this.nWritesSinceLastEvent = 0;
+            this.nCyclesSinceLastEvent = nCycles;
+        }
+        /*
+         * Then we calculate the value (which may or may not have just been propagated),
+         * based on the currently selected keyboard row(s) (bKbdRows).
+         */
+        var b = 0;
+        for (var iRow=0; iRow < 8; iRow++) {
+            if (!(this.bKbdRows & (1 << iRow)))
+                continue;
+            b |= this.abKbdColsLast[iRow];
+        }
+        /*
+         * Now invert all the bits, since I SET the column bit of an "active" key,
+         * whereas the C1P Model 600 keyboard expects "active" column bits to be CLEAR.
+         */
+        b ^= this.bInvert;
+
+        if (addr !== undefined) {
+            this.abMem[addr] = b;
+        }
+        else {
+            addr = this.offKbd;
+            if (b != this.bWriteLast) {
+                for (var offset=addr; offset < this.offKbdLimit; offset++)
+                    this.abMem[offset] = b;
+            }
+        }
+        this.bWriteLast = b;
+        if (DEBUG && this.dbg) this.dbg.info("updating kbd " + Str.toHexWord(addr) + " with " + Str.toHexByte(b) + (bWrite !== undefined? (" following write " + Str.toHexByte(bWrite)) : "") + " @" + nCycles + " cycles");
+    }
+
+    /**
+     * isShift()
+     *
+     * @this {C1PKeyboard}
+     * @param {number} charCode
+     * @return {boolean}
+     *
+     isShift(charCode)
+     {
+         return charCode == this.CHARCODE_LSHIFT || charCode == this.CHARCODE_RSHIFT || charCode == this.CHARCODE_CTRL || charCode == this.CHARCODE_SHIFTLOCK;
+     }
+     */
+
+    /**
+     * C1PKeyboard.init()
+     *
+     * This function operates on every HTML element of class "keyboard", extracting the
+     * JSON-encoded parameters for the C1PKeyboard constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a C1PKeyboard component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeKbd = Component.getElementsByClass(document, C1PJS.APPCLASS, "keyboard");
+        for (var iKbd=0; iKbd < aeKbd.length; iKbd++) {
+            var eKbd = aeKbd[iKbd];
+            var parmsKbd = Component.getComponentParms(eKbd);
+            var kbd = new C1PKeyboard(parmsKbd);
+            Component.bindComponentControls(kbd, eKbd, C1PJS.APPCLASS);
+        }
+    }
+}
+
+/*
+ * Initialize every Keyboard module on the page.
+ */
+Web.onInit(C1PKeyboard.init);
+
+/**
+ * @copyright http://pcjs.org/modules/c1pjs/lib/video.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class C1PVideo extends Component {
+    /**
+     * C1PVideo(parmsVideo, canvas, context, imgChars)
+     *
+     * The Video component can be configured with the following (parmsVideo) properties:
+     *
+     *      model: model number (one of: 540 or 600; 600 is the default)
+     *      screenWidth: width of the screen window, in pixels
+     *      screenHeight: height of the screen window, in pixels
+     *      charCols: number of character columns
+     *      charRows: number of character rows
+     *      charWidth: width of charSet characters, in pixels (default is 0)
+     *      charHeight: height of charSet characters, in pixels (default is 0)
+     *      charSet: path to image (eg, PNG) file that defines the character set
+     *      screenColor: background color of the screen window (default is black)
+     *
+     * The Video object assumes that the video buffer is organized such that offset 0 is mapped
+     * to the left-most column and top-most row (col=0,row=0), offset 1 is (1,0), offset 2
+     * is (2,0), and so on.
+     *
+     * The Video object initially contains no underlying video buffer; memory for the buffer
+     * must be given to it by the Computer object.  We allocate a separate buffer, called
+     * the screen buffer, into which we periodically copy the contents of the video buffer
+     * via updateScreen(); any differences between the two buffers are then rendered in the
+     * associated window, via updateWindow().
+     *
+     * When updateScreen() finds a byte in the screen buffer must be redisplayed, it converts
+     * the offset of that byte into a (col,row) character position for the updateWindow() function,
+     * which then converts (col,row) into (x,y) pixel offsets within the underlying canvas.
+     *
+     * Regarding the C1P (aka Model 600): The C1P has a 1K video buffer located at 0xD000-0xD3FF.
+     * The ROM draws the initial "D/C/W/M ?" prompt at the "bottom" of the video buffer at location
+     * 0xD365. That row really begins at 0xD360, but the C1P "indents" everything by 5 columns due
+     * to the lack of a "guard band feature."  Similarly, BASIC defaults to a width of 24 columns
+     * avoid display problems near the right edge.  BASIC will let you choose a width SMALLER than
+     * 24 but not larger. So, while the video buffer supports a theoretical maximum of 32 rows x 32
+     * columns, the practical maximum is 25 rows x 24 columns; the last 4 rows of the video buffer
+     * are never used, and while content DOES scroll through the top 3 lines of the buffer, it should
+     * never be assumed that you can see the top 3 lines.
+     *
+     * This is partially confirmed by the "C1P Character Graphics Reference Manual", p3, which says
+     * that the "the visible character field consists of 25 lines of 25 columns" and that the "first
+     * visible character in the upper left of the screen is accessed via address 53379," or 0xD083.
+     * However, they were wrong about both the number of columns and the first visible character.
+     *
+     * They probably meant 0xD085, because as mentioned earlier, the C1P indents every row by 5
+     * characters, not 3.  But that's not correct either, because the difference between 0xD365
+     * (where the bottom line starts) and 0xD085 is 0x2E0, or 736.  736 divided by 32 equals 23;
+     * add the bottom row, and that would give you 24 visible rows, not 25.  Since we now have
+     * screenshots of a C1P monitor displaying 25 rows (courtesy of Stephan Mühlstrasser), C1Pjs
+     * now assumes that only the first 3 lines are not visible, and that the address of the first
+     * visible character is actually 0xD065 (53349), yielding 25 visible rows.
+     *
+     * All of this explains why we now use setDimensions(iRowTop=3, nRowsVisible=25) instead of
+     * setDimensions(iRowTop=4, nRowsVisible=24) for the Model 600.
+     *
+     * Model 540 Video Board vs. Model 600 "Superboard II"
+     * ---------------------------------------------------
+     * This emulation was originally written for the Model 600 "Superboard II" (eg, Challenger 1P).
+     * Support for the Model 540 video board (as used in the Challenger II-4P and II-8P) was added
+     * later.
+     *
+     * NOTE: When Model 540 video emulation is enabled, Model 542 keyboard emulation must also be
+     * enabled, because the former always came with the latter keyboard interface; this is why when
+     * we call this.setModel(540), we must also notify the Keyboard via kbd.setModel(542).
+     *
+     * Key features/differences of the Model 540 video board include:
+     *
+     *      2K (8 pages) of video memory located at 0xD000-0xD7FF
+     *      Two display modes: 32 rows x 64 cols (default on power up), and 32 rows x 32 cols
+     *      64 bytes per screen row, regardless which display mode is selected
+     *      The following options can be selected via WRITE to port address 0xDE00:
+     *          Bit 0: clear to enable 32/64 mode (default on power up), set to enable 32/32
+     *          Bit 1: 1=tone on (542 keyboard)
+     *          Bit 2: 1=color on (Rev. B only?)
+     *          bit 3: 1=enable 38-40Khz AC Home control output (Rev. B only?)
+     *      Video timing counter status via READ from port address 0xDE00:
+     *          Bit 7: 0 for 1/120 second, then 1 for 1/120 second, based on video clock (60Hz)
+     *
+     * @this {C1PVideo}
+     * @param {Object} parmsVideo
+     * @param {Object} canvas
+     * @param {Object} context
+     * @param {Object} imgChars
+     */
+    constructor(parmsVideo, canvas, context, imgChars)
+    {
+        super("C1PVideo", parmsVideo);
+
+        this.nDefaultModel = parmsVideo['model'];
+        this.nDefaultCols = parmsVideo['charCols'];
+        this.nDefaultRows = parmsVideo['charRows'];
+
+        this.cxScreen = parmsVideo['screenWidth'];
+        this.cyScreen = parmsVideo['screenHeight'];
+
+        /*
+         * These (source) character dimensions are tentative, and may not even be provided,
+         * but they will become definitive once imgChars has finished loading and setReady() is called.
+         */
+        this.cxChar = parmsVideo['charWidth'];
+        this.cyChar = parmsVideo['charHeight'];
+
+        /*
+         * This is a preliminary call to setDimensions(), to initialize default screen buffer and
+         * window dimensions.  A more extensive call to setDimensions() will take place when setModel()
+         * is called later, from reset() and possibly via the tripGuard() handler.
+         *
+         * This preliminary call merely establishes a default screen buffer size, so that when
+         * setBuffer() is called, it's able to verify the assigned address space is at least as big
+         * as the screen buffer.
+         */
+        this.setDimensions();
+
+        this.canvasScreen = canvas;
+        this.contextScreen = context;
+        this.imgChars = imgChars;
+
+        /*
+         * Support for disabling (or, less commonly, enabling) image smoothing, which all browsers
+         * seem to support now (well, OK, I still have to test the latest MS Edge browser), despite
+         * it still being labelled "experimental technology".  Let's hope the browsers standardize
+         * on this.  I see other options emerging, like the CSS property "image-rendering: pixelated"
+         * that's apparently been added to Chrome.  Sigh.
+         */
+        var i, sEvent, asWebPrefixes = ['', 'moz', 'ms', 'webkit'];
+        var fSmoothing = parmsVideo['smoothing'];
+        var sSmoothing = Web.getURLParm('smoothing');
+        if (sSmoothing) fSmoothing = (sSmoothing == "true");
+        if (fSmoothing != null) {
+            for (i = 0; i < asWebPrefixes.length; i++) {
+                sEvent = asWebPrefixes[i];
+                if (!sEvent) {
+                    sEvent = 'imageSmoothingEnabled';
+                } else {
+                    sEvent += 'ImageSmoothingEnabled';
+                }
+                if (this.contextScreen[sEvent] !== undefined) {
+                    this.contextScreen[sEvent] = fSmoothing;
+                    break;
+                }
+            }
+        }
+
+        /*
+         * QUESTION: Does this video port exist only on the Model 540?
+         */
+        this.addrVideoPort = 0xDE00;        // WARNING: Hard-coded port address -JP
+    }
+
+    /**
+     * @this {C1PVideo}
+     * @param {boolean} [fPowerOn] is true for the initial reset, so that we have
+     * the option of rendering "random" graphic characters, just like the real machine would do.
+     */
+    reset(fPowerOn)
+    {
+        this.setModel(this.nDefaultModel);
+
+        if (this.abMem) {
+            /*
+             * Let's treat every reset like a power-cycle, just for fun.
+             * If you don't think that's fun, then simply remove the next line.
+             *
+                fPowerOn = true;
+             */
+            for (var offset = this.offVideo; offset < this.offVideoLimit; offset++) {
+                var b = (fPowerOn? Math.floor(Math.random() * 256) : 0x20);
+
+                this.abMem[offset] = b;
+            }
+        }
+    }
+
+    /**
+     * @this {C1PVideo}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "refresh")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        switch(sBinding) {
+        case "refresh":
+            this.bindings[sBinding] = control;
+            control.onclick = function(video) {
+                return function() {
+                    if (DEBUG) video.println("refreshScreen()");
+                    video.initScreen();
+                    video.updateScreen();
+                };
+            }(this);
+            return true;
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * @this {C1PVideo}
+     * @param {Array} abMemory
+     * @param {number} start
+     * @param {number} end
+     * @param {C1PCPU} cpu
+     */
+    setBuffer(abMemory, start, end, cpu)
+    {
+        this.abMem = abMemory;
+        this.offVideo = start;
+        this.cbVideo = end - start + 1;
+        this.offVideoLimit = this.offVideo + this.cbVideo;
+
+        if (cpu) {
+            this.cpu = cpu;
+            if (this.addrVideoPort !== undefined) {
+                cpu.addReadNotify(this.addrVideoPort, this.addrVideoPort, this, this.getByte);
+                cpu.addWriteNotify(this.addrVideoPort, this.addrVideoPort, this, this.setByte);
+            }
+        }
+        this.reset(true);
+    }
+
+    /**
+     * @this {C1PVideo}
+     * @param {number|undefined} [nCols] (default is nDefaultCols)
+     * @param {number|undefined} [nRows] (default is nDefaultRows)
+     * @param {number|undefined} [iRowTop] (eg, 4; default is 0)
+     * @param {number|undefined} [nRowsVisible] (eg, 24; default is nRows)
+     */
+    setDimensions(nCols, nRows, iRowTop, nRowsVisible)
+    {
+        this.nCols = (nCols !== undefined? nCols : this.nDefaultCols);
+        this.nRows = (nRows !== undefined? nRows : this.nDefaultRows);
+        this.cbScreen = this.nCols * this.nRows;
+        this.offVideoLimit = this.offVideo + this.cbScreen;
+        /*
+         * Set the first visible row and total visible rows next
+         */
+        this.iRowTop = (iRowTop !== undefined? iRowTop : 0);
+        this.nRowsVisible = (nRowsVisible !== undefined? nRowsVisible : nRows);
+        this.setDrawingDimensions();
+    }
+
+    /**
+     * @this {C1PVideo}
+     *
+     * cxScreen and cyScreen give us the overall dimensions of the destination surface.  Dividing that by the number of
+     * columns and rows yields a target cell size (cxCharDst,cyCharDst), which may or may not map 1-1 to the source cell size
+     * (cxChar,cyChar).
+     */
+    setDrawingDimensions()
+    {
+        this.cxCharDst = Math.floor(this.cxScreen / this.nCols);
+        this.cyCharDst = Math.floor(this.cyScreen / this.nRowsVisible);
+    }
+
+    /**
+     * @this {C1PVideo}
+     */
+    setFocus()
+    {
+        this.canvasScreen.focus();
+    }
+
+    /**
+     * @this {C1PVideo}
+     * @param {number} nModel
+     */
+    setModel(nModel)
+    {
+        this.nModel = nModel;
+        /*
+         * Default to model 600 behavior (1K video buffer);
+         * the only other supported model is 540 (2K video buffer).
+         */
+        if (this.nModel == 600) {
+            this.setDimensions(this.nDefaultCols, this.nDefaultRows, 3, 25);
+            if (this.cbScreen == 1024 && this.cpu) {
+                /*
+                 * NOTE: We deliberately set the guard address to the LAST byte of the 2K
+                 * buffer range, not the FIRST byte, which has the same effect but with the
+                 * added benefit of deferring any screen update until after the "Model 540"
+                 * screen initialization code has completely blanked the entire 2K buffer,
+                 * avoiding a brief flicker of unsightly characters.
+                 */
+                this.addrGuard = this.offVideoLimit + this.cbScreen - 1;
+                this.cpu.addWriteNotify(this.addrGuard, this.addrGuard, this, this.tripGuard);
+            }
+        }
+        else {
+            this.println("updated video model: " + this.nModel);
+            this.setDimensions(64, 32);
+        }
+        this.initScreen();
+        this.updateScreen();
+    }
+
+    /**
+     * @this {C1PVideo}
+     * @param {boolean} fOn
+     * @param {C1PComputer} cmp
+     */
+    setPower(fOn, cmp)
+    {
+        /*
+         * NOTE: No one should be calling power(true) before first checking isReady(), but we check
+         * it ourselves, too.  This also means that updateScreen() need check only fPower and not isReady(),
+         * since we guarantee that the former implies the latter.
+         */
+        if (fOn && !this.flags.powered && this.isReady()) {
+            this.flags.powered = true;
+            if (DEBUGGER) this.dbg = cmp.getComponentByType("debugger");
+            /*
+             * If we have an associated keyboard, then ensure that the keyboard will be notified whenever
+             * the canvas gets focus and receives input.
+             *
+             * Also, when simulating a Model 540 video board, we need to access to the Keyboard component due
+             * to some shared I/O responsibilities; ie, bit 1 of the video control port at 0xDE00 enables whatever
+             * tone has been selected via the keyboard frequency port at 0xDF01 (frequency == 49152/n, where n
+             * is the value stored at 0xDF01).
+             */
+            this.kbd = cmp.getComponentByType("keyboard");
+            if (this.kbd) {
+                this.kbd.setBinding("canvas", "keyDown", this.canvasScreen);
+                this.kbd.setBinding("canvas", "keyPress", this.canvasScreen);
+                this.kbd.setBinding("canvas", "keyUp", this.canvasScreen);
+            }
+        }
+        else
+        if (!fOn && this.flags.powered) {
+            this.flags.powered = false;
+            /*
+             * This is where we would add some method of blanking the display, without the disturbing the video
+             * buffer contents, and blocking all further updates to the display.
+             */
+        }
+    }
+
+    /**
+     * cxChar and cyChar are the source cell size.  Originally, those values came strictly from the parmsVideo
+     * 'charWidth' and 'charHeight' properties.  Now, if those aren't defined (which is normally the case now),
+     * then we infer the source cell size from the dimensions of imgChars, which is expected to be a 16x16 array of
+     * character bitmaps.  We could be even more flexible, by allowing imgChars to be any rectangular dimension
+     * (eg, 1x256) as long as we can assume it contains exactly 256 characters, but there's no need to get carried away.
+     *
+     * @this {C1PVideo}
+     * @param {boolean} [fReady] is assumed to indicate "ready" unless EXPLICITLY set to false
+     */
+    setReady(fReady)
+    {
+        if (!this.cxChar) this.cxChar = Math.floor(this.imgChars.width / 16);
+        if (!this.cyChar) this.cyChar = Math.floor(this.imgChars.height / 16);
+        super.setReady();
+    }
+
+    /**
+     * @this {C1PVideo}
+     * @param {number} addr (ie, addrVideoPort)
+     * @param {number|undefined} addrFrom (not defined whenever the Debugger tries to read the specified addr)
+     *
+     * NOTE: Ordinarily, I wouldn't allow Debugger writes (addrFrom === undefined) to interfere with the simulated
+     * hardware state, but for now, I find it useful to be able to prod the simulation code directly from the Debugger.
+     */
+    getByte(addr, addrFrom)
+    {
+        var b = this.cpu.getByte(addr);
+        if (addrFrom !== undefined) {
+            if (DEBUGGER && this.dbg) this.dbg.messageIO(this, addr, addrFrom, this.dbg.MESSAGE_VIDEO);
+        }
+        /*
+         * The only documented READ bit in addrVideoPort is bit 7, which is supposed to alternate between
+         * 0 and 1 every 1/120 of a second.  There's no way we're going to add special code to the emulator to update
+         * this stupid byte every 8,333 cycles (assuming 1Mhz operation), so clearly we're going to fake it.
+         *
+         * Faking it means that any polling code will unavoidably get a stale value the FIRST time it reads bit 7.
+         * However, we can still do a pretty good job of faking any EXTENSIVE polling: get the number of cycles
+         * executed so far, divide that by 8333, floor the quotient, and then set/clear bit 7 according to whether the
+         * result is odd/even.
+         */
+        var nCyclesHigh = Math.floor(this.cpu.getCycles() / 8333);
+        this.cpu.setByte(addr, (b & 0x7F) | ((nCyclesHigh & 0x1)? 0x80 : 0));
+    }
+
+    /**
+     * @this {C1PVideo}
+     * @param {number} addr (ie, addrVideoPort)
+     * @param {number|undefined} addrFrom (not defined whenever the Debugger tries to write the specified addr)
+     */
+    setByte(addr, addrFrom)
+    {
+        if (addrFrom !== undefined) {
+            if (DEBUGGER && this.dbg) this.dbg.messageIO(this, addr, addrFrom, this.dbg.MESSAGE_VIDEO);
+        }
+    }
+
+    /**
+     * @this {C1PVideo}
+     * @param {number} addr (ie, addrGuard)
+     * @param {number|undefined} addrFrom (not defined whenever the Debugger tries to read the specified addr)
+     */
+    tripGuard(addr, addrFrom)
+    {
+        /*
+         * Don't trigger any further hardware emulation (beyond what we've already stored in memory) if
+         * the Debugger performed this read (need a special Debugger I/O command if/when you really want to do that).
+         */
+        if (addrFrom !== undefined) {
+            if (DEBUGGER && this.dbg) this.dbg.messageIO(this, addr, addrFrom, this.dbg.MESSAGE_VIDEO, true);
+            /*
+             * The CPU has just written to the guard address we established just beyond the video buffer's 1K boundary,
+             * implying that the system thinks we have a 2K buffer instead.  So we bump our model to 540, bump the
+             * associated keyboard model to 542, and remove this guard handler.
+             */
+            this.setModel(540);
+            if (this.kbd) this.kbd.setModel(542);
+            this.cpu.removeWriteNotify(this.addrGuard, this.addrGuard, this, this.tripGuard);
+        }
+    }
+
+    /**
+     * @this {C1PVideo}
+     */
+    initScreen()
+    {
+        this.abScreen = new Array(this.cbScreen);
+        for (var offset=0; offset <= this.cbScreen; offset++) {
+            this.abScreen[offset] = -1; // initialize every cell of the screen to an invalid value
+        }
+    }
+
+    /**
+     * updateScreen() updates the screen buffer from the video buffer and updates the window with any changes.
+     *
+     * @this {C1PVideo}
+     * @return {boolean}
+     *
+     * For every byte in the video buffer, this renders it if it differs from the byte stored in the screen buffer,
+     * and then updates the screen buffer to match.  Since initScreen() sets every byte in the screen buffer
+     * to an illegal byte value (ie, a value which is outside the byte range 0x00-0xff), that assures the first call
+     * to updateScreen() will redraw every byte in the video buffer.
+     */
+    updateScreen()
+    {
+        var offset = 0;
+        if (this.flags.powered) {
+            while (offset < this.cbScreen) {
+                var b = this.abMem[this.offVideo + offset];
+                if (this.abScreen[offset] != b) {
+                    if (!this.writeByte(offset, b)) {
+                        break;
+                    }
+                    this.abScreen[offset] = b;
+                }
+                offset++;
+            }
+        }
+        return (offset == this.cbScreen);
+    }
+
+    /**
+     * @this {C1PVideo}
+     * @param {number} offset
+     * @param {number} b
+     * @return {boolean}
+     */
+    writeByte(offset, b)
+    {
+        var col = offset % this.nCols;
+        var row = Math.floor(offset / this.nCols);
+        return this.updateWindow(col, row, b);
+    }
+
+    /**
+     * updateWindow(col, row, b)
+     *
+     * Updates a particular position (row,col) in the associated window with the given byte (b)
+     *
+     * @this {C1PVideo}
+     * @param {number} col
+     * @param {number} row
+     * @param {number} b
+     * @return {boolean} true if successful, false if not
+     *
+     * I originally used (screenWidth,screenHeight) == (512,448) and (cols,rows) == (32,32) and (cxChar,cyChar) == (16,16),
+     * and I simply copied the source cells 1-to-1 to the destination (16,16), knowing that we would never try to display
+     * more than 28 rows (the last 4 rows of the 32 possible rows were never used to display any content).  However, I should
+     * still have ignored any attempt to draw past row 28 (aka screenHeight 448).  I now perform row clipping and biasing,
+     * according to the first visible row (iRowTop) and total visible rows (nRowsVisible).
+     *
+     * Moreover, I no longer copy the source cell images to the destination 1-to-1.  I calculate (cxCharDst,cyCharDst)
+     * separately (see setDrawingDimensions).  And I no longer assume that (cxChar,cyChar) are (16,16); once the source
+     * image file has finished loading, I calculate (cxChar,cyChar) based on the size of image file (see setReady).  I made
+     * this change when I created chargen1x.png.  In fact, at first I thought I might be able to eliminate chargen2x.png
+     * and just let drawImage() scale up the individual character images from (8,8) to (16,16) or whatever (cxCharDst,cyCharDst)
+     * size was needed, but the results were fuzzy, so it's still best to use chargen2x.png when using larger window sizes.
+     */
+    updateWindow(col, row, b)
+    {
+        if (row >= this.iRowTop) {
+            row -= this.iRowTop;
+            if (row < this.nRowsVisible) {
+                var xChar = (b * this.cxChar);
+                var ySrc = Math.floor(xChar / this.imgChars.width) * this.cyChar;
+                var xSrc = xChar % this.imgChars.width;
+                var xDst = col * this.cxCharDst;
+                var yDst = row * this.cyCharDst;
+                // if (DEBUG) this.log("updateWindow(" + col + "," + row + "," + b +"): drawing from " + xSrc + "," + ySrc + " to " + xDst + "," + yDst);
+                this.contextScreen.drawImage(this.imgChars, xSrc, ySrc, this.cxChar, this.cyChar, xDst, yDst, this.cxCharDst, this.cyCharDst);
+            }
+        }
+        return true;
+    }
+
+    /**
+     * C1PVideo.init()
+     *
+     * This function operates on every HTML element of class "video", extracting the
+     * JSON-encoded parameters for the C1PVideo constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a C1PVideo component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeVideo = Component.getElementsByClass(document, C1PJS.APPCLASS, "video");
+        for (var iVideo=0; iVideo < aeVideo.length; iVideo++) {
+            var eVideo = aeVideo[iVideo];
+            var parmsVideo = Component.getComponentParms(eVideo);
+
+            /*
+             * As noted in keyboard.js, the keyboard on an iOS device pops up with the SHIFT key depressed,
+             * which is not the initial keyboard state that the C1P expects. I originally tried to fix that by
+             * adding an 'autocapitalize="off"' attribute alongside the 'contenteditable="true"' attribute
+             * on the <canvas> element, but apparently Safari honors that only inside certain elements (eg, <input>).
+             *
+             * I've since settled on a better work-around in keyboard.js, so I've stopped worrying about how to make
+             * "autocapitalize" work here.
+             */
+            var eCanvas = document.createElement("canvas");
+            if (eCanvas === undefined || !eCanvas.getContext) {
+                eVideo.innerHTML = "<br/>Missing &lt;canvas&gt; support. Please try a newer web browser.";
+                return;
+            }
+            eCanvas.setAttribute("class", C1PJS.APPCLASS + "-canvas");
+            eCanvas.setAttribute("width", parmsVideo['screenWidth']);
+            eCanvas.setAttribute("height", parmsVideo['screenHeight']);
+
+            eCanvas.setAttribute("contenteditable", "true");
+            eCanvas.setAttribute("autocapitalize", "off");
+            eCanvas.setAttribute("autocorrect", "off");
+            eCanvas.style.backgroundColor = parmsVideo['screenColor'];
+
+            /*
+             * HACK: A canvas style of "auto" provides for excellent responsive canvas scaling in EVERY browser
+             * except IE9/IE10, so I recalculate the appropriate CSS height every time the parent DIV is resized;
+             * IE11 works without this hack, so we take advantage of the fact that IE11 doesn't report itself as "MSIE".
+             */
+            eCanvas.style.height = "auto";
+            if (Web.getUserAgent().indexOf("MSIE") >= 0) {
+                eCanvas.style.height = (((eVideo.clientWidth * parmsVideo['screenHeight']) / parmsVideo['screenWidth']) | 0) + "px";
+                eVideo.onresize = function(eParent, eChild, cx, cy) {
+                    return function() {
+                        eChild.style.height = (((eParent.clientWidth * cy) / cx) | 0) + "px";
+                    };
+                }(eVideo, eCanvas, parmsVideo['screenWidth'], parmsVideo['screenHeight']);
+            }
+            eVideo.appendChild(eCanvas);
+
+            /*
+             * Now we can create the Video object, record it, and wire it up to the associated document elements.
+             *
+             * Regarding "new Image()", see https://developer.mozilla.org/en-US/docs/Web/API/HTMLImageElement.Image:
+             *
+             *      This constructor exists for historical reasons only and returns an HTMLImageElement instance just as
+             *      document.createElement('img') would.
+             */
+            var imgCharSet = new Image();
+            var eContext = eCanvas.getContext("2d");
+            var video = new C1PVideo(parmsVideo, eCanvas, eContext, imgCharSet);
+            imgCharSet.onload = function(video, sCharSet) {
+                return function() {
+                    if (DEBUG) video.log("onload(): finished loading " + sCharSet);
+                    video.setReady();
+                };
+            }(video, parmsVideo['charSet']);        // jshint ignore:line
+            imgCharSet.src = parmsVideo['charSet'];
+
+            /*
+             * Bind any video-specific controls (eg, the Refresh button). There are no essential controls, however;
+             * even the "Refresh" button is just a diagnostic tool, to verify that the screen contents are up-to-date.
+             */
+            Component.bindComponentControls(video, eVideo, C1PJS.APPCLASS);
+        }
+    }
+}
+
+/*
+ * Initialize every Video module on the page.
+ */
+Web.onInit(C1PVideo.init);
+
+/**
+ * @copyright http://pcjs.org/modules/c1pjs/lib/serial.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class C1PSerialPort extends Component {
+    /**
+     * C1PSerialPort(parmsSerial)
+     *
+     * The SerialPort component has no component-specific parameters.
+     *
+     * @this {C1PSerialPort}
+     * @param {Object} parmsSerial
+     */
+    constructor(parmsSerial)
+    {
+        super("C1PSerialPort", parmsSerial);
+
+        this.flags.powered = false;
+        this.fDemo = parmsSerial['demo'];
+
+        this.reset(true);
+    }
+
+    /**
+     * @this {C1PSerialPort}
+     * @param {boolean} [fHard]
+     */
+    reset(fHard)
+    {
+        /*
+         * Because we reset the machine at the start of a 6502 HEX command file auto-load,
+         * we must avoid tossing the serial port's input buffer in that particular case (2).
+         */
+        if (fHard || this.autoLoad != C1PSerialPort.AUTOLOAD_6502) {
+
+            this.bInput = -1;
+            this.iInput = 0;
+            this.sInput = "";
+            if (this.fDemo) {
+                this.sInput = "10 PRINT \"HELLO OSI #" + this.getMachineNum() + "\"\n";
+            }
+
+         // this.sOutput = new Array(0);
+         // this.iOutputNext = 0;
+
+            this.fConvertLF = true;
+            this.autoLoad = C1PSerialPort.AUTOLOAD_NONE;
+        }
+    }
+
+    /**
+     * @this {C1PSerialPort}
+     */
+    start()
+    {
+        if (this.kbd && this.fDemo) {
+            this.kbd.injectKeys(" C\n\n", 3000);     // override the default injection delay (currently 300ms)
+            setTimeout(function(serial) { return function() {serial.startLoad();}; }(this), 12000);
+        }
+        this.fDemo = false;
+    }
+
+    /**
+     * @this {C1PSerialPort}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "listSerial")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        var serial = this;
+
+        switch(sBinding) {
+
+        case "listSerial":
+            this.bindings[sBinding] = control;
+            return true;
+
+        case "loadSerial":
+            this.bindings[sBinding] = control;
+
+            control.onclick = function(event) {
+                if (serial.bindings["listSerial"]) {
+                    var sFile = serial.bindings["listSerial"].value;
+                    // serial.println("loading " + sFile + "...");
+                    Web.getResource(sFile, null, true, function(sURL, sResponse, nErrorCode) {
+                        serial.loadFile(sURL, sResponse, nErrorCode);
+                    });
+                }
+            };
+            return true;
+
+        case "mountSerial":
+            /*
+             * Check for non-mobile (desktop) browser and the availability of FileReader
+             */
+            if (!Web.isMobile() && window && 'FileReader' in window) {
+                this.bindings[sBinding] = control;
+
+                /*
+                 * Enable "Mount" button only if a file is actually selected
+                 */
+                control.addEventListener('change', function() {
+                    var fieldset = control.children[0];
+                    var files = fieldset.children[0].files;
+                    var submit = fieldset.children[1];
+                    submit.disabled = !files.length;
+                });
+
+                control.onsubmit = function(event) {
+                    var file = event.currentTarget[1].files[0];
+
+                    var reader = new FileReader();
+                    reader.onload = function() {
+                        // serial.println("mounting " + file.name + "...");
+                        serial.loadFile(file.name, reader.result.toString(), 0);
+                    };
+                    reader.readAsText(file);
+
+                    /*
+                     * Prevent reloading of web page after form submission
+                     */
+                    return false;
+                };
+            }
+            else {
+                if (DEBUG) this.log("Local file support not available");
+                control.parentNode.removeChild(/** @type {Node} */ (control));
+            }
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * @this {C1PSerialPort}
+     * @param {Array} abMemory
+     * @param {number} start
+     * @param {number} end
+     * @param {C1PCPU} cpu
+     */
+    setBuffer(abMemory, start, end, cpu)
+    {
+        this.abMem = abMemory;
+        this.offPort = start;
+        this.cbPort = end - start + 1;
+        this.offPortLimit = this.offPort + this.cbPort;
+        if ((this.cpu = cpu)) {
+            cpu.addReadNotify(start, end, this, this.getByte);
+            cpu.addWriteNotify(start, end, this, this.setByte);
+        }
+        this.setReady();
+    }
+
+    /**
+     * @this {C1PSerialPort}
+     * @param {boolean} fOn
+     * @param {C1PComputer} cmp
+     *
+     * We make a note of the Computer component, so that we can invoke its reset() method whenever we need to
+     * simulate a warm start, and we query the Keyboard component so that we can use its injectKeys() function.
+     */
+    setPower(fOn, cmp)
+    {
+        if (fOn && !this.flags.powered) {
+            this.flags.powered = true;
+            this.cmp = cmp;
+            this.kbd = cmp.getComponentByType("keyboard");
+            if (DEBUGGER) this.dbg = cmp.getComponentByType("debugger");
+        }
+    }
+
+    /**
+     * @this {C1PSerialPort}
+     */
+    startLoad()
+    {
+        this.autoLoad = C1PSerialPort.AUTOLOAD_BASIC;
+        this.kbd.injectKeys("LOAD\n");
+    }
+
+    /**
+     * @this {C1PSerialPort}
+     * @param {string} sFileName
+     * @param {string} sFileData (null if getResource() encountered an error)
+     * @param {number} nResponse from server
+     */
+    loadFile(sFileName, sFileData, nResponse)
+    {
+        if (!sFileData) {
+            this.println("Error loading file \"" + sFileName + "\" (" + nResponse + ")");
+            return;
+        }
+
+        this.iInput = 0;
+        this.sInput = sFileData;
+        this.fConvertLF = true;
+        this.autoLoad = C1PSerialPort.AUTOLOAD_NONE;
+
+        /*
+         * The following code adds support for loading "65V" files encoded as JSON, which is a cleaner
+         * way to store and deliver those files when they contain binary (non-ASCII) data.
+         *
+         * For example, my 6502 ASSEMBLER/DISASSEMBLER program starts with a conventional "65V" loading
+         * sequence, which loads and launches a small program loader that loads the rest of the program
+         * using a raw (1-to-1) binary format instead of the usual (3-to-1) HEX format used by "65V" files.
+         *
+         * The "rawness" of the binary format also necessitates disabling fConvertLF.
+         */
+        if (Str.endsWith(sFileName, ".json")) {
+            try {
+                /*
+                 * The most likely source of any exception will be here: parsing the JSON-encoded data.
+                 */
+                var s = "";
+                var data = eval("(" + sFileData + ")");
+                var ab = data['bytes'];
+                for (var i = 0; i < ab.length; i++) {
+                    s += String.fromCharCode(ab[i]);
+                }
+                this.sInput = s;
+                this.fConvertLF = false;
+            } catch (e) {
+                this.println("Error processing file \"" + sFileName + "\": " + e.message);
+                return;
+            }
+        }
+
+        if (this.cmp && this.kbd && this.cpu.isRunning()) {
+            this.println("auto-loading " + sFileName);
+            /*
+             * QUESTION: Is this setFocus() call strictly necessary?  We're being called in the
+             * context of getResource(), not some user action.  If there was an original user action,
+             * then the handler for THAT action should take care to switch focus back, not us.
+             */
+            this.cpu.setFocus();
+            /*
+             * We interpret the presence of a "." at the beginning of the file as a "65V Monitor"
+             * address-mode command, and consequently treat the file as 6502 HEX command file.
+             *
+             * Anything else is treated as commands for the BASIC interpreter, which we re-initialize
+             * with "NEW" and "LOAD" commands.  To prevent that behavior, halt the CPU, perform the load,
+             * and then start it running again.  BASIC will start reading the data as soon as you type
+             * LOAD.
+             */
+            if (this.sInput.charAt(0) != '.') {
+                this.autoLoad = C1PSerialPort.AUTOLOAD_BASIC;
+                this.kbd.injectKeys("NEW\nLOAD\n");
+            }
+            else {
+                /*
+                 * Set autoLoad to AUTOLOAD_6502 before the reset, so that when our reset() method is called,
+                 * we'll take care to preserve all the data we just loaded.
+                 */
+                this.autoLoad = C1PSerialPort.AUTOLOAD_6502;
+                /*
+                 * Although the Keyboard allows us to inject any key, even the BREAK key, like so:
+                 *
+                 *      this.kbd.injectKeys(String.fromCharCode(this.kbd.CHARCODE_BREAK))
+                 *
+                 * it's easier to initiate a reset() ourselves and then start the machine-language load process
+                 */
+                this.cmp.reset(true);
+                this.kbd.injectKeys("ML");
+            }
+        }
+        else {
+            this.println(sFileName + " ready to load");
+        }
+    }
+
+    /**
+     * @this {C1PSerialPort}
+     * @param {number} addr
+     * @param {number|undefined} addrFrom (not defined whenever the Debugger tries to read the specified addr)
+     */
+    getByte(addr, addrFrom)
+    {
+        /*
+         * Don't trigger any further hardware emulation (beyond what we've already stored in memory) if
+         * the Debugger performed this read (need a special Debugger I/O command if/when you really want to do that).
+         */
+        if (addrFrom !== undefined) {
+            /*
+             *  WARNING: All I need to do for now is load the COM interface's "data byte"
+             *  with the next byte from the virtual cassette data stream -JP
+             */
+            if (!(addr & 0x01)) {
+                /*
+                 * An EVEN address implies they're looking, so if we have a fresh buffer,
+                 * then prime the pump.
+                 */
+                if (this.sInput && !this.iInput)
+                    this.advanceInput();
+            } else {
+                /*
+                 * An ODD address implies they just grabbed a data byte, so prep the next data byte.
+                 */
+                this.advanceInput();
+            }
+        }
+    }
+
+    /**
+     * @this {C1PSerialPort}
+     * @param {number} addr
+     * @param {number|undefined} addrFrom (not defined whenever the Debugger tries to write the specified addr)
+     */
+    setByte(addr, addrFrom)
+    {
+        /*
+         * Don't trigger any further hardware emulation (beyond what we've already stored in memory) if
+         * the Debugger performed this write (need a special Debugger I/O command if/when you really want to do that).
+         */
+        if (addrFrom !== undefined) {
+            if (DEBUGGER && this.dbg) this.dbg.messageIO(this, addr, addrFrom, this.dbg.MESSAGE_SERIAL, true);
+            /*
+             * WARNING: I don't yet care what state the CPU puts the port into.  When it's time to support serial output,
+             * obviously that will become an issue.
+             */
+        }
+    }
+
+    /**
+     * @this {C1PSerialPort}
+     */
+    advanceInput()
+    {
+        if (this.sInput !== undefined) {
+            this.bInput = -1;
+            if (this.iInput < this.sInput.length) {
+                var b = this.sInput.charCodeAt(this.iInput++) & 0xff;
+                if (this.fConvertLF) {
+                    if (b == 0x0a) b = 0x0d;
+                }
+                this.bInput = b;
+                // if (DEBUG) this.log("advanceInput(" + Str.toHexByte(b) + ")");
+            }
+            else {
+                this.sInput = "";
+                this.iInput = 0;
+                if (DEBUG) this.log("advanceInput(): out of data");
+                if (this.autoLoad == C1PSerialPort.AUTOLOAD_BASIC && this.kbd) {
+                    this.kbd.injectKeys(" \nRUN\n");
+                }
+                this.autoLoad = C1PSerialPort.AUTOLOAD_NONE;
+            }
+            this.updateMemory();
+        }
+        // else if (DEBUG) this.log("advanceInput(): no input");
+    }
+
+    /**
+     * @this {C1PSerialPort}
+     */
+    updateMemory()
+    {
+        var offset;
+        /*
+         * Update all the status (even) bytes
+         */
+        for (offset = this.offPort+0; offset < this.offPortLimit; offset+=2) {
+            this.abMem[offset] = (this.bInput >= 0? C1PSerialPort.STATUS_DATA : C1PSerialPort.STATUS_NONE);
+        }
+        /*
+         * Update all the data (odd) bytes
+         */
+        for (offset = this.offPort+1; offset < this.offPortLimit; offset+=2) {
+            this.abMem[offset] = (this.bInput >= 0? this.bInput : 0);
+        }
+    }
+
+    /**
+     * C1PSerialPort.init()
+     *
+     * This function operates on every HTML element of class "serial", extracting the
+     * JSON-encoded parameters for the C1PSerialPort constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a C1PSerialPort component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeSerial = Component.getElementsByClass(document, C1PJS.APPCLASS, "serial");
+        for (var iSerial=0; iSerial < aeSerial.length; iSerial++) {
+            var eSerial = aeSerial[iSerial];
+            var parmsSerial = Component.getComponentParms(eSerial);
+            var serial = new C1PSerialPort(parmsSerial);
+            Component.bindComponentControls(serial, eSerial, C1PJS.APPCLASS);
+        }
+    }
+}
+
+C1PSerialPort.STATUS_NONE   = 0x00;
+C1PSerialPort.STATUS_DATA   = 0x01;     // indicates data available
+
+/*
+ * Values for autoLoad:
+ *
+ *      0: no auto-load active
+ *      1: BASIC command file auto-load in progress
+ *      2: 6502 HEX command file auto-load in progress
+ */
+C1PSerialPort.AUTOLOAD_NONE  = 0;
+C1PSerialPort.AUTOLOAD_BASIC = 1;
+C1PSerialPort.AUTOLOAD_6502  = 2;
+
+/*
+ * Initialize every SerialPort module on the page.
+ */
+Web.onInit(C1PSerialPort.init);
+
+/**
+ * @copyright http://pcjs.org/modules/c1pjs/lib/disk.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * @class Drive
+ * @property {number} iType
+ * @property {number} nTracks
+ * @property {boolean} fProtected
+ * @property {number} nIndexPulse
+ * @property {number} iTrackSelect
+ * @property {number} iTrackOffset
+ * @property {Array} aTracks
+ */
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class C1PDiskController extends Component {
+    /**
+     * C1PDiskController(parmsDC)
+     *
+     * The C1PDiskController component has no component-specific parameters.
+     *
+     * This component is being built to supplement a C1P (aka SuperBoard II) Model 600
+     * single-board computer with the addition of a 610 Accessory Board, which included:
+     *
+     *      MC6820 PIA (Peripheral Interface Adapter at $C000-$C003, decoded at $C000-$C00F)
+     *      MC6850 ACIA (Asynchronous Communications Interface Adapter at $C010-$C011, decoded at $C010-$C01F)
+     *
+     * From "OSI C1P Technical Report" p.4 regarding the 610 Accessory Board:
+     *
+     *      "This board holds up to 24K of additional RAM memory, a dual mini-floppy disk controller,
+     *      a BUS expansion facility to Model 620 BUS adapter, and switching circuitry to route the
+     *      600 board's serial interface to both the modem and printer as well as an audio cassette.
+     *      Thus, a fully expanded Challenger lP system can have BASIC-in-ROM, 32K of RAM memory,
+     *      dual mini-floppies, cassette, printer, modem, and full BUS expansion capability to the OSI
+     *      48 line BUS through which over 40 accessories can be added (A/D, D/A, voice, I/O, more memory,
+     *      etc.)."
+     *
+     * On p.20, the Report says that the 610 Accessory Board contains:
+     *
+     *      - Up to 24K of RAM
+     *      - Dual mini-floppy controller
+     *      - Real Time Clock (although elsewhere the Report says this is disabled by default)
+     *      - Expansion interface to a model 620 BUS adapter
+     *
+     * On p.21, the Report also says:
+     *
+     *      "The dual mini-floppy interface is designed after Ohio Scientific's extremely popular
+     *      and successful 470 floppy disk controller. This floppy disk controller and encoding
+     *      technique has been field proven for several years in thousands of floppy disks and is
+     *      believed to be one of the most reliable floppy disk configurations in existence. Although
+     *      the Challenger lP product line is new, it has the advantage of the experience of a company
+     *      which has been building high performance microcomputers for several years."
+     *
+     * From "PEEK 65" Vol.2 No.3 March 1981, p.9:
+     *
+     *      "The 470 board wired as a floppy disk controller contains two different interfaces:
+     *      a PIA and an ACIA. The PIA A and B ports are used in control circuits: raise and lower
+     *      the head, detect drive ready, detect sector hole, clear error faults, etc. The ACIA is
+     *      the interface over which the data actually travels. Typical operation is to drop the head,
+     *      reset the ACIA, wait for the index hole to come around, activate the read or write circuit,
+     *      then read or write characters through the ACIA."
+     *
+     *      470 Board Addressing
+     *      --------------------
+     *
+     *      Address     Read                    Write
+     *      -------     ----                    -----
+     *      C000        PIA: PA0 thru PA7       PIA: PA0 thru PA7 or DDA0 thru DDA7
+     *      C001        PIA: Port A Ctrl        PIA: Port A Control
+     *      C002        PIA: PB0 thru PB7       PIA: PB0 thru PB7 or DDB0 thru DDB7
+     *      C003        PIA: Port B Ctrl        PIA: Port B Control
+     *      C010        ACIA: Status Reg.       ACIA: Control Register
+     *      C011        ACIA: Data Path         ACIA: Data Path
+     *      C020        Clear Real Time Clock   Clear Real Time Clock
+     *                  (Reset) ($FF returned)  (Reset) (Data Ignored)
+     *
+     *      PIA Data Register A Layout:
+     *
+     *      PA7     PA6     PA5     PA4     PA3     PA2     PA1     PA0
+     *      ---     ---     ---     ----    ---     ---     ---     ----
+     *      IHD  |  SD2  |  WP   |  RDY2 |  SHD  |  FD   |  TZD  |  RDY1
+     *      (In)    (Out)   (In)    (In)    (In)    (In)    (In)    (In)
+     *
+     *      PIA Data Register B Layout:
+     *
+     *      PB7     PB6     PB5     PB4     PB3     PB2     PB1     PB0
+     *      ---     ---     ---     ---     ---     ---     ---     ---
+     *      HLD  |  LCS  |  SD1  |  FR   |  ST   |  STI  |  EE   |  WE
+     *      (Out)   (Out)   (Out)   (Out)   (Out)   (Out)   (Out)   (Out)
+     *
+     *      PIA Data Register A Lines       PIA Data Register B Lines
+     *      -------------------------       -------------------------
+     *      IHD - Index Hole Detect         HLD - Head Load
+     *      SD2 - Select Drive 2 (Drive B)  LCS - Low Current Select
+     *      WP  - Write Protected           SD1 - Select Drive 1
+     *      RDY2- Drive 2 Ready             FR  - Fault Reset
+     *      SHD - Sector Hole Detect        ST  - Step
+     *      FD  - Fault Detected            STI - Step In
+     *      TZD - Track Zero Detected       EE  - Enable Erase
+     *      RDY1- Drive 1 Ready             WE  - Write Enable
+     *
+     * NOTE: The PIA bit assignments above agree with those described, albeit somewhat less clearly,
+     * in http://www.osiweb.org/osiweb/misc/osi-hardware.txt, under "Model 475 Floppy disk system with
+     * 470 Controller board".
+     *
+     * There is apparently significant overlap with another OSI board: the Model 505 CPU Board
+     * used in C4P/MF systems.  According to http://www.osiweb.org/osiweb/misc/osi-hardware.txt, it
+     * contained:
+     *
+     *      CPU board w/ ROM, ACIA, Floppy Disk I/O, Real Time Clock
+     *      ROM $FDxx, $FExx, $FFxx
+     *      Floppy disk interface: 6820 PIA at $C000, 6850 ACIA at $C010 [Original says "6850 PIA"]
+     *      ACIA 6850 at $FC00 for RS-232 serial I/O. Baud jumpers for 75,150,300,600,1200,2400,4800,9600
+     *      Disk PIA $C0xx CB1 connected to 400mSEC (2.5/sec) clock divided from system clock (RTC)
+     *      Home security - PIA $F700-F703
+     *
+     * Disk Formats (from http://osi.marks-lab.com/files/winOSI/old-source-V1.2/Disk_io.cpp):
+     *
+     *      5.25" disk, 40 tracks, 8 sectors/track, 256 bytes/sector, 11 bits/byte (8E1) = 80K/disk.
+     *
+     *      NOTE: 8E1 refers to "8 data bits, even parity, 1 stop bit," plus an implied start bit.
+     *
+     *      OSI uses 8E1 to give a max unformatted capacity of 2272 bytes per track (see below).
+     *      However other bit encodings (8N1) could give up to 2500 bytes/track.
+     *
+     *      NOTE: 8N1 refers to "8 data bits, no parity, 1 stop bit," plus an implied start bit.
+     *
+     *      The standard speed for 5.25" drives is 300rpm. Thus one rotation of the disk is 200ms.
+     *      Stated baud-rate is 125k or 125000 bits/sec and one serial byte is 11 bits (1 start,
+     *      8 data, 1 parity, 1 stop). So the theoretical absolute maximum storage per track is
+     *      (125000 x 0.2) / 11 = 2272 bytes or 8.8 pages.
+     *
+     *      OS-65D loses a bit more because it doesn't write until 10ms after the index pulse, so
+     *      (125000 x 0.19) / 11 = 2159 bytes or 8.4 pages and this doesn't even allow for the length
+     *      of the index pulse (a few milliseconds?) and the speed variation between drives.
+     *
+     *      8" disk, 77 tracks, 12 sectors/track, 256 bytes/sector, 11 bits/byte (8E1) = 231K/disk.
+     *      OSI uses 8E1 to give a max unformatted capacity of 3772 bytes/track (see below).
+     *      However other bit encodings (8N1) could give up to 3900 bytes/track.
+     *
+     *      The standard speed for 8" drives is 360rpm. Thus one rotation of the disk is 166.6ms.
+     *      Stated baud rate is 250K or 250000 bits/sec and one serial byte is 11 bits (1 start,
+     *      8 data, 1 parity, 1 stop). So the theoretical absolute maximum storage per track is
+     *      (250000 x 0.166 ) / 11 = 3772 or 14.7 pages.
+     *
+     *      OS-65D loses a bit more because it doesn't write until 10 mS after the index pulse, so
+     *      (250000 x 0.156) / 11 = 3545 bytes  or 13.8 pages and this doesn't even allow for the length
+     *      of the index pulse (a few milliseconds?) and the speed variation between drives.
+     *
+     *      Track 0 Format
+     *      --------------
+     *              (10ms delay after index hole)
+     *      0,1     load address of the track in hi,lo form
+     *      2       page count of how much data is written on track 0.
+     *      3+      sector data
+     *
+     *      Track N Format (N > 0)
+     *      ----------------------
+     *              (10ms delay after index hole)
+     *      0,1     2-byte start code $43, $57
+     *      2       BCD track number
+     *      3       track type code (always $58)
+     *      4+      sector data
+     *
+     *      Sector Format (5.25" disks)
+     *      ---------------------------
+     *      There can be any mixture of various length sectors. The total page count can not
+     *      exceed 8 pages (8*256) if more than one sector is on a track. Each sector is written
+     *      in the following format:
+     *
+     *          previous sector length (4 if none before) times 800 microseconds of delay
+     *          sector start code $76
+     *          sector number in binary
+     *          sector length (#pages) in binary
+     *          sector data
+     *          (end of sector mark? $47, $53? MDS)
+     *
+     *      Directory Format
+     *      ----------------
+     *      2 sectors (1 & 2) on track 12 hold the directory information.
+     *      Each entry requires 8 bytes. There are a total of 64 entries. The entries are
+     *      formatted as follows:
+     *
+     *          0-5 ASCII 6 character filename
+     *          6 BCD first track of file
+     *          7 BCD Last track of file
+     *
+     * So far, all the 5.25" disk images I've seen are 92160 bytes, regardless whether they have an
+     * .IMG or .65D extension.  If we divide that total by 40 (tracks/disk), we get 2304 (bytes/track).
+     * Divide 2304 by 256 (bytes/page) and we get 9 pages/track.  Presumably a fixed 9 pages was chosen
+     * to yield a consistent track size across the entire image, while also allowing room for all the
+     * metadata that's typically present on a track as well.  As explained above, the upper limit
+     * on data per track (both sector data and metadata) is 8.8 pages in theory, or 8.4 pages in practice.
+     *
+     * @this {C1PDiskController}
+     * @param {Object} parmsDC
+     */
+    constructor(parmsDC)
+    {
+        super("C1PDiskController", parmsDC);
+
+        this.flags.powered = false;
+
+        /*
+         * Our DiskController simulates the combination of an MC6820 PIA and an MC6850 ACIA.
+         * This image of an OSI 470 Controller Board (http://osi.marks-lab.com/boards/images/OSI470.jpg)
+         * shows that the chips actually used were MC68B21P and MC68B50P.
+         *
+         * We start with definitions for the MC6820 PIA.
+         */
+        this.PORT_PDA   = 0;        // PIA Peripheral Data Register A
+        this.PORT_DDA   = 0;        // PIA Data Direction Register A (DDA shares the same register offset as PDA)
+        this.PORT_CRA   = 1;        // PIA Control Register A
+
+        this.PORT_PDB   = 2;        // PIA Peripheral Data Register B
+        this.PORT_DDB   = 2;        // PIA Data Direction Register B (DDB shares the same register offset as PDB)
+        this.PORT_CRB   = 3;        // PIA Control Register B
+
+        this.CR_IRQ1    = 0x80;     // IRQ1
+        this.CR_IRQ2    = 0x40;     // IRQ2
+     // this.CR_C2_OUT  = 0x20;     // C2 is designated an output
+     // this.CR_C2_CTRL = 0x18;     // C2 Control (00 and 10 mask IRQ2, 01 and 11 pass IRQ2 through to the CPU)
+        this.CR_PD_SEL  = 0x04;     // set to select PD (PDA or PDB), clear to select DD (DDA or DDB)
+     // this.CR_C1_CTRL = 0x03;     // C1 Control (00 and 10 mask IRQ1, 01 and 11 pass IRQ1 through to the CPU)
+
+        /*
+         * The PDA bits have the following hard-wired connections in the OSI Floppy Disk Controller.
+         * Each line marked INPUT should have its corresponding Data Direction bit clear (0), and each line
+         * marked OUTPUT should have its Data Direction bit set (1); however, we do not currently verify that
+         * the Data Direction bits are actually initialized to match these specs (and in fact, in the case
+         * of PDA_SD2, they may not be).
+         */
+        this.PDA_RDY1   = 0x01;     // INPUT:   0 = Drive 1 Ready
+        this.PDA_TZD    = 0x02;     // INPUT:   0 = Track Zero Detected
+        this.PDA_FD     = 0x04;     // INPUT:   0 = Fault Detected
+        this.PDA_SHD    = 0x08;     // INPUT:   0 = Sector Hole Detect
+        this.PDA_RDY2   = 0x10;     // INPUT:   0 = Drive 2 Ready
+        this.PDA_WP     = 0x20;     // INPUT:   0 = Write Protected
+        this.PDA_SD2    = 0x40;     // OUTPUT:  0 = Select Drive 2 (Drive B)
+        this.PDA_IHD    = 0x80;     // INPUT:   0 = Index Hole Detect
+
+     // this.PDB_WE     = 0x01;     // OUTPUT:  0 = Write Enable
+     // this.PDB_EE     = 0x02;     // OUTPUT:  0 = Erase Enable (set to 1)
+        this.PDB_STI    = 0x04;     // OUTPUT:  0 = Step In (away from track 0)
+        this.PDB_ST     = 0x08;     // OUTPUT:  0 = Step (on 1-to-0 transition)
+     // this.PDB_FR     = 0x10;     // OUTPUT:  0 = Fault Reset (set to 1)
+        this.PDB_SD1    = 0x20;     // OUTPUT:  0 = Select Drive 1
+     // this.PDB_LCS    = 0x40;     // OUTPUT:  0 = Low Current Select (set to 1)
+     // this.PDB_HLD    = 0x80;     // OUTPUT:  0 = Head Load (head on disk)
+
+        /*
+         * Next, definitions for the MC6850 ACIA.
+         *
+         * For reference, here are all the possible CTRL_WSEL (Word Select) values:
+         *
+         *      000     0x00        7 bits, even parity, 2 stop bits
+         *      001     0x04        7 bits, odd parity, 2 stop bits
+         *      010     0x08        7 bits, even parity, 1 stop bit
+         *      011     0x0C        7 bits, odd parity, 1 stop bit
+         *      100     0x10        8 bits, 2 stop bits
+         *      101     0x14        8 bits, 1 stop bit
+         *      110     0x18        8 bits, even parity, 1 stop bit
+         *      111     0x1C        8 bits, odd parity, 1 stop bit
+         *
+         * And here are all the possible CTRL_TCTL (Transmit Control) values:
+         *
+         *      00      0x00        RTS=Low, Transmitting Interrupt Disabled
+         *      01      0x20        RTS=Low, Transmitting Interrupt Enabled
+         *      10      0x40        RTS=High, Transmitting Interrupt Disabled
+         *      11      0x60        RTS=Low, Transmits a Break level on the Transmit Data Output; Transmitting Interrupt Disabled
+         */
+        this.PORT_CTRL = 0x10;  // ACIA Control Register (WRITE-only)
+        this.PORT_STAT = 0x10;  // ACIA Status Register (READ-only)
+        this.PORT_DATA = 0x11;  // ACIA Data Register (Transmit Data Register on WRITE, Receive Data Register on READ)
+
+        this.CTRL_CDIV  = 0x03; // Counter Divide (CR1,CR0) [OSI sets both, performing a "Master Reset", then immediately clears both, for a divide ratio of 1]
+     // this.CTRL_WSEL  = 0x1C; // Word Select (CR4,CR3,CR2), determining word length, parity and stop bits [OSI selects 0x18 for "8 bits, even parity, 1 stop bit"]
+     // this.CTRL_TCTL  = 0x60; // Transmit Control (CR6,CR5) [OSI selects 0x40 for "RTS=High, Transmitting Interrupt Disabled"]
+     // this.CTRL_RINT  = 0x80; // Receive Interrupt Enable (CR7) [OSI selects 0x00 for interrupts disabled]
+
+        this.STAT_RDRF  = 0x01; // Receive Data Register Full
+        this.STAT_TDRE  = 0x02; // Transmit Data Register Empty
+        this.STAT_DCD   = 0x04; // Data Carrier Detect
+        this.STAT_CTS   = 0x08; // Clear To Send
+     // this.STAT_FE    = 0x10; // Framing Error (ie, the received character is improperly framed by a start and a stop bit and is detected by the absence of the first stop bit)
+     // this.STAT_OVRN  = 0x20; // Receiver Overrun (ie, one or more characters in the data stream were lost due to not being read from the Receive Data Register in time)
+     // this.STAT_PE    = 0x40; // Parity Error (ie, the number of highs (ones) in the character does not agree with the preselected odd or even parity)
+     // this.STAT_IRQ   = 0x80; // Interrupt Request (ie, state of the IRQ output; cleared by a read operation to the Receive Data Register or a write operation to the Transmit Data Register)
+
+        /*
+         * Last but not least, some internal state definitions and hard-coded assumptions
+         */
+        this.DRIVETYPE_5INCH = 0;
+     // this.DRIVETYPE_8INCH = 1;
+
+        this.MAXTRACKS_5INCH = 40;
+     // this.MAXTRACKS_8INCH = 77;
+
+        /*
+         * Some random OS-65D notes
+         *
+         * Version 3.3 Initialization Code
+         * -------------------------------
+         *
+         * The following code (where X is 0x00):
+         *
+         *      2217 8E 01 F4  STX $F401
+         *      221A 8E 00 F4  STX $F400
+         *      221D 8E 03 F4  STX $F403
+         *
+         * is intended to reset a Printer PIA located at 0xF400.
+         *
+         * It then takes a detour to "SET KEYBOARD SOUND GENERATOR TO LOWEST FREQUENCY (192.753 HZ)"
+         * with X set to 0xFF; the sound generator is supposed to be turned off a bit later, presumably
+         * at the same time it sets "64 char/line" mode -- well, that's what v3.2 did anyway.
+         *
+         *      2220 CA        DEX
+         *      2221 8E 01 DF  STX $DF01
+         *
+         * While X is still 0xFF, it continues initializing the Printer PIA:
+         *
+         *      2224 8E 02 F4  STX $F402
+         *
+         * Then the code fiddles a bit with a mystery serial port (perhaps the "Model 430B Cassette & Analog I/O"
+         * interface?)
+         *
+         *      2227 AD 06 FB  LDA $FB06
+         *      222A 8E 05 FB  STX $FB05
+         *
+         * And then it's back to more Printer PIA initialization:
+         *
+         *      222D A9 04     LDA #$04
+         *      222F 8D 01 F4  STA $F401
+         *      2232 8D 03 F4  STA $F403
+         *
+         * Then it does some disk resetting (with A still 0x04 and Y set to 0x00):
+         *
+         *      2235 8C 01 C0  STY $C001
+         *      2238 A0 40     LDY #$40 ;'@'
+         *      223A 8C 00 C0  STY $C000
+         *      223D 8D 01 C0  STA $C001
+         *
+         * This code supposedly selects DRIVE 1:
+         *
+         *      2240 A9 01     LDA #$01
+         *      2242 20 C6 29  JSR $29C6
+         *
+         * Then it "resets" and "sets" the TERMINAL ACIA.  Note that the C1P serial port is addressed
+         * at 0xF000-0xF0FF, and the C1P has ROM mapped to 0xF800-0xFFFF, so we know nothing of the serial
+         * port mentioned above at 0xFBxx, nor this terminal ACIA port at 0xFCxx.
+         *
+         *      2245 A9 03     LDA #$03
+         *      2247 8D 00 FC  STA $FC00
+         *      224A A0 11     LDY #$11
+         *      224C 8C 00 FC  STY $FC00
+         *
+         * Next, there's some code to "SET CA-10X 16 WAY SERIAL BOARD" at 0xCF00-0xCF1F; again, something
+         * we know nothing about:
+         *
+         *      224F A2 1E     LDX #$1E
+         *      2251 9D 00 CF  STA $CF00,X
+         *      2254 98        TYA
+         *      2255 9D 00 CF  STA $CF00,X
+         *      2258 A9 03     LDA #$03
+         *      225A CA        DEX
+         *      225B CA        DEX
+         *      225C 10 F3     BPL $2251
+         *
+         * Then it clears 8 pages of video memory (ie, it simply ASSUMES that this is a Model 540 video board
+         * with 2K of video memory):
+         *
+         *      225E A2 08     LDX #$08
+         *      2260 A9 D0     LDA #$D0
+         *      2262 85 FF     STA $FF
+         *      2264 A0 00     LDY #$00
+         *      2266 84 FE     STY $FE
+         *      2268 A9 20     LDA #$20 ;' '
+         *      226A 91 FE     STA ($FE),Y
+         *      226C C8        INY
+         *      226D D0 FB     BNE $226A
+         *      226F E6 FF     INC $FF
+         *      2271 CA        DEX
+         *      2272 D0 F6     BNE $226A
+         *
+         * Then it performs a memory test, starting with a high page of 0xBF, and stores the highest page of
+         * available RAM at 0x2300:
+         *
+         *      2276 A0 BF     LDY #$BF
+         *      2278 20 EC 22  JSR $22EC
+         *      227B F0 03     BEQ $2280
+         *      227D 88        DEY
+         *      227E D0 F8     BNE $2278
+         *      2280 8C 00 23  STY $2300
+         *
+         * Now it checks for "SERIAL OR VIDEO (EITHER 65-A OR 65-V PROM)" (the byte at 0xFE01 on a C1P is 0x28,
+         * so X will be 2, implying "VIDEO"):
+         *
+         *      2283 A2 01     LDX #$01
+         *      2285 AD 01 FE  LDA $FE01
+         *      2288 F0 01     BEQ $228B
+         *      228A E8        INX
+         *      228B 8E C6 2A  STX $2AC6
+         *
+         * Finally, there's some code that's a little different from v3.2; in 3.2, it would set X to 0x01
+         * and then store X at 0xDE00, effectively forcing the video board into "64 char/line" mode -- which was
+         * originally EXACTLY what I was looking for in the video emulation component.  But v3.3 doesn't do that.
+         * Here's what it does instead:
+         *
+         *      228F A2 00     LDX #$00
+         *      2291 8E 80 DC  STX $DC80
+         *
+         * So, what's supposed to be at 0xDC80?
+         */
+
+        this.reset(true);
+    }
+
+    /**
+     * @this {C1PDiskController}
+     * @param {boolean|undefined} [fPowerOn] is true for the initial reset only
+     */
+    reset(fPowerOn)
+    {
+        this.resetRegs();
+        this.iDriveSelect = -1;
+        if (fPowerOn) {
+            this.aDrives = [];
+            this.resetDrive(0, this.DRIVETYPE_5INCH, this.MAXTRACKS_5INCH);
+        }
+    }
+
+    /**
+     * @this {C1PDiskController}
+     */
+    resetRegs()
+    {
+        this.regDDA = {
+            bits: this.PDA_SD2, // clear all DDA bits, indicating that all PDA bits represent INPUT lines (well, except for PDA_SD2)
+            read: function() {},
+            update: function(controller) {
+                return function(b) {
+                    if (b !== undefined) this.bits = b;
+                    if (!(controller.regCRA.bits & controller.CR_PD_SEL)) {
+                        controller.writePort(controller.PORT_DDA, this);
+                    }
+                };
+            }(this)
+        };
+        this.regPDA = {
+            bits: 0xff,
+            read: function() {
+                this.update();
+            },
+            update: function(controller) {
+                return function(b) {
+                    this.bits = controller.updatePDA(b);
+                    if (controller.regCRA.bits & controller.CR_PD_SEL) {
+                        controller.writePort(controller.PORT_PDA, this);
+                    }
+                };
+            }(this)
+        };
+        this.regCRA = {
+            bits: 0,
+            read: function() {},
+            update: function(controller) {
+                return function(b) {
+                    /*
+                     * Most bits written to CRA should be left as-is (the CPU should read back what it wrote);
+                     * bits 7 and 6 (IRQ1 and IRQ2) are exceptions, since those are tied to peripheral "Control Lines"
+                     * C1 and C2, which can in theory generate an interrupt depending on how the C1_CTRL and C2_CTRL bits
+                     * in CRA are set.  However, assuming there's no need to simulate interrupts for this particular
+                     * controller hardware, all we'll do is simply insure those two bits are always off.
+                     */
+                    if (b !== undefined) this.bits = (b & ~(controller.CR_IRQ1 | controller.CR_IRQ2));
+                    controller.writePort(controller.PORT_CRA, this);
+                    /*
+                     * Since a CRA write may have also changed which register (PDA or DDA) is enabled via the corresponding
+                     * PDA port, we simply ask ask both to update (only the one that's enabled will write itself to memory).
+                     */
+                    controller.regPDA.update();
+                    controller.regDDA.update();
+                };
+            }(this)
+        };
+        this.regDDB = {
+            bits: 0xff,         // set all DDB bits, indicating that all PDB bits represent OUTPUT lines
+            read: function() {},
+            update: function(controller) {
+                return function(b) {
+                    if (b !== undefined) this.bits = b;
+                    if (!(controller.regCRB.bits & controller.CR_PD_SEL)) {
+                        controller.writePort(controller.PORT_DDB, this);
+                    }
+                };
+            }(this)
+        };
+        this.regPDB = {
+            bits: 0xff,
+            read: function() {},
+            update: function(controller) {
+                return function(b) {
+                    this.bits = controller.updatePDB(b);
+                    if (controller.regCRB.bits & controller.CR_PD_SEL) {
+                        controller.writePort(controller.PORT_PDB, this);
+                    }
+                };
+            }(this)
+        };
+        this.regCRB = {
+            bits: 0,
+            read: function() {},
+            update: function(controller) {
+                return function(b) {
+                    /*
+                     * Most bits written to CRB should be left as-is (the CPU should read back what it wrote);
+                     * bits 7 and 6 (IRQ1 and IRQ2) are exceptions, since those are tied to peripheral "Control Lines"
+                     * C1 and C2, which can in theory generate an interrupt depending on how the C1_CTRL and C2_CTRL bits
+                     * in CRB are set.  However, assuming there's no need to simulate interrupts for this particular
+                     * controller hardware, all we'll do is simply insure those two bits are always off.
+                     */
+                    if (b !== undefined) this.bits = (b & ~(controller.CR_IRQ1 | controller.CR_IRQ2));
+                    controller.writePort(controller.PORT_CRB, this);
+                    /*
+                     * Since a CRB write may have also changed which register (PDB or DDB) is enabled via the corresponding
+                     * PDB port, we simply ask ask both to update (only the one that's enabled will write itself to memory).
+                     */
+                    controller.regPDB.update();
+                    controller.regDDB.update();
+                };
+            }(this)
+        };
+        this.regCTRL = {
+            bits: 0,
+            read: function() {},
+            update: function(controller) {
+                return function(b) {
+                    if (b !== undefined) {
+                        if ((b & controller.CTRL_CDIV) == controller.CTRL_CDIV) {
+                            /*
+                             * Setting both CTRL_CDIV bits (CR0 and CR1) constitutes a "Master Reset" of the ACIA
+                             */
+                            controller.regSTAT.bits = (controller.STAT_TDRE | controller.STAT_DCD | controller.STAT_CTS);
+                        }
+                        this.bits = b;
+                    }
+                    // regCTRL isn't readable; instead, we ensure regSTAT is rewritten in its place
+                    controller.regSTAT.update();
+                };
+            }(this)
+        };
+        this.regSTAT = {
+            bits: (this.STAT_TDRE | this.STAT_DCD | this.STAT_CTS),
+            read: function() {},
+            update: function(controller) {
+                return function(b) {
+                    this.bits = controller.updateSTAT(b);
+                    controller.writePort(controller.PORT_STAT, this);
+                };
+            }(this)
+        };
+        this.regDATA = {
+            bits: 0,
+            read: function(controller) {
+                return function() {
+                    controller.advanceDriveData();
+                };
+            }(this),
+            update: function(controller) {
+                return function(b) {
+                    if (b !== undefined) this.bits = b;
+                    controller.writePort(controller.PORT_DATA, this);
+                };
+            }(this)
+        };
+        this.regUnknown = {
+            bits: 0,
+            read: function() {},
+            update: function(controller) {
+                return function(b) {};
+            }(this)
+        };
+        if (DEBUG) {
+            this.regDDA.sName = "DDA",
+            this.regDDA.aBitIDs = {0x80:"DD7",0x40:"DD6",0x20:"DD5",0x10:"DD4",0x08:"DD3",0x04:"DD2",0x02:"DD1",0x01:"DD0"};    // jshint ignore:line
+            this.regPDA.sName = "PDA";
+            this.regPDA.aBitIDs = {0x80:"IHD",0x40:"SD2",0x20:"WP",0x10:"RDY2",0x08:"SHD",0x04:"FD",0x02:"TZD",0x01:"RDY1"};
+            this.regCRA.sName = "CRA";
+            this.regCRA.aBitIDs = {0x80:"IRQ1",0x40:"IRQ2",0x20:"C2OUT",0x10:"C2:1",0x08:"C2:0",0x04:"PDS",0x02:"C1:1",0x01:"C1:0"};
+            this.regDDB.sName = "DDB";
+            this.regDDB.aBitIDs = {0x80:"DD7",0x40:"DD6",0x20:"DD5",0x10:"DD4",0x08:"DD3",0x04:"DD2",0x02:"DD1",0x01:"DD0"};
+            this.regPDB.sName = "PDB";
+            this.regPDB.aBitIDs = {0x80:"HLD",0x40:"LCS",0x20:"SD1",0x10:"FR",0x08:"ST",0x04:"STI",0x02:"EE",0x01:"WE"};
+            this.regCRB.sName = "CRB";
+            this.regCRB.aBitIDs = {0x80:"IRQ1",0x40:"IRQ2",0x20:"C2OUT",0x10:"C2:1",0x08:"C2:0",0x04:"PDS",0x02:"C1:1",0x01:"C1:0"};
+            this.regCTRL.sName = "CTRL";
+            this.regCTRL.aBitIDs = {0x80:"CR7",0x40:"CR6",0x20:"CR5",0x10:"CR4",0x08:"CR3",0x04:"CR2",0x02:"CR1",0x01:"CR0"};
+            this.regSTAT.sName = "STAT";
+            this.regDATA.sName = "DATA";
+            this.regUnknown.sName = "unknown";
+        }
+    }
+
+    /**
+    * @this {C1PDiskController}
+    * @param {number} iDrive
+    * @param {number} iDriveType
+    * @param {number} nMaxTracks
+    */
+    resetDrive(iDrive, iDriveType, nMaxTracks)
+    {
+        this.aDrives[iDrive] = {
+            iType: iDriveType,
+            nTracks: nMaxTracks,
+            fProtected: true,               // fake for now
+            nIndexPulse: 20,                // nIndex (20 is initial index pulse)
+            iTrackSelect: 0,                // nTrack
+            iTrackOffset: -1,               // nSector
+            /*
+             * Our disk data consists of an array of tracks, where each track is an array of sectors;
+             * as long as aTracks.length == 0 (empty array), the drive is not considered "loaded" with a disk.
+             */
+            aTracks: []
+        };
+    }
+
+    /**
+    * @this {C1PDiskController}
+    * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea")
+    * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "listDisk")
+    * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+    * @param {string} [sValue] optional data value
+    * @return {boolean} true if binding was successful, false if unrecognized binding request
+    */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        switch(sBinding) {
+
+        case "listDisk":
+            this.bindings[sBinding] = control;
+            return true;
+
+        case "loadDisk":
+            this.bindings[sBinding] = control;
+            control.onclick = function(controller) {
+                return function() {
+                    if (controller.bindings["listDisk"]) {
+                        var sFilePath = controller.bindings["listDisk"].value;
+                        var sFileURL = sFilePath;
+                        /*
+                         * If the selected disk image has a ".json" extension, then we assume it's a pre-converted
+                         * JSON-encoded disk image, so we load it as-is; otherwise, we ask our server-side disk image
+                         * converter to return the corresponding JSON-encoded data, in compact form (ie, minimal whitespace,
+                         * no ASCII data comments, etc).
+                         */
+                        if (sFilePath.substr(sFilePath.length-5) != ".json") {
+                            /*
+                             * TODO: This code was using a deprecated parameter (compact=1); make sure things still work.
+                             *
+                             * TODO: Convert this code to use the new shared Disk API definitions and weblib functions; eg:
+                             *
+                             *      sDiskURL = Web.getHost() + DumpAPI.ENDPOINT + "?" + DumpAPI.QUERY.DISK + "=" + sDiskPath;
+                             */
+                            sFileURL = "http://" + window.location.host + "/api/v1/dump?disk=" + sFilePath;
+                        }
+                        controller.println("loading  " + Str.getBaseName(sFilePath) + "...");
+                        Web.getResource(sFileURL, null, true, function(sURL, sResponse, nErrorCode) {
+                            controller.loadDisk(sURL, sResponse, nErrorCode);
+                        });
+                    }
+                };
+            }(this);
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+    * @this {C1PDiskController}
+    * @param {Array} abMemory
+    * @param {number} start
+    * @param {number} end
+    * @param {C1PCPU} cpu
+    */
+    setBuffer(abMemory, start, end, cpu)
+    {
+        this.abMem = abMemory;
+        this.addrController = start;
+     // this.addrControllerLimit = end + 1;
+        if ((this.cpu = cpu)) {
+            cpu.addReadNotify(start, end, this, this.getByte);
+            cpu.addWriteNotify(start, end, this, this.setByte);
+        }
+        this.setReady();
+    }
+
+    /**
+    * @this {C1PDiskController}
+    * @param {boolean} fOn
+    * @param {C1PComputer} cmp
+    *
+    * We need We make a note of the Computer component, so that we can invoke its reset() method whenever we need to
+    * simulate a warm start, and we query the Keyboard component so that we can use its injectKeys() function.
+    */
+    setPower(fOn, cmp)
+    {
+        if (fOn && !this.flags.powered) {
+            this.flags.powered = true;
+            if (DEBUGGER) this.dbg = cmp.getComponentByType("debugger");
+        }
+    }
+
+    /**
+    * @this {C1PDiskController}
+    * @param {string} sDiskName
+    * @param {string} sDiskData
+    * @param {number} nErrorCode (response from server if anything other than 200)
+    *
+    * NOTE: Although I've expanded the JSON disk-image format to support multiple heads (ie, platters or disk surfaces),
+    * this controller implementation currently supports only single-head drives, and therefore only single-sided images.
+    * So, if the image contains more than one entry in head data array, all we use is the first entry; data for any remaining
+    * heads is discarded.
+    *
+    * WARNING: The disk-image format should match that used by PCjs, where the image is an array of cylinders, each of which
+    * is an array of heads.  That's also more typical, because it maintains the original data's physical locality.
+    */
+    loadDisk(sDiskName, sDiskData, nErrorCode)
+    {
+        if (nErrorCode) {
+            this.println("disk load error (" + nErrorCode + ")");
+            return;
+        }
+        var aHeads = [];
+        this.println("mounting " + sDiskName + "...");
+        try {
+            /*
+             * The most likely source of any exception will be right here, where we're parsing
+             * the JSON-encoded disk data.
+             */
+            aHeads = eval("(" + sDiskData + ")");   // jshint ignore:line
+            if (!aHeads.length) {
+                this.println("no data: " + sDiskName);
+                return;
+            }
+            if (!aHeads[0].length) {
+                this.println("no tracks: " + sDiskName);
+                return;
+            }
+            var aTracks = aHeads[0];
+            if (aTracks[0]['trackNum'] === undefined) {
+                this.println("data error: " + aTracks[0]);
+                return;
+            }
+            /*
+             * NOTE: This should never happen, otherwise we shouldn't have initiated the load
+             * in the first place. Can we guarantee that and eliminate this test?
+             */
+            if (!this.aDrives[0]) {
+                this.println("no available drives");
+                return;
+            }
+            /*
+             * To make disk access more efficient, we need to supplement every track object with a
+             * simple byte-array (trackData) containing all the data bytes for the entire track.
+             */
+            for (var iTrack=0; iTrack < aTracks.length; iTrack++) {
+                var iTrackNum;
+                var track = aTracks[iTrack];
+                var sectors = track['sectors'];
+                /*
+                 * WARNING: There are MANY other ways the track data could be malformed, but we'll
+                 * start with the most egregious, and worry about the rest later.
+                 */
+                if ((iTrackNum = track['trackNum']) === undefined || sectors === undefined) {
+                    throw new Error("track " + iTrack + " missing data");
+                }
+                /*
+                 * WARNING: We allow out-of-order tracks, because we store each track's data according
+                 * to its trackNum index, but just in case that wasn't intended, we're going to mention it.
+                 */
+                if (iTrackNum != iTrack) {
+                    Component.warning("track " + iTrackNum + " out of order (expected " + iTrack + ")");
+                }
+                /*
+                 * For each track, we start with an empty trackData array and "push" (ie, append) all the
+                 * sector data onto it. Most of the data is already in byte form and can simply use Array.push(),
+                 * but there is also some metadata (signatures, types, lengths, etc), for which we have assorted
+                 * helpers below: pushBCD, pushBin, and pushSig.
+                 */
+                var trackData = [], sector, sectorData, i;
+                if (!iTrackNum) {
+                    sector = sectors[0];
+                    sectorData = sector['sectorData'];
+                    this.pushBin(trackData, track, 'trackLoad', 2);
+                    this.pushBin(trackData, sector, 'sectorPages');
+                    for (i = 0; i < sectorData.length; i++) {
+                        trackData.push(sectorData[i]);
+                    }
+                }
+                else {
+                    this.pushSig(trackData, track, 'trackSig');
+                    this.pushBCD(trackData, track, 'trackNum');
+                    this.pushBin(trackData, track, 'trackType');
+                    for (var iSector=0; iSector < sectors.length; iSector++) {
+                        sector = sectors[iSector];
+                        sectorData = sector['sectorData'];
+                        this.pushBin(trackData, sector, 'sectorSig');
+                        this.pushBin(trackData, sector, 'sectorNum');
+                        this.pushBin(trackData, sector, 'sectorPages');
+                        for (i = 0; i < sectorData.length; i++) {
+                            trackData.push(sectorData[i]);
+                        }
+                        this.pushSig(trackData, sector, 'sectorEndSig');
+                    }
+                }
+                /*
+                 * Finally, here's where we add the newly-created chunk of track data to the current track object
+                 */
+                aTracks[iTrackNum].trackData = trackData;
+                if (DEBUGGER && this.dbg && this.dbg.messageEnabled(this.dbg.MESSAGE_DISK)) {
+                    this.dbg.message("track " + iTrackNum + ": " + trackData.length + " bytes");
+                }
+            }
+            this.aDrives[0].aTracks = aTracks;
+            this.println("mount of " + sDiskName + " complete");
+        } catch (e) {
+            this.println("disk data error: " + e.message);
+        }
+    }
+
+    /**
+    * @this {C1PDiskController}
+    * @param {Array.<number>} a
+    * @param {Object} o is the object containing the key
+    * @param {string} k is the key of 8-bit value to convert to BCD (ie, two 4-bit BCD digits) and push
+    */
+    pushBCD(a, o, k)
+    {
+        var n = o[k];
+        if (n === undefined) {
+            throw new Error("missing bcd value: " + k);
+        }
+        var bcd = (Math.floor(n / 10) << 4) | (n % 10);
+        a.push(bcd);
+    }
+
+    /**
+    * @this {C1PDiskController}
+    * @param {Array.<number>} a
+    * @param {Object} o is the object containing the key
+    * @param {string} k is the key of the value
+    * @param {number} [cb] is the number of bytes to push (only 1 or 2 is supported, and the default is 1)
+    */
+    pushBin(a, o, k, cb)
+    {
+        var n = o[k];
+        if (n === undefined) {
+            throw new Error("missing binary value: " + k);
+        }
+        if (cb == 2) {
+            a.push((n >> 8) & 0xff);
+        }
+        a.push(n & 0xff);
+    }
+
+    /**
+    * @this {C1PDiskController}
+    * @param {Array.<number>} a
+    * @param {Object} o is the object containing the key
+    * @param {string} k is the key of the signature string to push
+    */
+    pushSig(a, o, k)
+    {
+        var s = o[k];
+        if (s === undefined) {
+            throw new Error("missing signature: " + k);
+        }
+        for (var i=0; i < s.length; i++) {
+            a.push(s.charCodeAt(i));
+        }
+    }
+
+    /**
+    * @this {C1PDiskController}
+    * @param {number} port address (0x0000-0x00FF) relative to addrController (0xC000)
+    * @param {boolean} fWrite is true if port write, false if port read
+    * @return {Object} reg will always be a valid register object, but it may be the "unknown" register if we don't recognize the port.
+    */
+    getReg(port, fWrite)
+    {
+        var reg;
+        port &= 0x3F;
+        /*
+         * Now that we've masked the full port range of 0x00-0xFF down to 0x00-0x3F, we further mask the
+         * PIA port range (0x00-0x0F) to 0x00-0x03, and the ACIA port range (0x10-0x1F) to 0x10-0x11.
+         * The rest of the masked range (0x20-0x3F) is unmapped, so we map it to our global unknown register.
+         */
+        if (port < 0x10)
+            port &= 0x03;
+        else if (port < 0x20)
+            port &= 0x11;
+        switch(port) {
+        case this.PORT_PDA:
+            reg = (this.regCRA.bits & this.CR_PD_SEL)? this.regPDA : this.regDDA;
+            break;
+        case this.PORT_CRA:
+            reg = this.regCRA;
+            break;
+        case this.PORT_PDB:
+            reg = (this.regCRB.bits & this.CR_PD_SEL)? this.regPDB : this.regDDB;
+            break;
+        case this.PORT_CRB:
+            reg = this.regCRB;
+            break;
+        case this.PORT_CTRL:
+            reg = (fWrite? this.regCTRL : this.regSTAT);
+            break;
+        case this.PORT_DATA:
+            reg = this.regDATA;
+            break;
+        default:
+            reg = this.regUnknown;
+            break;
+        }
+        return reg;
+    }
+
+    /**
+    * @this {C1PDiskController}
+    * @param {number} addr
+    * @param {number|undefined} addrFrom (not defined whenever the Debugger tries to read the specified addr)
+    */
+    getByte(addr, addrFrom)
+    {
+        /*
+         * Don't trigger any further hardware emulation (beyond what we've already stored in memory) if
+         * the Debugger performed this read (need a special Debugger I/O command if/when you really want to do that).
+         */
+        if (addrFrom !== undefined) {
+            var port = addr - this.addrController;
+            var reg = this.getReg(port, false);
+            if (DEBUGGER && this.dbg) this.dbg.messageIO(this, addr, addrFrom, this.dbg.MESSAGE_DISK, false, reg.sName);
+            reg.read();
+        }
+    }
+
+    /**
+    * @this {C1PDiskController}
+    * @param {number} addr
+    * @param {number|undefined} addrFrom (not defined whenever the Debugger tries to write the specified addr)
+    */
+    setByte(addr, addrFrom)
+    {
+        /*
+         * Don't trigger any further hardware emulation (beyond what we've already stored in memory) if
+         * the Debugger performed this write (need a special Debugger I/O command if/when you really want to do that).
+         */
+        if (addrFrom !== undefined) {
+            var b = this.cpu.getByte(addr);
+            var port = addr - this.addrController;
+            var reg = this.getReg(port, true);
+            if (DEBUGGER && this.dbg && this.dbg.messageEnabled(this.dbg.MESSAGE_DISK | this.dbg.MESSAGE_PORT)) {
+                this.dbg.messageIO(this, addr, addrFrom, this.dbg.MESSAGE_DISK, true, reg.sName);
+                if (reg.aBitIDs) {
+                    var bTest = 0x80;
+                    var bChanged = reg.bits ^ b;
+                    while (bChanged && bTest) {
+                        if (bChanged & bTest) {
+                            this.dbg.message("  changed " + reg.sName + "." + reg.aBitIDs[bTest] + " to " + ((b & bTest)? "1" : "0"));
+                        }
+                        bTest >>= 1;
+                    }
+                }
+            }
+            reg.update(b);
+        }
+    }
+
+    /**
+    * @this {C1PDiskController}
+    * @param {number} bPDA
+    * @param {number} bPDB
+    */
+    setSelectedDrive(bPDA, bPDB)
+    {
+        var iDriveSelect = -1;
+        if (bPDA !== undefined && bPDB !== undefined) {
+            iDriveSelect = 0;
+            if (!(bPDB & this.PDB_SD1))
+                iDriveSelect |= 0x02;
+            if (!(this.regPDA.bits & this.PDA_SD2))
+                iDriveSelect |= 0x01;
+        }
+        if (this.iDriveSelect != iDriveSelect) {
+            this.iDriveSelect = iDriveSelect;
+            this.regSTAT.update();
+        }
+    }
+
+    /**
+     * @this {C1PDiskController}
+     */
+    startDriveData()
+    {
+        if (this.iDriveSelect >= 0) {
+            this.aDrives[this.iDriveSelect].iTrackOffset = 0;
+            this.advanceDriveData();
+        }
+    }
+
+    /**
+     * @this {C1PDiskController}
+     */
+    stopDriveData()
+    {
+        if (this.iDriveSelect >= 0) {
+            this.aDrives[this.iDriveSelect].iTrackOffset = -1;
+            this.regDATA.update(0xFF);          // QUESTION: Is this necessary or helpful in some way?
+            this.regSTAT.update();
+        }
+    }
+
+    /**
+     * @this {C1PDiskController}
+     * @return {number} current byte of data from the currently selected drive, or null if no (more) data available
+     */
+    advanceDriveData()
+    {
+        var b = null;
+        if (this.iDriveSelect >= 0) {
+            var drive = this.aDrives[this.iDriveSelect];
+            var track = drive.aTracks[drive.iTrackSelect];
+            if (track !== undefined) {
+                if (drive.iTrackOffset >= 0 && drive.iTrackOffset < track.trackData.length) {
+                    drive.nIndexPulse = 100;    // QUESTION: Necessary?
+                    b = track.trackData[drive.iTrackOffset++];
+                    this.regDATA.update(b);
+                    this.regSTAT.update();
+                }
+                else {
+                    drive.nIndexPulse = 10;     // QUESTION: Valid or necessary to force index pulse on next poll of $C000?
+                    this.stopDriveData();
+                }
+            }
+        }
+        return b;
+    }
+
+    /**
+     * updatePDA() calculates an updated value for the PDA register.
+     *
+     * In the process, this may also update iDriveSelect and assorted drive internal variables.
+     *
+     * @this {C1PDiskController}
+     * @param {number|undefined} bPDA
+     * @return {number} updated bits for PDA
+     */
+    updatePDA(bPDA)
+    {
+        if (bPDA === undefined)
+            bPDA = this.regPDA.bits;
+        else
+            this.setSelectedDrive(bPDA, this.regPDB.bits);
+
+        /*
+         * We start by turning ON most bits, except for PDA_RDY1, which we always leave
+         * OFF (indicating ready).  We leave PDA_SD2 alone, so that it reflects whatever
+         * the CPU had set.
+         *
+         * Then we dive into the update logic, which will turn OFF any of the bits we
+         * originally turned ON if the corresponding condition is true (because an OFF bit
+         * signals an active condition).
+         */
+        bPDA |= (this.PDA_IHD | this.PDA_WP | this.PDA_SHD | this.PDA_FD | this.PDA_TZD | this.PDA_RDY2);
+        bPDA &= ~(this.PDA_RDY1);
+
+        if (this.iDriveSelect >= 0) {
+
+            if (this.aDrives[this.iDriveSelect].aTracks.length) {
+
+                var drive = this.aDrives[this.iDriveSelect];
+
+                if (drive.fProtected) {
+                    bPDA &= ~this.PDA_WP;
+                }
+                if (!drive.iTrackSelect) {
+                    bPDA &= ~this.PDA_TZD;
+                }
+                /*
+                 * Simulate PHD_IHD (Index Hole Detect)
+                 */
+                if (--drive.nIndexPulse <= 10) {
+                    if (drive.nIndexPulse > 0) {
+                        bPDA &= ~this.PDA_IHD;
+                        this.stopDriveData();
+                    } else {
+                        drive.nIndexPulse = 100;
+                        this.startDriveData();
+                    }
+                }
+            }
+        }
+        return bPDA;
+    }
+
+    /**
+     * updatePDB() calculates an updated value for the PDB register.  However, since the
+     * PDB consists entirely of OUTPUT bits, none of the given bits should actually be modified.
+     *
+     * In the process, this may also update iDriveSelect and assorted drive internal variables,
+     * as well as selected PDA INPUT bits (hence the call to regPDA.update()).
+     *
+     * @this {C1PDiskController}
+     * @param {number|undefined} bPDB
+     * @return {number} updated bits for PDB
+     */
+    updatePDB(bPDB)
+    {
+        if (bPDB === undefined)
+            bPDB = this.regPDB.bits;
+        else
+            this.setSelectedDrive(this.regPDA.bits, bPDB);
+
+        if (this.iDriveSelect >= 0 && this.iDriveSelect < this.aDrives.length) {
+
+            var drive = this.aDrives[this.iDriveSelect];
+
+            if (drive.aTracks.length) {
+                /*
+                 * Is PDB_ST transitioning from 1 to 0?
+                 */
+                if ((this.regPDB.bits & this.PDB_ST) && !(bPDB & this.PDB_ST)) {
+                    /*
+                     *  PDB_STI == 0? step toward track 39 : step toward track 0
+                     */
+                    if (bPDB & this.PDB_STI)
+                        drive.iTrackSelect--;
+                    else
+                        drive.iTrackSelect++;
+
+                    if (DEBUGGER && this.dbg && this.dbg.messageEnabled(this.dbg.MESSAGE_DISK)) {
+                        this.dbg.message("stepping " + ((bPDB & this.PDB_STI)? "down" : "up") + " to track " + drive.iTrackSelect);
+                    }
+
+                    if (drive.iTrackSelect >= drive.nTracks)
+                        drive.iTrackSelect = drive.nTracks;
+
+                    if (drive.iTrackSelect < 0)
+                        drive.iTrackSelect = 0;
+
+                    drive.nIndexPulse = 20;
+
+                    this.regPDA.update(this.regPDA.bits | this.PDA_IHD);
+                    this.stopDriveData();
+                }
+            }
+        }
+        else if (DEBUG && this.iDriveSelect >= 0) {
+            this.println("updatePDB(" + Str.toHexByte(bPDB) + "): invalid drive: " + this.iDriveSelect);
+        }
+        return bPDB;
+    }
+
+    /**
+     * updateSTAT() calculates an updated value for the ACIA Status register.
+     *
+     * @this {C1PDiskController}
+     * @param {number|undefined} bSTAT
+     * @return {number} updated bits for STAT
+     */
+    updateSTAT(bSTAT)
+    {
+        if (bSTAT === undefined)
+            bSTAT = this.regSTAT.bits;
+        bSTAT &= ~this.STAT_RDRF;
+        if (this.iDriveSelect >= 0 && this.aDrives[this.iDriveSelect].iTrackOffset >= 0)
+            bSTAT |= this.STAT_RDRF;
+        return bSTAT;
+    }
+
+    /**
+     * @this {C1PDiskController}
+     * @param {number} port
+     * @param {Object} reg
+     */
+    writePort(port, reg)
+    {
+        this.cpu.setByte(port + this.addrController, reg.bits);
+    }
+
+    /**
+     * @this {C1PDiskController}
+     * @param {boolean} fLoaded is true if the selected drive must be loaded, false if don't care
+     * @return {Object} drive reference to the selected drive, or null if no drive is selected or it doesn't meet the fLoaded requirement
+     *
+     getSelectedDrive(fLoaded)
+     {
+         var drive = null;
+         if (this.iDriveSelect >= 0) {
+             if (this.aDrives[this.iDriveSelect]) {
+                 if (!fLoaded || this.aDrives[this.iDriveSelect].aTracks.length)
+                     drive = this.aDrives[this.iDriveSelect];
+             }
+         }
+         return drive;
+     }
+     */
+
+    /**
+     * C1PDiskController.init()
+     *
+     * This function operates on every HTML element of class "disk", extracting the
+     * JSON-encoded parameters for the C1PDiskController constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a C1PDiskController component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeDC = Component.getElementsByClass(document, C1PJS.APPCLASS, "disk");
+        for (var iDC=0; iDC < aeDC.length; iDC++) {
+            var eDC = aeDC[iDC];
+            var parmsDC = Component.getComponentParms(eDC);
+            var controller = new C1PDiskController(parmsDC);
+            Component.bindComponentControls(controller, eDC, C1PJS.APPCLASS);
+        }
+    }
+}
+
+/*
+ * Initialize every DiskController module on the page.
+ */
+Web.onInit(C1PDiskController.init);
+
+/**
+ * @copyright http://pcjs.org/modules/c1pjs/lib/debugger.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class C1PDebugger extends Component {
+    /**
+     * C1PDebugger(parmsDbg)
+     *
+     * The C1PDebugger component has no required (parmsDbg) properties.
+     *
+     * The C1PDebugger component is an optional component that implements a variety of user
+     * commands for controlling the CPU, dumping and editing memory, etc.
+     *
+     * @this {C1PDebugger}
+     * @param {Object} parmsDbg
+     */
+    constructor(parmsDbg)
+    {
+        if (DEBUGGER) {
+
+            super("C1PDebugger", parmsDbg);
+
+            this.dbg = this;
+            /*
+             * This keeps track of instruction activity, but only when tracing or when
+             * Debugger checks have been enabled (eg, one or more breakpoints have been set).
+             *
+             * This is zeroed by CPU notification handlers reset() and stopped().
+             * We set it here to -1 to indicate that the CPU has not yet initialized us.
+             */
+            this.cIns = -1;
+
+            /*
+             * Some commands, like the dump (d) command, start at nextAddr when no address
+             * is given (and they also update nextAddr when they're done).
+             */
+            this.nextAddr = 0;
+
+            /*
+             * When Enter is pressed on an empty input buffer, we default to the previous
+             * command, which is preserved here.
+             */
+            this.prevCmd = null;
+
+            /*
+             * fAssemble is true when "assemble mode" is active, false when not.
+             */
+            this.fAssemble = false;
+            this.addrAssembleNext = 0;
+
+            /*
+             * Initialize the lists of breakpoint addresses.  aExecBreak is a list (Array) of addresses
+             * to halt at whenever attempting to execute an instruction at the corresponding address,
+             * and aReadBreak and aWriteBreak are lists of addresses to halt at whenever a read or write,
+             * respectively, occurs at the corresponding address.
+             */
+            this.clearBreakpoints();
+
+            /*
+             * Instead of pre-allocating these arrays, we wait until our reset() function is called.
+             * These arrays are updated in checkInstruction(), but the CPU will never actually call it
+             * unless checksEnabled() returns true, and that won't happen until one or more breakpoints
+             * have been set.  This ensures that, by default, the CPU runs as fast as possible.
+             */
+            this.iStepHistory = 0;
+            this.aStepHistory = [];
+            this.aaOpcodeFreqs = [];
+
+            /*
+             * This "info" buffer is a lightweight logging mechanism that has minimal impact on the
+             * browser (unlike printing to either window.console.log or an HTML control, which can make
+             * the browser unusable if printing is too frequent).  The Debugger's "i" command dumps
+             * this buffer.  Note that dumping too much at once can also bog things down, but by that
+             * point, you've presumably already captured the info you need and are willing to wait.
+             */
+            if (DEBUG) {
+                this.iInfoBuffer = 0;
+                this.aInfoBuffer = new Array(10000);
+            }
+
+            /*
+             * Message categories supported by the message() function; they are designed to be combined
+             * (ie, OR'ed) as needed.  The Debugger's "option" command is used to turn message categories
+             * on and off, like so:
+             *
+             *      o msg port on
+             *      o msg port off
+             *      ...
+             */
+            this.MESSAGE_PORT   = 0x01;
+            this.MESSAGE_KBD    = 0x10;
+            this.MESSAGE_VIDEO  = 0x20;
+            this.MESSAGE_DISK   = 0x40;
+            this.MESSAGE_SERIAL = 0x80;
+            this.MESSAGE_NONE   = 0x00;
+         // this.MESSAGE_ALL    = 0xff;
+            this.bitsMessage = this.MESSAGE_NONE;
+            this.aMessageCategories = {
+                'port':     this.MESSAGE_PORT,
+                'kbd':      this.MESSAGE_KBD,
+                'video':    this.MESSAGE_VIDEO,
+                'disk':     this.MESSAGE_DISK,
+                'serial':   this.MESSAGE_SERIAL
+            };
+
+            /*
+             * The aaOperations array is indexed by opcode, and each element is a sub-array that
+             * describes the corresponding opcode. The sub-elements are as follows:
+             *
+             *      [0]: {number} of the operation code (see OP_*)
+             *      [1]: {number} of additional bytes following the opcode byte, if any
+             *      [2]: {number} of the operation mode operand, if any (see MODE_*)
+             *
+             * These sub-elements are all optional. If [0] is not present, the opcode is undefined;
+             * if [1] is not present (or contains a zero), the opcode is a single-byte opcode; and if
+             * [2] is not present, the opcode uses no (or implied) operands.
+             */
+            this.OP_ADC = 0;
+            this.OP_AND = 1;
+            this.OP_ASL = 2;
+            this.OP_BCC = 3;
+            this.OP_BCS = 4;
+            this.OP_BEQ = 5;
+            this.OP_BIT = 6;
+            this.OP_BMI = 7;
+            this.OP_BNE = 8;
+            this.OP_BPL = 9;
+            this.OP_BRK = 10;
+            this.OP_BVC = 11;
+            this.OP_BVS = 12;
+            this.OP_CLC = 13;
+            this.OP_CLD = 14;
+            this.OP_CLI = 15;
+            this.OP_CLV = 16;
+            this.OP_CMP = 17;
+            this.OP_CPX = 18;
+            this.OP_CPY = 19;
+            this.OP_DEC = 20;
+            this.OP_DEX = 21;
+            this.OP_DEY = 22;
+            this.OP_EOR = 23;
+            this.OP_INC = 24;
+            this.OP_INX = 25;
+            this.OP_INY = 26;
+            this.OP_JMP = 27;
+            this.OP_JSR = 28;
+            this.OP_LDA = 29;
+            this.OP_LDX = 30;
+            this.OP_LDY = 31;
+            this.OP_LSR = 32;
+            this.OP_NOP = 33;
+            this.OP_ORA = 34;
+            this.OP_PHA = 35;
+            this.OP_PHP = 36;
+            this.OP_PLA = 37;
+            this.OP_PLP = 38;
+            this.OP_ROL = 39;
+            this.OP_ROR = 40;
+            this.OP_RTI = 41;
+            this.OP_RTS = 42;
+            this.OP_SBC = 43;
+            this.OP_SEC = 44;
+            this.OP_SED = 45;
+            this.OP_SEI = 46;
+            this.OP_STA = 47;
+            this.OP_STX = 48;
+            this.OP_STY = 49;
+            this.OP_TAX = 50;
+            this.OP_TAY = 51;
+            this.OP_TSX = 52;
+            this.OP_TXA = 53;
+            this.OP_TXS = 54;
+            this.OP_TYA = 55;
+            this.OP_SIM = 56;
+            this.OP_DB  = 57;
+
+            this.aOpCodes = [
+                "ADC","AND","ASL","BCC","BCS","BEQ","BIT","BMI",
+                "BNE","BPL","BRK","BVC","BVS","CLC","CLD","CLI",
+                "CLV","CMP","CPX","CPY","DEC","DEX","DEY","EOR",
+                "INC","INX","INY","JMP","JSR","LDA","LDX","LDY",
+                "LSR","NOP","ORA","PHA","PHP","PLA","PLP","ROL",
+                "ROR","RTI","RTS","SBC","SEC","SED","SEI","STA",
+                "STX","STY","TAX","TAY","TSX","TXA","TXS","TYA",
+                "SIM",".DB"
+            ];
+
+            this.aOpSimCodes = [
+                "HLT", "MSG"
+            ];
+
+            this.setOpModes(true);
+
+            this.aaOperations = [
+                /* 0x00 */ [this.OP_BRK],
+                /* 0x01 */ [this.OP_ORA, 1, this.MODE_INDX],
+                /* 0x02 */ [this.OP_SIM, 1],
+                /* 0x03 */ [],
+                /* 0x04 */ [],
+                /* 0x05 */ [this.OP_ORA, 1, this.MODE_ZP],
+                /* 0x06 */ [this.OP_ASL, 1, this.MODE_ZP],
+                /* 0x07 */ [],
+                /* 0x08 */ [this.OP_PHP],
+                /* 0x09 */ [this.OP_ORA, 1, this.MODE_IMM],
+                /* 0x0a */ [this.OP_ASL, 0, this.MODE_ACC],
+                /* 0x0b */ [],
+                /* 0x0c */ [],
+                /* 0x0d */ [this.OP_ORA, 2, this.MODE_ABS],
+                /* 0x0e */ [this.OP_ASL, 2, this.MODE_ABS],
+                /* 0x0f */ [],
+                /* 0x10 */ [this.OP_BPL, 1, this.MODE_DISP],
+                /* 0x11 */ [this.OP_ORA, 1, this.MODE_INDY],
+                /* 0x12 */ [],
+                /* 0x13 */ [],
+                /* 0x14 */ [],
+                /* 0x15 */ [this.OP_ORA, 1, this.MODE_ZPX],
+                /* 0x16 */ [this.OP_ASL, 1, this.MODE_ZPX],
+                /* 0x17 */ [],
+                /* 0x18 */ [this.OP_CLC],
+                /* 0x19 */ [this.OP_ORA, 2, this.MODE_ABSY],
+                /* 0x1a */ [],
+                /* 0x1b */ [],
+                /* 0x1c */ [],
+                /* 0x1d */ [this.OP_ORA, 2, this.MODE_ABSX],
+                /* 0x1e */ [this.OP_ASL, 2, this.MODE_ABSX],
+                /* 0x1f */ [],
+                /* 0x20 */ [this.OP_JSR, 2, this.MODE_IMM16],
+                /* 0x21 */ [this.OP_AND, 1, this.MODE_INDX],
+                /* 0x22 */ [],
+                /* 0x23 */ [],
+                /* 0x24 */ [this.OP_BIT, 1, this.MODE_ZP],
+                /* 0x25 */ [this.OP_AND, 1, this.MODE_ZP],
+                /* 0x26 */ [this.OP_ROL, 1, this.MODE_ZP],
+                /* 0x27 */ [],
+                /* 0x28 */ [this.OP_PLP],
+                /* 0x29 */ [this.OP_AND, 1, this.MODE_IMM],
+                /* 0x2a */ [this.OP_ROL, 0, this.MODE_ACC],
+                /* 0x2b */ [],
+                /* 0x2c */ [this.OP_BIT, 2, this.MODE_ABS],
+                /* 0x2d */ [this.OP_AND, 2, this.MODE_ABS],
+                /* 0x2e */ [this.OP_ROL, 2, this.MODE_ABS],
+                /* 0x2f */ [],
+                /* 0x30 */ [this.OP_BMI, 1, this.MODE_DISP],
+                /* 0x31 */ [this.OP_AND, 1, this.MODE_INDY],
+                /* 0x32 */ [],
+                /* 0x33 */ [],
+                /* 0x34 */ [],
+                /* 0x35 */ [this.OP_AND, 1, this.MODE_ZPX],
+                /* 0x36 */ [this.OP_ROL, 1, this.MODE_ZPX],
+                /* 0x37 */ [],
+                /* 0x38 */ [this.OP_SEC],
+                /* 0x39 */ [this.OP_AND, 2, this.MODE_ABSY],
+                /* 0x3a */ [],
+                /* 0x3b */ [],
+                /* 0x3c */ [],
+                /* 0x3d */ [this.OP_AND, 2, this.MODE_ABSX],
+                /* 0x3e */ [this.OP_ROL, 2, this.MODE_ABSX],
+                /* 0x3f */ [],
+                /* 0x40 */ [this.OP_RTI],
+                /* 0x41 */ [this.OP_EOR, 1, this.MODE_INDX],
+                /* 0x42 */ [],
+                /* 0x43 */ [],
+                /* 0x44 */ [],
+                /* 0x45 */ [this.OP_EOR, 1, this.MODE_ZP],
+                /* 0x46 */ [this.OP_LSR, 1, this.MODE_ZP],
+                /* 0x47 */ [],
+                /* 0x48 */ [this.OP_PHA],
+                /* 0x49 */ [this.OP_EOR, 1, this.MODE_IMM],
+                /* 0x4a */ [this.OP_LSR, 0, this.MODE_ACC],
+                /* 0x4b */ [],
+                /* 0x4c */ [this.OP_JMP, 2, this.MODE_IMM16],
+                /* 0x4d */ [this.OP_EOR, 2, this.MODE_ABS],
+                /* 0x4e */ [this.OP_LSR, 2, this.MODE_ABS],
+                /* 0x4f */ [],
+                /* 0x50 */ [this.OP_BVC, 1, this.MODE_DISP],
+                /* 0x51 */ [this.OP_EOR, 1, this.MODE_INDY],
+                /* 0x52 */ [],
+                /* 0x53 */ [],
+                /* 0x54 */ [],
+                /* 0x55 */ [this.OP_EOR, 1, this.MODE_ZPX],
+                /* 0x56 */ [this.OP_LSR, 1, this.MODE_ZPX],
+                /* 0x57 */ [],
+                /* 0x58 */ [this.OP_CLI],
+                /* 0x59 */ [this.OP_EOR, 2, this.MODE_ABSY],
+                /* 0x5a */ [],
+                /* 0x5b */ [],
+                /* 0x5c */ [],
+                /* 0x5d */ [this.OP_EOR, 2, this.MODE_ABSX],
+                /* 0x5e */ [this.OP_LSR, 2, this.MODE_ABSX],
+                /* 0x5f */ [],
+                /* 0x60 */ [this.OP_RTS],
+                /* 0x61 */ [this.OP_ADC, 1, this.MODE_INDX],
+                /* 0x62 */ [],
+                /* 0x63 */ [],
+                /* 0x64 */ [],
+                /* 0x65 */ [this.OP_ADC, 1, this.MODE_ZP],
+                /* 0x66 */ [this.OP_ROR, 1, this.MODE_ZP],
+                /* 0x67 */ [],
+                /* 0x68 */ [this.OP_PLA],
+                /* 0x69 */ [this.OP_ADC, 1, this.MODE_IMM],
+                /* 0x6a */ [this.OP_ROR, 0, this.MODE_ACC],
+                /* 0x6b */ [],
+                /* 0x6c */ [this.OP_JMP, 2, this.MODE_ABS16],
+                /* 0x6d */ [this.OP_ADC, 2, this.MODE_ABS],
+                /* 0x6e */ [this.OP_ROR, 2, this.MODE_ABS],
+                /* 0x6f */ [],
+                /* 0x70 */ [this.OP_BVS, 1, this.MODE_DISP],
+                /* 0x71 */ [this.OP_ADC, 1, this.MODE_INDY],
+                /* 0x72 */ [],
+                /* 0x73 */ [],
+                /* 0x74 */ [],
+                /* 0x75 */ [this.OP_ADC, 1, this.MODE_ZPX],
+                /* 0x76 */ [this.OP_ROR, 1, this.MODE_ZPX],
+                /* 0x77 */ [],
+                /* 0x78 */ [this.OP_SEI],
+                /* 0x79 */ [this.OP_ADC, 2, this.MODE_ABSY],
+                /* 0x7a */ [],
+                /* 0x7b */ [],
+                /* 0x7c */ [],
+                /* 0x7d */ [this.OP_ADC, 2, this.MODE_ABSX],
+                /* 0x7e */ [this.OP_ROR, 2, this.MODE_ABSX],
+                /* 0x7f */ [],
+                /* 0x80 */ [],
+                /* 0x81 */ [this.OP_STA, 1, this.MODE_INDX],
+                /* 0x82 */ [],
+                /* 0x83 */ [],
+                /* 0x84 */ [this.OP_STY, 1, this.MODE_ZP],
+                /* 0x85 */ [this.OP_STA, 1, this.MODE_ZP],
+                /* 0x86 */ [this.OP_STX, 1, this.MODE_ZP],
+                /* 0x87 */ [],
+                /* 0x88 */ [this.OP_DEY],
+                /* 0x89 */ [],
+                /* 0x8a */ [this.OP_TXA],
+                /* 0x8b */ [],
+                /* 0x8c */ [this.OP_STY, 2, this.MODE_ABS],
+                /* 0x8d */ [this.OP_STA, 2, this.MODE_ABS],
+                /* 0x8e */ [this.OP_STX, 2, this.MODE_ABS],
+                /* 0x8f */ [],
+                /* 0x90 */ [this.OP_BCC, 1, this.MODE_DISP],
+                /* 0x91 */ [this.OP_STA, 1, this.MODE_INDY],
+                /* 0x92 */ [],
+                /* 0x93 */ [],
+                /* 0x94 */ [this.OP_STY, 1, this.MODE_ZPX],
+                /* 0x95 */ [this.OP_STA, 1, this.MODE_ZPX],
+                /* 0x96 */ [this.OP_STX, 1, this.MODE_ZPY],
+                /* 0x97 */ [],
+                /* 0x98 */ [this.OP_TYA],
+                /* 0x99 */ [this.OP_STA, 2, this.MODE_ABSY],
+                /* 0x9a */ [this.OP_TXS],
+                /* 0x9b */ [],
+                /* 0x9c */ [],
+                /* 0x9d */ [this.OP_STA, 2, this.MODE_ABSX],
+                /* 0x9e */ [],
+                /* 0x9f */ [],
+                /* 0xa0 */ [this.OP_LDY, 1, this.MODE_IMM],
+                /* 0xa1 */ [this.OP_LDA, 1, this.MODE_INDX],
+                /* 0xa2 */ [this.OP_LDX, 1, this.MODE_IMM],
+                /* 0xa3 */ [],
+                /* 0xa4 */ [this.OP_LDY, 1, this.MODE_ZP],
+                /* 0xa5 */ [this.OP_LDA, 1, this.MODE_ZP],
+                /* 0xa6 */ [this.OP_LDX, 1, this.MODE_ZP],
+                /* 0xa7 */ [],
+                /* 0xa8 */ [this.OP_TAY],
+                /* 0xa9 */ [this.OP_LDA, 1, this.MODE_IMM],
+                /* 0xaa */ [this.OP_TAX],
+                /* 0xab */ [],
+                /* 0xac */ [this.OP_LDY, 2, this.MODE_ABS],
+                /* 0xad */ [this.OP_LDA, 2, this.MODE_ABS],
+                /* 0xae */ [this.OP_LDX, 2, this.MODE_ABS],
+                /* 0xaf */ [],
+                /* 0xb0 */ [this.OP_BCS, 1, this.MODE_DISP],
+                /* 0xb1 */ [this.OP_LDA, 1, this.MODE_INDY],
+                /* 0xb2 */ [],
+                /* 0xb3 */ [],
+                /* 0xb4 */ [this.OP_LDY, 1, this.MODE_ZPX],
+                /* 0xb5 */ [this.OP_LDA, 1, this.MODE_ZPX],
+                /* 0xb6 */ [this.OP_LDX, 1, this.MODE_ZPY],
+                /* 0xb7 */ [],
+                /* 0xb8 */ [this.OP_CLV],
+                /* 0xb9 */ [this.OP_LDA, 2, this.MODE_ABSY],
+                /* 0xba */ [this.OP_TSX],
+                /* 0xbb */ [],
+                /* 0xbc */ [this.OP_LDY, 2, this.MODE_ABSX],
+                /* 0xbd */ [this.OP_LDA, 2, this.MODE_ABSX],
+                /* 0xbe */ [this.OP_LDX, 2, this.MODE_ABSY],
+                /* 0xbf */ [],
+                /* 0xc0 */ [this.OP_CPY, 1, this.MODE_IMM],
+                /* 0xc1 */ [this.OP_CMP, 1, this.MODE_INDX],
+                /* 0xc2 */ [],
+                /* 0xc3 */ [],
+                /* 0xc4 */ [this.OP_CPY, 1, this.MODE_ZP],
+                /* 0xc5 */ [this.OP_CMP, 1, this.MODE_ZP],
+                /* 0xc6 */ [this.OP_DEC, 1, this.MODE_ZP],
+                /* 0xc7 */ [],
+                /* 0xc8 */ [this.OP_INY],
+                /* 0xc9 */ [this.OP_CMP, 1, this.MODE_IMM],
+                /* 0xca */ [this.OP_DEX],
+                /* 0xcb */ [],
+                /* 0xcc */ [this.OP_CPY, 2, this.MODE_ABS],
+                /* 0xcd */ [this.OP_CMP, 2, this.MODE_ABS],
+                /* 0xce */ [this.OP_DEC, 2, this.MODE_ABS],
+                /* 0xcf */ [],
+                /* 0xd0 */ [this.OP_BNE, 1, this.MODE_DISP],
+                /* 0xd1 */ [this.OP_CMP, 1, this.MODE_INDY],
+                /* 0xd2 */ [],
+                /* 0xd3 */ [],
+                /* 0xd4 */ [],
+                /* 0xd5 */ [this.OP_CMP, 1, this.MODE_ZPX],
+                /* 0xd6 */ [this.OP_DEC, 1, this.MODE_ZPX],
+                /* 0xd7 */ [],
+                /* 0xd8 */ [this.OP_CLD],
+                /* 0xd9 */ [this.OP_CMP, 2, this.MODE_ABSY],
+                /* 0xda */ [],
+                /* 0xdb */ [],
+                /* 0xdc */ [],
+                /* 0xdd */ [this.OP_CMP, 2, this.MODE_ABSX],
+                /* 0xde */ [this.OP_DEC, 2, this.MODE_ABSX],
+                /* 0xdf */ [],
+                /* 0xe0 */ [this.OP_CPX, 1, this.MODE_IMM],
+                /* 0xe1 */ [this.OP_SBC, 1, this.MODE_INDX],
+                /* 0xe2 */ [],
+                /* 0xe3 */ [],
+                /* 0xe4 */ [this.OP_CPX, 1, this.MODE_ZP],
+                /* 0xe5 */ [this.OP_SBC, 1, this.MODE_ZP],
+                /* 0xe6 */ [this.OP_INC, 1, this.MODE_ZP],
+                /* 0xe7 */ [],
+                /* 0xe8 */ [this.OP_INX],
+                /* 0xe9 */ [this.OP_SBC, 1, this.MODE_IMM],
+                /* 0xea */ [this.OP_NOP],
+                /* 0xeb */ [],
+                /* 0xec */ [this.OP_CPX, 2, this.MODE_ABS],
+                /* 0xed */ [this.OP_SBC, 2, this.MODE_ABS],
+                /* 0xee */ [this.OP_INC, 2, this.MODE_ABS],
+                /* 0xef */ [],
+                /* 0xf0 */ [this.OP_BEQ, 1, this.MODE_DISP],
+                /* 0xf1 */ [this.OP_SBC, 1, this.MODE_INDY],
+                /* 0xf2 */ [],
+                /* 0xf3 */ [],
+                /* 0xf4 */ [],
+                /* 0xf5 */ [this.OP_SBC, 1, this.MODE_ZPX],
+                /* 0xf6 */ [this.OP_INC, 1, this.MODE_ZPX],
+                /* 0xf7 */ [],
+                /* 0xf8 */ [this.OP_SED],
+                /* 0xf9 */ [this.OP_SBC, 2, this.MODE_ABSY],
+                /* 0xfa */ [],
+                /* 0xfb */ [],
+                /* 0xfc */ [],
+                /* 0xfd */ [this.OP_SBC, 2, this.MODE_ABSX],
+                /* 0xfe */ [this.OP_INC, 2, this.MODE_ABSX],
+                /* 0xff */ []
+            ];
+
+        }   // endif DEBUGGER
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "reset")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        var dbg = this;
+        switch(sBinding) {
+        case "debugInput":
+            this.bindings[sBinding] = control;
+            this.eDebug = control;
+            this.eDebug.focus();
+            control.onkeypress = function(dbg, e) {
+                return function(event) {
+                    if (event.keyCode == 13) {
+                        sBinding = e.value;
+                        e.value = "";
+                        C1PDebugger.input(dbg, sBinding);
+                    }
+                };
+            }(this, control);
+            return true;
+        case "debugEnter":
+            this.bindings[sBinding] = control;
+            /*
+             * I've replaced the standard "onclick" code with a call to our onClickRepeat() helper in
+             * component.js, so that the "Enter" button can be held to repeat, just like the "Step" button.
+             */
+            Web.onClickRepeat(
+                control, 500, 100,
+                function(fRepeat) {
+                    if (dbg.eDebug) {
+                        sBinding = dbg.eDebug.value;
+                        //
+                        //  If we want to use the debugEnter button to repeatedly enter the same command,
+                        //  then don't clear the command string.
+                        //
+                        //      dbg.eDebug.value = "";
+                        //
+                        C1PDebugger.input(dbg, sBinding);
+                        return true;
+                    }
+                    if (DEBUG) dbg.log("no debugger input buffer");
+                    return false;
+                }
+            );
+            return true;
+        case "step":
+            this.bindings[sBinding] = control;
+            Web.onClickRepeat(
+                control, 500, 100,
+                function(fRepeat) {
+                    var fCompleted = false;
+                    if (!dbg.isBusy(true)) {
+                        dbg.setBusy(true);
+                        fCompleted = dbg.step(fRepeat? 1 : 0);
+                        dbg.setBusy(false);
+                    }
+                    return fCompleted;
+                }
+            );
+            return true;
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {Array} abMemory
+     * @param {number} start
+     * @param {number} end
+     */
+    setBuffer(abMemory, start, end)
+    {
+        this.abMem = abMemory;
+        this.offMem = start;
+        this.cbMem = end - start + 1;
+        this.offLimit = this.offMem + this.cbMem;
+        this.setReady();
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {boolean} fOn
+     * @param {C1PComputer} cmp
+     */
+    setPower(fOn, cmp)
+    {
+        if (fOn && !this.flags.powered) {
+            this.flags.powered = true;
+            this.cpu = cmp.getComponentByType("cpu");
+        }
+    }
+
+    /**
+     * @this {C1PDebugger}
+     */
+    setFocus()
+    {
+        this.eDebug.focus();
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {boolean} fClassic is true for "classic" operand syntax, or false for "modern" operand syntax
+     *
+     * The strings describing the operand(s) also describe the addressing mode, as follows:
+     *
+     *      bbb     mode    classic     modern         description
+     *      ---     ----    -------     -------         ----------------
+     *      000     INDX    ($nn,X)     [[nn+X]]        Indexed Indirect
+     *      001     ZP      $nn         [nn]            Zero-Page
+     *      010     IMM     #$nn        nn              Immediate
+     *      011     ABS     $nnnn       [nnnn]          Absolute
+     *      100     INDY    ($nn),Y     [[nn]+Y]        Indirect Indexed
+     *      101     ZPX     $nn,X       [nn+X]          Zero-Page,X
+     *      110     ABSY    $nnnn,Y     [nnnn+Y]        Absolute,Y
+     *      111     ABSX    $nnnn,X     [nnnn+X]        Absolute,X
+     *
+     * where bbb generally corresponds to bits 2-4 of the opcode.  I find that using brackets in the
+     * descriptors to indicate a memory access (or multiple brackets, in the case of indirect accesses),
+     * along with "+" and any index register, is more intuitive than the "classic" operand formats;
+     * the absence of any brackets implies immediate data, eliminating the need for a prepended "#".
+     * Also, the use of 2-digit instead of 4-digit addresses indicates that a zero-page address is
+     * being used.  Finally, all displacements/addresses and immediate values are displayed in hex by
+     * default, so there is no need to waste space prepending the traditional "$" to such values.
+     *
+     * Other addressing modes:
+     *
+     *      101     ZPY     $nn,Y           Zero-Page,Y (used by LDX and STX only)
+     *
+     *              ACC     A               Accumulator
+     *
+     *              IMM16   $nnnn           Used by JSR (0x20) and JMP (0x4C); I consider this an "Immediate" operation
+     *                                      that uses 16 bits, but it is documented as "Absolute" addressing (see Zaks)
+     *
+     *                                      FYI, this is the same operand format used for branch displacements (MODE_DISP),
+     *                                      except the displacements are 8-bit values that are signed-extended to 16 bits, so
+     *                                      discriminating between MODE_DISP and MODE_IMM16 also requires checking the operand size
+     *
+     *              ABS16   ($nnnn)         Used by JMP (0x6C); I consider this an "Absolute" operation that fetches
+     *                                      16 bits of data, but it is documented as "Indirect" addressing (see Zaks)
+     */
+    setOpModes(fClassic)
+    {
+        /*
+         * NOTE: The modes are arranged within aOpModes so that longer matches are checked before
+         * any subsets that could also match (eg, check for "$nn,X" before "$nn", "$nnnn,X" before "$nnnn", etc).
+         */
+        this.MODE_ACC   = 0;
+        this.MODE_IMM   = 1;
+        this.MODE_ABSX  = 2;
+        this.MODE_ABSY  = 3;
+        this.MODE_IMM16 = 4;
+        this.MODE_ABS16 = 5;
+        this.MODE_ZPX   = 6;
+        this.MODE_ZPY   = 7;
+        this.MODE_INDX  = 8;
+        this.MODE_INDY  = 9;
+        this.MODE_ABS   = 10;
+        this.MODE_ZP    = 11;
+        this.MODE_DISP  = this.MODE_IMM16;
+
+        var sRegEx = "";
+        var iMode, sMode;
+
+        if (fClassic) {
+            this.aOpModes = [
+                            "A",            // MODE_ACC
+                /* 010b */  "#$nn",         // MODE_IMM
+                /* 111b */  "$nnnn,X",      // MODE_ABSX
+                /* 110b */  "$nnnn,Y",      // MODE_ABSY
+                            "$nnnn",        // MODE_IMM16
+                            "($nnnn)",      // MODE_ABS16
+                /* 101b */  "$nn,X",        // MODE_ZPX
+                            "$nn,Y",        // MODE_ZPY
+                /* 000b */  "($nn,X)",      // MODE_INDX
+                /* 100b */  "($nn),Y",      // MODE_INDY
+                /* 011b */  "$nnnn",        // MODE_ABS
+                /* 001b */  "$nn"           // MODE_ZP
+            ];
+            for (iMode=0; iMode < this.aOpModes.length; iMode++) {
+                sMode = this.aOpModes[iMode];
+                sRegEx += "(" + sMode.replace(/\(/g, "\\(").replace(/\)/g, "\\)").replace(/nnnn/g, "[0-9A-F][0-9A-F][0-9A-F][0-9A-F]?").replace(/nn/g, "[0-9A-F][0-9A-F]?").replace(/\$/g, "\\$") + "|)";
+            }
+            this.regexOpModes = new RegExp(sRegEx);
+        }
+        else {
+            this.aOpModes = [
+                            "A",            // MODE_ACC
+                /* 010b */  "nn",           // MODE_IMM
+                /* 111b */  "[nnnn+X]",     // MODE_ABSX
+                /* 110b */  "[nnnn+Y]",     // MODE_ABSY
+                            "nnnn",         // MODE_IMM16
+                            "[nnnn]",       // MODE_ABS16
+                /* 101b */  "[nn+X]",       // MODE_ZPX
+                            "[nn+Y]",       // MODE_ZPY
+                /* 000b */  "[[nn+X]]",     // MODE_INDX
+                /* 100b */  "[[nn]+Y]",     // MODE_INDY
+                /* 011b */  "[nnnn]",       // MODE_ABS
+                /* 001b */  "[nn]"          // MODE_ZP
+            ];
+            for (iMode=0; iMode < this.aOpModes.length; iMode++) {
+                sMode = this.aOpModes[iMode];
+                sRegEx += "(" + sMode.replace(/\[/g, "\\[").replace(/]/g, "\\]").replace(/nnnn/g, "[0-9A-F][0-9A-F][0-9A-F][0-9A-F]?").replace(/nn/g, "[0-9A-F][0-9A-F]?").replace(/\+/g, "\\+") + "|)";
+            }
+            this.regexOpModes = new RegExp(sRegEx);
+        }
+        /*
+         * Regrettably, if "classic" operand syntax is in effect, then we will have to look at the context of the
+         * operand (ie, the operation code) whenever we have a MODE_IMM16 (or MODE_DISP) match, because it might actually
+         * be a MODE_ABS operand.  MODE_IMM16 is used with only 2 operations (OP_JSR and OP_JMP), and MODE_DISP only 8
+         * (OP_BPL, OP_BMI, OP_BVC, OP_BVS, OP_BCC, OP_BCS, OP_BNE, and OP_BEQ), so if the operation isn't one of those
+         * codes (in the following array), then we should convert MODE_IMM16 (aka MODE_DISP) into MODE_ABS.
+         */
+        this.aImm16Codes = [this.OP_JMP, this.OP_JSR, this.OP_BPL, this.OP_BMI, this.OP_BVC, this.OP_BVS, this.OP_BCC, this.OP_BCS, this.OP_BNE, this.OP_BEQ];
+    }
+
+    /**
+     * @this {C1PDebugger}
+     */
+    halt()
+    {
+        /*
+         * We ask the CPU to halt, but we can't assume it's stopped until it calls stop()
+         */
+        this.cpu.halt();
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {string} s is any diagnostic string that you can print later using the Debugger's "i" command
+     */
+    info(s)
+    {
+        if (DEBUG) {
+            this.aInfoBuffer[this.iInfoBuffer++] = s;
+            if (this.iInfoBuffer >= this.aInfoBuffer.length)
+                this.iInfoBuffer = 0;
+        }
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {Component} component
+     * @param {number} addr
+     * @param {number|undefined} addrFrom
+     * @param {boolean} bitsMessage is a Debugger MESSAGE_* category flag
+     * @param {boolean|undefined} [fWrite] is true if this was a write, false (or undefined) if read
+     * @param {string|undefined} [name] of the port, if any
+     */
+    messageIO(component, addr, addrFrom, bitsMessage, fWrite, name)
+    {
+        if ((this.bitsMessage & bitsMessage) == bitsMessage) {
+            var b = this.cpu.getByte(addr);
+            this.message(component.id + "." + (fWrite? "setByte":"getByte") + "(" + Str.toHexWord(addr) + ")" + (addrFrom !== undefined? (" @" + Str.toHexWord(addrFrom)) : "") + ": " + (name? (name + "=") : "") + Str.toHexByte(b));
+        }
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {string} sMessage is any caller-defined message string
+     */
+    message(sMessage)
+    {
+        this.println(sMessage);
+        this.cpu.yieldCPU();    // these print() calls are at risk of being called with high frequency, so we need to yieldCPU() more
+    }
+
+    /**
+     * @this {C1PDebugger}
+     */
+    init()
+    {
+        // this.doHelp();
+        this.println("Type ? for list of debugger commands\n");
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @return {boolean}
+     */
+    run()
+    {
+        if (!this.isCPUOK()) return false;
+        this.cpu.run();
+        return true;
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {number} n (0 implies a single-step, and therefore breakpoints should be ignored)
+     * @return {boolean}
+     */
+    step(n)
+    {
+        if (!this.isCPUOK()) return false;
+        var fCompleted;
+        try {
+            fCompleted = this.cpu.step(n);
+        }
+        catch(e) {
+            fCompleted = undefined;
+            this.cpu.setError(e.stack || e.message);
+        }
+        if (fCompleted !== undefined) this.cIns++;
+        /*
+         * Because we called cpu.step() and not cpu.run(), we must
+         * nudge the CPU's update code, and then update our own state.
+         */
+        this.cpu.update(true);
+        this.update(true);
+        return fCompleted;
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {boolean} [fStep]
+     */
+    update(fStep)
+    {
+        this.nextAddr = this.cpu.regPC;
+        if (fStep || this.fStepOver)
+            this.doUnassemble();
+        else
+            this.doRegisters();
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @return {boolean}
+     *
+     * Make sure the CPU is ready (finished initializing), not busy (already running), and not in an error state.
+     */
+    isCPUOK()
+    {
+        if (!this.cpu)
+            return false;
+        if (!this.cpu.isReady())
+            return false;
+        if (this.cpu.isBusy())
+            return false;
+        return !this.cpu.isError();
+    }
+
+    /**
+     * @this {C1PDebugger}
+     *
+     * This is a notification handler, called by the CPU, to inform us that the CPU has been reset.
+     */
+    reset()
+    {
+        var i;
+        if (!this.aStepHistory.length)
+            this.aStepHistory = new Array(1000);
+        for (i = 0; i < this.aStepHistory.length; i++)
+            this.aStepHistory[i] = -1;
+        if (!this.aaOpcodeFreqs.length)
+            this.aaOpcodeFreqs = new Array(256);
+        for (i = 0; i < this.aaOpcodeFreqs.length; i++)
+            this.aaOpcodeFreqs[i] = [i, 0];
+        if (this.cIns) this.update();
+        this.cIns = 0;
+        this.cReads = this.cWrites = this.cWritesZP = 0;
+    }
+
+    /**
+     * @this {C1PDebugger}
+     *
+     * This is a notification handler, called by the CPU, to inform us that the CPU has started running.
+     */
+    start()
+    {
+        if (!this.fStepOver) this.println("running");
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {number} msStart
+     * @param {number} nCycles
+     *
+     * This is a notification handler, called by the CPU, to inform us that the CPU has now stopped running.
+     */
+    stop(msStart, nCycles)
+    {
+        if (!this.fStepOver) {
+            this.println("stopped");
+            if (nCycles) {
+                var msTotal = Usr.getTime();
+                msTotal -= msStart;
+                this.println(msTotal + "ms (" + nCycles + " cycles)");
+                if (DEBUG && msTotal > 0) {
+                    nCycles = nCycles * 1000 / msTotal;
+                    this.println("total cycles/second: " + Math.round(nCycles));
+                    var percent = Math.round((this.cIns? this.cReads / this.cIns : 0) * 1000) / 10;
+                    this.println("total reads: " + this.cReads + " (" + percent + "%)");
+                    percent = Math.round((this.cIns? this.cWrites / this.cIns : 0) * 1000) / 10;
+                    this.println("total writes: " + this.cWrites + " (" + percent + "%)");
+                    percent = Math.round((this.cIns? this.cWritesZP / this.cIns : 0) * 1000) / 10;
+                    this.println("total zero-page writes: " + this.cWritesZP + " (" + percent + "%)");
+                    this.println("total instructions: " + this.cIns);
+                }
+            }
+        }
+        this.update();
+        this.setFocus();
+        if (!this.fStepOver) {
+            this.cIns = 0;
+            this.cReads = this.cWrites = this.cWritesZP = 0;
+        }
+        this.clearTempBreakpoint(this.cpu.regPC);
+    }
+
+    /**
+     * @this {C1PDebugger}
+     *
+     * This is a check function, called by the CPU, indicating whether other instructions need to be checked.
+     */
+    checksEnabled()
+    {
+        return (DEBUG? true : (this.aExecBreak.length > 0 || this.aReadBreak.length > 0 || this.aWriteBreak.length > 0));
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {number} addr
+     * @param {number} bOpCode
+     * @return {boolean} true to proceed, false to halt
+     *
+     * This is a check function, called by the CPU, to inform us about the next instruction to be executed, giving
+     * us an opportunity to look for "exec" breakpoints and update opcode frequencies and instruction history.
+     */
+    checkInstruction(addr, bOpCode)
+    {
+        var fBreak = false;
+        if (this.checkBreakpoint(addr, this.aExecBreak, "exec"))
+            fBreak = true;
+        else {
+            this.cIns++;
+            this.aaOpcodeFreqs[bOpCode][1]++;
+            this.aStepHistory[this.iStepHistory++] = this.cpu.regPC;
+            if (this.iStepHistory >= this.aStepHistory.length)
+                this.iStepHistory = 0;
+        }
+        return !fBreak;
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {number} addr
+     * @return {boolean} true to proceed, false to halt
+     *
+     * This is a check function, called by the CPU, to inform us that a memory read occurred, giving us an
+     * opportunity to track the read if we want, and look for a matching "read" breakpoint, if any.
+     */
+    checkMemoryRead(addr)
+    {
+        var fBreak = false;
+        this.cReads++;
+        if (this.checkBreakpoint(addr, this.aReadBreak, "read"))
+            fBreak = true;
+        return !fBreak;
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {number} addr
+     * @param {number} value written
+     * @return {boolean} true to proceed, false to halt
+     *
+     * This is a check function, called by the CPU, to inform us that a memory write occurred, giving us an
+     * opportunity to track the write if we want, and look for a matching "write" breakpoint, if any.
+     */
+    checkMemoryWrite(addr, value)
+    {
+        var fBreak = false;
+        this.cWrites++;
+        /*
+         * NOTE: We keep track of zero-page writes mainly as a reminder to look into whether it makes sense
+         * for the CPU to calculate zero-page EAs using a different variable (eg, regEAWriteZP instead of regEAWrite),
+         * because write-notification handlers never care about page zero accesses, and while write breakpoints *may*
+         * care, it may not be worth the cost of tracking writes to page zero if there's an associated perf penalty.
+         */
+        if (!(addr & 0xff00))
+            this.cWritesZP++;
+        if ((value & 0xff) != value) {
+            this.println("invalid value at " + Str.toHexWord(addr) + ": " + value);
+            fBreak = true;
+        }
+        if (this.checkBreakpoint(addr, this.aWriteBreak, "write"))
+            fBreak = true;
+        return !fBreak;
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {number} addr
+     * @param {number} b
+     * @return {number}
+     */
+    addSignedByte(addr, b)
+    {
+        return addr + ((b << 24) >> 24);
+    }
+
+    /**
+     * getByte() should be used for all memory reads performed by the Debugger (eg, doDump, doUnassemble),
+     * to insure that the CPU is properly notified (and by extension, any device that's registered a
+     * notification handler with the CPU).
+     *
+     * @this {C1PDebugger}
+     * @param {number} addr
+     * @return {number|undefined}
+     */
+    getByte(addr)
+    {
+        var b;
+        if (addr >= this.offMem && addr < this.offLimit) {
+            this.cpu.checkReadNotify(addr);
+            b = this.abMem[this.offMem + addr];
+
+            b &= 0xff;
+        }
+        return b;
+    }
+
+    /**
+     * setByte() should be used for all memory writes performed by the Debugger (eg, doAssemble, doEdit),
+     * to insure that the CPU is properly notified (and by extension, any device that's registered a
+     * notification handler with the CPU).
+     *
+     * NOTE: Even though we call all write-notification handlers, we don't include a "from" address,
+     * because the write originated from the Debugger, not from a CPU instruction.  As a result, handlers should
+     * not refuse the write unless they have good reason; in particular, the ROM handlers will not refuse our writes,
+     * allowing the Debugger to modify ROM contents as needed.
+     *
+     * @this {C1PDebugger}
+     * @param {number} addr
+     * @param {number} b
+     */
+    setByte(addr, b)
+    {
+        if (addr < this.offMem || addr >= this.offLimit) {
+            this.println("invalid address: " + Str.toHexWord(addr));
+            return;
+        }
+        this.abMem[this.offMem + addr] = (b & 0xff);
+        this.cpu.checkWriteNotify(addr);
+        this.cpu.update();
+    }
+
+    /**
+     * @this {C1PDebugger}
+     */
+    clearBreakpoints()
+    {
+        this.aExecBreak = [];
+        this.aReadBreak = [];
+        this.aWriteBreak = [];
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {number} addr
+     * @return {boolean}
+     */
+    addExecBreakpoint(addr)
+    {
+        if (!this.findExecBreakpoint(addr)) {
+            this.aExecBreak.push(addr);
+        }
+        return true;
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {number} addr
+     * @return {boolean}
+     */
+    addReadBreakpoint(addr)
+    {
+        if (!this.findReadBreakpoint(addr)) {
+            this.aReadBreak.push(addr);
+        }
+        return true;
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {number} addr
+     * @return {boolean}
+     */
+    addWriteBreakpoint(addr)
+    {
+        if (!this.findWriteBreakpoint(addr)) {
+            this.aWriteBreak.push(addr);
+        }
+        return true;
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @return {Array}
+     */
+    getExecBreakpoints()
+    {
+        return this.aExecBreak;
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @return {Array}
+     */
+    getReadBreakpoints()
+    {
+        return this.aReadBreak;
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @return {Array}
+     */
+    getWriteBreakpoints()
+    {
+        return this.aWriteBreak;
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {Array} aBreak
+     * @param {number} addr
+     * @param {boolean} [fRemove]
+     * @return {boolean}
+     */
+    findBreakpoint(aBreak, addr, fRemove)
+    {
+        var fMatch = false;
+        for (var i=0; i < aBreak.length; i++) {
+            if (aBreak[i] == addr) {
+                if (fRemove) {
+                    aBreak.splice(i, 1);
+                }
+                fMatch = true;
+                break;
+            }
+        }
+        return fMatch;
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {number} addr
+     * @param {boolean} [fRemove]
+     * @return {boolean}
+     */
+    findExecBreakpoint(addr, fRemove)
+    {
+        return this.findBreakpoint(this.aExecBreak, addr, fRemove);
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {number} addr
+     * @param {boolean} [fRemove]
+     * @return {boolean}
+     */
+    findReadBreakpoint(addr, fRemove)
+    {
+        return this.findBreakpoint(this.aReadBreak, addr, fRemove);
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {number} addr
+     * @param {boolean} [fRemove]
+     * @return {boolean}
+     */
+    findWriteBreakpoint(addr, fRemove)
+    {
+        return this.findBreakpoint(this.aWriteBreak, addr, fRemove);
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {number|undefined} addr of new temp breakpoint
+     */
+    setTempBreakpoint(addr)
+    {
+        if (addr !== undefined) {
+            /*
+             * I don't want temporary breakpoints growing out of control, so I forcibly clear any
+             * existing temp breakpoint by feeding clearTempBreakpoint() the current temp address, if any;
+             * but you can remove the next line if you decide multiple temp breakpoints are a good thing.
+             */
+            this.clearTempBreakpoint(this.addrTempBP);
+            if (this.addExecBreakpoint(addr))
+                this.addrTempBP = addr;
+        }
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {number} addr to compare to addrTempBP; the latter is cleared if there's a match
+     */
+    clearTempBreakpoint(addr)
+    {
+        if (this.addrTempBP !== undefined && addr == this.addrTempBP) {
+            if (this.findExecBreakpoint(this.addrTempBP, true)) {
+                this.addrTempBP = undefined;
+            }
+        }
+        this.fStepOver = false;
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {number} addr
+     * @param {Array} aBreakpoints
+     * @param {string} sType (ie, "exec" or "write")
+     * @return {boolean} true if breakpoint has been hit, false if not
+     */
+    checkBreakpoint(addr, aBreakpoints, sType)
+    {
+        /*
+         * Time to check for execution breakpoints; note that this should be done BEFORE updating any of the frequency
+         * or history data (see checkInstruction), since we might not actually execute the current instruction.
+         */
+        var fBreak = false;
+        for (var i=0; i < aBreakpoints.length; i++) {
+            if (aBreakpoints[i] == addr) {
+                if (addr != this.addrTempBP)
+                    this.println("breakpoint hit: " + Str.toHexWord(addr) + " (" + sType + ")");
+                fBreak = true;
+                break;
+            }
+        }
+        return fBreak;
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {number} addr
+     * @param {number} [nIns] is an associated instruction number, or 0 (or undefined) if none
+     * @return {string}
+     */
+    getInstruction(addr, nIns)
+    {
+        var sLine = Str.toHex(addr, 4);
+        var bOpCode = this.getByte(addr++);
+        var b = (bOpCode === undefined? 0 : bOpCode);
+        var aOpDesc = this.aaOperations[b];
+        var abOperand = [];
+        var cb = (aOpDesc[1] === undefined? 0 : aOpDesc[1]);
+        do {
+            sLine += " " + Str.toHex(b, 2);
+            if (!(cb--)) break;
+            b = this.getByte(addr++);
+            if (b === undefined) break;
+            abOperand.push(b);
+        } while (true);
+        if (aOpDesc[0] === undefined) {
+            aOpDesc = [this.OP_DB, 1, this.MODE_IMM];
+            abOperand.push(bOpCode);
+        }
+        sLine = (sLine + "        ").substr(0, 15);
+        sLine += this.aOpCodes[aOpDesc[0]];
+        var sOperand = null;
+        if (aOpDesc[2] !== undefined) {
+            var bOpMode = aOpDesc[2];
+            sOperand = this.aOpModes[bOpMode];
+            if (aOpDesc[1] == 1 && bOpMode == this.MODE_DISP) {
+                sOperand = sOperand.replace(/nnnn/, Str.toHex(this.addSignedByte(addr, b = abOperand.pop()), 4));
+            }
+            else {
+                while (abOperand.length) {
+                    sOperand = sOperand.replace(/nn/, Str.toHex(b = abOperand.pop(), 2));
+                }
+            }
+            if (bOpMode == this.MODE_IMM && aOpDesc[1] == 1) {
+                if (b >= 0x20 && b < 0x80)
+                    sOperand += " ;'" + String.fromCharCode(b) + "'";
+            }
+        }
+        if (bOpCode == this.cpu.OP_SIM) {
+            if (b < this.aOpSimCodes.length)
+                sOperand = this.aOpSimCodes[b];
+            if (b == this.cpu.SIMOP_MSG) {
+                cb = 0;
+                sOperand = "\"";
+                while ((b = this.getByte(addr++))) {
+                    if (cb < 16)
+                        sOperand += String.fromCharCode(b);
+                    else if (cb == 16)
+                        sOperand += "…";
+                    cb++;
+                }
+                sOperand += "\"";
+            }
+        }
+        if (sOperand) sLine += " " + sOperand;
+        if (nIns) {
+            sLine += "               ";
+            sLine = sLine.substr(0, 30);
+            sLine += ";" + nIns.toString();
+        }
+        this.nextIns = addr;
+        return sLine;
+    }
+
+    /**
+     * parseInstruction(sCode, sOperand, addr)
+     *
+     * This generally requires an exact match of both the operation code (sCode) and mode operand (sOperand)
+     * against the aOpCodes[] and aOpModes[] arrays, respectively; however, the regular expression built from
+     * aOpModes and stored in regexOpModes does relax the matching criteria slightly; ie, a 4-digit hex value
+     * ("nnnn") will be satisfied with either 3 or 4 digits, and similarly, a 2-digit hex address (nn) will
+     * be satisified with either 1 or 2 digits.
+     *
+     * Note that this function does not actually store the instruction into memory, even though it requires
+     * a target address (addr); that parameter is currently needed ONLY for "branch" instructions, because in
+     * order to calculate the branch displacement, it needs to know where the instruction will ultimately be
+     * stored, relative to its target address.
+     *
+     * Another handy feature of this function is its ability to display all available modes for a particular
+     * operation. For example, while in "assemble mode", if one types:
+     *
+     *      ldy?
+     *
+     * the Debugger will display:
+     *
+     *      supported opcodes:
+     *           A0: LDY nn
+     *           A4: LDY [nn]
+     *           AC: LDY [nnnn]
+     *           B4: LDY [nn+X]
+     *           BC: LDY [nnnn+X]
+     *
+     * Use of a trailing "?" on any opcode will display all variations of that opcode; no instruction will be
+     * assembled, and the operand parameter, if any, will be ignored.
+     *
+     * Although this function is capable of reporting numerous errors, roughly half of them indicate internal
+     * consistency errors, not user errors; the former should really be asserts, but I'm not comfortable bombing
+     * out because of my error as opposed to their error.  The only errors a user should expect to see:
+     *
+     *      "unknown operation":    sCode is not a valid operation (per aOpCodes)
+     *      "unknown operand":      sOperand is not a valid operand (per aOpModes)
+     *      "unknown instruction":  the combination of sCode + sOperand does not exist (per aaOperations)
+     *      "branch out of range":  the branch address, relative to addr, is too far away
+     *
+     * @this {C1PDebugger}
+     * @param {string} sCode
+     * @param {string|undefined} sOperand
+     * @param {number} addr of memory where this instruction is being assembled
+     * @return {Array.<number>} of opcode bytes; if the instruction can't be parsed, the array will be empty
+     */
+    parseInstruction(sCode, sOperand, addr)
+    {
+        var aOpBytes = [];
+        if (sCode !== undefined) {
+            var iCode, iMode;
+            /*
+             * Find the iCode that corresponds to the given operation code
+             */
+            sCode = sCode.toUpperCase();
+            if (sCode.charAt(sCode.length-1) == "?") {
+                sOperand = "?";
+                sCode = sCode.substr(0, sCode.length-1);
+            }
+            for (iCode=0; iCode < this.aOpCodes.length; iCode++) {
+                if (sCode == this.aOpCodes[iCode]) {
+                    break;
+                }
+            }
+            if (iCode == this.aOpCodes.length) {
+                this.println("unknown operation: " + sCode);
+                iCode = -1;
+            }
+            var sMode = "", aModeMatch, i;
+            if (iCode >= 0 && sOperand !== undefined) {
+                sMode = sOperand.toUpperCase();
+                if (sMode == "?") {
+                    var cModes = 0;
+                    for (i = 0; i < this.aaOperations.length; i++) {
+                        if (this.aaOperations[i][0] === iCode) {
+                            if (!cModes) this.println("supported opcodes:");
+                            this.println("     " + Str.toHex(i, 2) + ": " + sCode + (this.aaOperations[i][2] !== undefined? (" " + this.aOpModes[this.aaOperations[i][2]]) : ""));
+                            cModes++;
+                        }
+                    }
+                    iCode = -1;
+                }
+                else {
+                    /*
+                     * Find the iMode that corresponds to the given operand
+                     */
+                    aModeMatch = sMode.match(this.regexOpModes);
+                    if (aModeMatch !== null && aModeMatch[0] == sMode) {
+                        /*
+                         * One of the sub-patterns must have matched as well; the index of the matching
+                         * sub-pattern will correspond to the proper aOpModes index, albeit off-by-one since
+                         * the regex match at [0] is the complete match, not a sub-pattern match.
+                         */
+                        for (i = 1; i < aModeMatch.length; i++) {
+                            if (aModeMatch[i] == sMode) {
+                                if (iMode === undefined)
+                                    iMode = i-1;
+                                else {
+                                    /*
+                                     * This is really an internal consistency error; regardless what the user types, this should not occur.
+                                     */
+                                    //noinspection JSUnusedAssignment
+                                    this.println("too many operand matches (both " + this.aOpModes[iMode] + " and " + this.aOpModes[i-1] + ")");
+                                    iCode = -1;
+                                    break;
+                                }
+                            }
+                        }
+                        /*
+                         * Regrettably, if "classic" operand syntax is in effect, then we must look at the context of the
+                         * operand (ie, the operation code) whenever we have a MODE_IMM16 (or MODE_DISP) match, because it might
+                         * actually be a MODE_ABS operand; see setOpModes() for details of the aImm16Codes array.
+                         */
+                        if (iMode == this.MODE_IMM16) {
+                            if (this.aImm16Codes.indexOf(iCode) < 0)
+                                iMode = this.MODE_ABS;
+                        }
+                        /*
+                         * Even in "modern" syntax mode, we have to look at the context of a MODE_ABS16 match, because unless
+                         * the operation is OP_JMP, then the mode must actually be MODE_ABS.
+                         */
+                        if (iMode == this.MODE_ABS16) {
+                            if (iCode != this.OP_JMP)
+                                iMode = this.MODE_ABS;
+                        }
+                    }
+                    else {
+                        this.println("unknown operand: " + sMode);
+                        iCode = -1;
+                    }
+                }
+            }
+            if (iCode >= 0) {
+                /*
+                 * So we have an iCode and possibly an iMode; find the one (and hopefully only) aaOperations instruction entry that matches
+                 */
+                var bOpCode = -1;
+                for (i = 0; i < this.aaOperations.length; i++) {
+                    if (this.aaOperations[i][0] === iCode && this.aaOperations[i][2] === iMode) {
+                        if (bOpCode < 0)
+                            bOpCode = i;
+                        else {
+                            /*
+                             * This is really an internal consistency error; regardless what the user types, this should not occur.
+                             */
+                            this.println("too many instruction matches (both " + Str.toHexByte(bOpCode) + " and " + Str.toHexByte(i) + ")");
+                            bOpCode = -2;
+                            break;
+                        }
+                    }
+                }
+                if (bOpCode >= 0) {
+                    aOpBytes.push(bOpCode);
+                    if (iMode !== undefined) {
+                        var cb = this.aaOperations[bOpCode][1];
+                        var asHex = sMode.match(/[0-9A-F]+/);
+                        if (asHex !== null) {
+                            var nHex = parseInt(asHex[0], 16);
+                            if (cb == 1 && iMode == this.MODE_DISP) {
+                                nHex -= (addr + 2);
+                                if (nHex < -128 || nHex > 127) {
+                                    this.println("branch out of range (" + nHex + ")");
+                                    aOpBytes = [];
+                                    cb = 0;
+                                }
+                            }
+                            for (i = 0; i < cb; i++) {
+                                aOpBytes.push(nHex & 0xff);
+                                nHex >>>= 8;
+                            }
+                        }
+                        else if (cb) {
+                            /*
+                             * This is really an internal consistency error; regardless what the user types, this should not occur.
+                             */
+                            this.println("instruction missing " + cb + " bytes");
+                        }
+                    }
+                }
+                else {
+                    this.println("unknown instruction: " + sCode + " " + sMode + (DEBUG? (" (" + iMode + ")") : ""));
+                }
+            }
+        }
+        return aOpBytes;
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @return {string}
+     */
+    getRegs()
+    {
+        return "A=" + Str.toHex(this.cpu.regA, 2) +
+              " X=" + Str.toHex(this.cpu.regX, 2) +
+              " Y=" + Str.toHex(this.cpu.regY, 2) +
+              " P=" + Str.toHex(this.cpu.getRegP(), 2) +
+              " S=" + Str.toHex(this.cpu.regS, 4) +
+              " PC=" + Str.toHex(this.cpu.regPC, 4);
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {string|undefined} [sAddr]
+     * @return {number|undefined}
+     */
+    getUserAddr(sAddr)
+    {
+        var addr = this.nextAddr;
+        if (sAddr !== undefined) {
+            var nBase = 16;
+            if (sAddr.charAt(0) == "$")
+                sAddr = sAddr.substr(1);
+            else
+            if (sAddr.substr(0, 2) == "0x")
+                sAddr = sAddr.substr(2);
+            else
+            if (sAddr.charAt(sAddr.length-1) == ".") {
+                nBase = 10;
+                sAddr = sAddr.substr(0, sAddr.length-1);
+            }
+            addr = parseInt(sAddr, nBase);
+            if (isNaN(addr)) {
+                this.println("invalid base-" + nBase + " address: " + sAddr);
+                addr = undefined;
+            }
+        }
+        if (addr !== undefined && (addr < this.offMem || addr >= this.offLimit)) {
+            this.println("address out of range: " + Str.toHex(addr));
+            addr = undefined;
+        }
+        return addr;
+    }
+
+    /**
+     * @this {C1PDebugger}
+     */
+    doHelp()
+    {
+        this.println("\ncommands:\n?\thelp\na [#]\tassemble\nb [#]\tbreakpoint\nd [#]\tdump memory\ne [#]\tedit memory\nf\tdump frequencies\ng [#]\trun to [#]\nh\thalt\no\toptions\np [#]\tdump history\nr\tdump/edit registers\ns\tstep over instruction\nt [#]\tstep instruction(s)\nu [#]\tunassemble");
+        this.println("note: frequency and history commands operate only when breakpoints are set");
+    }
+
+    /**
+     * doAssemble() always receives the complete argument array, where the order of the arguments is:
+     *
+     *      [0]: the assemble command (assumed to be "a")
+     *      [1]: the target address (eg, "200")
+     *      [2]: the operation code, aka mnemonic (eg, "adc")
+     *      [3]: the operation mode operand, if any (eg, "14", "[1234]", etc)
+     *
+     * The Debugger enters "assemble mode" whenever only the first (or first and second) arguments are present.
+     * As long as "assemble mode is active, the user can omit the first two arguments on all later assemble commands
+     * until "assemble mode" is cancelled with an empty command line; the command processor automatically prepends "a"
+     * and the next available target address to the argument array.
+     *
+     * Entering "assemble mode" is optional; one could enter a series of fully-qualified assemble commands; eg:
+     *
+     *      a ff00 cld
+     *      a ff01 ldx 28
+     *      ...
+     *
+     * without ever entering "assemble mode", but of course, that requires more typing and doesn't take advantage
+     * of automatic target address advancement (see addrAssembleNext).
+     *
+     * NOTE: As the previous example implies, you can even assemble new instructions into ROM address space;
+     * as our setByte() function explains, the ROM write-notification handlers only refuse writes from the CPU.
+     *
+     * @this {C1PDebugger}
+     * @param {Array.<string>} asArgs is the complete argument array, beginning with the "a" command in asArgs[0]
+     */
+    doAssemble(asArgs)
+    {
+        var addr = this.getUserAddr(asArgs[1]);
+        if (addr === undefined)
+            return;
+        this.addrAssembleNext = addr;
+        if (asArgs[2] === undefined) {
+            this.println("begin assemble @" + Str.toHexWord(this.addrAssembleNext));
+            this.fAssemble = true;
+            this.cpu.update();
+            return;
+        }
+        var aOpBytes = this.parseInstruction(asArgs[2], asArgs[3], this.addrAssembleNext);
+        if (aOpBytes.length) {
+            for (var i=0; i < aOpBytes.length; i++) {
+                // this.println(Str.toHexWord(this.addrAssembleNext) + ": " + Str.toHexByte(aOpBytes[i]));
+                this.setByte(this.addrAssembleNext+i, aOpBytes[i]);
+            }
+            this.println(this.getInstruction(this.addrAssembleNext));
+            this.addrAssembleNext += aOpBytes.length;
+        }
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {string} [sParm]
+     * @param {string} [sAddr]
+     */
+    doBreak(sParm, sAddr)
+    {
+        if (sParm === undefined || sParm == "?") {
+            this.println("\nbreakpoint commands:");
+            this.println("bp [a]\tset exec breakpoint at [a]");
+            this.println("br [a]\tset read breakpoint at [a]");
+            this.println("bw [a]\tset write breakpoint at [a]");
+            this.println("bc [a]\tclear breakpoint at [a]");
+            this.println("bl\tlist all breakpoints");
+            return;
+        }
+        if (sAddr === undefined && sParm.length > 1) {
+            sAddr = sParm.substr(1);
+            sParm = sParm.substr(0, 1);
+        }
+        if (sParm == "l") {
+            var cBreaks = 0, i;
+            var aAddrs = this.getExecBreakpoints();
+            for (i = 0; i < aAddrs.length; i++) {
+                this.println("breakpoint enabled: " + Str.toHexWord(aAddrs[i]) + " (exec)");
+                cBreaks++;
+            }
+            aAddrs = this.getReadBreakpoints();
+            for (i = 0; i < aAddrs.length; i++) {
+                this.println("breakpoint enabled: " + Str.toHexWord(aAddrs[i]) + " (read)");
+                cBreaks++;
+            }
+            aAddrs = this.getWriteBreakpoints();
+            for (i = 0; i < aAddrs.length; i++) {
+                this.println("breakpoint enabled: " + Str.toHexWord(aAddrs[i]) + " (write)");
+                cBreaks++;
+            }
+            if (!cBreaks)
+                this.println("no breakpoints");
+            return;
+        }
+        if (sAddr === undefined) {
+            this.println("missing breakpoint address");
+            return;
+        }
+        if (sParm == "c" && sAddr == "*") {
+            this.clearBreakpoints();
+            this.println("all breakpoints cleared");
+            return;
+        }
+        var addr = this.getUserAddr(sAddr);
+        if (addr === undefined)
+            return;
+        if (sParm == "p") {
+            if (this.addExecBreakpoint(addr))
+                this.println("breakpoint enabled: " + Str.toHexWord(addr) + " (exec)");
+            else
+                this.println("breakpoint not set: " + Str.toHexWord(addr));
+            return;
+        }
+        if (sParm == "c") {
+            if (this.findExecBreakpoint(addr, true))
+                this.println("breakpoint cleared: " + Str.toHexWord(addr) + " (exec)");
+            else
+            if (this.findReadBreakpoint(addr, true))
+                this.println("breakpoint cleared: " + Str.toHexWord(addr) + " (read)");
+            else
+            if (this.findWriteBreakpoint(addr, true))
+                this.println("breakpoint cleared: " + Str.toHexWord(addr) + " (write)");
+            else
+                this.println("breakpoint missing: " + Str.toHexWord(addr));
+            return;
+        }
+        if (sParm == "r") {
+            if (this.addReadBreakpoint(addr))
+                this.println("breakpoint enabled: " + Str.toHexWord(addr) + " (read)");
+            else
+                this.println("breakpoint not set: " + Str.toHexWord(addr));
+            return;
+        }
+        if (sParm == "w") {
+            if (this.addWriteBreakpoint(addr))
+                this.println("breakpoint enabled: " + Str.toHexWord(addr) + " (write)");
+            else
+                this.println("breakpoint not set: " + Str.toHexWord(addr));
+            return;
+        }
+        this.println("unknown breakpoint command: " + sParm);
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {string} sAddr
+     * @param {string} sLen
+     */
+    doDump(sAddr, sLen)
+    {
+        if (sAddr == "?") {
+            this.println("\ndump commands:");
+            this.println("d [a] [#]    dump # lines of memory");
+            return;
+        }
+        var addr = this.getUserAddr(sAddr);
+        if (addr === undefined)
+            return;
+        var cLines = 0;
+        if (sLen !== undefined) {
+            if (sLen.charAt(0) == "l")
+                sLen = sLen.substr(1);
+            cLines = parseInt(sLen, 10);
+        }
+        if (!cLines) cLines = 1;
+        for (var line=0; line < cLines; line++) {
+            var sBytes = "";
+            var sChars = "";
+            var addrLine = addr;
+            for (var i=0; i < 8 && addr < this.offLimit; i++) {
+                var b = this.getByte(addr);
+                if (b === undefined) b = 0;
+                sBytes += Str.toHex(b, 2) + " ";
+                sChars += (b >= 32 && b < 128? String.fromCharCode(b) : ".");
+                addr++;
+            }
+            this.println(Str.toHex(addrLine, 4) + " " + sBytes + sChars);
+        }
+        this.nextAddr = addr;
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {Array.<string>} asArgs
+     */
+    doEdit(asArgs)
+    {
+        var sAddr = asArgs[1];
+        if (sAddr === undefined) {
+            this.println("missing address");
+            return;
+        }
+        var addr = this.getUserAddr(sAddr);
+        if (addr === undefined)
+            return;
+        for (var i=2; i < asArgs.length; i++) {
+            var b = parseInt(asArgs[i], 16);
+            this.setByte(addr++, b);
+        }
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {string} sParm
+     */
+    doFreqs(sParm)
+    {
+        if (sParm == "?") {
+            this.println("\nfrequency commands:");
+            this.println("clear\tclear all frequency counts");
+            return;
+        }
+        var cData = 0, i;
+        if (this.aaOpcodeFreqs) {
+            if (sParm == "clear") {
+                for (i = 0; i < this.aaOpcodeFreqs.length; i++)
+                    this.aaOpcodeFreqs[i] = [i, 0];
+                this.println("frequency data cleared");
+                cData++;
+            }
+            else if (sParm !== undefined) {
+                this.println("unknown frequency command: " + sParm);
+                cData++;
+            }
+            else {
+                var aaSortedOpcodeFreqs = this.aaOpcodeFreqs.slice();
+                aaSortedOpcodeFreqs.sort(function(p, q) {return q[1] - p[1];});
+                for (i = 0; i < aaSortedOpcodeFreqs.length; i++) {
+                    var bOpcode = aaSortedOpcodeFreqs[i][0];
+                    var cFreq = aaSortedOpcodeFreqs[i][1];
+                    if (cFreq) {
+                        this.println(this.aOpCodes[this.aaOperations[bOpcode][0]] + " (" + Str.toHexByte(bOpcode) + "): " + cFreq + " times");
+                        cData++;
+                    }
+                }
+            }
+        }
+        if (!cData) {
+            this.println("no frequency data available");
+        }
+    }
+
+    /**
+     * @this {C1PDebugger}
+     */
+    doHalt()
+    {
+        this.halt();
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {string} sCount
+     */
+    doHistory(sCount)
+    {
+        var cLines = 10;
+        var iHistory = this.iStepHistory;
+        var aHistory = this.aStepHistory;
+        if (aHistory !== undefined) {
+            var n = (sCount === undefined? this.nextHistory : parseInt(sCount, 10));
+            if (n === undefined)
+                n = 10;
+            if (n > aHistory.length) {
+                this.println("note: only " + aHistory.length + " available");
+                n = aHistory.length;
+            }
+            if (sCount !== undefined) {
+                this.nInsHistory = 0;
+                this.println(n + " instructions earlier:");
+            }
+            var nIns = (this.nInsHistory? this.nInsHistory : 1);
+            iHistory -= n;
+            if (iHistory < 0) iHistory = aHistory.length - 1;
+            while (cLines && iHistory != this.iStepHistory) {
+                var addr = aHistory[iHistory];
+                if (addr < 0) break;
+                this.println(this.getInstruction(addr, nIns++));
+                if (++iHistory == aHistory.length) iHistory = 0;
+                cLines--;
+                n--;
+            }
+            this.nextHistory = n;
+            this.nInsHistory = nIns;
+        }
+        if (cLines == 10) this.println("no history available");
+    }
+
+    /**
+     * Prints the contents of the Debugger's "info" buffer (filled by calls like cpu.dbg.info())
+     * @this {C1PDebugger}
+     * @param {string|undefined} sCount
+     * @return {boolean|undefined} true only if the "info" command is supported
+     */
+    doInfo(sCount)
+    {
+        if (DEBUG) {
+            var cLines = (sCount === undefined? -1 : parseInt(sCount, 10));
+            var i = this.iInfoBuffer;
+            do {
+                var s = this.aInfoBuffer[i++];
+                if (s !== undefined) {
+                    this.println(s);
+                    cLines--;
+                }
+                if (i >= this.aInfoBuffer.length)
+                    i = 0;
+            } while (cLines && i != this.iInfoBuffer);
+            this.println("nYieldsPerSecond: " + this.cpu.nYieldsPerSecond);
+            this.println("msPerYield: " + this.cpu.msPerYield);
+            this.println("nCyclesPerBurst: " + this.cpu.nCyclesPerBurst);
+            this.println("nCyclesPerYield: " + this.cpu.nCyclesPerYield);
+            this.println("nCyclesPerVideoUpdate: " + this.cpu.nCyclesPerVideoUpdate);
+            this.println("nCyclesPerStatusUpdate: " + this.cpu.nCyclesPerStatusUpdate);
+            return true;
+        }
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {string} [sAddr]
+     * @param {string} [sAddrEnd]
+     * @param {number} [n]
+     */
+    doUnassemble(sAddr, sAddrEnd, n)
+    {
+        var addr = this.getUserAddr(sAddr);
+        if (addr === undefined)
+            return;
+
+        if (n === undefined) n = 1;
+        var addrEnd = this.offLimit;
+        if (sAddrEnd !== undefined) {
+            addrEnd = this.getUserAddr(sAddrEnd);
+            if (addrEnd === undefined || addrEnd < addr)
+                return;
+            if (!DEBUG && (addrEnd - addr) > 0x100) {
+                /*
+                 * Limiting the amount of disassembled code to 1 page in non-DEBUG builds is partly to
+                 * prevent the user from wedging their browser, but also a recognition that, in non-DEBUG builds,
+                 * Component.println() also keeps its output buffer truncated to 8K, which is only enough for
+                 * about 2 pages of disassembled code anyway.
+                 */
+                this.println("range too large");
+                return;
+            }
+            addrEnd++;
+            n = -1;
+        }
+
+        if (addr != this.nextAddr)
+            this.println();
+
+        while (n-- && addr < addrEnd) {
+            var sIns = this.getInstruction(addr, this.isBusy(false) || this.fStepOver? this.cIns : 0);
+            this.println(sIns);
+            this.nextAddr = addr = this.nextIns;
+        }
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {Array.<string>} asArgs
+     */
+    doOptions(asArgs)
+    {
+        if (asArgs[1] === undefined || asArgs[1] == "?") {
+            this.println("\noption commands:");
+            this.println("max\trun at maximum speed");
+            this.println("fast\trun faster (up to " + this.cpu.mhzFast + "Mhz)");
+            this.println("slow\trun at normal speed (1Mhz)");
+            this.println("classic\tuse classic operand syntax");
+            this.println("modern\tuse modern operand syntax");
+            this.println("msg\tenable message categories");
+            return;
+        }
+        var sOption = asArgs[1];
+        switch(sOption) {
+        case "slow":
+            this.cpu.setSpeed(this.cpu.SPEED_SLOW);
+            break;
+        case "fast":
+            this.cpu.setSpeed(this.cpu.SPEED_FAST);
+            break;
+        case "max":
+            this.cpu.setSpeed(this.cpu.SPEED_MAX);
+            break;
+        case "classic":
+            this.setOpModes(true);
+            this.println("classic syntax enabled");
+            break;
+        case "modern":
+            this.setOpModes(false);
+            this.println("modern syntax enabled");
+            break;
+        case "msg":
+            var bitsMessage = 0;
+            if (asArgs[2] !== undefined) {
+                if (asArgs[2] == "all")
+                    bitsMessage = 0xff;
+                else if (this.aMessageCategories[asArgs[2]] !== undefined)
+                    bitsMessage = this.aMessageCategories[asArgs[2]];
+                if (bitsMessage) {
+                    if (asArgs[3] == "on") {
+                        this.bitsMessage |= bitsMessage;
+                    }
+                    else if (asArgs[3] == "off") {
+                        this.bitsMessage &= ~bitsMessage;
+                    }
+                }
+            }
+            for (var sCategory in this.aMessageCategories) {
+                if (asArgs[2] !== undefined && (asArgs[2] != "all" && asArgs[2] != sCategory)) continue;
+                bitsMessage = this.aMessageCategories[sCategory];
+                this.println(sCategory + " messages: " + ((this.bitsMessage & bitsMessage)? "on" : "off"));
+            }
+            break;
+        default:
+            this.println("unknown option: " + sOption);
+            break;
+        }
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {Array.<string>} [asArgs]
+     */
+    doRegisters(asArgs)
+    {
+        if (asArgs && asArgs[1] == "?") {
+            this.println("\nregister commands:");
+            this.println("r to display all");
+            this.println("r [target=value] to modify");
+            this.println("supported targets:");
+            this.println("A,X,Y,S,PC and flags C,Z,D,V,N");
+            return;
+        }
+        var fIns = true;
+        if (asArgs !== undefined && asArgs.length > 1) {
+            fIns = false;
+            var sReg = asArgs[1];
+            var sValue = null;
+            var i = sReg.indexOf("=");
+            if (i > 0) {
+                sValue = sReg.substr(i+1);
+                sReg = sReg.substr(0, i);
+            }
+            else if (asArgs.length > 2) {
+                sValue = asArgs[2];
+            }
+            else {
+                this.println("missing value for " + asArgs[1]);
+                return;
+            }
+            var b = parseInt(sValue, 16);
+            if (!isNaN(b)) {
+                switch(sReg.toUpperCase()) {
+                case "A":
+                    this.cpu.regA = b & 0xff;
+                    break;
+                case "X":
+                    this.cpu.regX = b & 0xff;
+                    break;
+                case "Y":
+                    this.cpu.regY = b & 0xff;
+                    break;
+                case "C":
+                    if (b) this.cpu.setC(); else this.cpu.clearC();
+                    break;
+                case "Z":
+                    if (b) this.cpu.setZ(); else this.cpu.clearZ();
+                    break;
+                case "D":
+                    if (b) this.cpu.setBCD(); else this.cpu.clearBCD();
+                    break;
+                case "V":
+                    if (b) this.cpu.setV(); else this.cpu.clearV();
+                    break;
+                case "N":
+                    if (b) this.cpu.setN(); else this.cpu.clearN();
+                    break;
+                case "S":
+                    if ((b & ~0xff) != 0x100) {
+                        this.println("invalid stack pointer: " + sValue);
+                        return;
+                    }
+                    this.cpu.regS = b;
+                    break;
+                case "PC":
+                    fIns = true;
+                    this.cpu.regPC = b & 0xffff;
+                    this.nextAddr = this.cpu.regPC;
+                    break;
+                default:
+                    this.println("unknown register: " + sReg);
+                    return;
+                }
+            }
+            else {
+                this.println("invalid value: " + sValue);
+                return;
+            }
+            this.cpu.update();
+        }
+        this.println(this.getRegs());
+        if (fIns) this.doUnassemble(Str.toHex(this.nextAddr = this.cpu.regPC, 4));
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {string} sAddr
+     */
+    doRun(sAddr)
+    {
+        if (sAddr !== undefined)
+            this.setTempBreakpoint(this.getUserAddr(sAddr));
+        if (!this.run()) {
+            this.cpu.setFocus();
+        }
+    }
+
+    /**
+     * @this {C1PDebugger}
+     */
+    doStep()
+    {
+        if (this.getByte(this.cpu.regPC) == this.cpu.OP_JSR) {
+            this.setTempBreakpoint(this.cpu.regPC+3);
+            this.fStepOver = true;
+            if (!this.run())
+                this.cpu.setFocus();
+        }
+        else {
+            this.doTrace();
+        }
+    }
+
+    /**
+     * @this {C1PDebugger}
+     * @param {string} [sCount]
+     */
+    doTrace(sCount)
+    {
+        var c = (sCount === undefined? 1 : parseInt(sCount, 10));
+        var n = (c == 1? 0 : 1);
+        Web.onCountRepeat(
+            c,
+            function(dbg) {
+                return function() {
+                    return dbg.setBusy(true) && dbg.step(n);
+                };
+            }(this),
+            function(dbg) {
+                return function() {
+                    dbg.setBusy(false);
+                };
+            }(this)
+        );
+    }
+
+    static input(dbg, sCmd)
+    {
+        if (!sCmd.length) {
+            if (dbg.fAssemble) {
+                dbg.println("ended assemble @" + Str.toHex(dbg.addrAssembleNext, 4));
+                dbg.nextAddr = dbg.addrAssembleNext;
+                dbg.fAssemble = false;
+            }
+            else
+            if (dbg.prevCmd)
+                sCmd = dbg.prevCmd;
+        }
+        if (dbg.isReady() && !dbg.isBusy(true) && sCmd.length > 0) {
+
+            if (dbg.fAssemble) {
+                sCmd = "a " + Str.toHex(dbg.addrAssembleNext, 4) + " " + sCmd;
+            }
+            else if (sCmd.length > 1 && sCmd.indexOf(" ") != 1) {
+                /*
+                 * For certain commands lacking a space after the first character,
+                 * insert an automatic space, so that split(" ") has the desired effect.
+                 */
+                var ch = sCmd.charAt(0).toLowerCase();
+                sCmd = ch + " " + sCmd.substr(1);
+            }
+
+            var asArgs = sCmd.split(" ");
+            dbg.prevCmd = asArgs[0];
+
+            switch(asArgs[0].toLowerCase()) {
+            case "a":
+                dbg.doAssemble(asArgs);
+                break;
+            case "b":
+                dbg.doBreak(asArgs[1], asArgs[2]);
+                break;
+            case "d":
+                dbg.doDump(asArgs[1], asArgs[2]);
+                break;
+            case "e":
+                dbg.doEdit(asArgs);
+                break;
+            case "f":
+                dbg.doFreqs(asArgs[1]);
+                break;
+            case "g":
+                dbg.doRun(asArgs[1]);
+                break;
+            case "h":
+                dbg.doHalt();
+                break;
+            case "o":
+                dbg.doOptions(asArgs);
+                break;
+            case "p":
+                dbg.doHistory(asArgs[1]);
+                break;
+            case "r":
+                dbg.doRegisters(asArgs);
+                break;
+            case "s":
+                dbg.doStep();
+                break;
+            case "t":
+                dbg.doTrace(asArgs[1]);
+                break;
+            case "u":
+                dbg.doUnassemble(asArgs[1], asArgs[2], 8);
+                break;
+            case "?":
+            case "help":
+                dbg.doHelp();
+                break;
+            case "i":
+                if (dbg.doInfo(asArgs[1])) break;
+                /* falls through */
+            default:
+                dbg.println("unknown command: " + sCmd);
+                break;
+            }
+        }
+    }
+
+    /**
+     * C1PDebugger.init()
+     *
+     * This function operates on every HTML element of class "debugger", extracting the
+     * JSON-encoded parameters for the C1PDebugger constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a C1PDebugger component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeDbg = Component.getElementsByClass(document, C1PJS.APPCLASS, "debugger");
+        for (var iDbg=0; iDbg < aeDbg.length; iDbg++) {
+            var eDbg = aeDbg[iDbg];
+            var parmsDbg = Component.getComponentParms(eDbg);
+            var dbg = new C1PDebugger(parmsDbg);
+            Component.bindComponentControls(dbg, eDbg, C1PJS.APPCLASS);
+        }
+    }
+}
+
+if (DEBUGGER) {
+
+    /*
+     * Initialize every Debugger module on the page (as IF there's ever going to be more than one ;-))
+     */
+    Web.onInit(C1PDebugger.init);
+
+}   // endif DEBUGGER
+
+/**
+ * @copyright http://pcjs.org/modules/c1pjs/lib/computer.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class C1PComputer extends Component {
+    /**
+     * C1PComputer(parmsComputer, modules)
+     *
+     * The C1PComputer component expects the following (parmsComputer) properties:
+     *
+     *      modules[{}] (from the <module> definition(s) for the computer)
+     *
+     * This component processes all the <module> "start" and "end" specifications
+     * and "wires" everything to a common "address buffer"; namely, the abMemory array.
+     * abMemory encompasses the computer's entire address space, but every component must
+     * play nice and use only its assigned section of abMemory -- and pretend it's an array
+     * of bytes, when in fact it's an array of floating-point values (the only primitive
+     * numeric data type that JavaScript provides).
+     *
+     * This component also insures that all the other components are ready; in particular,
+     * this means that the ROM and Video components have finished loading their resources
+     * and are ready for operation.  Other components become ready as soon as we call their
+     * setBuffer() method (eg, CPU, RAM, Keyboard, Debugger, SerialPort, DiskController), and
+     * others, like Panel, become ready even earlier, at the end of their initialization.
+     *
+     * Once every component has indicated it's ready, we call its setPower() notification
+     * function (if it has one; it's optional).  We call the CPU's setPower() function last,
+     * so that the CPU is assured that all other components are ready and "powered".
+     *
+     * @this {C1PComputer}
+     * @param {Object} parmsComputer
+     * @param {Object} modules
+     */
+    constructor(parmsComputer, modules)
+    {
+        super("C1PComputer", parmsComputer);
+
+        this.modules = modules;
+    }
+
+    /**
+     * reset(fPowerOn)
+     *
+     * @this {C1PComputer}
+     * @param {boolean} [fPowerOn] is true to indicate that we should start the CPU running
+     */
+    reset(fPowerOn)
+    {
+        var cpu = null;
+        for (var sType in this.modules) {
+            for (var i=0; i < this.modules[sType].length; i++) {
+                var component = this.modules[sType][i];
+                if (component && component.reset) {
+                    if (DEBUG) this.println("resetting " + sType);
+                    component.reset();
+                    if (sType == "cpu") cpu = component;
+                }
+            }
+        }
+        if (cpu) {
+            cpu.update();
+            if (fPowerOn) cpu.run();
+        }
+    }
+
+    /**
+     * start()
+     *
+     * Called by the CPU to notify all component start() handlers.
+     *
+     * @this {C1PComputer}
+     */
+    start()
+    {
+        for (var sType in this.modules) {
+            if (sType == "cpu") continue;
+            for (var i=0; i < this.modules[sType].length; i++) {
+                var component = this.modules[sType][i];
+                if (component && component.start) {
+                    component.start();
+                }
+            }
+        }
+    }
+
+    /**
+     * stop(msStart, nCycles)
+     *
+     * Called by the CPU to notify all component stop() handlers
+     *
+     * @this {C1PComputer}
+     * @param {number} msStart
+     * @param {number} nCycles
+     */
+    stop(msStart, nCycles)
+    {
+        for (var sType in this.modules) {
+            if (sType == "cpu") continue;
+            for (var i=0; i < this.modules[sType].length; i++) {
+                var component = this.modules[sType][i];
+                if (component && component.stop) {
+                    component.stop(msStart, nCycles);
+                }
+            }
+        }
+    }
+
+    /**
+     * @this {C1PComputer}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "reset")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        switch(sBinding) {
+        case "reset":
+            this.bindings[sBinding] = control;
+            control.onclick = function(computer) {
+                return function() {
+                    computer.reset();
+                };
+            }(this);
+            return true;
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * NOTE: If there are multiple components for a given type, we may need to provide a means of discriminating.
+     *
+     * @this {C1PComputer}
+     * @param {string} sType
+     * @param {string} [idRelated] of related component
+     * @param {Component|null} [componentPrev] of previously returned component, if any
+     * @return {Component|null}
+     */
+    getComponentByType(sType, idRelated, componentPrev)
+    {
+        if (this.modules[sType]) {
+            return this.modules[sType][0];
+        }
+        return null;
+    }
+
+    static power(computer)
+    {
+        /*
+         * Insure that the ROMs, Video and CPU are all ready before "powering" everything; always "power"
+         * the CPU last, to make sure it doesn't start asking other components to do things before they're ready.
+         */
+        var cpu = null;
+        for (var sType in computer.modules) {
+            for (var i=0; i < computer.modules[sType].length; i++) {
+                var component = computer.modules[sType][i];
+                if (!component) continue;
+                if (!component.isReady()) {
+                    component.isReady(function(computer) {
+                        return function() {
+                            C1PComputer.power(computer);
+                        };
+                    }(computer));   // jshint ignore:line
+                    return;
+                }
+                /*
+                 * The CPU component's setPower() notification handler is a special case: we don't want
+                 * to call it until the end (below), after all others have been called.
+                 */
+                if (sType == "cpu")
+                    cpu = component;
+                else if (component.setPower) {
+                    component.setPower(true, computer);
+                }
+            }
+        }
+
+        /*
+         * The entire computer is finally ready; we call our own setReady() for completeness, not because any
+         * other component actually cares when we're ready.
+         */
+        computer.setReady();
+
+        computer.println(C1PJS.APPNAME + " v" + C1PJS.APPVERSION + "\n" + COPYRIGHT);
+
+        /*
+         * Once we get to this point, we're guaranteed that all components are ready, so it's safe to "power" the CPU;
+         * setPower() includes an automatic reset(fPowerOn), so the CPU should begin executing immediately, unless a debugger
+         * is attached.
+         */
+        if (cpu) cpu.setPower(true, computer);
+    }
+
+    /*
+     * C1PComputer.init()
+     *
+     * This function operates on every HTML element of class "c1pjs-computer", extracting the
+     * JSON-encoded parameters for the C1PComputer constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a C1PComputer component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        /*
+         * In non-COMPILED builds, embedMachine() may have set XMLVERSION.
+         */
+        if (!COMPILED && XMLVERSION) C1PJS.APPVERSION = XMLVERSION;
+
+        var aeComputers = Component.getElementsByClass(document, C1PJS.APPCLASS, "computer");
+
+        for (var iComputer=0; iComputer < aeComputers.length; iComputer++) {
+
+            var eComputer = aeComputers[iComputer];
+            var parmsComputer = Component.getComponentParms(eComputer);
+
+            var component;
+            var modules = {};
+
+            var abMemory;
+            var addrStart = 0, addrEnd = 0;
+
+            for (var iAddr=0; iAddr < parmsComputer['modules'].length; iAddr++) {
+                var addrInfo = parmsComputer['modules'][iAddr];
+                /*
+                 * The first address range (ie, the CPU range) must specify the range for the entire
+                 * address space (abMemory), which we allocate and zero-initialize.
+                 *
+                 * NOTE: We might consider doing what the Video component does on first reset: initializing
+                 * the entire memory buffer to random values.  However, a constant (eg, 0xA5) might be
+                 * more useful, acting as a crude indicator of memory the client code hasn't written yet.
+                 */
+                if (!iAddr) {
+                    if (addrInfo['type'] != "cpu") break;
+                    addrStart = addrInfo['start'];
+                    addrEnd = addrInfo['end'];
+                    abMemory = new Array(addrEnd+1 - addrStart);
+                    for (var addr=addrStart; addr < abMemory.length; addr++) {
+                        abMemory[addr] = 0;
+                    }
+                }
+                component = Component.getComponentByID(addrInfo['refID'], parmsComputer['id']);
+                if (component) {
+                    var sType = addrInfo['type'];
+                    if (modules[sType] === undefined)
+                        modules[sType] = [];
+                    modules[sType].push(component);
+                    if (component.setBuffer && addrInfo['start'] !== undefined) {
+                        component.setBuffer(abMemory, addrInfo['start'], addrInfo['end'], modules['cpu'][0]);
+                    }
+                }
+                else {
+                    Component.error("no component for <module refid=\"" + addrInfo['refID'] + "\">");
+                    return;
+                }
+            }
+
+            if (abMemory === undefined) {
+                Component.error("<module type=\"cpu\"> definition must appear first in the <computer> specification");
+                return;
+            }
+
+            /*
+             * Let's see if the Debugger is installed (NOTE: its ID must be "debugger", and only one per machine is supported);
+             * the Debugger needs our setBuffer(), setPower() and reset() notifications, and this relieves us from having an explicit
+             * <module> entry for type="debugger".
+             */
+            component = Component.getComponentByID('debugger', parmsComputer['id']);
+            if (component) {
+                modules['debugger'] = [component];
+                if (component.setBuffer) {
+                    component.setBuffer(abMemory, addrStart, addrEnd, modules['cpu'][0]);
+                }
+            }
+
+            var computer = new C1PComputer(parmsComputer, modules);
+
+            /*
+             * Let's see if the Control Panel is installed (NOTE: its ID must be "panel", and only one per machine is supported);
+             * the Panel needs our setPower() notifications, and this relieves us from having an explicit <module> entry for type="panel".
+             */
+            var panel = Component.getComponentByID('panel', parmsComputer['id']);
+            if (panel) {
+                modules['panel'] = [panel];
+                /*
+                 * Iterate through all the other components and update their print methods if the Control Panel has provided overrides.
+                 */
+                if (panel.controlPrint) {
+                    var aComponents = Component.getComponents(parmsComputer['id']);
+                    for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+                        component = aComponents[iComponent];
+                        if (component == panel) continue;
+                        component.notice = panel.notice;
+                        component.println = panel.println;
+                        component.controlPrint = panel.controlPrint;
+                    }
+                }
+            }
+
+            /*
+             *  We may eventually add a "Power" button, but for now, all we have is a "Reset" button
+             */
+            Component.bindComponentControls(computer, eComputer, C1PJS.APPCLASS);
+
+            /*
+             * "Power" the computer automatically
+             */
+            C1PComputer.power(computer);
+        }
+    }
+}
+
+/*
+ * Initialize every Computer on the page.
+ */
+Web.onInit(C1PComputer.init);
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/embed.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * We now support asynchronous XML and XSL file loads; simply set fAsync (below) to true.
+ *
+ * NOTE: For that support to work, we have to keep track of the number of machines on the page
+ * (ie, how many embedMachine() calls were issued), reduce the count as each machine XML file
+ * is fully transformed into HTML, and when the count finally returns to zero, notify all the
+ * machine component init() handlers.
+ *
+ * Also, to prevent those init() handlers from running prematurely, we must disable all page
+ * notification events at the start of the embedding process (Web.enablePageEvents(false)) and
+ * re-enable them at the end (Web.enablePageEvents(true)).
+ */
+var fAsync = true;
+var cAsyncMachines = 0;
+
+/**
+ * loadXML(sFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+ *
+ * This is the preferred way to load all XML and XSL files. It uses getResource()
+ * to load them as strings, which parseXML() can massage before parsing/transforming them.
+ *
+ * For example, since I've been unable to get the XSLT document() function to work inside any
+ * XSL document loaded by JavaScript's XSLT processor, that has prevented me from dynamically
+ * loading any XML machine file that uses the "ref" attribute to refer to and incorporate
+ * another XML document.
+ *
+ * To solve that, I've added an fResolve parameter that tells parseXML() to fetch any
+ * referenced documents ITSELF and insert them into the XML string prior to parsing, instead
+ * of relying on the XSLT template to pull them in.  That fetching is handled by resolveXML(),
+ * which iterates over the XML until all "refs" have been resolved (including any nested
+ * references).
+ *
+ * Also, XSL files with a <!DOCTYPE [...]> cause MSIE's Microsoft.XMLDOM.loadXML() function
+ * to choke, so I strip that out prior to parsing as well.
+ *
+ * TODO: Figure out why the XSLT document() function works great when the web browser loads an
+ * XML file (and the associated XSL file) itself, but does not work when loading documents via
+ * JavaScript XSLT support. Is it broken, is it a security issue, or am I just calling it wrong?
+ *
+ * @param {string} sXMLFile
+ * @param {string|null|undefined} idMachine
+ * @param {string|null|undefined} sAppName
+ * @param {string|null|undefined} sAppClass
+ * @param {string|null|undefined} sParms
+ * @param {boolean} fResolve is true to resolve any "ref" attributes
+ * @param {function(string)} display
+ * @param {function(string,Object)} done (string contains the unparsed XML string data, and Object contains a parsed XML object)
+ */
+function loadXML(sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+{
+    var doneLoadXML = function(sURLName, sXML, nErrorCode) {
+        if (nErrorCode) {
+            if (!sXML) sXML = "unable to load " + sXMLFile + " (" + nErrorCode + ")";
+            done(sXML, null);
+            return;
+        }
+        parseXML(sXML, sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done);
+    };
+    display("Loading " + sXMLFile + "...");
+    Web.getResource(sXMLFile, null, fAsync, doneLoadXML);
+}
+
+/**
+ * parseXML(sXML, sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+ *
+ * Generates an XML document from an XML string. This function also provides a work-around for XSLT's
+ * lack of support for the document() function (at least on some browsers), by replacing every reference
+ * tag (ie, a tag with a "ref" attribute) with the contents of the referenced file.
+ *
+ * @param {string} sXML
+ * @param {string|null} sXMLFile
+ * @param {string|null|undefined} idMachine
+ * @param {string|null|undefined} sAppName
+ * @param {string|null|undefined} sAppClass
+ * @param {string|null|undefined} sParms
+ * @param {boolean} fResolve is true to resolve any "ref" attributes; default is false
+ * @param {function(string)} display
+ * @param {function(string,Object)} done (string contains the unparsed XML string data, and Object contains a parsed XML object)
+ */
+function parseXML(sXML, sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+{
+    var buildXML = function(sXML, sError) {
+        if (sError) {
+            done(sError, null);
+            return;
+        }
+        if (idMachine) {
+
+            /*
+             * A more sensible place to record the machine XML would be embedMachine(), like we do for the
+             * XSL file, but since we're about to modify the original machine XML, it's best to record it now.
+             */
+            Component.addMachineResource(idMachine, sXMLFile, sXML);
+
+            var sURL = sXMLFile;
+            if (sURL && sURL.indexOf('/') < 0 && window.location.pathname.slice(-1) == '/') {
+                sURL = window.location.pathname + sURL;
+            }
+            /*
+             * We embed the URL of the XML file both as a separate "xml" attribute for easy access from the
+             * XSL file, and as part of the "parms" attribute for easy access from machines (see getMachineParm()).
+             */
+            if (!sParms) {
+                sParms = '{';
+            } else if (sParms.slice(-1) == '}') {
+                sParms = sParms.slice(0, -1);
+                if (sParms.length > 1) sParms += ',';
+            } else {            // sParms must just be a "state" file, so encode it as a "state" property
+                sParms = '{state:"' + sParms + '",';
+            }
+            sParms += 'url:"' + sURL + '"}';
+            /*
+             * Note that while we no longer generate a machine XML file with a "state" attribute (because it's
+             * encoded inside the "parms" attribute), the XSL file must still cope with "state" attributes inside
+             * other XML files; for example, manifest XML files like /apps/pc/1981/visicalc/manifest.xml contain
+             * machine elements with "state" attributes that must still be passed down to the computer element
+             * "the old fashioned way".
+             *
+             * Until/unless that changes, components.xsl cannot be simplified as much as I might have hoped.
+             */
+            if (typeof resources == 'object') sURL = null;      // turn off URL inclusion if we have embedded resources
+            sXML = sXML.replace(/(<machine[^>]*\sid=)(['"]).*?\2/, "$1$2" + idMachine + "$2" + (sParms? " parms='" + sParms + "'" : "") + (sURL? ' url="' + sURL + '"' : ''));
+        }
+
+        if (!fResolve) {
+            /*
+             * I'm trying to switch to a shared components.xsl (at least for all PC-class machines),
+             * but in the interim, that means hacking the XSL file on the fly to reflect the actual class.
+             */
+            sXML = sXML.replace(/(<xsl:variable name="APPNAME">).*?(<\/xsl:variable>)/, "$1" + sAppName + "$2");
+            sXML = sXML.replace(/(<xsl:variable name="APPCLASS">).*?(<\/xsl:variable>)/, "$1" + sAppClass + "$2");
+
+            /*
+             * Non-COMPILED kludge to replace the version number template in the XSL file (which we assume we're reading,
+             * since fResolve is false) with whatever XMLVERSION we extracted from the XML file (see corresponding kludge below).
+             *
+             * ES6 ALERT: Template strings.
+             */
+            if (!COMPILED && XMLVERSION) {
+                sXML = sXML.replace(/<xsl:variable name="APPVERSION">1.x.x<\/xsl:variable>/, `<xsl:variable name="APPVERSION">${XMLVERSION}</xsl:variable>`);
+            }
+        }
+
+        /*
+         * If the resource we requested is not really an XML file (or the file didn't exist and the server simply returned
+         * a message like "Cannot GET /devices/pc/machine/5150/cga/64kb/donkey/machine.xml"), we'd like to display a more
+         * meaningful message, because the XML DOM parsers will blithely return a document that contains nothing useful; eg:
+         *
+         *      This page contains the following errors:error on line 1 at column 1:
+         *      Document is empty Below is a rendering of the page up to the first error.
+         *
+         * Supposedly, the IE XML DOM parser will throw an exception, but I haven't tested that, and unless all other
+         * browsers do that, that's not helpful.
+         *
+         * The best I can do at this stage (assuming Web.getResource() didn't drop any error information on the floor)
+         * is verify that the requested resource "looks like" valid XML (in other words, it begins with a '<').
+         */
+        var xmlDoc = null;
+        if (sXML.charAt(0) == '<') {
+            try {
+                /*
+                 * Another hack for MSIE, which fails to load XSL documents containing a <!DOCTYPE [...]> tag.
+                 *
+                 * This is also why the XSLTProcessor 'transformToFragment' method in Microsoft Edge silently failed,
+                 * so I had pull this hack out of the "ActiveXObject" code.  And rather than add yet-another Microsoft
+                 * browser check, I'm going to try doing this across the board, and hope that none of the other XSLT
+                 * processors fail *without* the DOCTYPE tag.
+                 */
+                if (!fResolve) {
+                    sXML = sXML.replace(/<!DOCTYPE(.|[\r\n])*]>\s*/g, "");
+                }
+                /*
+                 * Beginning with Microsoft Edge and the corresponding release of Windows 10, all the
+                 * 'ActiveXObject' crud has gone away; but of course, this code must remain in place if
+                 * we want to continue supporting older Internet Explorer browsers (ie, back to IE9).
+                 */
+                /** @namespace window.ActiveXObject */
+                if (window.ActiveXObject || 'ActiveXObject' in window) {        // second test is required for IE11 on Windows 8.1
+                    xmlDoc = new window.ActiveXObject("Microsoft.XMLDOM");
+                    xmlDoc.async = false;
+                    xmlDoc['loadXML'](sXML);
+                } else {
+                    /** @namespace window.DOMParser */
+                    xmlDoc = (new window.DOMParser()).parseFromString(sXML, "text/xml");
+                }
+            } catch(e) {
+                xmlDoc = null;
+                sXML = e.message;
+            }
+        } else {
+            sXML = "unrecognized XML: " + (sXML.length > 255? sXML.substr(0, 255) + "..." : sXML);
+        }
+        done(sXML, xmlDoc);
+    };
+    if (sXML) {
+        if (PRIVATE) sXML = sXML.replace(/\/library.xml/, "/private/library.xml");
+        if (fResolve) {
+            resolveXML(sXML, display, buildXML);
+            return;
+        }
+        buildXML(sXML, null);
+        return;
+    }
+    done("no data" + (sXMLFile? " for file: " + sXMLFile : ""), null);
+}
+
+/**
+ * resolveXML(sXML, display, done)
+ *
+ * Replaces every tag with a "ref" attribute with the contents of the corresponding file.
+ *
+ * TODO: Fix some of the limitations of this code, such as: 1) requiring the "ref" attribute
+ * to appear as the tag's first attribute, 2) requiring the "ref" attribute to be double-quoted,
+ * and 3) requiring the "ref" tag to be self-closing.
+ *
+ * @param {string} sXML
+ * @param {function(string)} display
+ * @param {function(string,(string|null))} done (the first string contains the resolved XML data, the second is for any error message)
+ */
+function resolveXML(sXML, display, done)
+{
+    var matchRef;
+    var reRef = /<([a-z]+)\s+ref="(.*?)"(.*?)\/>/g;
+
+    if ((matchRef = reRef.exec(sXML))) {
+
+        var sRefFile = matchRef[2];
+
+        var doneReadXML = function(sURLName, sXMLRef, nErrorCode) {
+            if (nErrorCode || !sXMLRef) {
+                done(sXML, "unable to resolve XML reference: " + matchRef[0] + " (" + nErrorCode + ")");
+                return;
+            }
+            /*
+             * If there are additional attributes in the "referring" XML tag, we want to insert them
+             * into the "referred" XML tag; attributes that don't exist in the referred tag should be
+             * appended, and attributes that DO exist should be overwritten.
+             */
+            var sRefAttrs = matchRef[3];
+            if (sRefAttrs) {
+                var aXMLRefTag = sXMLRef.match(new RegExp("<" + matchRef[1] + "[^>]*>"));
+                if (aXMLRefTag) {
+                    var sXMLNewTag = aXMLRefTag[0];
+                    /*
+                     * Iterate over all the attributes in the "referring" XML tag (sRefAttrs)
+                     */
+                    var matchAttr;
+                    var reAttr = /( [a-z]+=)(['"])(.*?)\2/g;
+                    while ((matchAttr = reAttr.exec(sRefAttrs))) {
+                        if (sXMLNewTag.indexOf(matchAttr[1]) < 0) {
+                            /*
+                             * This is the append case
+                             */
+                            sXMLNewTag = sXMLNewTag.replace(">", matchAttr[0] + ">");
+                        } else {
+                            /*
+                             * This is the overwrite case
+                             */
+                            sXMLNewTag = sXMLNewTag.replace(new RegExp(matchAttr[1] + "(['\"])(.*?)\\1"), matchAttr[0]);
+                        }
+                    }
+                    if (aXMLRefTag[0] != sXMLNewTag) {
+                        sXMLRef = sXMLRef.replace(aXMLRefTag[0], sXMLNewTag);
+                    }
+                } else {
+                    done(sXML, "missing <" + matchRef[1] + "> in " + sRefFile);
+                    return;
+                }
+            }
+
+            /*
+             * Apparently when a Windows Azure server delivers one of my XML files, it may modify the first line:
+             *
+             *      <?xml version="1.0" encoding="UTF-8"?>\n
+             *
+             * I didn't determine exactly what it was doing at this point (probably just changing the \n to \r\n),
+             * but in any case, relaxing the following replace() solved it.
+             */
+            sXMLRef = sXMLRef.replace(/<\?xml[^>]*>[\r\n]*/, "");
+
+            sXML = sXML.replace(matchRef[0], sXMLRef);
+
+            resolveXML(sXML, display, done);
+        };
+
+        display("Loading " + sRefFile + "...");
+        Web.getResource(sRefFile, null, fAsync, doneReadXML);
+        return;
+    }
+    done(sXML, null);
+}
+
+/**
+ * embedMachine(sAppName, sAppClass, sVersion, idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * This allows to you embed a machine on a web page, by transforming the machine XML into HTML.
+ *
+ * @param {string} sAppName is the app name (eg, "PCx86")
+ * @param {string} sAppClass is the app class (eg, "pcx86"); also known as the machine class
+ * @param {string} sVersion is the app version (eg, "1.15.7")
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedMachine(sAppName, sAppClass, sVersion, idMachine, sXMLFile, sXSLFile, sParms)
+{
+    var eMachine, eWarning, fSuccess = true;
+
+    cAsyncMachines++;
+    Component.addMachine(idMachine);
+
+    var doneMachine = function() {
+
+        if (!--cAsyncMachines) {
+            if (fAsync) Web.enablePageEvents(true);
+        }
+    };
+
+    var displayError = function(sError) {
+        Component.log(sError);
+        displayMessage("Error: " + sError);
+        if (fSuccess) doneMachine();
+        fSuccess = false;
+    };
+
+    var displayMessage = function(sMessage) {
+        if (eWarning === undefined) {
+            /*
+             * Our MarkOut module (in convertMDMachineLinks()) creates machine containers that look like:
+             *
+             *      <div id="' + sMachineID + '" class="machine-placeholder"><p>Embedded PC</p><p class="machine-warning">...</p></div>
+             *
+             * with the "machine-warning" paragraph pre-populated with a warning message that the user will
+             * see if nothing at all happens.  But hopefully, in the normal case (and especially the error case),
+             * *something* will have happened.
+             *
+             * Note that it is the HTMLOut module (in processMachines()) that ultimately decides which scripts to
+             * include and then generates the embedXXX() call.
+             */
+            var aeWarning = (eMachine && Component.getElementsByClass(eMachine, "machine-warning"));
+            eWarning = (aeWarning && aeWarning[0]) || eMachine;
+        }
+        if (eWarning) eWarning.innerHTML = Str.escapeHTML(sMessage);
+    };
+
+    try {
+        eMachine = document.getElementById(idMachine);
+        if (eMachine) {
+
+            /*
+             * If we have a 'css' resource, add it to the page first.
+             */
+            var css;
+            if (typeof resources == "object" && (css = resources['css'])) {
+                var head = document.head || document.getElementsByTagName('head')[0];
+                var style = document.createElement('style');
+                style.type = 'text/css';
+                if (style.styleSheet) {
+                    style.styleSheet.cssText = css;
+                } else {
+                    style.appendChild(document.createTextNode(css));
+                }
+                head.appendChild(style);
+            }
+
+            if (!sXSLFile) {
+                /*
+                 * Now that PCjs is an open-source project, we can make the following test more flexible,
+                 * and revert to the internal template if DEBUG *or* internal version (instead of *and*).
+                 *
+                 * Third-party sites that don't use the PCjs server will ALWAYS want to specify a fully-qualified
+                 * path to the XSL file, unless they choose to mirror our folder structure.
+                 */
+                var sAppFolder = sAppClass;
+                if (DEBUG || sVersion == "1.x.x") {
+                    sXSLFile = "/modules/" + sAppFolder + "/templates/components.xsl";
+                } else {
+                    if (sAppClass.substr(0, 3) == "pdp") sAppFolder = "pdpjs";
+                    sXSLFile = "/versions/" + sAppFolder + "/" + sVersion + "/components.xsl";
+                }
+            }
+
+            var processXML = function(sXML, xml) {
+                if (!xml) {
+                    displayError(sXML);
+                    return;
+                }
+
+                /*
+                 * Non-COMPILED kludge to extract the version number from the stylesheet path in the machine XML file;
+                 * we don't need this code in COMPILED (non-DEBUG) releases, because APPVERSION is hard-coded into them.
+                 */
+                if (!COMPILED) {
+                    var aMatch = sXML.match(/<\?xml-stylesheet[^>]* href=(['"])[^'"]*?\/([0-9.]*)\/([^'"]*)\1/);
+                    if (aMatch) XMLVERSION = aMatch[2];
+                }
+
+                var transformXML = function(sXSL, xsl) {
+                    if (!xsl) {
+                        displayError(sXSL);
+                        return;
+                    }
+
+                    /*
+                     * Record the XSL file, in case someone wants to save the entire machine later.
+                     */
+                    Component.addMachineResource(idMachine, sXSLFile, sXSL);
+
+                    /*
+                     * The <machine> template in components.xsl now generates a "machine div" that makes
+                     * the div we required the caller of embedMachine() to provide redundant, so instead
+                     * of appending this fragment to the caller's node, we REPLACE the caller's node.
+                     * This works only because because we ALSO inject the caller's "machine div" ID into
+                     * the fragment's ID during parseXML().
+                     *
+                     *      eMachine.innerHTML = sFragment;
+                     *
+                     * Also, if the transform function fails, make sure you're using the appropriate
+                     * "components.xsl" and not a "machine.xsl", because the latter will not produce valid
+                     * embeddable HTML (and is the most common cause of failure at this final stage).
+                     */
+                    displayMessage("Processing " + sXMLFile + "...");
+
+                    /*
+                     * Beginning with Microsoft Edge and the corresponding release of Windows 10, all the
+                     * 'ActiveXObject' crud has gone away; but of course, this code must remain in place if
+                     * we want to continue supporting older Internet Explorer browsers (ie, back to IE9).
+                     */
+                    if (window.ActiveXObject || 'ActiveXObject' in window) {        // second test is required for IE11 on Windows 8.1
+                        var sFragment = xml['transformNode'](xsl);
+                        if (sFragment) {
+                            eMachine.outerHTML = sFragment;
+                            doneMachine();
+                        } else {
+                            displayError("transformNodeToObject failed");
+                        }
+                    }
+                    else if (document.implementation && document.implementation.createDocument) {
+                        var xsltProcessor = new XSLTProcessor();
+                        xsltProcessor['importStylesheet'](xsl);
+                        var eFragment = xsltProcessor['transformToFragment'](xml, document);
+                        if (eFragment) {
+                            /*
+                             * This fails in Microsoft Edge...
+                             *
+                            var machine = eFragment.getElementById(idMachine);
+                            if (!machine) {
+                                displayError("machine generation failed: " + idMachine);
+                            } else
+                            */
+                            if (eMachine.parentNode) {
+                                eMachine.parentNode.replaceChild(eFragment, eMachine);
+                                doneMachine();
+                            } else {
+                                /*
+                                 * NOTE: This error can occur if our Node web server, when processing a folder with
+                                 * both a manifest.xml with a machine.xml reference AND a README.md containing a
+                                 * machine link, generates duplicate embedXXX() calls for the same machine; if the
+                                 * first embedXXX() call finds its target, subsequent calls for the same target will
+                                 * fail.
+                                 *
+                                 * Technically, such a folder is in a misconfigured state, but it happens, in part
+                                 * because when we switched to the Jekyll web server, we had to add machine links to
+                                 * all README.md files where we had previously relied on manifest.xml or machine.xml
+                                 * processing.  This is because the Jekyll web server currently doesn't process XML
+                                 * files, nor is support for that likely to be added any time soon; it was a nice
+                                 * feature of the Node web server, but it's not clear that it's worth doing for Jekyll.
+                                 */
+                                displayError("invalid machine element: " + idMachine);
+                            }
+                        } else {
+                            displayError("transformToFragment failed");
+                        }
+                    } else {
+                        /*
+                         * Perhaps I should have performed this test at the outset; on the other hand, I'm
+                         * not aware of any browsers don't support one or both of the above XSLT transformation
+                         * methods, so treat this as a bug.
+                         */
+                        displayError("unable to transform XML: unsupported browser");
+                    }
+                };
+                loadXML(sXSLFile, null, sAppName, sAppClass, null, false, displayMessage, transformXML);
+            };
+
+            if (sXMLFile.charAt(0) != '<') {
+                loadXML(sXMLFile, idMachine, sAppName, sAppClass, sParms, true, displayMessage, processXML);
+            } else {
+                parseXML(sXMLFile, null, idMachine, sAppName, sAppClass, sParms, false, displayMessage, processXML);
+            }
+        } else {
+            displayError("missing machine element: " + idMachine);
+        }
+    } catch(e) {
+        displayError(e.message);
+    }
+    return fSuccess;
+}
+
+/**
+ * embedC1P(idMachine, sXMLFile, sXSLFile)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @return {boolean} true if successful, false if error
+ */
+function embedC1P(idMachine, sXMLFile, sXSLFile)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("C1Pjs", "c1pjs", APPVERSION, idMachine, sXMLFile, sXSLFile);
+}
+
+/**
+ * embedPCx86(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPCx86(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PCx86", "pcx86", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * embedPC8080(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPC8080(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PC8080", "pc8080", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * embedPDP10(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPDP10(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PDPjs", "pdp10", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * embedPDP11(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPDP11(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PDPjs", "pdp11", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * findMachineComponent(idMachine, sType)
+ *
+ * @param {string} idMachine
+ * @param {string} sType
+ * @return {Component|null}
+ */
+function findMachineComponent(idMachine, sType)
+{
+    return Component.getComponentByType(sType, idMachine + ".machine");
+}
+
+/**
+ * processMachineScript(idMachine, sScript)
+ *
+ * @param {string} idMachine
+ * @param {string} sScript
+ * @return {boolean}
+ */
+function processMachineScript(idMachine, sScript)
+{
+    return Component.processScript(idMachine, sScript);
+}
+
+/**
+ * Prevent the Closure Compiler from renaming functions we want to export, by adding them as global properties.
+ *
+ * TODO: Consider making all these functions properties on a single global object (eg, 'PCjs'), to minimize global
+ * pollution and risk of name collision.
+ */
+if (APPNAME == "C1Pjs") {
+    window['embedC1P']    = embedC1P;
+}
+if (APPNAME == "PCx86") {
+    window['embedPC']     = embedPCx86;         // WARNING: embedPC() deprecated as of v1.23.0
+    window['embedPCx86']  = embedPCx86;
+}
+if (APPNAME == "PC8080") {
+    window['embedPC8080'] = embedPC8080;
+}
+if (APPNAME == "PDPjs") {
+    window['embedPDP10']  = embedPDP10;
+    window['embedPDP11']  = embedPDP11;
+}
+
+window['findMachineComponent'] = findMachineComponent;
+window['processMachineScript'] = processMachineScript;
+
+window['enableEvents'] = Web.enablePageEvents;
+window['sendEvent']    = Web.sendPageEvent;
diff --git a/versions/c1pjs/1.35.0/c1p.js b/versions/c1pjs/1.35.0/c1p.js
index a1c153925..b3c921113 100644
--- a/versions/c1pjs/1.35.0/c1p.js
+++ b/versions/c1pjs/1.35.0/c1p.js
@@ -155,4 +155,4 @@ a=a.replace(d[0],h);rb(a,b,c)}})}else c(a,null)}
 function tb(a,b,c){function d(a){if(void 0===h){var b=g&&I(g,"machine-warning");h=b&&b[0]||g}h&&(h.innerHTML=ia(a))}function f(a){d("Error: "+a);l&&(--ob||C(!0));l=!1}var g,h,l=!0;ob++;L[a]={};try{if(g=document.getElementById(a)){var k;if("object"==typeof resources&&(k=resources.css)){var n=document.head||document.getElementsByTagName("head")[0],m=document.createElement("style");m.type="text/css";m.styleSheet?m.styleSheet.cssText=k:m.appendChild(document.createTextNode(k));n.appendChild(m)}c||(c=
 "/versions/c1pjs/1.35.0/components.xsl");k=function(h,k){k?pb(c,null,null,!1,d,function(h,l){l?(L[a]&&c&&(L[a][c]=h),d("Processing "+b+"..."),window.ActiveXObject||"ActiveXObject"in window?(l=k.transformNode(l))?(g.outerHTML=l,--ob||C(!0)):f("transformNodeToObject failed"):document.implementation&&document.implementation.createDocument?(h=new XSLTProcessor,h.importStylesheet(l),(l=h.transformToFragment(k,document))?g.parentNode?(g.parentNode.replaceChild(l,g),--ob||C(!0)):f("invalid machine element: "+
 a):f("transformToFragment failed")):f("unable to transform XML: unsupported browser")):f(h)}):f(h)};"<"!=b.charAt(0)?pb(b,a,void 0,!0,d,k):qb(b,null,a,void 0,!1,d,k)}else f("missing machine element: "+a)}catch(p){f(p.message)}return l}window.embedC1P=function(a,b,c){C(!1);return tb(a,b,c)};window.findMachineComponent=function(a,b){return qa(b,a+".machine")};
-window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==typeof b&&!J[a]){for(var c=!0,d=J,f=a,g=b.length,h=[],l=[],k="",n=null,m=0;m<g;m++){var p=b[m];if('"'==p||"'"==p)n&&p!=n?k+=p:(n?n=null:n=p,k&&(l.push(k),k=""));else{if(!n){if("\r"==p||"\n"==p)p=";";if(" "==p||"\t"==p||";"==p){k&&(l.push(k),k="");";"==p&&l.length&&(h.push(l),l=[]);continue}}k+=p}}k&&l.push(k);l.length&&h.push(l);d[f]=h;ra(a)||(c=!1)}return c};window.enableEvents=C;window.sendEvent=na;})();
+window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==typeof b&&!J[a]){for(var c=!0,d=J,f=a,g=b.length,h=[],l=[],k="",n=null,m=0;m<g;m++){var p=b[m];if('"'==p||"'"==p)n&&p!=n?k+=p:(n?n=null:n=p,k&&(l.push(k),k=""));else{if(!n){if("\r"==p||"\n"==p)p=";";if(" "==p||"\t"==p||";"==p){k&&(l.push(k),k="");";"==p&&l.length&&(h.push(l),l=[]);continue}}k+=p}}k&&l.push(k);l.length&&h.push(l);d[f]=h;ra(a)||(c=!1)}return c};window.enableEvents=C;window.sendEvent=na;})();//# sourceMappingURL=/versions/c1pjs/1.35.0/c1p.map
diff --git a/versions/pc8080/1.35.0/pc8080-dbg.js b/versions/pc8080/1.35.0/pc8080-dbg.js
index 0ae212406..e18e84815 100644
--- a/versions/pc8080/1.35.0/pc8080-dbg.js
+++ b/versions/pc8080/1.35.0/pc8080-dbg.js
@@ -305,4 +305,4 @@ a=a.replace(d[0],g);bj(a,b,c)}})}else c(a,null)}
 function cj(a,b,c,d){function e(a){if(void 0===h){var b=g&&qb(g,"machine-warning");h=b&&b[0]||g}h&&(h.innerHTML=va(a))}function f(a){e("Error: "+a);k&&(--Zi||Za(!0));k=!1}var g,h,k=!0;Zi++;hb[a]={};try{if(g=document.getElementById(a)){var p;if("object"==typeof resources&&(p=resources.css)){var u=document.head||document.getElementsByTagName("head")[0],v=document.createElement("style");v.type="text/css";v.styleSheet?v.styleSheet.cssText=p:v.appendChild(document.createTextNode(p));u.appendChild(v)}c||
 (c="/versions/pc8080/1.35.0/components.xsl");p=function(d,h){h?$i(c,null,null,!1,e,function(d,k){k?(gb(a,c,d),e("Processing "+b+"..."),window.ActiveXObject||"ActiveXObject"in window?(k=h.transformNode(k))?(g.outerHTML=k,--Zi||Za(!0)):f("transformNodeToObject failed"):document.implementation&&document.implementation.createDocument?(d=new XSLTProcessor,d.importStylesheet(k),(k=d.transformToFragment(h,document))?g.parentNode?(g.parentNode.replaceChild(k,g),--Zi||Za(!0)):f("invalid machine element: "+
 a):f("transformToFragment failed")):f("unable to transform XML: unsupported browser")):f(d)}):f(d)};"<"!=b.charAt(0)?$i(b,a,d,!0,e,p):aj(b,null,a,d,!1,e,p)}else f("missing machine element: "+a)}catch(B){f(B.message)}return k}window.embedPC8080=function(a,b,c,d){Za(!1);return cj(a,b,c,d)};window.findMachineComponent=function(a,b){return mb(b,a+".machine")};
-window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==typeof b&&!sb[a]){for(var c=!0,d=sb,e=a,f=b.length,g=[],h=[],k="",p=null,u=0;u<f;u++){var v=b[u];if('"'==v||"'"==v)p&&v!=p?k+=v:(p?p=null:p=v,k&&(h.push(k),k=""));else{if(!p){if("\r"==v||"\n"==v)v=";";if(" "==v||"\t"==v||";"==v){k&&(h.push(k),k="");";"==v&&h.length&&(g.push(h),h=[]);continue}}k+=v}}k&&h.push(k);h.length&&g.push(h);d[e]=g;rb(a)||(c=!1)}return c};window.enableEvents=Za;window.sendEvent=db;})();
+window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==typeof b&&!sb[a]){for(var c=!0,d=sb,e=a,f=b.length,g=[],h=[],k="",p=null,u=0;u<f;u++){var v=b[u];if('"'==v||"'"==v)p&&v!=p?k+=v:(p?p=null:p=v,k&&(h.push(k),k=""));else{if(!p){if("\r"==v||"\n"==v)v=";";if(" "==v||"\t"==v||";"==v){k&&(h.push(k),k="");";"==v&&h.length&&(g.push(h),h=[]);continue}}k+=v}}k&&h.push(k);h.length&&g.push(h);d[e]=g;rb(a)||(c=!1)}return c};window.enableEvents=Za;window.sendEvent=db;})();//# sourceMappingURL=/versions/pc8080/1.35.0/pc8080-dbg.map
diff --git a/versions/pc8080/1.35.0/pc8080-uncompiled.js b/versions/pc8080/1.35.0/pc8080-uncompiled.js
new file mode 100644
index 000000000..27ac25800
--- /dev/null
+++ b/versions/pc8080/1.35.0/pc8080-uncompiled.js
@@ -0,0 +1,25300 @@
+"use strict";
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/defines.js (C) Jeff Parsons 2012-2017
+ */
+
+/**
+ * @define {string}
+ */
+var APPVERSION = "1.x.x";       // this @define is overridden by the Closure Compiler with the version in package.json
+
+var XMLVERSION = null;          // this is set in non-COMPILED builds by embedMachine() if a version number was found in the machine XML
+
+var COPYRIGHT = "Copyright © 2012-2017 Jeff Parsons <Jeff@pcjs.org>";
+
+var LICENSE = "License: GPL version 3 or later <http://gnu.org/licenses/gpl.html>";
+
+var CSSCLASS = "pcjs";
+
+/**
+ * @define {string}
+ */
+var SITEHOST = "localhost:8088";// this @define is overridden by the Closure Compiler with "www.pcjs.org"
+
+/**
+ * @define {boolean}
+ */
+var COMPILED = false;           // this @define is overridden by the Closure Compiler (to true)
+
+/**
+ * @define {boolean}
+ */
+var DEBUG = true;               // this @define is overridden by the Closure Compiler (to false) to remove DEBUG-only code
+
+/**
+ * @define {boolean}
+ */
+var MAXDEBUG = false;           // this @define is overridden by the Closure Compiler (to false) to remove MAXDEBUG-only code
+
+/**
+ * @define {boolean}
+ */
+var PRIVATE = false;            // this @define is overridden by the Closure Compiler (to false) to enable PRIVATE code
+
+/*
+ * RS-232 DB-25 Pin Definitions, mapped to bits 1-25 in a 32-bit status value.
+ *
+ * SerialPorts in PCjs machines are considered DTE (Data Terminal Equipment), which means they should be "virtually"
+ * connected to each other via a null-modem cable, which assumes the following cross-wiring:
+ *
+ *     G       1  <->  1        G       (Ground)
+ *     TD      2  <->  3        RD      (Received Data)
+ *     RD      3  <->  2        TD      (Transmitted Data)
+ *     RTS     4  <->  5        CTS     (Clear To Send)
+ *     CTS     5  <->  4        RTS     (Request To Send)
+ *     DSR   6+8  <->  20       DTR     (Data Terminal Ready)
+ *     SG      7  <->  7        SG      (Signal Ground)
+ *     DTR    20  <->  6+8      DSR     (Data Set Ready + Carrier Detect)
+ *     RI     22  <->  22       RI      (Ring Indicator)
+ *
+ * TODO: Move these definitions to a more appropriate shared file at some point.
+ */
+var RS232 = {
+    RTS: {
+        PIN:  4,
+        MASK: 0x00000010
+    },
+    CTS: {
+        PIN:  5,
+        MASK: 0x00000020
+    },
+    DSR: {
+        PIN:  6,
+        MASK: 0x00000040
+    },
+    CD: {
+        PIN:  8,
+        MASK: 0x00000100
+    },
+    DTR: {
+        PIN:  20,
+        MASK: 0x00100000
+    },
+    RI: {
+        PIN:  22,
+        MASK: 0x00400000
+    }
+};
+
+/*
+ * NODE should be true if we're running under NodeJS (eg, command-line), false if not (eg, web browser)
+ */
+var NODE = false;
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/dumpapi.js (C) Jeff Parsons 2012-2017
+ */
+
+/*
+ * Our "DiskDump API", such as it was, used to look like:
+ *
+ *      http://jsmachines.net/bin/convdisk.php?disk=/disks/pc/dos/ibm/2.00/PCDOS200-DISK1.json&format=img
+ *
+ * To make it (a bit) more "REST-like", the above request now looks like:
+ *
+ *      http://www.pcjs.org/api/v1/dump?disk=/disks/pc/dos/ibm/2.00/PCDOS200-DISK1.json&format=img
+ *
+ * Similarly, our "FileDump API" used to look like:
+ *
+ *      http://jsmachines.net/bin/convrom.php?rom=/devices/pc/rom/5150/1981-04-24/PCBIOS-REV1.rom&format=json
+ *
+ * and that request now looks like:
+ *
+ *      http://www.pcjs.org/api/v1/dump?file=/devices/pc/rom/5150/1981-04-24/PCBIOS-REV1.rom&format=json
+ *
+ * I don't think it makes sense to avoid "query" parameters, because blending the path of a disk image with the
+ * the rest of the URL would be (a) confusing, and (b) more work to parse.
+ */
+var DumpAPI = {
+    ENDPOINT:       "/api/v1/dump",
+    QUERY: {
+        DIR:        "dir",      // value is path of a directory (DiskDump only)
+        DISK:       "disk",     // value is path of a disk image (DiskDump only)
+        FILE:       "file",     // value is path of a ROM image file (FileDump only)
+        IMG:        "img",      // alias for DISK
+        PATH:       "path",     // value is path of a one or more files (DiskDump only)
+        FORMAT:     "format",   // value is one of FORMAT values below
+        COMMENTS:   "comments", // value is either "true" or "false"
+        DECIMAL:    "decimal",  // value is either "true" to force all numbers to decimal, "false" or undefined otherwise
+        MBHD:       "mbhd",     // value is hard drive size in Mb (formerly "mbsize") (DiskDump only) (DEPRECATED)
+        SIZE:       "size"      // value is target disk size in Kb (supersedes "mbhd") (DiskDump only)
+    },
+    FORMAT: {
+        JSON:       "json",     // default
+        JSON_GZ:    "gz",       // gzip is currently used ONLY for compressed JSON
+        DATA:       "data",     // same as "json", but built without JSON.stringify() (DiskDump only)
+        HEX:        "hex",      // deprecated
+        OCTAL:      "octal",    // displays data as octal words
+        BYTES:      "bytes",    // displays data as hex bytes; normally used only when comments are enabled
+        WORDS:      "words",    // displays data as hex words; normally used only when comments are enabled
+        LONGS:      "longs",    // displays data as dwords
+        IMG:        "img",      // returns the raw disk data (ie, using a Buffer object) (DiskDump only)
+        ROM:        "rom"       // returns the raw file data (ie, using a Buffer object) (FileDump only)
+    }
+};
+
+/*
+ * Because we use an overloaded API endpoint (ie, one that's shared with the FileDump module), we must
+ * also provide a list of commands which, when combined with the endpoint, define a unique request.
+ */
+DumpAPI.asDiskCommands = [DumpAPI.QUERY.DIR, DumpAPI.QUERY.DISK, DumpAPI.QUERY.PATH];
+DumpAPI.asFileCommands = [DumpAPI.QUERY.FILE];
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/reportapi.js (C) Jeff Parsons 2012-2017
+ */
+
+var ReportAPI = {
+    ENDPOINT:       "/api/v1/report",
+    QUERY: {
+        APP:        "app",
+        VER:        "ver",
+        URL:        "url",
+        USER:       "user",
+        TYPE:       "type",
+        DATA:       "data"
+    },
+    TYPE: {
+        BUG:        "bug"
+    },
+    RES: {
+        OK:         "Thank you"
+    }
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/userapi.js (C) Jeff Parsons 2012-2017
+ */
+
+/*
+ * Examples of User API requests:
+ *
+ *      web.getHost() + UserAPI.ENDPOINT + '?' + UserAPI.QUERY.REQ + '=' + UserAPI.REQ.VERIFY + '&' + UserAPI.QUERY.USER + '=' + sUser;
+ */
+var UserAPI = {
+    ENDPOINT:       "/api/v1/user",
+    QUERY: {
+        REQ:        "req",      // specifies a request
+        USER:       "user",     // specifies a user ID
+        STATE:      "state",    // specifies a state ID
+        DATA:       "data"      // specifies state data
+    },
+    REQ: {
+        CREATE:     "create",   // creates a user ID
+        VERIFY:     "verify",   // requests verification of a user ID
+        STORE:      "store",    // stores a machine state on the server
+        LOAD:       "load"      // loads a machine state from the server
+    },
+    RES: {
+        CODE:       "code",
+        DATA:       "data"
+    },
+    CODE: {
+        OK:         "ok",
+        FAIL:       "error"
+    },
+    FAIL: {
+        DUPLICATE:  "user already exists",
+        VERIFY:     "unable to verify user",
+        BADSTATE:   "invalid state parameter",
+        NOSTATE:    "no machine state",
+        BADLOAD:    "unable to load machine state",
+        BADSTORE:   "unable to save machine state"
+    }
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/keys.js (C) Jeff Parsons 2012-2017
+ */
+
+var Keys = {
+    /*
+     * Keys and/or key combinations that generate common ASCII codes.
+     *
+     * NOTE: If you're looking for a general-purpose ASCII code table, see Str.ASCII in strlib.js;
+     * if something's missing, that's probably the more appropriate table to add it to.
+     *
+     * TODO: The Closure Compiler doesn't inline all references to these values, at least those with
+     * quoted property names, which is why I've 'unquoted' as many of them as possible.  One solution
+     * would be to add mnemonics for all of them, not just the non-printable ones (eg, SPACE instead
+     * of ' ', AMP instead of '&', etc.)
+     */
+    ASCII: {
+          BREAK:  0, CTRL_A:  1, CTRL_B:  2, CTRL_C:  3, CTRL_D:  4, CTRL_E:  5, CTRL_F:  6, CTRL_G:  7,
+         CTRL_H:  8, CTRL_I:  9, CTRL_J: 10, CTRL_K: 11, CTRL_L: 12, CTRL_M: 13, CTRL_N: 14, CTRL_O: 15,
+         CTRL_P: 16, CTRL_Q: 17, CTRL_R: 18, CTRL_S: 19, CTRL_T: 20, CTRL_U: 21, CTRL_V: 22, CTRL_W: 23,
+         CTRL_X: 24, CTRL_Y: 25, CTRL_Z: 26,
+            ' ': 32,    '!': 33,    '"': 34,    '#': 35,    '$': 36,    '%': 37,    '&': 38,    "'": 39,
+            '(': 40,    ')': 41,    '*': 42,    '+': 43,    ',': 44,    '-': 45,    '.': 46,    '/': 47,
+            '0': 48,    '1': 49,    '2': 50,    '3': 51,    '4': 52,    '5': 53,    '6': 54,    '7': 55,
+            '8': 56,    '9': 57,    ':': 58,    ';': 59,    '<': 60,    '=': 61,    '>': 62,    '?': 63,
+            '@': 64,     A:  65,     B:  66,     C:  67,     D:  68,     E:  69,     F:  70,     G:  71,
+             H:  72,     I:  73,     J:  74,     K:  75,     L:  76,     M:  77,     N:  78,     O:  79,
+             P:  80,     Q:  81,     R:  82,     S:  83,     T:  84,     U:  85,     V:  86,     W:  87,
+             X:  88,     Y:  89,     Z:  90,    '[': 91,    '\\':92,    ']': 93,    '^': 94,    '_': 95,
+            '`': 96,     a:  97,     b:  98,     c:  99,     d: 100,     e: 101,     f: 102,     g: 103,
+             h:  104,    i: 105,     j: 106,     k: 107,     l: 108,     m: 109,     n: 110,     o: 111,
+             p:  112,    q: 113,     r: 114,     s: 115,     t: 116,     u: 117,     v: 118,     w: 119,
+             x:  120,    y: 121,     z: 122,    '{':123,    '|':124,    '}':125,    '~':126,   DEL: 127
+    },
+    /*
+     * Browser keyCodes we must pay particular attention to.  For the most part, these are non-alphanumeric
+     * or function keys, some which may require special treatment (eg, preventDefault() if returning false on
+     * the initial keyDown event is insufficient).
+     *
+     * keyCodes for most common ASCII keys can simply use the appropriate ASCII code above.
+     *
+     * Most of these represent non-ASCII keys (eg, the LEFT arrow key), yet for some reason, browsers defined
+     * them using ASCII codes (eg, the LEFT arrow key uses the ASCII code for '%' or 37).
+     */
+    KEYCODE: {
+        /* 0x08 */ BS:          8,          // BACKSPACE        (ASCII.CTRL_H)
+        /* 0x09 */ TAB:         9,          // TAB              (ASCII.CTRL_I)
+        /* 0x0A */ LF:          10,         // LINE FEED        (ASCII.CTRL_J) (TODO: Determine if any key actually generates this)
+        /* 0x0D */ CR:          13,         // CARRIAGE RETURN  (ASCII.CTRL_M)
+        /* 0x10 */ SHIFT:       16,
+        /* 0x11 */ CTRL:        17,
+        /* 0x12 */ ALT:         18,
+        /* 0x13 */ PAUSE:       19,         // PAUSE/BREAK
+        /* 0x14 */ CAPS_LOCK:   20,
+        /* 0x1B */ ESC:         27,
+        /* 0x20 */ SPACE:       32,
+        /* 0x21 */ PGUP:        33,
+        /* 0x22 */ PGDN:        34,
+        /* 0x23 */ END:         35,
+        /* 0x24 */ HOME:        36,
+        /* 0x25 */ LEFT:        37,
+        /* 0x26 */ UP:          38,
+        /* 0x27 */ RIGHT:       39,
+        /* 0x27 */ FF_QUOTE:    39,
+        /* 0x28 */ DOWN:        40,
+        /* 0x2C */ FF_COMMA:    44,
+        /* 0x2C */ PRTSC:       44,
+        /* 0x2D */ INS:         45,
+        /* 0x2E */ DEL:         46,
+        /* 0x2E */ FF_PERIOD:   46,
+        /* 0x2F */ FF_SLASH:    47,
+        /* 0x30 */ ZERO:        48,
+        /* 0x31 */ ONE:         49,
+        /* 0x32 */ TWO:         50,
+        /* 0x33 */ THREE:       51,
+        /* 0x34 */ FOUR:        52,
+        /* 0x35 */ FIVE:        53,
+        /* 0x36 */ SIX:         54,
+        /* 0x37 */ SEVEN:       55,
+        /* 0x38 */ EIGHT:       56,
+        /* 0x39 */ NINE:        57,
+        /* 0x3B */ FF_SEMI:     59,
+        /* 0x3D */ FF_EQUALS:   61,
+        /* 0x5B */ CMD:         91,         // aka WIN
+        /* 0x5B */ FF_LBRACK:   91,
+        /* 0x5C */ FF_BSLASH:   92,
+        /* 0x5D */ RCMD:        93,         // aka MENU
+        /* 0x5D */ FF_RBRACK:   93,
+        /* 0x60 */ NUM_0:       96,
+        /* 0x60 */ NUM_INS:     96,
+        /* 0x60 */ FF_BQUOTE:   96,
+        /* 0x61 */ NUM_1:       97,
+        /* 0x61 */ NUM_END:     97,
+        /* 0x62 */ NUM_2:       98,
+        /* 0x62 */ NUM_DOWN:    98,
+        /* 0x63 */ NUM_3:       99,
+        /* 0x63 */ NUM_PGDN:    99,
+        /* 0x64 */ NUM_4:       100,
+        /* 0x64 */ NUM_LEFT:    100,
+        /* 0x65 */ NUM_5:       101,
+        /* 0x65 */ NUM_CENTER:  101,
+        /* 0x66 */ NUM_6:       102,
+        /* 0x66 */ NUM_RIGHT:   102,
+        /* 0x67 */ NUM_7:       103,
+        /* 0x67 */ NUM_HOME:    103,
+        /* 0x68 */ NUM_8:       104,
+        /* 0x68 */ NUM_UP:      104,
+        /* 0x69 */ NUM_9:       105,
+        /* 0x69 */ NUM_PGUP:    105,
+        /* 0x6A */ NUM_MUL:     106,
+        /* 0x6B */ NUM_ADD:     107,
+        /* 0x6D */ NUM_SUB:     109,
+        /* 0x6E */ NUM_DEL:     110,        // aka PERIOD
+        /* 0x6F */ NUM_DIV:     111,
+        /* 0x70 */ F1:          112,
+        /* 0x71 */ F2:          113,
+        /* 0x72 */ F3:          114,
+        /* 0x73 */ F4:          115,
+        /* 0x74 */ F5:          116,
+        /* 0x75 */ F6:          117,
+        /* 0x76 */ F7:          118,
+        /* 0x77 */ F8:          119,
+        /* 0x78 */ F9:          120,
+        /* 0x79 */ F10:         121,
+        /* 0x7A */ F11:         122,
+        /* 0x7B */ F12:         123,
+        /* 0x90 */ NUM_LOCK:    144,
+        /* 0x91 */ SCROLL_LOCK: 145,
+        /* 0xAD */ FF_DASH:     173,
+        /* 0xBA */ SEMI:        186,        // Firefox:  59 (FF_SEMI)
+        /* 0xBB */ EQUALS:      187,        // Firefox:  61 (FF_EQUALS)
+        /* 0xBC */ COMMA:       188,
+        /* 0xBD */ DASH:        189,        // Firefox: 173 (FF_DASH)
+        /* 0xBE */ PERIOD:      190,
+        /* 0xBF */ SLASH:       191,
+        /* 0xC0 */ BQUOTE:      192,
+        /* 0xDB */ LBRACK:      219,
+        /* 0xDC */ BSLASH:      220,
+        /* 0xDD */ RBRACK:      221,
+        /* 0xDE */ QUOTE:       222,
+        /* 0xE0 */ FF_CMD:      224,        // Firefox only (used for both CMD and RCMD)
+        //
+        // The following biases use what I'll call Decimal Coded Binary or DCB (the opposite of BCD),
+        // where the thousands digit is used to store the sum of "binary" digits 1 and/or 2 and/or 4.
+        //
+        // Technically, that makes it DCO (Decimal Coded Octal), but then again, BCD should have really
+        // been called HCD (Hexadecimal Coded Decimal), so if "they" can take liberties, so can I.
+        //
+        // ONDOWN is a bias we add to browser keyCodes that we want to handle on "down" rather than on "press".
+        //
+        ONDOWN:                 1000,
+        //
+        // ONRIGHT is a bias we add to browser keyCodes that need to check for a "right" location (default is "left")
+        //
+        ONRIGHT:                2000,
+        //
+        // FAKE is a bias we add to signal these are fake keyCodes corresponding to internal keystroke combinations.
+        // The actual values are for internal use only and merely need to be unique and used consistently.
+        //
+        FAKE:                   4000
+    },
+    /*
+     * The set of values that a browser may store in the 'location' property of a keyboard event object
+     * which we also support.
+     */
+    LOCATION: {
+        LEFT:                   1,
+        RIGHT:                  2,
+        NUMPAD:                 3
+    }
+};
+
+/*
+ * Check the event object's 'location' property for a non-zero value for the following ONRIGHT keys.
+ */
+Keys.KEYCODE.NUM_CR = Keys.KEYCODE.CR + Keys.KEYCODE.ONRIGHT;
+
+
+/*
+ * Maps Firefox keyCodes to their more common keyCode counterparts; a number of entries in this table
+ * are no longer valid (if indeed they ever were), so they've been commented out.  It's likely that I
+ * simply extended this table to resolve additional differences in other browsers (ie, Opera), but without
+ * browser-specific checks, it's not safe to perform all the mappings shown below.
+ */
+Keys.FF_KEYCODES = {};
+Keys.FF_KEYCODES[Keys.KEYCODE.FF_SEMI]   = Keys.KEYCODE.SEMI;           //  59 -> 186
+Keys.FF_KEYCODES[Keys.KEYCODE.FF_EQUALS] = Keys.KEYCODE.EQUALS;         //  61 -> 187
+Keys.FF_KEYCODES[Keys.KEYCODE.FF_DASH]   = Keys.KEYCODE.DASH;           // 173 -> 189
+Keys.FF_KEYCODES[Keys.KEYCODE.FF_CMD]    = Keys.KEYCODE.CMD;            // 224 -> 91
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_COMMA]  = Keys.KEYCODE.COMMA;       //  44 -> 188
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_PERIOD] = Keys.KEYCODE.PERIOD;      //  46 -> 190
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_SLASH]  = Keys.KEYCODE.SLASH;       //  47 -> 191
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_BQUOTE] = Keys.KEYCODE.BQUOTE;      //  96 -> 192
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_LBRACK  = Keys.KEYCODE.LBRACK;      //  91 -> 219
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_BSLASH] = Keys.KEYCODE.BSLASH;      //  92 -> 220
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_RBRACK] = Keys.KEYCODE.RBRACK;      //  93 -> 221
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_QUOTE]  = Keys.KEYCODE.QUOTE;       //  39 -> 222
+
+/*
+ * Maps non-ASCII keyCodes to their ASCII counterparts
+ */
+Keys.NONASCII_KEYCODES = {};
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.FF_DASH] = Keys.ASCII['-'];         // 173 -> 45
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.SEMI]    = Keys.ASCII[';'];         // 186 -> 59
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.EQUALS]  = Keys.ASCII['='];         // 187 -> 61
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.DASH]    = Keys.ASCII['-'];         // 189 -> 45
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.COMMA]   = Keys.ASCII[','];         // 188 -> 44
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.PERIOD]  = Keys.ASCII['.'];         // 190 -> 46
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.SLASH]   = Keys.ASCII['/'];         // 191 -> 47
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.BQUOTE]  = Keys.ASCII['`'];         // 192 -> 96
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.LBRACK]  = Keys.ASCII['['];         // 219 -> 91
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.BSLASH]  = Keys.ASCII['\\'];        // 220 -> 92
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.RBRACK]  = Keys.ASCII[']'];         // 221 -> 93
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.QUOTE]   = Keys.ASCII["'"];         // 222 -> 39
+
+/*
+ * Maps unshifted keyCodes to their shifted counterparts; to be used when a shift-key is down.
+ * Alphabetic characters are handled in code, since they must also take CAPS_LOCK into consideration.
+ */
+Keys.SHIFTED_KEYCODES = {};
+Keys.SHIFTED_KEYCODES[Keys.ASCII['1']]     = Keys.ASCII['!'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['2']]     = Keys.ASCII['@'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['3']]     = Keys.ASCII['#'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['4']]     = Keys.ASCII['$'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['5']]     = Keys.ASCII['%'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['6']]     = Keys.ASCII['^'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['7']]     = Keys.ASCII['&'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['8']]     = Keys.ASCII['*'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['9']]     = Keys.ASCII['('];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['0']]     = Keys.ASCII[')'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.SEMI]   = Keys.ASCII[':'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.EQUALS] = Keys.ASCII['+'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.COMMA]  = Keys.ASCII['<'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.DASH]   = Keys.ASCII['_'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.PERIOD] = Keys.ASCII['>'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.SLASH]  = Keys.ASCII['?'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.BQUOTE] = Keys.ASCII['~'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.LBRACK] = Keys.ASCII['{'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.BSLASH] = Keys.ASCII['|'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.RBRACK] = Keys.ASCII['}'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.QUOTE]  = Keys.ASCII['"'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.FF_DASH]   = Keys.ASCII['_'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.FF_EQUALS] = Keys.ASCII['+'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.FF_SEMI]   = Keys.ASCII[':'];
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/strlib.js (C) Jeff Parsons 2012-2017
+ */
+
+class Str {
+    /**
+     * isValidInt(s, base)
+     *
+     * The built-in parseInt() function has the annoying feature of returning a partial value (ie,
+     * up to the point where it encounters an invalid character); eg, parseInt("foo", 16) returns 0xf.
+     *
+     * So it's best to use our own Str.parseInt() function, which will in turn use this function to
+     * validate the entire string.
+     *
+     * @param {string} s is the string representation of some number
+     * @param {number} [base] is the radix to use (default is 10); only 2, 8, 10 and 16 are supported
+     * @return {boolean} true if valid, false if invalid (or the specified base isn't supported)
+     */
+    static isValidInt(s, base)
+    {
+        if (!base || base == 10) return s.match(/^-?[0-9]+$/) !== null;
+        if (base == 16) return s.match(/^-?[0-9a-f]+$/i) !== null;
+        if (base == 8) return s.match(/^-?[0-7]+$/) !== null;
+        if (base == 2) return s.match(/^-?[01]+$/) !== null;
+        return false;
+    }
+
+    /**
+     * parseInt(s, base)
+     *
+     * This is a wrapper around the built-in parseInt() function.  Our wrapper recognizes certain prefixes
+     * ('$' or "0x" for hex, '#' or "0o" for octal) and suffixes ('.' for decimal, 'h' for hex, 'y' for
+     * binary), and then calls isValidInt() to ensure we don't convert strings that contain partial values;
+     * see isValidInt() for details.
+     *
+     * The use of multiple prefix/suffix combinations is undefined (although for the record, we process
+     * prefixes first).  We do NOT support the "0b" prefix to indicate binary UNLESS one or more commas are
+     * also present (because "0b" is also a valid hex sequence), and we do NOT support a single leading zero
+     * to indicate octal (because such a number could also be decimal or hex).  Any number of commas are
+     * allowed; we remove them all before calling the built-in parseInt().
+     *
+     * More recently, we've added support for "^D", "^O", and "^B" prefixes to accommodate the base overrides
+     * that the PDP-10's MACRO-10 assembly language supports (decimal, octal, and binary, respectively).
+     * If this support turns out to adversely affect other debuggers, then it will have to be "conditionalized".
+     * Similarly, we've added support for "K", "M", and "G" MACRO-10-style suffixes that add 3, 6, or 9 zeros
+     * to the value to be parsed, respectively.
+     *
+     * @param {string} s is the string representation of some number
+     * @param {number} [base] is the radix to use (default is 10); can be overridden by prefixes/suffixes
+     * @return {number|undefined} corresponding value, or undefined if invalid
+     */
+    static parseInt(s, base)
+    {
+        var value;
+
+        if (s) {
+            if (!base) base = 10;
+
+            var ch, chPrefix, chSuffix;
+            var fCommas = (s.indexOf(',') > 0);
+            if (fCommas) s = s.replace(/,/g, '');
+
+            ch = chPrefix = s.charAt(0);
+            if (chPrefix == '#') {
+                base = 8;
+                chPrefix = '';
+            }
+            else if (chPrefix == '$') {
+                base = 16;
+                chPrefix = '';
+            }
+            if (ch != chPrefix) {
+                s = s.substr(1);
+            }
+            else {
+                ch = chPrefix = s.substr(0, 2);
+                if (chPrefix == '0b' && fCommas || chPrefix == '^B') {
+                    base = 2;
+                    chPrefix = '';
+                }
+                else if (chPrefix == '0o' || chPrefix == '^O') {
+                    base = 8;
+                    chPrefix = '';
+                }
+                else if (chPrefix == '^D') {
+                    base = 10;
+                    chPrefix = '';
+                }
+                else if (chPrefix == '0x') {
+                    base = 16;
+                    chPrefix = '';
+                }
+                if (ch != chPrefix) s = s.substr(2);
+            }
+            ch = chSuffix = s.slice(-1);
+            if (chSuffix == 'Y' || chSuffix == 'y') {
+                base = 2;
+                chSuffix = '';
+            }
+            else if (chSuffix == '.') {
+                base = 10;
+                chSuffix = '';
+            }
+            else if (chSuffix == 'H' || chSuffix == 'h') {
+                base = 16;
+                chSuffix = '';
+            }
+            else if (chSuffix == 'K') {
+                chSuffix = '000';
+            }
+            else if (chSuffix == 'M') {
+                chSuffix = '000000';
+            }
+            else if (chSuffix == 'G') {
+                chSuffix = '000000000';
+            }
+            if (ch != chSuffix) s = s.slice(0, -1) + chSuffix;
+            /*
+             * This adds support for the MACRO-10 binary shifting (Bn) suffix, which must be stripped from the
+             * number before parsing, and then applied to the value after parsing.  If n is omitted, 35 is assumed,
+             * which is a net shift of zero.  If n < 35, then a left shift of (35 - n) is required; if n > 35, then
+             * a right shift of -(35 - n) is required.
+             */
+            var v, shift = 0;
+            if (base <= 10) {
+                var match = s.match(/(-?[0-9]+)B([0-9]*)/);
+                if (match) {
+                    s = match[1];
+                    shift = 35 - ((match[2] || 35) & 0xff);
+                }
+            }
+            if (Str.isValidInt(s, base) && !isNaN(v = parseInt(s, base))) {
+                /*
+                 * With the need to support larger (eg, 36-bit) integers, truncating to 32 bits is no longer helpful.
+                 *
+                 *      value = v|0;
+                 */
+                if (shift) {
+                    /*
+                     * Since binary shifting is a logical operation, and since shifting by division only works properly
+                     * with positive numbers, we must convert a negative value to a positive value, by computing the two's
+                     * complement.
+                     */
+                    if (v < 0) v += Math.pow(2, 36);
+                    if (shift > 0) {
+                        v *= Math.pow(2, shift);
+                    } else {
+                        v = Math.trunc(v / Math.pow(2, -shift));
+                    }
+                }
+                value = v;
+            }
+        }
+        return value;
+    }
+
+    /**
+     * toBase(n, radix, cch, sPrefix, nGrouping)
+     *
+     * Displays the given number as an unsigned integer using the specified radix and number of digits.
+     *
+     * @param {number|null|undefined} n
+     * @param {number} radix (ie, the base)
+     * @param {number} cch (the desired number of digits)
+     * @param {string} [sPrefix] (default is none)
+     * @param {number} [nGrouping]
+     * @return {string}
+     */
+    static toBase(n, radix, cch, sPrefix = "", nGrouping = 0)
+    {
+        /*
+         * An initial "falsey" check for null takes care of both null and undefined;
+         * we can't rely entirely on isNaN(), because isNaN(null) returns false, oddly enough.
+         *
+         * Alternatively, we could mask and shift n regardless of whether it's null/undefined/NaN,
+         * since JavaScript coerces such operands to zero, but I think there's "value" in seeing those
+         * values displayed differently.
+         */
+        var s = "";
+        if (isNaN(n)) {
+            n = null;
+        } else if (n != null) {
+            /*
+             * Callers that produced an input by dividing by a power of two rather than shifting (in order
+             * to access more than 32 bits) may produce a fractional result, which ordinarily we would simply
+             * ignore, but if the integer portion is zero and the sign is negative, we should probably treat
+             * this value as a sign-extension.
+             */
+            if (n < 0 && n > -1) n = -1;
+            /*
+             * Negative values should be two's complemented according to the number of digits; for example,
+             * 12 octal digits implies an upper limit 8^12.
+             */
+            if (n < 0) {
+                n += Math.pow(radix, cch);
+            }
+            if (n >= Math.pow(radix, cch)) {
+                cch = Math.ceil(Math.log(n) / Math.log(radix));
+            }
+        }
+        var g = nGrouping || -1;
+        while (cch-- > 0) {
+            if (!g) {
+                s = ',' + s;
+                g = nGrouping;
+            }
+            if (n == null) {
+                s = '?' + s;
+            } else {
+                var d = n % radix;
+                d += (d >= 0 && d <= 9? 0x30 : 0x41 - 10);
+                s = String.fromCharCode(d) + s;
+                n = Math.trunc(n / radix);
+            }
+            g--;
+        }
+        return sPrefix + s;
+    }
+
+    /**
+     * toBin(n, cch, nGrouping)
+     *
+     * Converts an integer to binary, with the specified number of digits (up to a maximum of 36).
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of binary digits (0 or undefined for default of either 8, 18, or 36)
+     * @param {number} [nGrouping]
+     * @return {string} the binary representation of n
+     */
+    static toBin(n, cch, nGrouping)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.LN2) || 1;
+            var v = Math.abs(n);
+            if (v <= 0b11111111) {
+                cch = 8;
+            } else if (v <= 0b111111111111111111) {
+                cch = 18;
+            } else {
+                cch = 36;
+            }
+        } else if (cch > 36) cch = 36;
+        return Str.toBase(n, 2, cch, "", nGrouping);
+    }
+
+    /**
+     * toBinBytes(n, cb, fPrefix)
+     *
+     * Converts an integer to binary, with the specified number of bytes (up to the default of 4).
+     *
+     * @param {number|null|undefined} n (interpreted as a 32-bit value)
+     * @param {number} [cb] is the desired number of binary bytes (4 is both the default and the maximum)
+     * @param {boolean} [fPrefix]
+     * @return {string} the binary representation of n
+     */
+    static toBinBytes(n, cb, fPrefix)
+    {
+        var s = "";
+        if (!cb || cb > 4) cb = 4;
+        for (var i = 0; i < cb; i++) {
+            if (s) s = ',' + s;
+            s = Str.toBin(n & 0xff, 8) + s;
+            n >>= 8;
+        }
+        return (fPrefix? "0b" : "") + s;
+    }
+
+    /**
+     * toOct(n, cch, fPrefix)
+     *
+     * Converts an integer to octal, with the specified number of digits (default of 6; max of 12)
+     *
+     * You might be tempted to use the built-in n.toString(8) instead, but it doesn't zero-pad and it
+     * doesn't properly convert negative values.  Moreover, if n is undefined, n.toString() will throw
+     * an exception, whereas this function will return '?' characters.
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of octal digits (0 or undefined for default of either 6, 8, or 12)
+     * @param {boolean} [fPrefix]
+     * @return {string} the octal representation of n
+     */
+    static toOct(n, cch, fPrefix)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.log(8)) || 1;
+            var v = Math.abs(n);
+            if (v <= 0o777777) {
+                cch = 6;
+            } else if (v <= 0o77777777) {
+                cch = 8;
+            } else {
+                cch = 12;
+            }
+        } else if (cch > 12) cch = 12;
+        return Str.toBase(n, 8, cch, fPrefix? "0o" : "");
+    }
+
+    /**
+     * toDec(n, cch)
+     *
+     * Converts an integer to decimal, with the specified number of digits (default of 5; max of 11)
+     *
+     * You might be tempted to use the built-in n.toString(10) instead, but it doesn't zero-pad and it
+     * doesn't properly convert negative values.  Moreover, if n is undefined, n.toString() will throw
+     * an exception, whereas this function will return '?' characters.
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of decimal digits (0 or undefined for default of either 5 or 11)
+     * @return {string} the decimal representation of n
+     */
+    static toDec(n, cch)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.LN10) || 1;
+            var v = Math.abs(n);
+            if (v <= 99999) {
+                cch = 5;
+            } else {
+                cch = 11;
+            }
+        } else if (cch > 11) cch = 11;
+        return Str.toBase(n, 10, cch);
+    }
+
+    /**
+     * toHex(n, cch, fPrefix)
+     *
+     * Converts an integer to hex, with the specified number of digits (default of 4 or 8, max of 9).
+     *
+     * You might be tempted to use the built-in n.toString(16) instead, but it doesn't zero-pad and it
+     * doesn't properly convert negative values; for example, if n is -2147483647, then n.toString(16)
+     * will return "-7fffffff" instead of "80000001".  Moreover, if n is undefined, n.toString() will
+     * throw an exception, whereas this function will return '?' characters.
+     *
+     * NOTE: The following work-around (adapted from code found on StackOverflow) would be another solution,
+     * taking care of negative values, zero-padding, and upper-casing, but not null/undefined/NaN values:
+     *
+     *      s = (n < 0? n + 0x100000000 : n).toString(16);
+     *      s = "00000000".substr(0, 8 - s.length) + s;
+     *      s = s.substr(0, cch).toUpperCase();
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of hex digits (0 or undefined for default of either 4, 8, or 9)
+     * @param {boolean} [fPrefix]
+     * @return {string} the hex representation of n
+     */
+    static toHex(n, cch, fPrefix)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.log(16)) || 1;
+            var v = Math.abs(n);
+            if (v <= 0xffff) {
+                cch = 4;
+            } else if (v <= 0xffffffff) {
+                cch = 8;
+            } else {
+                cch = 9;
+            }
+        } else if (cch > 9) cch = 9;
+        return Str.toBase(n, 16, cch, fPrefix? "0x" : "");
+    }
+
+    /**
+     * toHexByte(b)
+     *
+     * Alias for Str.toHex(b, 2, true)
+     *
+     * @param {number|null|undefined} b is a byte value
+     * @return {string} the hex representation of b
+     */
+    static toHexByte(b)
+    {
+        return Str.toHex(b, 2, true);
+    }
+
+    /**
+     * toHexWord(w)
+     *
+     * Alias for Str.toHex(w, 4, true)
+     *
+     * @param {number|null|undefined} w is a word (16-bit) value
+     * @return {string} the hex representation of w
+     */
+    static toHexWord(w)
+    {
+        return Str.toHex(w, 4, true);
+    }
+
+    /**
+     * toHexLong(l)
+     *
+     * Alias for Str.toHex(l, 8, true)
+     *
+     * @param {number|null|undefined} l is a dword (32-bit) value
+     * @return {string} the hex representation of w
+     */
+    static toHexLong(l)
+    {
+        return Str.toHex(l, 8, true);
+    }
+
+    /**
+     * getBaseName(sFileName, fStripExt)
+     *
+     * This is a poor-man's version of Node's path.basename(), which Node-only components should use instead.
+     *
+     * Note that if fStripExt is true, this strips ANY extension, whereas path.basename() strips the extension only
+     * if it matches the second parameter (eg, path.basename("/foo/bar/baz/asdf/quux.html", ".html") returns "quux").
+     *
+     * @param {string} sFileName
+     * @param {boolean} [fStripExt]
+     * @return {string}
+     */
+    static getBaseName(sFileName, fStripExt)
+    {
+        var sBaseName = sFileName;
+
+        var i = sFileName.lastIndexOf('/');
+        if (i >= 0) sBaseName = sFileName.substr(i + 1);
+
+        /*
+         * This next bit is a kludge to clean up names that are part of a URL that includes unsightly query parameters.
+         */
+        i = sBaseName.indexOf('&');
+        if (i > 0) sBaseName = sBaseName.substr(0, i);
+
+        if (fStripExt) {
+            i = sBaseName.lastIndexOf(".");
+            if (i > 0) {
+                sBaseName = sBaseName.substring(0, i);
+            }
+        }
+        return sBaseName;
+    }
+
+    /**
+     * getExtension(sFileName)
+     *
+     * This is a poor-man's version of Node's path.extname(), which Node-only components should use instead.
+     *
+     * Note that we EXCLUDE the period from the returned extension, whereas path.extname() includes it.
+     *
+     * @param {string} sFileName
+     * @return {string} the filename's extension (in lower-case and EXCLUDING the "."), or an empty string
+     */
+    static getExtension(sFileName)
+    {
+        var sExtension = "";
+        var i = sFileName.lastIndexOf(".");
+        if (i >= 0) {
+            sExtension = sFileName.substr(i + 1).toLowerCase();
+        }
+        return sExtension;
+    }
+
+    /**
+     * endsWith(s, sSuffix)
+     *
+     * @param {string} s
+     * @param {string} sSuffix
+     * @return {boolean} true if s ends with sSuffix, false if not
+     */
+    static endsWith(s, sSuffix)
+    {
+        return s.indexOf(sSuffix, s.length - sSuffix.length) !== -1;
+    }
+
+    /**
+     * escapeHTML(sHTML)
+     *
+     * @param {string} sHTML
+     * @return {string} with HTML entities "escaped", similar to PHP's htmlspecialchars()
+     */
+    static escapeHTML(sHTML)
+    {
+        return sHTML.replace(/[&<>"']/g, function(m)
+        {
+            return Str.aHTMLEscapeMap[m];
+        });
+    }
+
+    /**
+     * replaceAll(sFind, sReplace, s)
+     *
+     * @param {string} sFind
+     * @param {string} sReplace
+     * @param {string} s
+     * @return {string}
+     */
+    static replaceAll(sFind, sReplace, s)
+    {
+        var a = {};
+        a[sFind] = sReplace;
+        return Str.replaceArray(a, s);
+    }
+
+    /**
+     * replaceArray(a, s)
+     *
+     * @param {Object} a
+     * @param {string} s
+     * @return {string}
+     */
+    static replaceArray(a, s)
+    {
+        var sMatch = "";
+        for (var k in a) {
+            /*
+             * As noted in:
+             *
+             *      http://www.regexguru.com/2008/04/escape-characters-only-when-necessary/
+             *
+             * inside character classes, only backslash, caret, hyphen and the closing bracket need to be
+             * escaped.  And in fact, if you ensure that the closing bracket is first, the caret is not first,
+             * and the hyphen is last, you can avoid escaping those as well.
+             */
+            k = k.replace(/([\\[\]*{}().+?])/g, "\\$1");
+            sMatch += (sMatch? '|' : '') + k;
+        }
+        return s.replace(new RegExp('(' + sMatch + ')', "g"), function(m)
+        {
+            return a[m];
+        });
+    }
+
+    /**
+     * pad(s, cch, fPadLeft)
+     *
+     * NOTE: the maximum amount of padding currently supported is 40 spaces.
+     *
+     * @param {string} s is a string
+     * @param {number} cch is desired length
+     * @param {boolean} [fPadLeft] (default is padding on the right)
+     * @return {string} the original string (s) with spaces padding it to the specified length
+     */
+    static pad(s, cch, fPadLeft)
+    {
+        var sPadding = "                                        ";
+        return fPadLeft? (sPadding + s).slice(-cch) : (s + sPadding).slice(0, cch);
+    }
+
+    /**
+     * stripLeadingZeros(s, fPad)
+     *
+     * @param {string} s
+     * @param {boolean} [fPad]
+     * @return {string}
+     */
+    static stripLeadingZeros(s, fPad)
+    {
+        var cch = s.length;
+        s = s.replace(/^0+([0-9A-F]+)$/i, "$1");
+        if (fPad) s = Str.pad(s, cch, true);
+        return s;
+    }
+
+    /**
+     * trim(s)
+     *
+     * @param {string} s
+     * @return {string}
+     */
+    static trim(s)
+    {
+        if (String.prototype.trim) {
+            return s.trim();
+        }
+        return s.replace(/^\s+|\s+$/g, "");
+    }
+
+    /**
+     * toASCIICode(b)
+     *
+     * @param {number} b
+     * @return {string}
+     */
+    static toASCIICode(b)
+    {
+        var s;
+        if (b != Str.ASCII.CR && b != Str.ASCII.LF) {
+            s = Str.aASCIICodes[b];
+        }
+        if (s) {
+            s = '<' + s + '>';
+        } else {
+            s = String.fromCharCode(b);
+        }
+        return s;
+    }
+}
+
+Str.aHTMLEscapeMap = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#039;'
+};
+
+/*
+ * Future home of a general-purpose ASCII table.  TODO: Flesh it out.
+ */
+Str.ASCII = {
+    LF:     0x0A,
+    CR:     0x0D
+};
+
+/*
+ * Table for converting "unprintable" ASCII codes into mnemonics, to more clearly see what's being printed.
+ */
+Str.aASCIICodes = {
+    0x00:   "NUL",
+    0x01:   "SOH",      // (CTRL_A) Start of Heading
+    0x02:   "STX",      // (CTRL_B) Start of Text
+    0x03:   "ETX",      // (CTRL_C) End of Text
+    0x04:   "EOT",      // (CTRL_D) End of Transmission
+    0x05:   "ENQ",      // (CTRL_E) Enquiry
+    0x06:   "ACK",      // (CTRL_F) Acknowledge
+    0x07:   "BEL",      // (CTRL_G) Bell
+    0x08:   "BS",       // (CTRL_H) Backspace
+    0x09:   "TAB",      // (CTRL_I) Horizontal Tab
+    0x0A:   "LF",       // (CTRL_J) Line Feed (New Line)
+    0x0B:   "VT",       // (CTRL_K) Vertical Tab
+    0x0C:   "FF",       // (CTRL_L) Form Feed (New Page)
+    0x0D:   "CR",       // (CTRL_M) Carriage Return
+    0x0E:   "SO",       // (CTRL_N) Shift Out
+    0x0F:   "SI",       // (CTRL_O) Shift In
+    0x10:   "DLE",      // (CTRL_P) Data Link Escape
+    0x11:   "XON",      // (CTRL_Q) Device Control 1 (aka DC1)
+    0x12:   "DC2",      // (CTRL_R) Device Control 2
+    0x13:   "XOFF",     // (CTRL_S) Device Control 3 (aka DC3)
+    0x14:   "DC4",      // (CTRL_T) Device Control 4
+    0x15:   "NAK",      // (CTRL_U) Negative Acknowledge
+    0x16:   "SYN",      // (CTRL_V) Synchronous Idle
+    0x17:   "ETB",      // (CTRL_W) End of Transmission Block
+    0x18:   "CAN",      // (CTRL_X) Cancel
+    0x19:   "EM",       // (CTRL_Y) End of Medium
+    0x1A:   "SUB",      // (CTRL_Z) Substitute
+    0x1B:   "ESC",      // Escape
+    0x1C:   "FS",       // File Separator
+    0x1D:   "GS",       // Group Separator
+    0x1E:   "RS",       // Record Separator
+    0x1F:   "US"        // Unit Separator
+};
+
+Str.TYPES = {
+    NULL:       0,
+    BYTE:       1,
+    WORD:       2,
+    DWORD:      3,
+    NUMBER:     4,
+    STRING:     5,
+    BOOLEAN:    6,
+    OBJECT:     7,
+    ARRAY:      8
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/usrlib.js (C) Jeff Parsons 2012-2017
+ */
+
+/**
+ * @typedef {{
+ *  mask:       number,
+ *  shift:      number
+ * }}
+ */
+var BitField;
+
+/**
+ * @typedef {Object.<BitField>}
+ */
+var BitFields;
+
+class Usr {
+    /**
+     * binarySearch(a, v, fnCompare)
+     *
+     * @param {Array} a is an array
+     * @param {number|string|Array|Object} v
+     * @param {function((number|string|Array|Object), (number|string|Array|Object))} [fnCompare]
+     * @return {number} the index of matching entry if non-negative, otherwise the index of the insertion point
+     */
+    static binarySearch(a, v, fnCompare)
+    {
+        var left = 0;
+        var right = a.length;
+        var found = 0;
+        if (fnCompare === undefined) {
+            fnCompare = function(a, b)
+            {
+                return a > b ? 1 : a < b ? -1 : 0;
+            };
+        }
+        while (left < right) {
+            var middle = (left + right) >> 1;
+            var compareResult;
+            compareResult = fnCompare(v, a[middle]);
+            if (compareResult > 0) {
+                left = middle + 1;
+            } else {
+                right = middle;
+                found = !compareResult;
+            }
+        }
+        return found ? left : ~left;
+    }
+
+    /**
+     * binaryInsert(a, v, fnCompare)
+     *
+     * If element v already exists in array a, the array is unchanged (we don't allow duplicates); otherwise, the
+     * element is inserted into the array at the appropriate index.
+     *
+     * @param {Array} a is an array
+     * @param {number|string|Array|Object} v is the value to insert
+     * @param {function((number|string|Array|Object), (number|string|Array|Object))} [fnCompare]
+     */
+    static binaryInsert(a, v, fnCompare)
+    {
+        var index = Usr.binarySearch(a, v, fnCompare);
+        if (index < 0) {
+            a.splice(-(index + 1), 0, v);
+        }
+    }
+
+    /**
+     * getTimestamp()
+     *
+     * @return {string} timestamp containing the current date and time ("yyyy-mm-dd hh:mm:ss")
+     */
+    static getTimestamp()
+    {
+        var date = new Date();
+        var padNum = function(n)
+        {
+            return (n < 10 ? "0" : "") + n;
+        };
+        return date.getFullYear() + "-" + padNum(date.getMonth() + 1) + "-" + padNum(date.getDate()) + " " + padNum(date.getHours()) + ":" + padNum(date.getMinutes()) + ":" + padNum(date.getSeconds());
+    }
+
+    /**
+     * getMonthDays(nMonth, nYear)
+     *
+     * Note that if we're being called on behalf of the RTC, its year is always truncated to two digits (mod 100),
+     * so we have no idea what century the year 0 might refer to.  When using the normal leap-year formula, 0 fails
+     * the mod 100 test but passes the mod 400 test, so as far as the RTC is concerned, every century year is a leap
+     * year.  Since we're most likely dealing with the year 2000, that's fine, since 2000 was also a leap year.
+     *
+     * TODO: There IS a separate CMOS byte that's supposed to be set to CMOS_ADDR.CENTURY_DATE; it's always BCD,
+     * so theoretically it will contain values like 0x19 or 0x20 (for the 20th and 21st centuries, respectively), and
+     * we could add that as another parameter to this function, to improve the accuracy, but that would go beyond what
+     * a real RTC actually does.
+     *
+     * @param {number} nMonth (1-12)
+     * @param {number} nYear (normally a 4-digit year, but it may also be mod 100)
+     * @return {number} the maximum (1-based) day allowed for the specified month and year
+     */
+    static getMonthDays(nMonth, nYear)
+    {
+        var nDays = Usr.aMonthDays[nMonth - 1];
+        if (nDays == 28) {
+            if ((nYear % 4) === 0 && ((nYear % 100) || (nYear % 400) === 0)) {
+                nDays++;
+            }
+        }
+        return nDays;
+    }
+
+    /**
+     * formatDate(sFormat, date)
+     *
+     * @param {string} sFormat (eg, "F j, Y", "Y-m-d H:i:s")
+     * @param {Date} [date] (default is the current time)
+     * @return {string}
+     *
+     * Supported identifiers in sFormat include:
+     *
+     *      a:  lowercase ante meridiem and post meridiem (am or pm)
+     *      d:  day of the month, 2 digits with leading zeros (01,...,31)
+     *      g:  hour in 12-hour format, without leading zeros (1,...,12)
+     *      i:  minutes, with leading zeros (00,...,59)
+     *      j:  day of the month, without leading zeros (1,...,31)
+     *      l:  day of the week ("Sunday",...,"Saturday")
+     *      m:  month, with leading zeros (01,...,12)
+     *      s:  seconds, with leading zeros (00,...,59)
+     *      F:  month ("January",...,"December")
+     *      H:  hour in 24-hour format, with leading zeros (00,...,23)
+     *      Y:  year (eg, 2014)
+     *
+     * For more inspiration, see: http://php.net/manual/en/function.date.php
+     */
+    static formatDate(sFormat, date)
+    {
+        var sDate = "";
+        if (!date) date = new Date();
+        var iHour = date.getHours();
+        var iDay = date.getDate();
+        var iMonth = date.getMonth() + 1;
+        for (var i = 0; i < sFormat.length; i++) {
+            var ch;
+            switch ((ch = sFormat.charAt(i))) {
+            case 'a':
+                sDate += (iHour < 12 ? "am" : "pm");
+                break;
+            case 'd':
+                sDate += ('0' + iDay).slice(-2);
+                break;
+            case 'g':
+                sDate += (!iHour ? 12 : (iHour > 12 ? iHour - 12 : iHour));
+                break;
+            case 'i':
+                sDate += ('0' + date.getMinutes()).slice(-2);
+                break;
+            case 'j':
+                sDate += iDay;
+                break;
+            case 'l':
+                sDate += Usr.asDays[date.getDay()];
+                break;
+            case 'm':
+                sDate += ('0' + iMonth).slice(-2);
+                break;
+            case 's':
+                sDate += ('0' + date.getSeconds()).slice(-2);
+                break;
+            case 'F':
+                sDate += Usr.asMonths[iMonth - 1];
+                break;
+            case 'H':
+                sDate += ('0' + iHour).slice(-2);
+                break;
+            case 'Y':
+                sDate += date.getFullYear();
+                break;
+            default:
+                sDate += ch;
+                break;
+            }
+        }
+        return sDate;
+    }
+
+    /**
+     * defineBitFields(bfs)
+     *
+     * Prepares a bit field definition for use with getBitField() and setBitField(); eg:
+     *
+     *      var bfs = Usr.defineBitFields({num:20, count:8, btmod:1, type:3});
+     *
+     * The above defines a set of bit fields containing four fields: num (bits 0-19), count (bits 20-27), btmod (bit 28), and type (bits 29-31).
+     *
+     *      Usr.setBitField(bfs.num, n, 1);
+     *
+     * The above set bit field "bfs.num" in numeric variable "n" to the value 1.
+     *
+     * @param {Object} bfs
+     * @return {BitFields}
+     */
+    static defineBitFields(bfs)
+    {
+        var bit = 0;
+        for (var f in bfs) {
+            var width = bfs[f];
+            var mask = ((1 << width) - 1) << bit;
+            bfs[f] = {mask: mask, shift: bit};
+            bit += width;
+        }
+        return bfs;
+    }
+
+    /**
+     * initBitFields(bfs, ...)
+     *
+     * @param {BitFields} bfs
+     * @param {...number} var_args
+     * @return {number} a value containing all supplied bit fields
+     */
+    static initBitFields(bfs, var_args)
+    {
+        var v = 0, i = 1;
+        for (var f in bfs) {
+            if (i >= arguments.length) break;
+            v = Usr.setBitField(bfs[f], v, arguments[i++]);
+        }
+        return v;
+    }
+
+    /**
+     * getBitField(bf, v)
+     *
+     * @param {BitField} bf
+     * @param {number} v is a value containing bit fields
+     * @return {number} the value of the bit field in v defined by bf
+     */
+    static getBitField(bf, v)
+    {
+        return (v & bf.mask) >> bf.shift;
+    }
+
+    /**
+     * setBitField(bf, v, n)
+     *
+     * @param {BitField} bf
+     * @param {number} v is a value containing bit fields
+     * @param {number} n is a value to store in v in the bit field defined by bf
+     * @return {number} updated v
+     */
+    static setBitField(bf, v, n)
+    {
+        return (v & ~bf.mask) | ((n << bf.shift) & bf.mask);
+    }
+
+    /**
+     * indexOf(a, t, i)
+     *
+     * Use this instead of Array.prototype.indexOf() if you can't be sure the browser supports it.
+     *
+     * @param {Array} a
+     * @param {*} t
+     * @param {number} [i]
+     * @returns {number}
+     */
+    static indexOf(a, t, i)
+    {
+        if (Array.prototype.indexOf) {
+            return a.indexOf(t, i);
+        }
+        i = i || 0;
+        if (i < 0) i += a.length;
+        if (i < 0) i = 0;
+        for (var n = a.length; i < n; i++) {
+            if (i in a && a[i] === t) return i;
+        }
+        return -1;
+    }
+}
+
+Usr.asDays = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
+Usr.asMonths = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
+Usr.aMonthDays = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+
+/**
+ * getTime()
+ *
+ * @return {number} the current time, in milliseconds
+ */
+Usr.getTime = Date.now || function() { return +new Date(); };
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/weblib.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * According to http://www.w3schools.com/jsref/jsref_obj_global.asp, these are the *global* properties
+ * and functions of JavaScript-in-the-Browser:
+ *
+ * Property             Description
+ * ---
+ * Infinity             A numeric value that represents positive/negative infinity
+ * NaN                  "Not-a-Number" value
+ * undefined            Indicates that a variable has not been assigned a value
+ *
+ * Function             Description
+ * ---
+ * decodeURI()          Decodes a URI
+ * decodeURIComponent() Decodes a URI component
+ * encodeURI()          Encodes a URI
+ * encodeURIComponent() Encodes a URI component
+ * escape()             Deprecated in version 1.5. Use encodeURI() or encodeURIComponent() instead
+ * eval()               Evaluates a string and executes it as if it was script code
+ * isFinite()           Determines whether a value is a finite, legal number
+ * isNaN()              Determines whether a value is an illegal number
+ * Number()             Converts an object's value to a number
+ * parseFloat()         Parses a string and returns a floating point number
+ * parseInt()           Parses a string and returns an integer
+ * String()             Converts an object's value to a string
+ * unescape()           Deprecated in version 1.5. Use decodeURI() or decodeURIComponent() instead
+ *
+ * And according to http://www.w3schools.com/jsref/obj_window.asp, these are the properties and functions
+ * of the *window* object.
+ *
+ * Property             Description
+ * ---
+ * closed               Returns a Boolean value indicating whether a window has been closed or not
+ * defaultStatus        Sets or returns the default text in the statusbar of a window
+ * document             Returns the Document object for the window (See Document object)
+ * frames               Returns an array of all the frames (including iframes) in the current window
+ * history              Returns the History object for the window (See History object)
+ * innerHeight          Returns the inner height of a window's content area
+ * innerWidth           Returns the inner width of a window's content area
+ * length               Returns the number of frames (including iframes) in a window
+ * location             Returns the Location object for the window (See Location object)
+ * name                 Sets or returns the name of a window
+ * navigator            Returns the Navigator object for the window (See Navigator object)
+ * opener               Returns a reference to the window that created the window
+ * outerHeight          Returns the outer height of a window, including toolbars/scrollbars
+ * outerWidth           Returns the outer width of a window, including toolbars/scrollbars
+ * pageXOffset          Returns the pixels the current document has been scrolled (horizontally) from the upper left corner of the window
+ * pageYOffset          Returns the pixels the current document has been scrolled (vertically) from the upper left corner of the window
+ * parent               Returns the parent window of the current window
+ * screen               Returns the Screen object for the window (See Screen object)
+ * screenLeft           Returns the x coordinate of the window relative to the screen
+ * screenTop            Returns the y coordinate of the window relative to the screen
+ * screenX              Returns the x coordinate of the window relative to the screen
+ * screenY              Returns the y coordinate of the window relative to the screen
+ * self                 Returns the current window
+ * status               Sets or returns the text in the statusbar of a window
+ * top                  Returns the topmost browser window
+ *
+ * Method               Description
+ * ---
+ * alert()              Displays an alert box with a message and an OK button
+ * atob()               Decodes a base-64 encoded string
+ * blur()               Removes focus from the current window
+ * btoa()               Encodes a string in base-64
+ * clearInterval()      Clears a timer set with setInterval()
+ * clearTimeout()       Clears a timer set with setTimeout()
+ * close()              Closes the current window
+ * confirm()            Displays a dialog box with a message and an OK and a Cancel button
+ * createPopup()        Creates a pop-up window
+ * focus()              Sets focus to the current window
+ * moveBy()             Moves a window relative to its current position
+ * moveTo()             Moves a window to the specified position
+ * open()               Opens a new browser window
+ * print()              Prints the content of the current window
+ * prompt()             Displays a dialog box that prompts the visitor for input
+ * resizeBy()           Resizes the window by the specified pixels
+ * resizeTo()           Resizes the window to the specified width and height
+ * scroll()             This method has been replaced by the scrollTo() method.
+ * scrollBy()           Scrolls the content by the specified number of pixels
+ * scrollTo()           Scrolls the content to the specified coordinates
+ * setInterval()        Calls a function or evaluates an expression at specified intervals (in milliseconds)
+ * setTimeout()         Calls a function or evaluates an expression after a specified number of milliseconds
+ * stop()               Stops the window from loading
+ */
+
+class Web {
+    /**
+     * log(s, type)
+     *
+     * For diagnostic output only.  DEBUG must be true (or "--debug" specified via the command-line)
+     * for Component.log() to display anything.
+     *
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     */
+    static log(s, type)
+    {
+        Component.log(s, type);
+    }
+
+    /**
+     * notice(s, fPrintOnly, id)
+     *
+     * @param {string} s is the message text
+     * @param {boolean} [fPrintOnly]
+     * @param {string} [id] is the caller's ID, if any
+     */
+    static notice(s, fPrintOnly, id)
+    {
+        Component.notice(s, fPrintOnly, id);
+    }
+
+    /**
+     * getResource(sURL, dataPost, fAsync, done)
+     *
+     * Request the specified resource (sURL), and once the request is complete, notify done().
+     *
+     * If fAsync is true, a done() callback should ALWAYS be supplied; otherwise, you'll have no
+     * idea when the request is complete or what the response was.  done() is passed three parameters:
+     *
+     *      done(sURL, sResource, nErrorCode)
+     *
+     * If nErrorCode is zero, sResource should contain the requested data; otherwise, an error occurred.
+     *
+     * If dataPost is set to a string, that string can be used to control the response format;
+     * by default, the response format is plain text, but you can specify "bytes" to request arbitrary
+     * binary data, which should come back as a string of bytes.
+     *
+     * TODO: The "bytes" option works by calling overrideMimeType(), which was never a best practice.
+     * Instead, we should implement supported response types ("text" and "arraybuffer", at a minimum)
+     * by setting xmlHTTP.responseType to one of those values before calling xmlHTTP.send().
+     *
+     * @param {string} sURL
+     * @param {string|Object|null} [dataPost] for a POST request (default is a GET request)
+     * @param {boolean} [fAsync] is true for an asynchronous request
+     * @param {function(string,string,number)} [done]
+     * @return {Array|null} Array containing [sResource, nErrorCode], or null if no response yet
+     */
+    static getResource(sURL, dataPost, fAsync = false, done)
+    {
+        var nErrorCode = 0, sResource = null, response = null;
+
+        if (typeof resources == 'object' && (sResource = resources[sURL])) {
+            if (done) done(sURL, sResource, nErrorCode);
+            return [sResource, nErrorCode];
+        }
+        else if (fAsync && typeof resources == 'function') {
+            resources(sURL, function(sResource, nErrorCode)
+            {
+                if (done) done(sURL, sResource, nErrorCode);
+            });
+            return response;
+        }
+
+        if (DEBUG) {
+            /*
+             * The larger resources we put on archive.pcjs.org should also be available locally...
+             */
+            sURL = sURL.replace(/^http:\/\/archive.pcjs.org(\/.*)\/([^\/]*)$/, "$1/archive/$2");
+        }
+
+
+        var xmlHTTP = (window.XMLHttpRequest? new window.XMLHttpRequest() : new window.ActiveXObject("Microsoft.XMLHTTP"));
+        if (fAsync) {
+            xmlHTTP.onreadystatechange = function()
+            {
+                if (xmlHTTP.readyState === 4) {
+                    /*
+                     * The following line was recommended for WebKit, as a work-around to prevent the handler firing multiple
+                     * times when debugging.  Unfortunately, that's not the only XMLHttpRequest problem that occurs when
+                     * debugging, so I think the WebKit problem is deeper than that.  When we have multiple XMLHttpRequests
+                     * pending, any debugging activity means most of them simply get dropped on floor, so what may actually be
+                     * happening are mis-notifications rather than redundant notifications.
+                     *
+                     *      xmlHTTP.onreadystatechange = undefined;
+                     */
+                    sResource = xmlHTTP.responseText;
+                    /*
+                     * The normal "success" case is an HTTP status code of 200, but when testing with files loaded
+                     * from the local file system (ie, when using the "file:" protocol), we have to be a bit more "flexible".
+                     */
+                    if (xmlHTTP.status == 200 || !xmlHTTP.status && sResource.length && Web.getHostProtocol() == "file:") {
+                        if (MAXDEBUG) Web.log("xmlHTTP.onreadystatechange(" + sURL + "): returned " + sResource.length + " bytes");
+                    }
+                    else {
+                        nErrorCode = xmlHTTP.status || -1;
+                        Web.log("xmlHTTP.onreadystatechange(" + sURL + "): error code " + nErrorCode);
+                    }
+                    if (done) done(sURL, sResource, nErrorCode);
+                }
+            };
+        }
+
+        if (dataPost && typeof dataPost == "object") {
+            var sDataPost = "";
+            for (var p in dataPost) {
+                if (!dataPost.hasOwnProperty(p)) continue;
+                if (sDataPost) sDataPost += "&";
+                sDataPost += p + '=' + encodeURIComponent(dataPost[p]);
+            }
+            sDataPost = sDataPost.replace(/%20/g, '+');
+            if (MAXDEBUG) Web.log("Web.getResource(POST " + sURL + "): " + sDataPost.length + " bytes");
+            xmlHTTP.open("POST", sURL, fAsync);     // ensure that fAsync is a valid boolean (Internet Explorer xmlHTTP functions insist on it)
+            xmlHTTP.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
+            xmlHTTP.send(sDataPost);
+        } else {
+            if (MAXDEBUG) Web.log("Web.getResource(GET " + sURL + ")");
+            xmlHTTP.open("GET", sURL, fAsync);      // ensure that fAsync is a valid boolean (Internet Explorer xmlHTTP functions insist on it)
+            if (dataPost == "bytes") {
+                xmlHTTP.overrideMimeType("text/plain; charset=x-user-defined");
+            }
+            xmlHTTP.send();
+        }
+
+        if (!fAsync) {
+            sResource = xmlHTTP.responseText;
+            if (xmlHTTP.status == 200) {
+                if (MAXDEBUG) Web.log("Web.getResource(" + sURL + "): returned " + sResource.length + " bytes");
+            } else {
+                nErrorCode = xmlHTTP.status || -1;
+                Web.log("Web.getResource(" + sURL + "): error code " + nErrorCode);
+            }
+            if (done) done(sURL, sResource, nErrorCode);
+            response = [sResource, nErrorCode];
+        }
+        return response;
+    }
+
+    /**
+     * parseMemoryResource(sURL, sData)
+     *
+     * This converts a variety of JSON-style data streams into an Object with the following properties:
+     *
+     *      aBytes
+     *      aSymbols
+     *      addrLoad
+     *      addrExec
+     *
+     * If the source data contains a 'bytes' array, it's passed through to 'aBytes'; alternatively, if
+     * it contains a 'words' array, the values are converted from 16-bit to 8-bit and stored in 'aBytes',
+     * and if it contains a 'longs' array, the values are converted from 32-bit longs into bytes and
+     * stored in 'aBytes'.
+     *
+     * Alternatively, if the source data contains a 'data' array, we simply pass that through to the output
+     * object as:
+     *
+     *      aData
+     *
+     * @param {string} sURL
+     * @param {string} sData
+     * @return {Object|null} (resource)
+     */
+    static parseMemoryResource(sURL, sData)
+    {
+        var i;
+        var resource = {
+            aBytes: null,
+            aSymbols: null,
+            addrLoad: null,
+            addrExec: null
+        };
+
+        if (sData.charAt(0) == "[" || sData.charAt(0) == "{") {
+            try {
+                var a, ib, data;
+
+                if (sData.substr(0, 1) == "<") {    // if the "data" begins with a "<"...
+                    /*
+                     * Early server configs reported an error (via the nErrorCode parameter) if a tape URL was invalid,
+                     * but more recent server configs now display a somewhat friendlier HTML error page.  The downside,
+                     * however, is that the original error has been buried, and we've received "data" that isn't actually
+                     * tape data.  So if the data we've received appears to be "HTML-like", we treat it as an error message.
+                     */
+                    throw new Error(sData);
+                }
+
+                /*
+                 * TODO: IE9 is rather unfriendly and restrictive with regard to how much data it's willing to
+                 * eval().  In particular, the 10Mb disk image we use for the Windows 1.01 demo config fails in
+                 * IE9 with an "Out of memory" exception.  One work-around would be to chop the data into chunks
+                 * (perhaps one track per chunk, using regular expressions) and then manually re-assemble it.
+                 *
+                 * However, it turns out that using JSON.parse(sDiskData) instead of eval("(" + sDiskData + ")")
+                 * is a much easier fix. The only drawback is that we must first quote any unquoted property names
+                 * and remove any comments, because while eval() was cool with them, JSON.parse() is more particular;
+                 * the following RegExp replacements take care of those requirements.
+                 *
+                 * The use of hex values is something else that eval() was OK with, but JSON.parse() is not, and
+                 * while I've stopped using hex values in DumpAPI responses (at least when "format=json" is specified),
+                 * I can't guarantee they won't show up in "legacy" images, and there's no simple RegExp replacement
+                 * for transforming hex values into decimal values, so I cop out and fall back to eval() if I detect
+                 * any hex prefixes ("0x") in the sequence.  Ditto for error messages, which appear like so:
+                 *
+                 *      ["unrecognized disk path: test.img"]
+                 */
+                if (sData.indexOf("0x") < 0 && sData.indexOf("0o") < 0 && sData.substr(0, 2) != '["') {
+                    data = JSON.parse(sData.replace(/([a-z]+):/gm, '"$1":').replace(/\/\/[^\n]*/gm, ""));
+                } else {
+                    data = eval("(" + sData + ")");
+                }
+
+                resource.addrLoad = data['load'];
+                resource.addrExec = data['exec'];
+
+                if (a = data['bytes']) {
+                    resource.aBytes = a;
+                }
+                else if (a = data['words']) {
+                    /*
+                     * Convert all words into bytes
+                     */
+                    resource.aBytes = new Array(a.length * 2);
+                    for (i = 0, ib = 0; i < a.length; i++) {
+                        resource.aBytes[ib++] = a[i] & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 8) & 0xff;
+
+                    }
+                }
+                else if (a = data['longs']) {
+                    /*
+                     * Convert all dwords (longs) into bytes
+                     */
+                    resource.aBytes = new Array(a.length * 4);
+                    for (i = 0, ib = 0; i < a.length; i++) {
+                        resource.aBytes[ib++] = a[i] & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 8) & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 16) & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 24) & 0xff;
+                    }
+                }
+                else if (a = data['data']) {
+                    resource.aData = a;
+                }
+                else {
+                    resource.aBytes = data;
+                }
+
+                if (resource.aBytes) {
+                    if (!resource.aBytes.length) {
+                        Component.error("Empty resource: " + sURL);
+                        resource = null;
+                    }
+                    else if (resource.aBytes.length == 1) {
+                        Component.error(resource.aBytes[0]);
+                        resource = null;
+                    }
+                }
+                resource.aSymbols = data['symbols'];
+
+            } catch (e) {
+                Component.error("Resource data error (" + sURL + "): " + e.message);
+                resource = null;
+            }
+        }
+        else {
+            /*
+             * Parse the data manually; we assume it's a series of hex byte-values separated by whitespace.
+             */
+            var ab = [];
+            var sHexData = sData.replace(/\n/gm, " ").replace(/ +$/, "");
+            var asHexData = sHexData.split(" ");
+            for (i = 0; i < asHexData.length; i++) {
+                var n = parseInt(asHexData[i], 16);
+                if (isNaN(n)) {
+                    Component.error("Resource data error (" + sURL + "): invalid hex byte (" + asHexData[i] + ")");
+                    break;
+                }
+                ab.push(n & 0xff);
+            }
+            if (i == asHexData.length) resource.aBytes = ab;
+        }
+        return resource;
+    }
+
+    /**
+     * sendReport(sApp, sVer, sURL, sUser, sType, sReport, sHostName)
+     *
+     * Send a report (eg, bug report) to the server.
+     *
+     * @param {string} sApp (eg, "PCjs")
+     * @param {string} sVer (eg, "1.02")
+     * @param {string} sURL (eg, "/devices/pc/machine/5150/mda/64kb/machine.xml")
+     * @param {string} sUser (ie, the user key, if any)
+     * @param {string} sType (eg, "bug"); one of ReportAPI.TYPE.*
+     * @param {string} sReport (eg, unparsed state data)
+     * @param {string} [sHostName] (default is http://SITEHOST)
+     */
+    static sendReport(sApp, sVer, sURL, sUser, sType, sReport, sHostName)
+    {
+        var dataPost = {};
+        dataPost[ReportAPI.QUERY.APP] = sApp;
+        dataPost[ReportAPI.QUERY.VER] = sVer;
+        dataPost[ReportAPI.QUERY.URL] = sURL;
+        dataPost[ReportAPI.QUERY.USER] = sUser;
+        dataPost[ReportAPI.QUERY.TYPE] = sType;
+        dataPost[ReportAPI.QUERY.DATA] = sReport;
+        var sReportURL = (sHostName? sHostName : "http://" + SITEHOST) + ReportAPI.ENDPOINT;
+        Web.getResource(sReportURL, dataPost, true);
+    }
+
+    /**
+     * getHost()
+     *
+     * @return {string}
+     */
+    static getHost()
+    {
+        return ("http://" + (window? window.location.host : SITEHOST));
+    }
+
+    /**
+     * getHostURL()
+     *
+     * @return {string|null}
+     */
+    static getHostURL()
+    {
+        return (window? window.location.href : null);
+    }
+
+    /**
+     * getHostProtocol()
+     *
+     * @return {string}
+     */
+    static getHostProtocol()
+    {
+        return (window? window.location.protocol : "file:");
+    }
+
+    /**
+     * getUserAgent()
+     *
+     * @return {string}
+     */
+    static getUserAgent()
+    {
+        return (window? window.navigator.userAgent : "");
+    }
+
+    /**
+     * hasLocalStorage
+     *
+     * true if localStorage support exists, is enabled, and works; false otherwise
+     *
+     * @return {boolean}
+     */
+    static hasLocalStorage()
+    {
+        if (Web.fLocalStorage == null) {
+            var f = false;
+            if (window) {
+                try {
+                    window.localStorage.setItem(Web.sLocalStorageTest, Web.sLocalStorageTest);
+                    f = (window.localStorage.getItem(Web.sLocalStorageTest) == Web.sLocalStorageTest);
+                    window.localStorage.removeItem(Web.sLocalStorageTest);
+                } catch (e) {
+                    Web.logLocalStorageError(e);
+                    f = false;
+                }
+            }
+            Web.fLocalStorage = f;
+        }
+        return Web.fLocalStorage;
+    }
+
+    /**
+     * logLocalStorageError(e)
+     *
+     * @param {Error} e is an exception
+     */
+    static logLocalStorageError(e)
+    {
+        Web.log(e.message, "localStorage error");
+    }
+
+    /**
+     * getLocalStorageItem(sKey)
+     *
+     * Returns the requested key value, or null if the key does not exist, or undefined if localStorage is not available
+     *
+     * @param {string} sKey
+     * @return {string|null|undefined} sValue
+     */
+    static getLocalStorageItem(sKey)
+    {
+        var sValue;
+        if (window) {
+            try {
+                sValue = window.localStorage.getItem(sKey);
+            } catch (e) {
+                Web.logLocalStorageError(e);
+            }
+        }
+        return sValue;
+    }
+
+    /**
+     * setLocalStorageItem(sKey, sValue)
+     *
+     * @param {string} sKey
+     * @param {string} sValue
+     * @return {boolean} true if localStorage is available, false if not
+     */
+    static setLocalStorageItem(sKey, sValue)
+    {
+        try {
+            window.localStorage.setItem(sKey, sValue);
+            return true;
+        } catch (e) {
+            Web.logLocalStorageError(e);
+        }
+        return false;
+    }
+
+    /**
+     * removeLocalStorageItem(sKey)
+     *
+     * @param {string} sKey
+     */
+    static removeLocalStorageItem(sKey)
+    {
+        try {
+            window.localStorage.removeItem(sKey);
+        } catch (e) {
+            Web.logLocalStorageError(e);
+        }
+    }
+
+    /**
+     * getLocalStorageKeys()
+     *
+     * @return {Array}
+     */
+    static getLocalStorageKeys()
+    {
+        var a = [];
+        try {
+            for (var i = 0, c = window.localStorage.length; i < c; i++) {
+                a.push(window.localStorage.key(i));
+            }
+        } catch (e) {
+            Web.logLocalStorageError(e);
+        }
+        return a;
+    }
+
+    /**
+     * reloadPage()
+     */
+    static reloadPage()
+    {
+        if (window) window.location.reload();
+    }
+
+    /**
+     * isUserAgent(s)
+     *
+     * Check the browser's user-agent string for the given substring; "iOS" and "MSIE" are special values you can
+     * use that will match any iOS or MSIE browser, respectively (even IE11, in the case of "MSIE").
+     *
+     * 2013-11-06: In a questionable move, MSFT changed the user-agent reported by IE11 on Windows 8.1, eliminating
+     * the "MSIE" string (which MSDN calls a "version token"; see http://msdn.microsoft.com/library/ms537503.aspx);
+     * they say "public websites should rely on feature detection, rather than browser detection, in order to design
+     * their sites for browsers that don't support the features used by the website." So, in IE11, we get a user-agent
+     * that tries to fool apps into thinking the browser is more like WebKit or Gecko:
+     *
+     *      Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
+     *
+     * That's a nice idea, but in the meantime, they hosed the XSL transform code in embed.js, which contained
+     * some very critical browser-specific code; turning on IE's "Compatibility Mode" didn't help either, because
+     * that's a sledgehammer solution which restores the old user-agent string but also disables other features like
+     * HTML5 canvas support. As an interim solution, I'm treating any "MSIE" check as a check for either "MSIE" or
+     * "Trident".
+     *
+     * UPDATE: I've since found ways to make the code in embed.js more browser-agnostic, so for now, there's isn't
+     * any code that cares about "MSIE", but I've left the change in place, because I wouldn't be surprised if I'll
+     * need more IE-specific code in the future, perhaps for things like copy/paste functionality, or mouse capture.
+     *
+     * @param {string} s is a substring to search for in the user-agent; as noted above, "iOS" and "MSIE" are special values
+     * @return {boolean} is true if the string was found, false if not
+     */
+    static isUserAgent(s)
+    {
+        if (window) {
+            var userAgent = Web.getUserAgent();
+            /*
+             * Here's one case where we have to be careful with Component, because when isUserAgent() is called by
+             * the init code below, component.js hasn't been loaded yet.  The simple solution for now is to remove the call.
+             *
+             *      Web.log("agent: " + userAgent);
+             *
+             * And yes, it would be pointless to use the conditional (?) operator below, if not for the Google Closure
+             * Compiler (v20130823) failing to detect the entire expression as a boolean.
+             */
+            return s == "iOS" && !!userAgent.match(/(iPod|iPhone|iPad)/) && !!userAgent.match(/AppleWebKit/) || s == "MSIE" && !!userAgent.match(/(MSIE|Trident)/) || (userAgent.indexOf(s) >= 0);
+        }
+        return false;
+    }
+
+    /**
+     * isMobile()
+     *
+     * Check the browser's user-agent string for the substring "Mobi", as per Mozilla recommendation:
+     *
+     *      https://developer.mozilla.org/en-US/docs/Browser_detection_using_the_user_agent
+     *
+     * @return {boolean} is true if the browser appears to be a mobile (ie, non-desktop) web browser, false if not
+     */
+    static isMobile()
+    {
+        return Web.isUserAgent("Mobi");
+    }
+
+    /**
+     * getURLParm(sParm)
+     *
+     * @param {string} sParm
+     * @return {string|undefined}
+     */
+    static getURLParm(sParm)
+    {
+        if (!Web.parmsURL) {
+            Web.parmsURL = Web.parseURLParms();
+        }
+        return Web.parmsURL[sParm];
+    }
+
+    /**
+     * parseURLParms(sParms)
+     *
+     * @param {string} [sParms] containing the parameter portion of a URL (ie, after the '?')
+     * @return {Object} containing properties for each parameter found
+     */
+    static parseURLParms(sParms)
+    {
+        var aParms = {};
+        if (window) {       // an alternative to "if (typeof module === 'undefined')" if require("defines") was used
+            if (!sParms) {
+                /*
+                 * Note that window.location.href returns the entire URL, whereas window.location.search
+                 * returns only the parameters, if any (starting with the '?', which we skip over with a substr() call).
+                 */
+                sParms = window.location.search.substr(1);
+            }
+            var match;
+            var pl = /\+/g; // RegExp for replacing addition symbol with a space
+            var search = /([^&=]+)=?([^&]*)/g;
+            var decode = function(s)
+            {
+                return decodeURIComponent(s.replace(pl, " "));
+            };
+
+            while ((match = search.exec(sParms))) {
+                aParms[decode(match[1])] = decode(match[2]);
+            }
+        }
+        return aParms;
+    }
+
+    /**
+     * downloadFile(sData, sType, fBase64, sFileName)
+     *
+     * @param {string} sData
+     * @param {string} sType
+     * @param {boolean} [fBase64]
+     * @param {string} [sFileName]
+     */
+    static downloadFile(sData, sType, fBase64, sFileName)
+    {
+        var link = null, sAlert;
+        var sURI = "data:application/" + sType + (fBase64? ";base64" : "") + ",";
+
+        if (!Web.isUserAgent("Firefox")) {
+            sURI += (fBase64? sData : encodeURI(sData));
+        } else {
+            sURI += (fBase64? sData : encodeURIComponent(sData));
+        }
+        if (sFileName) {
+            link = document.createElement('a');
+            if (typeof link.download != 'string') link = null;
+        }
+        if (link) {
+            link.href = sURI;
+            link.download = sFileName;
+            document.body.appendChild(link);    // Firefox allegedly requires the link to be in the body
+            link.click();
+            document.body.removeChild(link);
+            sAlert = 'Check your Downloads folder for ' + sFileName + '.';
+        } else {
+            window.open(sURI);
+            sAlert = 'Check your browser for a new window/tab containing the requested data' + (sFileName? (' (' + sFileName + ')') : '') + '.';
+        }
+        return sAlert;
+    }
+
+    /**
+     * onCountRepeat(n, fnRepeat, fnComplete, msDelay)
+     *
+     * Call fnRepeat() n times with an msDelay millisecond delay between calls,
+     * then call fnComplete() when n has been exhausted OR fnRepeat() returns false.
+     *
+     * @param {number} n
+     * @param {function()} fnRepeat
+     * @param {function()} fnComplete
+     * @param {number} [msDelay]
+     */
+    static onCountRepeat(n, fnRepeat, fnComplete, msDelay)
+    {
+        var fnTimeout = function doCountRepeat()
+        {
+            n -= 1;
+            if (n >= 0) {
+                if (!fnRepeat()) n = 0;
+            }
+            if (n > 0) {
+                setTimeout(fnTimeout, msDelay || 0);
+                return;
+            }
+            fnComplete();
+        };
+        fnTimeout();
+    }
+
+    /**
+     * onClickRepeat(e, msDelay, msRepeat, fn)
+     *
+     * Repeatedly call fn() with an initial msDelay, and an msRepeat delay thereafter,
+     * as long as HTML control Object e has an active "down" event and fn() returns true.
+     *
+     * @param {Object} e
+     * @param {number} msDelay
+     * @param {number} msRepeat
+     * @param {function(boolean)} fn is passed false on the first call, true on all repeated calls
+     */
+    static onClickRepeat(e, msDelay, msRepeat, fn)
+    {
+        var ms = 0, timer = null, fIgnoreMouseEvents = false;
+
+        var fnRepeat = function doClickRepeat()
+        {
+            if (fn(ms === msRepeat)) {
+                timer = setTimeout(fnRepeat, ms);
+                ms = msRepeat;
+            }
+        };
+        e.onmousedown = function()
+        {
+            // Web.log("onMouseDown()");
+            if (!fIgnoreMouseEvents) {
+                if (!timer) {
+                    ms = msDelay;
+                    fnRepeat();
+                }
+            }
+        };
+        e.ontouchstart = function()
+        {
+            // Web.log("onTouchStart()");
+            if (!timer) {
+                ms = msDelay;
+                fnRepeat();
+            }
+        };
+        e.onmouseup = e.onmouseout = function()
+        {
+            // Web.log("onMouseUp()/onMouseOut()");
+            if (timer) {
+                clearTimeout(timer);
+                timer = null;
+            }
+        };
+        e.ontouchend = e.ontouchcancel = function()
+        {
+            // Web.log("onTouchEnd()/onTouchCancel()");
+            if (timer) {
+                clearTimeout(timer);
+                timer = null;
+            }
+            /*
+             * Devices that generate ontouch* events ALSO generate onmouse* events,
+             * and generally do so immediately after all the touch events are complete,
+             * so unless we want double the action, we need to ignore mouse events.
+             */
+            fIgnoreMouseEvents = true;
+        };
+    }
+
+    /**
+     * onPageEvent(sName, fn)
+     *
+     * For 'onload', 'onunload', and 'onpageshow' events, most callers should NOT use this function, but
+     * instead use Web.onInit(), Web.onShow(), and Web.onExit(), respectively.
+     *
+     * The only components that should still use onPageEvent() are THIS component (see the bottom of this file)
+     * and components that need to capture other events (eg, the 'onresize' event in the Video component).
+     *
+     * This function creates a chain of callbacks, allowing multiple JavaScript modules to define handlers
+     * for the same event, which wouldn't be possible if everyone modified window['onload'], window['onunload'],
+     * etc, themselves.  However, that's less of a concern now, because assuming everyone else is now using
+     * onInit(), onExit(), etc, then there really IS only one component setting the window callback: this one.
+     *
+     * NOTE: It's risky to refer to obscure event handlers with "dot" names, because the Closure Compiler may
+     * erroneously replace them (eg, window.onpageshow is a good example).
+     *
+     * @param {string} sFunc
+     * @param {function()} fn
+     */
+    static onPageEvent(sFunc, fn)
+    {
+        if (window) {
+            var fnPrev = window[sFunc];
+            if (typeof fnPrev !== 'function') {
+                window[sFunc] = fn;
+            } else {
+                /*
+                 * TODO: Determine whether there's any value in receiving/sending the Event object that the
+                 * browser provides when it generates the original event.
+                 */
+                window[sFunc] = function onWindowEvent()
+                {
+                    if (fnPrev) fnPrev();
+                    fn();
+                };
+            }
+        }
+    };
+
+    /**
+     * onInit(fn)
+     *
+     * Use this instead of setting window.onload.  Allows multiple JavaScript modules to define their own 'onload' event handler.
+     *
+     * @param {function()} fn
+     */
+    static onInit(fn)
+    {
+        Web.aPageEventHandlers['init'].push(fn);
+    };
+
+    /**
+     * onShow(fn)
+     *
+     * @param {function()} fn
+     *
+     * Use this instead of setting window.onpageshow.  Allows multiple JavaScript modules to define their own 'onpageshow' event handler.
+     */
+    static onShow(fn)
+    {
+        Web.aPageEventHandlers['show'].push(fn);
+    };
+
+    /**
+     * onExit(fn)
+     *
+     * @param {function()} fn
+     *
+     * Use this instead of setting window.onunload.  Allows multiple JavaScript modules to define their own 'onunload' event handler.
+     */
+    static onExit(fn)
+    {
+        Web.aPageEventHandlers['exit'].push(fn);
+    };
+
+    /**
+     * doPageEvent(afn)
+     *
+     * @param {Array.<function()>} afn
+     */
+    static doPageEvent(afn)
+    {
+        if (Web.fPageEventsEnabled) {
+            try {
+                for (var i = 0; i < afn.length; i++) {
+                    afn[i]();
+                }
+            } catch (e) {
+                Web.notice("An unexpected exception occurred:\n\n" + e.message + "\n\nPlease send this information to support@pcjs.org. Thanks.");
+            }
+        }
+    };
+
+    /**
+     * enablePageEvents(fEnable)
+     *
+     * @param {boolean} fEnable is true to enable page events, false to disable (they're enabled by default)
+     */
+    static enablePageEvents(fEnable)
+    {
+        if (!Web.fPageEventsEnabled && fEnable) {
+            Web.fPageEventsEnabled = true;
+            if (Web.fPageLoaded) Web.sendPageEvent('init');
+            if (Web.fPageShowed) Web.sendPageEvent('show');
+            return;
+        }
+        Web.fPageEventsEnabled = fEnable;
+    }
+
+    /**
+     * sendPageEvent(sEvent)
+     *
+     * This allows us to manually trigger page events.
+     *
+     * @param {string} sEvent (one of 'init', 'show' or 'exit')
+     */
+    static sendPageEvent(sEvent)
+    {
+        if (Web.aPageEventHandlers[sEvent]) {
+            Web.doPageEvent(Web.aPageEventHandlers[sEvent]);
+        }
+    }
+}
+
+Web.parmsURL = null;            // initialized on first call to parseURLParms()
+
+Web.aPageEventHandlers = {
+    'init': [],                 // list of window 'onload' handlers
+    'show': [],                 // list of window 'onpageshow' handlers
+    'exit': []                  // list of window 'onunload' handlers (although we prefer to use 'onbeforeunload' if possible)
+};
+
+Web.fPageLoaded = false;        // set once the page's first 'onload' event has occurred
+Web.fPageShowed = false;        // set once the page's first 'onpageshow' event has occurred
+Web.fPageEventsEnabled = true;  // default is true, set to false (or true) by enablePageEvents()
+
+/**
+ * fLocalStorage
+ *
+ * true if localStorage support exists, is enabled, and works; "falsey" otherwise
+ *
+ * @type {boolean|null}
+ */
+Web.fLocalStorage = null;
+
+/**
+ * TODO: Is there any way to get the Closure Compiler to stop inlining this string?  This isn't cutting it.
+ *
+ * @const {string}
+ */
+Web.sLocalStorageTest = "PCjs.localStorage";
+
+Web.onPageEvent('onload', function onPageLoad() {
+    Web.fPageLoaded = true;
+    Web.doPageEvent(Web.aPageEventHandlers['init']);
+});
+
+Web.onPageEvent('onpageshow', function onPageShow() {
+    Web.fPageShowed = true;
+    Web.doPageEvent(Web.aPageEventHandlers['show']);
+});
+
+Web.onPageEvent(Web.isUserAgent("Opera") || Web.isUserAgent("iOS")? 'onunload' : 'onbeforeunload', function onPageUnload() {
+    Web.doPageEvent(Web.aPageEventHandlers['exit']);
+});
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/component.js (C) Jeff Parsons 2012-2017
+ */
+
+/*
+ * All PCjs components now use JSDoc types, primarily so that Google's Closure Compiler will compile
+ * everything with zero warnings when ADVANCED_OPTIMIZATIONS are enabled.  For more information about
+ * the JSDoc types supported by the Closure Compiler:
+ *
+ *      https://developers.google.com/closure/compiler/docs/js-for-compiler#types
+ *
+ * I also attempted to validate this code with JSLint, but it complained too much; eg, it didn't like
+ * "while (true)", a tried and "true" programming convention for decades, and it wanted me to replace
+ * all "++" and "--" operators with "+= 1" and "-= 1", use "(s || '')" instead of "(s? s : '')", etc.
+ *
+ * I prefer sticking with traditional C-style idioms, in part because they are more portable.  That
+ * does NOT mean I'm trying to write "portable JavaScript," but some of this code was ported from C code
+ * I'd written long ago, so portability is good, and I'm not going to throw that away if there's no need.
+ *
+ * UPDATE: I've since switched from JSLint to JSHint, which seems to have more reasonable defaults.
+ * And for new code, I have adopted some popular JavaScript idioms, like "(s || '')", although the need
+ * for those kinds of expressions will be reduced as I also start adopting some ES6 features, like
+ * default parameters.
+ */
+
+
+/**
+ * Since the Closure Compiler treats ES6 classes as @struct rather than @dict by default,
+ * it deters us from defining named properties on our components; eg:
+ *
+ *      this['exports'] = {...}
+ *
+ * results in an error:
+ *
+ *      Cannot do '[]' access on a struct
+ *
+ * So, in order to define 'exports', we must override the @struct assumption by annotating
+ * the class as @unrestricted (or @dict).  Note that this must be done both here and in the
+ * subclass (eg, SerialPort), because otherwise the Compiler won't allow us to *reference*
+ * the named property either.
+ *
+ * TODO: Consider marking ALL our classes unrestricted, because otherwise it forces us to
+ * define every single property the class uses in its constructor, which results in a fair
+ * bit of redundant initialization, since many properties aren't (and don't need to be) fully
+ * initialized until the appropriate init(), reset(), restore(), etc. function is called.
+ *
+ * The upside, however, may be that since the structure of the class is completely defined by
+ * the constructor, JavaScript engines may be able to optimize and run more efficiently.
+ *
+ * @unrestricted
+ */
+class Component {
+    /**
+     * Component(type, parms, bitsMessage)
+     *
+     * A Component object requires:
+     *
+     *      type: a user-defined type name (eg, "CPU")
+     *
+     * and accepts any or all of the following (parms) properties:
+     *
+     *      id: component ID (default is "")
+     *      name: component name (default is ""; if blank, toString() will use the type name only)
+     *      comment: component comment string (default is undefined)
+     *
+     * Component subclasses will usually have additional (parms) properties.
+     *
+     * @param {string} type
+     * @param {Object} [parms]
+     * @param {number} [bitsMessage] selects message(s) that the component wants to enable (default is 0)
+     */
+    constructor(type, parms, bitsMessage)
+    {
+        this.type = type;
+
+        if (!parms) parms = {'id': "", 'name': ""};
+
+        this.id = parms['id'] || "";
+        this.name = parms['name'];
+        this.comment = parms['comment'];
+        this.parms = parms;
+
+        /*
+         * The following Component properties need to be accessible by other machines and/or command scripts;
+         * well, OK, or we could have exported some new functions to walk the contents of these properties, as we
+         * did with findMachineComponent(), but this works just as well.
+         *
+         * Also, while the double-assignment looks silly (ie, using both dot and bracket property notation), it
+         * resolves a complaint from the Closure Compiler, because if we use ONLY bracket notation here, then the
+         * Compiler wants us to change all the other references to bracket notation as well.
+         */
+        this.exports = this['exports'] = {};
+        this.bindings = this['bindings'] = {};
+
+        var i = this.id.indexOf('.');
+        if (i < 0) {
+            this.idComponent = this.id;
+        } else {
+            this.idMachine = this.id.substr(0, i);
+            this.idComponent = this.id.substr(i + 1);
+        }
+
+        /*
+         * Gather all the various component flags (booleans) into a single "flags" object, and encourage
+         * subclasses to do the same, to reduce the property clutter we have to wade through while debugging.
+         */
+        this.flags = {
+            ready:      false,
+            busy:       false,
+            busyCancel: false,
+            powered:    false,
+            error:      false
+        };
+
+        this.fnReady = null;
+        this.clearError();
+        this.bitsMessage = bitsMessage || 0;
+
+        /** @type {Object|null} controlPrint is the HTML control, if any, that we can print to */
+        this.controlPrint = null;
+
+        this.cmp = null;
+        this.bus = null;
+        this.cpu = null;
+        this.dbg = null;
+
+        /*
+         * TODO: Consider adding another parameter to the Component() constructor that allows components to tell
+         * us if they support single or multiple instances per machine.  For example, there can be multiple SerialPort
+         * components per machine, but only one CPU component (some machines also support an FPU, but that component
+         * is considered separate from the CPU).
+         *
+         * It's not critical, but it would help catch machine configuration errors; for example, a machine that mistakenly
+         * includes two CPU components may, aside from wasting memory, end up with odd side-effects, like unresponsive
+         * CPU controls.
+         */
+        Component.add(this);
+    }
+
+    /**
+     * Component.add(component)
+     *
+     * @param {Component} component
+     */
+    static add(component)
+    {
+        /*
+         * This just generates a lot of useless noise, handy in the early days, not so much these days....
+         *
+         *      if (DEBUG) Component.log("Component.add(" + component.type + "," + component.id + ")");
+         */
+        Component.components.push(component);
+    }
+
+    /**
+     * Component.addMachine(idMachine)
+     *
+     * @param {string} idMachine
+     */
+    static addMachine(idMachine)
+    {
+        Component.machines[idMachine] = {};
+    }
+
+    /**
+     * Component.addMachineResource(idMachine, sName, data)
+     *
+     * @param {string} idMachine
+     * @param {string|null} sName (name of the resource)
+     * @param {*} data
+     */
+    static addMachineResource(idMachine, sName, data)
+    {
+        /*
+         * I used to assert(Component.machines[idMachine]), but when we're running as a Node app, embed.js is not used,
+         * so addMachine() is never called, so resources do not need to be recorded.
+         */
+        if (Component.machines[idMachine] && sName) {
+            Component.machines[idMachine][sName] = data;
+        }
+    }
+
+    /**
+     * Component.getMachineResources(idMachine)
+     *
+     * @param {string} idMachine
+     * @return {Object|undefined}
+     */
+    static getMachineResources(idMachine)
+    {
+        return Component.machines[idMachine];
+    }
+
+    /**
+     * Component.getTime()
+     *
+     * @return {number} the current time, in milliseconds
+     */
+    static getTime()
+    {
+        return Date.now() || +new Date();
+    }
+
+    /**
+     * Component.log(s, type)
+     *
+     * For diagnostic output only.
+     *
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     */
+    static log(s, type)
+    {
+        if (!COMPILED) {
+            if (s) {
+                var sElapsed = "", sMsg = (type? (type + ": ") : "") + s;
+                if (typeof Usr != "undefined") {
+                    if (Component.msStart === undefined) {
+                        Component.msStart = Component.getTime();
+                    }
+                    sElapsed = (Component.getTime() - Component.msStart) + "ms: ";
+                }
+                if (window && window.console) console.log(sElapsed + sMsg.replace(/\n/g, " "));
+            }
+        }
+    }
+
+    /**
+     * Component.assert(f, s)
+     *
+     * Verifies conditions that must be true (for DEBUG builds only).
+     *
+     * The Closure Compiler should automatically remove all references to Component.assert() in non-DEBUG builds.
+     * TODO: Add a task to the build process that "asserts" there are no instances of "assertion failure" in RELEASE builds.
+     *
+     * @param {boolean} f is the expression we are asserting to be true
+     * @param {string} [s] is description of the assertion on failure
+     */
+    static assert(f, s)
+    {
+        if (DEBUG) {
+            if (!f) {
+                if (!s) s = "assertion failure";
+                Component.log(s);
+                throw new Error(s);
+            }
+        }
+    }
+
+    /**
+     * Component.println(s, type, id)
+     *
+     * For non-diagnostic messages, which components may override to control the destination/appearance of their output.
+     *
+     * Components that inherit from this class should use the instance method, this.println(), rather than Component.println(),
+     * because if a Control Panel is loaded, it will override only the instance method, not the class method (overriding the class
+     * method would improperly affect any other machines loaded on the same page).
+     *
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     * @param {string} [id] is the caller's ID, if any
+     */
+    static println(s, type, id)
+    {
+        if (!COMPILED) {
+            Component.log((id? (id + ": ") : "") + (s? ("\"" + s + "\"") : ""), type);
+        }
+    }
+
+    /**
+     * Component.notice(s, fPrintOnly, id)
+     *
+     * notice() is like println() but implies a need for user notification, so we alert() as well.
+     *
+     * @param {string} s is the message text
+     * @param {boolean} [fPrintOnly]
+     * @param {string} [id] is the caller's ID, if any
+     */
+    static notice(s, fPrintOnly, id)
+    {
+        if (!COMPILED) {
+            Component.println(s, "notice", id);
+        }
+        if (!fPrintOnly) Component.alertUser((id? (id + ": ") : "") + s);
+    }
+
+    /**
+     * Component.warning(s)
+     *
+     * @param {string} s describes the warning
+     */
+    static warning(s)
+    {
+        if (!COMPILED) {
+            Component.println(s, "warning");
+        }
+        Component.alertUser(s);
+    }
+
+    /**
+     * Component.error(s)
+     *
+     * @param {string} s describes the error; an alert() is displayed as well
+     */
+    static error(s)
+    {
+        if (!COMPILED) {
+            Component.println(s, "error");
+        }
+        Component.alertUser(s);
+    }
+
+    /**
+     * Component.alertUser(sMessage)
+     *
+     * @param {string} sMessage
+     */
+    static alertUser(sMessage)
+    {
+        if (window) {
+            window.alert(sMessage);
+        } else {
+            Component.log(sMessage);
+        }
+    };
+
+    /**
+     * Component.confirmUser(sPrompt)
+     *
+     * @param {string} sPrompt
+     * @returns {boolean} true if the user clicked OK, false if Cancel/Close
+     */
+    static confirmUser(sPrompt)
+    {
+        var fResponse = false;
+        if (window) {
+            fResponse = window.confirm(sPrompt);
+        }
+        return fResponse;
+    }
+
+    /**
+     * Component.promptUser()
+     *
+     * @param {string} sPrompt
+     * @param {string} [sDefault]
+     * @returns {string|null}
+     */
+    static promptUser(sPrompt, sDefault)
+    {
+        var sResponse = null;
+        if (window) {
+            sResponse = window.prompt(sPrompt, sDefault === undefined? "" : sDefault);
+        }
+        return sResponse;
+    }
+
+    /**
+     * Component.getComponents(idRelated)
+     *
+     * We could store components as properties, using the component's ID, and change
+     * this linear lookup into a property lookup, but some components may have no ID.
+     *
+     * @param {string} [idRelated] of related component
+     * @return {Array} of components
+     */
+    static getComponents(idRelated)
+    {
+        var i;
+        var aComponents = [];
+        /*
+         * getComponentByID(id, idRelated)
+         *
+         * If idRelated is provided, we check it for a machine prefix, and use any
+         * existing prefix to constrain matches to IDs with the same prefix, in order to
+         * avoid matching components belonging to other machines.
+         */
+        if (idRelated) {
+            if ((i = idRelated.indexOf('.')) > 0)
+                idRelated = idRelated.substr(0, i + 1);
+            else
+                idRelated = "";
+        }
+        for (i = 0; i < Component.components.length; i++) {
+            var component = Component.components[i];
+            if (!idRelated || !component.id.indexOf(idRelated)) {
+                aComponents.push(component);
+            }
+        }
+        return aComponents;
+    }
+
+    /**
+     * Component.getComponentByID(id, idRelated)
+     *
+     * We could store components as properties, using the component's ID, and change
+     * this linear lookup into a property lookup, but some components may have no ID.
+     *
+     * @param {string} id of the desired component
+     * @param {string} [idRelated] of related component
+     * @return {Component|null}
+     */
+    static getComponentByID(id, idRelated)
+    {
+        if (id !== undefined) {
+            var i;
+            /*
+             * If idRelated is provided, we check it for a machine prefix, and use any
+             * existing prefix to constrain matches to IDs with the same prefix, in order to
+             * avoid matching components belonging to other machines.
+             */
+            if (idRelated && (i = idRelated.indexOf('.')) > 0) {
+                id = idRelated.substr(0, i + 1) + id;
+            }
+            for (i = 0; i < Component.components.length; i++) {
+                if (Component.components[i].id === id) {
+                    return Component.components[i];
+                }
+            }
+            if (Component.components.length) {
+                Component.log("Component ID '" + id + "' not found", "warning");
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Component.getComponentByType(sType, idRelated, componentPrev)
+     *
+     * @param {string} sType of the desired component
+     * @param {string} [idRelated] of related component
+     * @param {Component|null} [componentPrev] of previously returned component, if any
+     * @return {Component|null}
+     */
+    static getComponentByType(sType, idRelated, componentPrev)
+    {
+        if (sType !== undefined) {
+            var i;
+            /*
+             * If idRelated is provided, we check it for a machine prefix, and use any
+             * existing prefix to constrain matches to IDs with the same prefix, in order to
+             * avoid matching components belonging to other machines.
+             */
+            if (idRelated) {
+                if ((i = idRelated.indexOf('.')) > 0) {
+                    idRelated = idRelated.substr(0, i + 1);
+                } else {
+                    idRelated = "";
+                }
+            }
+            for (i = 0; i < Component.components.length; i++) {
+                if (componentPrev) {
+                    if (componentPrev == Component.components[i]) componentPrev = null;
+                    continue;
+                }
+                if (sType == Component.components[i].type && (!idRelated || !Component.components[i].id.indexOf(idRelated))) {
+                    return Component.components[i];
+                }
+            }
+            Component.log("Component type '" + sType + "' not found", "warning");
+        }
+        return null;
+    }
+
+    /**
+     * Component.getComponentParms(element)
+     *
+     * @param {Object} element from the DOM
+     */
+    static getComponentParms(element)
+    {
+        var parms = null;
+        var sParms = element.getAttribute("data-value");
+        if (sParms) {
+            try {
+                parms = eval("(" + sParms + ")");   // jshint ignore:line
+                /*
+                 * We can no longer invoke removeAttribute() because some components (eg, Panel) need
+                 * to run their initXXX() code more than once, to avoid initialization-order dependencies.
+                 *
+                 *      if (!DEBUG) {
+                 *          element.removeAttribute("data-value");
+                 *      }
+                 */
+            } catch(e) {
+                Component.error(e.message + " (" + sParms + ")");
+            }
+        }
+        return parms;
+    }
+
+    /**
+     * Component.bindExternalControl(component, sControl, sBinding, sType)
+     *
+     * @param {Component} component
+     * @param {string} sControl
+     * @param {string} sBinding
+     * @param {string} [sType] is the external component type
+     */
+    static bindExternalControl(component, sControl, sBinding, sType)
+    {
+        if (sControl) {
+            if (sType === undefined) sType = "Panel";
+            var target = Component.getComponentByType(sType, component.id);
+            if (target) {
+                var eBinding = target.bindings[sControl];
+                if (eBinding) {
+                    component.setBinding(null, sBinding, eBinding);
+                }
+            }
+        }
+    }
+
+    /**
+     * Component.bindComponentControls(component, element, sAppClass)
+     *
+     * @param {Component} component
+     * @param {Object} element from the DOM
+     * @param {string} sAppClass
+     */
+    static bindComponentControls(component, element, sAppClass)
+    {
+        var aeControls = Component.getElementsByClass(element.parentNode, sAppClass + "-control");
+
+        for (var iControl = 0; iControl < aeControls.length; iControl++) {
+
+            var aeChildNodes = aeControls[iControl].childNodes;
+
+            for (var iNode = 0; iNode < aeChildNodes.length; iNode++) {
+                var control = aeChildNodes[iNode];
+                if (control.nodeType !== 1 /* document.ELEMENT_NODE */) {
+                    continue;
+                }
+                var sClass = control.getAttribute("class");
+                if (!sClass) continue;
+                var aClasses = sClass.split(" ");
+                for (var iClass = 0; iClass < aClasses.length; iClass++) {
+                    var parms;
+                    sClass = aClasses[iClass];
+                    switch (sClass) {
+                        case sAppClass + "-binding":
+                            parms = Component.getComponentParms(control);
+                            if (parms && parms['binding']) {
+                                component.setBinding(parms['type'], parms['binding'], control, parms['value']);
+                            } else if (!parms || parms['type'] != "description") {
+                                Component.log("Component '" + component.toString() + "' missing binding" + (parms? " for " + parms['type'] : ""), "warning");
+                            }
+                            iClass = aClasses.length;
+                            break;
+                        default:
+                            // if (DEBUG) Component.log("Component.bindComponentControls(" + component.toString() + "): unrecognized control class \"" + sClass + "\"", "warning");
+                            break;
+                    }
+                }
+            }
+        }
+    }
+
+    /**
+     * Component.getElementsByClass(element, sClass, sObjClass)
+     *
+     * This is a cross-browser helper function, since not all browser's support getElementsByClassName()
+     *
+     * TODO: This should probably be moved into weblib.js at some point, along with the control binding functions above,
+     * to keep all the browser-related code together.
+     *
+     * @param {Object} element from the DOM
+     * @param {string} sClass
+     * @param {string} [sObjClass]
+     * @return {Array|NodeList}
+     */
+    static getElementsByClass(element, sClass, sObjClass)
+    {
+        if (sObjClass) sClass += '-' + sObjClass + "-object";
+        /*
+         * Use the browser's built-in getElementsByClassName() if it appears to be available
+         * (for example, it's not available in IE8, but it should be available in IE9 and up)
+         */
+        if (element.getElementsByClassName) {
+            return element.getElementsByClassName(sClass);
+        }
+        var i, j, ae = [];
+        var aeAll = element.getElementsByTagName("*");
+        var re = new RegExp('(^| )' + sClass + '( |$)');
+        for (i = 0, j = aeAll.length; i < j; i++) {
+            if (re.test(aeAll[i].className)) {
+                ae.push(aeAll[i]);
+            }
+        }
+        if (!ae.length) {
+            Component.log('No elements of class "' + sClass + '" found');
+        }
+        return ae;
+    }
+
+    /**
+     * Component.getScriptCommands(sScript)
+     *
+     * This is a simple parser that breaks sScript into an array of commands, where each command
+     * is an array of tokens, where tokens are sequences of characters separated by any of: tab, space,
+     * carriage-return (CR), line-feed (LF), semicolon, single-quote, or double-quote;  if a quote is
+     * used, all characters up to the next matching quote become part of the token, allowing any of the
+     * other separators to be part of the token.  CR, LF and semicolon also serve to terminate a command,
+     * with semicolon being preferred, because it's 1) more visible, and 2) essential when the entire
+     * script is a multi-line string where all CR/LF were replaced by spaces (which is what Jekyll does,
+     * and since we can't change Jekyll, it's what our own MarkDown Front Matter parser does as well;
+     * see convertMD() in markout.js, where the aCommandDefs array is built).
+     *
+     * Backslash sequences like \n, \r, and \\ have already been converted to LF, CR and backslash
+     * characters, since the entire script string is injected into a JavaScript function call, so any
+     * backslash sequence that JavaScript supports is automatically converted:
+     *
+     *      \0  \'  \"  \\  \n  \r  \v  \t  \b  \f  \uXXXX \xXX
+     *                      ^J  ^M  ^K  ^I  ^H  ^L
+     *
+     * To support any other non-printable 8-bit character, such as ESC, you should use \xXX, where XX
+     * is the ASCII code in hex.  For ESC, that would \x1B.
+     *
+     * @param {string} sScript
+     * @return {Array}
+     */
+    static getScriptCommands(sScript)
+    {
+        var cch = sScript.length;
+        var aCommands = [], aTokens = [], sToken = "", chQuote = null;
+        for (var i = 0; i < cch; i++) {
+            var ch = sScript[i];
+            if (ch == '"' || ch == "'") {
+                if (chQuote && ch != chQuote) {
+                    sToken += ch;
+                    continue;
+                }
+                if (!chQuote) {
+                    chQuote = ch;
+                } else {
+                    chQuote = null;
+                }
+                if (sToken) {
+                    aTokens.push(sToken);
+                    sToken = "";
+                }
+                continue;
+            }
+            if (!chQuote) {
+                if (ch == '\r' || ch == '\n') {
+                    ch = ';';
+                }
+                if (ch == ' ' || ch == '\t' || ch == ';') {
+                    if (sToken) {
+                        aTokens.push(sToken);
+                        sToken = "";
+                    }
+                    if (ch == ';' && aTokens.length) {
+                        aCommands.push(aTokens);
+                        aTokens = [];
+                    }
+                    continue;
+                }
+            }
+            sToken += ch;
+        }
+        if (sToken) {
+            aTokens.push(sToken);
+        }
+        if (aTokens.length) {
+            aCommands.push(aTokens);
+        }
+        return aCommands;
+    }
+
+    /**
+     * Component.processScript(idMachine, sScript)
+     *
+     * @param {string} idMachine
+     * @param {string} sScript
+     * @return {boolean}
+     */
+    static processScript(idMachine, sScript)
+    {
+        var fSuccess = false;
+        idMachine += ".machine";
+        if (typeof sScript == "string" && !Component.commands[idMachine]) {
+            fSuccess = true;
+            Component.commands[idMachine] = Component.getScriptCommands(sScript);
+            if (!Component.processCommands(idMachine)) {
+                fSuccess = false;
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * Component.processCommands(idMachine)
+     *
+     * @param {string} idMachine
+     * @return {boolean}
+     */
+    static processCommands(idMachine)
+    {
+        var fSuccess = true;
+        var aCommands = Component.commands[idMachine];
+
+     // var dbg = Component.getComponentByType("Debugger", idMachine);
+
+        while (aCommands && aCommands.length) {
+
+            var aTokens = aCommands.splice(0, 1)[0];
+            var sCommand = aTokens[0];
+
+            /*
+             * It's possible to route this output to the Debugger window with dbg.println()
+             * instead, but it's a bit too confusing mingling script output in a window that
+             * already mingles Debugger and machine output.
+             */
+            Component.println('script: ' + aTokens.join(' '));
+
+            var fnCallReady = null;
+            if (Component.asyncCommands.indexOf(sCommand) >= 0) {
+                fnCallReady = function processNextCommand() {
+                    return function() {
+                        Component.processCommands(idMachine);
+                    }
+                }();
+            }
+
+            var fnCommand = Component.globalCommands[sCommand];
+            if (fnCommand) {
+                if (!fnCallReady) {
+                    fSuccess = fnCommand(aTokens[1], aTokens[2], aTokens[3]);
+                } else {
+                    if (!fnCommand(fnCallReady, aTokens[1], aTokens[2], aTokens[3])) break;
+                }
+            }
+            else {
+                fSuccess = false;
+                var component = Component.getComponentByType(aTokens[1], idMachine);
+                if (component) {
+                    fnCommand = Component.componentCommands[sCommand];
+                    if (fnCommand) {
+                        fSuccess = fnCommand(component, aTokens[2], aTokens[3]);
+                    }
+                    else {
+                        var exports = component['exports'];
+                        if (exports) {
+                            fnCommand = exports[sCommand];
+                            if (fnCommand) {
+                                fSuccess = true;
+                                if (!fnCallReady) {
+                                    fSuccess = fnCommand.call(component, aTokens[2], aTokens[3]);
+                                } else {
+                                    if (!fnCommand.call(component, fnCallReady, aTokens[2], aTokens[3])) break;
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+
+            if (!fSuccess) {
+                Component.alertUser("Script error: " + sCommand + (fnCommand? " failed" : " unrecognized"));
+                break;
+            }
+        }
+
+        if (aCommands && !aCommands.length) {
+            delete Component.commands[idMachine];
+        }
+
+        return fSuccess;
+    }
+
+    /**
+     * Component.scriptAlert(sMessage)
+     *
+     * @param {string} sMessage
+     * @return {boolean}
+     */
+    static scriptAlert(sMessage)
+    {
+        Component.alertUser(sMessage);
+        return true;
+    }
+
+    /**
+     * Component.scriptSelect(component, sBinding, sValue)
+     *
+     * @param {Component} component
+     * @param {string} sBinding
+     * @param {string} sValue
+     * @return {boolean}
+     */
+    static scriptSelect(component, sBinding, sValue)
+    {
+        var fSuccess = false;
+        var aBindings = component['bindings'];
+        var control = aBindings[sBinding];
+        if (control) {
+            for (var i = 0; i < control.options.length; i++) {
+                if (control.options[i].textContent == sValue) {
+                    if (control.selectedIndex != i) {
+                        control.selectedIndex = i;
+                    }
+                    fSuccess = true;
+                    break;
+                }
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * Component.scriptSleep(fnCallback, sDelay)
+     *
+     * @param {function()} fnCallback
+     * @param {string} sDelay (in milliseconds)
+     * @return {boolean}
+     */
+    static scriptSleep(fnCallback, sDelay)
+    {
+        setTimeout(fnCallback, +sDelay);
+        return false;
+    }
+
+    /**
+     * toString()
+     *
+     * @this {Component}
+     * @return {string}
+     */
+    toString() {
+        return (this.name? this.name : (this.id || this.type));
+    }
+
+    /**
+     * getMachineNum()
+     *
+     * @this {Component}
+     * @return {number} unique machine number
+     */
+    getMachineNum() {
+        var nMachine = 1;
+        if (this.idMachine) {
+            var aDigits = this.idMachine.match(/\d+/);
+            if (aDigits !== null)
+                nMachine = parseInt(aDigits[0], 10);
+        }
+        return nMachine;
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * Component's setBinding() method is intended to be overridden by subclasses.
+     *
+     * @this {Component}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "reset")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue) {
+        switch (sBinding) {
+        case "clear":
+            if (!this.bindings[sBinding]) {
+                this.bindings[sBinding] = control;
+                control.onclick = (function(component) {
+                    return function clearPanel() {
+                        if (component.bindings['print']) {
+                            component.bindings['print'].value = "";
+                        }
+                    };
+                }(this));
+            }
+            return true;
+        case "print":
+            if (!this.bindings[sBinding]) {
+                this.bindings[sBinding] = control;
+                /*
+                 * HACK: Save this particular HTML element so that the Debugger can access it, too
+                 */
+                this.controlPrint = control;
+                /*
+                 * This was added for Firefox (Safari automatically clears the <textarea> on a page reload,
+                 * but Firefox does not).
+                 */
+                control.value = "";
+                this.println = (function(control) {
+                    return function printPanel(s, type) {
+                        s = (type !== undefined? (type + ": ") : "") + (s || "");
+                        /*
+                         * Prevent the <textarea> from getting too large; otherwise, printing becomes slower and slower.
+                         */
+                        if (COMPILED) {
+                            if (control.value.length > 8192) {
+                                control.value = control.value.substr(control.value.length - 4096);
+                            }
+                        }
+                        control.value += s + "\n";
+                        control.scrollTop = control.scrollHeight;
+                        if (!COMPILED && window && window.console) console.log(s);
+                    };
+                }(control));
+                /**
+                 * Override this.notice() with a replacement function that eliminates the Component.alertUser() call
+                 *
+                 * @this {Component}
+                 * @param {string} s
+                 * @param {boolean} [fPrintOnly]
+                 * @param {string} [id]
+                 */
+                this.notice = function noticePanel(s, fPrintOnly, id) {
+                    this.println(s, this.idComponent);
+                };
+            }
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    /**
+     * log(s, type)
+     *
+     * For diagnostic output only.
+     *
+     * WARNING: Even though this function's body is completely wrapped in DEBUG, that won't prevent the Closure Compiler
+     * from including it, so all calls must still be prefixed with "if (DEBUG) ....".  For this reason, the class method,
+     * Component.log(), is preferred, because the compiler IS smart enough to remove those calls.
+     *
+     * @this {Component}
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     */
+    log(s, type) {
+        if (!COMPILED) {
+            Component.log(s, type || this.id || this.type);
+        }
+    }
+
+    /**
+     * assert(f, s)
+     *
+     * Verifies conditions that must be true (for DEBUG builds only).
+     *
+     * WARNING: Make sure you preface all calls to this.assert() with "if (DEBUG)", because unlike Component.assert(),
+     * the Closure Compiler can't be sure that this instance method hasn't been overridden, so it refuses to treat it as
+     * dead code in non-DEBUG builds.
+     *
+     * TODO: Add a task to the build process that "asserts" there are no instances of "assertion failure" in RELEASE builds.
+     *
+     * @this {Component}
+     * @param {boolean|number} f is the expression asserted to be true
+     * @param {string} [s] is a description of the assertion to be displayed or logged on failure
+     */
+    assert(f, s) {
+        if (DEBUG) {
+            if (!f) {
+                s = "assertion failure in " + (this.id || this.type) + (s? ": " + s : "");
+                if (DEBUGGER && this.dbg) {
+                    this.dbg.stopCPU();
+                    /*
+                     * Why do we throw an Error only to immediately catch and ignore it?  Simply to give
+                     * any IDE the opportunity to inspect the application's state.  Even when the IDE has
+                     * control, you should still be able to invoke Debugger commands from the IDE's REPL,
+                     * using the '$' global function that the Debugger constructor defines; eg:
+                     *
+                     *      $('r')
+                     *      $('dw 0:0')
+                     *      $('h')
+                     *      ...
+                     *
+                     * If you have no desire to stop on assertions, consider this a no-op.  However, another
+                     * potential benefit of creating an Error object is that, for browsers like Chrome, we get
+                     * a stack trace, too.
+                     */
+                    try {
+                        throw new Error(s);
+                    } catch(e) {
+                        this.println(e.stack || e.message);
+                    }
+                    return;
+                }
+                this.log(s);
+                throw new Error(s);
+            }
+        }
+    }
+
+    /**
+     * println(s, type)
+     *
+     * For non-diagnostic messages, which components may override to control the destination/appearance of their output.
+     *
+     * Components using this.println() should wait until after their constructor has run to display any messages, because
+     * if a Control Panel has been loaded, its override will not take effect until its own constructor has run.
+     *
+     * @this {Component}
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     * @param {string} [id] is the caller's ID, if any
+     */
+    println(s, type, id) {
+        Component.println(s, type, id || this.id);
+    }
+
+    /**
+     * status(s)
+     *
+     * status() is like println() but it also includes information about the component (ie, the component ID),
+     * which is why there is no corresponding Component.status() function.
+     *
+     * @param {string} s is the message text
+     */
+    status(s) {
+        this.println(this.idComponent + ": " + s);
+    }
+
+    /**
+     * notice(s, fPrintOnly)
+     *
+     * notice() is like println() but implies a need for user notification, so we alert() as well; however, if this.println()
+     * is overridden, this.notice will be replaced with a similar override, on the assumption that the override is taking care
+     * of alerting the user.
+     *
+     * @this {Component}
+     * @param {string} s is the message text
+     * @param {boolean} [fPrintOnly]
+     * @param {string} [id] is the caller's ID, if any
+     */
+    notice(s, fPrintOnly, id) {
+        Component.notice(s, fPrintOnly, id || this.type);
+    }
+
+    /**
+     * setError(s)
+     *
+     * Set a fatal error condition
+     *
+     * @this {Component}
+     * @param {string} s describes a fatal error condition
+     */
+    setError(s) {
+        this.flags.error = true;
+        this.notice(s);         // TODO: Any cases where we should still prefix this string with "Fatal error: "?
+    }
+
+    /**
+     * clearError()
+     *
+     * Clear any fatal error condition
+     *
+     * @this {Component}
+     */
+    clearError() {
+        this.flags.error = false;
+    }
+
+    /**
+     * isError()
+     *
+     * Report any fatal error condition
+     *
+     * @this {Component}
+     * @return {boolean} true if a fatal error condition exists, false if not
+     */
+    isError() {
+        if (this.flags.error) {
+            this.println(this.toString() + " error");
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * isReady(fnReady)
+     *
+     * Return the "ready" state of the component; if the component is not ready, it will queue the optional
+     * notification function, otherwise it will immediately call the notification function, if any, without queuing it.
+     *
+     * NOTE: Since only the Computer component actually cares about the "readiness" of other components, the so-called
+     * "queue" of notification functions supports exactly one function.  This keeps things nice and simple.
+     *
+     * @this {Component}
+     * @param {function()} [fnReady]
+     * @return {boolean} true if the component is in a "ready" state, false if not
+     */
+    isReady(fnReady) {
+        if (fnReady) {
+            if (this.flags.ready) {
+                fnReady();
+            } else {
+                if (MAXDEBUG) this.log("NOT ready");
+                this.fnReady = fnReady;
+            }
+        }
+        return this.flags.ready;
+    }
+
+    /**
+     * setReady(fReady)
+     *
+     * Set the "ready" state of the component to true, and call any queued notification functions.
+     *
+     * @this {Component}
+     * @param {boolean} [fReady] is assumed to indicate "ready" unless EXPLICITLY set to false
+     */
+    setReady(fReady) {
+        if (!this.flags.error) {
+            this.flags.ready = (fReady !== false);
+            if (this.flags.ready) {
+                if (MAXDEBUG /* || this.name */) this.log("ready");
+                var fnReady = this.fnReady;
+                this.fnReady = null;
+                if (fnReady) fnReady();
+            }
+        }
+    }
+
+    /**
+     * isBusy(fCancel)
+     *
+     * Return the "busy" state of the component
+     *
+     * @this {Component}
+     * @param {boolean} [fCancel] is set to true to cancel a "busy" state
+     * @return {boolean} true if "busy", false if not
+     */
+    isBusy(fCancel) {
+        if (this.flags.busy) {
+            if (fCancel) {
+                this.flags.busyCancel = true;
+            } else if (fCancel === undefined) {
+                this.println(this.toString() + " busy");
+            }
+        }
+        return this.flags.busy;
+    }
+
+    /**
+     * setBusy(fBusy)
+     *
+     * Update the current busy state; if a busyCancel request is pending, it will be honored now.
+     *
+     * @this {Component}
+     * @param {boolean} fBusy
+     * @return {boolean}
+     */
+    setBusy(fBusy) {
+        if (this.flags.busyCancel) {
+            this.flags.busy = false;
+            this.flags.busyCancel = false;
+            return false;
+        }
+        if (this.flags.error) {
+            this.println(this.toString() + " error");
+            return false;
+        }
+        this.flags.busy = fBusy;
+        return this.flags.busy;
+    }
+
+    /**
+     * powerUp(fSave)
+     *
+     * @this {Component}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower] is true if this is "repower" notification
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower) {
+        this.flags.powered = true;
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {Component}
+     * @param {boolean} fSave
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown) {
+        if (fShutdown) this.flags.powered = false;
+        return true;
+    }
+
+    /**
+     * messageEnabled(bitsMessage)
+     *
+     * If bitsMessage is not specified, the component's MESSAGE category is used.
+     *
+     * @this {Component}
+     * @param {number} [bitsMessage] is zero or more MESSAGE_* category flag(s)
+     * @return {boolean} true if all specified message enabled, false if not
+     */
+    messageEnabled(bitsMessage) {
+        if (DEBUGGER && this.dbg) {
+            if (this === this.dbg) {
+                bitsMessage |= 0;
+            } else {
+                bitsMessage = bitsMessage || this.bitsMessage;
+            }
+            var bitsEnabled = this.dbg.bitsMessage & bitsMessage;
+            return (!!bitsMessage && bitsEnabled === bitsMessage || !!(bitsEnabled & this.dbg.bitsWarning));
+        }
+        return false;
+    }
+
+    /**
+     * printMessage(sMessage, bitsMessage, fAddress)
+     *
+     * If bitsMessage is not specified, the component's MESSAGE category is used.
+     * If bitsMessage is true, the message is displayed regardless.
+     *
+     * @this {Component}
+     * @param {string} sMessage is any caller-defined message string
+     * @param {number|boolean} [bitsMessage] is zero or more MESSAGE_* category flag(s)
+     * @param {boolean} [fAddress] is true to display the current address
+     */
+    printMessage(sMessage, bitsMessage, fAddress) {
+        if (DEBUGGER && this.dbg) {
+            if (bitsMessage === true || this.messageEnabled(bitsMessage | 0)) {
+                this.dbg.message(sMessage, fAddress);
+            }
+        }
+    }
+
+    /**
+     * printMessageIO(port, bOut, addrFrom, name, bIn, bitsMessage)
+     *
+     * If bitsMessage is not specified, the component's MESSAGE category is used.
+     * If bitsMessage is true, the message is displayed as long as MESSAGE.PORT is enabled.
+     *
+     * @this {Component}
+     * @param {number} port
+     * @param {number|null} bOut if an output operation
+     * @param {number|null} [addrFrom]
+     * @param {string|null} [name] of the port, if any
+     * @param {number|null} [bIn] is the input value, if known, on an input operation
+     * @param {number|boolean} [bitsMessage] is zero or more MESSAGE_* category flag(s)
+     */
+    printMessageIO(port, bOut, addrFrom, name, bIn, bitsMessage) {
+        if (DEBUGGER && this.dbg) {
+            if (bitsMessage === true) {
+                bitsMessage = 0;
+            } else if (bitsMessage == null) {
+                bitsMessage = this.bitsMessage;
+            }
+            this.dbg.messageIO(this, port, bOut, addrFrom, name, bIn, bitsMessage);
+        }
+    }
+}
+
+/*
+ * Every component created on the current page is recorded in this array (see Component.add()),
+ * enabling any component to locate another component by ID (see Component.getComponentByID())
+ * or by type (see Component.getComponentByType()).
+ *
+ * Every machine on the page are now recorded as well, by their machine ID.  We then record the
+ * various resources used by that machine.
+ *
+ * Includes a fallback for non-browser-based environments (ie, Node).  TODO: This will need to be
+ * tailored to Node, probably using the global object instead of the window object, if we ever want
+ * to support multi-machine configs in that environment.
+ */
+if (window) {
+    if (!window['PCjs']) window['PCjs'] = {};
+    if (!window['PCjs']['Machines']) window['PCjs']['Machines'] = {};
+    if (!window['PCjs']['Components']) window['PCjs']['Components'] = [];
+    if (!window['PCjs']['Commands']) window['PCjs']['Commands'] = {};
+}
+Component.machines = window? window['PCjs']['Machines'] : {};
+Component.components = window? window['PCjs']['Components'] : [];
+Component.commands = window? window['PCjs']['Commands'] : {};
+
+Component.asyncCommands = [
+    'hold', 'sleep', 'wait'
+];
+Component.globalCommands = {
+    'alert': Component.scriptAlert,
+    'sleep': Component.scriptSleep
+};
+Component.componentCommands = {
+    'select':   Component.scriptSelect
+};
+
+/*
+ * The following polyfills provide ES5 functionality that's missing in older browsers (eg, IE8),
+ * allowing PCjs apps to run without slamming into exceptions; however, due to the lack of HTML5 canvas
+ * support in those browsers, all you're likely to see are "soft" errors (eg, "Missing <canvas> support").
+ *
+ * Perhaps we can implement a text-only faux video display for a fun retro-browser experience someday.
+ *
+ * TODO: Come up with a better place to put these polyfills.  We will likely have more if we decide to
+ * make the leap from ES5 to ES6 features.
+ */
+
+/*
+ * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/indexOf
+ */
+if (!Array.prototype.indexOf) {
+    Array.prototype.indexOf = function(obj, start) {
+        for (var i = (start || 0), j = this.length; i < j; i++) {
+            if (this[i] === obj) { return i; }
+        }
+        return -1;
+    }
+}
+
+/*
+ * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/isArray
+ */
+if (!Array.isArray) {
+    Array.isArray = function(arg) {
+        return Object.prototype.toString.call(arg) === '[object Array]';
+    };
+}
+
+/*
+ * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/bind
+ */
+if (!Function.prototype.bind) {
+    Function.prototype.bind = function(obj) {
+        if (typeof this != "function") {
+            // Closest thing possible to the ECMAScript 5 internal IsCallable function
+            throw new TypeError("Function.prototype.bind: non-callable object");
+        }
+        var args = Array.prototype.slice.call(arguments, 1);
+        var fToBind = this;
+        var fnNOP = /** @constructor */ (function() {});
+        var fnBound = function() {
+            return fToBind.apply(this instanceof fnNOP && obj? this : obj, args.concat(Array.prototype.slice.call(arguments)));
+        };
+        fnNOP.prototype = this.prototype;
+        fnBound.prototype = new fnNOP();
+        return fnBound;
+    };
+}
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pc8080/lib/defines.js (C) Jeff Parsons 2012-2017
+ */
+
+/**
+ * @define {string}
+ */
+var APPCLASS = "pc8080";        // this @define is the default application class (eg, "pcx86", "c1pjs")
+
+/**
+ * @define {string}
+ */
+var APPNAME = "PC8080";         // this @define is the default application name (eg, "PCx86", "C1Pjs")
+
+/**
+ * @define {boolean}
+ *
+ * WARNING: DEBUGGER needs to accurately reflect whether or not the Debugger component is (or will be) loaded.
+ * In the compiled case, we rely on the Closure Compiler to override DEBUGGER as appropriate.  When it's *false*,
+ * nearly all of debugger.js will be conditionally removed by the compiler, reducing it to little more than a
+ * "type skeleton", which also solves some type-related warnings we would otherwise have if we tried to remove
+ * debugger.js from the compilation process altogether.
+ *
+ * However, when we're in "development mode" and running uncompiled code in debugger-less configurations,
+ * I would like to skip loading debugger.js altogether.  When doing that, we must ALSO arrange for an additional file
+ * (nodebugger.js) to be loaded immediately after this file, which *explicitly* overrides DEBUGGER with *false*.
+ */
+var DEBUGGER = true;            // this @define is overridden by the Closure Compiler to remove Debugger-related support
+
+/**
+ * @define {boolean}
+ *
+ * BYTEARRAYS is a Closure Compiler compile-time option that allocates an Array of numbers for every Memory block,
+ * where each a number represents ONE byte; very wasteful, but potentially slightly faster.
+ *
+ * See the Memory component for details.
+ */
+var BYTEARRAYS = false;
+
+/**
+ * TYPEDARRAYS enables use of typed arrays for Memory blocks.  This used to be a compile-time-only option, but I've
+ * added Memory access functions for typed arrays (see Memory8080.afnTypedArray), so support can be enabled dynamically now.
+ *
+ * See the Memory component for details.
+ */
+var TYPEDARRAYS = (typeof ArrayBuffer !== 'undefined');
+
+/*
+ * Combine all the shared globals and machine-specific globals into one machine-specific global object,
+ * which all machine components should start using; eg: "if (PC8080.DEBUG) ..." instead of "if (DEBUG) ...".
+ */
+var PC8080 = {
+    APPCLASS:    APPCLASS,
+    APPNAME:     APPNAME,
+    APPVERSION:  APPVERSION,    // shared
+    BYTEARRAYS:  BYTEARRAYS,
+    COMPILED:    COMPILED,      // shared
+    CSSCLASS:    CSSCLASS,      // shared
+    DEBUG:       DEBUG,         // shared
+    DEBUGGER:    DEBUGGER,
+    MAXDEBUG:    MAXDEBUG,      // shared
+    PRIVATE:     PRIVATE,       // shared
+    TYPEDARRAYS: TYPEDARRAYS,
+    SITEHOST:    SITEHOST,      // shared
+    XMLVERSION:  XMLVERSION     // shared
+};
+
+
+/**
+ * @copyright http://pcjs.org/modules/pc8080/lib/cpudef.js (C) Jeff Parsons 2012-2017
+ */
+
+var CPUDef8080 = {
+    /*
+     * CPU model numbers (supported)
+     */
+    MODEL_8080: 8080,
+
+    /*
+     * This constant is used to mark points in the code where the physical address being returned
+     * is invalid and should not be used.
+     *
+     * In a 32-bit CPU, -1 (ie, 0xffffffff) could actually be a valid address, so consider changing
+     * ADDR_INVALID to NaN or null (which is also why all ADDR_INVALID tests should use strict equality
+     * operators).
+     *
+     * The main reason I'm NOT using NaN or null now is my concern that, by mixing non-numbers
+     * (specifically, values outside the range of signed 32-bit integers), performance may suffer.
+     *
+     * WARNING: Like many of the properties defined here, ADDR_INVALID is a common constant, which the
+     * Closure Compiler will happily inline (with or without @const annotations; in fact, I've yet to
+     * see a @const annotation EVER improve automatic inlining).  However, if you don't make ABSOLUTELY
+     * certain that this file is included BEFORE the first reference to any of these properties, that
+     * automatic inlining will no longer occur.
+     */
+    ADDR_INVALID: -1,
+
+    /*
+     * Processor Status flag definitions (stored in regPS)
+     */
+    PS: {
+        CF:     0x0001,         // bit 0: Carry Flag
+        BIT1:   0x0002,         // bit 1: reserved, always set
+        PF:     0x0004,         // bit 2: Parity Flag
+        BIT3:   0x0008,         // bit 3: reserved, always clear
+        AF:     0x0010,         // bit 4: Auxiliary Carry Flag
+        BIT5:   0x0020,         // bit 5: reserved, always clear
+        ZF:     0x0040,         // bit 6: Zero Flag
+        SF:     0x0080,         // bit 7: Sign Flag
+        ALL:    0x00D5,         // all "arithmetic" flags (CF, PF, AF, ZF, SF)
+        MASK:   0x00FF,         //
+        IF:     0x0200          // bit 9: Interrupt Flag (set if interrupts enabled; Intel calls this the INTE bit)
+    },
+    PARITY:  [                  // 256-byte array with a 1 wherever the number of set bits of the array index is EVEN
+        1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+        0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+        0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+        1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+        0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+        1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+        1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+        0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+        0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+        1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+        1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+        0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+        1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+        0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+        0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+        1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
+    ],
+    /*
+     * Interrupt-related flags (stored in intFlags)
+     */
+    INTFLAG: {
+        NONE:   0x0000,
+        INTR:   0x00ff,         // mask for 8 bits, representing interrupt levels 0-7
+        HALT:   0x0100          // halt requested; see opHLT()
+    },
+    /*
+     * Opcode definitions
+     */
+    OPCODE: {
+        HLT:    0x76,           // Halt
+        ACI:    0xCE,           // Add with Carry Immediate (affects PS.ALL)
+        CALL:   0xCD,           // Call
+        RST0:   0xC7
+        // to be continued....
+    }
+};
+
+/*
+ * These are the internal PS bits (outside of PS.MASK) that getPS() and setPS() can get and set,
+ * but which cannot be seen with any of the documented instructions.
+ */
+CPUDef8080.PS.INTERNAL  =   (CPUDef8080.PS.IF);
+
+/*
+ * PS "arithmetic" flags are NOT stored in regPS; they are maintained across separate result registers,
+ * hence the RESULT designation.
+ */
+CPUDef8080.PS.RESULT    =   (CPUDef8080.PS.CF | CPUDef8080.PS.PF | CPUDef8080.PS.AF | CPUDef8080.PS.ZF | CPUDef8080.PS.SF);
+
+/*
+ * These are the "always set" PS bits for the 8080.
+ */
+CPUDef8080.PS.SET       =   (CPUDef8080.PS.BIT1);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pc8080/lib/messages.js (C) Jeff Parsons 2012-2017
+ */
+
+var Messages8080 = {
+    CPU:        0x00000001,
+    BUS:        0x00000040,
+    MEM:        0x00000080,
+    PORT:       0x00000100,
+    NVR:        0x00004000,
+    CHIPSET:    0x00008000,
+    KEYBOARD:   0x00010000,
+    KEYS:       0x00020000,
+    VIDEO:      0x00040000,
+    FDC:        0x00080000,
+    DISK:       0x00200000,
+    SERIAL:     0x00800000,
+    SPEAKER:    0x02000000,
+    COMPUTER:   0x04000000,
+    LOG:        0x10000000,
+    WARN:       0x20000000,
+    BUFFER:     0x40000000,
+    HALT:       0x80000000|0
+};
+
+/*
+ * Message categories supported by the messageEnabled() function and other assorted message
+ * functions. Each category has a corresponding bit value that can be combined (ie, OR'ed) as
+ * needed.  The Debugger's message command ("m") is used to turn message categories on and off,
+ * like so:
+ *
+ *      m port on
+ *      m port off
+ *      ...
+ *
+ * NOTE: The order of these categories can be rearranged, alphabetized, etc, as desired; just be
+ * aware that changing the bit values could break saved Debugger states (not a huge concern, just
+ * something to be aware of).
+ */
+Messages8080.CATEGORIES = {
+    "cpu":      Messages8080.CPU,
+    "bus":      Messages8080.BUS,
+    "mem":      Messages8080.MEM,
+    "port":     Messages8080.PORT,
+    "nvr":      Messages8080.NVR,
+    "chipset":  Messages8080.CHIPSET,
+    "keyboard": Messages8080.KEYBOARD,  // "kbd" is also allowed as shorthand for "keyboard"; see doMessages()
+    "key":      Messages8080.KEYS,      // using "key" instead of "keys", since the latter is a method on JavasScript objects
+    "video":    Messages8080.VIDEO,
+    "fdc":      Messages8080.FDC,
+    "disk":     Messages8080.DISK,
+    "serial":   Messages8080.SERIAL,
+    "speaker":  Messages8080.SPEAKER,
+    "computer": Messages8080.COMPUTER,
+    "log":      Messages8080.LOG,
+    "warn":     Messages8080.WARN,
+    /*
+     * Now we turn to message actions rather than message types; for example, setting "halt"
+     * on or off doesn't enable "halt" messages, but rather halts the CPU on any message above.
+     *
+     * Similarly, "m buffer on" turns on message buffering, deferring the display of all messages
+     * until "m buffer off" is issued.
+     */
+    "buffer":   Messages8080.BUFFER,
+    "halt":     Messages8080.HALT
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pc8080/lib/panel.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class Panel8080 extends Component {
+    /**
+     * Panel8080(parmsPanel)
+     *
+     * The Panel8080 component has no required (parmsPanel) properties.
+     *
+     * @this {Panel8080}
+     * @param {Object} parmsPanel
+     */
+    constructor(parmsPanel)
+    {
+        super("Panel", parmsPanel);
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * Most panel layouts don't have bindings of their own, so we pass along all binding requests to the
+     * Computer, CPU, Keyboard and Debugger components first.  The order shouldn't matter, since any component
+     * that doesn't recognize the specified binding should simply ignore it.
+     *
+     * @this {Panel8080}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "reset")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        if (this.cmp && this.cmp.setBinding(sHTMLType, sBinding, control, sValue)) return true;
+        if (this.cpu && this.cpu.setBinding(sHTMLType, sBinding, control, sValue)) return true;
+        if (this.kbd && this.kbd.setBinding(sHTMLType, sBinding, control, sValue)) return true;
+        if (DEBUGGER && this.dbg && this.dbg.setBinding(sHTMLType, sBinding, control, sValue)) return true;
+        return super.setBinding(sHTMLType, sBinding, control, sValue);
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {Panel8080}
+     * @param {Computer8080} cmp
+     * @param {Bus8080} bus
+     * @param {CPUState8080} cpu
+     * @param {Debugger8080} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cmp = cmp;
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+        this.kbd = /** @type {Keyboard8080} */ (cmp.getMachineComponent("Keyboard"));
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {Panel8080}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) Panel8080.init();
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {Panel8080}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return true;
+    }
+
+    /**
+     * updateStatus(fForce)
+     *
+     * Update function for Panels containing elements with high-frequency display requirements.
+     *
+     * For older (and slower) DOM-based display elements, those are sill being managed by the CPUState component,
+     * so it has its own updateStatus() handler.
+     *
+     * The Computer's updateStatus() handler is currently responsible for calling both our handler and the CPU's handler.
+     *
+     * @this {Panel8080}
+     * @param {boolean} [fForce] (true will display registers even if the CPU is running and "live" registers are not enabled)
+     */
+    updateStatus(fForce)
+    {
+    }
+
+    /**
+     * Panel8080.init()
+     *
+     * This function operates on every HTML element of class "panel", extracting the
+     * JSON-encoded parameters for the Panel8080 constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a Panel8080 component, and then binding
+     * any associated HTML controls to the new component.
+     *
+     * NOTE: Unlike most other component init() functions, this one is designed to be
+     * called multiple times: once at load time, so that we can bind our print()
+     * function to the panel's output control ASAP, and again when the Computer component
+     * is verifying that all components are ready and invoking their powerUp() functions.
+     *
+     * Our powerUp() method gives us a second opportunity to notify any components that
+     * that might care (eg, CPU, Keyboard, and Debugger) that we have some controls they
+     * might want to use.
+     */
+    static init()
+    {
+        var fReady = false;
+        var aePanels = Component.getElementsByClass(document, PC8080.APPCLASS, "panel");
+        for (var iPanel=0; iPanel < aePanels.length; iPanel++) {
+            var ePanel = aePanels[iPanel];
+            var parmsPanel = Component.getComponentParms(ePanel);
+            var panel = Component.getComponentByID(parmsPanel['id']);
+            if (!panel) {
+                fReady = true;
+                panel = new Panel8080(parmsPanel);
+            }
+            Component.bindComponentControls(panel, ePanel, PC8080.APPCLASS);
+            if (fReady) panel.setReady();
+        }
+    }
+}
+
+/*
+ * Initialize every Panel module on the page.
+ */
+Web.onInit(Panel8080.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pc8080/lib/bus.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class Bus8080 extends Component {
+    /**
+     * Bus8080(cpu, dbg)
+     *
+     * The Bus8080 component manages physical memory and I/O address spaces.
+     *
+     * The Bus8080 component has no UI elements, so it does not require an init() handler,
+     * but it still inherits from the Component class and must be allocated like any
+     * other device component.  It's currently allocated by the Computer's init() handler,
+     * which then calls the initBus() method of all the other components.
+     *
+     * For memory beyond the simple needs of the ROM and RAM components (ie, memory-mapped
+     * devices), the address space must still be allocated through the Bus8080 component via
+     * addMemory().  If the component needs something more than simple read/write storage,
+     * it must provide a custom controller.
+     *
+     * All port (I/O) operations are defined by external handlers; they register with us,
+     * and we manage those registrations and provide support for I/O breakpoints, but the
+     * only default I/O behavior we provide is ignoring writes to any unregistered output
+     * ports and returning 0xff from any unregistered input ports.
+     *
+     * @this {Bus8080}
+     * @param {Object} parmsBus
+     * @param {CPUState8080} cpu
+     * @param {Debugger8080} dbg
+     */
+    constructor(parmsBus, cpu, dbg)
+    {
+        super("Bus", parmsBus);
+
+        this.cpu = cpu;
+        this.dbg = dbg;
+
+        this.nBusWidth = parmsBus['busWidth'] || 16;
+
+        /*
+         * Compute all Bus8080 memory block parameters, based on the width of the bus.  The entire
+         * address space is divided into blocks, using a block size that is (hopefully) appropriate to
+         * the bus width.  The following table summarizes our simplistic calculations.
+         *
+         *      Bus Width                       Block Shift     Block Size
+         *      ---------                       -----------     ----------
+         *      16 bits (64Kb address space):   10              1Kb (64 maximum blocks)
+         *      18 bits (256Kb address space):  11              2Kb (128 maximum blocks)
+         *      20 bits (1Mb address space):    12              4Kb (256 maximum blocks)
+         *      22 bits (4Mb address space):    13              8Kb (512 maximum blocks)
+         *      24 bits (16Mb address space):   14              16Kb (1K maximum blocks)
+         *      32 bits (4Gb address space);    15              32Kb (128K maximum blocks)
+         *
+         * The coarser block granularities (ie, 16Kb and 32Kb) may cause problems for certain RAM and/or ROM
+         * allocations that are contiguous but are allocated out of order, or that have different controller
+         * requirements.  Your choices, for the moment, are either to ensure the allocations are performed in
+         * order, or to choose smaller nBlockShift values (at the expense of a generating a larger block array).
+         */
+        this.addrTotal = Math.pow(2, this.nBusWidth);
+        this.nBusLimit = this.nBusMask = (this.addrTotal - 1) | 0;
+        this.nBlockShift = (this.nBusWidth >> 1) + 2;
+        if (this.nBlockShift < 10) this.nBlockShift = 10;
+        if (this.nBlockShift > 15) this.nBlockShift = 15;
+        this.nBlockSize = 1 << this.nBlockShift;
+        this.nBlockLen = this.nBlockSize >> 2;
+        this.nBlockLimit = this.nBlockSize - 1;
+        this.nBlockTotal = (this.addrTotal / this.nBlockSize) | 0;
+        this.nBlockMask = this.nBlockTotal - 1;
+
+
+        /*
+         * Lists of I/O notification functions: aPortInputNotify and aPortOutputNotify are arrays, indexed by
+         * port, of sub-arrays which contain:
+         *
+         *      [0]: registered function to call for every I/O access
+         *
+         * The registered function is called with the port address, and if the access was triggered by the CPU,
+         * the instruction pointer (IP) at the point of access.
+         *
+         * WARNING: Unlike the (old) read and write memory notification functions, these support only one
+         * pair of input/output functions per port.  A more sophisticated architecture could support a list
+         * of chained functions across multiple components, but I doubt that will be necessary here.
+         *
+         * UPDATE: The Debugger now piggy-backs on these arrays to indicate ports for which it wants notification
+         * of I/O.  In those cases, the registered component/function elements may or may not be set, but the
+         * following additional element will be set:
+         *
+         *      [1]: true to break on I/O, false to ignore I/O
+         *
+         * The false case is important if fPortInputBreakAll and/or fPortOutputBreakAll is set, because it allows the
+         * Debugger to selectively ignore specific ports.
+         */
+        this.aPortInputNotify = [];
+        this.aPortOutputNotify = [];
+        this.fPortInputBreakAll = this.fPortOutputBreakAll = false;
+
+        /*
+         * By default, all I/O ports are 1 byte wide; ports that are wider must add themselves to one or both of
+         * these lists, using addPortInputWidth() and/or addPortOutputWidth().
+         */
+        this.aPortInputWidth = [];
+        this.aPortOutputWidth = [];
+
+        /*
+         * Allocate empty Memory blocks to span the entire physical address space.
+         */
+        this.initMemory();
+
+        this.setReady();
+    }
+
+    /**
+     * initMemory()
+     *
+     * Allocate enough (empty) Memory blocks to span the entire physical address space.
+     *
+     * @this {Bus8080}
+     */
+    initMemory()
+    {
+        var block = new Memory8080();
+        block.copyBreakpoints(this.dbg);
+        this.aMemBlocks = new Array(this.nBlockTotal);
+        for (var iBlock = 0; iBlock < this.nBlockTotal; iBlock++) {
+            this.aMemBlocks[iBlock] = block;
+        }
+    }
+
+    /**
+     * reset()
+     *
+     * @this {Bus8080}
+     */
+    reset()
+    {
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * We don't need a powerDown() handler, because for largely historical reasons, our state is saved by saveMemory(),
+     * which called by the CPU.
+     *
+     * However, we do need a powerUp() handler, because on resumable machines, the Computer's onReset() function calls
+     * everyone's powerUp() handler rather than their reset() handler.
+     *
+     * TODO: Perhaps Computer should be smarter: if there's no powerUp() handler, then fallback to the reset() handler.
+     * In that case, however, we'd either need to remove the powerUp() stub in Component, or detect the existence of the stub.
+     *
+     * @this {Bus8080}
+     * @param {Object|null} data (always null because we supply no powerDown() handler)
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) this.reset();
+        return true;
+    }
+
+    /**
+     * addMemory(addr, size, type)
+     *
+     * Adds new Memory blocks to the specified address range.  Any Memory blocks previously
+     * added to that range must first be removed via removeMemory(); otherwise, you'll get
+     * an allocation conflict error.  This helps prevent address calculation errors, redundant
+     * allocations, etc.
+     *
+     * We've relaxed some of the original requirements (ie, that addresses must start at a
+     * block-granular address, or that sizes must be equal to exactly one or more blocks),
+     * because machines with large block sizes can make it impossible to load certain ROMs at
+     * their required addresses.  Every allocation still allocates a whole number of blocks.
+     *
+     * Even so, Bus8080 memory management does NOT provide a general-purpose heap.  Most memory
+     * allocations occur during machine initialization and never change.  In particular, there
+     * is NO support for removing partial-block allocations.
+     *
+     * Each Memory block keeps track of a start address (addr) and length (used), indicating
+     * the used space within the block; any free space that precedes or follows that used space
+     * can be allocated later, by simply extending the beginning or ending of the previously used
+     * space.  However, any holes that might have existed between the original allocation and an
+     * extension are subsumed by the extension.
+     *
+     * @this {Bus8080}
+     * @param {number} addr is the starting physical address of the request
+     * @param {number} size of the request, in bytes
+     * @param {number} type is one of the Memory8080.TYPE constants
+     * @return {boolean} true if successful, false if not
+     */
+    addMemory(addr, size, type)
+    {
+        var addrNext = addr;
+        var sizeLeft = size;
+        var iBlock = addrNext >>> this.nBlockShift;
+
+        while (sizeLeft > 0 && iBlock < this.aMemBlocks.length) {
+
+            var block = this.aMemBlocks[iBlock];
+            var addrBlock = iBlock * this.nBlockSize;
+            var sizeBlock = this.nBlockSize - (addrNext - addrBlock);
+            if (sizeBlock > sizeLeft) sizeBlock = sizeLeft;
+
+            if (block && block.size) {
+                if (block.type == type) {
+                    /*
+                     * Where there is already a similar block with a non-zero size, we allow the allocation only if:
+                     *
+                     *   1) addrNext + sizeLeft <= block.addr (the request precedes the used portion of the current block), or
+                     *   2) addrNext >= block.addr + block.used (the request follows the used portion of the current block)
+                     */
+                    if (addrNext + sizeLeft <= block.addr) {
+                        block.used += (block.addr - addrNext);
+                        block.addr = addrNext;
+                        return true;
+                    }
+                    if (addrNext >= block.addr + block.used) {
+                        var sizeAvail = block.size - (addrNext - addrBlock);
+                        if (sizeAvail > sizeLeft) sizeAvail = sizeLeft;
+                        block.used = addrNext - block.addr + sizeAvail;
+                        addrNext = addrBlock + this.nBlockSize;
+                        sizeLeft -= sizeAvail;
+                        iBlock++;
+                        continue;
+                    }
+                }
+                return this.reportError(Bus8080.ERROR.ADD_MEM_INUSE, addrNext, sizeLeft);
+            }
+
+            var blockNew = new Memory8080(addrNext, sizeBlock, this.nBlockSize, type);
+            blockNew.copyBreakpoints(this.dbg, block);
+            this.aMemBlocks[iBlock++] = blockNew;
+
+            addrNext = addrBlock + this.nBlockSize;
+            sizeLeft -= sizeBlock;
+        }
+
+        if (sizeLeft <= 0) {
+            this.status(Math.floor(size / 1024) + "Kb " + Memory8080.TYPE.NAMES[type] + " at " + Str.toHexWord(addr));
+            return true;
+        }
+
+        return this.reportError(Bus8080.ERROR.ADD_MEM_BADRANGE, addr, size);
+    }
+
+    /**
+     * cleanMemory(addr, size)
+     *
+     * @this {Bus8080}
+     * @param {number} addr
+     * @param {number} size
+     * @return {boolean} true if all blocks were clean, false if dirty; all blocks are cleaned in the process
+     */
+    cleanMemory(addr, size)
+    {
+        var fClean = true;
+        var iBlock = addr >>> this.nBlockShift;
+        while (size > 0 && iBlock < this.aMemBlocks.length) {
+            if (this.aMemBlocks[iBlock].fDirty) {
+                this.aMemBlocks[iBlock].fDirty = fClean = false;
+                this.aMemBlocks[iBlock].fDirtyEver = true;
+            }
+            size -= this.nBlockSize;
+            iBlock++;
+        }
+        return fClean;
+    }
+
+    /**
+     * scanMemory(info, addr, size)
+     *
+     * Returns a BusInfo8080 object for the specified address range.
+     *
+     * @this {Bus8080}
+     * @param {Object} [info] previous BusInfo8080, if any
+     * @param {number} [addr] starting address of range (0 if none provided)
+     * @param {number} [size] size of range, in bytes (up to end of address space if none provided)
+     * @return {Object} updated info (or new info if no previous info provided)
+     */
+    scanMemory(info, addr, size)
+    {
+        if (addr == null) addr = 0;
+        if (size == null) size = (this.addrTotal - addr) | 0;
+        if (info == null) info = {cbTotal: 0, cBlocks: 0, aBlocks: []};
+
+        var iBlock = addr >>> this.nBlockShift;
+        var iBlockMax = ((addr + size - 1) >>> this.nBlockShift);
+
+        info.cbTotal = 0;
+        info.cBlocks = 0;
+        while (iBlock <= iBlockMax) {
+            var block = this.aMemBlocks[iBlock];
+            info.cbTotal += block.size;
+            if (block.size) {
+                info.aBlocks.push(Usr.initBitFields(Bus8080.BlockInfo, iBlock, 0, 0, block.type));
+                info.cBlocks++
+            }
+            iBlock++;
+        }
+        return info;
+    }
+
+    /**
+     * getWidth()
+     *
+     * @this {Bus8080}
+     * @return {number}
+     */
+    getWidth()
+    {
+        return this.nBusWidth;
+    }
+
+    /**
+     * removeMemory(addr, size)
+     *
+     * Replaces every block in the specified address range with empty Memory blocks that ignore all reads/writes.
+     *
+     * TODO: Update the removeMemory() interface to reflect the relaxed requirements of the addMemory() interface.
+     *
+     * @this {Bus8080}
+     * @param {number} addr
+     * @param {number} size
+     * @return {boolean} true if successful, false if not
+     */
+    removeMemory(addr, size)
+    {
+        if (!(addr & this.nBlockLimit) && size && !(size & this.nBlockLimit)) {
+            var iBlock = addr >>> this.nBlockShift;
+            while (size > 0) {
+                var blockOld = this.aMemBlocks[iBlock];
+                var blockNew = new Memory8080(addr);
+                blockNew.copyBreakpoints(this.dbg, blockOld);
+                this.aMemBlocks[iBlock++] = blockNew;
+                addr = iBlock * this.nBlockSize;
+                size -= this.nBlockSize;
+            }
+            return true;
+        }
+        return this.reportError(Bus8080.ERROR.REM_MEM_BADRANGE, addr, size);
+    }
+
+    /**
+     * getMemoryBlocks(addr, size)
+     *
+     * @this {Bus8080}
+     * @param {number} addr is the starting physical address
+     * @param {number} size of the request, in bytes
+     * @return {Array} of Memory blocks
+     */
+    getMemoryBlocks(addr, size)
+    {
+        var aBlocks = [];
+        var iBlock = addr >>> this.nBlockShift;
+        while (size > 0 && iBlock < this.aMemBlocks.length) {
+            aBlocks.push(this.aMemBlocks[iBlock++]);
+            size -= this.nBlockSize;
+        }
+        return aBlocks;
+    }
+
+    /**
+     * setMemoryBlocks(addr, size, aBlocks, type)
+     *
+     * If no type is specified, then specified address range uses all the provided blocks as-is;
+     * this form of setMemoryBlocks() is used for complete physical aliases.
+     *
+     * Otherwise, new blocks are allocated with the specified type; the underlying memory from the
+     * provided blocks is still used, but the new blocks may have different access to that memory.
+     *
+     * @this {Bus8080}
+     * @param {number} addr is the starting physical address
+     * @param {number} size of the request, in bytes
+     * @param {Array} aBlocks as returned by getMemoryBlocks()
+     * @param {number} [type] is one of the Memory8080.TYPE constants
+     */
+    setMemoryBlocks(addr, size, aBlocks, type)
+    {
+        var i = 0;
+        var iBlock = addr >>> this.nBlockShift;
+        while (size > 0 && iBlock < this.aMemBlocks.length) {
+            var block = aBlocks[i++];
+
+            if (!block) break;
+            if (type !== undefined) {
+                var blockNew = new Memory8080(addr);
+                blockNew.clone(block, type, this.dbg);
+                block = blockNew;
+            }
+            this.aMemBlocks[iBlock++] = block;
+            size -= this.nBlockSize;
+        }
+    }
+
+    /**
+     * getByte(addr)
+     *
+     * @this {Bus8080}
+     * @param {number} addr is a physical address
+     * @return {number} byte (8-bit) value at that address
+     */
+    getByte(addr)
+    {
+        return this.aMemBlocks[(addr & this.nBusMask) >>> this.nBlockShift].readByte(addr & this.nBlockLimit, addr);
+    }
+
+    /**
+     * getByteDirect(addr)
+     *
+     * This is useful for the Debugger and other components that want to bypass getByte() breakpoint detection.
+     *
+     * @this {Bus8080}
+     * @param {number} addr is a physical address
+     * @return {number} byte (8-bit) value at that address
+     */
+    getByteDirect(addr)
+    {
+        return this.aMemBlocks[(addr & this.nBusMask) >>> this.nBlockShift].readByteDirect(addr & this.nBlockLimit, addr);
+    }
+
+    /**
+     * getShort(addr)
+     *
+     * @this {Bus8080}
+     * @param {number} addr is a physical address
+     * @return {number} word (16-bit) value at that address
+     */
+    getShort(addr)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = (addr & this.nBusMask) >>> this.nBlockShift;
+        if (off != this.nBlockLimit) {
+            return this.aMemBlocks[iBlock].readShort(off, addr);
+        }
+        return this.aMemBlocks[iBlock++].readByte(off, addr) | (this.aMemBlocks[iBlock & this.nBlockMask].readByte(0, addr + 1) << 8);
+    }
+
+    /**
+     * getShortDirect(addr)
+     *
+     * This is useful for the Debugger and other components that want to bypass getShort() breakpoint detection.
+     *
+     * @this {Bus8080}
+     * @param {number} addr is a physical address
+     * @return {number} word (16-bit) value at that address
+     */
+    getShortDirect(addr)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = (addr & this.nBusMask) >>> this.nBlockShift;
+        if (off != this.nBlockLimit) {
+            return this.aMemBlocks[iBlock].readShortDirect(off, addr);
+        }
+        return this.aMemBlocks[iBlock++].readByteDirect(off, addr) | (this.aMemBlocks[iBlock & this.nBlockMask].readByteDirect(0, addr + 1) << 8);
+    }
+
+    /**
+     * setByte(addr, b)
+     *
+     * @this {Bus8080}
+     * @param {number} addr is a physical address
+     * @param {number} b is the byte (8-bit) value to write (we truncate it to 8 bits to be safe)
+     */
+    setByte(addr, b)
+    {
+        this.aMemBlocks[(addr & this.nBusMask) >>> this.nBlockShift].writeByte(addr & this.nBlockLimit, b & 0xff, addr);
+    }
+
+    /**
+     * setByteDirect(addr, b)
+     *
+     * This is useful for the Debugger and other components that want to bypass breakpoint detection AND read-only
+     * memory protection (for example, this is an interface the ROM component could use to initialize ROM contents).
+     *
+     * @this {Bus8080}
+     * @param {number} addr is a physical address
+     * @param {number} b is the byte (8-bit) value to write (we truncate it to 8 bits to be safe)
+     */
+    setByteDirect(addr, b)
+    {
+        this.aMemBlocks[(addr & this.nBusMask) >>> this.nBlockShift].writeByteDirect(addr & this.nBlockLimit, b & 0xff, addr);
+    }
+
+    /**
+     * setShort(addr, w)
+     *
+     * @this {Bus8080}
+     * @param {number} addr is a physical address
+     * @param {number} w is the word (16-bit) value to write (we truncate it to 16 bits to be safe)
+     */
+    setShort(addr, w)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = (addr & this.nBusMask) >>> this.nBlockShift;
+        if (off != this.nBlockLimit) {
+            this.aMemBlocks[iBlock].writeShort(off, w & 0xffff, addr);
+            return;
+        }
+        this.aMemBlocks[iBlock++].writeByte(off, w & 0xff, addr);
+        this.aMemBlocks[iBlock & this.nBlockMask].writeByte(0, (w >> 8) & 0xff, addr + 1);
+    }
+
+    /**
+     * setShortDirect(addr, w)
+     *
+     * This is useful for the Debugger and other components that want to bypass breakpoint detection AND read-only
+     * memory protection (for example, this is an interface the ROM component could use to initialize ROM contents).
+     *
+     * @this {Bus8080}
+     * @param {number} addr is a physical address
+     * @param {number} w is the word (16-bit) value to write (we truncate it to 16 bits to be safe)
+     */
+    setShortDirect(addr, w)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = (addr & this.nBusMask) >>> this.nBlockShift;
+        if (off != this.nBlockLimit) {
+            this.aMemBlocks[iBlock].writeShortDirect(off, w & 0xffff, addr);
+            return;
+        }
+        this.aMemBlocks[iBlock++].writeByteDirect(off, w & 0xff, addr);
+        this.aMemBlocks[iBlock & this.nBlockMask].writeByteDirect(0, (w >> 8) & 0xff, addr + 1);
+    }
+
+    /**
+     * addMemBreak(addr, fWrite)
+     *
+     * @this {Bus8080}
+     * @param {number} addr
+     * @param {boolean} fWrite is true for a memory write breakpoint, false for a memory read breakpoint
+     */
+    addMemBreak(addr, fWrite)
+    {
+        if (DEBUGGER) {
+            var iBlock = addr >>> this.nBlockShift;
+            this.aMemBlocks[iBlock].addBreakpoint(addr & this.nBlockLimit, fWrite);
+        }
+    }
+
+    /**
+     * removeMemBreak(addr, fWrite)
+     *
+     * @this {Bus8080}
+     * @param {number} addr
+     * @param {boolean} fWrite is true for a memory write breakpoint, false for a memory read breakpoint
+     */
+    removeMemBreak(addr, fWrite)
+    {
+        if (DEBUGGER) {
+            var iBlock = addr >>> this.nBlockShift;
+            this.aMemBlocks[iBlock].removeBreakpoint(addr & this.nBlockLimit, fWrite);
+        }
+    }
+
+    /**
+     * saveMemory(fAll)
+     *
+     * The only memory blocks we save are those marked as dirty, but most likely all of RAM will have been marked dirty,
+     * and even if our dirty-memory flags were as smart as our dirty-sector flags (ie, were set only when a write changed
+     * what was already there), it's unlikely that would reduce the number of RAM blocks we must save/restore.  At least
+     * all the ROM blocks should be clean (except in the unlikely event that the Debugger was used to modify them).
+     *
+     * All dirty blocks will be stored in a single array, as pairs of block numbers and data arrays, like so:
+     *
+     *      [iBlock0, [dw0, dw1, ...], iBlock1, [dw0, dw1, ...], ...]
+     *
+     * In a normal 4Kb block, there will be 1K DWORD values in the data array.  Remember that each DWORD is a signed 32-bit
+     * integer (because they are formed using bitwise operator rather than floating-point math operators), so don't be
+     * surprised to see negative numbers in the data.
+     *
+     * The above example assumes "uncompressed" data arrays.  If we choose to use "compressed" data arrays, the data arrays
+     * will look like:
+     *
+     *      [count0, dw0, count1, dw1, ...]
+     *
+     * where each count indicates how many times the following DWORD value occurs.  A data array length less than 1K indicates
+     * that it's compressed, since we'll only store them in compressed form if they actually shrank, and we'll use State
+     * helper methods compress() and decompress() to create and expand the compressed data arrays.
+     *
+     * @this {Bus8080}
+     * @param {boolean} [fAll] (true to save all non-ROM memory blocks, regardless of their dirty flags)
+     * @return {Array} a
+     */
+    saveMemory(fAll)
+    {
+        var i = 0;
+        var a = [];
+
+        for (var iBlock = 0; iBlock < this.nBlockTotal; iBlock++) {
+            var block = this.aMemBlocks[iBlock];
+            /*
+             * We have to check both fDirty and fDirtyEver, because we may have called cleanMemory() on some of
+             * the memory blocks (eg, video memory), and while cleanMemory() will clear a dirty block's fDirty flag,
+             * it also sets the dirty block's fDirtyEver flag, which is left set for the lifetime of the machine.
+             */
+            if (fAll && block.type != Memory8080.TYPE.ROM || block.fDirty || block.fDirtyEver) {
+                a[i++] = iBlock;
+                a[i++] = State.compress(block.save());
+            }
+        }
+
+        return a;
+    }
+
+    /**
+     * restoreMemory(a)
+     *
+     * This restores the contents of all Memory blocks; called by CPUState.restore().
+     *
+     * In theory, we ONLY have to save/restore block contents.  Other block attributes,
+     * like the type, the memory controller (if any), and the active memory access functions,
+     * should already be restored, since every component (re)allocates all the memory blocks
+     * it was using when it's restored.  And since the CPU is guaranteed to be the last
+     * component to be restored, all those blocks (and their attributes) should be in place now.
+     *
+     * See saveMemory() for more information on how the memory block contents are saved.
+     *
+     * @this {Bus8080}
+     * @param {Array} a
+     * @return {boolean} true if successful, false if not
+     */
+    restoreMemory(a)
+    {
+        var i;
+        for (i = 0; i < a.length - 1; i += 2) {
+            var iBlock = a[i];
+            var adw = a[i+1];
+            if (adw && adw.length < this.nBlockLen) {
+                adw = State.decompress(adw, this.nBlockLen);
+            }
+            var block = this.aMemBlocks[iBlock];
+            if (!block || !block.restore(adw)) {
+                /*
+                 * Either the block to restore hasn't been allocated, indicating a change in the machine
+                 * configuration since it was last saved (the most likely explanation) or there's some internal
+                 * inconsistency (eg, the block size is wrong).
+                 */
+                Component.error("Unable to restore memory block " + iBlock);
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * addPortInputBreak(port)
+     *
+     * @this {Bus8080}
+     * @param {number} [port]
+     * @return {boolean} true if break on port input enabled, false if disabled
+     */
+    addPortInputBreak(port)
+    {
+        if (port === undefined) {
+            this.fPortInputBreakAll = !this.fPortInputBreakAll;
+            return this.fPortInputBreakAll;
+        }
+        if (this.aPortInputNotify[port] === undefined) {
+            this.aPortInputNotify[port] = [null, false];
+        }
+        this.aPortInputNotify[port][1] = !this.aPortInputNotify[port][1];
+        return this.aPortInputNotify[port][1];
+    }
+
+    /**
+     * addPortInputNotify(start, end, fn)
+     *
+     * Add a port input-notification handler to the list of such handlers.
+     *
+     * @this {Bus8080}
+     * @param {number} start port address
+     * @param {number} end port address
+     * @param {function(number,number)} fn is called with the port and IP values at the time of the input
+     */
+    addPortInputNotify(start, end, fn)
+    {
+        if (fn !== undefined) {
+            for (var port = start; port <= end; port++) {
+                if (this.aPortInputNotify[port] !== undefined) {
+                    Component.warning("Input port " + Str.toHexWord(port) + " already registered");
+                    continue;
+                }
+                this.aPortInputNotify[port] = [fn, false];
+                if (MAXDEBUG) this.log("addPortInputNotify(" + Str.toHexWord(port) + ")");
+            }
+        }
+    }
+
+    /**
+     * addPortInputTable(component, table, offset)
+     *
+     * Add port input-notification handlers from the specified table (a batch version of addPortInputNotify)
+     *
+     * @this {Bus8080}
+     * @param {Component} component
+     * @param {Object} table
+     * @param {number} [offset] is an optional port offset
+     */
+    addPortInputTable(component, table, offset)
+    {
+        if (offset === undefined) offset = 0;
+        if (table) {
+            for (var port in table) {
+                this.addPortInputNotify(+port + offset, +port + offset, table[port].bind(component));
+            }
+        }
+    }
+
+    /**
+     * addPortInputWidth(port, size)
+     *
+     * By default, all input ports are 1 byte wide; ports that are wider must call this function.
+     *
+     * @this {Bus8080}
+     * @param {number} port
+     * @param {number} size (1, 2 or 4)
+     */
+    addPortInputWidth(port, size)
+    {
+        this.aPortInputWidth[port] = size;
+    }
+
+    /**
+     * checkPortInputNotify(port, size, addrIP)
+     *
+     * @this {Bus8080}
+     * @param {number} port
+     * @param {number} size (1, 2 or 4)
+     * @param {number} [addrIP] is the IP value at the time of the input
+     * @return {number} simulated port data
+     *
+     * NOTE: It seems that parts of the ROM BIOS (like the RS-232 probes around F000:E5D7 in the 5150 BIOS)
+     * assume that ports for non-existent hardware return 0xff rather than 0x00, hence my new default (0xff) below.
+     */
+    checkPortInputNotify(port, size, addrIP)
+    {
+        var data = 0, shift = 0;
+
+        while (size > 0) {
+
+            var aNotify = this.aPortInputNotify[port];
+            var sizePort = this.aPortInputWidth[port] || 1;
+            var maskPort = (sizePort == 1? 0xff : (sizePort == 2? 0xffff : -1));
+            var dataPort = maskPort;
+
+            /*
+             * TODO: We need to decide what to do about 8-bit I/O to a 16-bit port (ditto for 16-bit I/O
+             * to a 32-bit port).  We probably should pass the size through to the aNotify[0] handler,
+             * and let it decide what to do, but I don't feel like changing all the I/O handlers right now.
+             * The good news, at least, is that the 8-bit handlers would not have to do anything special.
+             * This assert will warn us if this is a pressing need.
+             */
+
+
+            if (aNotify !== undefined) {
+                if (aNotify[0]) {
+                    dataPort = aNotify[0](port, addrIP);
+                    if (dataPort === undefined) {
+                        dataPort = maskPort;
+                    } else {
+                        dataPort &= maskPort;
+                    }
+                }
+                if (DEBUGGER && this.dbg && this.fPortInputBreakAll != aNotify[1]) {
+                    this.dbg.checkPortInput(port, size, dataPort);
+                }
+            }
+            else {
+                if (DEBUGGER && this.dbg) {
+                    this.dbg.messageIO(this, port, null, addrIP);
+                    if (this.fPortInputBreakAll) this.dbg.checkPortInput(port, size, dataPort);
+                }
+            }
+
+            data |= dataPort << shift;
+            shift += (sizePort << 3);
+            port += sizePort;
+            size -= sizePort;
+        }
+
+
+        return data;
+    }
+
+    /**
+     * addPortOutputBreak(port)
+     *
+     * @this {Bus8080}
+     * @param {number} [port]
+     * @return {boolean} true if break on port output enabled, false if disabled
+     */
+    addPortOutputBreak(port)
+    {
+        if (port === undefined) {
+            this.fPortOutputBreakAll = !this.fPortOutputBreakAll;
+            return this.fPortOutputBreakAll;
+        }
+        if (this.aPortOutputNotify[port] === undefined) {
+            this.aPortOutputNotify[port] = [null, false];
+        }
+        this.aPortOutputNotify[port][1] = !this.aPortOutputNotify[port][1];
+        return this.aPortOutputNotify[port][1];
+    }
+
+    /**
+     * addPortOutputNotify(start, end, fn)
+     *
+     * Add a port output-notification handler to the list of such handlers.
+     *
+     * @this {Bus8080}
+     * @param {number} start port address
+     * @param {number} end port address
+     * @param {function(number,number)} fn is called with the port and IP values at the time of the output
+     */
+    addPortOutputNotify(start, end, fn)
+    {
+        if (fn !== undefined) {
+            for (var port = start; port <= end; port++) {
+                if (this.aPortOutputNotify[port] !== undefined) {
+                    Component.warning("Output port " + Str.toHexWord(port) + " already registered");
+                    continue;
+                }
+                this.aPortOutputNotify[port] = [fn, false];
+                if (MAXDEBUG) this.log("addPortOutputNotify(" + Str.toHexWord(port) + ")");
+            }
+        }
+    }
+
+    /**
+     * addPortOutputTable(component, table, offset)
+     *
+     * Add port output-notification handlers from the specified table (a batch version of addPortOutputNotify)
+     *
+     * @this {Bus8080}
+     * @param {Component} component
+     * @param {Object} table
+     * @param {number} [offset] is an optional port offset
+     */
+    addPortOutputTable(component, table, offset)
+    {
+        if (offset === undefined) offset = 0;
+        if (table) {
+            for (var port in table) {
+                this.addPortOutputNotify(+port + offset, +port + offset, table[port].bind(component));
+            }
+        }
+    }
+
+    /**
+     * addPortOutputWidth(port, size)
+     *
+     * By default, all output ports are 1 byte wide; ports that are wider must call this function.
+     *
+     * @this {Bus8080}
+     * @param {number} port
+     * @param {number} size (1, 2 or 4)
+     */
+    addPortOutputWidth(port, size)
+    {
+        this.aPortOutputWidth[port] = size;
+    }
+
+    /**
+     * checkPortOutputNotify(port, size, data, addrIP)
+     *
+     * @this {Bus8080}
+     * @param {number} port
+     * @param {number} size
+     * @param {number} data
+     * @param {number} [addrIP] is the IP value at the time of the output
+     */
+    checkPortOutputNotify(port, size, data, addrIP)
+    {
+        var shift = 0;
+
+        while (size > 0) {
+
+            var aNotify = this.aPortOutputNotify[port];
+            var sizePort = this.aPortOutputWidth[port] || 1;
+            var maskPort = (sizePort == 1? 0xff : (sizePort == 2? 0xffff : -1));
+            var dataPort = (data >>>= shift) & maskPort;
+
+            /*
+             * TODO: We need to decide what to do about 8-bit I/O to a 16-bit port (ditto for 16-bit I/O
+             * to a 32-bit port).  We probably should pass the size through to the aNotify[0] handler,
+             * and let it decide what to do, but I don't feel like changing all the I/O handlers right now.
+             * The good news, at least, is that the 8-bit handlers would not have to do anything special.
+             * This assert will warn us if this is a pressing need.
+             */
+
+
+            if (aNotify !== undefined) {
+                if (aNotify[0]) {
+                    aNotify[0](port, dataPort, addrIP);
+                }
+                if (DEBUGGER && this.dbg && this.fPortOutputBreakAll != aNotify[1]) {
+                    this.dbg.checkPortOutput(port, size, dataPort);
+                }
+            }
+            else {
+                if (DEBUGGER && this.dbg) {
+                    this.dbg.messageIO(this, port, dataPort, addrIP);
+                    if (this.fPortOutputBreakAll) this.dbg.checkPortOutput(port, size, dataPort);
+                }
+            }
+
+            shift += (sizePort << 3);
+            port += sizePort;
+            size -= sizePort;
+        }
+
+    }
+
+    /**
+     * removePortInputNotify(start, end)
+     *
+     * Remove port input-notification handler(s) (to be ENABLED later if needed)
+     *
+     * @this {Bus8080}
+     * @param {number} start address
+     * @param {number} end address
+     *
+     removePortInputNotify(start, end)
+     {
+         for (var port = start; port < end; port++) {
+             if (this.aPortInputNotify[port]) {
+                 delete this.aPortInputNotify[port];
+             }
+         }
+     }
+     */
+
+    /**
+     * removePortOutputNotify(start, end)
+     *
+     * Remove port output-notification handler(s) (to be ENABLED later if needed)
+     *
+     * @this {Bus8080}
+     * @param {number} start address
+     * @param {number} end address
+     *
+     removePortOutputNotify(start, end)
+     {
+         for (var port = start; port < end; port++) {
+             if (this.aPortOutputNotify[port]) {
+                 delete this.aPortOutputNotify[port];
+             }
+         }
+     }
+     */
+
+    /**
+     * reportError(op, addr, size, fQuiet)
+     *
+     * @this {Bus8080}
+     * @param {number} op
+     * @param {number} addr
+     * @param {number} size
+     * @param {boolean} [fQuiet] (true if any error should be quietly logged)
+     * @return {boolean} false
+     */
+    reportError(op, addr, size, fQuiet)
+    {
+        var sError = "Memory block error (" + op + ": " + Str.toHex(addr) + "," + Str.toHex(size) + ")";
+        if (fQuiet) {
+            if (this.dbg) {
+                this.dbg.message(sError);
+            } else {
+                this.log(sError);
+            }
+        } else {
+            Component.error(sError);
+        }
+        return false;
+    }
+}
+
+Bus8080.ERROR = {
+    ADD_MEM_INUSE:      1,
+    ADD_MEM_BADRANGE:   2,
+    SET_MEM_BADRANGE:   4,
+    REM_MEM_BADRANGE:   5
+};
+
+/*
+ * Data types used by scanMemory()
+ */
+
+/**
+ * @typedef {number}
+ */
+var BlockInfo;
+
+/**
+ * This defines the BlockInfo bit fields used by scanMemory() when it creates the aBlocks array.
+ *
+ * @typedef {{
+ *  num:    BitField,
+ *  count:  BitField,
+ *  btmod:  BitField,
+ *  type:   BitField
+ * }}
+ */
+Bus8080.BlockInfo = Usr.defineBitFields({num:20, count:8, btmod:1, type:3});
+
+/**
+ * BusInfo8080 object definition (returned by scanMemory())
+ *
+ *  cbTotal:    total bytes allocated
+ *  cBlocks:    total Memory blocks allocated
+ *  aBlocks:    array of allocated Memory block numbers
+ *
+ * @typedef {{
+ *  cbTotal:    number,
+ *  cBlocks:    number,
+ *  aBlocks:    Array.<BlockInfo>
+ * }}
+ */
+var BusInfo8080;
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pc8080/lib/memory.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * @class DataView
+ * @property {function(number,boolean):number} getUint8
+ * @property {function(number,number,boolean)} setUint8
+ * @property {function(number,boolean):number} getUint16
+ * @property {function(number,number,boolean)} setUint16
+ * @property {function(number,boolean):number} getInt32
+ * @property {function(number,number,boolean)} setInt32
+ */
+
+var littleEndian = (TYPEDARRAYS? (function() {
+    var buffer = new ArrayBuffer(2);
+    new DataView(buffer).setUint16(0, 256, true);
+    return new Uint16Array(buffer)[0] === 256;
+})() : false);
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class Memory8080 {
+    /**
+     * Memory8080(addr, used, size, type)
+     *
+     * The Bus component allocates Memory8080 objects so that each has a memory buffer with a
+     * block-granular starting address and an address range equal to bus.nBlockSize; however,
+     * the size of any given Memory8080 object's underlying buffer can be either zero or bus.nBlockSize;
+     * memory read/write functions for empty (buffer-less) blocks are mapped to readNone/writeNone.
+     *
+     * The Bus allocates empty blocks for the entire address space during initialization, so that
+     * any reads/writes to undefined addresses will have no effect.  Later, the ROM and RAM
+     * components will ask the Bus to allocate memory for specific ranges, and the Bus will allocate
+     * as many new blockSize Memory8080 objects as the ranges require.  Partial Memory8080 blocks could
+     * also be supported in theory, but in practice, they're not.
+     *
+     * Because Memory8080 blocks now allow us to have a "sparse" address space, we could choose to
+     * take the memory hit of allocating 4K arrays per block, where each element stores only one byte,
+     * instead of the more frugal but slightly slower approach of allocating arrays of 32-bit dwords
+     * (LONGARRAYS) and shifting/masking bytes/words to/from dwords; in theory, byte accesses would
+     * be faster and word accesses somewhat less faster.
+     *
+     * However, preliminary testing of that feature (BYTEARRAYS) did not yield significantly faster
+     * performance, so it is OFF by default to minimize our memory consumption.  Using TYPEDARRAYS
+     * would seem best, but as discussed in defines.js, it's off by default, because it doesn't perform
+     * as well as LONGARRAYS; the other advantage of TYPEDARRAYS is that it should theoretically use
+     * about 1/2 the memory of LONGARRAYS (32-bit elements vs 64-bit numbers), but I value speed over
+     * size at this point.  Also, not all JavaScript implementations support TYPEDARRAYS (IE9 is probably
+     * the only real outlier: it lacks typed arrays but otherwise has all the necessary HTML5 support).
+     *
+     * WARNING: Since Memory8080 blocks are low-level objects that have no UI requirements, they
+     * do not inherit from the Component class, so if you want to use any Component class methods,
+     * such as Component.assert(), use the corresponding Debugger methods instead (assuming a debugger
+     * is available).
+     *
+     * @this {Memory8080}
+     * @param {number|null} [addr] of lowest used address in block
+     * @param {number} [used] portion of block in bytes (0 for none); must be a multiple of 4
+     * @param {number} [size] of block's buffer in bytes (0 for none); must be a multiple of 4
+     * @param {number} [type] is one of the Memory8080.TYPE constants (default is Memory8080.TYPE.NONE)
+     */
+    constructor(addr, used, size, type)
+    {
+        var i;
+        this.id = (Memory8080.idBlock += 2);
+        this.adw = null;
+        this.offset = 0;
+        this.addr = addr;
+        this.used = used;
+        this.size = size || 0;
+        this.type = type || Memory8080.TYPE.NONE;
+        this.fReadOnly = (type == Memory8080.TYPE.ROM);
+        this.copyBreakpoints();     // initialize the block's Debugger info; the caller will reinitialize
+
+        /*
+         * TODO: Study the impact of dirty block tracking.  The original purposes were to allow saveMemory()
+         * to save only dirty blocks, and to enable the Video component to quickly detect changes to the video buffer.
+         * But the benefit to saveMemory() is minimal, and the Video component has other options; for example, it now
+         * uses a custom memory controller for all EGA/VGA video modes, which performs its own dirty block tracking,
+         * and that could easily be extended to the older MDA/CGA video modes, which still use conventional memory blocks.
+         * Alternatively, we could restrict the use of dirty block tracking to certain memory types (eg, VIDEO memory).
+         *
+         * However, a quick test with dirty block tracking disabled didn't yield a noticeable improvement in performance,
+         * so I think the overhead of our block-based architecture is swamping the impact of these micro-updates.
+         */
+        this.fDirty = this.fDirtyEver = false;
+
+        /*
+         * For empty memory blocks, all we need to do is ensure all access functions are mapped to "none" handlers.
+         */
+        if (!size) {
+            this.setAccess();
+            return;
+        }
+
+        /*
+         * This is the normal case: allocate a buffer that provides 8 bits of data per address;
+         * no controller is required because our default memory access functions (see afnMemory)
+         * know how to deal with this simple 1-1 mapping of addresses to bytes and words.
+         *
+         * TODO: Consider initializing the memory array to random (or pseudo-random) values in DEBUG
+         * mode; pseudo-random might be best, to help make any bugs reproducible.
+         */
+        if (TYPEDARRAYS) {
+            this.buffer = new ArrayBuffer(size);
+            this.dv = new DataView(this.buffer, 0, size);
+            /*
+             * If littleEndian is true, we can use ab[], aw[] and adw[] directly; well, we can use them
+             * whenever the offset is a multiple of 1, 2 or 4, respectively.  Otherwise, we must fallback to
+             * dv.getUint8()/dv.setUint8(), dv.getUint16()/dv.setUint16() and dv.getInt32()/dv.setInt32().
+             */
+            this.ab = new Uint8Array(this.buffer, 0, size);
+            this.aw = new Uint16Array(this.buffer, 0, size >> 1);
+            this.adw = new Int32Array(this.buffer, 0, size >> 2);
+            this.setAccess(littleEndian? Memory8080.afnArrayLE : Memory8080.afnArrayBE);
+        } else {
+            if (BYTEARRAYS) {
+                this.ab = new Array(size);
+            } else {
+                /*
+                 * NOTE: This is the default mode of operation (!TYPEDARRAYS && !BYTEARRAYS), because it
+                 * seems to provide the best performance; and although in theory, that performance might
+                 * come at twice the overhead of TYPEDARRAYS, it's increasingly likely that the JavaScript
+                 * runtime will notice that all we ever store are 32-bit values, and optimize accordingly.
+                 */
+                this.adw = new Array(size >> 2);
+                for (i = 0; i < this.adw.length; i++) this.adw[i] = 0;
+            }
+            this.setAccess(Memory8080.afnMemory);
+        }
+    }
+
+    /**
+     * init(addr)
+     *
+     * Quick reinitializer when reusing a Memory8080 block.
+     *
+     * @this {Memory8080}
+     * @param {number} addr
+     */
+    init(addr)
+    {
+        this.addr = addr;
+    }
+
+    /**
+     * clone(mem, type)
+     *
+     * Converts the current Memory8080 block (this) into a clone of the given Memory8080 block (mem),
+     * and optionally overrides the current block's type with the specified type.
+     *
+     * @this {Memory8080}
+     * @param {Memory8080} mem
+     * @param {number} [type]
+     * @param {Debugger8080} [dbg]
+     */
+    clone(mem, type, dbg)
+    {
+        /*
+         * Original memory block IDs are even; cloned memory block IDs are odd;
+         * the original ID of the current block is lost, but that's OK, since it was presumably
+         * produced merely to become a clone.
+         */
+        this.id = mem.id | 0x1;
+        this.used = mem.used;
+        this.size = mem.size;
+        if (type) {
+            this.type = type;
+            this.fReadOnly = (type == Memory8080.TYPE.ROM);
+        }
+        if (TYPEDARRAYS) {
+            this.buffer = mem.buffer;
+            this.dv = mem.dv;
+            this.ab = mem.ab;
+            this.aw = mem.aw;
+            this.adw = mem.adw;
+            this.setAccess(littleEndian? Memory8080.afnArrayLE : Memory8080.afnArrayBE);
+        } else {
+            if (BYTEARRAYS) {
+                this.ab = mem.ab;
+            } else {
+                this.adw = mem.adw;
+            }
+            this.setAccess(Memory8080.afnMemory);
+        }
+        this.copyBreakpoints(dbg, mem);
+    }
+
+    /**
+     * save()
+     *
+     * This gets the contents of a Memory8080 block as an array of 32-bit values; used by Bus8080.saveMemory(),
+     * which in turn is called by CPUState.save().
+     *
+     * Memory8080 blocks with custom memory controllers do NOT save their contents; that's the responsibility
+     * of the controller component.
+     *
+     * @this {Memory8080}
+     * @return {Array|Int32Array|null}
+     */
+    save()
+    {
+        var adw, i;
+        if (BYTEARRAYS) {
+            adw = new Array(this.size >> 2);
+            var off = 0;
+            for (i = 0; i < adw.length; i++) {
+                adw[i] = this.ab[off] | (this.ab[off + 1] << 8) | (this.ab[off + 2] << 16) | (this.ab[off + 3] << 24);
+                off += 4;
+            }
+        }
+        else if (TYPEDARRAYS) {
+            /*
+             * It might be tempting to just return a copy of Int32Array(this.buffer, 0, this.size >> 2),
+             * but we can't be sure of the "endianness" of an Int32Array -- which would be OK if the array
+             * was always saved/restored on the same machine, but there's no guarantee of that, either.
+             * So we use getInt32() and require little-endian values.
+             *
+             * Moreover, an Int32Array isn't treated by JSON.stringify() and JSON.parse() exactly like
+             * a normal array; it's serialized as an Object rather than an Array, so it lacks a "length"
+             * property and causes problems for State.store() and State.parse().
+             */
+            adw = new Array(this.size >> 2);
+            for (i = 0; i < adw.length; i++) {
+                adw[i] = this.dv.getInt32(i << 2, true);
+            }
+        }
+        else {
+            adw = this.adw;
+        }
+        return adw;
+    }
+
+    /**
+     * restore(adw)
+     *
+     * This restores the contents of a Memory8080 block from an array of 32-bit values;
+     * used by Bus8080.restoreMemory(), which is called by CPUState.restore(), after all other
+     * components have been restored and thus all Memory8080 blocks have been allocated
+     * by their respective components.
+     *
+     * @this {Memory8080}
+     * @param {Array|null} adw
+     * @return {boolean} true if successful, false if block size mismatch
+     */
+    restore(adw)
+    {
+        /*
+         * At this point, it's a consistency error for adw to be null; it's happened once already,
+         * when there was a restore bug in the Video component that added the frame buffer at the video
+         * card's "spec'ed" address instead of the programmed address, so there were no controller-owned
+         * memory blocks installed at the programmed address, and so we arrived here at a block with
+         * no controller AND no data.
+         */
+
+
+        if (adw && this.size == adw.length << 2) {
+            var i;
+            if (BYTEARRAYS) {
+                var off = 0;
+                for (i = 0; i < adw.length; i++) {
+                    this.ab[off] = adw[i] & 0xff;
+                    this.ab[off + 1] = (adw[i] >> 8) & 0xff;
+                    this.ab[off + 2] = (adw[i] >> 16) & 0xff;
+                    this.ab[off + 3] = (adw[i] >> 24) & 0xff;
+                    off += 4;
+                }
+            } else if (TYPEDARRAYS) {
+                for (i = 0; i < adw.length; i++) {
+                    this.dv.setInt32(i << 2, adw[i], true);
+                }
+            } else {
+                this.adw = adw;
+            }
+            this.fDirty = true;
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * setAccess(afn, fDirect)
+     *
+     * If no function table is specified, a default is selected based on the Memory8080 type.
+     *
+     * @this {Memory8080}
+     * @param {Array.<function()>} [afn] function table
+     * @param {boolean} [fDirect] (true to update direct access functions as well; default is true)
+     */
+    setAccess(afn, fDirect)
+    {
+        if (!afn) {
+
+            afn = Memory8080.afnNone;
+        }
+        this.setReadAccess(afn, fDirect);
+        this.setWriteAccess(afn, fDirect);
+    }
+
+    /**
+     * setReadAccess(afn, fDirect)
+     *
+     * @this {Memory8080}
+     * @param {Array.<function()>} afn
+     * @param {boolean} [fDirect]
+     */
+    setReadAccess(afn, fDirect)
+    {
+        if (!fDirect || !this.cReadBreakpoints) {
+            this.readByte = afn[0] || this.readNone;
+            this.readShort = afn[2] || this.readShortDefault;
+        }
+        if (fDirect || fDirect === undefined) {
+            this.readByteDirect = afn[0] || this.readNone;
+            this.readShortDirect = afn[2] || this.readShortDefault;
+        }
+    }
+
+    /**
+     * setWriteAccess(afn, fDirect)
+     *
+     * @this {Memory8080}
+     * @param {Array.<function()>} afn
+     * @param {boolean} [fDirect]
+     */
+    setWriteAccess(afn, fDirect)
+    {
+        if (!fDirect || !this.cWriteBreakpoints) {
+            this.writeByte = !this.fReadOnly && afn[1] || this.writeNone;
+            this.writeShort = !this.fReadOnly && afn[3] || this.writeShortDefault;
+        }
+        if (fDirect || fDirect === undefined) {
+            this.writeByteDirect = afn[1] || this.writeNone;
+            this.writeShortDirect = afn[3] || this.writeShortDefault;
+        }
+    }
+
+    /**
+     * resetReadAccess()
+     *
+     * @this {Memory8080}
+     */
+    resetReadAccess()
+    {
+        this.readByte = this.readByteDirect;
+        this.readShort = this.readShortDirect;
+    }
+
+    /**
+     * resetWriteAccess()
+     *
+     * @this {Memory8080}
+     */
+    resetWriteAccess()
+    {
+        this.writeByte = this.fReadOnly? this.writeNone : this.writeByteDirect;
+        this.writeShort = this.fReadOnly? this.writeShortDefault : this.writeShortDirect;
+    }
+
+    /**
+     * printAddr(sMessage)
+     *
+     * @this {Memory8080}
+     * @param {string} sMessage
+     */
+    printAddr(sMessage)
+    {
+        if (DEBUG && this.dbg && this.dbg.messageEnabled(Messages8080.MEM)) {
+            this.dbg.printMessage(sMessage + ' ' + (this.addr != null? ('%' + Str.toHex(this.addr)) : '#' + this.id), true);
+        }
+    }
+
+    /**
+     * addBreakpoint(off, fWrite)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {boolean} fWrite
+     */
+    addBreakpoint(off, fWrite)
+    {
+        if (!fWrite) {
+            if (this.cReadBreakpoints++ === 0) {
+                this.setReadAccess(Memory8080.afnChecked, false);
+            }
+            if (DEBUG) this.printAddr("read breakpoint added to memory block");
+        }
+        else {
+            if (this.cWriteBreakpoints++ === 0) {
+                this.setWriteAccess(Memory8080.afnChecked, false);
+            }
+            if (DEBUG) this.printAddr("write breakpoint added to memory block");
+        }
+    }
+
+    /**
+     * removeBreakpoint(off, fWrite)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {boolean} fWrite
+     */
+    removeBreakpoint(off, fWrite)
+    {
+        if (!fWrite) {
+            if (--this.cReadBreakpoints === 0) {
+                this.resetReadAccess();
+                if (DEBUG) this.printAddr("all read breakpoints removed from memory block");
+            }
+
+        }
+        else {
+            if (--this.cWriteBreakpoints === 0) {
+                this.resetWriteAccess();
+                if (DEBUG) this.printAddr("all write breakpoints removed from memory block");
+            }
+
+        }
+    }
+
+    /**
+     * copyBreakpoints(dbg, mem)
+     *
+     * @this {Memory8080}
+     * @param {Debugger8080} [dbg]
+     * @param {Memory8080} [mem] (outgoing Memory8080 block to copy breakpoints from, if any)
+     */
+    copyBreakpoints(dbg, mem)
+    {
+        this.dbg = dbg;
+        this.cReadBreakpoints = this.cWriteBreakpoints = 0;
+        if (mem) {
+            if ((this.cReadBreakpoints = mem.cReadBreakpoints)) {
+                this.setReadAccess(Memory8080.afnChecked, false);
+            }
+            if ((this.cWriteBreakpoints = mem.cWriteBreakpoints)) {
+                this.setWriteAccess(Memory8080.afnChecked, false);
+            }
+        }
+    }
+
+    /**
+     * readNone(off)
+     *
+     * Previously, this always returned 0x00, but the initial memory probe by the COMPAQ DeskPro 386 ROM BIOS
+     * writes 0x0000 to the first word of every 64Kb block in the nearly 16Mb address space it supports, and
+     * if it reads back 0x0000, it will initially think that LOTS of RAM exists, only to be disappointed later
+     * when it performs a more exhaustive memory test, generating unwanted error messages in the process.
+     *
+     * TODO: Determine if we should have separate readByteNone(), readShortNone() and readLongNone() functions
+     * to return 0xff, 0xffff and 0xffffffff|0, respectively.  This seems sufficient for now, as it seems unlikely
+     * that a system would require nonexistent memory locations to return ALL bits set.
+     *
+     * Also, I'm reluctant to address that potential issue by simply returning -1, because to date, the above
+     * Memory8080 interfaces have always returned values that are properly masked to 8, 16 or 32 bits, respectively.
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readNone(off, addr)
+    {
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(Messages8080.CPU | Messages8080.MEM) /* && !off */) {
+            this.dbg.message("attempt to read invalid block %" + Str.toHex(this.addr), true);
+        }
+        return 0xff;
+    }
+
+    /**
+     * writeNone(off, v, addr)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} v (could be either a byte or word value, since we use the same handler for both kinds of accesses)
+     * @param {number} addr
+     */
+    writeNone(off, v, addr)
+    {
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(Messages8080.CPU | Messages8080.MEM) /* && !off */) {
+            this.dbg.message("attempt to write " + Str.toHexWord(v) + " to invalid block %" + Str.toHex(this.addr), true);
+        }
+    }
+
+    /**
+     * readShortDefault(off, addr)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readShortDefault(off, addr)
+    {
+        return this.readByte(off++, addr++) | (this.readByte(off, addr) << 8);
+    }
+
+    /**
+     * writeShortDefault(off, w, addr)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} w
+     * @param {number} addr
+     */
+    writeShortDefault(off, w, addr)
+    {
+        this.writeByte(off++, w & 0xff, addr++);
+        this.writeByte(off, w >> 8, addr);
+    }
+
+    /**
+     * readByteMemory(off, addr)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readByteMemory(off, addr)
+    {
+        if (BYTEARRAYS) {
+            return this.ab[off];
+        }
+        return ((this.adw[off >> 2] >>> ((off & 0x3) << 3)) & 0xff);
+    }
+
+    /**
+     * readShortMemory(off, addr)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readShortMemory(off, addr)
+    {
+        if (BYTEARRAYS) {
+            return this.ab[off] | (this.ab[off + 1] << 8);
+        }
+        var w;
+        var idw = off >> 2;
+        var nShift = (off & 0x3) << 3;
+        var dw = (this.adw[idw] >> nShift);
+        if (nShift < 24) {
+            w = dw & 0xffff;
+        } else {
+            w = (dw & 0xff) | ((this.adw[idw + 1] & 0xff) << 8);
+        }
+        return w;
+    }
+
+    /**
+     * writeByteMemory(off, b, addr)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} b
+     * @param {number} addr
+     */
+    writeByteMemory(off, b, addr)
+    {
+        if (BYTEARRAYS) {
+            this.ab[off] = b;
+        } else {
+            var idw = off >> 2;
+            var nShift = (off & 0x3) << 3;
+            this.adw[idw] = (this.adw[idw] & ~(0xff << nShift)) | (b << nShift);
+        }
+        this.fDirty = true;
+    }
+
+    /**
+     * writeShortMemory(off, w, addr)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} w
+     * @param {number} addr
+     */
+    writeShortMemory(off, w, addr)
+    {
+        if (BYTEARRAYS) {
+            this.ab[off] = (w & 0xff);
+            this.ab[off + 1] = (w >> 8);
+        } else {
+            var idw = off >> 2;
+            var nShift = (off & 0x3) << 3;
+            if (nShift < 24) {
+                this.adw[idw] = (this.adw[idw] & ~(0xffff << nShift)) | (w << nShift);
+            } else {
+                this.adw[idw] = (this.adw[idw] & 0x00ffffff) | (w << 24);
+                idw++;
+                this.adw[idw] = (this.adw[idw] & (0xffffff00|0)) | (w >> 8);
+            }
+        }
+        this.fDirty = true;
+    }
+
+    /**
+     * readByteChecked(off, addr)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readByteChecked(off, addr)
+    {
+        if (DEBUGGER && this.dbg && this.addr != null) {
+            this.dbg.checkMemoryRead(this.addr + off);
+        }
+        return this.readByteDirect(off, addr);
+    }
+
+    /**
+     * readShortChecked(off, addr)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readShortChecked(off, addr)
+    {
+        if (DEBUGGER && this.dbg && this.addr != null) {
+            this.dbg.checkMemoryRead(this.addr + off, 2);
+        }
+        return this.readShortDirect(off, addr);
+    }
+
+    /**
+     * writeByteChecked(off, b, addr)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} addr
+     * @param {number} b
+     */
+    writeByteChecked(off, b, addr)
+    {
+        if (DEBUGGER && this.dbg && this.addr != null) {
+            this.dbg.checkMemoryWrite(this.addr + off);
+        }
+        if (this.fReadOnly) this.writeNone(off, b, addr); else this.writeByteDirect(off, b, addr);
+    }
+
+    /**
+     * writeShortChecked(off, w, addr)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} addr
+     * @param {number} w
+     */
+    writeShortChecked(off, w, addr)
+    {
+        if (DEBUGGER && this.dbg && this.addr != null) {
+            this.dbg.checkMemoryWrite(this.addr + off, 2)
+        }
+        if (this.fReadOnly) this.writeNone(off, w, addr); else this.writeShortDirect(off, w, addr);
+    }
+
+    /**
+     * readByteBE(off, addr)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readByteBE(off, addr)
+    {
+        return this.ab[off];
+    }
+
+    /**
+     * readByteLE(off, addr)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readByteLE(off, addr)
+    {
+        return this.ab[off];
+    }
+
+    /**
+     * readShortBE(off, addr)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readShortBE(off, addr)
+    {
+        return this.dv.getUint16(off, true);
+    }
+
+    /**
+     * readShortLE(off, addr)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readShortLE(off, addr)
+    {
+        /*
+         * TODO: It remains to be seen if there's any advantage to checking the offset for an aligned read
+         * vs. always reading the bytes separately; it seems a safe bet for longs, but it's less clear for shorts.
+         */
+        return (off & 0x1)? (this.ab[off] | (this.ab[off+1] << 8)) : this.aw[off >> 1];
+    }
+
+    /**
+     * writeByteBE(off, b, addr)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} b
+     * @param {number} addr
+     */
+    writeByteBE(off, b, addr)
+    {
+        this.ab[off] = b;
+        this.fDirty = true;
+    }
+
+    /**
+     * writeByteLE(off, b, addr)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} addr
+     * @param {number} b
+     */
+    writeByteLE(off, b, addr)
+    {
+        this.ab[off] = b;
+        this.fDirty = true;
+    }
+
+    /**
+     * writeShortBE(off, w, addr)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} addr
+     * @param {number} w
+     */
+    writeShortBE(off, w, addr)
+    {
+        this.dv.setUint16(off, w, true);
+        this.fDirty = true;
+    }
+
+    /**
+     * writeShortLE(off, w, addr)
+     *
+     * @this {Memory8080}
+     * @param {number} off
+     * @param {number} addr
+     * @param {number} w
+     */
+    writeShortLE(off, w, addr)
+    {
+        /*
+         * TODO: It remains to be seen if there's any advantage to checking the offset for an aligned write
+         * vs. always writing the bytes separately; it seems a safe bet for longs, but it's less clear for shorts.
+         */
+        if (off & 0x1) {
+            this.ab[off] = w;
+            this.ab[off+1] = w >> 8;
+        } else {
+            this.aw[off >> 1] = w;
+        }
+        this.fDirty = true;
+    }
+
+    /**
+     * adjustEndian(dw)
+     *
+     * @param {number} dw
+     * @return {number}
+     */
+    static adjustEndian(dw)
+    {
+        if (TYPEDARRAYS && !littleEndian) {
+            dw = (dw << 24) | ((dw << 8) & 0x00ff0000) | ((dw >> 8) & 0x0000ff00) | (dw >>> 24);
+        }
+        return dw;
+    }
+}
+
+/*
+ * Basic memory types
+ *
+ * RAM is the most conventional memory type, providing full read/write capability to x86-compatible (ie,
+ * 'little endian") storage.  ROM is equally conventional, except that the fReadOnly property is set,
+ * disabling writes.  VIDEO is treated exactly like RAM, unless a controller is provided.  Both RAM and
+ * VIDEO memory are always considered writable, and even ROM can be written using the Bus setByteDirect()
+ * interface (which in turn uses the Memory8080 writeByteDirect() interface), allowing the ROM component to
+ * initialize its own memory.  The CTRL type is used to identify memory-mapped devices that do not need
+ * any default storage and always provide their own controller.
+ *
+ * Unallocated regions of the address space contain a special memory block of type NONE that contains
+ * no storage.  Mapping every addressible location to a memory block allows all accesses to be routed in
+ * exactly the same manner, without resorting to any range or processor checks.
+ *
+ * These types are not mutually exclusive.  For example, VIDEO memory could be allocated as RAM, with or
+ * without a custom controller (the original Monochrome and CGA video cards used read/write storage that
+ * was indistinguishable from RAM), and CTRL memory could be allocated as an empty block of any type, with
+ * a custom controller.  A few types are required for certain features (eg, ROM is required if you want
+ * read-only memory), but the larger purpose of these types is to help document the caller's intent and to
+ * provide the Control Panel with the ability to highlight memory regions accordingly.
+ */
+Memory8080.TYPE = {
+    NONE:       0,
+    RAM:        1,
+    ROM:        2,
+    VIDEO:      3,
+    CTRL:       4,
+    COLORS:     ["black", "blue", "green", "cyan"],
+    NAMES:      ["NONE",  "RAM",  "ROM",   "VID",  "H/W"]
+};
+
+/*
+ * Last used block ID (used for debugging only)
+ */
+Memory8080.idBlock = 0;
+
+
+/*
+ * This is the effective definition of afnNone, but we need not fully define it, because setAccess()
+ * uses these defaults when any of the 4 handlers (ie, 2 byte handlers and 2 short handlers) are undefined.
+ *
+Memory8080.afnNone = [
+    Memory8080.prototype.readNone,
+    Memory8080.prototype.writeNone,
+    Memory8080.prototype.readShortDefault,
+    Memory8080.prototype.writeShortDefault
+];
+ */
+Memory8080.afnNone = [];
+
+Memory8080.afnMemory = [
+    Memory8080.prototype.readByteMemory,
+    Memory8080.prototype.writeByteMemory,
+    Memory8080.prototype.readShortMemory,
+    Memory8080.prototype.writeShortMemory
+];
+
+Memory8080.afnChecked = [
+    Memory8080.prototype.readByteChecked,
+    Memory8080.prototype.writeByteChecked,
+    Memory8080.prototype.readShortChecked,
+    Memory8080.prototype.writeShortChecked
+];
+
+if (TYPEDARRAYS) {
+    Memory8080.afnArrayBE = [
+        Memory8080.prototype.readByteBE,
+        Memory8080.prototype.writeByteBE,
+        Memory8080.prototype.readShortBE,
+        Memory8080.prototype.writeShortBE
+    ];
+
+    Memory8080.afnArrayLE = [
+        Memory8080.prototype.readByteLE,
+        Memory8080.prototype.writeByteLE,
+        Memory8080.prototype.readShortLE,
+        Memory8080.prototype.writeShortLE
+    ];
+}
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pc8080/lib/cpu.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class CPU8080 extends Component {
+    /**
+     * CPU8080(parmsCPU, nCyclesDefault)
+     *
+     * The CPU8080 class supports the following (parmsCPU) properties:
+     *
+     *      cycles: the machine's base cycles per second; the CPUState8080 constructor
+     *      will provide us with a default (based on the CPU model) to use as a fallback.
+     *
+     *      multiplier: base cycle multiplier; default is 1.
+     *
+     *      autoStart: true to automatically start, false to not, or null if "it depends";
+     *      null is the default, which means do not autostart UNLESS there is no Debugger
+     *      and no "Run" button (ie, no way to manually start the machine).
+     *
+     *      csStart: the number of cycles that runCPU() must wait before generating
+     *      checksum records; -1 if disabled. checksum records are a diagnostic aid
+     *      used to help compare one CPU run to another.
+     *
+     *      csInterval: the number of cycles that runCPU() must execute before generating
+     *      a checksum record; -1 if disabled.
+     *
+     *      csStop: the number of cycles to stop generating checksum records.
+     *
+     * This component is primarily responsible for interfacing the CPU with the outside
+     * world (eg, Panel and Debugger components), and managing overall CPU operation.
+     *
+     * It is extended by the CPUState8080 component, where the simulation control logic resides.
+     *
+     * @this {CPU8080}
+     * @param {Object} parmsCPU
+     * @param {number} nCyclesDefault
+     */
+    constructor(parmsCPU, nCyclesDefault)
+    {
+        super("CPU", parmsCPU, Messages8080.CPU);
+
+        var nCycles = parmsCPU['cycles'] || nCyclesDefault;
+
+        var nMultiplier = parmsCPU['multiplier'] || 1;
+
+        this.nCyclesPerSecond = nCycles;
+
+        /*
+         * nCyclesMultiplier replaces the old "speed" variable (0, 1, 2) and eliminates the need for
+         * the constants (SPEED_SLOW, SPEED_FAST and SPEED_MAX).  The UI simply doubles the multiplier
+         * until we've exceeded the host's speed limit and then starts the multiplier over at 1.
+         */
+        this.nCyclesMultiplier = nMultiplier;
+        this.mhzDefault = Math.round(this.nCyclesPerSecond / 10000) / 100;
+        /*
+         * TODO: Take care of this with an initial setSpeed() call instead?
+         */
+        this.mhzTarget = this.mhzDefault * this.nCyclesMultiplier;
+
+        /*
+         * We add a number of flags to the set initialized by Component
+         */
+        this.flags.running = false;
+        this.flags.starting = false;
+        this.flags.autoStart = parmsCPU['autoStart'];
+
+        /*
+         * TODO: Add some UI for fDisplayLiveRegs (either an XML property, or a UI checkbox, or both)
+         */
+        this.flags.displayLiveRegs = false;
+
+        /*
+         * Get checksum parameters, if any. runCPU() behavior is not affected until fChecksum
+         * is true, which won't happen until resetChecksum() is called with nCyclesChecksumInterval
+         * ("csInterval") set to a positive value.
+         *
+         * As above, any of these parameters can also be set with the Debugger's execution options
+         * command ("x"); for example, "x cs int 5000" will set nCyclesChecksumInterval to 5000
+         * and call resetChecksum().
+         */
+        this.flags.checksum = false;
+        this.nChecksum = this.nCyclesChecksumNext = 0;
+        this.nCyclesChecksumStart = parmsCPU["csStart"];
+        this.nCyclesChecksumInterval = parmsCPU["csInterval"];
+        this.nCyclesChecksumStop = parmsCPU["csStop"];
+
+        /*
+         * Array of countdown timers managed by addTimer() and setTimer().
+         */
+        this.aTimers = [];
+
+        this.onRunTimeout = this.runCPU.bind(this); // function onRunTimeout() { cpu.runCPU(); };
+
+        this.setReady();
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {CPU8080}
+     * @param {Computer8080} cmp
+     * @param {Bus8080} bus
+     * @param {CPU8080} cpu
+     * @param {Debugger8080} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cmp = cmp;
+        this.bus = bus;
+        this.dbg = dbg;
+
+        for (var i = 0; i < CPU8080.BUTTONS.length; i++) {
+            var control = this.bindings[CPU8080.BUTTONS[i]];
+            if (control) this.cmp.setBinding(null, CPU8080.BUTTONS[i], control);
+        }
+
+        /*
+         * Attach the ChipSet component to the CPU so that it can be notified whenever the CPU stops and starts.
+         */
+        this.chipset = /** @type {ChipSet8080} */ (cmp.getMachineComponent("ChipSet"));
+
+        /*
+         * We've already saved the parmsCPU 'autoStart' setting, but there may be a machine (or URL) override.
+         */
+        var sAutoStart = cmp.getMachineParm('autoStart');
+        if (sAutoStart != null) {
+            this.flags.autoStart = (sAutoStart == "true"? true : (sAutoStart  == "false"? false : !!sAutoStart));
+        }
+
+        this.setReady();
+    }
+
+    /**
+     * reset()
+     *
+     * @this {CPU8080}
+     */
+    reset()
+    {
+    }
+
+    /**
+     * save()
+     *
+     * This is a placeholder for save support (overridden by the CPUState8080 component).
+     *
+     * @this {CPU8080}
+     * @return {Object|null}
+     */
+    save()
+    {
+        return null;
+    }
+
+    /**
+     * restore(data)
+     *
+     * This is a placeholder for restore support (overridden by the CPUState8080 component).
+     *
+     * @this {CPU8080}
+     * @param {Object} data
+     * @return {boolean} true if restore successful, false if not
+     */
+    restore(data)
+    {
+        return false;
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {CPU8080}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            if (!data || !this.restore) {
+                this.reset();
+            } else {
+                this.resetCycles();
+                if (!this.restore(data)) return false;
+                this.resetChecksum();
+            }
+            /*
+             * Give the Debugger a chance to do/print something once we've powered up
+             */
+            if (DEBUGGER && this.dbg) {
+                this.dbg.init();
+            } else {
+                /*
+                 * The Computer (this.cmp) knows if there's a Control Panel (this.cmp.panel), and the Control Panel
+                 * knows if there's a "print" control (this.cmp.panel.controlPrint), and if there IS a "print" control
+                 * but no debugger, the machine is probably misconfigured (most likely, the page simply neglected to
+                 * load the Debugger component).
+                 *
+                 * However, we don't actually need to check all that; it's always safe use println(), regardless whether
+                 * a Control Panel with a "print" control is present or not.
+                 */
+                this.println("No debugger detected");
+            }
+        }
+        /*
+         * The Computer component (which is responsible for all powerDown and powerUp notifications)
+         * is now responsible for managing a component's fPowered flag, not us.
+         *
+         *      this.flags.powered = true;
+         */
+        this.updateCPU();
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {CPU8080}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        /*
+         * The Computer component (which is responsible for all powerDown and powerUp notifications)
+         * is now responsible for managing a component's fPowered flag, not us.
+         *
+         *      this.flags.powered = false;
+         */
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * autoStart()
+     *
+     * @this {CPU8080}
+     * @return {boolean} true if started, false if not
+     */
+    autoStart()
+    {
+        /*
+         * Start running automatically on power-up, assuming there's no Debugger and no "Run" button
+         */
+        if (this.flags.autoStart || (!DEBUGGER || !this.dbg) && this.bindings["run"] === undefined) {
+            /*
+             * We used to also set fUpdateFocus when calling runCPU(), on the assumption that in the "auto-starting"
+             * context, a machine without focus is like a day without sunshine, but in reality, focus should only be
+             * forced when the user takes some other machine-related action.
+             */
+            this.runCPU();
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * isPowered()
+     *
+     * @this {CPU8080}
+     * @return {boolean}
+     */
+    isPowered()
+    {
+        if (!this.flags.powered) {
+            this.println(this.toString() + " not powered");
+            return false;
+        }
+        return true;
+    }
+
+    /**
+     * isRunning()
+     *
+     * @this {CPU8080}
+     * @return {boolean}
+     */
+    isRunning()
+    {
+        return this.flags.running;
+    }
+
+    /**
+     * getChecksum()
+     *
+     * This will be implemented by the CPUState8080 component.
+     *
+     * @this {CPU8080}
+     * @return {number} a 32-bit summation of key elements of the current CPU state (used by the CPU checksum code)
+     */
+    getChecksum()
+    {
+        return 0;
+    }
+
+    /**
+     * resetChecksum()
+     *
+     * If checksum generation is enabled (fChecksum is true), this resets the running 32-bit checksum and the
+     * cycle counter that will trigger the next displayChecksum(); called by resetCycles(), which is called whenever
+     * the CPU is reset or restored.
+     *
+     * @this {CPU8080}
+     * @return {boolean} true if checksum generation enabled, false if not
+     */
+    resetChecksum()
+    {
+        if (this.nCyclesChecksumStart === undefined) this.nCyclesChecksumStart = 0;
+        if (this.nCyclesChecksumInterval === undefined) this.nCyclesChecksumInterval = -1;
+        if (this.nCyclesChecksumStop === undefined) this.nCyclesChecksumStop = -1;
+        this.flags.checksum = (this.nCyclesChecksumStart >= 0 && this.nCyclesChecksumInterval > 0);
+        if (this.flags.checksum) {
+            this.nChecksum = 0;
+            this.nCyclesChecksumNext = this.nCyclesChecksumStart - this.nTotalCycles;
+            /*
+             *  this.nCyclesChecksumNext = this.nCyclesChecksumStart + this.nCyclesChecksumInterval -
+             *      (this.nTotalCycles % this.nCyclesChecksumInterval);
+             */
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * updateChecksum(nCycles)
+     *
+     * When checksum generation is enabled (fChecksum is true), runCPU() asks stepCPU() to execute a minimum
+     * number of cycles (1), effectively limiting execution to a single instruction, and then we're called with
+     * the exact number cycles that were actually executed.  This should give us instruction-granular checksums
+     * at precise intervals that are 100% repeatable.
+     *
+     * @this {CPU8080}
+     * @param {number} nCycles
+     */
+    updateChecksum(nCycles)
+    {
+        if (this.flags.checksum) {
+            /*
+             * Get a 32-bit summation of the current CPU state and add it to our running 32-bit checksum
+             */
+            var fDisplay = false;
+            this.nChecksum = (this.nChecksum + this.getChecksum())|0;
+            this.nCyclesChecksumNext -= nCycles;
+            if (this.nCyclesChecksumNext <= 0) {
+                this.nCyclesChecksumNext += this.nCyclesChecksumInterval;
+                fDisplay = true;
+            }
+            if (this.nCyclesChecksumStop >= 0) {
+                if (this.nCyclesChecksumStop <= this.getCycles()) {
+                    this.nCyclesChecksumInterval = this.nCyclesChecksumStop = -1;
+                    this.resetChecksum();
+                    this.stopCPU();
+                    fDisplay = true;
+                }
+            }
+            if (fDisplay) this.displayChecksum();
+        }
+    }
+
+    /**
+     * displayChecksum()
+     *
+     * When checksum generation is enabled (fChecksum is true), this is called to provide a crude log of all
+     * checksums generated at the specified cycle intervals, as specified by the "csStart" and "csInterval" parmsCPU
+     * properties).
+     *
+     * @this {CPU8080}
+     */
+    displayChecksum()
+    {
+        this.println(this.getCycles() + " cycles: " + "checksum=" + Str.toHex(this.nChecksum));
+    }
+
+    /**
+     * displayValue(sLabel, nValue, cch)
+     *
+     * This is principally for displaying register values, but in reality, it can be used to display any
+     * numeric (hex) value bound to the given label.
+     *
+     * @this {CPU8080}
+     * @param {string} sLabel
+     * @param {number} nValue
+     * @param {number} cch
+     */
+    displayValue(sLabel, nValue, cch)
+    {
+        if (this.bindings[sLabel]) {
+            if (nValue === undefined) {
+                this.setError("Value for " + sLabel + " is invalid");
+                this.stopCPU();
+            }
+            var sVal;
+            if (!this.flags.running || this.flags.displayLiveRegs) {
+                sVal = Str.toHex(nValue, cch);
+            } else {
+                sVal = "--------".substr(0, cch);
+            }
+            /*
+             * TODO: Determine if this test actually avoids any redrawing when a register hasn't changed, and/or if
+             * we should maintain our own (numeric) cache of displayed register values (to avoid creating these temporary
+             * string values that will have to garbage-collected), and/or if this is actually slower, and/or if I'm being
+             * too obsessive.
+             */
+            if (this.bindings[sLabel].textContent != sVal) this.bindings[sLabel].textContent = sVal;
+        }
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * @this {CPU8080}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "run")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        var cpu = this;
+        var fBound = false;
+
+        switch (sBinding) {
+        case "power":
+        case "reset":
+            /*
+             * The "power" and "reset" buttons are functions of the entire computer, not just the CPU,
+             * but it's not always convenient to stick a power button in the Computer component definition,
+             * so we record those bindings here and pass them on to the Computer component in initBus().
+             */
+            this.bindings[sBinding] = control;
+            fBound = true;
+            break;
+
+        case "run":
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickRun() {
+                if (!cpu.cmp || !cpu.cmp.checkPower()) return;
+                /*
+                 * We no longer pass true to these runCPU()/stopCPU() calls, on the theory that if the "run"
+                 * control is visible, then the computer is probably sufficiently visible as well; the problem
+                 * with setting fUpdateFocus to true is that it can jerk the web page around in annoying ways.
+                 */
+                if (!cpu.flags.running)
+                    cpu.runCPU();
+                else
+                    cpu.stopCPU();
+            };
+            fBound = true;
+            break;
+
+        case "speed":
+            this.bindings[sBinding] = control;
+            fBound = true;
+            break;
+
+        case "setSpeed":
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickSetSpeed() {
+                cpu.setSpeed(cpu.nCyclesMultiplier << 1, true);
+            };
+            control.textContent = this.getSpeedTarget();
+            fBound = true;
+            break;
+
+        default:
+            break;
+        }
+        return fBound;
+    }
+
+    /**
+     * setBurstCycles(nCycles)
+     *
+     * This function is used by the ChipSet component whenever a very low timer count is set,
+     * in anticipation of the timer requiring an update sooner than the normal nCyclesPerYield
+     * period in runCPU() would normally provide.
+     *
+     * NOTE: In this context, "timer" refers to a timer chip (eg, an Intel 8253) being emulated by
+     * by the ChipSet component, not the timers managed by the CPU (eg, addTimer(), setTimer(), etc).
+     *
+     * @this {CPU8080}
+     * @param {number} nCycles is the target number of cycles to drop the current burst to
+     * @return {boolean}
+     */
+    setBurstCycles(nCycles)
+    {
+        if (this.flags.running) {
+            var nDelta = this.nStepCycles - nCycles;
+            /*
+             * NOTE: If nDelta is negative, we will actually be increasing nStepCycles and nBurstCycles.
+             * Which is OK, but if we're also taking snapshots of the cycle counts, to make sure that instruction
+             * costs are being properly assessed, then we need to update nSnapCycles as well.
+             *
+             * TODO: If the delta is negative, we could simply ignore the request, but we must first carefully
+             * consider the impact on the ChipSet timers, if any.
+             */
+            // if (DEBUG) this.nSnapCycles -= nDelta;
+            this.nStepCycles -= nDelta;
+            this.nBurstCycles -= nDelta;
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * addCycles(nCycles, fEndStep)
+     *
+     * @this {CPU8080}
+     * @param {number} nCycles
+     * @param {boolean} [fEndStep]
+     */
+    addCycles(nCycles, fEndStep)
+    {
+        this.nTotalCycles += nCycles;
+        if (fEndStep) {
+            this.nBurstCycles = this.nStepCycles = 0;
+        }
+    }
+
+    /**
+     * calcCycles(fRecalc)
+     *
+     * Calculate the number of cycles to process for each "burst" of CPU activity.  The size of a burst
+     * is driven by YIELDS_PER_SECOND (eg, 30).
+     *
+     * At the end of each burst, we subtract burst cycles from the yield cycle "threshold" counter.
+     * Whenever the "next yield" cycle counter goes to (or below) zero, we compare elapsed time to the time
+     * we expected the virtual hardware to take (eg, 1000ms/50 or 20ms), and if we still have time remaining,
+     * we sleep the remaining time (or 0ms if there's no remaining time), and then restart runCPU().
+     *
+     * @this {CPU8080}
+     * @param {boolean} [fRecalc] is true if the caller wants to recalculate thresholds based on the most recent
+     * speed calculation (see calcSpeed).
+     */
+    calcCycles(fRecalc)
+    {
+        /*
+         * Calculate "per" yield values.
+         */
+        var vMultiplier = 1;
+        if (fRecalc) {
+            if (this.nCyclesMultiplier > 1 && this.mhz) {
+                vMultiplier = (this.mhz / this.mhzDefault);
+            }
+        }
+
+        this.msPerYield = Math.round(1000 / CPU8080.YIELDS_PER_SECOND);
+        this.nCyclesPerYield = Math.floor(this.nCyclesPerSecond / CPU8080.YIELDS_PER_SECOND * vMultiplier);
+
+        /*
+         * And initialize "next" yield values to the "per" values.
+         */
+        if (!fRecalc) {
+            this.nCyclesNextYield = this.nCyclesPerYield;
+        }
+        this.nCyclesRecalc = 0;
+    }
+
+    /**
+     * getCycles(fScaled)
+     *
+     * getCycles() returns the number of cycles executed so far.  Note that we can be called after
+     * runCPU() OR during runCPU(), perhaps from a handler triggered during the current run's stepCPU(),
+     * so nRunCycles must always be adjusted by number of cycles stepCPU() was asked to run (nBurstCycles),
+     * less the number of cycles it has yet to run (nStepCycles).
+     *
+     * nRunCycles is zeroed whenever the CPU is halted or the CPU speed is changed, which is why we also
+     * have nTotalCycles, which accumulates all nRunCycles before we zero it.  However, nRunCycles and
+     * nTotalCycles eventually get reset by calcSpeed(), to avoid overflow, so components that rely on
+     * getCycles() returning steadily increasing values should also be prepared for a reset at any time.
+     *
+     * @this {CPU8080}
+     * @param {boolean} [fScaled] is true if the caller wants a cycle count relative to a multiplier of 1
+     * @return {number}
+     */
+    getCycles(fScaled)
+    {
+        var nCycles = this.nTotalCycles + this.nRunCycles + this.nBurstCycles - this.nStepCycles;
+        if (fScaled && this.nCyclesMultiplier > 1 && this.mhz > this.mhzDefault) {
+            /*
+             * We could scale the current cycle count by the current effective speed (this.mhz); eg:
+             *
+             *      nCycles = Math.round(nCycles / (this.mhz / this.mhzDefault));
+             *
+             * but that speed will fluctuate somewhat: large fluctuations at first, but increasingly smaller
+             * fluctuations after each burst of instructions that runCPU() executes.
+             *
+             * Alternatively, we can scale the cycle count by the multiplier, which is good in that the
+             * multiplier doesn't vary once the user changes it, but a potential downside is that the
+             * multiplier might be set too high, resulting in a target speed that's higher than the effective
+             * speed is able to reach.
+             *
+             * Also, if multipliers were always limited to a power-of-two, then this could be calculated
+             * with a simple shift.  However, only the "setSpeed" UI binding limits it that way; the Debugger
+             * interface allows any value, as does the CPU "multiplier" parmsCPU property (from the machine's
+             * XML file).
+             */
+            nCycles = Math.round(nCycles / this.nCyclesMultiplier);
+        }
+        return nCycles;
+    }
+
+    /**
+     * getCyclesPerSecond()
+     *
+     * This returns the CPU's "base" speed (ie, the original cycles per second defined for the machine)
+     *
+     * @this {CPU8080}
+     * @return {number}
+     */
+    getCyclesPerSecond()
+    {
+        return this.nCyclesPerSecond;
+    }
+
+    /**
+     * resetCycles()
+     *
+     * Resets speed and cycle information as part of any reset() or restore(); this typically occurs during powerUp().
+     * It's important that this be called BEFORE the actual restore() call, because restore() may want to call setSpeed(),
+     * which in turn assumes that all the cycle counts have been initialized to sensible values.
+     *
+     * @this {CPU8080}
+     */
+    resetCycles()
+    {
+        this.mhz = 0;
+        this.nYieldsSinceStatusUpdate = 0;
+        this.nTotalCycles = this.nRunCycles = this.nBurstCycles = this.nStepCycles = 0;
+        this.resetChecksum();
+        this.setSpeed(1);
+    }
+
+    /**
+     * getSpeed()
+     *
+     * @this {CPU8080}
+     * @return {number} the current speed multiplier
+     */
+    getSpeed()
+    {
+        return this.nCyclesMultiplier;
+    }
+
+    /**
+     * getSpeedCurrent()
+     *
+     * @this {CPU8080}
+     * @return {string} the current speed, in mhz, as a string formatted to two decimal places
+     */
+    getSpeedCurrent()
+    {
+        /*
+         * TODO: Has toFixed() been "fixed" in all browsers (eg, IE) to return a rounded value now?
+         */
+        return ((this.flags.running && this.mhz)? (this.mhz.toFixed(2) + "Mhz") : "Stopped");
+    }
+
+    /**
+     * getSpeedTarget()
+     *
+     * @this {CPU8080}
+     * @return {string} the target speed, in mhz, as a string formatted to two decimal places
+     */
+    getSpeedTarget()
+    {
+        /*
+         * TODO: Has toFixed() been "fixed" in all browsers (eg, IE) to return a rounded value now?
+         */
+        return this.mhzTarget.toFixed(2) + "Mhz";
+    }
+
+    /**
+     * setSpeed(nMultiplier, fUpdateFocus)
+     *
+     * NOTE: This used to return the target speed, in mhz, but no callers appear to care at this point.
+     *
+     * @desc Whenever the speed is changed, the running cycle count and corresponding start time must be reset,
+     * so that the next effective speed calculation obtains sensible results.  In fact, when runCPU() initially calls
+     * setSpeed() with no parameters, that's all this function does (it doesn't change the current speed setting).
+     *
+     * @this {CPU8080}
+     * @param {number} [nMultiplier] is the new proposed multiplier (reverts to 1 if the target was too high)
+     * @param {boolean} [fUpdateFocus] is true to update Computer focus
+     * @return {boolean} true if successful, false if not
+     */
+    setSpeed(nMultiplier, fUpdateFocus)
+    {
+        var fSuccess = false;
+        if (nMultiplier !== undefined) {
+            /*
+             * If we haven't reached 80% (0.8) of the current target speed, revert to a multiplier of one (1).
+             */
+            if (this.mhz / this.mhzTarget < 0.8) {
+                nMultiplier = 1;
+            } else {
+                fSuccess = true;
+            }
+            this.nCyclesMultiplier = nMultiplier;
+            var mhz = this.mhzDefault * this.nCyclesMultiplier;
+            if (this.mhzTarget != mhz) {
+                this.mhzTarget = mhz;
+                var sSpeed = this.getSpeedTarget();
+                var controlSpeed = this.bindings["setSpeed"];
+                if (controlSpeed) controlSpeed.textContent = sSpeed;
+                this.println("target speed: " + sSpeed);
+            }
+            if (fUpdateFocus && this.cmp) this.cmp.updateFocus();
+        }
+        this.addCycles(this.nRunCycles);
+        this.nRunCycles = 0;
+        this.msStartRun = Component.getTime();
+        this.msEndThisRun = 0;
+        this.calcCycles();
+        return fSuccess;
+    }
+
+    /**
+     * calcSpeed(nCycles, msElapsed)
+     *
+     * @this {CPU8080}
+     * @param {number} nCycles
+     * @param {number} msElapsed
+     */
+    calcSpeed(nCycles, msElapsed)
+    {
+        if (msElapsed) {
+            this.mhz = Math.round(nCycles / (msElapsed * 10)) / 100;
+            if (msElapsed >= 86400000) {
+                this.nTotalCycles = 0;
+                this.setSpeed();        // reset all counters once per day so that we never have to worry about overflow
+            }
+        }
+    }
+
+    /**
+     * calcStartTime()
+     *
+     * @this {CPU8080}
+     */
+    calcStartTime()
+    {
+        if (this.nCyclesRecalc >= this.nCyclesPerSecond) {
+            this.calcCycles(true);
+        }
+        this.nCyclesThisRun = 0;
+        this.msStartThisRun = Component.getTime();
+
+        /*
+         * Try to detect situations where the browser may have throttled us, such as when the user switches
+         * to a different tab; in those situations, Chrome and Safari may restrict setTimeout() callbacks
+         * to roughly one per second.
+         *
+         * Another scenario: the user resizes the browser window.  setTimeout() callbacks are not throttled,
+         * but there can still be enough of a lag between the callbacks that CPU speed will be noticeably
+         * erratic if we don't compensate for it here.
+         *
+         * We can detect throttling/lagging by verifying that msEndThisRun (which was set at the end of the
+         * previous run and includes any requested sleep time) is comparable to the current msStartThisRun;
+         * if the delta is significant, we compensate by bumping msStartRun forward by that delta.
+         *
+         * This shouldn't be triggered when the Debugger halts the CPU, because setSpeed() -- which is called
+         * whenever the CPU starts running again -- zeroes msEndThisRun.
+         *
+         * This also won't do anything about other internal delays; for example, Debugger message() calls.
+         * By the time the message() function has called yieldCPU(), the cost of the message has already been
+         * incurred, so it will be end up being charged against the instruction(s) that triggered it.
+         *
+         * TODO: Consider calling yieldCPU() sooner from message(), so that it can arrange for the msEndThisRun
+         * "snapshot" to occur sooner; it's unclear, however, whether that will really improve the CPU's ability
+         * to hit its target speed, since you would expect any instruction that displays a message to be an
+         * EXTREMELY slow instruction.
+         */
+        if (this.msEndThisRun) {
+            var msDelta = this.msStartThisRun - this.msEndThisRun;
+            if (msDelta > this.msPerYield) {
+                if (MAXDEBUG) this.println("large time delay: " + msDelta + "ms");
+                this.msStartRun += msDelta;
+                /*
+                 * Bumping msStartRun forward should NEVER cause it to exceed msStartThisRun; however, just
+                 * in case, I make absolutely sure it cannot happen, since doing so could result in negative
+                 * speed calculations.
+                 */
+
+                if (this.msStartRun > this.msStartThisRun) {
+                    this.msStartRun = this.msStartThisRun;
+                }
+            }
+        }
+    }
+
+    /**
+     * calcRemainingTime()
+     *
+     * @this {CPU8080}
+     * @return {number}
+     */
+    calcRemainingTime()
+    {
+        this.msEndThisRun = Component.getTime();
+
+        var msYield = this.msPerYield;
+        if (this.nCyclesThisRun) {
+            /*
+             * Normally, we would assume we executed a full quota of work over msPerYield, but since the CPU
+             * now has the option of calling yieldCPU(), that might not be true.  If nCyclesThisRun is correct, then
+             * the ratio of nCyclesThisRun/nCyclesPerYield should represent the percentage of work we performed,
+             * and so applying that percentage to msPerYield should give us a better estimate of work vs. time.
+             */
+            msYield = Math.round(msYield * this.nCyclesThisRun / this.nCyclesPerYield);
+        }
+
+        var msElapsedThisRun = this.msEndThisRun - this.msStartThisRun;
+        var msRemainsThisRun = msYield - msElapsedThisRun;
+
+        /*
+         * We could pass only "this run" results to calcSpeed():
+         *
+         *      nCycles = this.nCyclesThisRun;
+         *      msElapsed = msElapsedThisRun;
+         *
+         * but it seems preferable to use longer time periods and hopefully get a more accurate speed.
+         *
+         * Also, if msRemainsThisRun >= 0 && this.nCyclesMultiplier == 1, we could pass these results instead:
+         *
+         *      nCycles = this.nCyclesThisRun;
+         *      msElapsed = this.msPerYield;
+         *
+         * to insure that we display a smooth, constant N Mhz.  But for now, I prefer seeing any fluctuations.
+         */
+        var nCycles = this.nRunCycles;
+        var msElapsed = this.msEndThisRun - this.msStartRun;
+
+        if (MAXDEBUG && msRemainsThisRun < 0 && this.nCyclesMultiplier > 1) {
+            this.println("warning: updates @" + msElapsedThisRun + "ms (prefer " + Math.round(msYield) + "ms)");
+        }
+
+        this.calcSpeed(nCycles, msElapsed);
+
+        if (msRemainsThisRun < 0 || this.mhz < this.mhzTarget) {
+            /*
+             * Try "throwing out" the effects of large anomalies, by moving the overall run start time up;
+             * ordinarily, this should only happen when the someone is using an external Debugger or some other
+             * tool or feature that is interfering with our overall execution.
+             */
+            if (msRemainsThisRun < -1000) {
+                this.msStartRun -= msRemainsThisRun;
+            }
+            /*
+             * If the last burst took MORE time than we allotted (ie, it's taking more than 1 second to simulate
+             * nCyclesPerSecond), all we can do is yield for as little time as possible (ie, 0ms) and hope that the
+             * simulation is at least usable.
+             */
+            msRemainsThisRun = 0;
+        }
+
+        /*
+         * Last but not least, update nCyclesRecalc, so that when runCPU() starts up again and calls calcStartTime(),
+         * it'll be ready to decide if calcCycles() should be called again.
+         */
+        this.nCyclesRecalc += this.nCyclesThisRun;
+
+        if (DEBUG && this.messageEnabled(Messages8080.LOG) && msRemainsThisRun) {
+            this.log("calcRemainingTime: " + msRemainsThisRun + "ms to sleep after " + this.msEndThisRun + "ms");
+        }
+
+        this.msEndThisRun += msRemainsThisRun;
+        return msRemainsThisRun;
+    }
+
+    /**
+     * addTimer(callBack)
+     *
+     * Components that want to have timers that periodically fire after some number of milliseconds call
+     * addTimer() to create the timer, and then setTimer() every time they want to arm it.  There is currently
+     * no removeTimer() because these are generally used for the entire lifetime of a component.
+     *
+     * Internally, each timer entry is a preallocated Array with two entries: a cycle countdown in element [0]
+     * and a callback function in element [1].  A timer is initially dormant; dormant timers have a countdown
+     * value of -1 (although any negative number will suffice) and active timers have a non-negative value.
+     *
+     * Why not use JavaScript's setTimeout() instead?  Good question.  For a good answer, see setTimer() below.
+     *
+     * @this {CPU8080}
+     * @param {function()} callBack
+     * @return {number} timer index
+     */
+    addTimer(callBack)
+    {
+        var iTimer = this.aTimers.length;
+        this.aTimers.push([-1, callBack]);
+        return iTimer;
+    }
+
+    /**
+     * setTimer(iTimer, ms, fReset)
+     *
+     * Using the timer index from a previous addTimer() call, this sets that timer to fire after the
+     * specified number of milliseconds.
+     *
+     * This is preferred over JavaScript's setTimeout(), because all our timers are effectively paused when
+     * the CPU is paused (eg, when the Debugger halts execution).  Moreover, setTimeout() handlers only run after
+     * runCPU() yields, which is far too granular for some components (eg, when the SerialPort tries to simulate
+     * interrupts at 9600 baud).
+     *
+     * Ideally, the only function that would use setTimeout() is runCPU(), while the rest of the components
+     * use setTimer(); however, due to legacy code (ie, code that predates these functions) and/or laziness,
+     * that's currently not the case.  TODO: Fix.
+     *
+     * @this {CPU8080}
+     * @param {number} iTimer
+     * @param {number} ms (converted into a cycle countdown internally)
+     * @param {boolean} [fReset] (true if the timer should be reset even if already armed)
+     * @return {number} (number of cycles used to arm timer, or -1 if error)
+     */
+    setTimer(iTimer, ms, fReset)
+    {
+        var nCycles = -1;
+        if (iTimer >= 0 && iTimer < this.aTimers.length) {
+            if (fReset || this.aTimers[iTimer][0] < 0) {
+                nCycles = this.getMSCycles(ms);
+                /*
+                 * We must now confront the following problem: if the CPU is currently executing a burst of cycles,
+                 * the number of cycles it has executed in that burst so far must NOT be charged against the cycle
+                 * timeout we're about to set.  The simplest way to resolve that is to immediately call endBurst()
+                 * and bias the above cycle timeout by the number of cycles that the burst executed.
+                 */
+                this.aTimers[iTimer][0] = nCycles + this.endBurst();
+            }
+        }
+        return nCycles;
+    }
+
+    /**
+     * getMSCycles(ms)
+     *
+     * @this {CPU8080}
+     * @param {number} ms
+     * @return {number} number of corresponding cycles
+     */
+    getMSCycles(ms)
+    {
+        return (this.nCyclesPerSecond * this.nCyclesMultiplier) / 1000 * ms;
+    }
+
+    /**
+     * getBurstCycles(nCycles)
+     *
+     * Used by runCPU() to get min(nCycles,[timer cycle counts])
+     *
+     * @this {CPU8080}
+     * @param {number} nCycles (number of cycles about to execute)
+     * @return {number} (either nCycles or less if a timer needs to fire)
+     */
+    getBurstCycles(nCycles)
+    {
+        for (var i = this.aTimers.length - 1; i >= 0; i--) {
+            var timer = this.aTimers[i];
+            if (timer[0] < 0) continue;
+            if (nCycles > timer[0]) {
+                nCycles = timer[0];
+            }
+        }
+        return nCycles;
+    }
+
+    /**
+     * updateTimers(nCycles)
+     *
+     * Used by runCPU() to reduce all active timer countdown values by the number of cycles just executed;
+     * this is the function that actually "fires" any timer(s) whose countdown has reached (or dropped below)
+     * zero, invoking their callback function.
+     *
+     * @this {CPU8080}
+     * @param {number} nCycles (number of cycles actually executed)
+     */
+    updateTimers(nCycles)
+    {
+        for (var i = this.aTimers.length - 1; i >= 0; i--) {
+            var timer = this.aTimers[i];
+            if (timer[0] < 0) continue;
+            timer[0] -= nCycles;
+            if (timer[0] <= 0) {
+                timer[0] = -1;      // zero is technically an "active" value, so ensure the timer is dormant now
+                timer[1]();         // safe to invoke the callback function now
+            }
+        }
+    }
+
+    /**
+     * endBurst(fReset)
+     *
+     * @this {CPU8080}
+     * @param {boolean} [fReset]
+     * @return {number} (number of cycles executed in the most recent burst)
+     */
+    endBurst(fReset)
+    {
+        var nCycles = this.nBurstCycles -= this.nStepCycles;
+        this.nStepCycles = 0;
+        if (fReset) this.nBurstCycles = 0;
+        return nCycles;
+    }
+
+    /**
+     * runCPU(fUpdateFocus)
+     *
+     * @this {CPU8080}
+     * @param {boolean} [fUpdateFocus] is true to update Computer focus
+     */
+    runCPU(fUpdateFocus)
+    {
+        if (!this.setBusy(true)) {
+            this.updateCPU();
+            if (this.cmp) this.cmp.stop(Component.getTime(), this.getCycles());
+            return;
+        }
+
+        this.startCPU(fUpdateFocus);
+
+        /*
+         *  calcStartTime() initializes the cycle counter and timestamp for this runCPU() invocation, and optionally
+         *  recalculates the the maximum number of cycles for each burst if the nCyclesRecalc threshold has been reached.
+         */
+        this.calcStartTime();
+
+        try {
+            do {
+                /*
+                 * nCycles is how many cycles we WANT to run on each iteration of stepCPU(), and may be as
+                 * HIGH as nCyclesPerYield, but it may be significantly less.  getBurstCycles() will adjust
+                 * nCycles downward if any CPU timers need to fire during the next burst.
+                 */
+                var nCycles = this.getBurstCycles(this.flags.checksum? 1 : this.nCyclesPerYield);
+
+                /*
+                 * Execute the burst.
+                 */
+                this.stepCPU(nCycles);
+
+                /*
+                 * Terminate the burst, returning the number of cycles that stepCPU() actually ran.
+                 */
+                nCycles = this.endBurst(true);
+
+                /*
+                 * Add nCycles to nCyclesThisRun, as well as nRunCycles (the cycle count since the CPU first started).
+                 */
+                this.nCyclesThisRun += nCycles;
+                this.nRunCycles += nCycles;
+                this.updateChecksum(nCycles);
+
+                /*
+                 * Update any/all timers, firing those whose cycle countdowns have reached (or dropped below) zero.
+                 */
+                this.updateTimers(nCycles);
+
+                this.nCyclesNextYield -= nCycles;
+                if (this.nCyclesNextYield <= 0) {
+                    this.nCyclesNextYield += this.nCyclesPerYield;
+                    if (++this.nYieldsSinceStatusUpdate >= CPU8080.YIELDS_PER_STATUS) {
+                        if (this.cmp) this.cmp.updateStatus();
+                        this.nYieldsSinceStatusUpdate = 0;
+                    }
+                    break;
+                }
+            } while (this.flags.running);
+        }
+        catch (e) {
+            this.stopCPU();
+            this.updateCPU();
+            if (this.cmp) this.cmp.stop(Component.getTime(), this.getCycles());
+            this.setBusy(false);
+            this.setError(e.stack || e.message);
+            return;
+        }
+
+        setTimeout(this.onRunTimeout, this.calcRemainingTime());
+    }
+
+    /**
+     * startCPU(fUpdateFocus)
+     *
+     * WARNING: Other components must use runCPU() to get the CPU running; this is a runCPU() helper function only.
+     *
+     * @param {boolean} [fUpdateFocus]
+     */
+    startCPU(fUpdateFocus)
+    {
+        if (!this.flags.running) {
+            /*
+             *  setSpeed() without a speed parameter leaves the selected speed in place, but also resets the
+             *  cycle counter and timestamp for the current series of runCPU() calls, calculates the maximum number
+             *  of cycles for each burst based on the last known effective CPU speed, and resets the nCyclesRecalc
+             *  threshold counter.
+             */
+            this.setSpeed();
+            if (this.cmp) this.cmp.start(this.msStartRun, this.getCycles());
+            this.flags.running = true;
+            this.flags.starting = true;
+            if (this.chipset) this.chipset.start();
+            var controlRun = this.bindings["run"];
+            if (controlRun) controlRun.textContent = "Halt";
+            if (this.cmp) {
+                this.cmp.updateStatus(true);
+                if (fUpdateFocus) this.cmp.updateFocus(true);
+            }
+        }
+    }
+
+    /**
+     * stepCPU(nMinCycles)
+     *
+     * This will be implemented by the CPUState8080 component.
+     *
+     * @this {CPU8080}
+     * @param {number} nMinCycles (0 implies a single-step, and therefore breakpoints should be ignored)
+     * @return {number} of cycles executed; 0 indicates that the last instruction was not executed
+     */
+    stepCPU(nMinCycles)
+    {
+        return 0;
+    }
+
+    /**
+     * stopCPU(fComplete)
+     *
+     * For use by any component that wants to stop the CPU.
+     *
+     * This similar to yieldCPU(), but it doesn't need to zero nCyclesNextYield to break out of runCPU();
+     * it simply needs to clear fRunning (well, "simply" may be oversimplifying a bit....)
+     *
+     * @this {CPU8080}
+     * @param {boolean} [fComplete]
+     */
+    stopCPU(fComplete)
+    {
+        this.isBusy(true);
+        this.endBurst();
+        this.addCycles(this.nRunCycles);
+        this.nRunCycles = 0;
+        if (this.flags.running) {
+            this.flags.running = false;
+            if (this.chipset) this.chipset.stop();
+            var controlRun = this.bindings["run"];
+            if (controlRun) controlRun.textContent = "Run";
+        }
+        this.flags.complete = fComplete;
+    }
+
+    /**
+     * updateCPU(fForce)
+     *
+     * This used to be performed at the end of every stepCPU(), but runCPU() -- which relies upon
+     * stepCPU() -- needed to have more control over when these updates are performed.  However, for
+     * other callers of stepCPU(), such as the Debugger, the combination of stepCPU() + updateCPU()
+     * provides the old behavior.
+     *
+     * @this {CPU8080}
+     * @param {boolean} [fForce] (true to force a video update; used by the Debugger)
+     */
+    updateCPU(fForce)
+    {
+        if (this.cmp) {
+            this.cmp.updateVideo(fForce);
+            this.cmp.updateStatus(fForce);
+        }
+    }
+
+    /**
+     * yieldCPU()
+     *
+     * Similar to stopCPU() with regard to how it resets various cycle countdown values, but the CPU
+     * remains in a "running" state.
+     *
+     * @this {CPU8080}
+     */
+    yieldCPU()
+    {
+        this.endBurst();                    // this will break us out of stepCPU()
+        this.nCyclesNextYield = 0;          // this will break us out of runCPU(), once we break out of stepCPU()
+        // if (DEBUG) this.nSnapCycles = this.nBurstCycles;
+        /*
+         * The Debugger calls yieldCPU() after every message() to ensure browser responsiveness, but it looks
+         * odd for those messages to show CPU state changes but for the CPU's own status display to not (ditto
+         * for the Video display), so I've added this call to try to keep things looking synchronized.
+         */
+        this.updateCPU();
+    }
+}
+
+/*
+ * Constants that control the frequency at which various updates should occur.
+ *
+ * These values do NOT control the simulation directly.  Instead, they are used by
+ * calcCycles(), which uses the nCyclesPerSecond passed to the constructor as a starting
+ * point and computes the following variables:
+ *
+ *      this.nCyclesPerYield:    (this.nCyclesPerSecond / CPU8080.YIELDS_PER_SECOND)
+ *
+ * The above variables are also multiplied by any cycle multiplier in effect, via setSpeed(),
+ * and then they're used to initialize another set of variables for each runCPU() iteration:
+ *
+ *      this.nCyclesNextYield:   this.nCyclesPerYield
+ */
+CPU8080.YIELDS_PER_SECOND       = 30;           // just a gut feeling for the MINIMUM number of yields per second
+CPU8080.YIELDS_PER_STATUS       = 15;           // every 15 yields (ie, twice per second), perform CPU status updates
+
+CPU8080.BUTTONS = ["power", "reset"];
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pc8080/lib/cpustate.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class CPUState8080 extends CPU8080 {
+    /**
+     * CPUState8080(parmsCPU)
+     *
+     * The CPUState8080 class uses the following (parmsCPU) properties:
+     *
+     *      model: a number (eg, 8080) that should match one of the CPUDef8080.MODEL_* values
+     *
+     * This extends the CPU class and passes any remaining parmsCPU properties to the CPU class
+     * constructor, along with a default speed (cycles per second) based on the specified (or default)
+     * CPU model number.
+     *
+     * The CPUState8080 class was initially written to simulate a 8080 microprocessor, although over time
+     * it may evolved to support other microprocessors (eg, the Zilog Z80).
+     *
+     * @this {CPUState8080}
+     * @param {Object} parmsCPU
+     */
+    constructor(parmsCPU)
+    {
+        var nCyclesDefault = 0;
+        var model = +parmsCPU['model'] || CPUDef8080.MODEL_8080;
+
+        switch(model) {
+        case CPUDef8080.MODEL_8080:
+        default:
+            nCyclesDefault = 1000000;
+            break;
+        }
+
+        super(parmsCPU, nCyclesDefault);
+
+        this.model = model;
+
+        /*
+         * Initialize processor operation to match the requested model
+         */
+        this.initProcessor();
+
+        /*
+         * A variety of stepCPU() state variables that don't strictly need to be initialized before the first
+         * stepCPU() call, but it's good form to do so.
+         */
+        this.resetCycles();
+        this.flags.complete = this.flags.debugCheck = false;
+
+        /*
+         * If there are no live registers to display, then updateStatus() can skip a bit....
+         */
+        this.cLiveRegs = 0;
+
+        /*
+         * Array of halt handlers, if any (see addHaltCheck)
+         */
+        this.afnHalt = [];
+        this.addrReset = 0x0000;
+
+        /*
+         * This initial resetRegs() call is important to create all the registers, so that if/when we call restore(),
+         * it will have something to fill in.
+         */
+        this.resetRegs();
+    }
+
+    /**
+     * addHaltCheck(fn)
+     *
+     * Records a function that will be called during HLT opcode processing.
+     *
+     * @this {CPUState8080}
+     * @param {function(number)} fn
+     */
+    addHaltCheck(fn)
+    {
+        this.afnHalt.push(fn);
+    }
+
+    /**
+     * initProcessor()
+     *
+     * Interestingly, if I dynamically generate aOps as an array of functions bound to "this", using the bind()
+     * method, overall performance is worse.  You would think that eliminating the need to use the call() method
+     * on every opcode function invocation would be helpful, but it's not.  I'm not sure exactly why yet; perhaps
+     * a Closure Compiler optimization is defeated when generating the function array at run-time instead of at
+     * compile-time.
+     *
+     * @this {CPUState8080}
+     */
+    initProcessor()
+    {
+        this.aOps = CPUDef8080.aOps8080;
+    }
+
+    /**
+     * reset()
+     *
+     * @this {CPUState8080}
+     */
+    reset()
+    {
+        if (this.flags.running) this.stopCPU();
+        this.resetRegs();
+        this.resetCycles();
+        this.clearError();      // clear any fatal error/exception that setError() may have flagged
+        super.reset();
+    }
+
+    /**
+     * resetRegs()
+     *
+     * @this {CPUState8080}
+     */
+    resetRegs()
+    {
+        this.regA = 0;
+        this.regB = 0;
+        this.regC = 0;
+        this.regD = 0;
+        this.regE = 0;
+        this.regH = 0;
+        this.regL = 0;
+        this.setSP(0);
+        this.setPC(this.addrReset);
+
+        /*
+         * This resets the Processor Status flags (regPS), along with all the internal "result registers".
+         */
+        this.setPS(0);
+
+        /*
+         * intFlags contains some internal states we use to indicate whether a hardware interrupt (INTFLAG.INTR) or
+         * Trap software interrupt (INTR.TRAP) has been requested, as well as when we're in a "HLT" state (INTFLAG.HALT)
+         * that requires us to wait for a hardware interrupt (INTFLAG.INTR) before continuing execution.
+         */
+        this.intFlags = CPUDef8080.INTFLAG.NONE;
+    }
+
+    /**
+     * setReset(addr)
+     *
+     * @this {CPUState8080}
+     * @param {number} addr
+     */
+    setReset(addr)
+    {
+        this.addrReset = addr;
+        this.setPC(addr);
+    }
+
+    /**
+     * getChecksum()
+     *
+     * @this {CPUState8080}
+     * @return {number} a 32-bit summation of key elements of the current CPU state (used by the CPU checksum code)
+     */
+    getChecksum()
+    {
+        var sum = (this.regA + this.regB + this.regC + this.regD + this.regE + this.regH + this.regL)|0;
+        sum = (sum + this.getSP() + this.getPC() + this.getPS())|0;
+        return sum;
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the CPUState8080 component.
+     *
+     * @this {CPUState8080}
+     * @return {Object|null}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, [this.regA, this.regB, this.regC, this.regD, this.regE, this.regH, this.regL, this.getSP(), this.getPC(), this.getPS()]);
+        state.set(1, [this.intFlags, this.nTotalCycles, this.getSpeed()]);
+        state.set(2, this.bus.saveMemory());
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the CPUState8080 component.
+     *
+     * @this {CPUState8080}
+     * @param {Object} data
+     * @return {boolean} true if restore successful, false if not
+     */
+    restore(data)
+    {
+        var a = data[0];
+        this.regA = a[0];
+        this.regB = a[1];
+        this.regC = a[2];
+        this.regD = a[3];
+        this.regE = a[4];
+        this.regH = a[5];
+        this.regL = a[6];
+        this.setSP(a[7]);
+        this.setPC(a[8]);
+        this.setPS(a[9]);
+        a = data[1];
+        this.intFlags = a[0];
+        this.nTotalCycles = a[1];
+        this.setSpeed(a[3]);
+        return this.bus.restoreMemory(data[2]);
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * @this {CPUState8080}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "AX")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        var fBound = false;
+        switch (sBinding) {
+        case "A":
+        case "B":
+        case "C":
+        case "BC":
+        case "D":
+        case "E":
+        case "DE":
+        case "H":
+        case "L":
+        case "HL":
+        case "SP":
+        case "PC":
+        case "PS":
+        case "IF":
+        case "SF":
+        case "ZF":
+        case "AF":
+        case "PF":
+        case "CF":
+            this.bindings[sBinding] = control;
+            this.cLiveRegs++;
+            fBound = true;
+            break;
+        default:
+            fBound = super.setBinding(sHTMLType, sBinding, control);
+            break;
+        }
+        return fBound;
+    }
+
+    /**
+     * getBC()
+     *
+     * @this {CPUState8080}
+     * @return {number}
+     */
+    getBC()
+    {
+        return (this.regB << 8) | this.regC;
+    }
+
+    /**
+     * setBC(w)
+     *
+     * @this {CPUState8080}
+     * @param {number} w
+     */
+    setBC(w)
+    {
+        this.regB = (w >> 8) & 0xff;
+        this.regC = w & 0xff;
+    }
+
+    /**
+     * getDE()
+     *
+     * @this {CPUState8080}
+     * @return {number}
+     */
+    getDE()
+    {
+        return (this.regD << 8) | this.regE;
+    }
+
+    /**
+     * setDE(w)
+     *
+     * @this {CPUState8080}
+     * @param {number} w
+     */
+    setDE(w)
+    {
+        this.regD = (w >> 8) & 0xff;
+        this.regE = w & 0xff;
+    }
+
+    /**
+     * getHL()
+     *
+     * @this {CPUState8080}
+     * @return {number}
+     */
+    getHL()
+    {
+        return (this.regH << 8) | this.regL;
+    }
+
+    /**
+     * setHL(w)
+     *
+     * @this {CPUState8080}
+     * @param {number} w
+     */
+    setHL(w)
+    {
+        this.regH = (w >> 8) & 0xff;
+        this.regL = w & 0xff;
+    }
+
+    /**
+     * getSP()
+     *
+     * @this {CPUState8080}
+     * @return {number}
+     */
+    getSP()
+    {
+        return this.regSP;
+    }
+
+    /**
+     * setSP(off)
+     *
+     * @this {CPUState8080}
+     * @param {number} off
+     */
+    setSP(off)
+    {
+        this.regSP = off & 0xffff;
+    }
+
+    /**
+     * getPC()
+     *
+     * @this {CPUState8080}
+     * @return {number}
+     */
+    getPC()
+    {
+        return this.regPC;
+    }
+
+    /**
+     * offPC()
+     *
+     * @this {CPUState8080}
+     * @param {number} off
+     * @return {number}
+     */
+    offPC(off)
+    {
+        return (this.regPC + off) & 0xffff;
+    }
+
+    /**
+     * setPC(off)
+     *
+     * @this {CPUState8080}
+     * @param {number} off
+     */
+    setPC(off)
+    {
+        this.regPC = off & 0xffff;
+    }
+
+    /**
+     * clearCF()
+     *
+     * @this {CPUState8080}
+     */
+    clearCF()
+    {
+        this.resultZeroCarry &= 0xff;
+    }
+
+    /**
+     * getCF()
+     *
+     * @this {CPUState8080}
+     * @return {number} 0 or 1 (CPUDef8080.PS.CF)
+     */
+    getCF()
+    {
+        return (this.resultZeroCarry & 0x100)? CPUDef8080.PS.CF : 0;
+    }
+
+    /**
+     * setCF()
+     *
+     * @this {CPUState8080}
+     */
+    setCF()
+    {
+        this.resultZeroCarry |= 0x100;
+    }
+
+    /**
+     * updateCF(CF)
+     *
+     * @this {CPUState8080}
+     * @param {number} CF (0x000 or 0x100)
+     */
+    updateCF(CF)
+    {
+        this.resultZeroCarry = (this.resultZeroCarry & 0xff) | CF;
+    }
+
+    /**
+     * clearPF()
+     *
+     * @this {CPUState8080}
+     */
+    clearPF()
+    {
+        if (this.getPF()) this.resultParitySign ^= 0x1;
+    }
+
+    /**
+     * getPF()
+     *
+     * @this {CPUState8080}
+     * @return {number} 0 or CPUDef8080.PS.PF
+     */
+    getPF()
+    {
+        return (CPUDef8080.PARITY[this.resultParitySign & 0xff])? CPUDef8080.PS.PF : 0;
+    }
+
+    /**
+     * setPF()
+     *
+     * @this {CPUState8080}
+     */
+    setPF()
+    {
+        if (!this.getPF()) this.resultParitySign ^= 0x1;
+    }
+
+    /**
+     * clearAF()
+     *
+     * @this {CPUState8080}
+     */
+    clearAF()
+    {
+        this.resultAuxOverflow = (this.resultParitySign & 0x10) | (this.resultAuxOverflow & ~0x10);
+    }
+
+    /**
+     * getAF()
+     *
+     * @this {CPUState8080}
+     * @return {number} 0 or CPUDef8080.PS.AF
+     */
+    getAF()
+    {
+        return ((this.resultParitySign ^ this.resultAuxOverflow) & 0x10)? CPUDef8080.PS.AF : 0;
+    }
+
+    /**
+     * setAF()
+     *
+     * @this {CPUState8080}
+     */
+    setAF()
+    {
+        this.resultAuxOverflow = (~this.resultParitySign & 0x10) | (this.resultAuxOverflow & ~0x10);
+    }
+
+    /**
+     * clearZF()
+     *
+     * @this {CPUState8080}
+     */
+    clearZF()
+    {
+        this.resultZeroCarry |= 0xff;
+    }
+
+    /**
+     * getZF()
+     *
+     * @this {CPUState8080}
+     * @return {number} 0 or CPUDef8080.PS.ZF
+     */
+    getZF()
+    {
+        return (this.resultZeroCarry & 0xff)? 0 : CPUDef8080.PS.ZF;
+    }
+
+    /**
+     * setZF()
+     *
+     * @this {CPUState8080}
+     */
+    setZF()
+    {
+        this.resultZeroCarry &= ~0xff;
+    }
+
+    /**
+     * clearSF()
+     *
+     * @this {CPUState8080}
+     */
+    clearSF()
+    {
+        if (this.getSF()) this.resultParitySign ^= 0xc0;
+    }
+
+    /**
+     * getSF()
+     *
+     * @this {CPUState8080}
+     * @return {number} 0 or CPUDef8080.PS.SF
+     */
+    getSF()
+    {
+        return (this.resultParitySign & 0x80)? CPUDef8080.PS.SF : 0;
+    }
+
+    /**
+     * setSF()
+     *
+     * @this {CPUState8080}
+     */
+    setSF()
+    {
+        if (!this.getSF()) this.resultParitySign ^= 0xc0;
+    }
+
+    /**
+     * clearIF()
+     *
+     * @this {CPUState8080}
+     */
+    clearIF()
+    {
+        this.regPS &= ~CPUDef8080.PS.IF;
+    }
+
+    /**
+     * getIF()
+     *
+     * @this {CPUState8080}
+     * @return {number} 0 or CPUDef8080.PS.IF
+     */
+    getIF()
+    {
+        return (this.regPS & CPUDef8080.PS.IF);
+    }
+
+    /**
+     * setIF()
+     *
+     * @this {CPUState8080}
+     */
+    setIF()
+    {
+        this.regPS |= CPUDef8080.PS.IF;
+    }
+
+    /**
+     * getPS()
+     *
+     * @this {CPUState8080}
+     * @return {number}
+     */
+    getPS()
+    {
+        return (this.regPS & ~CPUDef8080.PS.RESULT) | (this.getSF() | this.getZF() | this.getAF() | this.getPF() | this.getCF());
+    }
+
+    /**
+     * setPS(regPS)
+     *
+     * @this {CPUState8080}
+     * @param {number} regPS
+     */
+    setPS(regPS)
+    {
+        this.resultZeroCarry = this.resultParitySign = this.resultAuxOverflow = 0;
+        if (regPS & CPUDef8080.PS.CF) this.resultZeroCarry |= 0x100;
+        if (!(regPS & CPUDef8080.PS.PF)) this.resultParitySign |= 0x01;
+        if (regPS & CPUDef8080.PS.AF) this.resultAuxOverflow |= 0x10;
+        if (!(regPS & CPUDef8080.PS.ZF)) this.resultZeroCarry |= 0xff;
+        if (regPS & CPUDef8080.PS.SF) this.resultParitySign ^= 0xc0;
+        this.regPS = (this.regPS & ~(CPUDef8080.PS.RESULT | CPUDef8080.PS.INTERNAL)) | (regPS & CPUDef8080.PS.INTERNAL) | CPUDef8080.PS.SET;
+
+    }
+
+    /**
+     * getPSW()
+     *
+     * @this {CPUState8080}
+     * @return {number}
+     */
+    getPSW()
+    {
+        return (this.getPS() & CPUDef8080.PS.MASK) | (this.regA << 8);
+    }
+
+    /**
+     * setPSW(w)
+     *
+     * @this {CPUState8080}
+     * @param {number} w
+     */
+    setPSW(w)
+    {
+        this.setPS((w & CPUDef8080.PS.MASK) | (this.regPS & ~CPUDef8080.PS.MASK));
+        this.regA = w >> 8;
+    }
+
+    /**
+     * addByte(src)
+     *
+     * @this {CPUState8080}
+     * @param {number} src
+     * @return {number} regA + src
+     */
+    addByte(src)
+    {
+        this.resultAuxOverflow = this.regA ^ src;
+        return this.resultParitySign = (this.resultZeroCarry = this.regA + src) & 0xff;
+    }
+
+    /**
+     * addByteCarry(src)
+     *
+     * @this {CPUState8080}
+     * @param {number} src
+     * @return {number} regA + src + carry
+     */
+    addByteCarry(src)
+    {
+        this.resultAuxOverflow = this.regA ^ src;
+        return this.resultParitySign = (this.resultZeroCarry = this.regA + src + ((this.resultZeroCarry & 0x100)? 1 : 0)) & 0xff;
+    }
+
+    /**
+     * andByte(src)
+     *
+     * Ordinarily, one would expect the Auxiliary Carry flag (AF) to be clear after this operation,
+     * but apparently the 8080 will set AF if bit 3 in either operand is set.
+     *
+     * @this {CPUState8080}
+     * @param {number} src
+     * @return {number} regA & src
+     */
+    andByte(src)
+    {
+        this.resultZeroCarry = this.resultParitySign = this.resultAuxOverflow = this.regA & src;
+        if ((this.regA | src) & 0x8) this.resultAuxOverflow ^= 0x10;        // set AF by inverting bit 4 in resultAuxOverflow
+        return this.resultZeroCarry;
+    }
+
+    /**
+     * decByte(b)
+     *
+     * We perform this operation using 8-bit two's complement arithmetic, by negating and then adding
+     * the implied src of 1.  This appears to mimic how the 8080 manages the Auxiliary Carry flag (AF).
+     *
+     * @this {CPUState8080}
+     * @param {number} b
+     * @return {number}
+     */
+    decByte(b)
+    {
+        this.resultAuxOverflow = b ^ 0xff;
+        b = this.resultParitySign = (b + 0xff) & 0xff;
+        this.resultZeroCarry = (this.resultZeroCarry & ~0xff) | b;
+        return b;
+    }
+
+    /**
+     * incByte(b)
+     *
+     * @this {CPUState8080}
+     * @param {number} b
+     * @return {number}
+     */
+    incByte(b)
+    {
+        this.resultAuxOverflow = b;
+        b = this.resultParitySign = (b + 1) & 0xff;
+        this.resultZeroCarry = (this.resultZeroCarry & ~0xff) | b;
+        return b;
+    }
+
+    /**
+     * orByte(src)
+     *
+     * @this {CPUState8080}
+     * @param {number} src
+     * @return {number} regA | src
+     */
+    orByte(src)
+    {
+        return this.resultParitySign = this.resultZeroCarry = this.resultAuxOverflow = this.regA | src;
+    }
+
+    /**
+     * subByte(src)
+     *
+     * We perform this operation using 8-bit two's complement arithmetic, by inverting src, adding
+     * src + 1, and then inverting the resulting carry (resultZeroCarry ^ 0x100).  This appears to mimic
+     * how the 8080 manages the Auxiliary Carry flag (AF).
+     *
+     * This function is also used as a cmpByte() function; compare instructions simply ignore the
+     * return value.
+     *
+     * Example: A=66, SUI $10
+     *
+     * If we created the two's complement of 0x10 by negating it, there would just be one addition:
+     *
+     *      0110 0110   (0x66)
+     *    + 1111 0000   (0xF0)  (ie, -0x10)
+     *      ---------
+     *    1 0101 0110   (0x56)
+     *
+     * But in order to mimic the 8080's AF flag, we must perform the two's complement of src in two steps,
+     * inverting it before the add, and then incrementing after the add; eg:
+     *
+     *      0110 0110   (0x66)
+     *    + 1110 1111   (0xEF)  (ie, ~0x10)
+     *      ---------
+     *    1 0101 0101   (0x55)
+     *    + 0000 0001   (0x01)
+     *      ---------
+     *    1 0101 0110   (0x56)
+     *
+     * @this {CPUState8080}
+     * @param {number} src
+     * @return {number} regA - src
+     */
+    subByte(src)
+    {
+        src ^= 0xff;
+        this.resultAuxOverflow = this.regA ^ src;
+        return this.resultParitySign = (this.resultZeroCarry = (this.regA + src + 1) ^ 0x100) & 0xff;
+    }
+
+    /**
+     * subByteBorrow(src)
+     *
+     * We perform this operation using 8-bit two's complement arithmetic, using logic similar to subByte(),
+     * but changing the final increment to a conditional increment, because if the Carry flag (CF) is set, then
+     * we don't need to perform the increment at all.
+     *
+     * This mimics the behavior of subByte() when the Carry flag (CF) is clear, and hopefully also mimics how the
+     * 8080 manages the Auxiliary Carry flag (AF) when the Carry flag (CF) is set.
+     *
+     * @this {CPUState8080}
+     * @param {number} src
+     * @return {number} regA - src - carry
+     */
+    subByteBorrow(src)
+    {
+        src ^= 0xff;
+        this.resultAuxOverflow = this.regA ^ src;
+        return this.resultParitySign = (this.resultZeroCarry = (this.regA + src + ((this.resultZeroCarry & 0x100)? 0 : 1)) ^ 0x100) & 0xff;
+    }
+
+    /**
+     * xorByte(src)
+     *
+     * @this {CPUState8080}
+     * @param {number} src
+     * @return {number} regA ^ src
+     */
+    xorByte(src)
+    {
+        return this.resultParitySign = this.resultZeroCarry = this.resultAuxOverflow = this.regA ^ src;
+    }
+
+    /**
+     * getByte(addr)
+     *
+     * @this {CPUState8080}
+     * @param {number} addr is a linear address
+     * @return {number} byte (8-bit) value at that address
+     */
+    getByte(addr)
+    {
+        return this.bus.getByte(addr);
+    }
+
+    /**
+     * getWord(addr)
+     *
+     * @this {CPUState8080}
+     * @param {number} addr is a linear address
+     * @return {number} word (16-bit) value at that address
+     */
+    getWord(addr)
+    {
+        return this.bus.getShort(addr);
+    }
+
+    /**
+     * setByte(addr, b)
+     *
+     * @this {CPUState8080}
+     * @param {number} addr is a linear address
+     * @param {number} b is the byte (8-bit) value to write (which we truncate to 8 bits; required by opSTOSb)
+     */
+    setByte(addr, b)
+    {
+        this.bus.setByte(addr, b);
+    }
+
+    /**
+     * setWord(addr, w)
+     *
+     * @this {CPUState8080}
+     * @param {number} addr is a linear address
+     * @param {number} w is the word (16-bit) value to write (which we truncate to 16 bits to be safe)
+     */
+    setWord(addr, w)
+    {
+        this.bus.setShort(addr, w);
+    }
+
+    /**
+     * getPCByte()
+     *
+     * @this {CPUState8080}
+     * @return {number} byte at the current PC; PC advanced by 1
+     */
+    getPCByte()
+    {
+        var b = this.getByte(this.regPC);
+        this.setPC(this.regPC + 1);
+        return b;
+    }
+
+    /**
+     * getPCWord()
+     *
+     * @this {CPUState8080}
+     * @return {number} word at the current PC; PC advanced by 2
+     */
+    getPCWord()
+    {
+        var w = this.getWord(this.regPC);
+        this.setPC(this.regPC + 2);
+        return w;
+    }
+
+    /**
+     * popWord()
+     *
+     * @this {CPUState8080}
+     * @return {number} word popped from the current SP; SP increased by 2
+     */
+    popWord()
+    {
+        var w = this.getWord(this.regSP);
+        this.setSP(this.regSP + 2);
+        return w;
+    }
+
+    /**
+     * pushWord(w)
+     *
+     * @this {CPUState8080}
+     * @param {number} w is the word (16-bit) value to push at current SP; SP decreased by 2
+     */
+    pushWord(w)
+    {
+        this.setSP(this.regSP - 2);
+        this.setWord(this.regSP, w);
+    }
+
+    /**
+     * checkINTR()
+     *
+     * @this {CPUState8080}
+     * @return {boolean} true if execution may proceed, false if not
+     */
+    checkINTR()
+    {
+        /*
+         * If the Debugger is single-stepping, this.nStepCycles will always be zero, which we take
+         * advantage of here to avoid processing interrupts.  The Debugger will have to issue a "g"
+         * command (or "p" command on a call instruction) if you want interrupts to be processed.
+         */
+        if (this.nStepCycles) {
+            if ((this.intFlags & CPUDef8080.INTFLAG.INTR) && this.getIF()) {
+                for (var nLevel = 0; nLevel < 8; nLevel++) {
+                    if (this.intFlags & (1 << nLevel)) break;
+                }
+                this.clearINTR(nLevel);
+                this.clearIF();
+                this.intFlags &= ~CPUDef8080.INTFLAG.HALT;
+                this.aOps[CPUDef8080.OPCODE.RST0 | (nLevel << 3)].call(this);
+            }
+        }
+        if (this.intFlags & CPUDef8080.INTFLAG.HALT) {
+            /*
+             * As discussed in opHLT(), the CPU is never REALLY halted by a HLT instruction; instead, opHLT()
+             * calls requestHALT(), which sets INTFLAG.HALT and signals to stepCPU() that it's free to end the
+             * current burst AND that it should not execute any more instructions until checkINTR() indicates
+             * that a hardware interrupt has been requested.
+             */
+            this.endBurst();
+            return false;
+        }
+        return true;
+    }
+
+    /**
+     * clearINTR(nLevel)
+     *
+     * Clear the corresponding interrupt level.
+     *
+     * nLevel can either be a valid interrupt level (0-7), or -1 to clear all pending interrupts
+     * (eg, in the event of a system-wide reset).
+     *
+     * @this {CPUState8080}
+     * @param {number} nLevel (0-7, or -1 for all)
+     */
+    clearINTR(nLevel)
+    {
+        var bitsClear = nLevel < 0? 0xff : (1 << nLevel);
+        this.intFlags &= ~bitsClear;
+    }
+
+    /**
+     * requestHALT()
+     *
+     * @this {CPUState8080}
+     */
+    requestHALT()
+    {
+        this.intFlags |= CPUDef8080.INTFLAG.HALT;
+        this.endBurst();
+    }
+
+    /**
+     * requestINTR(nLevel)
+     *
+     * Request the corresponding interrupt level.
+     *
+     * Each interrupt level (0-7) has its own intFlags bit (0-7).  If the Interrupt Flag (IF) is also
+     * set, then we know that checkINTR() will want to issue the interrupt, so we end the current burst
+     * by setting nStepCycles to zero.  But before we do, we subtract nStepCycles from nBurstCycles,
+     * so that the calculation of how many cycles were actually executed on this burst is correct.
+     *
+     * @this {CPUState8080}
+     * @param {number} nLevel (0-7)
+     */
+    requestINTR(nLevel)
+    {
+        this.intFlags |= (1 << nLevel);
+        if (this.getIF()) {
+            this.endBurst();
+        }
+    }
+
+    /**
+     * updateReg(sReg, nValue, cch)
+     *
+     * This function helps updateStatus() by massaging the register names and values according to
+     * CPU type before passing the call to displayValue(); in the "old days", updateStatus() called
+     * displayValue() directly (although then it was called displayReg()).
+     *
+     * @this {CPUState8080}
+     * @param {string} sReg
+     * @param {number} nValue
+     * @param {number} [cch] (default is 2 hex digits)
+     */
+    updateReg(sReg, nValue, cch)
+    {
+        this.displayValue(sReg, nValue, cch || 2);
+    }
+
+    /**
+     * updateStatus(fForce)
+     *
+     * This provides periodic Control Panel updates (eg, a few times per second; see YIELDS_PER_STATUS).
+     * this is where we take care of any DOM updates (eg, register values) while the CPU is running.
+     *
+     * Any high-frequency updates should be performed in updateVideo(), which should avoid DOM updates,
+     * since updateVideo() can be called up to 60 times per second.
+     *
+     * @this {CPUState8080}
+     * @param {boolean} [fForce] (true will display registers even if the CPU is running and "live" registers are not enabled)
+     */
+    updateStatus(fForce)
+    {
+        if (this.cLiveRegs) {
+            if (fForce || !this.flags.running || this.flags.displayLiveRegs) {
+                this.updateReg("A", this.regA);
+                this.updateReg("B", this.regB);
+                this.updateReg("C", this.regC);
+                this.updateReg("BC", this.getBC(), 4);
+                this.updateReg("D", this.regD);
+                this.updateReg("E", this.regE);
+                this.updateReg("DE", this.getDE(), 4);
+                this.updateReg("H", this.regH);
+                this.updateReg("L", this.regL);
+                this.updateReg("HL", this.getHL(), 4);
+                this.updateReg("SP", this.getSP(), 4);
+                this.updateReg("PC", this.getPC(), 4);
+                var regPS = this.getPS();
+                this.updateReg("PS", regPS, 4);
+                this.updateReg("IF", (regPS & CPUDef8080.PS.IF)? 1 : 0, 1);
+                this.updateReg("SF", (regPS & CPUDef8080.PS.SF)? 1 : 0, 1);
+                this.updateReg("ZF", (regPS & CPUDef8080.PS.ZF)? 1 : 0, 1);
+                this.updateReg("AF", (regPS & CPUDef8080.PS.AF)? 1 : 0, 1);
+                this.updateReg("PF", (regPS & CPUDef8080.PS.PF)? 1 : 0, 1);
+                this.updateReg("CF", (regPS & CPUDef8080.PS.CF)? 1 : 0, 1);
+            }
+        }
+        var controlSpeed = this.bindings["speed"];
+        if (controlSpeed) controlSpeed.textContent = this.getSpeedCurrent();
+    }
+
+    /**
+     * stepCPU(nMinCycles)
+     *
+     * NOTE: Single-stepping should not be confused with the Trap flag; single-stepping is a Debugger
+     * operation that's completely independent of Trap status.  The CPU can go in and out of Trap mode,
+     * in and out of h/w interrupt service routines (ISRs), etc, but from the Debugger's perspective,
+     * they're all one continuous stream of instructions that can be stepped or run at will.  Moreover,
+     * stepping vs. running should never change the behavior of the simulation.
+     *
+     * @this {CPUState8080}
+     * @param {number} nMinCycles (0 implies a single-step, and therefore breakpoints should be ignored)
+     * @return {number} of cycles executed; 0 indicates a pre-execution condition (ie, an execution breakpoint
+     * was hit), -1 indicates a post-execution condition (eg, a read or write breakpoint was hit), and a positive
+     * number indicates successful completion of that many cycles (which should always be >= nMinCycles).
+     */
+    stepCPU(nMinCycles)
+    {
+        /*
+         * The Debugger uses fComplete to determine if the instruction completed (true) or was interrupted
+         * by a breakpoint or some other exceptional condition (false).  NOTE: this does NOT include JavaScript
+         * exceptions, which stepCPU() expects the caller to catch using its own exception handler.
+         *
+         * The CPU relies on the use of stopCPU() rather than fComplete, because the CPU never single-steps
+         * (ie, nMinCycles is always some large number), whereas the Debugger does.  And conversely, when the
+         * Debugger is single-stepping (even when performing multiple single-steps), fRunning is never set,
+         * so stopCPU() would have no effect as far as the Debugger is concerned.
+         */
+        this.flags.complete = true;
+
+        /*
+         * fDebugCheck is true if we need to "check" every instruction with the Debugger.
+         */
+        var fDebugCheck = this.flags.debugCheck = (DEBUGGER && this.dbg && this.dbg.checksEnabled());
+
+        /*
+         * nDebugState is checked only when fDebugCheck is true, and its sole purpose is to tell the first call
+         * to checkInstruction() that it can skip breakpoint checks, and that will be true ONLY when fStarting is
+         * true OR nMinCycles is zero (the latter means the Debugger is single-stepping).
+         *
+         * Once we snap fStarting, we clear it, because technically, we've moved beyond "starting" and have
+         * officially "started" now.
+         */
+        var nDebugState = (!nMinCycles)? -1 : (this.flags.starting? 0 : 1);
+        this.flags.starting = false;
+
+        /*
+         * We move the minimum cycle count to nStepCycles (the number of cycles left to step), so that other
+         * functions have the ability to force that number to zero (eg, stopCPU()), and thus we don't have to check
+         * any other criteria to determine whether we should continue stepping or not.
+         */
+        this.nBurstCycles = this.nStepCycles = nMinCycles;
+
+        /*
+         * NOTE: If checkINTR() returns false, INTFLAG.HALT must be set, so no instructions should be executed.
+         */
+        if (this.checkINTR()) {
+            do {
+                if (DEBUGGER && fDebugCheck) {
+                    if (this.dbg.checkInstruction(this.regPC, nDebugState)) {
+                        this.stopCPU();
+                        break;
+                    }
+                    nDebugState = 1;
+                }
+                this.aOps[this.getPCByte()].call(this);
+
+            } while (this.nStepCycles > 0);
+        }
+
+        return (this.flags.complete? this.nBurstCycles - this.nStepCycles : (this.flags.complete === undefined? 0 : -1));
+    }
+
+    /**
+     * CPUState8080.init()
+     *
+     * This function operates on every HTML element of class "cpu", extracting the
+     * JSON-encoded parameters for the CPUState8080 constructor from the element's "data-value"
+     * attribute, invoking the constructor (which in turn invokes the CPU constructor)
+     * to create a CPUState8080 component, and then binding any associated HTML controls to the
+     * new component.
+     */
+    static init()
+    {
+        var aeCPUs = Component.getElementsByClass(document, PC8080.APPCLASS, "cpu");
+        for (var iCPU = 0; iCPU < aeCPUs.length; iCPU++) {
+            var eCPU = aeCPUs[iCPU];
+            var parmsCPU = Component.getComponentParms(eCPU);
+            var cpu = new CPUState8080(parmsCPU);
+            Component.bindComponentControls(cpu, eCPU, PC8080.APPCLASS);
+        }
+    }
+}
+
+/*
+ * Initialize every CPU module on the page
+ */
+Web.onInit(CPUState8080.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pc8080/lib/cpuops.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * op=0x00 (NOP)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opNOP = function()
+{
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x01 (LXI B,d16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opLXIB = function()
+{
+    this.setBC(this.getPCWord());
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0x02 (STAX B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSTAXB = function()
+{
+    this.setByte(this.getBC(), this.regA);
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x03 (INX B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opINXB = function()
+{
+    this.setBC(this.getBC() + 1);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x04 (INR B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opINRB = function()
+{
+    this.regB = this.incByte(this.regB);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x05 (DCR B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opDCRB = function()
+{
+    this.regB = this.decByte(this.regB);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x06 (MVI B,d8)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMVIB = function()
+{
+    this.regB = this.getPCByte();
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x07 (RLC)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRLC = function()
+{
+    var carry = this.regA << 1;
+    this.regA = (carry & 0xff) | (carry >> 8);
+    this.updateCF(carry & 0x100);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x09 (DAD B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opDADB = function()
+{
+    var w;
+    this.setHL(w = this.getHL() + this.getBC());
+    this.updateCF((w >> 8) & 0x100);
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0x0A (LDAX B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opLDAXB = function()
+{
+    this.regA = this.getByte(this.getBC());
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x0B (DCX B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opDCXB = function()
+{
+    this.setBC(this.getBC() - 1);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x0C (INR C)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opINRC = function()
+{
+    this.regC = this.incByte(this.regC);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x0D (DCR C)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opDCRC = function()
+{
+    this.regC = this.decByte(this.regC);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x0E (MVI C,d8)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMVIC = function()
+{
+    this.regC = this.getPCByte();
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x0F (RRC)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRRC = function()
+{
+    var carry = (this.regA << 8) & 0x100;
+    this.regA = (carry | this.regA) >> 1;
+    this.updateCF(carry);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x11 (LXI D,d16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opLXID = function()
+{
+    this.setDE(this.getPCWord());
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0x12 (STAX D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSTAXD = function()
+{
+    this.setByte(this.getDE(), this.regA);
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x13 (INX D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opINXD = function()
+{
+    this.setDE(this.getDE() + 1);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x14 (INR D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opINRD = function()
+{
+    this.regD = this.incByte(this.regD);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x15 (DCR D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opDCRD = function()
+{
+    this.regD = this.decByte(this.regD);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x16 (MVI D,d8)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMVID = function()
+{
+    this.regD = this.getPCByte();
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x17 (RAL)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRAL = function()
+{
+    var carry = this.regA << 1;
+    this.regA = (carry & 0xff) | this.getCF();
+    this.updateCF(carry & 0x100);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x19 (DAD D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opDADD = function()
+{
+    var w;
+    this.setHL(w = this.getHL() + this.getDE());
+    this.updateCF((w >> 8) & 0x100);
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0x1A (LDAX D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opLDAXD = function()
+{
+    this.regA = this.getByte(this.getDE());
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x1B (DCX D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opDCXD = function()
+{
+    this.setDE(this.getDE() - 1);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x1C (INR E)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opINRE = function()
+{
+    this.regE = this.incByte(this.regE);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x1D (DCR E)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opDCRE = function()
+{
+    this.regE = this.decByte(this.regE);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x1E (MVI E,d8)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMVIE = function()
+{
+    this.regE = this.getPCByte();
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x1F (RAR)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRAR = function()
+{
+    var carry = (this.regA << 8);
+    this.regA = ((this.getCF() << 8) | this.regA) >> 1;
+    this.updateCF(carry & 0x100);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x21 (LXI H,d16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opLXIH = function()
+{
+    this.setHL(this.getPCWord());
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0x22 (SHLD a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSHLD = function()
+{
+    this.setWord(this.getPCWord(), this.getHL());
+    this.nStepCycles -= 16;
+};
+
+/**
+ * op=0x23 (INX H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opINXH = function()
+{
+    this.setHL(this.getHL() + 1);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x24 (INR H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opINRH = function()
+{
+    this.regH = this.incByte(this.regH);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x25 (DCR H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opDCRH = function()
+{
+    this.regH = this.decByte(this.regH);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x26 (MVI H,d8)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMVIH = function()
+{
+    this.regH = this.getPCByte();
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x27 (DAA)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opDAA = function()
+{
+    var src = 0;
+    var CF = this.getCF();
+    var AF = this.getAF();
+    if (AF || (this.regA & 0x0F) > 9) {
+        src |= 0x06;
+    }
+    if (CF || this.regA >= 0x9A) {
+        src |= 0x60;
+        CF = CPUDef8080.PS.CF;
+    }
+    this.regA = this.addByte(src);
+    this.updateCF(CF? 0x100 : 0);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x29 (DAD H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opDADH = function()
+{
+    var w;
+    this.setHL(w = this.getHL() + this.getHL());
+    this.updateCF((w >> 8) & 0x100);
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0x2A (LHLD a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opLHLD = function()
+{
+    this.setHL(this.getWord(this.getPCWord()));
+    this.nStepCycles -= 16;
+};
+
+/**
+ * op=0x2B (DCX H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opDCXH = function()
+{
+    this.setHL(this.getHL() - 1);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x2C (INR L)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opINRL = function()
+{
+    this.regL = this.incByte(this.regL);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x2D (DCR L)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opDCRL = function()
+{
+    this.regL = this.decByte(this.regL);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x2E (MVI L,d8)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMVIL = function()
+{
+    this.regL = this.getPCByte();
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x2F (CMA)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCMA = function()
+{
+    this.regA = ~this.regA & 0xff;
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x31 (LXI SP,d16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opLXISP = function()
+{
+    this.setSP(this.getPCWord());
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0x32 (STA a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSTA = function()
+{
+    this.setByte(this.getPCWord(), this.regA);
+    this.nStepCycles -= 13;
+};
+
+/**
+ * op=0x33 (INX SP)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opINXSP = function()
+{
+    this.setSP(this.getSP() + 1);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x34 (INR M)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opINRM = function()
+{
+    var addr = this.getHL();
+    this.setByte(addr, this.incByte(this.getByte(addr)));
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0x35 (DCR M)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opDCRM = function()
+{
+    var addr = this.getHL();
+    this.setByte(addr, this.decByte(this.getByte(addr)));
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0x36 (MVI M,d8)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMVIM = function()
+{
+    this.setByte(this.getHL(), this.getPCByte());
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0x37 (STC)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSTC = function()
+{
+    this.setCF();
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x39 (DAD SP)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opDADSP = function()
+{
+    var w;
+    this.setHL(w = this.getHL() + this.getSP());
+    this.updateCF((w >> 8) & 0x100);
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0x3A (LDA a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opLDA = function()
+{
+    this.regA = this.getByte(this.getPCWord());
+    this.nStepCycles -= 13;
+};
+
+/**
+ * op=0x3B (DCX SP)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opDCXSP = function()
+{
+    this.setSP(this.getSP() - 1);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x3C (INR A)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opINRA = function()
+{
+    this.regA = this.incByte(this.regA);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x3D (DCR A)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opDCRA = function()
+{
+    this.regA = this.decByte(this.regA);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x3E (MVI A,d8)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMVIA = function()
+{
+    this.regA = this.getPCByte();
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x3F (CMC)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCMC = function()
+{
+    this.updateCF(this.getCF()? 0 : 0x100);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x40 (MOV B,B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVBB = function()
+{
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x41 (MOV B,C)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVBC = function()
+{
+    this.regB = this.regC;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x42 (MOV B,D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVBD = function()
+{
+    this.regB = this.regD;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x43 (MOV B,E)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVBE = function()
+{
+    this.regB = this.regE;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x44 (MOV B,H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVBH = function()
+{
+    this.regB = this.regH;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x45 (MOV B,L)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVBL = function()
+{
+    this.regB = this.regL;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x46 (MOV B,M)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVBM = function()
+{
+    this.regB = this.getByte(this.getHL());
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x47 (MOV B,A)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVBA = function()
+{
+    this.regB = this.regA;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x48 (MOV C,B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVCB = function()
+{
+    this.regC = this.regB;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x49 (MOV C,C)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVCC = function()
+{
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x4A (MOV C,D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVCD = function()
+{
+    this.regC = this.regD;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x4B (MOV C,E)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVCE = function()
+{
+    this.regC = this.regE;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x4C (MOV C,H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVCH = function()
+{
+    this.regC = this.regH;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x4D (MOV C,L)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVCL = function()
+{
+    this.regC = this.regL;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x4E (MOV C,M)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVCM = function()
+{
+    this.regC = this.getByte(this.getHL());
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x4F (MOV C,A)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVCA = function()
+{
+    this.regC = this.regA;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x50 (MOV D,B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVDB = function()
+{
+    this.regD = this.regB;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x51 (MOV D,C)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVDC = function()
+{
+    this.regD = this.regC;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x52 (MOV D,D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVDD = function()
+{
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x53 (MOV D,E)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVDE = function()
+{
+    this.regD = this.regE;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x54 (MOV D,H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVDH = function()
+{
+    this.regD = this.regH;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x55 (MOV D,L)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVDL = function()
+{
+    this.regD = this.regL;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x56 (MOV D,M)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVDM = function()
+{
+    this.regD = this.getByte(this.getHL());
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x57 (MOV D,A)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVDA = function()
+{
+    this.regD = this.regA;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x58 (MOV E,B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVEB = function()
+{
+    this.regE = this.regB;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x59 (MOV E,C)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVEC = function()
+{
+    this.regE = this.regC;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x5A (MOV E,D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVED = function()
+{
+    this.regE = this.regD;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x5B (MOV E,E)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVEE = function()
+{
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x5C (MOV E,H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVEH = function()
+{
+    this.regE = this.regH;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x5D (MOV E,L)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVEL = function()
+{
+    this.regE = this.regL;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x5E (MOV E,M)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVEM = function()
+{
+    this.regE = this.getByte(this.getHL());
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x5F (MOV E,A)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVEA = function()
+{
+    this.regE = this.regA;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x60 (MOV H,B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVHB = function()
+{
+    this.regH = this.regB;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x61 (MOV H,C)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVHC = function()
+{
+    this.regH = this.regC;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x62 (MOV H,D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVHD = function()
+{
+    this.regH = this.regD;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x63 (MOV H,E)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVHE = function()
+{
+    this.regH = this.regE;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x64 (MOV H,H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVHH = function()
+{
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x65 (MOV H,L)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVHL = function()
+{
+    this.regH = this.regL;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x66 (MOV H,M)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVHM = function()
+{
+    this.regH = this.getByte(this.getHL());
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x67 (MOV H,A)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVHA = function()
+{
+    this.regH = this.regA;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x68 (MOV L,B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVLB = function()
+{
+    this.regL = this.regB;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x69 (MOV L,C)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVLC = function()
+{
+    this.regL = this.regC;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x6A (MOV L,D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVLD = function()
+{
+    this.regL = this.regD;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x6B (MOV L,E)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVLE = function()
+{
+    this.regL = this.regE;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x6C (MOV L,H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVLH = function()
+{
+    this.regL = this.regH;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x6D (MOV L,L)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVLL = function()
+{
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x6E (MOV L,M)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVLM = function()
+{
+    this.regL = this.getByte(this.getHL());
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x6F (MOV L,A)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVLA = function()
+{
+    this.regL = this.regA;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x70 (MOV M,B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVMB = function()
+{
+    this.setByte(this.getHL(), this.regB);
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x71 (MOV M,C)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVMC = function()
+{
+    this.setByte(this.getHL(), this.regC);
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x72 (MOV M,D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVMD = function()
+{
+    this.setByte(this.getHL(), this.regD);
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x73 (MOV M,E)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVME = function()
+{
+    this.setByte(this.getHL(), this.regE);
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x74 (MOV M,H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVMH = function()
+{
+    this.setByte(this.getHL(), this.regH);
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x75 (MOV M,L)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVML = function()
+{
+    this.setByte(this.getHL(), this.regL);
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x76 (HLT)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opHLT = function()
+{
+    var addr = this.getPC() - 1;
+
+    /*
+     * If any HLT check functions are installed, call them, and if any of them return true, then
+     * immediately stop HLT processing.
+     */
+    if (this.afnHalt.length) {
+        for (var i = 0; i < this.afnHalt.length; i++) {
+            if (this.afnHalt[i](addr)) return;
+        }
+    }
+
+    this.nStepCycles -= 7;
+
+    /*
+     * The CPU is never REALLY halted by a HLT instruction; instead, we call requestHALT(), which
+     * signals to stepCPU() that it should end the current burst AND that it should not execute any
+     * more instructions until checkINTR() indicates a hardware interrupt has been requested.
+     */
+    this.requestHALT();
+
+    /*
+     * If a Debugger is present and the HALT message category is enabled, then we REALLY halt the CPU,
+     * on the theory that whoever's using the Debugger would like to see HLTs.
+     */
+    if (DEBUGGER && this.dbg && this.messageEnabled(Messages8080.HALT)) {
+        this.setPC(addr);               // this is purely for the Debugger's benefit, to show the HLT
+        this.dbg.stopCPU();
+        return;
+    }
+
+    /*
+     * We also REALLY halt the machine if interrupts have been disabled, since that means it's dead
+     * in the water (we have no NMI generation mechanism at the moment).
+     */
+    if (!this.getIF()) {
+        if (DEBUGGER && this.dbg) this.setPC(addr);
+        this.stopCPU();
+    }
+};
+
+/**
+ * op=0x77 (MOV M,A)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVMA = function()
+{
+    this.setByte(this.getHL(), this.regA);
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x78 (MOV A,B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVAB = function()
+{
+    this.regA = this.regB;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x79 (MOV A,C)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVAC = function()
+{
+    this.regA = this.regC;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x7A (MOV A,D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVAD = function()
+{
+    this.regA = this.regD;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x7B (MOV A,E)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVAE = function()
+{
+    this.regA = this.regE;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x7C (MOV A,H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVAH = function()
+{
+    this.regA = this.regH;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x7D (MOV A,L)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVAL = function()
+{
+    this.regA = this.regL;
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x7E (MOV A,M)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVAM = function()
+{
+    this.regA = this.getByte(this.getHL());
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x7F (MOV A,A)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opMOVAA = function()
+{
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0x80 (ADD B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opADDB = function()
+{
+    this.regA = this.addByte(this.regB);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x81 (ADD C)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opADDC = function()
+{
+    this.regA = this.addByte(this.regC);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x82 (ADD D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opADDD = function()
+{
+    this.regA = this.addByte(this.regD);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x83 (ADD E)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opADDE = function()
+{
+    this.regA = this.addByte(this.regE);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x84 (ADD H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opADDH = function()
+{
+    this.regA = this.addByte(this.regH);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x85 (ADD L)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opADDL = function()
+{
+    this.regA = this.addByte(this.regL);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x86 (ADD M)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opADDM = function()
+{
+    this.regA = this.addByte(this.getByte(this.getHL()));
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x87 (ADD A)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opADDA = function()
+{
+    this.regA = this.addByte(this.regA);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x88 (ADC B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opADCB = function()
+{
+    this.regA = this.addByteCarry(this.regB);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x89 (ADC C)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opADCC = function()
+{
+    this.regA = this.addByteCarry(this.regC);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x8A (ADC D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opADCD = function()
+{
+    this.regA = this.addByteCarry(this.regD);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x8B (ADC E)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opADCE = function()
+{
+    this.regA = this.addByteCarry(this.regE);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x8C (ADC H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opADCH = function()
+{
+    this.regA = this.addByteCarry(this.regH);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x8D (ADC L)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opADCL = function()
+{
+    this.regA = this.addByteCarry(this.regL);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x8E (ADC M)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opADCM = function()
+{
+    this.regA = this.addByteCarry(this.getByte(this.getHL()));
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x8F (ADC A)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opADCA = function()
+{
+    this.regA = this.addByteCarry(this.regA);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x90 (SUB B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSUBB = function()
+{
+    this.regA = this.subByte(this.regB);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x91 (SUB C)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSUBC = function()
+{
+    this.regA = this.subByte(this.regC);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x92 (SUB D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSUBD = function()
+{
+    this.regA = this.subByte(this.regD);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x93 (SUB E)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSUBE = function()
+{
+    this.regA = this.subByte(this.regE);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x94 (SUB H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSUBH = function()
+{
+    this.regA = this.subByte(this.regH);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x95 (SUB L)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSUBL = function()
+{
+    this.regA = this.subByte(this.regL);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x96 (SUB M)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSUBM = function()
+{
+    this.regA = this.subByte(this.getByte(this.getHL()));
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x97 (SUB A)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSUBA = function()
+{
+    this.regA = this.subByte(this.regA);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x98 (SBB B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSBBB = function()
+{
+    this.regA = this.subByteBorrow(this.regB);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x99 (SBB C)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSBBC = function()
+{
+    this.regA = this.subByteBorrow(this.regC);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x9A (SBB D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSBBD = function()
+{
+    this.regA = this.subByteBorrow(this.regD);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x9B (SBB E)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSBBE = function()
+{
+    this.regA = this.subByteBorrow(this.regE);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x9C (SBB H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSBBH = function()
+{
+    this.regA = this.subByteBorrow(this.regH);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x9D (SBB L)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSBBL = function()
+{
+    this.regA = this.subByteBorrow(this.regL);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0x9E (SBB M)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSBBM = function()
+{
+    this.regA = this.subByteBorrow(this.getByte(this.getHL()));
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0x9F (SBB A)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSBBA = function()
+{
+    this.regA = this.subByteBorrow(this.regA);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xA0 (ANA B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opANAB = function()
+{
+    this.regA = this.andByte(this.regB);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xA1 (ANA C)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opANAC = function()
+{
+    this.regA = this.andByte(this.regC);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xA2 (ANA D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opANAD = function()
+{
+    this.regA = this.andByte(this.regD);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xA3 (ANA E)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opANAE = function()
+{
+    this.regA = this.andByte(this.regE);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xA4 (ANA H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opANAH = function()
+{
+    this.regA = this.andByte(this.regH);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xA5 (ANA L)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opANAL = function()
+{
+    this.regA = this.andByte(this.regL);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xA6 (ANA M)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opANAM = function()
+{
+    this.regA = this.andByte(this.getByte(this.getHL()));
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0xA7 (ANA A)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opANAA = function()
+{
+    this.regA = this.andByte(this.regA);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xA8 (XRA B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opXRAB = function()
+{
+    this.regA = this.xorByte(this.regB);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xA9 (XRA C)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opXRAC = function()
+{
+    this.regA = this.xorByte(this.regC);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xAA (XRA D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opXRAD = function()
+{
+    this.regA = this.xorByte(this.regD);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xAB (XRA E)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opXRAE = function()
+{
+    this.regA = this.xorByte(this.regE);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xAC (XRA H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opXRAH = function()
+{
+    this.regA = this.xorByte(this.regH);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xAD (XRA L)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opXRAL = function()
+{
+    this.regA = this.xorByte(this.regL);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xAE (XRA M)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opXRAM = function()
+{
+    this.regA = this.xorByte(this.getByte(this.getHL()));
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0xAF (XRA A)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opXRAA = function()
+{
+    this.regA = this.xorByte(this.regA);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xB0 (ORA B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opORAB = function()
+{
+    this.regA = this.orByte(this.regB);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xB1 (ORA C)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opORAC = function()
+{
+    this.regA = this.orByte(this.regC);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xB2 (ORA D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opORAD = function()
+{
+    this.regA = this.orByte(this.regD);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xB3 (ORA E)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opORAE = function()
+{
+    this.regA = this.orByte(this.regE);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xB4 (ORA H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opORAH = function()
+{
+    this.regA = this.orByte(this.regH);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xB5 (ORA L)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opORAL = function()
+{
+    this.regA = this.orByte(this.regL);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xB6 (ORA M)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opORAM = function()
+{
+    this.regA = this.orByte(this.getByte(this.getHL()));
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0xB7 (ORA A)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opORAA = function()
+{
+    this.regA = this.orByte(this.regA);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xB8 (CMP B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCMPB = function()
+{
+    this.subByte(this.regB);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xB9 (CMP C)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCMPC = function()
+{
+    this.subByte(this.regC);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xBA (CMP D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCMPD = function()
+{
+    this.subByte(this.regD);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xBB (CMP E)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCMPE = function()
+{
+    this.subByte(this.regE);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xBC (CMP H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCMPH = function()
+{
+    this.subByte(this.regH);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xBD (CMP L)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCMPL = function()
+{
+    this.subByte(this.regL);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xBE (CMP M)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCMPM = function()
+{
+    this.subByte(this.getByte(this.getHL()));
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0xBF (CMP A)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCMPA = function()
+{
+    this.subByte(this.regA);
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xC0 (RNZ)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRNZ = function()
+{
+    if (!this.getZF()) {
+        this.setPC(this.popWord());
+        this.nStepCycles -= 6;
+    }
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0xC1 (POP B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opPOPB = function()
+{
+    this.setBC(this.popWord());
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0xC2 (JNZ a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opJNZ = function()
+{
+    var w = this.getPCWord();
+    if (!this.getZF()) this.setPC(w);
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0xC3 (JMP a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opJMP = function()
+{
+    this.setPC(this.getPCWord());
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0xC4 (CNZ a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCNZ = function()
+{
+    var w = this.getPCWord();
+    if (!this.getZF()) {
+        this.pushWord(this.getPC());
+        this.setPC(w);
+        this.nStepCycles -= 6;
+    }
+    this.nStepCycles -= 11;
+};
+
+/**
+ * op=0xC5 (PUSH B)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opPUSHB = function()
+{
+    this.pushWord(this.getBC());
+    this.nStepCycles -= 11;
+};
+
+/**
+ * op=0xC6 (ADI d8)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opADI = function()
+{
+    this.regA = this.addByte(this.getPCByte());
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0xC7 (RST 0)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRST0 = function()
+{
+    this.pushWord(this.getPC());
+    this.setPC(0);
+    this.nStepCycles -= 11;
+};
+
+/**
+ * op=0xC8 (RZ)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRZ = function()
+{
+    if (this.getZF()) {
+        this.setPC(this.popWord());
+        this.nStepCycles -= 6;
+    }
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0xC9 (RET)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRET = function()
+{
+    this.setPC(this.popWord());
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0xCA (JZ a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opJZ = function()
+{
+    var w = this.getPCWord();
+    if (this.getZF()) this.setPC(w);
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0xCC (CZ a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCZ = function()
+{
+    var w = this.getPCWord();
+    if (this.getZF()) {
+        this.pushWord(this.getPC());
+        this.setPC(w);
+        this.nStepCycles -= 6;
+    }
+    this.nStepCycles -= 11;
+};
+
+/**
+ * op=0xCD (CALL a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCALL = function()
+{
+    var w = this.getPCWord();
+    this.pushWord(this.getPC());
+    this.setPC(w);
+    this.nStepCycles -= 17;
+};
+
+/**
+ * op=0xCE (ACI d8)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opACI = function()
+{
+    this.regA = this.addByteCarry(this.getPCByte());
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0xCF (RST 1)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRST1 = function()
+{
+    this.pushWord(this.getPC());
+    this.setPC(0x08);
+    this.nStepCycles -= 11;
+};
+
+/**
+ * op=0xD0 (RNC)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRNC = function()
+{
+    if (!this.getCF()) {
+        this.setPC(this.popWord());
+        this.nStepCycles -= 6;
+    }
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0xD1 (POP D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opPOPD = function()
+{
+    this.setDE(this.popWord());
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0xD2 (JNC a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opJNC = function()
+{
+    var w = this.getPCWord();
+    if (!this.getCF()) this.setPC(w);
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0xD3 (OUT d8)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opOUT = function()
+{
+    var port = this.getPCByte();
+    this.bus.checkPortOutputNotify(port, 1, this.regA, this.offPC(-2));
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0xD4 (CNC a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCNC = function()
+{
+    var w = this.getPCWord();
+    if (!this.getCF()) {
+        this.pushWord(this.getPC());
+        this.setPC(w);
+        this.nStepCycles -= 6;
+    }
+    this.nStepCycles -= 11;
+};
+
+/**
+ * op=0xD5 (PUSH D)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opPUSHD = function()
+{
+    this.pushWord(this.getDE());
+    this.nStepCycles -= 11;
+};
+
+/**
+ * op=0xD6 (SUI d8)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSUI = function()
+{
+    this.regA = this.subByte(this.getPCByte());
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0xD7 (RST 2)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRST2 = function()
+{
+    this.pushWord(this.getPC());
+    this.setPC(0x10);
+    this.nStepCycles -= 11;
+};
+
+/**
+ * op=0xD8 (RC)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRC = function()
+{
+    if (this.getCF()) {
+        this.setPC(this.popWord());
+        this.nStepCycles -= 6;
+    }
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0xDA (JC a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opJC = function()
+{
+    var w = this.getPCWord();
+    if (this.getCF()) this.setPC(w);
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0xDB (IN d8)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opIN = function()
+{
+    var port = this.getPCByte();
+    this.regA = this.bus.checkPortInputNotify(port, 1, this.offPC(-2)) & 0xff;
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0xDC (CC a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCC = function()
+{
+    var w = this.getPCWord();
+    if (this.getCF()) {
+        this.pushWord(this.getPC());
+        this.setPC(w);
+        this.nStepCycles -= 6;
+    }
+    this.nStepCycles -= 11;
+};
+
+/**
+ * op=0xDE (SBI d8)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSBI = function()
+{
+    this.regA = this.subByteBorrow(this.getPCByte());
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0xDF (RST 3)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRST3 = function()
+{
+    this.pushWord(this.getPC());
+    this.setPC(0x18);
+    this.nStepCycles -= 11;
+};
+
+/**
+ * op=0xE0 (RPO)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRPO = function()
+{
+    if (!this.getPF()) {
+        this.setPC(this.popWord());
+        this.nStepCycles -= 6;
+    }
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0xE1 (POP H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opPOPH = function()
+{
+    this.setHL(this.popWord());
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0xE2 (JPO a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opJPO = function()
+{
+    var w = this.getPCWord();
+    if (!this.getPF()) this.setPC(w);
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0xE3 (XTHL)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opXTHL = function()
+{
+    var w = this.popWord();
+    this.pushWord(this.getHL());
+    this.setHL(w);
+    this.nStepCycles -= 18;
+};
+
+/**
+ * op=0xE4 (CPO a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCPO = function()
+{
+    var w = this.getPCWord();
+    if (!this.getPF()) {
+        this.pushWord(this.getPC());
+        this.setPC(w);
+        this.nStepCycles -= 6;
+    }
+    this.nStepCycles -= 11;
+};
+
+/**
+ * op=0xE5 (PUSH H)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opPUSHH = function()
+{
+    this.pushWord(this.getHL());
+    this.nStepCycles -= 11;
+};
+
+/**
+ * op=0xE6 (ANI d8)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opANI = function()
+{
+    this.regA = this.andByte(this.getPCByte());
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0xE7 (RST 4)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRST4 = function()
+{
+    this.pushWord(this.getPC());
+    this.setPC(0x20);
+    this.nStepCycles -= 11;
+};
+
+/**
+ * op=0xE8 (RPE)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRPE = function()
+{
+    if (this.getPF()) {
+        this.setPC(this.popWord());
+        this.nStepCycles -= 6;
+    }
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0xE9 (PCHL)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opPCHL = function()
+{
+    this.setPC(this.getHL());
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0xEA (JPE a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opJPE = function()
+{
+    var w = this.getPCWord();
+    if (this.getPF()) this.setPC(w);
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0xEB (XCHG)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opXCHG = function()
+{
+    var w = this.getHL();
+    this.setHL(this.getDE());
+    this.setDE(w);
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0xEC (CPE a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCPE = function()
+{
+    var w = this.getPCWord();
+    if (this.getPF()) {
+        this.pushWord(this.getPC());
+        this.setPC(w);
+        this.nStepCycles -= 6;
+    }
+    this.nStepCycles -= 11;
+};
+
+/**
+ * op=0xEE (XRI d8)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opXRI = function()
+{
+    this.regA = this.xorByte(this.getPCByte());
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0xEF (RST 5)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRST5 = function()
+{
+    this.pushWord(this.getPC());
+    this.setPC(0x28);
+    this.nStepCycles -= 11;
+};
+
+/**
+ * op=0xF0 (RP)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRP = function()
+{
+    if (!this.getSF()) {
+        this.setPC(this.popWord());
+        this.nStepCycles -= 6;
+    }
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0xF1 (POP PSW)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opPOPSW = function()
+{
+    this.setPSW(this.popWord());
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0xF2 (JP a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opJP = function()
+{
+    var w = this.getPCWord();
+    if (!this.getSF()) this.setPC(w);
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0xF3 (DI)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opDI = function()
+{
+    this.clearIF();
+    this.nStepCycles -= 4;
+};
+
+/**
+ * op=0xF4 (CP a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCP = function()
+{
+    var w = this.getPCWord();
+    if (!this.getSF()) {
+        this.pushWord(this.getPC());
+        this.setPC(w);
+        this.nStepCycles -= 6;
+    }
+    this.nStepCycles -= 11;
+};
+
+/**
+ * op=0xF5 (PUSH PSW)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opPUPSW = function()
+{
+    this.pushWord(this.getPSW());
+    this.nStepCycles -= 11;
+};
+
+/**
+ * op=0xF6 (ORI d8)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opORI = function()
+{
+    this.regA = this.orByte(this.getPCByte());
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0xF7 (RST 6)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRST6 = function()
+{
+    this.pushWord(this.getPC());
+    this.setPC(0x30);
+    this.nStepCycles -= 11;
+};
+
+/**
+ * op=0xF8 (RM)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRM = function()
+{
+    if (this.getSF()) {
+        this.setPC(this.popWord());
+        this.nStepCycles -= 6;
+    }
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0xF9 (SPHL)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opSPHL = function()
+{
+    this.setSP(this.getHL());
+    this.nStepCycles -= 5;
+};
+
+/**
+ * op=0xFA (JM a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opJM = function()
+{
+    var w = this.getPCWord();
+    if (this.getSF()) this.setPC(w);
+    this.nStepCycles -= 10;
+};
+
+/**
+ * op=0xFB (EI)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opEI = function()
+{
+    this.setIF();
+    this.nStepCycles -= 4;
+    this.checkINTR();
+};
+
+/**
+ * op=0xFC (CM a16)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCM = function()
+{
+    var w = this.getPCWord();
+    if (this.getSF()) {
+        this.pushWord(this.getPC());
+        this.setPC(w);
+        this.nStepCycles -= 6;
+    }
+    this.nStepCycles -= 11;
+};
+
+/**
+ * op=0xFE (CPI d8)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opCPI = function()
+{
+    this.subByte(this.getPCByte());
+    this.nStepCycles -= 7;
+};
+
+/**
+ * op=0xFF (RST 7)
+ *
+ * @this {CPUState8080}
+ */
+CPUDef8080.opRST7 = function()
+{
+    this.pushWord(this.getPC());
+    this.setPC(0x38);
+    this.nStepCycles -= 11;
+};
+
+/*
+ * This 256-entry array of opcode functions is at the heart of the CPU engine: stepCPU(n).
+ *
+ * It might be worth trying a switch() statement instead, to see how the performance compares,
+ * but I suspect that would vary quite a bit across JavaScript engines; for now, I'm putting my
+ * money on array lookup.
+ */
+CPUDef8080.aOps8080 = [
+    /* 0x00-0x03 */ CPUDef8080.opNOP,   CPUDef8080.opLXIB,  CPUDef8080.opSTAXB, CPUDef8080.opINXB,
+    /* 0x04-0x07 */ CPUDef8080.opINRB,  CPUDef8080.opDCRB,  CPUDef8080.opMVIB,  CPUDef8080.opRLC,
+    /* 0x08-0x0B */ CPUDef8080.opNOP,   CPUDef8080.opDADB,  CPUDef8080.opLDAXB, CPUDef8080.opDCXB,
+    /* 0x0C-0x0F */ CPUDef8080.opINRC,  CPUDef8080.opDCRC,  CPUDef8080.opMVIC,  CPUDef8080.opRRC,
+    /* 0x10-0x13 */ CPUDef8080.opNOP,   CPUDef8080.opLXID,  CPUDef8080.opSTAXD, CPUDef8080.opINXD,
+    /* 0x14-0x17 */ CPUDef8080.opINRD,  CPUDef8080.opDCRD,  CPUDef8080.opMVID,  CPUDef8080.opRAL,
+    /* 0x18-0x1B */ CPUDef8080.opNOP,   CPUDef8080.opDADD,  CPUDef8080.opLDAXD, CPUDef8080.opDCXD,
+    /* 0x1C-0x1F */ CPUDef8080.opINRE,  CPUDef8080.opDCRE,  CPUDef8080.opMVIE,  CPUDef8080.opRAR,
+    /* 0x20-0x23 */ CPUDef8080.opNOP,   CPUDef8080.opLXIH,  CPUDef8080.opSHLD,  CPUDef8080.opINXH,
+    /* 0x24-0x27 */ CPUDef8080.opINRH,  CPUDef8080.opDCRH,  CPUDef8080.opMVIH,  CPUDef8080.opDAA,
+    /* 0x28-0x2B */ CPUDef8080.opNOP,   CPUDef8080.opDADH,  CPUDef8080.opLHLD,  CPUDef8080.opDCXH,
+    /* 0x2C-0x2F */ CPUDef8080.opINRL,  CPUDef8080.opDCRL,  CPUDef8080.opMVIL,  CPUDef8080.opCMA,
+    /* 0x30-0x33 */ CPUDef8080.opNOP,   CPUDef8080.opLXISP, CPUDef8080.opSTA,   CPUDef8080.opINXSP,
+    /* 0x34-0x37 */ CPUDef8080.opINRM,  CPUDef8080.opDCRM,  CPUDef8080.opMVIM,  CPUDef8080.opSTC,
+    /* 0x38-0x3B */ CPUDef8080.opNOP,   CPUDef8080.opDADSP, CPUDef8080.opLDA,   CPUDef8080.opDCXSP,
+    /* 0x3C-0x3F */ CPUDef8080.opINRA,  CPUDef8080.opDCRA,  CPUDef8080.opMVIA,  CPUDef8080.opCMC,
+    /* 0x40-0x43 */ CPUDef8080.opMOVBB, CPUDef8080.opMOVBC, CPUDef8080.opMOVBD, CPUDef8080.opMOVBE,
+    /* 0x44-0x47 */ CPUDef8080.opMOVBH, CPUDef8080.opMOVBL, CPUDef8080.opMOVBM, CPUDef8080.opMOVBA,
+    /* 0x48-0x4B */ CPUDef8080.opMOVCB, CPUDef8080.opMOVCC, CPUDef8080.opMOVCD, CPUDef8080.opMOVCE,
+    /* 0x4C-0x4F */ CPUDef8080.opMOVCH, CPUDef8080.opMOVCL, CPUDef8080.opMOVCM, CPUDef8080.opMOVCA,
+    /* 0x50-0x53 */ CPUDef8080.opMOVDB, CPUDef8080.opMOVDC, CPUDef8080.opMOVDD, CPUDef8080.opMOVDE,
+    /* 0x54-0x57 */ CPUDef8080.opMOVDH, CPUDef8080.opMOVDL, CPUDef8080.opMOVDM, CPUDef8080.opMOVDA,
+    /* 0x58-0x5B */ CPUDef8080.opMOVEB, CPUDef8080.opMOVEC, CPUDef8080.opMOVED, CPUDef8080.opMOVEE,
+    /* 0x5C-0x5F */ CPUDef8080.opMOVEH, CPUDef8080.opMOVEL, CPUDef8080.opMOVEM, CPUDef8080.opMOVEA,
+    /* 0x60-0x63 */ CPUDef8080.opMOVHB, CPUDef8080.opMOVHC, CPUDef8080.opMOVHD, CPUDef8080.opMOVHE,
+    /* 0x64-0x67 */ CPUDef8080.opMOVHH, CPUDef8080.opMOVHL, CPUDef8080.opMOVHM, CPUDef8080.opMOVHA,
+    /* 0x68-0x6B */ CPUDef8080.opMOVLB, CPUDef8080.opMOVLC, CPUDef8080.opMOVLD, CPUDef8080.opMOVLE,
+    /* 0x6C-0x6F */ CPUDef8080.opMOVLH, CPUDef8080.opMOVLL, CPUDef8080.opMOVLM, CPUDef8080.opMOVLA,
+    /* 0x70-0x73 */ CPUDef8080.opMOVMB, CPUDef8080.opMOVMC, CPUDef8080.opMOVMD, CPUDef8080.opMOVME,
+    /* 0x74-0x77 */ CPUDef8080.opMOVMH, CPUDef8080.opMOVML, CPUDef8080.opHLT,   CPUDef8080.opMOVMA,
+    /* 0x78-0x7B */ CPUDef8080.opMOVAB, CPUDef8080.opMOVAC, CPUDef8080.opMOVAD, CPUDef8080.opMOVAE,
+    /* 0x7C-0x7F */ CPUDef8080.opMOVAH, CPUDef8080.opMOVAL, CPUDef8080.opMOVAM, CPUDef8080.opMOVAA,
+    /* 0x80-0x83 */ CPUDef8080.opADDB,  CPUDef8080.opADDC,  CPUDef8080.opADDD,  CPUDef8080.opADDE,
+    /* 0x84-0x87 */ CPUDef8080.opADDH,  CPUDef8080.opADDL,  CPUDef8080.opADDM,  CPUDef8080.opADDA,
+    /* 0x88-0x8B */ CPUDef8080.opADCB,  CPUDef8080.opADCC,  CPUDef8080.opADCD,  CPUDef8080.opADCE,
+    /* 0x8C-0x8F */ CPUDef8080.opADCH,  CPUDef8080.opADCL,  CPUDef8080.opADCM,  CPUDef8080.opADCA,
+    /* 0x90-0x93 */ CPUDef8080.opSUBB,  CPUDef8080.opSUBC,  CPUDef8080.opSUBD,  CPUDef8080.opSUBE,
+    /* 0x94-0x97 */ CPUDef8080.opSUBH,  CPUDef8080.opSUBL,  CPUDef8080.opSUBM,  CPUDef8080.opSUBA,
+    /* 0x98-0x9B */ CPUDef8080.opSBBB,  CPUDef8080.opSBBC,  CPUDef8080.opSBBD,  CPUDef8080.opSBBE,
+    /* 0x9C-0x9F */ CPUDef8080.opSBBH,  CPUDef8080.opSBBL,  CPUDef8080.opSBBM,  CPUDef8080.opSBBA,
+    /* 0xA0-0xA3 */ CPUDef8080.opANAB,  CPUDef8080.opANAC,  CPUDef8080.opANAD,  CPUDef8080.opANAE,
+    /* 0xA4-0xA7 */ CPUDef8080.opANAH,  CPUDef8080.opANAL,  CPUDef8080.opANAM,  CPUDef8080.opANAA,
+    /* 0xA8-0xAB */ CPUDef8080.opXRAB,  CPUDef8080.opXRAC,  CPUDef8080.opXRAD,  CPUDef8080.opXRAE,
+    /* 0xAC-0xAF */ CPUDef8080.opXRAH,  CPUDef8080.opXRAL,  CPUDef8080.opXRAM,  CPUDef8080.opXRAA,
+    /* 0xB0-0xB3 */ CPUDef8080.opORAB,  CPUDef8080.opORAC,  CPUDef8080.opORAD,  CPUDef8080.opORAE,
+    /* 0xB4-0xB7 */ CPUDef8080.opORAH,  CPUDef8080.opORAL,  CPUDef8080.opORAM,  CPUDef8080.opORAA,
+    /* 0xB8-0xBB */ CPUDef8080.opCMPB,  CPUDef8080.opCMPC,  CPUDef8080.opCMPD,  CPUDef8080.opCMPE,
+    /* 0xBC-0xBF */ CPUDef8080.opCMPH,  CPUDef8080.opCMPL,  CPUDef8080.opCMPM,  CPUDef8080.opCMPA,
+    /* 0xC0-0xC3 */ CPUDef8080.opRNZ,   CPUDef8080.opPOPB,  CPUDef8080.opJNZ,   CPUDef8080.opJMP,
+    /* 0xC4-0xC7 */ CPUDef8080.opCNZ,   CPUDef8080.opPUSHB, CPUDef8080.opADI,   CPUDef8080.opRST0,
+    /* 0xC8-0xCB */ CPUDef8080.opRZ,    CPUDef8080.opRET,   CPUDef8080.opJZ,    CPUDef8080.opJMP,
+    /* 0xCC-0xCF */ CPUDef8080.opCZ,    CPUDef8080.opCALL,  CPUDef8080.opACI,   CPUDef8080.opRST1,
+    /* 0xD0-0xD3 */ CPUDef8080.opRNC,   CPUDef8080.opPOPD,  CPUDef8080.opJNC,   CPUDef8080.opOUT,
+    /* 0xD4-0xD7 */ CPUDef8080.opCNC,   CPUDef8080.opPUSHD, CPUDef8080.opSUI,   CPUDef8080.opRST2,
+    /* 0xD8-0xDB */ CPUDef8080.opRC,    CPUDef8080.opRET,   CPUDef8080.opJC,    CPUDef8080.opIN,
+    /* 0xDC-0xDF */ CPUDef8080.opCC,    CPUDef8080.opCALL,  CPUDef8080.opSBI,   CPUDef8080.opRST3,
+    /* 0xE0-0xE3 */ CPUDef8080.opRPO,   CPUDef8080.opPOPH,  CPUDef8080.opJPO,   CPUDef8080.opXTHL,
+    /* 0xE4-0xE7 */ CPUDef8080.opCPO,   CPUDef8080.opPUSHH, CPUDef8080.opANI,   CPUDef8080.opRST4,
+    /* 0xE8-0xEB */ CPUDef8080.opRPE,   CPUDef8080.opPCHL,  CPUDef8080.opJPE,   CPUDef8080.opXCHG,
+    /* 0xEC-0xEF */ CPUDef8080.opCPE,   CPUDef8080.opCALL,  CPUDef8080.opXRI,   CPUDef8080.opRST5,
+    /* 0xF0-0xF3 */ CPUDef8080.opRP,    CPUDef8080.opPOPSW, CPUDef8080.opJP,    CPUDef8080.opDI,
+    /* 0xF4-0xF7 */ CPUDef8080.opCP,    CPUDef8080.opPUPSW, CPUDef8080.opORI,   CPUDef8080.opRST6,
+    /* 0xF8-0xFB */ CPUDef8080.opRM,    CPUDef8080.opSPHL,  CPUDef8080.opJM,    CPUDef8080.opEI,
+    /* 0xFC-0xFF */ CPUDef8080.opCM,    CPUDef8080.opCALL,  CPUDef8080.opCPI,   CPUDef8080.opRST7
+];
+
+/**
+ * @copyright http://pcjs.org/modules/pc8080/lib/chipset.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class ChipSet8080 extends Component {
+    /**
+     * ChipSet8080(parmsChipSet)
+     *
+     * The ChipSet8080 component has the following component-specific (parmsChipSet) properties:
+     *
+     *      model:  eg, "SI1978" (should be a member of ChipSet8080.MODELS)
+     *      swDIP:  eg, "00000000", where swDIP[0] is DIP0, swDIP[1] is DIP1, etc.
+     *
+     * @this {ChipSet8080}
+     * @param {Object} parmsChipSet
+     */
+    constructor(parmsChipSet)
+    {
+        super("ChipSet", parmsChipSet, Messages8080.CHIPSET);
+
+        var model = parmsChipSet['model'];
+
+        if (model && !ChipSet8080.MODELS[model]) {
+            Component.notice("Unrecognized ChipSet model: " + model);
+        }
+
+        this.config = ChipSet8080.MODELS[model] || {};
+
+        this.bSwitches = this.parseDIPSwitches(parmsChipSet['swDIP']);
+
+        /*
+         * Here, I'm finally getting around to trying the Web Audio API.  Fortunately, based on what little I know about
+         * sound generation, using the API to make the same noises as the IBM PC speaker seems straightforward.
+         *
+         * To start, we create an audio context, unless the 'sound' parameter has been explicitly set to false.
+         *
+         * From:
+         *
+         *      http://developer.apple.com/library/safari/#documentation/AudioVideo/Conceptual/Using_HTML5_Audio_Video/PlayingandSynthesizingSounds/PlayingandSynthesizingSounds.html
+         *
+         * "Similar to how HTML5 canvas requires a context on which lines and curves are drawn, Web Audio requires an audio context
+         *  on which sounds are played and manipulated. This context will be the parent object of further audio objects to come....
+         *  Your audio context is typically created when your page initializes and should be long-lived. You can play multiple sounds
+         *  coming from multiple sources within the same context, so it is unnecessary to create more than one audio context per page."
+         */
+        this.fSpeaker = false;
+        if (parmsChipSet['sound']) {
+            this.classAudio = this.contextAudio = null;
+            if (window) {
+                this.classAudio = window['AudioContext'] || window['webkitAudioContext'];
+            }
+            if (this.classAudio) {
+                this.contextAudio = new this.classAudio();
+            } else {
+                if (DEBUG) this.log("AudioContext not available");
+            }
+        }
+
+        this.setReady();
+    }
+
+    /**
+     * parseDIPSwitches(sBits, bDefault)
+     *
+     * @this {ChipSet8080}
+     * @param {string} sBits describing switch settings
+     * @param {number} [bDefault]
+     * @return {number|undefined}
+     */
+    parseDIPSwitches(sBits, bDefault)
+    {
+        var b = bDefault;
+        if (sBits) {
+            /*
+             * NOTE: We can't use parseInt() with a base of 2, because both bit order and bit sense are reversed.
+             */
+            b = 0;
+            var bit = 0x1;
+            for (var i = 0; i < sBits.length; i++) {
+                if (sBits.charAt(i) == "0") b |= bit;
+                bit <<= 1;
+            }
+        }
+        return b;
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * @this {ChipSet8080}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "sw1")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        return false;
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {ChipSet8080}
+     * @param {Computer8080} cmp
+     * @param {Bus8080} bus
+     * @param {CPUState8080} cpu
+     * @param {Debugger8080} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+        this.cmp = cmp;
+        this.kbd = /** @type {Keyboard8080} */ (cmp.getMachineComponent("Keyboard"));
+        this.serial = /** @type {SerialPort8080} */ (cmp.getMachineComponent("SerialPort"));
+        this.video = /** @type {Video8080} */ (cmp.getMachineComponent("Video"));
+        bus.addPortInputTable(this, this.config.portsInput);
+        bus.addPortOutputTable(this, this.config.portsOutput);
+
+        if (DEBUGGER) {
+            if (dbg) {
+                var chipset = this;
+                dbg.messageDump(Messages8080.NVR, function onDumpNVR() {
+                    chipset.dumpNVR();
+                });
+            }
+        }
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {ChipSet8080}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            if (!data) {
+                this.reset();
+            } else {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {ChipSet8080}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * dumpNVR()
+     *
+     * @this {ChipSet8080}
+     */
+    dumpNVR()
+    {
+        if (DEBUGGER) {
+            var sDump = "";
+            for (var iWord = 0; iWord < this.aNVRWords.length; iWord++) {
+                if (sDump) {
+                    sDump += (iWord && (iWord % 10)? ", " : ",\n");
+                }
+                sDump += Str.toHexWord(this.aNVRWords[iWord]);
+            }
+            this.dbg.println(sDump);
+        }
+    }
+
+    /**
+     * reset()
+     *
+     * @this {ChipSet8080}
+     */
+    reset()
+    {
+        if (this.config.INIT && !this.restore(this.config.INIT)) {
+            this.notice("reset error");
+        }
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the ChipSet component.
+     *
+     * @this {ChipSet8080}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        switch(this.config.MODEL) {
+        case ChipSet8080.SI1978.MODEL:
+            state.set(0, [this.bStatus0, this.bStatus1, this.bStatus2, this.wShiftData, this.bShiftCount, this.bSound1, this.bSound2]);
+            break;
+        case ChipSet8080.VT100.MODEL:
+            state.set(0, [this.bBrightness, this.bFlags]);
+            state.set(1, [this.bDC011Cols, this.bDC011Rate]);
+            state.set(2, [this.bDC012Scroll, this.bDC012Blink, this.bDC012Reverse, this.bDC012Attr]);
+            state.set(3, [this.dNVRAddr, this.wNVRData, this.bNVRLatch, this.bNVROut, this.aNVRWords]);
+            break;
+        }
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the ChipSet component.
+     *
+     * @this {ChipSet8080}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        var a;
+        if (data && (a = data[0]) && a.length) {
+            switch(this.config.MODEL) {
+            case ChipSet8080.SI1978.MODEL:
+                this.bStatus0      = a[0];
+                this.bStatus1      = a[1];
+                this.bStatus2      = a[2];
+                this.wShiftData    = a[3];
+                this.bShiftCount   = a[4];
+                this.bSound1       = a[5];
+                this.bSound2       = a[6];
+                return true;
+            case ChipSet8080.VT100.MODEL:
+                this.bBrightness   = a[0];
+                this.bFlags        = a[1];
+                a = data[1];
+                this.bDC011Cols    = a[0];
+                this.bDC011Rate    = a[1];
+                a = data[2];
+                this.bDC012Scroll  = a[0];
+                this.bDC012Blink   = a[1];
+                this.bDC012Reverse = a[2];
+                this.bDC012Attr    = a[3];
+                a = data[3];
+                this.dNVRAddr      = a[0];          // 20-bit address
+                this.wNVRData      = a[1];          // 14-bit word
+                this.bNVRLatch     = a[2];          // 1 byte
+                this.bNVROut       = a[3];          // 1 bit
+                this.aNVRWords     = a[4];          // 100 14-bit words
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * start()
+     *
+     * Notification from the CPU that it's starting.
+     *
+     * @this {ChipSet8080}
+     */
+    start()
+    {
+        /*
+         * Currently, all we (may) do with this notification is allow the speaker to make noise.
+         */
+    }
+
+    /**
+     * stop()
+     *
+     * Notification from the CPU that it's stopping.
+     *
+     * @this {ChipSet8080}
+     */
+    stop()
+    {
+        /*
+         * Currently, all we (may) do with this notification is prevent the speaker from making noise.
+         */
+    }
+
+    /**
+     * updateStatus0(bit, fSet)
+     *
+     * @this {ChipSet8080}
+     * @param {number} bit
+     * @param {boolean} fSet
+     */
+    updateStatus0(bit, fSet)
+    {
+        this.bStatus0 &= ~bit;
+        if (fSet) this.bStatus0 |= bit;
+    }
+
+    /**
+     * updateStatus1(bit, fSet)
+     *
+     * @this {ChipSet8080}
+     * @param {number} bit
+     * @param {boolean} fSet
+     */
+    updateStatus1(bit, fSet)
+    {
+        this.bStatus1 &= ~bit;
+        if (fSet) this.bStatus1 |= bit;
+    }
+
+    /**
+     * updateStatus2(bit, fSet)
+     *
+     * @this {ChipSet8080}
+     * @param {number} bit
+     * @param {boolean} fSet
+     */
+    updateStatus2(bit, fSet)
+    {
+        this.bStatus2 &= ~bit;
+        if (fSet) this.bStatus2 |= bit;
+    }
+
+    /**
+     * inSIStatus0(port, addrFrom)
+     *
+     * @this {ChipSet8080}
+     * @param {number} port (0x00)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inSIStatus0(port, addrFrom)
+    {
+        var b = this.bStatus0;
+        this.printMessageIO(port, null, addrFrom, "STATUS0", b, true);
+        return b;
+    }
+
+    /**
+     * inSIStatus1(port, addrFrom)
+     *
+     * @this {ChipSet8080}
+     * @param {number} port (0x01)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inSIStatus1(port, addrFrom)
+    {
+        var b = this.bStatus1;
+        this.printMessageIO(port, null, addrFrom, "STATUS1", b, true);
+        return b;
+    }
+
+    /**
+     * inSIStatus2(port, addrFrom)
+     *
+     * @this {ChipSet8080}
+     * @param {number} port (0x02)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inSIStatus2(port, addrFrom)
+    {
+        var b = this.bStatus2;
+        this.printMessageIO(port, null, addrFrom, "STATUS2", b, true);
+        return b;
+    }
+
+    /**
+     * inSIShiftResult(port, addrFrom)
+     *
+     * @this {ChipSet8080}
+     * @param {number} port (0x03)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inSIShiftResult(port, addrFrom)
+    {
+        var b = (this.wShiftData >> (8 - this.bShiftCount)) & 0xff;
+        this.printMessageIO(port, null, addrFrom, "SHIFT.RESULT", b, true);
+        return b;
+    }
+
+    /**
+     * outSIShiftCount(port, b, addrFrom)
+     *
+     * @this {ChipSet8080}
+     * @param {number} port (0x02)
+     * @param {number} b
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to write the specified port)
+     */
+    outSIShiftCount(port, b, addrFrom)
+    {
+        this.printMessageIO(port, b, addrFrom, "SHIFT.COUNT", null, true);
+        this.bShiftCount = b;
+    }
+
+    /**
+     * outSISound1(port, b, addrFrom)
+     *
+     * @this {ChipSet8080}
+     * @param {number} port (0x03)
+     * @param {number} b
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to write the specified port)
+     */
+    outSISound1(port, b, addrFrom)
+    {
+        this.printMessageIO(port, b, addrFrom, "SOUND1", null, true);
+        this.bSound1 = b;
+    }
+
+    /**
+     * outSIShiftData(port, b, addrFrom)
+     *
+     * @this {ChipSet8080}
+     * @param {number} port (0x04)
+     * @param {number} b
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to write the specified port)
+     */
+    outSIShiftData(port, b, addrFrom)
+    {
+        this.printMessageIO(port, b, addrFrom, "SHIFT.DATA", null, true);
+        this.wShiftData = (b << 8) | (this.wShiftData >> 8);
+    }
+
+    /**
+     * outSISound2(port, b, addrFrom)
+     *
+     * @this {ChipSet8080}
+     * @param {number} port (0x05)
+     * @param {number} b
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to write the specified port)
+     */
+    outSISound2(port, b, addrFrom)
+    {
+        this.printMessageIO(port, b, addrFrom, "SOUND2", null, true);
+        this.bSound2 = b;
+    }
+
+    /**
+     * outSIWatchdog(port, b, addrFrom)
+     *
+     * @this {ChipSet8080}
+     * @param {number} port (0x06)
+     * @param {number} b
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to write the specified port)
+     */
+    outSIWatchdog(port, b, addrFrom)
+    {
+        this.printMessageIO(port, b, addrFrom, "WATCHDOG", null, true);
+    }
+
+    /**
+     * getVT100LBA(iBit)
+     *
+     * Returns the state of the requested (simulated) LBA bit.
+     *
+     * NOTE: This is currently only used to obtain LBA7, which we approximate with the slightly faster approach
+     * of masking bit 6 of the CPU cycle count (see the DC011 discussion above).  This will result in a shorter LBA7
+     * period than if we divided the cycle count by 88, but a shorter LBA7 period is probably helpful in terms of
+     * overall performance.
+     *
+     * @param {number} iBit
+     * @return {number}
+     */
+    getVT100LBA(iBit)
+    {
+        return (this.cpu.getCycles() & (1 << (iBit - 1))) << 1;
+    }
+
+    /**
+     * getNVRAddr()
+     *
+     * @return {number}
+     */
+    getNVRAddr()
+    {
+        var i;
+        var tens = 0, ones = 0;
+        var addr = ~this.dNVRAddr;
+        for (i = 0; i < 10; i++) {
+            if (addr & 0x1) tens = 9-i;
+            addr >>= 1;
+        }
+        for (i = 0; i < 10; i++) {
+            if (addr & 0x1) ones = 9-i;
+            addr >>= 1;
+        }
+        addr = tens*10 + ones;
+
+        return addr;
+    }
+
+    /**
+     * doNVRCommand()
+     */
+    doNVRCommand()
+    {
+        var addr, data;
+        var bit = this.bNVRLatch & 0x1;
+        var bCmd = (this.bNVRLatch >> 1) & 0x7;
+
+        switch(bCmd) {
+        case ChipSet8080.VT100.NVR.CMD.STANDBY:
+            break;
+
+        case ChipSet8080.VT100.NVR.CMD.ACCEPT_ADDR:
+            this.dNVRAddr = (this.dNVRAddr << 1) | bit;
+            break;
+
+        case ChipSet8080.VT100.NVR.CMD.ERASE:
+            addr = this.getNVRAddr();
+            this.aNVRWords[addr] = ChipSet8080.VT100.NVR.WORDMASK;
+            this.printMessage("doNVRCommand(): erase data at addr " + Str.toHexWord(addr));
+            break;
+
+        case ChipSet8080.VT100.NVR.CMD.ACCEPT_DATA:
+            this.wNVRData = (this.wNVRData << 1) | bit;
+            break;
+
+        case ChipSet8080.VT100.NVR.CMD.WRITE:
+            addr = this.getNVRAddr();
+            data = this.wNVRData & ChipSet8080.VT100.NVR.WORDMASK;
+            this.aNVRWords[addr] = data;
+            this.printMessage("doNVRCommand(): write data " + Str.toHexWord(data) + " to addr " + Str.toHexWord(addr));
+            break;
+
+        case ChipSet8080.VT100.NVR.CMD.READ:
+            addr = this.getNVRAddr();
+            data = this.aNVRWords[addr];
+            /*
+             * If we don't explicitly initialize aNVRWords[], pretend any uninitialized words contains WORDMASK.
+             */
+            if (data == null) data = ChipSet8080.VT100.NVR.WORDMASK;
+            this.wNVRData = data;
+            this.printMessage("doNVRCommand():  read data " + Str.toHexWord(data) + " from addr " + Str.toHexWord(addr));
+            break;
+
+        case ChipSet8080.VT100.NVR.CMD.SHIFT_OUT:
+            this.wNVRData <<= 1;
+            /*
+             * Since WORDMASK is 0x3fff, this will mask the shifted data with 0x4000, which is the bit we want to isolate.
+             */
+            this.bNVROut = this.wNVRData & (ChipSet8080.VT100.NVR.WORDMASK + 1);
+            break;
+
+        default:
+            this.printMessage("doNVRCommand(): unrecognized command " + Str.toHexByte(bCmd));
+            break;
+        }
+    }
+
+    /**
+     * inVT100Flags(port, addrFrom)
+     *
+     * @this {ChipSet8080}
+     * @param {number} port (0x42)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inVT100Flags(port, addrFrom)
+    {
+        var b = this.bFlags;
+
+        /*
+         * The NVR_CLK bit is driven by LBA7 (ie, bit 7 from Line Buffer Address generation); see the DC011 discussion above.
+         */
+        b &= ~ChipSet8080.VT100.FLAGS.NVR_CLK;
+        if (this.getVT100LBA(7)) {
+            b |= ChipSet8080.VT100.FLAGS.NVR_CLK;
+            if (b != this.bFlags) {
+                this.doNVRCommand();
+            }
+        }
+
+        b &= ~ChipSet8080.VT100.FLAGS.NVR_DATA;
+        if (this.bNVROut) {
+            b |= ChipSet8080.VT100.FLAGS.NVR_DATA;
+        }
+
+        b &= ~ChipSet8080.VT100.FLAGS.KBD_XMIT;
+        if (this.kbd && this.kbd.isVT100TransmitterReady()) {
+            b |= ChipSet8080.VT100.FLAGS.KBD_XMIT;
+        }
+
+        b &= ~ChipSet8080.VT100.FLAGS.UART_XMIT;
+        if (this.serial && this.serial.isTransmitterReady()) {
+            b |= ChipSet8080.VT100.FLAGS.UART_XMIT;
+        }
+
+        this.bFlags = b;
+        this.printMessageIO(port, null, addrFrom, "FLAGS", b);
+        return b;
+    }
+
+    /**
+     * outVT100Brightness(port, b, addrFrom)
+     *
+     * @this {ChipSet8080}
+     * @param {number} port (0x42)
+     * @param {number} b
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to write the specified port)
+     */
+    outVT100Brightness(port, b, addrFrom)
+    {
+        this.printMessageIO(port, b, addrFrom, "BRIGHTNESS");
+        this.bBrightness = b;
+    }
+
+    /**
+     * outVT100NVRLatch(port, b, addrFrom)
+     *
+     * @this {ChipSet8080}
+     * @param {number} port (0x62)
+     * @param {number} b
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to write the specified port)
+     */
+    outVT100NVRLatch(port, b, addrFrom)
+    {
+        this.printMessageIO(port, b, addrFrom, "NVR.LATCH");
+        this.bNVRLatch = b;
+    }
+
+    /**
+     * outVT100DC012(port, b, addrFrom)
+     *
+     * TODO: Consider whether we should disable any interrupts (eg, vertical retrace) until
+     * this port is initialized at runtime.
+     *
+     * @this {ChipSet8080}
+     * @param {number} port (0xA2)
+     * @param {number} b
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to write the specified port)
+     */
+    outVT100DC012(port, b, addrFrom)
+    {
+        this.printMessageIO(port, b, addrFrom, "DC012");
+
+        var bOpt = b & 0x3;
+        var bCmd = (b >> 2) & 0x3;
+        switch(bCmd) {
+        case 0x0:
+            this.bDC012Scroll = (this.bDC012Scroll & ~0x3) | bOpt;
+            break;
+        case 0x1:
+            this.bDC012Scroll = (this.bDC012Scroll & ~0xC) | (bOpt << 2);
+            if (this.video) this.video.updateScrollOffset(this.bDC012Scroll);
+            break;
+        case 0x2:
+            switch(bOpt) {
+            case 0x0:
+                this.bDC012Blink = ~this.bDC012Blink;
+                break;
+            case 0x1:
+                // TODO: Clear vertical frequency interrupt?
+                break;
+            case 0x2:
+            case 0x3:
+                this.bDC012Reverse = 0x3 - bOpt;
+                break;
+            }
+            break;
+        case 0x3:
+            this.bDC012Attr = bOpt;
+            break;
+        }
+    }
+
+    /**
+     * outVT100DC011(port, b, addrFrom)
+     *
+     * @this {ChipSet8080}
+     * @param {number} port (0xC2)
+     * @param {number} b
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to write the specified port)
+     */
+    outVT100DC011(port, b, addrFrom)
+    {
+        this.printMessageIO(port, b, addrFrom, "DC011");
+        if (b & ChipSet8080.VT100.DC011.RATE60) {
+            b &= ChipSet8080.VT100.DC011.RATE50;
+            if (this.bDC011Rate != b) {
+                this.bDC011Rate = b;
+                if (this.video) {
+                    this.video.updateRate(this.bDC011Rate == ChipSet8080.VT100.DC011.RATE50? 50 : 60);
+                }
+            }
+        } else {
+            b &= ChipSet8080.VT100.DC011.COLS132;
+            if (this.bDC011Cols != b) {
+                this.bDC011Cols = b;
+                if (this.video) {
+                    var nCols = (this.bDC011Cols == ChipSet8080.VT100.DC011.COLS132? 132 : 80);
+                    var nRows = (nCols > 80 && (this.bFlags & ChipSet8080.VT100.FLAGS.NO_AVO)? 14 : 24);
+                    this.video.updateDimensions(nCols, nRows);
+                }
+            }
+        }
+    }
+
+    /**
+     * ChipSet8080.init()
+     *
+     * This function operates on every HTML element of class "chipset", extracting the
+     * JSON-encoded parameters for the ChipSet constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a ChipSet component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeChipSet = Component.getElementsByClass(document, PC8080.APPCLASS, "chipset");
+        for (var iChip = 0; iChip < aeChipSet.length; iChip++) {
+            var eChipSet = aeChipSet[iChip];
+            var parmsChipSet = Component.getComponentParms(eChipSet);
+            var chipset = new ChipSet8080(parmsChipSet);
+            Component.bindComponentControls(chipset, eChipSet, PC8080.APPCLASS);
+        }
+    }
+}
+
+/*
+ * NOTE: The STATUS1 port could have been handled entirely by the Keyboard component, but it was just as easy
+ * to create a simple ChipSet interface, updateStatus1(), that the Keyboard calls whenever it wants to simulate a
+ * button press or release.  It's a six-of-one, half-a-dozen-of-another choice, since technically, Space Invaders
+ * doesn't have a keyboard.
+ */
+ChipSet8080.SI1978 = {
+    MODEL:          1978.1,
+    STATUS0: {                          // NOTE: STATUS0 not used by the SI1978 ROMs; refer to STATUS1 instead
+        PORT:       0,
+        DIP4:       0x01,               // self-test request at power up?
+        FIRE:       0x10,               // 1 = fire
+        LEFT:       0x20,               // 1 = left
+        RIGHT:      0x40,               // 1 = right
+        PORT7:      0x80,               // some connection to (undocumented) port 7
+        ALWAYS_SET: 0x0E                // always set
+    },
+    STATUS1: {
+        PORT:       1,
+        CREDIT:     0x01,               // credit (coin slot)
+        P2:         0x02,               // 1 = 2P start
+        P1:         0x04,               // 1 = 1P start
+        P1_FIRE:    0x10,               // 1 = fire (P1 fire if cocktail machine?)
+        P1_LEFT:    0x20,               // 1 = left (P1 left if cocktail machine?)
+        P1_RIGHT:   0x40,               // 1 = right (P1 right if cocktail machine?)
+        ALWAYS_SET: 0x08                // always set
+    },
+    STATUS2: {
+        PORT:       2,
+        DIP3_5:     0x03,               // 00 = 3 ships, 01 = 4 ships, 10 = 5 ships, 11 = 6 ships
+        TILT:       0x04,               // 1 = tilt detected
+        DIP6:       0x08,               // 0 = extra ship at 1500, 1 = extra ship at 1000
+        P2_FIRE:    0x10,               // 1 = P2 fire (cocktail machines only?)
+        P2_LEFT:    0x20,               // 1 = P2 left (cocktail machines only?)
+        P2_RIGHT:   0x40,               // 1 = P2 right (cocktail machines only?)
+        DIP7:       0x80,               // 0 = display coin info on demo ("attract") screen
+        ALWAYS_SET: 0x00
+    },
+    SHIFT_RESULT: {                     // bits 0-7 of barrel shifter result
+        PORT:       3
+    },
+    SHIFT_COUNT: {
+        PORT:       2,
+        MASK:       0x07
+    },
+    SOUND1: {
+        PORT:       3,
+        UFO:        0x01,
+        SHOT:       0x02,
+        PDEATH:     0x04,
+        IDEATH:     0x08,
+        EXPLAY:     0x10,
+        AMP_ENABLE: 0x20
+    },
+    SHIFT_DATA: {
+        PORT:       4
+    },
+    SOUND2: {
+        PORT:       5,
+        FLEET1:     0x01,
+        FLEET2:     0x02,
+        FLEET3:     0x04,
+        FLEET4:     0x08,
+        UFO_HIT:    0x10
+    }
+};
+
+/*
+ * One of the many chips in the VT100 is an 8224, which operates at 24.8832MHz.  That frequency is divided by 9
+ * to yield a 361.69ns clock period for the 8080 CPU, which means (in theory) that the CPU is running at 2.76Mhz.
+ *
+ * Hence the CPU component in the VT100's machine.xml should be defined as:
+ *
+ *      <cpu id="cpu8080" model="8080" cycles="2764800"/>
+ *
+ * WARNING: The choice of clock speed has an effect on other simulated VT100 circuits; see the DC011 Timing Chip
+ * discussion below, along with the getVT100LBA() function.
+ *
+ * For reference, here is a list of all the VT100 I/O ports, from /devices/pc8080/machine/vt100/debugger/README.md,
+ * which in turn comes from p. 4-17 of the VT100 Technical Manual (July 1982):
+ *
+ *      READ OR WRITE
+ *      00H     PUSART data bus
+ *      01H     PUSART command port
+ *
+ *      WRITE ONLY (Decoded with I/O WR L)
+ *      02H     Baud rate generator
+ *      42H     Brightness D/A latch
+ *      62H     NVR latch
+ *      82H     Keyboard UART data input [used to update the Keyboard Status Byte -JP]
+ *      A2H     Video processor DC012
+ *      C2H     Video processor DC011
+ *      E2H     Graphics port
+ *
+ *      READ ONLY (Decoded with I/O RD L)
+ *      22H     Modem buffer
+ *      42H     Flags buffer
+ *      82H     Keyboard UART data output
+ *
+ * Most of these are handled by the ChipSet component, since it exists as sort of a "catch-all" component,
+ * but some are more appropriately handled by other components; eg, port 0x82 is handled by the Keyboard component,
+ * so it's defined there instead of here.
+ */
+ChipSet8080.VT100 = {
+    MODEL:          100.0,
+    FLAGS: {
+        PORT:       0x42,               // read-only
+        UART_XMIT:  0x01,               // PUSART transmit buffer empty if SET
+        NO_AVO:     0x02,               // AVO present if CLEAR
+        NO_GFX:     0x04,               // VT125 graphics board present if CLEAR
+        OPTION:     0x08,               // OPTION present if SET
+        NO_EVEN:    0x10,               // EVEN FIELD active if CLEAR
+        NVR_DATA:   0x20,               // NVR DATA if SET
+        NVR_CLK:    0x40,               // NVR CLOCK if SET
+        KBD_XMIT:   0x80                // KBD transmit buffer empty if SET
+    },
+    BRIGHTNESS: {
+        PORT:       0x42,               // write-only
+        INIT:       0x00                // for lack of a better guess
+    },
+    /*
+     * DC011 is referred to as a Timing Chip.
+     *
+     * As p. 4-55 (105) of the VT100 Technical Manual (July 1982) explains:
+     *
+     *      The DCO11 is a custom designed bipolar circuit that provides most of the timing signals required by the
+     *      video processor. Internal counters divide the output of a 24.0734 MHz oscillator (located elsewhere on the
+     *      terminal controller module) into the lower frequencies that define dot, character, scan, and frame timing.
+     *      The counters are programmable through various input pins to control the number of characters per line,
+     *      the frequency at which the screen is refreshed, and whether the display is interlaced or noninterlaced.
+     *      These parameters can be controlled through SET-UP mode or by the host.
+     *
+     *          Table 4-6-1: Video Mode Selection (Write Address 0xC2)
+     *
+     *          D5  D4      Configuration
+     *          --  --      -------------
+     *          0   0       80-column mode, interlaced
+     *          0   1       132-column mode, interlaced
+     *          1   0       60Hz, non-interlaced
+     *          1   1       50Hz, non-interlaced
+     *
+     * On p. 4-56, the DC011 Block Diagram shows 8 outputs labeled LBA0 through LBA7.  From p. 4-61:
+     *
+     *      Several of the LBAs are used as general purpose clocks in the VT100. LBA3 and LBA4 are used to generate
+     *      timing for the keyboard. These signals satisfy the keyboard's requirement of two square-waves, one twice the
+     *      frequency of the other, even though every 16th transition is delayed (the second stage of the horizontal
+     *      counter divides by 17, not 16). LBA7 is used by the nonvolatile RAM.
+     *
+     * And on p. 4-62, timings are provided for the LBA0 through LBA7; in particular:
+     *
+     *      LBA6:   16.82353us (when LBA6 is low, for a period of 33.64706us)
+     *      LBA7:   31.77778us (when LBA7 is high, for a period of 63.55556us)
+     *
+     * If we assume that the CPU cycle count increments once every 361.69ns, it will increment roughly 88 times every
+     * time LBA7 toggles.  So we can divide the CPU cycle count by 88 and set LBA to the low bit of that truncated
+     * result.  An even faster (but less accurate) solution would be to mask bit 6 of the CPU cycle count, which will
+     * doesn't change until the count has been incremented 64 times.  See getVT100LBA() for the chosen implementation.
+     */
+    DC011: {                            // generates Line Buffer Addresses (LBAs) for the Video Processor
+        PORT:       0xC2,               // write-only
+        COLS80:     0x00,
+        COLS132:    0x10,
+        RATE60:     0x20,
+        RATE50:     0x30,
+        INITCOLS:   0x00,               // ie, COLS80
+        INITRATE:   0x20                // ie, RATE60
+    },
+    /*
+     * DC012 is referred to as a Control Chip.
+     *
+     * As p. 4-67 (117) of the VT100 Technical Manual (July 1982) explains:
+     *
+     *      The DCO12 performs three main functions.
+     *
+     *       1. Scan count generation. This involves two counters, a multiplexer to switch between the counters,
+     *          double-height logic, scroll and line attribute latches, and various logic controlling switching between
+     *          the two counters. This is the biggest part of the chip. It includes all scrolling, double-height logic,
+     *          and feeds into the underline and hold request circuits.
+     *
+     *       2. Generation of HOLD REQUEST. This uses information from the scan counters and the scrolling logic to
+     *          decide when to generate HOLD REQUEST.
+     *
+     *       3. Video modifications: dot stretching, blanking, addition of attributes to video outputs, and multiple
+     *          intensity levels.
+     *
+     *      The input decoder accepts a 4-bit command from the microprocessor when VID WR 2 L is asserted. Table 4-6-2
+     *      lists the commands.
+     *
+     *      D3 D2 D1 D0     Function
+     *      -- -- -- --     --------
+     *      0  0  0  0      Load low order scroll latch = 00
+     *      0  0  0  1      Load low order scroll latch = 01
+     *      0  0  1  0      Load low order scroll latch = 10
+     *      0  0  1  1      Load low order scroll latch = 11
+     *
+     *      0  1  0  0      Load high order scroll latch = 00
+     *      0  1  0  1      Load high order scroll latch = 01
+     *      0  1  1  0      Load high order scroll latch = 10
+     *      0  1  1  1      Load high order scroll latch = 11 (not used)
+     *
+     *      1  0  0  0      Toggle blink flip-flop
+     *      1  0  0  1      Clear vertical frequency interrupt
+     *
+     *      1  0  1  0      Set reverse field on
+     *      1  0  1  1      Set reverse field off
+     *
+     *      1  1  0  0      Set basic attribute to underline*
+     *      1  1  0  1      Set basic attribute to reverse video*
+     *      1  1  1  0      Reserved for future specification*
+     *      1  1  1  1      Reserved for future specification*
+     *
+     *      *These functions also clear blink flip-flop.
+     */
+    DC012: {                            // generates scan counts for the Video Processor
+        PORT:       0xA2,               // write-only
+        SCROLL_LO:  0x00,
+        INITSCROLL: 0x00,
+        INITBLINK:  0x00,
+        INITREVERSE:0x00,
+        INITATTR:   0x00
+    },
+    /*
+     * ER1400 Non-Volatile RAM (NVR) Chip Definitions
+     */
+    NVR: {
+        LATCH: {
+            PORT:   0x62                // write-only
+        },
+        CMD: {
+            ACCEPT_DATA:    0x0,
+            ACCEPT_ADDR:    0x1,
+            SHIFT_OUT:      0x2,
+            WRITE:          0x4,
+            ERASE:          0x5,
+            READ:           0x6,
+            STANDBY:        0x7
+        },
+        WORDMASK:   0x3fff              // NVR words are 14-bit
+        /*
+         * The Technical Manual, p. 4-18, also notes that "Early VT100s can disable the receiver interrupt by
+         * programming D4 in the NVR latch. However, this is never used by the VT100."
+         */
+    }
+};
+
+/*
+ * Supported models and their configurations
+ */
+ChipSet8080.MODELS = {
+    "SI1978":       ChipSet8080.SI1978,
+    "VT100":        ChipSet8080.VT100
+};
+
+ChipSet8080.SI1978.INIT = [
+    [
+        ChipSet8080.SI1978.STATUS0.ALWAYS_SET,
+        ChipSet8080.SI1978.STATUS1.ALWAYS_SET,
+        ChipSet8080.SI1978.STATUS2.ALWAYS_SET,
+        0, 0, 0, 0
+    ]
+];
+
+ChipSet8080.VT100.INIT = [
+    [
+        ChipSet8080.VT100.BRIGHTNESS.INIT,
+        ChipSet8080.VT100.FLAGS.NO_AVO | ChipSet8080.VT100.FLAGS.NO_GFX
+    ],
+    [
+        ChipSet8080.VT100.DC011.INITCOLS,
+        ChipSet8080.VT100.DC011.INITRATE
+    ],
+    [
+        ChipSet8080.VT100.DC012.INITSCROLL,
+        ChipSet8080.VT100.DC012.INITBLINK,
+        ChipSet8080.VT100.DC012.INITREVERSE,
+        ChipSet8080.VT100.DC012.INITATTR
+    ],
+    [
+        0, 0, 0, 0,
+        [
+            /*
+             * The following array contains the data we use to initialize all (100) words of NVR (Non-Volatile RAM).
+             *
+             * I used to initialize every word to 0x3ff, as if the NVR had been freshly erased, but that causes the
+             * firmware to (attempt to) beep and then display an error code (2).  As the DEC Technical Manual says:
+             *
+             *      If the NVR fails, the bell sounds several times to inform the operator, and then default settings
+             *      stored in the ROM allow the terminal to work.
+             *
+             * but I think what they meant to say is that default settings are stored in the RAM copy of NVR.  So then
+             * I went into SET-UP, pressed SHIFT-S to save those settings back to NVR, and then used the PC8080 debugger
+             * "d nvr" command to dump the NVR contents.  The results are below.
+             *
+             * The first dump actually contains only two modifications to the factory defaults: enabling ONLINE instead
+             * of LOCAL operation, and turning ANSI support ON.  The second dump is unmodified (the TRUE factory defaults).
+             *
+             * By making selective changes, you can discern where the bits for certain features are stored.  For example,
+             * smooth-scrolling is apparently controlled by bit 7 of the word at offset 0x2B (and is ON by default in
+             * the factory settings).  And it's likely that the word at offset 0x32 (ie, the last word that's not zero)
+             * is the NVR checksum.
+             */
+            0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80,
+            0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80,
+            0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80,
+            0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E00,
+            0x2E08, 0x2E8E, 0x2E00, 0x2ED0, 0x2E70, 0x2E00, 0x2E20, 0x2E00, 0x2EE0, 0x2EE0,
+            0x2E7D, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+            0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+            0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+            0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+            0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000
+        ],
+        [
+            /*
+             * The TRUE factory defaults (not currently used for anything; they're just here for reference, wasting space....)
+             */
+            0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80,
+            0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80,
+            0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80,
+            0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E80, 0x2E00,
+            0x2E08, 0x2E8E, 0x2E20, 0x2ED0, 0x2E50, 0x2E00, 0x2E20, 0x2E00, 0x2EE0, 0x2EE0,
+            0x2E69, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+            0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+            0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+            0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+            0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000
+        ]
+    ]
+];
+
+/*
+ * Port notification tables
+ */
+ChipSet8080.SI1978.portsInput = {
+    0x00: ChipSet8080.prototype.inSIStatus0,
+    0x01: ChipSet8080.prototype.inSIStatus1,
+    0x02: ChipSet8080.prototype.inSIStatus2,
+    0x03: ChipSet8080.prototype.inSIShiftResult
+};
+
+ChipSet8080.SI1978.portsOutput = {
+    0x02: ChipSet8080.prototype.outSIShiftCount,
+    0x03: ChipSet8080.prototype.outSISound1,
+    0x04: ChipSet8080.prototype.outSIShiftData,
+    0x05: ChipSet8080.prototype.outSISound2,
+    0x06: ChipSet8080.prototype.outSIWatchdog
+};
+
+ChipSet8080.VT100.portsInput = {
+    0x42: ChipSet8080.prototype.inVT100Flags
+};
+
+ChipSet8080.VT100.portsOutput = {
+    0x42: ChipSet8080.prototype.outVT100Brightness,
+    0x62: ChipSet8080.prototype.outVT100NVRLatch,
+    0xA2: ChipSet8080.prototype.outVT100DC012,
+    0xC2: ChipSet8080.prototype.outVT100DC011
+};
+
+/*
+ * Initialize every ChipSet module on the page.
+ */
+Web.onInit(ChipSet8080.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pc8080/lib/rom.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class ROM8080 extends Component {
+    /**
+     * ROM8080(parmsROM)
+     *
+     * The ROM8080 component expects the following (parmsROM) properties:
+     *
+     *      addr: physical address of ROM
+     *      size: amount of ROM, in bytes
+     *      alias: physical alias address (null if none)
+     *      file: name of ROM data file
+     *
+     * NOTE: The ROM data will not be copied into place until the Bus is ready (see initBus()) AND the
+     * ROM data file has finished loading (see doneLoad()).
+     *
+     * Also, while the size parameter may seem redundant, I consider it useful to confirm that the ROM you received
+     * is the ROM you expected.
+     *
+     * @this {ROM8080}
+     * @param {Object} parmsROM
+     */
+    constructor(parmsROM)
+    {
+        super("ROM", parmsROM);
+
+        this.abROM = null;
+        this.addrROM = parmsROM['addr'];
+        this.sizeROM = parmsROM['size'];
+
+        /*
+         * The new 'alias' property can now be EITHER a single physical address (like 'addr') OR an array of
+         * physical addresses; eg:
+         *
+         *      [0xf0000,0xffff0000,0xffff8000]
+         *
+         * We could have overloaded 'addr' to accomplish the same thing, but I think it's better to have any
+         * aliased locations listed under a separate property.
+         *
+         * Most ROMs are not aliased, in which case the 'alias' property should have the default value of null.
+         */
+        this.addrAlias = parmsROM['alias'];
+
+        this.sFilePath = parmsROM['file'];
+        this.sFileName = Str.getBaseName(this.sFilePath);
+
+        if (this.sFilePath) {
+            var sFileURL = this.sFilePath;
+            if (DEBUG) this.log('load("' + sFileURL + '")');
+            /*
+             * If the selected ROM file has a ".json" extension, then we assume it's pre-converted
+             * JSON-encoded ROM data, so we load it as-is; ditto for ROM files with a ".hex" extension.
+             * Otherwise, we ask our server-side ROM converter to return the file in a JSON-compatible format.
+             */
+            var sFileExt = Str.getExtension(this.sFileName);
+            if (sFileExt != DumpAPI.FORMAT.JSON && sFileExt != DumpAPI.FORMAT.HEX) {
+                sFileURL = Web.getHost() + DumpAPI.ENDPOINT + '?' + DumpAPI.QUERY.FILE + '=' + this.sFilePath + '&' + DumpAPI.QUERY.FORMAT + '=' + DumpAPI.FORMAT.BYTES + '&' + DumpAPI.QUERY.DECIMAL + '=true';
+            }
+            var rom = this;
+            Web.getResource(sFileURL, null, true, function(sURL, sResponse, nErrorCode) {
+                rom.doneLoad(sURL, sResponse, nErrorCode);
+            });
+        }
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {ROM8080}
+     * @param {Computer8080} cmp
+     * @param {Bus8080} bus
+     * @param {CPUState8080} cpu
+     * @param {Debugger8080} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+        this.copyROM();
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {ROM8080}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (this.aSymbols) {
+            if (this.dbg) {
+                this.dbg.addSymbols(this.id, this.addrROM, this.sizeROM, this.aSymbols);
+            }
+            /*
+             * Our only role in the handling of symbols is to hand them off to the Debugger at our
+             * first opportunity. Now that we've done that, our copy of the symbols, if any, are toast.
+             */
+            delete this.aSymbols;
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * Since we have nothing to do on powerDown(), and no state to return, we could simply omit
+     * this function.  But it doesn't hurt anything, and maybe we'll use our state to save something
+     * useful down the road, like user-defined symbols (ie, symbols that the Debugger may have
+     * created, above and beyond those symbols we automatically loaded, if any, along with the ROM).
+     *
+     * @this {ROM8080}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return true;
+    }
+
+    /**
+     * doneLoad(sURL, sROMData, nErrorCode)
+     *
+     * @this {ROM8080}
+     * @param {string} sURL
+     * @param {string} sROMData
+     * @param {number} nErrorCode (response from server if anything other than 200)
+     */
+    doneLoad(sURL, sROMData, nErrorCode)
+    {
+        if (nErrorCode) {
+            this.notice("Unable to load system ROM (error " + nErrorCode + ": " + sURL + ")");
+            return;
+        }
+
+        Component.addMachineResource(this.idMachine, sURL, sROMData);
+
+        if (sROMData.charAt(0) == "[" || sROMData.charAt(0) == "{") {
+            try {
+                /*
+                 * The most likely source of any exception will be here: parsing the JSON-encoded ROM data.
+                 */
+                var rom = eval("(" + sROMData + ")");
+                var ab = rom['bytes'];
+                /*
+                 * Resource 'longs' should always be 32-bit DWORD values, whereas 'data' bit lengths
+                 * will vary according to the machine architecture for which the resource was designed.
+                 */
+                var adw = rom['longs'] || rom['data'];
+
+                if (ab) {
+                    this.abROM = ab;
+                }
+                else if (adw) {
+                    /*
+                     * Convert all the DWORDs into BYTEs, so that subsequent code only has to deal with abROM.
+                     */
+                    this.abROM = new Array(adw.length * 4);
+                    for (var idw = 0, ib = 0; idw < adw.length; idw++) {
+                        this.abROM[ib++] = adw[idw] & 0xff;
+                        this.abROM[ib++] = (adw[idw] >> 8) & 0xff;
+                        this.abROM[ib++] = (adw[idw] >> 16) & 0xff;
+                        this.abROM[ib++] = (adw[idw] >> 24) & 0xff;
+                    }
+                }
+                else {
+                    this.abROM = rom;
+                }
+
+                this.aSymbols = rom['symbols'];
+
+                if (!this.abROM.length) {
+                    Component.error("Empty ROM: " + sURL);
+                    return;
+                }
+                else if (this.abROM.length == 1) {
+                    Component.error(this.abROM[0]);
+                    return;
+                }
+            } catch (e) {
+                this.notice("ROM data error: " + e.message);
+                return;
+            }
+        }
+        else {
+            /*
+             * Parse the ROM data manually; we assume it's in "simplified" hex form (a series of hex byte-values
+             * separated by whitespace).
+             */
+            var sHexData = sROMData.replace(/\n/gm, " ").replace(/ +$/, "");
+            var asHexData = sHexData.split(" ");
+            this.abROM = new Array(asHexData.length);
+            for (var i = 0; i < asHexData.length; i++) {
+                this.abROM[i] = Str.parseInt(asHexData[i], 16);
+            }
+        }
+        this.copyROM();
+    }
+
+    /**
+     * copyROM()
+     *
+     * This function is called by both initBus() and doneLoad(), but it cannot copy the the ROM data into place
+     * until after initBus() has received the Bus component AND doneLoad() has received the abROM data.  When both
+     * those criteria are satisfied, the component becomes "ready".
+     *
+     * @this {ROM8080}
+     */
+    copyROM()
+    {
+        if (!this.isReady()) {
+            if (!this.sFilePath) {
+                this.setReady();
+            }
+            else if (this.abROM && this.bus) {
+                /*
+                 * If no explicit size was specified, then use whatever the actual size is.
+                 */
+                if (!this.sizeROM) {
+                    this.sizeROM = this.abROM.length;
+                }
+                if (this.abROM.length != this.sizeROM) {
+                    /*
+                     * Note that setError() sets the component's fError flag, which in turn prevents setReady() from
+                     * marking the component ready.  TODO: Revisit this decision.  On the one hand, it sounds like a
+                     * good idea to stop the machine in its tracks whenever a setError() occurs, but there may also be
+                     * times when we'd like to forge ahead anyway.
+                     */
+                    this.setError("ROM size (" + Str.toHexLong(this.abROM.length) + ") does not match specified size (" + Str.toHexLong(this.sizeROM) + ")");
+                }
+                else if (this.addROM(this.addrROM)) {
+
+                    var aliases = [];
+                    if (typeof this.addrAlias == "number") {
+                        aliases.push(this.addrAlias);
+                    } else if (this.addrAlias != null && this.addrAlias.length) {
+                        aliases = this.addrAlias;
+                    }
+                    for (var i = 0; i < aliases.length; i++) {
+                        this.cloneROM(aliases[i]);
+                    }
+                    /*
+                     * We used to hang onto the original ROM data so that we could restore any bytes the CPU overwrote,
+                     * using memory write-notification handlers, but with the introduction of read-only memory blocks, that's
+                     * no longer necessary.
+                     *
+                     * TODO: Consider an option to retain the ROM data, and give the user some way of restoring ROMs.
+                     * That may be useful for "resumable" machines that save/restore all dirty block of memory, regardless
+                     * whether they're ROM or RAM.  However, the only way to modify a machine's ROM is with the Debugger,
+                     * and Debugger users should know better.
+                     */
+                    delete this.abROM;
+                }
+                this.setReady();
+            }
+        }
+    }
+
+    /**
+     * addROM(addr)
+     *
+     * @this {ROM8080}
+     * @param {number} addr
+     * @return {boolean}
+     */
+    addROM(addr)
+    {
+        if (this.bus.addMemory(addr, this.sizeROM, Memory8080.TYPE.ROM)) {
+            if (DEBUG) this.log("addROM(): copying ROM to " + Str.toHexLong(addr) + " (" + Str.toHexLong(this.abROM.length) + " bytes)");
+            var i;
+            for (i = 0; i < this.abROM.length; i++) {
+                this.bus.setByteDirect(addr + i, this.abROM[i]);
+            }
+            return true;
+        }
+        /*
+         * We don't need to report an error here, because addMemory() already takes care of that.
+         */
+        return false;
+    }
+
+    /**
+     * cloneROM(addr)
+     *
+     * For ROMs with one or more alias addresses, we used to call addROM() for each address.  However,
+     * that obviously wasted memory, since each alias was an independent copy, and if you used the
+     * Debugger to edit the ROM in one location, the changes would not appear in the other location(s).
+     *
+     * Now that the Bus component provides low-level getMemoryBlocks() and setMemoryBlocks() methods
+     * to manually get and set the blocks of any memory range, it is now possible to create true aliases.
+     *
+     * @this {ROM8080}
+     * @param {number} addr
+     */
+    cloneROM(addr)
+    {
+        var aBlocks = this.bus.getMemoryBlocks(this.addrROM, this.sizeROM);
+        this.bus.setMemoryBlocks(addr, this.sizeROM, aBlocks);
+    }
+
+    /**
+     * ROM8080.init()
+     *
+     * This function operates on every HTML element of class "rom", extracting the
+     * JSON-encoded parameters for the ROM8080 constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a ROM8080 component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeROM = Component.getElementsByClass(document, PC8080.APPCLASS, "rom");
+        for (var iROM = 0; iROM < aeROM.length; iROM++) {
+            var eROM = aeROM[iROM];
+            var parmsROM = Component.getComponentParms(eROM);
+            var rom = new ROM8080(parmsROM);
+            Component.bindComponentControls(rom, eROM, PC8080.APPCLASS);
+        }
+    }
+}
+
+/*
+ * NOTE: There's currently no need for this component to have a reset() function, since
+ * once the ROM data is loaded, it can't be changed, so there's nothing to reinitialize.
+ *
+ * OK, well, I take that back, because the Debugger, if installed, has the ability to modify
+ * ROM contents, so in that case, having a reset() function that restores the original ROM data
+ * might be useful; then again, it might not, depending on what you're trying to debug.
+ *
+ * If we do add reset(), then we'll want to change copyROM() to hang onto the original
+ * ROM data; currently, we release it after copying it into the read-only memory allocated
+ * via bus.addMemory().
+ */
+
+/*
+ * Initialize all the ROM8080 modules on the page.
+ */
+Web.onInit(ROM8080.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pc8080/lib/ram.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class RAM8080 extends Component {
+    /**
+     * RAM8080(parmsRAM)
+     *
+     * The RAM8080 component expects the following (parmsRAM) properties:
+     *
+     *      addr: starting physical address of RAM (default is 0)
+     *      size: amount of RAM, in bytes (default is 0, which means defer to motherboard switch settings)
+     *      file: name of optional data file to load into RAM (default is "")
+     *      load: optional file load address (overrides any load address specified in the data file; default is null)
+     *      exec: optional file exec address (overrides any exec address specified in the data file; default is null)
+     *
+     * NOTE: We make a note of the specified size, but no memory is initially allocated for the RAM until the
+     * Computer component calls powerUp().
+     *
+     * @this {RAM8080}
+     * @param {Object} parmsRAM
+     */
+    constructor(parmsRAM)
+    {
+        super("RAM", parmsRAM);
+
+        this.abInit = null;
+        this.aSymbols = null;
+
+        this.addrRAM = parmsRAM['addr'];
+        this.sizeRAM = parmsRAM['size'];
+        this.addrLoad = parmsRAM['load'];
+        this.addrExec = parmsRAM['exec'];
+
+        this.fInstalled = (!!this.sizeRAM); // 0 is the default value for 'size' when none is specified
+        this.fAllocated = false;
+
+        this.sFilePath = parmsRAM['file'];
+        this.sFileName = Str.getBaseName(this.sFilePath);
+
+        if (this.sFilePath) {
+            var sFileURL = this.sFilePath;
+            if (DEBUG) this.log('load("' + sFileURL + '")');
+            /*
+             * If the selected data file has a ".json" extension, then we assume it's pre-converted
+             * JSON-encoded data, so we load it as-is; ditto for ROM files with a ".hex" extension.
+             * Otherwise, we ask our server-side converter to return the file in a JSON-compatible format.
+             */
+            var sFileExt = Str.getExtension(this.sFileName);
+            if (sFileExt != DumpAPI.FORMAT.JSON && sFileExt != DumpAPI.FORMAT.HEX) {
+                sFileURL = Web.getHost() + DumpAPI.ENDPOINT + '?' + DumpAPI.QUERY.FILE + '=' + this.sFilePath + '&' + DumpAPI.QUERY.FORMAT + '=' + DumpAPI.FORMAT.BYTES + '&' + DumpAPI.QUERY.DECIMAL + '=true';
+            }
+            var ram = this;
+            Web.getResource(sFileURL, null, true, function(sURL, sResponse, nErrorCode) {
+                ram.doneLoad(sURL, sResponse, nErrorCode);
+            });
+        }
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {RAM8080}
+     * @param {Computer8080} cmp
+     * @param {Bus8080} bus
+     * @param {CPUState8080} cpu
+     * @param {Debugger8080} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+        this.initRAM();
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {RAM8080}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        /*
+         * The Computer powers up the CPU last, at which point CPUState state is restored,
+         * which includes the Bus state, and since we use the Bus to allocate all our memory,
+         * memory contents are already restored for us, so we don't need the usual restore
+         * logic.
+         */
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {RAM8080}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        /*
+         * The Computer powers down the CPU first, at which point CPUState state is saved,
+         * which includes the Bus state, and since we use the Bus component to allocate all
+         * our memory, memory contents are already saved for us, so we don't need the usual
+         * save logic.
+         */
+        return true;
+    }
+
+    /**
+     * doneLoad(sURL, sData, nErrorCode)
+     *
+     * @this {RAM8080}
+     * @param {string} sURL
+     * @param {string} sData
+     * @param {number} nErrorCode (response from server if anything other than 200)
+     */
+    doneLoad(sURL, sData, nErrorCode)
+    {
+        if (nErrorCode) {
+            this.notice("Unable to load RAM resource (error " + nErrorCode + ": " + sURL + ")");
+            return;
+        }
+
+        Component.addMachineResource(this.idMachine, sURL, sData);
+
+        var resource = Web.parseMemoryResource(sURL, sData);
+        if (resource) {
+            this.abInit = resource.aBytes;
+            this.aSymbols = resource.aSymbols;
+            if (this.addrLoad == null) this.addrLoad = resource.addrLoad;
+            if (this.addrExec == null) this.addrExec = resource.addrExec;
+        } else {
+            this.sFilePath = null;
+        }
+        this.initRAM();
+    }
+
+    /**
+     * initRAM()
+     *
+     * This function is called by both initBus() and doneLoad(), but it cannot copy the initial data into place
+     * until after initBus() has received the Bus component AND doneLoad() has received the data.  When both those
+     * criteria are satisfied, the component becomes "ready".
+     *
+     * @this {RAM8080}
+     */
+    initRAM()
+    {
+        if (!this.fAllocated && this.sizeRAM) {
+            if (this.bus.addMemory(this.addrRAM, this.sizeRAM, Memory8080.TYPE.RAM)) {
+                this.fAllocated = true;
+            }
+        }
+        if (!this.isReady()) {
+            if (!this.fAllocated) {
+                Component.error("No RAM allocated");
+            }
+            else if (this.sFilePath) {
+                /*
+                 * Too early...
+                 */
+                if (!this.abInit || !this.bus) return;
+
+                var addr = this.addrRAM;
+                if (this.addrLoad !== null) addr = this.addrLoad;
+                for (var i = 0; i < this.abInit.length; i++) {
+                    this.bus.setByteDirect(addr + i, this.abInit[i]);
+                }
+
+                if (this.addrExec !== null) {
+                    /*
+                     * Here's where we enable our "Fake CP/M" support, triggered by the user loading a "writable" ROM image
+                     * at offset 0x100.  Fake CP/M support works by installing HLT opcodes at well-known CP/M addresses
+                     * (namely, 0x0000, which is the CP/M reset vector, and 0x0005, which is the CP/M system call vector) and
+                     * then telling the CPU to call us whenever a HLT occurs, so we can check PC for one of these addresses.
+                     */
+                    if (this.addrExec == RAM8080.CPM.INIT) {
+                        for (i = 0; i < RAM8080.CPM.VECTORS.length; i++) {
+                            this.bus.setByteDirect(RAM8080.CPM.VECTORS[i], CPUDef8080.OPCODE.HLT);
+                        }
+
+                        this.cpu.addHaltCheck(function(rom) {
+                            return function(addr) {
+                                return rom.checkCPMVector(addr)
+                            };
+                        }(this));
+                    }
+                    this.cpu.setReset(this.addrExec);
+                }
+
+                /*
+                 * TODO: Consider an option to retain this data and give the user a way of restoring the initial contents.
+                 */
+                delete this.abInit;
+            }
+            this.setReady();
+        }
+    }
+
+    /**
+     * reset()
+     *
+     * @this {RAM8080}
+     */
+    reset()
+    {
+        /*
+         * If you want to zero RAM on reset, then this would be a good place to do it.
+         */
+    }
+
+    /**
+     * checkCPMVector(addr)
+     *
+     * @this {RAM8080}
+     * @param {number} addr (of the HLT opcode)
+     * @return {boolean} true if special processing performed, false if not
+     */
+    checkCPMVector(addr)
+    {
+        var i = RAM8080.CPM.VECTORS.indexOf(addr);
+        if (i >= 0) {
+            var fCPM = false;
+            var cpu = this.cpu;
+            var dbg = this.dbg;
+            if (addr == RAM8080.CPM.BDOS.VECTOR) {
+                fCPM = true;
+                switch(cpu.regC) {
+                case RAM8080.CPM.BDOS.FUNC.CON_WRITE:
+                    this.writeCPMString(this.getCPMChar(cpu.regE));
+                    break;
+                case RAM8080.CPM.BDOS.FUNC.STR_WRITE:
+                    this.writeCPMString(this.getCPMString(cpu.getDE(), '$'));
+                    break;
+                default:
+                    fCPM = false;
+                    break;
+                }
+            }
+            if (fCPM) {
+                CPUDef8080.opRET.call(cpu);     // for recognized calls, automatically return
+            }
+            else if (dbg) {
+                this.println("\nCP/M vector " + Str.toHexWord(addr));
+                cpu.setPC(addr);                // this is purely for the Debugger's benefit, to show the HLT
+                dbg.stopCPU();
+            }
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * getCPMChar(ch)
+     *
+     * @this {RAM8080}
+     * @param {number} ch
+     * @return {string}
+     */
+    getCPMChar(ch)
+    {
+        return String.fromCharCode(ch);
+    }
+
+    /**
+     * getCPMString(addr, chEnd)
+     *
+     * @this {RAM8080}
+     * @param {number} addr (of a string)
+     * @param {string|number} [chEnd] (terminating character, default is 0)
+     * @return {string}
+     */
+    getCPMString(addr, chEnd)
+    {
+        var s = "";
+        var cchMax = 255;
+        var bEnd = chEnd && chEnd.length && chEnd.charCodeAt(0) || chEnd || 0;
+        while (cchMax--) {
+            var b = this.cpu.getByte(addr++);
+            if (b == bEnd) break;
+            s += String.fromCharCode(b);
+        }
+        return s;
+    }
+
+    /**
+     * writeCPMString(s)
+     *
+     * @this {RAM8080}
+     * @param {string} s
+     */
+    writeCPMString(s)
+    {
+        s = s.replace(/\r/g, '');
+        if (this.controlPrint) {
+            this.controlPrint.value += s;
+            this.controlPrint.scrollTop = this.controlPrint.scrollHeight;
+        }
+    }
+
+    /**
+     * RAM8080.init()
+     *
+     * This function operates on every HTML element of class "ram", extracting the
+     * JSON-encoded parameters for the RAM8080 constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a RAM8080 component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeRAM = Component.getElementsByClass(document, PC8080.APPCLASS, "ram");
+        for (var iRAM = 0; iRAM < aeRAM.length; iRAM++) {
+            var eRAM = aeRAM[iRAM];
+            var parmsRAM = Component.getComponentParms(eRAM);
+            var ram = new RAM8080(parmsRAM);
+            Component.bindComponentControls(ram, eRAM, PC8080.APPCLASS);
+        }
+    }
+}
+
+RAM8080.CPM = {
+    BIOS: {
+        VECTOR:         0x0000
+    },
+    BDOS: {
+        VECTOR:         0x0005,
+        FUNC: {                         // function number (specified in regC)
+            RESET:      0x00,
+            CON_READ:   0x01,           // output: A = L = ASCII character
+            CON_WRITE:  0x02,           // input: E = ASCII character
+            AUX_READ:   0x03,           // output: A = L = ASCII character
+            AUX_WRITE:  0x04,           // input: E = ASCII character
+            PRN_WRITE:  0x05,           // input: E = ASCII character
+            MEM_SIZE:   0x06,           // output: base address of CCP (Console Command Processor), but which register? (perhaps moot if this was CP/M 1.3 only...)
+            CON_IO:     0x06,           // input: E = ASCII character (or 0xFF to return ASCII character in A)
+            GET_IOBYTE: 0x07,
+            SET_IOBYTE: 0x08,
+            STR_WRITE:  0x09            // input: DE = address of string
+        }
+    },
+    INIT:               0x100
+};
+
+RAM8080.CPM.VECTORS = [RAM8080.CPM.BIOS.VECTOR, RAM8080.CPM.BDOS.VECTOR];
+
+/*
+ * Initialize all the RAM8080 modules on the page.
+ */
+Web.onInit(RAM8080.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pc8080/lib/keyboard.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class Keyboard8080 extends Component {
+    /**
+     * Keyboard8080(parmsKbd)
+     *
+     * The Keyboard8080 component has the following component-specific (parmsKbd) properties:
+     *
+     *      model:  eg, "VT100" (should be a member of Keyboard8080.MODELS)
+     *
+     * @this {Keyboard8080}
+     * @param {Object} parmsKbd
+     */
+    constructor(parmsKbd)
+    {
+        super("Keyboard", parmsKbd, Messages8080.KEYBOARD);
+
+        var model = parmsKbd['model'];
+
+        if (model && !Keyboard8080.MODELS[model]) {
+            Component.notice("Unrecognized Keyboard8080 model: " + model);
+        }
+
+        this.config = Keyboard8080.MODELS[model] || {};
+
+        this.reset();
+
+        this.setReady();
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * @this {Keyboard8080}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "esc")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        /*
+         * There's a special binding that the Video component uses ("screen") to effectively bind its
+         * screen to the entire keyboard, in Video.powerUp(); ie:
+         *
+         *      video.kbd.setBinding("canvas", "screen", video.canvasScreen);
+         * or:
+         *      video.kbd.setBinding("textarea", "screen", video.textareaScreen);
+         *
+         * However, it's also possible for the keyboard XML definition to define a control that serves
+         * a similar purpose; eg:
+         *
+         *      <control type="text" binding="kbd" width="2em">Keyboard</control>
+         *
+         * The latter is purely experimental, while we work on finding ways to trigger the soft keyboard on
+         * certain pesky devices (like the Kindle Fire).  Note that even if you use the latter, the former will
+         * still be enabled (there's currently no way to configure the Video component to not bind its screen,
+         * but we could certainly add one if the need ever arose).
+         */
+        var kbd = this;
+        var id = sHTMLType + '-' + sBinding;
+
+        if (this.bindings[id] === undefined) {
+
+            if (sHTMLType == "led" && this.config.LEDCODES[sBinding]) {
+                this.bindings[id] = control;
+                return true;
+            }
+
+            switch (sBinding) {
+            case "kbd":
+            case "screen":
+                /*
+                 * Recording the binding ID prevents multiple controls (or components) from attempting to erroneously
+                 * bind a control to the same ID, but in the case of a "dual display" configuration, we actually want
+                 * to allow BOTH video components to call setBinding() for "screen", so that it doesn't matter which
+                 * display the user gives focus to.
+                 *
+                 *      this.bindings[id] = control;
+                 */
+                if (Web.isUserAgent("iOS")) {
+                    /*
+                     * For iOS devices, it's best to deal only with keypress events.  The main reason is that we don't
+                     * get shift-key events, so we have no way of distinguishing between certain keys, such as ':' and
+                     * ';', unless we are monitoring key presses.  Another reason is that, under certain poorly documented
+                     * conditions, an iOS keyup event will not contain any keyCode; this is most easily reproduced with
+                     * the iOS simulator and a physical keyboard (not the pop-up keyboard).  When this happens, we think
+                     * the key is stuck.  Finally, certain other problems that we have tried to resolve when using a physical
+                     * keyboard (eg, keeping the physical and virtual CAPS-LOCK states in sync) simply don't exist in the
+                     * iOS environment.
+                     *
+                     * So, with all that mind, it seems best to have a separate iOS keypress handler and forego keydown
+                     * and keyup events entirely.  The iOS keypress handler must also perform some additional checks, such
+                     * as watching for keys that can only be typed on the emulated device when a shift key is down, and
+                     * simulating "fake" shift-key down and up events.
+                     *
+                     * Perhaps we can eventually standardize on this alternate keypress-centric approach for ALL devices,
+                     * but until then, it's safer to have these two code paths.
+                     *
+                     * UPDATE: So much for the best laid plans.  iOS won't deliver BACKSPACE events to the keypress handler,
+                     * so we have to deal with keydown/keyup events after all.
+                     */
+                    control.onkeypress = function oniOSKeyPress(event)
+                    {
+                        return kbd.oniOSKeyPress(event);
+                    };
+                    control.onkeydown = function oniOSKeyDown(event)
+                    {
+                        return kbd.oniOSKeyDown(event, true);
+                    };
+                    control.onkeyup = function oniOSKeyUp(event)
+                    {
+                        return kbd.oniOSKeyDown(event, false);
+                    };
+                }
+                else {
+                    control.onkeydown = function onKeyDown(event)
+                    {
+                        return kbd.onKeyDown(event, true);
+                    };
+                    control.onkeyup = function onKeyUp(event)
+                    {
+                        return kbd.onKeyDown(event, false);
+                    };
+                    control.onkeypress = function onKeyPress(event)
+                    {
+                        return kbd.onKeyPress(event);
+                    };
+                }
+                control.onpaste = function onKeyPaste(event)
+                {
+                    return kbd.onPaste(event);
+                };
+                return true;
+
+            default:
+                if (this.config.SOFTCODES && this.config.SOFTCODES[sBinding] !== undefined) {
+                    this.bindings[id] = control;
+                    control.onclick = function(kbd, keyCode) {
+                        return function onKeyboardBindingDown(event) {
+                            /*
+                             * iOS usability improvement: calling preventDefault() prevents rapid clicks from
+                             * also being (mis)interpreted as a desire to "zoom" in on the machine.
+                             */
+                            if (event.preventDefault) event.preventDefault();
+                            /*
+                             * TODO: Add some additional SOFTCODES configuration info that will tell us which soft
+                             * keys (eg, CTRL) should be treated as toggles, instead of hard-coding that knowledge below.
+                             *
+                             * Moreover, if a *real* CTRL or CAPS-LOCK key is pressed or released, it would be nice
+                             * to update the state of these on-screen controls, too (ie, not just when the controls are
+                             * clicked).
+                             */
+                            var fDown = true, bit = 0;
+                            if (keyCode == Keys.KEYCODE.CTRL) {
+                                bit = Keyboard8080.STATE.CTRL;
+                            }
+                            else if (keyCode == Keys.KEYCODE.CAPS_LOCK) {
+                                bit = Keyboard8080.STATE.CAPS_LOCK;
+                            }
+                            if (bit) {
+                                control.style.fontWeight = "normal";
+                                fDown = !(kbd.bitsState & bit);
+                                if (fDown) control.style.fontWeight = "bold";
+                                kbd.checkModifierKeys(keyCode, fDown);
+                            }
+                            kbd.onSoftKeyDown(keyCode, fDown, !bit);
+                            if (kbd.cmp) kbd.cmp.updateFocus();
+                        };
+                    }(this, this.config.SOFTCODES[sBinding]);
+                    //
+                    // var fnUp = function (kbd, keyCode) {
+                    //     return function onKeyboardBindingUp(event) {
+                    //         kbd.onSoftKeyDown(keyCode, false);
+                    //         /*
+                    //          * Give focus back to the machine (since clicking the button takes focus away).
+                    //          *
+                    //          *      if (kbd.cmp) kbd.cmp.updateFocus();
+                    //          *
+                    //          * iOS Usability Improvement: NOT calling updateFocus() keeps the soft keyboard down
+                    //          * (assuming it was already down).
+                    //          */
+                    //     };
+                    // }(this, this.config.SOFTCODES[sBinding]);
+                    //
+                    // if ('ontouchstart' in window) {
+                    //     control.ontouchstart = fnDown;
+                    //     control.ontouchend = fnUp;
+                    // } else {
+                    //     control.onmousedown = fnDown;
+                    //     control.onmouseup = control.onmouseout = fnUp;
+                    // }
+                    //
+                    // UPDATE: Since the only controls that we explicitly bind to SOFTCODES are buttons, I'm simplifying
+                    // the above code with a conventional "onclick" handler.  The only corresponding change I had to make
+                    // to the onclick (formerly fnDown) function was to set fAutoRelease on its call to onSoftKeyDown(),
+                    // since we're no longer attempting to detect when the control (ie, the button) is actually released.
+                    //
+                    // This change also resolves a problem I ran into with the Epiphany (WebKit-based) web browser running
+                    // on the "elementary" (Ubuntu-based) OS, where clicks on the SET-UP button were ignored; perhaps its
+                    // buttons don't generate mouse and/or touch events.  Anyway, an argument for keeping things simple.
+                    //
+                    return true;
+                }
+                break;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {Keyboard8080}
+     * @param {Computer8080} cmp
+     * @param {Bus8080} bus
+     * @param {CPUState8080} cpu
+     * @param {Debugger8080} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cmp = cmp;
+        this.cpu = cpu;
+        this.dbg = dbg;     // NOTE: The "dbg" property must be set for the message functions to work
+
+        var kbd = this;
+        this.timerReleaseKeys = this.cpu.addTimer(function() {
+            kbd.checkSoftKeysToRelease();
+        });
+
+        this.chipset = /** @type {ChipSet8080} */ (cmp.getMachineComponent("ChipSet"));
+
+        this.serial = /** @type {SerialPort8080} */ (cmp.getMachineComponent("SerialPort"));
+
+        bus.addPortInputTable(this, this.config.portsInput);
+        bus.addPortOutputTable(this, this.config.portsOutput);
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {Keyboard8080}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            if (!data) {
+                this.reset();
+            } else {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {Keyboard8080}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * reset()
+     *
+     * @this {Keyboard8080}
+     */
+    reset()
+    {
+        /*
+         * As keyDown events are encountered, a corresponding "softCode" is looked up.  If one is found,
+         * then an entry for the key is added to the aKeysActive array.  Each "key" entry in aKeysActive contains:
+         *
+         *      softCode:           number or string representing the key pressed
+         *      msDown:             timestamp of the most recent "down" event
+         *      fAutoRelease:       true to auto-release the key after MINPRESSTIME (set when "up" occurs too quickly)
+         *
+         * When the key is finally released (or auto-released), its entry is removed from the array.
+         */
+        this.aKeysActive = [];
+
+        /*
+         * The current (assumed) physical (and simulated) states of the various shift/lock keys.
+         *
+         * TODO: Determine how (or whether) we can query the browser's initial shift/lock key states.
+         */
+        this.bitsState = 0;
+
+        if (this.config.INIT && !this.restore(this.config.INIT)) {
+            this.notice("reset error");
+        }
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the Keyboard component.
+     *
+     * @this {Keyboard8080}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        switch(this.config.MODEL) {
+        case Keyboard8080.SI1978.MODEL:
+            break;
+        case Keyboard8080.VT100.MODEL:
+            state.set(0, [this.bVT100Status, this.bVT100Address, this.fVT100UARTBusy, this.nVT100UARTCycleSnap, -1]);
+            break;
+        }
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the Keyboard component.
+     *
+     * @this {Keyboard8080}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        var a;
+        if (data && (a = data[0]) && a.length) {
+            switch(this.config.MODEL) {
+            case Keyboard8080.SI1978.MODEL:
+                return true;
+
+            case Keyboard8080.VT100.MODEL:
+                this.bVT100Status = a[0];
+                this.updateLEDs(this.bVT100Status & Keyboard8080.VT100.STATUS.LEDS);
+                this.bVT100Address = a[1];
+                this.fVT100UARTBusy = a[2];
+                this.nVT100UARTCycleSnap = a[3];
+                this.iKeyNext = a[4];
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * setLED(control, f, color)
+     *
+     * TODO: Add support for user-definable LED colors
+     *
+     * @this {Keyboard8080}
+     * @param {Object} control is an HTML control DOM object
+     * @param {boolean|number} f is true if the LED represented by control should be "on", false if "off"
+     * @param {number} color (ie, 0xff0000 for RED, or 0x00ff00 for GREEN)
+     */
+    setLED(control, f, color)
+    {
+        control.style.backgroundColor = (f? ('#' + Str.toHex(color, 6)) : "#000000");
+    }
+
+    /**
+     * updateLEDs(bLEDs)
+     *
+     * @this {Keyboard8080}
+     * @param {number} [bLEDs]
+     */
+    updateLEDs(bLEDs)
+    {
+        var id, control;
+        if (bLEDs != null) {
+            this.bLEDs = bLEDs;
+        } else {
+            bLEDs = this.bLEDs;
+        }
+        for (var sBinding in this.config.LEDCODES) {
+            id = "led-" + sBinding;
+            control = this.bindings[id];
+            if (control) {
+                var bitLED = this.config.LEDCODES[sBinding];
+                var fOn = !!(bLEDs & bitLED);
+                if (bitLED & (bitLED-1)) {
+                    fOn = !(bLEDs & ~bitLED);
+                }
+                this.setLED(control, fOn, 0xff0000);
+            }
+        }
+        id = "led-caps-lock";
+        control = this.bindings[id];
+        if (control) {
+            this.setLED(control, (this.bitsState & Keyboard8080.STATE.CAPS_LOCK), 0x00ff00);
+        }
+    }
+
+    /**
+     * checkModifierKeys(keyCode, fDown, fRight)
+     *
+     * @this {Keyboard8080}
+     * @param {number} keyCode (ie, either a keycode or string ID)
+     * @param {boolean} fDown (true if key going down, false if key going up)
+     * @param {boolean} [fRight] (true if key is on the right, false if not or unknown or n/a)
+     * @return {boolean} (fDown updated as needed for CAPS-LOCK weirdness)
+     */
+    checkModifierKeys(keyCode, fDown, fRight)
+    {
+        var bit = 0;
+        switch(keyCode) {
+        case Keys.KEYCODE.SHIFT:
+            bit = fRight? Keyboard8080.STATE.RSHIFT : Keyboard8080.STATE.SHIFT;
+            break;
+        case Keys.KEYCODE.CTRL:
+            bit = fRight? Keyboard8080.STATE.RCTRL : Keyboard8080.STATE.CTRL;
+            break;
+        case Keys.KEYCODE.ALT:
+            bit = fRight? Keyboard8080.STATE.RALT : Keyboard8080.STATE.ALT;
+            break;
+        case Keys.KEYCODE.CMD:
+            bit = fRight? Keyboard8080.STATE.RCMD : Keyboard8080.STATE.CMD;
+            break;
+        case Keys.KEYCODE.CAPS_LOCK:
+            bit = Keyboard8080.STATE.CAPS_LOCK;
+            /*
+             * WARNING: You have an entered a browser weirdness zone.  In Chrome, pressing-and-releasing
+             * CAPS-LOCK generates a "down" event when it turns the lock on and an "up" event when it turns
+             * the lock off.  Firefox, OTOH, generates only "down" events, so we have to "manufacture"
+             * the fDown parameter ourselves -- which means we also have to propagate it back to the caller.
+             *
+             * And, while this isn't necessary for Chrome, it doesn't appear to hurt anything in Chrome, so
+             * we're not going to bother making it browser-specific.
+             */
+            fDown = !(this.bitsState & bit);
+            break;
+        }
+        if (bit) {
+            if (fDown) {
+                this.bitsState |= bit;
+            } else {
+                this.bitsState &= ~bit;
+            }
+        }
+        return fDown;
+    }
+
+    /**
+     * getSoftCode(keyCode)
+     *
+     * Returns a number if the keyCode exists in the KEYMAP, or a string if the keyCode has a string ID.
+     *
+     * @this {Keyboard8080}
+     * @return {string|number|null}
+     */
+    getSoftCode(keyCode)
+    {
+        keyCode = this.config.ALTCODES[keyCode] || keyCode;
+        if (this.config.KEYMAP[keyCode]) {
+            return keyCode;
+        }
+        for (var sSoftCode in this.config.SOFTCODES) {
+            if (this.config.SOFTCODES[sSoftCode] === keyCode) {
+                return sSoftCode;
+            }
+        }
+        return null;
+    }
+
+    /**
+     * onKeyDown(event, fDown)
+     *
+     * @this {Keyboard8080}
+     * @param {Object} event
+     * @param {boolean} fDown is true for a keyDown event, false for up
+     * @return {boolean} true to pass the event along, false to consume it
+     */
+    onKeyDown(event, fDown)
+    {
+        var fPass = true;
+        var keyCode = event.keyCode;
+
+        if (!COMPILED && this.messageEnabled(Messages8080.KEYS)) {
+            this.printMessage("onKey" + (fDown? "Down" : "Up") + "(" + keyCode + ")", true);
+        }
+
+        /*
+         * A note about Firefox: it uses different keyCodes for certain keys; there's a logic to the differences
+         * (they use ASCII codes), but since other browsers didn't follow suit, we must use a mapping table to
+         * convert their keyCodes to the more traditional values.
+         */
+        keyCode = Keys.FF_KEYCODES[keyCode] || keyCode;
+
+        /*
+         * We now keep track of physical keyboard modifier keys.  This makes it possible for new services
+         * to eventually be implemented (simulateKeysDown() and simulateKeysUp()), to map special ALT-key
+         * combinations to VT100 keys, etc.
+         */
+        fDown = this.checkModifierKeys(keyCode, fDown, event.location == Keys.LOCATION.RIGHT);
+
+        var softCode = this.getSoftCode(keyCode);
+        if (softCode) {
+            /*
+             * Key combinations involving the "meta" key (ie, the Windows or Command key) are meaningless to
+             * the VT100, so we ignore them.  The "meta" key itself is already effectively ignored, because it's
+             * not acknowledged by getSoftCode(), but we also don't want any of the keys combined with "meta"
+             * slipping through either.
+             */
+            if (!event.metaKey) {
+                /*
+                 * The LINE-FEED key is an important key on the VT100, and while we DO map a host function key
+                 * to it (F7), I like the idea of making ALT-ENTER an alias for LINE-FEED as well.  Ditto for
+                 * making ALT-DELETE an alias for BACKSPACE (and no, I don't mean ALT-BACKSPACE as an alias for
+                 * DELETE; see my earlier discussion involving BACKSPACE and DELETE).
+                 *
+                 * Of course, as experienced VT100 users know, it's always possible to type CTRL-J for LINE-FEED
+                 * and CTRL-H for BACKSPACE, too.  But not all our users are that experienced.
+                 *
+                 * I was also tempted to use CTRL-ENTER or SHIFT-ENTER, but those are composable VT100 key
+                 * sequences, so it's best not to muck with those.
+                 *
+                 * Finally, this hack is complicated by the fact that if the ALT key is released first, we run
+                 * the risk of the remapped key being stuck "down".  Hence the new REMAPPED bit, which should
+                 * remain set (as a "proxy" for the ALT bit) as long as a remapped key is down.
+                 */
+                var fRemapped = false;
+                if (this.bitsState & (Keyboard8080.STATE.ALTS | Keyboard8080.STATE.REMAPPED)) {
+                    if (softCode == Keys.KEYCODE.CR) {
+                        softCode = Keys.KEYCODE.F7;
+                        fRemapped = true;
+                    }
+                    else if (softCode == Keys.KEYCODE.BS) {
+                        softCode = Keys.KEYCODE.DEL;
+                        fRemapped = true;
+                    }
+                    if (fRemapped) {
+                        if (fDown) {
+                            this.bitsState |= Keyboard8080.STATE.REMAPPED;
+                        } else {
+                            this.bitsState &= ~Keyboard8080.STATE.REMAPPED;
+                        }
+                    }
+                }
+                fPass = this.onSoftKeyDown(softCode, fDown);
+                /*
+                 * As onKeyPress() explains, the only key presses we're interested in are letters, which provide
+                 * an important clue regarding the CAPS-LOCK state.  For all other keys, we call preventDefault(),
+                 * which normally "suppresses" the keyPress event, as well as other unwanted browser behaviors
+                 * (eg, the SPACE key, which browsers interpret as a desire to scroll the entire web page down).
+                 *
+                 * And, even if the key IS a letter, we STILL want to call preventDefault() if a CTRL key is down,
+                 * so that Windows-based browsers (eg, Edge) don't interfere with their stupid CTRL-based shortcuts. ;-)
+                 *
+                 * NOTE: We COULD check event.ctrlKey too, but it's six of one, half a dozen of another.
+                 */
+                if (!(softCode >= Keys.ASCII.A && softCode <= Keys.ASCII.Z) || (this.bitsState | Keyboard8080.STATE.CTRLS)) {
+                    if (event.preventDefault) event.preventDefault();
+                }
+            }
+        }
+
+        if (!COMPILED && this.messageEnabled(Messages8080.KEYS)) {
+            this.printMessage("onKey" + (fDown? "Down" : "Up") + "(" + keyCode + "): softCode=" + softCode + ", pass=" + fPass, true);
+        }
+
+        return fPass;
+    }
+
+    /**
+     * onKeyPress(event)
+     *
+     * For now, our only interest in keyPress events is letters, as a means of detecting the CAPS-LOCK state.
+     *
+     * @this {Keyboard8080}
+     * @param {Object} event
+     * @return {boolean} true to pass the event along, false to consume it
+     */
+    onKeyPress(event)
+    {
+        /*
+         * A note about Firefox: the KeyboardEvent they pass to a keypress handler doesn't set 'keyCode', so
+         * we have to fallback to 'charCode' (or 'which'), both of which are deprecated but realistically can't
+         * really go away.
+         *
+         * TODO: Consider "upgrading" this code to use the new 'key' property.  Note, however, that it's a string,
+         * not a number; for example; if the colon key is pressed, 'key' will be ":", whereas 'charCode' and 'which'
+         * will be 58.
+         */
+        var charCode = event.keyCode || event.charCode;
+
+        if (charCode >= Keys.ASCII.A && charCode <= Keys.ASCII.Z) {
+            if (!(this.bitsState & (Keyboard8080.STATE.SHIFTS | Keyboard8080.STATE.CAPS_LOCK))) {
+                this.bitsState |= Keyboard8080.STATE.CAPS_LOCK;
+                this.onSoftKeyDown(Keys.KEYCODE.CAPS_LOCK, true);
+                this.updateLEDs();
+            }
+        }
+        else if (charCode >= Keys.ASCII.a && charCode <= Keys.ASCII.z) {
+            if (this.bitsState & Keyboard8080.STATE.CAPS_LOCK) {
+                this.bitsState &= ~Keyboard8080.STATE.CAPS_LOCK;
+                this.onSoftKeyDown(Keys.KEYCODE.CAPS_LOCK, false);
+                this.updateLEDs();
+            }
+        }
+
+        if (!COMPILED && this.messageEnabled(Messages8080.KEYS)) {
+            this.printMessage("onKeyPress(" + charCode + ")", true);
+        }
+
+        return true;
+    }
+
+    /**
+     * oniOSKeyDown(event, fDown)
+     *
+     * @this {Keyboard8080}
+     * @param {Object} event
+     * @param {boolean} fDown is true for a keyDown event, false for up
+     * @return {boolean} true to pass the event along, false to consume it
+     */
+    oniOSKeyDown(event, fDown)
+    {
+        var fPass = true;
+        /*
+         * Because keydown/keyup events on iOS are inherently "fake", they can be delivered so quickly that
+         * if we generated matching down/up events, then the emulated machine might not see the key transition.
+         * So we now deliver only down events, with fAutoRelease always set (see below).
+         *
+         * Also, because of iOS weirdness discussed in setBinding() when using a physical keyboard, the keyup
+         * event may not provide a valid keyCode, which is another reason we have no choice but to always deliver
+         * keys with fAutoRelease set to true.
+         */
+        if (fDown) {
+            var keyCode = event.keyCode;
+            var bMapping = this.config.KEYMAP[keyCode];
+            if (bMapping) {
+                /*
+                 * If this is a mappable key, but the mapping isn't in the CHARMAP table, then we have to process
+                 * it now; the most common reason is that the key doesn't generate a keypress event (eg, BACKSPACE).
+                 */
+                if (!this.indexOfCharMap(bMapping)) {
+                    fPass = this.onSoftKeyDown(keyCode, fDown, true);
+                    if (event.preventDefault) event.preventDefault();
+                    if (!COMPILED && this.messageEnabled(Messages8080.KEYS)) {
+                        this.printMessage("oniOSKey" + (fDown ? "Down" : "Up") + "(" + keyCode + "): pass=" + fPass, true);
+                    }
+                }
+            }
+        }
+        return fPass;
+    }
+
+    /**
+     * oniOSKeyPress(event)
+     *
+     * @this {Keyboard8080}
+     * @param {Object} event
+     * @return {boolean} true to pass the event along, false to consume it
+     */
+    oniOSKeyPress(event)
+    {
+        /*
+         * A note about Firefox: the KeyboardEvent they pass to a keypress handler doesn't set 'keyCode', so
+         * we have to fallback to 'charCode' (or 'which'), both of which are deprecated but realistically can't
+         * really go away.
+         *
+         * TODO: Consider "upgrading" this code to use the new 'key' property.  Note, however, that it's a string,
+         * not a number; for example; if the colon key is pressed, 'key' will be ":", whereas 'charCode' and 'which'
+         * will be 58.
+         */
+        var charCode = event.keyCode || event.charCode;
+
+        var fShifted = false;
+        var bMapping = this.config.CHARMAP[charCode];
+        if (bMapping) {
+            if (bMapping & 0x80) {
+                bMapping &= 0x7f;
+                fShifted = true;
+            }
+            /*
+             * Since the rest of our code was built around keyCodes, not charCodes, we look up the CHARMAP byte
+             * in the KEYMAP table to find a corresponding keyCode, and that's what we'll use to simulate the key
+             * press/release.
+             */
+            var softCode = this.indexOfKeyMap(bMapping);
+            if (softCode) {
+                if (!fShifted) {
+                    this.onSoftKeyDown(Keys.KEYCODE.SHIFT, false);
+                } else {
+                    this.onSoftKeyDown(Keys.KEYCODE.SHIFT, true, true);
+                }
+                this.onSoftKeyDown(softCode, true, true);
+            }
+        }
+
+        if (!COMPILED && this.messageEnabled(Messages8080.KEYS)) {
+            this.printMessage("oniOSKeyPress(" + charCode + ")", true);
+        }
+
+        return true;
+    }
+
+    /**
+     * onPaste(event)
+     *
+     * @this {Keyboard8080}
+     * @param {Object} event
+     * @return {boolean} true to pass the event along, false to consume it
+     */
+    onPaste(event)
+    {
+        /*
+         * TODO: In a perfect world, we would have implemented simulateKeysDown() and simulateKeysUp(),
+         * which would transform any given text into the appropriate keystrokes.  But for now, we're going
+         * to leapfrog all that and try invoking the SerialPort's sendData() function, which if available,
+         * is nothing more than a call into a connected machine's receiveData() function.
+         *
+         * Besides, paste functionality doesn't seem to be consistently implemented across all browsers
+         * (partly out of security concerns, apparently) so it may not make sense to expend much more
+         * effort on this right now.  If you want to paste a lot of text into a machine, you're better off
+         * pasting into a machine that's been configured to use a textarea as part of its Control Panel.
+         * A visible textarea seems to have less issues than the hidden textarea overlaid on top of our
+         * Video display.
+         */
+        if (this.serial && this.serial.sendData) {
+            if (event.stopPropagation) event.stopPropagation();
+            if (event.preventDefault) event.preventDefault();
+            var clipboardData = event.clipboardData || window.clipboardData;
+            if (clipboardData) {
+                this.serial.transmitData(clipboardData.getData('Text'));
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * indexOfKeyMap(bMapping)
+     *
+     * @this {Keyboard8080}
+     * @param {number} bMapping
+     * @return {number}
+     */
+    indexOfKeyMap(bMapping)
+    {
+        for (var keyCode in this.config.KEYMAP) {
+            if (this.config.KEYMAP[keyCode] == bMapping) return +keyCode;
+        }
+        return 0;
+    }
+
+    /**
+     * indexOfCharMap(bMapping)
+     *
+     * @this {Keyboard8080}
+     * @param {number} bMapping
+     * @return {number}
+     */
+    indexOfCharMap(bMapping)
+    {
+        for (var charCode in this.config.CHARMAP) {
+            if (this.config.CHARMAP[charCode] == bMapping) return +charCode;
+        }
+        return 0;
+    }
+
+    /**
+     * indexOfSoftKey(softCode)
+     *
+     * @this {Keyboard8080}
+     * @param {number|string} softCode
+     * @return {number} index of softCode in aKeysActive, or -1 if not found
+     */
+    indexOfSoftKey(softCode)
+    {
+        for (var i = 0; i < this.aKeysActive.length; i++) {
+            if (this.aKeysActive[i].softCode == softCode) return i;
+        }
+        return -1;
+    }
+
+    /**
+     * onSoftKeyDown(softCode, fDown, fAutoRelease)
+     *
+     * @this {Keyboard8080}
+     * @param {number|string} softCode
+     * @param {boolean} fDown is true for a down event, false for up
+     * @param {boolean} [fAutoRelease] is true only if we know we want the key to auto-release
+     * @return {boolean} true to pass the event along, false to consume it
+     */
+    onSoftKeyDown(softCode, fDown, fAutoRelease)
+    {
+        var i = this.indexOfSoftKey(softCode);
+        if (fDown) {
+            // this.println(softCode + " down");
+            if (i < 0) {
+                this.aKeysActive.push({
+                    softCode: softCode,
+                    msDown: Date.now(),
+                    fAutoRelease: fAutoRelease || false
+                });
+            } else {
+                this.aKeysActive[i].msDown = Date.now();
+                this.aKeysActive[i].fAutoRelease = fAutoRelease || false;
+            }
+            if (fAutoRelease) this.checkSoftKeysToRelease();        // prime the pump
+        } else if (i >= 0) {
+            // this.println(softCode + " up");
+            if (!this.aKeysActive[i].fAutoRelease) {
+                var msDown = this.aKeysActive[i].msDown;
+                if (msDown) {
+                    var msElapsed = Date.now() - msDown;
+                    if (msElapsed < Keyboard8080.MINPRESSTIME) {
+                        // this.println(softCode + " released after only " + msElapsed + "ms");
+                        this.aKeysActive[i].fAutoRelease = true;
+                        this.checkSoftKeysToRelease();
+                        return true;
+                    }
+                }
+            }
+            this.aKeysActive.splice(i, 1);
+        } else {
+            // this.println(softCode + " up with no down?");
+        }
+
+        if (this.chipset) {
+            var bit = 0;
+            switch(softCode) {
+            case '1p':
+                bit = ChipSet8080.SI1978.STATUS1.P1;
+                break;
+            case '2p':
+                bit = ChipSet8080.SI1978.STATUS1.P2;
+                break;
+            case 'coin':
+                bit = ChipSet8080.SI1978.STATUS1.CREDIT;
+                break;
+            case 'left':
+                bit = ChipSet8080.SI1978.STATUS1.P1_LEFT;
+                break;
+            case 'right':
+                bit = ChipSet8080.SI1978.STATUS1.P1_RIGHT;
+                break;
+            case 'fire':
+                bit = ChipSet8080.SI1978.STATUS1.P1_FIRE;
+                break;
+            }
+            if (bit) {
+                this.chipset.updateStatus1(bit, fDown);
+            }
+        }
+        return true;
+    }
+
+    /**
+     * checkSoftKeysToRelease()
+     *
+     * @this {Keyboard8080}
+     */
+    checkSoftKeysToRelease()
+    {
+        var i = 0;
+        var msDelayMin = -1;
+        while (i < this.aKeysActive.length) {
+            if (this.aKeysActive[i].fAutoRelease) {
+                var softCode = this.aKeysActive[i].softCode;
+                var msDown = this.aKeysActive[i].msDown;
+                var msElapsed = Date.now() - msDown;
+                var msDelay = Keyboard8080.MINPRESSTIME - msElapsed;
+                if (msDelay > 0) {
+                    if (msDelayMin < 0 || msDelayMin > msDelay) {
+                        msDelayMin = msDelay;
+                    }
+                } else {
+                    /*
+                     * Because the key is already in the auto-release state, this next call guarantees that the
+                     * key will be removed from the array; a consequence of that removal, however, is that we must
+                     * reset our array index to zero.
+                     */
+                    this.onSoftKeyDown(softCode, false);
+                    i = 0;
+                    continue;
+                }
+            }
+            i++;
+        }
+        if (msDelayMin >= 0) {
+            /*
+             * Replaced the klunky browser setTimeout() call with our own timer service.
+             *
+             *      var kbd = this;
+             *      setTimeout(function() { kbd.checkSoftKeysToRelease(); }, msDelayMin);
+             */
+            this.cpu.setTimer(this.timerReleaseKeys, msDelayMin);
+        }
+    }
+
+    /**
+     * isVT100TransmitterReady()
+     *
+     * Called whenever the VT100 ChipSet circuit needs the Keyboard UART's transmitter status.
+     *
+     * From p. 4-32 of the VT100 Technical Manual (July 1982):
+     *
+     *      The operating clock for the keyboard interface comes from an address line in the video processor (LBA4).
+     *      This signal has an average period of 7.945 microseconds. Each data byte is transmitted with one start bit
+     *      and one stop bit, and each bit lasts 16 clock periods. The total time for each data byte is 160 times 7.945
+     *      or 1.27 milliseconds. Each time the Transmit Buffer Empty flag on the terminal's UART gets set (when the
+     *      current byte is being transmitted), the microprocessor loads another byte into the transmit buffer. In this
+     *      way, the stream of status bytes to the keyboard is continuous.
+     *
+     * We used to always return true (after all, what's wrong with an infinitely fast UART?), but unfortunately,
+     * the VT100 firmware relies on the UART's slow transmission speed to drive cursor blink rate.  We have several
+     * options:
+     *
+     *      1) Snapshot the CPU cycle count each time a byte is transmitted (see outVT100UARTStatus()) and then every
+     *      time this is polled, see if the cycle count has exceeded the snapshot value by the necessary threshold;
+     *      if we assume 361.69ns per CPU cycle, there are 22 CPU cycles for every 1 LBA4 cycle, and since transmission
+     *      time is supposed to last for 160 LBA4 cycles, the threshold is 22*160 CPU cycles, or 3520 cycles.
+     *
+     *      2) Set a CPU timer using the new setTimer() interface, which can be passed the number of milliseconds to
+     *      wait before firing (in this case, roughly 1.27ms).
+     *
+     *      3) Call the ChipSet's getVT100LBA(4) function for the state of the simulated LBA4, and count 160 LBA4
+     *      transitions; however, that would be the worst solution, because there's no guarantee that the firmware's
+     *      UART polling will occur regularly and/or frequently enough for us to catch every LBA4 transition.
+     *
+     * I'm going with solution #1 because it's less overhead.
+     *
+     * @this {Keyboard8080}
+     * @return {boolean} (true if ready, false if not)
+     */
+    isVT100TransmitterReady()
+    {
+        if (this.fVT100UARTBusy) {
+            /*
+             * NOTE: getMSCycles(1.2731488) should work out to 3520 cycles for a CPU clocked at 361.69ns per cycle,
+             * which is roughly 2.76Mhz.  We could just hard-code 3520 instead of calling getMSCycles(), but this helps
+             * maintain a reasonable blink rate for the cursor even when the user cranks up the CPU speed.
+             */
+            if (this.cpu.getCycles() >= this.nVT100UARTCycleSnap + this.cpu.getMSCycles(1.2731488)) {
+                this.fVT100UARTBusy = false;
+            }
+        }
+        return !this.fVT100UARTBusy;
+    }
+
+    /**
+     * inVT100UARTAddress(port, addrFrom)
+     *
+     * We take our cue from iKeyNext.  If it's -1 (default), we simply return the last value latched
+     * in bVT100Address.  Otherwise, if iKeyNext is a valid index into aKeysActive, we look up the key
+     * in the VT100.KEYMAP, latch it, and increment iKeyNext.  Failing that, we latch Keyboard8080.VT100.KEYLAST
+     * and reset iKeyNext to -1.
+     *
+     * @this {Keyboard8080}
+     * @param {number} port (0x82)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to write the specified port)
+     * @return {number} simulated port value
+     */
+    inVT100UARTAddress(port, addrFrom)
+    {
+        var b = this.bVT100Address;
+        if (this.iKeyNext >= 0) {
+            if (this.iKeyNext < this.aKeysActive.length) {
+                var key = this.aKeysActive[this.iKeyNext];
+                if (!MAXDEBUG) {
+                    this.iKeyNext++;
+                } else {
+                    /*
+                     * In MAXDEBUG builds, this code removes the key as soon as it's been reported, because
+                     * when debugging, it's easy for the window to lose focus and never receive the keyUp event,
+                     * thereby leaving us with a stuck key.  However, this may cause more problems than it solves,
+                     * because the VT100's ROM seems to require that key presses persist for more than a single poll.
+                     */
+                    this.aKeysActive.splice(this.iKeyNext, 1);
+                }
+                b = Keyboard8080.VT100.KEYMAP[key.softCode];
+                if (b & 0x80) {
+                    /*
+                     * TODO: This code is supposed to be accompanied by a SHIFT key; make sure that it is.
+                     */
+                    b &= 0x7F;
+                }
+            } else {
+                this.iKeyNext = -1;
+                b = Keyboard8080.VT100.KEYLAST;
+            }
+            this.bVT100Address = b;
+            this.cpu.requestINTR(1);
+        }
+        this.printMessageIO(port, null, addrFrom, "KBDUART.ADDRESS", b);
+        return b;
+    }
+
+    /**
+     * outVT100UARTStatus(port, b, addrFrom)
+     *
+     * @this {Keyboard8080}
+     * @param {number} port (0x82)
+     * @param {number} b
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to write the specified port)
+     */
+    outVT100UARTStatus(port, b, addrFrom)
+    {
+        this.printMessageIO(port, b, addrFrom, "KBDUART.STATUS");
+        this.bVT100Status = b;
+        this.fVT100UARTBusy = true;
+        this.nVT100UARTCycleSnap = this.cpu.getCycles();
+        this.updateLEDs(b & Keyboard8080.VT100.STATUS.LEDS);
+        if (b & Keyboard8080.VT100.STATUS.START) {
+            this.iKeyNext = 0;
+            this.cpu.requestINTR(1);
+        }
+    }
+
+    /**
+     * Keyboard8080.init()
+     *
+     * This function operates on every HTML element of class "keyboard", extracting the
+     * JSON-encoded parameters for the Keyboard constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a Keyboard component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeKbd = Component.getElementsByClass(document, PC8080.APPCLASS, "keyboard");
+        for (var iKbd = 0; iKbd < aeKbd.length; iKbd++) {
+            var eKbd = aeKbd[iKbd];
+            var parmsKbd = Component.getComponentParms(eKbd);
+            var kbd = new Keyboard8080(parmsKbd);
+            Component.bindComponentControls(kbd, eKbd, PC8080.APPCLASS);
+        }
+    }
+}
+
+/*
+ * Now that we want to keep track of the physical (and simulated) state of modifier keys, I've
+ * grabbed a copy of the same bit definitions used by /modules/pcx86/lib/keyboard.js, since it's
+ * only important that we have a set of unique values; what the values are isn't critical.
+ */
+Keyboard8080.STATE = {
+    RSHIFT:         0x0001,
+    SHIFT:          0x0002,
+    SHIFTS:         0x0003,
+    RCTRL:          0x0004,             // 101-key keyboard only
+    CTRL:           0x0008,
+    CTRLS:          0x000C,
+    RALT:           0x0010,             // 101-key keyboard only
+    ALT:            0x0020,
+    ALTS:           0x0030,
+    RCMD:           0x0040,             // 101-key keyboard only
+    CMD:            0x0080,             // 101-key keyboard only
+    CMDS:           0x00C0,
+    ALL_RIGHT:      0x0055,             // RSHIFT | RCTRL | RALT | RCMD
+    ALL_SHIFT:      0x00FF,             // SHIFT | RSHIFT | CTRL | RCTRL | ALT | RALT | CMD | RCMD
+    INSERT:         0x0100,             // TODO: Placeholder (we currently have no notion of any "insert" states)
+    CAPS_LOCK:      0x0200,
+    NUM_LOCK:       0x0400,
+    SCROLL_LOCK:    0x0800,
+    ALL_LOCKS:      0x0E00,             // CAPS_LOCK | NUM_LOCK | SCROLL_LOCK
+    REMAPPED:       0x1000
+};
+
+Keyboard8080.MINPRESSTIME = 50;         // minimum milliseconds to wait before auto-releasing keys
+
+/**
+ * Alternate keyCode mappings to support popular "WASD"-style directional-key mappings.
+ *
+ * TODO: ES6 computed property name support may now be in all mainstream browsers, allowing us to use
+ * a simple object literal for this and all other object initializations.
+ */
+Keyboard8080.WASDCODES = {};
+Keyboard8080.WASDCODES[Keys.ASCII.A] = Keys.KEYCODE.LEFT;
+Keyboard8080.WASDCODES[Keys.ASCII.D] = Keys.KEYCODE.RIGHT;
+Keyboard8080.WASDCODES[Keys.ASCII.L] = Keys.KEYCODE.SPACE;
+
+/*
+ * Supported keyboard configurations.
+ *
+ * A word (or two) about SOFTCODES.  Their main purpose is to provide a naming convention for machine-specific
+ * controls, without tying us to any particular keyboard mapping.  They are used in two main ways.
+ *
+ * First, if we have a binding to the machine's "screen", there will, at a minimum, be onkeydown and onkeyup
+ * handlers attached to the screen, and those handlers will need to iterate through the SOFTCODES table, looking
+ * for key codes that we care about and converting them to corresponding soft codes.  Some machines, like
+ * Space Invaders, will then act directly upon the soft code (eg, converting it to a machine-specific status bit).
+ *
+ * Second, a machine may have other bindings (eg, buttons) to one or more of these soft codes, and those bindings
+ * will need to know which key codes they're supposed to generate.  Some machines, like the VT100, will then use
+ * another table (KEYMAP) to convert key codes into a machine-specific "key addresses".
+ */
+Keyboard8080.SI1978 = {
+    MODEL:          1978.1,
+    KEYMAP:         {},
+    CHARMAP:        {},
+    ALTCODES:       Keyboard8080.WASDCODES,
+    LEDCODES:       {},
+    SOFTCODES: {
+        '1p':       Keys.KEYCODE.ONE,
+        '2p':       Keys.KEYCODE.TWO,
+        'coin':     Keys.KEYCODE.THREE,
+        'left':     Keys.KEYCODE.LEFT,
+        'right':    Keys.KEYCODE.RIGHT,
+        'fire':     Keys.KEYCODE.SPACE
+    }
+};
+
+Keyboard8080.VT100 = {
+    MODEL:          100.0,
+    KEYMAP: {
+        /*
+         * Map of keydown keyCodes to VT100 key addresses (7-bit values representing key positions on the VT100).
+         *
+         * NOTE: The VT100 keyboard has both BACKSPACE and DELETE keys, whereas modern keyboards generally only
+         * have DELETE.  And sadly, when you press DELETE, your modern keyboard and/or modern browser is reporting
+         * it as keyCode 8: the code for BACKSPACE, aka CTRL-H.  You have to press a modified DELETE key to get
+         * the actual DELETE keyCode of 127.
+         *
+         * We resolve this below by mapping KEYCODE.BS (8) to VT100 keyCode DELETE (0x03) and KEYCODE.DEL (127)
+         * to VT100 keyCode BACKSPACE (0x33).  So, DELETE is BACKSPACE and BACKSPACE is DELETE.  Fortunately, this
+         * confusion is all internal, because your physical key is (or should be) labeled DELETE, so the fact that
+         * the browser is converting it to BACKSPACE and that we're converting BACKSPACE back into DELETE is
+         * something most people don't need to worry their heads about.
+         *
+         * ES6 ALERT: As you can see below, I've finally started using computed property names.
+         */
+        [Keys.KEYCODE.BS]:      0x03,
+        [Keys.ASCII.P]:         0x05,
+        [Keys.ASCII.O]:         0x06,
+        [Keys.ASCII.Y]:         0x07,
+        [Keys.ASCII.T]:         0x08,
+        [Keys.ASCII.W]:         0x09,
+        [Keys.ASCII.Q]:         0x0A,
+        [Keys.KEYCODE.RIGHT]:   0x10,
+        [Keys.KEYCODE.RBRACK]:  0x14,
+        [Keys.KEYCODE.LBRACK]:  0x15,
+        [Keys.ASCII.I]:         0x16,
+        [Keys.ASCII.U]:         0x17,
+        [Keys.ASCII.R]:         0x18,
+        [Keys.ASCII.E]:         0x19,
+        [Keys.KEYCODE.ONE]:     0x1A,
+        [Keys.KEYCODE.LEFT]:    0x20,
+        [Keys.KEYCODE.DOWN]:    0x22,
+        [Keys.KEYCODE.F6]:      0x23,   // aka BREAK
+        [Keys.KEYCODE.PAUSE]:   0x23,   // aka BREAK
+        [Keys.KEYCODE.BQUOTE]:  0x24,
+        [Keys.KEYCODE.DASH]:    0x25,
+        [Keys.KEYCODE.NINE]:    0x26,
+        [Keys.KEYCODE.SEVEN]:   0x27,
+        [Keys.KEYCODE.FOUR]:    0x28,
+        [Keys.KEYCODE.THREE]:   0x29,
+        [Keys.KEYCODE.ESC]:     0x2A,
+        [Keys.KEYCODE.UP]:      0x30,
+        [Keys.KEYCODE.F3]:      0x31,   // aka PF3
+        [Keys.KEYCODE.F1]:      0x32,   // aka PF1
+        [Keys.KEYCODE.DEL]:     0x33,
+        [Keys.KEYCODE.EQUALS]:  0x34,
+        [Keys.KEYCODE.ZERO]:    0x35,
+        [Keys.KEYCODE.EIGHT]:   0x36,
+        [Keys.KEYCODE.SIX]:     0x37,
+        [Keys.KEYCODE.FIVE]:    0x38,
+        [Keys.KEYCODE.TWO]:     0x39,
+        [Keys.KEYCODE.TAB]:     0x3A,
+        [Keys.KEYCODE.NUM_7]:   0x40,
+        [Keys.KEYCODE.F4]:      0x41,   // aka PF4
+        [Keys.KEYCODE.F2]:      0x42,   // aka PF2
+        [Keys.KEYCODE.NUM_0]:   0x43,
+        [Keys.KEYCODE.F7]:      0x44,   // aka LINE-FEED
+        [Keys.KEYCODE.BSLASH]:  0x45,
+        [Keys.ASCII.L]:         0x46,
+        [Keys.ASCII.K]:         0x47,
+        [Keys.ASCII.G]:         0x48,
+        [Keys.ASCII.F]:         0x49,
+        [Keys.ASCII.A]:         0x4A,
+        [Keys.KEYCODE.NUM_8]:   0x50,
+        [Keys.KEYCODE.NUM_CR]:  0x51,
+        [Keys.KEYCODE.NUM_2]:   0x52,
+        [Keys.KEYCODE.NUM_1]:   0x53,
+        [Keys.KEYCODE.QUOTE]:   0x55,
+        [Keys.KEYCODE.SEMI]:    0x56,
+        [Keys.ASCII.J]:         0x57,
+        [Keys.ASCII.H]:         0x58,
+        [Keys.ASCII.D]:         0x59,
+        [Keys.ASCII.S]:         0x5A,
+        [Keys.KEYCODE.NUM_DEL]: 0x60,   // keypad period
+        [Keys.KEYCODE.F5]:      0x61,   // aka KEYPAD COMMA
+        [Keys.KEYCODE.NUM_5]:   0x62,
+        [Keys.KEYCODE.NUM_4]:   0x63,
+        [Keys.KEYCODE.CR]:      0x64,   // TODO: Figure out why the Technical Manual lists CR at both 0x04 and 0x64
+        [Keys.KEYCODE.PERIOD]:  0x65,
+        [Keys.KEYCODE.COMMA]:   0x66,
+        [Keys.ASCII.N]:         0x67,
+        [Keys.ASCII.B]:         0x68,
+        [Keys.ASCII.X]:         0x69,
+        [Keys.KEYCODE.F8]:      0x6A,   // aka NO-SCROLL
+        [Keys.KEYCODE.NUM_9]:   0x70,
+        [Keys.KEYCODE.NUM_3]:   0x71,
+        [Keys.KEYCODE.NUM_6]:   0x72,
+        [Keys.KEYCODE.NUM_SUB]: 0x73,   // aka KEYPAD MINUS
+        [Keys.KEYCODE.SLASH]:   0x75,
+        [Keys.ASCII.M]:         0x76,
+        [Keys.ASCII[' ']]:      0x77,
+        [Keys.ASCII.V]:         0x78,
+        [Keys.ASCII.C]:         0x79,
+        [Keys.ASCII.Z]:         0x7A,
+        [Keys.KEYCODE.F9]:      0x7B,   // aka SET-UP
+        [Keys.KEYCODE.CTRL]:    0x7C,
+        [Keys.KEYCODE.SHIFT]:   0x7D,   // either shift key (doesn't matter)
+        [Keys.KEYCODE.CAPS_LOCK]:0x7E
+    },
+    CHARMAP: {
+        /*
+         * Map of keypress charCodes to VT100 key addresses (7-bit values representing key positions on the VT100);
+         * the 8th bit (0x80) is set for keys that need to be shifted.
+         *
+         * This is currently used only with the iOS keypress handler, which processes character codes rather than
+         * keyboard codes.  As a result, this table is not as complete as the KEYMAP table, since certain keys are
+         * not delivered as key presses (eg, BACKSPACE) and/or are simply not present on the iOS keyboard (eg, ESC,
+         * arrow keys).  Also, SPACE had to be removed from the CHARMAP table as well, because otherwise it causes
+         * the entire page to scroll down (you have to wonder who thought THAT was a good idea).
+         *
+         * ES6 ALERT: As you can see below, I've finally started using computed property names.
+         */
+        [Keys.ASCII.p]:         0x05,
+        [Keys.ASCII.o]:         0x06,
+        [Keys.ASCII.y]:         0x07,
+        [Keys.ASCII.t]:         0x08,
+        [Keys.ASCII.w]:         0x09,
+        [Keys.ASCII.q]:         0x0A,
+        [Keys.ASCII[']']]:      0x14,
+        [Keys.ASCII['[']]:      0x15,
+        [Keys.ASCII.i]:         0x16,
+        [Keys.ASCII.u]:         0x17,
+        [Keys.ASCII.r]:         0x18,
+        [Keys.ASCII.e]:         0x19,
+        [Keys.ASCII['1']]:      0x1A,
+        [Keys.ASCII['`']]:      0x24,
+        [Keys.ASCII['-']]:      0x25,
+        [Keys.ASCII['9']]:      0x26,
+        [Keys.ASCII['7']]:      0x27,
+        [Keys.ASCII['4']]:      0x28,
+        [Keys.ASCII['3']]:      0x29,
+        [Keys.ASCII['=']]:      0x34,
+        [Keys.ASCII['0']]:      0x35,
+        [Keys.ASCII['8']]:      0x36,
+        [Keys.ASCII['6']]:      0x37,
+        [Keys.ASCII['5']]:      0x38,
+        [Keys.ASCII['2']]:      0x39,
+        [Keys.ASCII['\\']]:     0x45,
+        [Keys.ASCII.l]:         0x46,
+        [Keys.ASCII.k]:         0x47,
+        [Keys.ASCII.g]:         0x48,
+        [Keys.ASCII.f]:         0x49,
+        [Keys.ASCII.a]:         0x4A,
+        [Keys.ASCII["'"]]:      0x55,
+        [Keys.ASCII[';']]:      0x56,
+        [Keys.ASCII.j]:         0x57,
+        [Keys.ASCII.h]:         0x58,
+        [Keys.ASCII.d]:         0x59,
+        [Keys.ASCII.s]:         0x5A,
+        [Keys.KEYCODE.CR]:      0x64,   // TODO: Figure out why the Technical Manual lists CR at both 0x04 and 0x64
+        [Keys.ASCII['.']]:      0x65,
+        [Keys.ASCII[',']]:      0x66,
+        [Keys.ASCII.n]:         0x67,
+        [Keys.ASCII.b]:         0x68,
+        [Keys.ASCII.x]:         0x69,
+        [Keys.ASCII['/']]:      0x75,
+        [Keys.ASCII.m]:         0x76,
+     // [Keys.ASCII[' ']]:      0x77,   // as noted above, we need to process SPACE at keydown rather than keypress
+        [Keys.ASCII.v]:         0x78,
+        [Keys.ASCII.c]:         0x79,
+        [Keys.ASCII.z]:         0x7A,
+        [Keys.ASCII.P]:         0x85,
+        [Keys.ASCII.O]:         0x86,
+        [Keys.ASCII.Y]:         0x87,
+        [Keys.ASCII.T]:         0x88,
+        [Keys.ASCII.W]:         0x89,
+        [Keys.ASCII.Q]:         0x8A,
+        [Keys.ASCII['}']]:      0x94,
+        [Keys.ASCII['{']]:      0x95,
+        [Keys.ASCII.I]:         0x96,
+        [Keys.ASCII.U]:         0x97,
+        [Keys.ASCII.R]:         0x98,
+        [Keys.ASCII.E]:         0x99,
+        [Keys.ASCII['!']]:      0x9A,
+        [Keys.ASCII['~']]:      0xA4,
+        [Keys.ASCII['_']]:      0xA5,
+        [Keys.ASCII['(']]:      0xA6,
+        [Keys.ASCII['&']]:      0xA7,
+        [Keys.ASCII['$']]:      0xA8,
+        [Keys.ASCII['#']]:      0xA9,
+        [Keys.ASCII['+']]:      0xB4,
+        [Keys.ASCII[')']]:      0xB5,
+        [Keys.ASCII['*']]:      0xB6,
+        [Keys.ASCII['^']]:      0xB7,
+        [Keys.ASCII['%']]:      0xB8,
+        [Keys.ASCII['@']]:      0xB9,
+        [Keys.ASCII['|']]:      0xC5,
+        [Keys.ASCII.L]:         0xC6,
+        [Keys.ASCII.K]:         0xC7,
+        [Keys.ASCII.G]:         0xC8,
+        [Keys.ASCII.F]:         0xC9,
+        [Keys.ASCII.A]:         0xCA,
+        [Keys.ASCII['"']]:      0xD5,
+        [Keys.ASCII[':']]:      0xD6,
+        [Keys.ASCII.J]:         0xD7,
+        [Keys.ASCII.H]:         0xD8,
+        [Keys.ASCII.D]:         0xD9,
+        [Keys.ASCII.S]:         0xDA,
+        [Keys.ASCII['>']]:      0xE5,
+        [Keys.ASCII['<']]:      0xE6,
+        [Keys.ASCII.N]:         0xE7,
+        [Keys.ASCII.B]:         0xE8,
+        [Keys.ASCII.X]:         0xE9,
+        [Keys.ASCII['?']]:      0xF5,
+        [Keys.ASCII.M]:         0xF6,
+        [Keys.ASCII.V]:         0xF8,
+        [Keys.ASCII.C]:         0xF9,
+        [Keys.ASCII.Z]:         0xFA
+    },
+    ALTCODES: {},
+    LEDCODES: {},
+    SOFTCODES: {
+        'caps-lock':    Keys.KEYCODE.CAPS_LOCK,
+        'ctrl':         Keys.KEYCODE.CTRL,
+        'esc':          Keys.KEYCODE.ESC,
+        'tab':          Keys.KEYCODE.TAB,
+        'num-comma':    Keys.KEYCODE.F5,        // since modern keypads don't typically have a comma...
+        'break':        Keys.KEYCODE.F6,
+        'line-feed':    Keys.KEYCODE.F7,
+        'no-scroll':    Keys.KEYCODE.F8,
+        'setup':        Keys.KEYCODE.F9
+    },
+    /*
+     * Reading port 0x82 returns a key address from the VT100 keyboard's UART data output.
+     *
+     * Every time a keyboard scan is initiated (by setting the START bit of the status byte),
+     * our internal address index (iKeyNext) is set to zero, and an interrupt is generated for
+     * each entry in the aKeysActive array, along with a final interrupt for KEYLAST.
+     */
+    ADDRESS: {
+        PORT:       0x82,
+        INIT:       0x7F
+    },
+    /*
+     * Writing port 0x82 updates the VT100's keyboard status byte via the keyboard's UART data input.
+     */
+    STATUS: {
+        PORT:       0x82,               // write-only
+        LED4:       0x01,
+        LED3:       0x02,
+        LED2:       0x04,
+        LED1:       0x08,
+        LOCKED:     0x10,
+        LOCAL:      0x20,
+        LEDS:       0x3F,               // all LEDs
+        START:      0x40,               // set to initiate a scan
+        /*
+         * From p. 4-38 of the VT100 Technical Manual (July 1982):
+         *
+         *      A bit (CLICK) in the keyboard status word controls the bell....  When a single status word contains
+         *      the bell bit, flip-flop E3 toggles and turns on E1, generating a click. If the bell bit is set for
+         *      many words in succession, the UART latch holds the data output constant..., allowing the circuit to
+         *      produce an 800 hertz tone. Bell is generated by setting the bell bit for 0.25 seconds.  Each cycle of
+         *      the tone is at a reduced amplitude compared with the single keyclick....  The overall effect of the
+         *      tone burst on the ear is that of a beep.
+         */
+        CLICK:      0x80,
+        INIT:       0x00
+    },
+    KEYLAST:        0x7F                // special end-of-scan key address (all valid key addresses are < KEYLAST)
+};
+
+Keyboard8080.VT100.LEDCODES = {
+    'l4':       Keyboard8080.VT100.STATUS.LED4,
+    'l3':       Keyboard8080.VT100.STATUS.LED3,
+    'l2':       Keyboard8080.VT100.STATUS.LED2,
+    'l1':       Keyboard8080.VT100.STATUS.LED1,
+    'locked':   Keyboard8080.VT100.STATUS.LOCKED,
+    'local':    Keyboard8080.VT100.STATUS.LOCAL,
+    'online':  ~Keyboard8080.VT100.STATUS.LOCAL,
+    'caps-lock':Keyboard8080.STATE.CAPS_LOCK
+};
+
+/*
+ * Supported models and their configurations
+ */
+Keyboard8080.MODELS = {
+    "SI1978":       Keyboard8080.SI1978,
+    "VT100":        Keyboard8080.VT100
+};
+
+Keyboard8080.VT100.INIT = [
+    [
+        Keyboard8080.VT100.STATUS.INIT,         // bVT100Status
+        Keyboard8080.VT100.ADDRESS.INIT,        // bVT100Address
+        false,                                  // fVT100UARTBusy
+        0,                                      // nVT100UARTCycleSnap
+        -1                                      // iKeyNext
+    ]
+];
+
+/*
+ * Port notification tables
+ */
+Keyboard8080.VT100.portsInput = {
+    0x82: Keyboard8080.prototype.inVT100UARTAddress
+};
+
+Keyboard8080.VT100.portsOutput = {
+    0x82: Keyboard8080.prototype.outVT100UARTStatus
+};
+
+/*
+ * Initialize every Keyboard module on the page.
+ */
+Web.onInit(Keyboard8080.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pc8080/lib/video.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class Video8080 extends Component {
+    /**
+     * Video8080(parmsVideo, canvas, context, textarea, container)
+     *
+     * The Video8080 component can be configured with the following (parmsVideo) properties:
+     *
+     *      screenWidth: width of the screen canvas, in pixels
+     *      screenHeight: height of the screen canvas, in pixels
+     *      screenColor: background color of the screen canvas (default is black)
+     *      screenRotate: the amount of counter-clockwise screen rotation required (eg, -90 or 270)
+     *      aspectRatio (eg, 1.33)
+     *      bufferAddr: the starting address of the frame buffer (eg, 0x2400)
+     *      bufferRAM: true to use existing RAM (default is false)
+     *      bufferFormat: if defined, one of the recognized formats in Video8080.FORMATS (eg, "vt100")
+     *      bufferCols: the width of a single frame buffer row, in pixels (eg, 256)
+     *      bufferRows: the number of frame buffer rows (eg, 224)
+     *      bufferBits: the number of bits per column (default is 1)
+     *      bufferLeft: the bit position of the left-most pixel in a byte (default is 0; CGA uses 7)
+     *      bufferRotate: the amount of counter-clockwise buffer rotation required (eg, -90 or 270)
+     *      interruptRate: normally the same as (or some multiple of) refreshRate (eg, 120)
+     *      refreshRate: how many times updateScreen() should be performed per second (eg, 60)
+     *
+     *  In addition, if a text-only display is being emulated, define the following properties:
+     *
+     *      fontROM: URL of font ROM
+     *      fontColor: default is white
+     *      cellWidth: number (eg, 10 for VT100)
+     *      cellHeight: number (eg, 10 for VT100)
+     *
+     * We record all the above values now, but we defer creation of the frame buffer until our initBus()
+     * handler is called.  At that point, we will also compute the extent of the frame buffer, determine the
+     * appropriate "cell" size (ie, the number of pixels that updateScreen() will fetch and process at once),
+     * and then allocate our cell cache.
+     *
+     * Why interruptRate in addition to refreshRate?  A higher interrupt rate is required for Space Invaders,
+     * because even though the CRT refreshes at 60Hz, the CRT controller interrupts the CPU *twice* per
+     * refresh (once after the top half of the screen has been redrawn, and again after the bottom half has
+     * been redrawn), so we need an interrupt rate of 120Hz.  We pass the higher rate on to the CPU, so that
+     * it will call updateScreen() more frequently, but we still limit our screen updates to every *other* call.
+     *
+     * bufferRotate is an alternative to screenRotate; you may set one or the other (but not both) to -90 to
+     * enable different approaches to counter-clockwise 90-degree image rotation.  screenRotate uses canvas
+     * transformation methods (translate(), rotate(), and scale()), while bufferRotate inverts the dimensions
+     * of the off-screen buffer and then relies on setPixel() to "rotate" the data into the proper location.
+     *
+     * @this {Video8080}
+     * @param {Object} parmsVideo
+     * @param {Object} [canvas]
+     * @param {Object} [context]
+     * @param {Object} [textarea]
+     * @param {Object} [container]
+     */
+    constructor(parmsVideo, canvas, context, textarea, container)
+    {
+        super("Video", parmsVideo, Messages8080.VIDEO);
+
+        var video = this;
+        this.fGecko = Web.isUserAgent("Gecko/");
+        var i, sEvent, asWebPrefixes = ['', 'moz', 'ms', 'webkit'];
+
+        this.cxScreen = parmsVideo['screenWidth'];
+        this.cyScreen = parmsVideo['screenHeight'];
+
+        this.addrBuffer = parmsVideo['bufferAddr'];
+        this.fUseRAM = parmsVideo['bufferRAM'];
+
+        var sFormat = parmsVideo['bufferFormat'];
+        this.nFormat = sFormat && Video8080.FORMATS[sFormat.toUpperCase()] || Video8080.FORMAT.UNKNOWN;
+
+        this.nColsBuffer = parmsVideo['bufferCols'];
+        this.nRowsBuffer = parmsVideo['bufferRows'];
+
+        this.cxCellDefault = this.cxCell = parmsVideo['cellWidth'] || 1;
+        this.cyCellDefault = this.cyCell = parmsVideo['cellHeight'] || 1;
+        this.abFontData = null;
+        this.fDotStretcher = false;
+
+        this.nBitsPerPixel = parmsVideo['bufferBits'] || 1;
+        this.iBitFirstPixel = parmsVideo['bufferLeft'] || 0;
+
+        this.rotateBuffer = parmsVideo['bufferRotate'];
+        if (this.rotateBuffer) {
+            this.rotateBuffer = this.rotateBuffer % 360;
+            if (this.rotateBuffer > 0) this.rotateBuffer -= 360;
+            if (this.rotateBuffer != -90) {
+                this.notice("unsupported buffer rotation: " + this.rotateBuffer);
+                this.rotateBuffer = 0;
+            }
+        }
+
+        this.rateInterrupt = parmsVideo['interruptRate'];
+        this.rateRefresh = parmsVideo['refreshRate'] || 60;
+
+        this.canvasScreen = canvas;
+        this.contextScreen = context;
+        this.textareaScreen = textarea;
+        this.inputScreen = textarea || canvas || null;
+
+        /*
+         * These variables are here in case we want/need to add support for borders later...
+         */
+        this.xScreenOffset = this.yScreenOffset = 0;
+        this.cxScreenOffset = this.cxScreen;
+        this.cyScreenOffset = this.cyScreen;
+
+        this.cxScreenCell = (this.cxScreen / this.nColsBuffer)|0;
+        this.cyScreenCell = (this.cyScreen / this.nRowsBuffer)|0;
+
+        /*
+         * Now that we've finished using nRowsBuffer to help define the screen size, we add one more
+         * row for text modes, to account for the VT100's scroll line buffer (used for smooth scrolling).
+         */
+        if (this.cyCell > 1) {
+            this.nRowsBuffer++;
+            this.bScrollOffset = 0;
+            this.fSkipSingleCellUpdate = false;
+        }
+
+        /*
+         * Support for disabling (or, less commonly, enabling) image smoothing, which all browsers
+         * seem to support now (well, OK, I still have to test the latest MS Edge browser), despite
+         * it still being labelled "experimental technology".  Let's hope the browsers standardize
+         * on this.  I see other options emerging, like the CSS property "image-rendering: pixelated"
+         * that's apparently been added to Chrome.  Sigh.
+         */
+        var fSmoothing = parmsVideo['smoothing'];
+        var sSmoothing = Web.getURLParm('smoothing');
+        if (sSmoothing) fSmoothing = (sSmoothing == "true");
+        if (fSmoothing != null) {
+            for (i = 0; i < asWebPrefixes.length; i++) {
+                sEvent = asWebPrefixes[i];
+                if (!sEvent) {
+                    sEvent = 'imageSmoothingEnabled';
+                } else {
+                    sEvent += 'ImageSmoothingEnabled';
+                }
+                if (this.contextScreen[sEvent] !== undefined) {
+                    this.contextScreen[sEvent] = fSmoothing;
+                    break;
+                }
+            }
+        }
+
+        this.rotateScreen = parmsVideo['screenRotate'];
+        if (this.rotateScreen) {
+            this.rotateScreen = this.rotateScreen % 360;
+            if (this.rotateScreen > 0) this.rotateScreen -= 360;
+            /*
+             * TODO: Consider also disallowing any rotateScreen value if bufferRotate was already set; setting
+             * both is most likely a mistake, but who knows, maybe someone wants to use both for 180-degree rotation?
+             */
+            if (this.rotateScreen != -90) {
+                this.notice("unsupported screen rotation: " + this.rotateScreen);
+                this.rotateScreen = 0;
+            } else {
+                this.contextScreen.translate(0, this.cyScreen);
+                this.contextScreen.rotate((this.rotateScreen * Math.PI)/180);
+                this.contextScreen.scale(this.cyScreen/this.cxScreen, this.cxScreen/this.cyScreen);
+            }
+        }
+
+        /*
+         * Here's the gross code to handle full-screen support across all supported browsers.  The lack of standards
+         * is exasperating; browsers can't agree on 'full' or 'Full, 'request' or 'Request', 'screen' or 'Screen', and
+         * while some browsers honor other browser prefixes, most browsers don't.
+         */
+        this.container = container;
+        if (this.container) {
+            this.container.doFullScreen = container['requestFullscreen'] || container['msRequestFullscreen'] || container['mozRequestFullScreen'] || container['webkitRequestFullscreen'];
+            if (this.container.doFullScreen) {
+                for (i = 0; i < asWebPrefixes.length; i++) {
+                    sEvent = asWebPrefixes[i] + 'fullscreenchange';
+                    if ('on' + sEvent in document) {
+                        var onFullScreenChange = function() {
+                            var fFullScreen = (document['fullscreenElement'] || document['msFullscreenElement'] || document['mozFullScreenElement'] || document['webkitFullscreenElement']);
+                            video.notifyFullScreen(!!fFullScreen);
+                        };
+                        document.addEventListener(sEvent, onFullScreenChange, false);
+                        break;
+                    }
+                }
+                for (i = 0; i < asWebPrefixes.length; i++) {
+                    sEvent = asWebPrefixes[i] + 'fullscreenerror';
+                    if ('on' + sEvent in document) {
+                        var onFullScreenError = function() {
+                            video.notifyFullScreen(null);
+                        };
+                        document.addEventListener(sEvent, onFullScreenError, false);
+                        break;
+                    }
+                }
+            }
+        }
+
+        this.sFontROM = parmsVideo['fontROM'];
+        if (this.sFontROM) {
+            var sFileExt = Str.getExtension(this.sFontROM);
+            if (sFileExt != "json") {
+                this.sFontROM = Web.getHost() + DumpAPI.ENDPOINT + '?' + DumpAPI.QUERY.FILE + '=' + this.sFontROM + '&' + DumpAPI.QUERY.FORMAT + '=' + DumpAPI.FORMAT.BYTES;
+            }
+            Web.getResource(this.sFontROM, null, true, function(sURL, sResponse, nErrorCode) {
+                video.doneLoad(sURL, sResponse, nErrorCode);
+            });
+        }
+
+        this.ledBindings = {};
+    }
+
+    /**
+     * initBuffers()
+     *
+     * @this {Video8080}
+     * @return {boolean}
+     */
+    initBuffers()
+    {
+        /*
+         * Allocate off-screen buffers now
+         */
+        this.cxBuffer = this.nColsBuffer * this.cxCell;
+        this.cyBuffer = this.nRowsBuffer * this.cyCell;
+
+        var cxBuffer = this.cxBuffer;
+        var cyBuffer = this.cyBuffer;
+        if (this.rotateBuffer) {
+            cxBuffer = this.cyBuffer;
+            cyBuffer = this.cxBuffer;
+        }
+
+        this.sizeBuffer = 0;
+        if (!this.fUseRAM) {
+            this.sizeBuffer = ((this.cxBuffer * this.nBitsPerPixel) >> 3) * this.cyBuffer;
+            if (!this.bus.addMemory(this.addrBuffer, this.sizeBuffer, Memory8080.TYPE.VIDEO)) {
+                return false;
+            }
+        }
+
+        /*
+         * imageBuffer is only used for graphics modes.  For text modes, we create a canvas
+         * for each font and draw characters by drawing from the font canvas to the target canvas.
+         */
+        if (this.sizeBuffer) {
+            this.imageBuffer = this.contextScreen.createImageData(cxBuffer, cyBuffer);
+            this.nPixelsPerCell = (16 / this.nBitsPerPixel)|0;
+            this.initCellCache(this.sizeBuffer >> 1);
+        } else {
+            /*
+             * We add an extra column per row to store the visible line length at the start of every row.
+             */
+            this.initCellCache((this.nColsBuffer + 1) * this.nRowsBuffer);
+        }
+
+        this.canvasBuffer = document.createElement("canvas");
+        this.canvasBuffer.width = cxBuffer;
+        this.canvasBuffer.height = cyBuffer;
+        this.contextBuffer = this.canvasBuffer.getContext("2d");
+
+        this.aFonts = {};
+        this.initColors();
+
+        if (this.nFormat == Video8080.FORMAT.VT100) {
+            /*
+             * Beyond fonts, VT100 support requires that we maintain a number of additional properties:
+             *
+             *      rateMonitor: must be either 50 or 60 (defaults to 60); we don't emulate the monitor refresh rate,
+             *      but we do need to keep track of which rate has been selected, because that affects the number of
+             *      "fill lines" present at the top of the VT100's frame buffer: 2 lines for 60Hz, 5 lines for 50Hz.
+             *
+             *      The VT100 July 1982 Technical Manual, p. 4-89, shows the following sample frame buffer layout:
+             *
+             *                  00  01  02  03  04  05  06  07  08  09  0A  0B  0C  0D  0E  0F
+             *                  --------------------------------------------------------------
+             *          0x2000: 7F  70  03  7F  F2  D0  7F  70  06  7F  70  0C  7F  70  0F  7F
+             *          0x2010: 70  03  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..
+             *          ...
+             *          0x22D0: 'D' 'A' 'T' 'A' ' ' 'F' 'O' 'R' ' ' 'F' 'I' 'R' 'S' 'T' ' ' 'L'
+             *          0x22E0: 'I' 'N' 'E' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' '
+             *          ...
+             *          0x2320: 7F  F3  23  'D' 'A' 'T' 'A' ' ' 'F' 'O' 'R' ' ' 'S' 'E' 'C' 'O'
+             *          0x2330: 'N' 'D' ' ' 'L' 'I' 'N' 'E' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' '
+             *          ...
+             *          0x2BE0: ' ' ' ' 'E' 'N' 'D' ' ' 'O' 'F' ' ' 'L' 'A' 'S' 'T' ' ' 'L' 'I'
+             *          0x2BF0: 'N' 'E' 7F  70  06  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..
+             *          0x2C00: [AVO SCREEN RAM, IF ANY, BEGINS HERE]
+             *
+             *      ERRATA: The manual claims that if you change the byte at 0x2002 from 03 to 09, the number of "fill
+             *      lines" will change from 2 to 5 (for 50Hz operation), but it shows 06 instead of 0C at location 0x200B;
+             *      if you follow the links, it's pretty clear that byte has to be 0C to yield 5 "fill lines".  Since the
+             *      address following the terminator at 0x2006 points to itself, it never makes sense for that terminator
+             *      to be used EXCEPT at the end of the frame buffer.
+             *
+             *      As an alternative to tracking the monitor refresh rate, we could hard-code some knowledge about how
+             *      the VT100's 8080 code uses memory, and simply ignore lines below address 0x22D0.  But the VT100 Video
+             *      Processor makes no such assumption, and it would also break our test code in createFonts(), which
+             *      builds a contiguous screen of test data starting at the default frame buffer address (0x2000).
+             */
+            this.rateMonitor = 60;
+
+            /*
+             * The default character-selectable attribute (reverse video vs. underline) is controlled by fUnderline.
+             */
+            this.fUnderline = false;
+
+            this.abLineBuffer = new Array(this.nColsBuffer);
+        }
+        return true;
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * @this {Video8080}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "refresh")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        var video = this;
+
+        /*
+         * TODO: A more general-purpose binding mechanism would be nice someday....
+         */
+        if (sHTMLType == "led" || sHTMLType == "rled") {
+            this.ledBindings[sBinding] = control;
+            return true;
+        }
+
+        switch (sBinding) {
+        case "fullScreen":
+            this.bindings[sBinding] = control;
+            if (this.container && this.container.doFullScreen) {
+                control.onclick = function onClickFullScreen() {
+                    if (DEBUG) video.printMessage("fullScreen()");
+                    video.doFullScreen();
+                };
+            } else {
+                if (DEBUG) this.log("FullScreen API not available");
+                control.parentNode.removeChild(/** @type {Node} */ (control));
+            }
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {Video8080}
+     * @param {Computer8080} cmp
+     * @param {Bus8080} bus
+     * @param {CPUState8080} cpu
+     * @param {Debugger8080} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cmp = cmp;
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+
+        /*
+         * Allocate the frame buffer (as needed) along with all other buffers.
+         */
+        this.initBuffers();
+
+        /*
+         * If we have an associated keyboard, then ensure that the keyboard will be notified
+         * whenever the canvas gets focus and receives input.
+         */
+        this.kbd = /** @type {Keyboard8080} */ (cmp.getMachineComponent("Keyboard"));
+        if (this.kbd) {
+            for (var s in this.ledBindings) {
+                this.kbd.setBinding("led", s, this.ledBindings[s]);
+            }
+            if (this.canvasScreen) {
+                this.kbd.setBinding(this.textareaScreen? "textarea" : "canvas", "screen", this.inputScreen);
+            }
+        }
+
+        var video = this;
+        this.timerUpdateNext = this.cpu.addTimer(function() {
+            video.updateScreen();
+        });
+        this.cpu.setTimer(this.timerUpdateNext, this.getRefreshTime());
+        this.nUpdates = 0;
+
+        if (!this.sFontROM) this.setReady();
+    }
+
+    /**
+     * doneLoad(sURL, sFontData, nErrorCode)
+     *
+     * @this {Video8080}
+     * @param {string} sURL
+     * @param {string} sFontData
+     * @param {number} nErrorCode (response from server if anything other than 200)
+     */
+    doneLoad(sURL, sFontData, nErrorCode)
+    {
+        if (nErrorCode) {
+            this.notice("Unable to load font ROM (error " + nErrorCode + ": " + sURL + ")");
+            return;
+        }
+
+        Component.addMachineResource(this.idMachine, sURL, sFontData);
+
+        try {
+            /*
+             * The most likely source of any exception will be here: parsing the JSON-encoded data.
+             */
+            var ab = eval("(" + sFontData + ")");
+
+            var abFontData = ab['bytes'] || ab;
+
+            if (!abFontData || !abFontData.length) {
+                Component.error("Empty font ROM: " + sURL);
+                return;
+            }
+            else if (abFontData.length == 1) {
+                Component.error(abFontData[0]);
+                return;
+            }
+
+            /*
+             * Minimal font data validation, just to make sure we're not getting garbage from the server.
+             */
+            if (abFontData.length == 2048) {
+                this.abFontData = abFontData;
+                this.createFonts();
+            }
+            else {
+                this.notice("Unrecognized font data length (" + abFontData.length + ")");
+                return;
+            }
+
+        } catch (e) {
+            this.notice("Font ROM data error: " + e.message);
+            return;
+        }
+
+        /*
+         * If we're still here, then we're ready!
+         *
+         * UPDATE: Per issue #21, I'm issuing setReady() *only* if a valid contextScreen exists *or* a Debugger is attached.
+         *
+         * TODO: Consider a more general-purpose solution for deciding whether or not the user wants to run in a "headless" mode.
+         */
+        if (this.contextScreen || this.dbg) this.setReady();
+    }
+
+    /**
+     * createFonts()
+     *
+     * @this {Video8080}
+     * @return {boolean}
+     */
+    createFonts()
+    {
+        /*
+         * We retain abFontData in case we have to rebuild the fonts (eg, when we switch from 80 to 132 columns)
+         */
+        if (this.abFontData) {
+            this.fDotStretcher = (this.nFormat == Video8080.FORMAT.VT100);
+            this.aFonts[Video8080.VT100.FONT.NORML] = [
+                this.createFontVariation(this.cxCell, this.cyCell),
+                this.createFontVariation(this.cxCell, this.cyCell, this.fUnderline)
+            ];
+            this.aFonts[Video8080.VT100.FONT.DWIDE] = [
+                this.createFontVariation(this.cxCell*2, this.cyCell),
+                this.createFontVariation(this.cxCell*2, this.cyCell, this.fUnderline)
+            ];
+            this.aFonts[Video8080.VT100.FONT.DHIGH] = this.aFonts[Video8080.VT100.FONT.DHIGH_BOT] = [
+                this.createFontVariation(this.cxCell*2, this.cyCell*2),
+                this.createFontVariation(this.cxCell*2, this.cyCell*2, this.fUnderline)
+            ];
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * createFontVariation(cxCell, cyCell, fUnderline)
+     *
+     * This creates a 16x16 character grid for the requested font variation.  Variations include:
+     *
+     *      1) no variation (cell size is this.cxCell x this.cyCell)
+     *      2) double-wide characters (cell size is this.cxCell*2 x this.cyCell)
+     *      3) double-high double-wide characters (cell size is this.cxCell*2 x this.cyCell*2)
+     *      4) any of the above with either reverse video or underline enabled (default is neither)
+     *
+     * @this {Video8080}
+     * @param {number} cxCell is the target width of each character in the grid
+     * @param {number} cyCell is the target height of each character in the grid
+     * @param {boolean} [fUnderline] (null for unmodified font, false for reverse video, true for underline)
+     * @return {Object}
+     */
+    createFontVariation(cxCell, cyCell, fUnderline)
+    {
+        /*
+         * On a VT100, cxCell,cyCell is initially 10,10, but may change to 9,10 for 132-column mode.
+         */
+
+
+
+        /*
+         * Create a font canvas that is both 16 times the target character width and the target character height,
+         * ensuring that it will accommodate 16x16 characters (for a maximum of 256).  Note that the VT100 font ROM
+         * defines only 128 characters, so that canvas will contain only 16x8 entries.
+         */
+        var nFontBytesPerChar = this.cxCellDefault <= 8? 8 : 16;
+        var nFontByteOffset = nFontBytesPerChar > 8? 15 : 0;
+        var nChars = this.abFontData.length / nFontBytesPerChar;
+
+        /*
+         * The absence of a boolean for fUnderline means that both fReverse and fUnderline are "falsey".  The presence
+         * of a boolean means that fReverse will be true OR fUnderline will be true, but NOT both.
+         */
+        var fReverse = (fUnderline === false);
+
+        var font = {cxCell: cxCell, cyCell: cyCell};
+        font.canvas = document.createElement("canvas");
+        font.canvas.width = cxCell * 16;
+        font.canvas.height = cyCell * (nChars / 16);
+        font.context = font.canvas.getContext("2d");
+
+        var imageChar = font.context.createImageData(cxCell, cyCell);
+
+        for (var iChar = 0; iChar < nChars; iChar++) {
+            for (var y = 0, yDst = y; y < this.cyCell; y++) {
+                var offFontData = iChar * nFontBytesPerChar + ((nFontByteOffset + y) & (nFontBytesPerChar - 1));
+                var bits = (fUnderline && y == 8? 0xff : this.abFontData[offFontData]);
+                for (var nRows = 0; nRows < (cyCell / this.cyCell); nRows++) {
+                    var bitPrev = 0;
+                    for (var x = 0, xDst = x; x < this.cxCell; x++) {
+                        /*
+                         * While x goes from 0 to cxCell-1, obviously we will run out of bits after x is 7;
+                         * since the final bit must be replicated all the way to the right edge of the cell
+                         * (so that line-drawing characters seamlessly connect), we ensure that the effective
+                         * shift count remains stuck at 7 once it reaches 7.
+                         */
+                        var bitReal = bits & (0x80 >> (x > 7? 7 : x));
+                        var bit = (this.fDotStretcher && !bitReal && bitPrev)? bitPrev : bitReal;
+                        for (var nCols = 0; nCols < (cxCell / this.cxCell); nCols++) {
+                            if (fReverse) bit = !bit;
+                            this.setPixel(imageChar, xDst, yDst, bit? 1 : 0);
+                            xDst++;
+                        }
+                        bitPrev = bitReal;
+                    }
+                    yDst++;
+                }
+            }
+            /*
+             * (iChar >> 4) performs the integer equivalent of Math.floor(iChar / 16), and (iChar & 0xf) is the equivalent of (iChar % 16).
+             */
+            font.context.putImageData(imageChar, (iChar & 0xf) * cxCell, (iChar >> 4) * cyCell);
+        }
+        return font;
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {Video8080}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            if (data) {
+                if (!this.restore(data)) return false;
+            }
+        }
+        /*
+         * Because the VT100 frame buffer can be located anywhere in RAM (above 0x2000), we must defer this
+         * test code until the powerUp() notification handler is called, when all RAM has (hopefully) been allocated.
+         *
+         * NOTE: The following test screen was useful for early testing, but a *real* VT100 doesn't display a test screen,
+         * so this code is no longer enabled by default.  Remove MAXDEBUG if you want to see it again.
+         */
+        if (MAXDEBUG && this.nFormat == Video8080.FORMAT.VT100) {
+            /*
+             * Build a test screen in the VT100 frame buffer; we'll mimic the "SET-UP A" screen, since it uses
+             * all the font variations.  The process involves iterating over 0-based row numbers -2 (or -5 if 50Hz
+             * operation is selected) through 24, checking aLineData for a matching row number, and converting the
+             * corresponding string(s) to appropriate byte values.  Negative row numbers correspond to "fill lines"
+             * and do not require a row entry.  If multiple strings are present for a given row, we invert the
+             * default character attribute for subsequent strings.  An empty array ends the screen build process.
+             */
+            var aLineData = {
+                 0: [Video8080.VT100.FONT.DHIGH, 'SET-UP A'],
+                 2: [Video8080.VT100.FONT.DWIDE, 'TO EXIT PRESS "SET-UP"'],
+                22: [Video8080.VT100.FONT.NORML, '        T       T       T       T       T       T       T       T       T'],
+                23: [Video8080.VT100.FONT.NORML, '1234567890', '1234567890', '1234567890', '1234567890', '1234567890', '1234567890', '1234567890', '1234567890'],
+                24: []
+            };
+            var addr = this.addrBuffer;
+            var addrNext = -1, font = -1;
+            var b, nFill = (this.rateMonitor == 60? 2 : 5);
+            for (var iRow = -nFill; iRow < this.nRowsBuffer; iRow++) {
+                var lineData = aLineData[iRow];
+                if (addrNext >= 0) {
+                    var fBreak = false;
+                    addrNext = addr + 2;
+                    if (!lineData) {
+                        if (font == Video8080.VT100.FONT.DHIGH) {
+                            lineData = aLineData[iRow-1];
+                            font = Video8080.VT100.FONT.DHIGH_BOT;
+                        }
+                    }
+                    else {
+                        if (lineData.length) {
+                            font = lineData[0];
+                        } else {
+                            addrNext = addr - 1;
+                            fBreak = true;
+                        }
+                    }
+                    b = (font & Video8080.VT100.LINEATTR.FONTMASK) | ((addrNext >> 8) & Video8080.VT100.LINEATTR.ADDRMASK) | Video8080.VT100.LINEATTR.ADDRBIAS;
+                    this.bus.setByteDirect(addr++, b);
+                    this.bus.setByteDirect(addr++, addrNext & 0xff);
+                    if (fBreak) break;
+                }
+                if (lineData) {
+                    var attr = 0;
+                    for (var j = 1; j < lineData.length; j++) {
+                        var s = lineData[j];
+                        for (var k = 0; k < s.length; k++) {
+                            this.bus.setByteDirect(addr++, s.charCodeAt(k) | attr);
+                        }
+                        attr ^= 0x80;
+                    }
+                }
+                this.bus.setByteDirect(addr++, Video8080.VT100.LINETERM);
+                addrNext = addr;
+            }
+            /*
+             * NOTE: By calling updateVT100() directly, we are bypassing any checks that might block the update.
+             */
+            this.updateVT100();
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {Video8080}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return !fSave || this.save();
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the Video8080 component.
+     *
+     * @this {Video8080}
+     * @return {Object|null}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, []);
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the Video8080 component.
+     *
+     * @this {Video8080}
+     * @param {Object} data
+     * @return {boolean} true if restore successful, false if not
+     */
+    restore(data)
+    {
+        return true;
+    }
+
+    /**
+     * updateDimensions(nCols, nRows)
+     *
+     * Called from the ChipSet component whenever the screen dimensions have been dynamically altered.
+     *
+     * @this {Video8080}
+     * @param {number} nCols (should be either 80 or 132; 80 is the default)
+     * @param {number} nRows (should be either 24 or 14; 24 is the default)
+     */
+    updateDimensions(nCols, nRows)
+    {
+        this.printMessage("updateDimensions(" + nCols + "," + nRows + ")");
+        this.nColsBuffer = nCols;
+        /*
+         * Even when the number of effective rows is 14 (or 15 counting the scroll line buffer), we want
+         * to leave the number of rows at 24 (or 25 counting the scroll line buffer), because the VT100 doesn't
+         * actually change character height (only character width).
+         *
+         *      this.nRowsBuffer = nRows+1; // +1 for scroll line buffer
+         */
+        this.cxCell = this.cxCellDefault;
+        if (nCols > 80) this.cxCell--;      // VT100 font cells are 9x10 instead of 10x10 in 132-column mode
+        if (this.initBuffers()) {
+            this.createFonts();
+        }
+    }
+
+    /**
+     * updateRate(nRate)
+     *
+     * Called from the ChipSet component whenever the monitor refresh rate has been dynamically altered.
+     *
+     * @this {Video8080}
+     * @param {number} nRate (should be either 50 or 60; 60 is the default)
+     */
+    updateRate(nRate)
+    {
+        this.printMessage("updateRate(" + nRate + ")");
+        this.rateMonitor = nRate;
+    }
+
+    /**
+     * updateScrollOffset(bScroll)
+     *
+     * Called from the ChipSet component whenever the screen scroll offset has been dynamically altered.
+     *
+     * @this {Video8080}
+     * @param {number} bScroll
+     */
+    updateScrollOffset(bScroll)
+    {
+        this.printMessage("updateScrollOffset(" + bScroll + ")");
+        if (this.bScrollOffset !== bScroll) {
+            this.bScrollOffset = bScroll;
+            /*
+             * WARNING: If we immediately redraw the screen on the first wrap of the scroll offset back to zero,
+             * we end up "slamming" the screen's contents back down again, because it seems that the frame buffer
+             * contents haven't actually been scrolled yet.  So we redraw now ONLY if bScroll is non-zero, lest
+             * we ruin the smooth-scroll effect.
+             *
+             * And this change, while necessary, is not sufficient, because another intervening updateScreen()
+             * call could still occur before the frame buffer contents are actually scrolled; and ordinarily, if the
+             * buffer hasn't changed, updateScreen() would do nothing, but alas, if the cursor happens to get toggled
+             * in the interim, updateScreen() will want to update exactly ONE cell.
+             *
+             * So we deal with that by setting the fSkipSingleCellUpdate flag.  Now of course, there's no guarantee
+             * that the next update of only ONE cell will always be a cursor update, but even if it isn't, skipping
+             * that update doesn't seem like a huge cause for concern.
+             */
+            if (bScroll) {
+                this.updateScreen(true);
+            } else {
+                this.fSkipSingleCellUpdate = true;
+            }
+        }
+    }
+
+    /**
+     * doFullScreen()
+     *
+     * @this {Video8080}
+     * @return {boolean} true if request successful, false if not (eg, failed OR not supported)
+     */
+    doFullScreen()
+    {
+        var fSuccess = false;
+        if (this.container) {
+            if (this.container.doFullScreen) {
+                /*
+                 * Styling the container with a width of "100%" and a height of "auto" works great when the aspect ratio
+                 * of our virtual screen is at least roughly equivalent to the physical screen's aspect ratio, but now that
+                 * we support virtual VGA screens with an aspect ratio of 1.33, that's very much out of step with modern
+                 * wide-screen monitors, which usually have an aspect ratio of 1.6 or greater.
+                 *
+                 * And unfortunately, none of the browsers I've tested appear to make any attempt to scale our container to
+                 * the physical screen's dimensions, so the bottom of our screen gets clipped.  To prevent that, I reduce
+                 * the width from 100% to whatever percentage will accommodate the entire height of the virtual screen.
+                 *
+                 * NOTE: Mozilla recommends both a width and a height of "100%", but all my tests suggest that using "auto"
+                 * for height works equally well, so I'm sticking with it, because "auto" is also consistent with how I've
+                 * implemented a responsive canvas when the browser window is being resized.
+                 */
+                var sWidth = "100%";
+                var sHeight = "auto";
+                if (screen && screen.width && screen.height) {
+                    var aspectPhys = screen.width / screen.height;
+                    var aspectVirt = this.cxScreen / this.cyScreen;
+                    if (aspectPhys > aspectVirt) {
+                        sWidth = Math.round(aspectVirt / aspectPhys * 100) + '%';
+                    }
+                    // TODO: We may need to someday consider the case of a physical screen with an aspect ratio < 1.0....
+                }
+                if (!this.fGecko) {
+                    this.container.style.width = sWidth;
+                    this.container.style.height = sHeight;
+                } else {
+                    /*
+                     * Sadly, the above code doesn't work for Firefox, because as http://developer.mozilla.org/en-US/docs/Web/Guide/API/DOM/Using_full_screen_mode
+                     * explains:
+                     *
+                     *      'It's worth noting a key difference here between the Gecko and WebKit implementations at this time:
+                     *      Gecko automatically adds CSS rules to the element to stretch it to fill the screen: "width: 100%; height: 100%".
+                     *
+                     * Which would be OK if Gecko did that BEFORE we're called, but apparently it does that AFTER, effectively
+                     * overwriting our careful calculations.  So we style the inner element (canvasScreen) instead, which
+                     * requires even more work to ensure that the canvas is properly centered.  FYI, this solution is consistent
+                     * with Mozilla's recommendation for working around their automatic CSS rules:
+                     *
+                     *      '[I]f you're trying to emulate WebKit's behavior on Gecko, you need to place the element you want
+                     *      to present inside another element, which you'll make fullscreen instead, and use CSS rules to adjust
+                     *      the inner element to match the appearance you want.'
+                     */
+                    this.canvasScreen.style.width = sWidth;
+                    this.canvasScreen.style.width = sWidth;
+                    this.canvasScreen.style.display = "block";
+                    this.canvasScreen.style.margin = "auto";
+                }
+                this.container.style.backgroundColor = "black";
+                this.container.doFullScreen();
+                fSuccess = true;
+            }
+            this.setFocus();
+        }
+        return fSuccess;
+    }
+
+    /**
+     * notifyFullScreen(fFullScreen)
+     *
+     * @this {Video8080}
+     * @param {boolean|null} fFullScreen (null if there was a full-screen error)
+     */
+    notifyFullScreen(fFullScreen)
+    {
+        if (!fFullScreen && this.container) {
+            if (!this.fGecko) {
+                this.container.style.width = this.container.style.height = "";
+            } else {
+                this.canvasScreen.style.width = this.canvasScreen.style.height = "";
+            }
+        }
+        this.printMessage("notifyFullScreen(" + fFullScreen + ")");
+    }
+
+    /**
+     * setFocus()
+     *
+     * @this {Video8080}
+     */
+    setFocus()
+    {
+        if (this.inputScreen) this.inputScreen.focus();
+    }
+
+    /**
+     * getRefreshTime()
+     *
+     * @this {Video8080}
+     * @return {number} (number of milliseconds per refresh)
+     */
+    getRefreshTime()
+    {
+        return 1000 / Math.max(this.rateRefresh, this.rateInterrupt);
+    }
+
+    /**
+     * initCellCache(nCells)
+     *
+     * Initializes the contents of our internal cell cache.
+     *
+     * @this {Video8080}
+     * @param {number} nCells
+     */
+    initCellCache(nCells)
+    {
+        this.nCellCache = nCells;
+        this.fCellCacheValid = false;
+        if (this.aCellCache === undefined || this.aCellCache.length != this.nCellCache) {
+            this.aCellCache = new Array(this.nCellCache);
+        }
+    }
+
+    /**
+     * initColors()
+     *
+     * This creates an array of nColors, with additional OVERLAY_TOTAL colors tacked on to the end of the array.
+     *
+     * @this {Video8080}
+     */
+    initColors()
+    {
+        var rgbBlack  = [0x00, 0x00, 0x00, 0xff];
+        var rgbWhite  = [0xff, 0xff, 0xff, 0xff];
+        this.nColors = (1 << this.nBitsPerPixel);
+        this.aRGB = new Array(this.nColors + Video8080.COLORS.OVERLAY_TOTAL);
+        this.aRGB[0] = rgbBlack;
+        this.aRGB[1] = rgbWhite;
+        if (this.nFormat == Video8080.FORMAT.SI1978) {
+            var rgbGreen  = [0x00, 0xff, 0x00, 0xff];
+            //noinspection UnnecessaryLocalVariableJS
+            var rgbYellow = [0xff, 0xff, 0x00, 0xff];
+            this.aRGB[this.nColors + Video8080.COLORS.OVERLAY_TOP] = rgbYellow;
+            this.aRGB[this.nColors + Video8080.COLORS.OVERLAY_BOTTOM] = rgbGreen;
+        }
+    }
+
+    /**
+     * setPixel(image, x, y, bPixel)
+     *
+     * @this {Video8080}
+     * @param {Object} image
+     * @param {number} x
+     * @param {number} y
+     * @param {number} bPixel (ie, an index into aRGB)
+     */
+    setPixel(image, x, y, bPixel)
+    {
+        var index;
+        if (!this.rotateBuffer) {
+            index = (x + y * image.width);
+        } else {
+            index = (image.height - x - 1) * image.width + y;
+        }
+        if (bPixel && this.nFormat == Video8080.FORMAT.SI1978) {
+            if (x >= 208 && x < 236) {
+                bPixel = this.nColors + Video8080.COLORS.OVERLAY_TOP;
+            }
+            else if (x >= 28 && x < 72) {
+                bPixel = this.nColors + Video8080.COLORS.OVERLAY_BOTTOM;
+            }
+        }
+        var rgb = this.aRGB[bPixel];
+        index *= rgb.length;
+        image.data[index] = rgb[0];
+        image.data[index+1] = rgb[1];
+        image.data[index+2] = rgb[2];
+        image.data[index+3] = rgb[3];
+    }
+
+    /**
+     * updateChar(idFont, col, row, data, context)
+     *
+     * Updates a particular character cell (row,col) in the associated window.
+     *
+     * @this {Video8080}
+     * @param {number} idFont
+     * @param {number} col
+     * @param {number} row
+     * @param {number} data
+     * @param {Object} [context]
+     */
+    updateChar(idFont, col, row, data, context)
+    {
+        var bChar = data & 0x7f;
+        var font = this.aFonts[idFont][(data & 0x80)? 1 : 0];
+        if (!font) return;
+
+        var xSrc = (bChar & 0xf) * font.cxCell;
+        var ySrc = (bChar >> 4) * font.cyCell;
+
+        var xDst, yDst, cxDst, cyDst;
+
+        var cxSrc = font.cxCell;
+        var cySrc = font.cyCell;
+
+        if (context) {
+            xDst = col * this.cxCell;
+            yDst = row * this.cyCell;
+            cxDst = this.cxCell;
+            cyDst = this.cyCell;
+        } else {
+            xDst = col * this.cxScreenCell;
+            yDst = row * this.cyScreenCell;
+            cxDst = this.cxScreenCell;
+            cyDst = this.cyScreenCell;
+        }
+
+        /*
+         * If font.cxCell > this.cxCell, then we assume the caller wants to draw a double-wide character,
+         * so we will double xDst and cxDst.
+         */
+        if (font.cxCell > this.cxCell) {
+            xDst *= 2;
+            cxDst *= 2;
+
+        }
+
+        /*
+         * If font.cyCell > this.cyCell, then we rely on idFont to indicate whether the top half or bottom half
+         * of the character should be drawn.
+         */
+        if (font.cyCell > this.cyCell) {
+            if (idFont == Video8080.VT100.FONT.DHIGH_BOT) ySrc += this.cyCell;
+            cySrc = this.cyCell;
+
+        }
+
+        if (context) {
+            context.drawImage(font.canvas, xSrc, ySrc, cxSrc, cySrc, xDst, yDst, cxDst, cyDst);
+        } else {
+            xDst += this.xScreenOffset;
+            yDst += this.yScreenOffset;
+            this.contextScreen.drawImage(font.canvas, xSrc, ySrc, cxSrc, cySrc, xDst, yDst, cxDst, cyDst);
+        }
+    }
+
+    /**
+     * updateVT100(fForced)
+     *
+     * @this {Video8080}
+     * @param {boolean} [fForced]
+     */
+    updateVT100(fForced)
+    {
+        var addrNext = this.addrBuffer, fontNext = -1;
+
+        var nRows = 0;
+        var nFill = (this.rateMonitor == 60? 2 : 5);
+        var iCell = 0, cUpdated = 0, iCellUpdated = -1;
+
+
+
+        while (nRows < this.nRowsBuffer) {
+            /*
+             * Populate the line buffer
+             */
+            var nCols = 0;
+            var addr = addrNext;
+            var font = fontNext;
+            var nColsVisible = this.nColsBuffer;
+            if (font != Video8080.VT100.FONT.NORML) nColsVisible >>= 1;
+            while (true) {
+                var data = this.bus.getByteDirect(addr++);
+                if ((data & Video8080.VT100.LINETERM) == Video8080.VT100.LINETERM) {
+                    var b = this.bus.getByteDirect(addr++);
+                    fontNext = b & Video8080.VT100.LINEATTR.FONTMASK;
+                    addrNext = ((b & Video8080.VT100.LINEATTR.ADDRMASK) << 8) | this.bus.getByteDirect(addr);
+                    addrNext += (b & Video8080.VT100.LINEATTR.ADDRBIAS)? Video8080.VT100.ADDRBIAS_LO : Video8080.VT100.ADDRBIAS_HI;
+                    break;
+                }
+                if (nCols < nColsVisible) {
+                    this.abLineBuffer[nCols++] = data;
+                } else {
+                    break;                          // ideally, we would wait for a LINETERM byte, but it's not safe to loop without limit
+                }
+            }
+
+            /*
+             * Skip the first few "fill lines"
+             */
+            if (nFill) {
+                nFill--;
+                continue;
+            }
+
+            /*
+             * Pad the line buffer as needed
+             */
+            while (nCols < this.abLineBuffer.length) {
+                this.abLineBuffer[nCols++] = 0;     // character code 0 is a empty font character
+            }
+
+            /*
+             * Display the line buffer; ordinarily, the font number would be valid after processing the "fill lines",
+             * but if the buffer isn't initialized yet, those lines might be missing, so the font number might not be set.
+             */
+            if (font >= 0) {
+                /*
+                 * Cell cache logic is complicated by the fact that a line may be single-width one frame and double-width
+                 * the next.  So we store the visible line length at the start of each row in the cache, which must match if
+                 * the cache can be considered valid for the current line.
+                 */
+                var fLineCacheValid = this.fCellCacheValid && (this.aCellCache[iCell] == nColsVisible);
+                this.aCellCache[iCell++] = nColsVisible;
+                for (var iCol = 0; iCol < nCols; iCol++) {
+                    data = this.abLineBuffer[iCol];
+                    if (!fLineCacheValid || data !== this.aCellCache[iCell]) {
+                        this.aCellCache[iCellUpdated = iCell] = data;
+                        this.updateChar(font, iCol, nRows, data, this.contextBuffer);
+                        cUpdated++;
+                    }
+                    iCell++;
+                }
+            }
+            nRows++;
+        }
+
+        this.fCellCacheValid = true;
+
+
+
+        if (!fForced && this.fSkipSingleCellUpdate && cUpdated == 1) {
+            /*
+             * We're going to blow off this update, since it comes on the heels of a smooth-scroll that *may*
+             * not be completely finished yet, and at the same time, we're going to zap the only updated cell
+             * cache entry, to guarantee that it's redrawn on the next update.
+             */
+
+            /*
+             * TODO: If I change the RECV rate to 19200 and enable smooth scrolling, I sometimes see a spurious
+             * "H" on the bottom line after a long series of "HELLO WORLD!\r\n" tests.  Dumping video memory shows
+             * "HELLO WORLD!" on 23 lines and an "H" on the 24th line, so it's really there.  But strangely, if
+             * I then press SET-UP two times, the restored screen does NOT have the spurious "H".  So somehow the
+             * firmware knows what should and shouldn't be on-screen.
+             *
+             * Possible VT100 firmware bug?  I'm not sure.  Anyway, this DEBUG-only code is here to help trap
+             * that scenario, until I figure it out.
+             */
+            if (DEBUG && (this.aCellCache[iCellUpdated] & 0x7f) == 0x48) {
+                console.log("spurious character?");
+            }
+            this.aCellCache[iCellUpdated] = -1;
+            cUpdated = 0;
+        }
+        this.fSkipSingleCellUpdate = false;
+
+        if ((cUpdated || fForced) && this.contextBuffer) {
+            /*
+             * We must subtract cyCell from cyBuffer to avoid displaying the extra "scroll line" that we normally
+             * buffer, in support of smooth scrolling.  Speaking of which, we must also add bScrollOffset to ySrc
+             * (well, ySrc is always relative to zero, so no add is actually required).
+             */
+            this.contextScreen.drawImage(
+                this.canvasBuffer,
+                0,                                  // xSrc
+                this.bScrollOffset,                 // ySrc
+                this.cxBuffer,                      // cxSrc
+                this.cyBuffer - this.cyCell,        // cySrc
+                this.xScreenOffset,                 // xDst
+                this.yScreenOffset,                 // yDst
+                this.cxScreenOffset,                // cxDst
+                this.cyScreenOffset                 // cyDst
+            );
+        }
+    }
+
+    /**
+     * updateScreen(fForced)
+     *
+     * Propagates the video buffer to the cell cache and updates the screen with any changes.  Forced updates
+     * are generally internal updates triggered by an I/O operation or other state change, while non-forced updates
+     * are the periodic updates coming from the CPU.
+     *
+     * For every cell in the video buffer, compare it to the cell stored in the cell cache, render if it differs,
+     * and then update the cell cache to match.  Since initCellCache() sets every cell in the cell cache to an
+     * invalid value, we're assured that the next call to updateScreen() will redraw the entire (visible) video buffer.
+     *
+     * @this {Video8080}
+     * @param {boolean} [fForced]
+     */
+    updateScreen(fForced)
+    {
+        var fUpdate = true;
+
+        if (!fForced) {
+            if (this.rateInterrupt) {
+                /*
+                 * TODO: Incorporate these hard-coded interrupt vector numbers into configuration blocks.
+                 */
+                if (this.rateInterrupt == 120) {
+                    if (!(this.nUpdates & 1)) {
+                        /*
+                         * On even updates, call cpu.requestINTR(1), and also update our copy of the screen.
+                         */
+                        this.cpu.requestINTR(1);
+                    } else {
+                        /*
+                         * On odd updates, call cpu.requestINTR(2), but do NOT update our copy of the screen, because
+                         * the machine has presumably only updated the top half of the frame buffer at this point; it will
+                         * update the bottom half of the frame buffer after acknowledging this interrupt.
+                         */
+                        this.cpu.requestINTR(2);
+                        fUpdate = false;
+                    }
+                } else {
+                    this.cpu.requestINTR(4);
+                }
+            }
+
+            /*
+             * Since this is not a forced update, if our cell cache is valid AND we allocated our own buffer AND the buffer
+             * is clean, then there's nothing to do.
+             */
+            if (fUpdate && this.fCellCacheValid && this.sizeBuffer) {
+                if (this.bus.cleanMemory(this.addrBuffer, this.sizeBuffer)) {
+                    fUpdate = false;
+                }
+            }
+            this.cpu.setTimer(this.timerUpdateNext, this.getRefreshTime());
+            this.nUpdates++;
+        }
+
+        if (!fUpdate) {
+            return;
+        }
+
+        if (this.cxCell > 1) {
+            this.updateScreenText(fForced);
+        } else {
+            this.updateScreenGraphics(fForced);
+        }
+    }
+
+    /**
+     * updateScreenText(fForced)
+     *
+     * @this {Video8080}
+     * @param {boolean} [fForced]
+     */
+    updateScreenText(fForced)
+    {
+        switch(this.nFormat) {
+        case Video8080.FORMAT.VT100:
+            this.updateVT100(fForced);
+            break;
+        }
+    }
+
+    /**
+     * updateScreenGraphics(fForced)
+     *
+     * @this {Video8080}
+     * @param {boolean} [fForced]
+     */
+    updateScreenGraphics(fForced)
+    {
+        var addr = this.addrBuffer;
+        var addrLimit = addr + this.sizeBuffer;
+
+        var iCell = 0;
+        var nPixelShift = 1;
+
+        var xBuffer = 0, yBuffer = 0;
+        var xDirty = this.cxBuffer, xMaxDirty = 0, yDirty = this.cyBuffer, yMaxDirty = 0;
+
+        var nShiftInit = 0;
+        var nShiftPixel = this.nBitsPerPixel;
+        var nMask = (1 << nShiftPixel) - 1;
+        if (this.iBitFirstPixel) {
+            nShiftPixel = -nShiftPixel;
+            nShiftInit = 16 + nShiftPixel;
+        }
+
+        while (addr < addrLimit) {
+            var data = this.bus.getShortDirect(addr);
+
+            if (this.fCellCacheValid && data === this.aCellCache[iCell]) {
+                xBuffer += this.nPixelsPerCell;
+            } else {
+                this.aCellCache[iCell] = data;
+                var nShift = nShiftInit;
+                if (nShift) data = ((data >> 8) | ((data & 0xff) << 8));
+                if (xBuffer < xDirty) xDirty = xBuffer;
+                var cPixels = this.nPixelsPerCell;
+                while (cPixels--) {
+                    var bPixel = (data >> nShift) & nMask;
+                    this.setPixel(this.imageBuffer, xBuffer++, yBuffer, bPixel);
+                    nShift += nShiftPixel;
+                }
+                if (xBuffer > xMaxDirty) xMaxDirty = xBuffer;
+                if (yBuffer < yDirty) yDirty = yBuffer;
+                if (yBuffer >= yMaxDirty) yMaxDirty = yBuffer + 1;
+            }
+            addr += 2; iCell++;
+            if (xBuffer >= this.cxBuffer) {
+                xBuffer = 0; yBuffer++;
+                if (yBuffer > this.cyBuffer) break;
+            }
+        }
+
+        this.fCellCacheValid = true;
+
+        /*
+         * Instead of blasting the ENTIRE imageBuffer into contextBuffer, and then blasting the ENTIRE
+         * canvasBuffer onto contextScreen, even for the smallest change, let's try to be a bit smarter about
+         * the update (well, to the extent that the canvas APIs permit).
+         */
+        if (xDirty < this.cxBuffer) {
+            var cxDirty = xMaxDirty - xDirty;
+            var cyDirty = yMaxDirty - yDirty;
+            if (this.rotateBuffer) {
+                /*
+                 * If rotateBuffer is set, then it must be -90, so we must "rotate" the dirty coordinates as well,
+                 * because they are relative to the frame buffer, not the rotated image buffer.  Alternatively, you
+                 * can use the following call to blast the ENTIRE imageBuffer into contextBuffer instead:
+                 *
+                 *      this.contextBuffer.putImageData(this.imageBuffer, 0, 0);
+                 */
+                var xDirtyOrig = xDirty, cxDirtyOrig = cxDirty;
+                //noinspection JSSuspiciousNameCombination
+                xDirty = yDirty;
+                cxDirty = cyDirty;
+                yDirty = this.cxBuffer - (xDirtyOrig + cxDirtyOrig);
+                cyDirty = cxDirtyOrig;
+            }
+            this.contextBuffer.putImageData(this.imageBuffer, 0, 0, xDirty, yDirty, cxDirty, cyDirty);
+            /*
+             * As originally noted in /modules/pcx86/lib/video.js, I would prefer to draw only the dirty portion of
+             * canvasBuffer, but there usually isn't a 1-1 pixel mapping between canvasBuffer and contextScreen, so
+             * if we draw interior rectangles, we can end up with subpixel artifacts along the edges of those rectangles.
+             */
+            this.contextScreen.drawImage(this.canvasBuffer, 0, 0, this.canvasBuffer.width, this.canvasBuffer.height, 0, 0, this.cxScreen, this.cyScreen);
+        }
+    }
+
+    /**
+     * Video8080.init()
+     *
+     * This function operates on every HTML element of class "video", extracting the
+     * JSON-encoded parameters for the Video constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a Video component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeVideo = Component.getElementsByClass(document, PC8080.APPCLASS, "video");
+        for (var iVideo = 0; iVideo < aeVideo.length; iVideo++) {
+            var eVideo = aeVideo[iVideo];
+            var parmsVideo = Component.getComponentParms(eVideo);
+
+            var eCanvas = document.createElement("canvas");
+            if (eCanvas === undefined || !eCanvas.getContext) {
+                eVideo.innerHTML = "<br/>Missing &lt;canvas&gt; support. Please try a newer web browser.";
+                return;
+            }
+
+            eCanvas.setAttribute("class", "pcjs-canvas");
+            eCanvas.setAttribute("width", parmsVideo['screenWidth']);
+            eCanvas.setAttribute("height", parmsVideo['screenHeight']);
+            eCanvas.style.backgroundColor = parmsVideo['screenColor'];
+
+            /*
+             * The "contenteditable" attribute on a canvas element NOTICEABLY slows down canvas drawing on
+             * Safari as soon as you give the canvas focus (ie, click away from the canvas, and drawing speeds
+             * up; click on the canvas, and drawing slows down).  So the "transparent textarea hack" that we
+             * once employed as only a work-around for Android devices is now our default.
+             *
+             *      eCanvas.setAttribute("contenteditable", "true");
+             *
+             * HACK: A canvas style of "auto" provides for excellent responsive canvas scaling in EVERY browser
+             * except IE9/IE10, so I recalculate the appropriate CSS height every time the parent DIV is resized;
+             * IE11 works without this hack, so we take advantage of the fact that IE11 doesn't identify as "MSIE".
+             *
+             * The other reason it's good to keep this particular hack limited to IE9/IE10 is that most other
+             * browsers don't actually support an 'onresize' handler on anything but the window object.
+             */
+            eCanvas.style.height = "auto";
+            if (Web.getUserAgent().indexOf("MSIE") >= 0) {
+                eVideo.onresize = function(eParent, eChild, cx, cy) {
+                    return function onResizeVideo() {
+                        eChild.style.height = (((eParent.clientWidth * cy) / cx) | 0) + "px";
+                    };
+                }(eVideo, eCanvas, parmsVideo['screenWidth'], parmsVideo['screenHeight']);
+                eVideo.onresize();
+            }
+            /*
+             * The following is a related hack that allows the user to force the screen to use a particular aspect
+             * ratio if an 'aspect' attribute or URL parameter is set.  Initially, it's just for testing purposes
+             * until we figure out a better UI.  And note that we use our web.onPageEvent() helper function to make
+             * sure we don't trample any other 'onresize' handler(s) attached to the window object.
+             */
+            var aspect = +(parmsVideo['aspect'] || Web.getURLParm('aspect'));
+            /*
+             * No 'aspect' parameter yields NaN, which is falsey, and anything else must satisfy my arbitrary
+             * constraints of 0.3 <= aspect <= 3.33, to prevent any useless (or worse, browser-blowing) results.
+             */
+            if (aspect && aspect >= 0.3 && aspect <= 3.33) {
+                Web.onPageEvent('onresize', function(eParent, eChild, aspectRatio) {
+                    return function onResizeWindow() {
+                        /*
+                         * Since aspectRatio is the target width/height, we have:
+                         *
+                         *      eParent.clientWidth / eChild.style.height = aspectRatio
+                         *
+                         * which means that:
+                         *
+                         *      eChild.style.height = eParent.clientWidth / aspectRatio
+                         *
+                         * so for example, if aspectRatio is 16:9, or 1.78, and clientWidth = 640,
+                         * then the calculated height should approximately 360.
+                         */
+                        eChild.style.height = ((eParent.clientWidth / aspectRatio)|0) + "px";
+                    };
+                }(eVideo, eCanvas, aspect));
+                window['onresize']();
+            }
+            eVideo.appendChild(eCanvas);
+
+            /*
+             * HACK: Android-based browsers, like the Silk (Amazon) browser and Chrome for Android, don't honor the
+             * "contenteditable" attribute; that is, when the canvas receives focus, they don't activate the on-screen
+             * keyboard.  So my fallback is to create a transparent textarea on top of the canvas.
+             *
+             * The parent DIV must have a style of "position:relative" (alternatively, a class of "pcjs-container"),
+             * so that we can position the textarea using absolute coordinates.  Also, we don't want the textarea to be
+             * visible, but we must use "opacity:0" instead of "visibility:hidden", because the latter seems to prevent
+             * the element from receiving events.  These styling requirements are taken care of in components.css
+             * (see references to the "pcjs-video-object" class).
+             *
+             * UPDATE: Unfortunately, Android keyboards like to compose whole words before transmitting any of the
+             * intervening characters; our textarea's keyDown/keyUp event handlers DO receive intervening key events,
+             * but their keyCode property is ZERO.  Virtually the only usable key event we receive is the Enter key.
+             * Android users will have to use machines that include their own on-screen "soft keyboard", or use an
+             * external keyboard.
+             *
+             * The following attempt to use a password-enabled input field didn't work any better on Android.  You could
+             * clearly see the overlaid semi-transparent input field, but none of the input characters were passed along,
+             * with the exception of the "Go" (Enter) key.
+             *
+             *      var eInput = document.createElement("input");
+             *      eInput.setAttribute("type", "password");
+             *      eInput.setAttribute("style", "position:absolute; left:0; top:0; width:100%; height:100%; opacity:0.5");
+             *      eVideo.appendChild(eInput);
+             *
+             * See this Chromium issue for more information: https://code.google.com/p/chromium/issues/detail?id=118639
+             */
+            var eTextArea = document.createElement("textarea");
+
+            /*
+             * As noted in keyboard.js, the keyboard on an iOS device tends to pop up with the SHIFT key depressed,
+             * which is not the initial keyboard state that the Keyboard component expects, so hopefully turning off
+             * these "auto" attributes will help.
+             */
+            if (Web.isUserAgent("iOS")) {
+                eTextArea.setAttribute("autocapitalize", "off");
+                eTextArea.setAttribute("autocorrect", "off");
+                /*
+                 * One of the problems on iOS devices is that after a soft-key control is clicked, we need to give
+                 * focus back to the above textarea, usually by calling cmp.updateFocus(), but in doing so, iOS may
+                 * also "zoom" the page rather jarringly.  While it's a simple matter to completely disable zooming,
+                 * by fiddling with the page's viewport, that prevents the user from intentionally zooming.  A bit of
+                 * Googling reveals that another way to prevent those jarring unintentional zooms is to simply set the
+                 * font-size of the text control to 16px.  So that's what we do.
+                 */
+                eTextArea.style.fontSize = "16px";
+            }
+            eVideo.appendChild(eTextArea);
+
+            /*
+             * Now we can create the Video object, record it, and wire it up to the associated document elements.
+             */
+            var eContext = eCanvas.getContext("2d");
+            var video = new Video8080(parmsVideo, eCanvas, eContext, eTextArea /* || eInput */, eVideo);
+
+            /*
+             * Bind any video-specific controls (eg, the Refresh button). There are no essential controls, however;
+             * even the "Refresh" button is just a diagnostic tool, to ensure that the screen contents are up-to-date.
+             */
+            Component.bindComponentControls(video, eVideo, PC8080.APPCLASS);
+        }
+    }
+}
+
+Video8080.COLORS = {
+    OVERLAY_TOP:    0,
+    OVERLAY_BOTTOM: 1,
+    OVERLAY_TOTAL:  2
+};
+
+Video8080.FORMAT = {
+    UNKNOWN:        0,
+    SI1978:         1,
+    VT100:          2
+};
+
+Video8080.FORMATS = {
+    "SI1978":       Video8080.FORMAT.SI1978,
+    "VT100":        Video8080.FORMAT.VT100
+};
+
+
+Video8080.VT100 = {
+    /*
+     * The following font IDs are nothing more than all the possible LINEATTR values masked with FONTMASK;
+     * also, note that double-high implies double-wide; the VT100 doesn't support a double-high single-wide font.
+     */
+    FONT: {
+        NORML:      0x60,       // normal font (eg, 10x10)
+        DWIDE:      0x40,       // double-wide, single-high font (eg, 20x10)
+        DHIGH:      0x20,       // technically, this means display only the TOP half of the double-high font (eg, 20x20)
+        DHIGH_BOT:  0x00        // technically, this means display only the BOTTOM half of the double-high font (eg, 20x20)
+    },
+    LINETERM:       0x7F,
+    LINEATTR: {
+        ADDRMASK:   0x0F,
+        ADDRBIAS:   0x10,       // 0x10 == ADDRBIAS_LO, 0x00 = ADDRBIAS_HI
+        FONTMASK:   0x60,
+        SCROLL:     0x80
+    },
+    ADDRBIAS_LO:    0x2000,
+    ADDRBIAS_HI:    0x4000
+};
+
+/*
+ * Initialize every Video module on the page.
+ */
+Web.onInit(Video8080.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pc8080/lib/serial.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class SerialPort8080 extends Component {
+    /**
+     * SerialPort8080(parmsSerial)
+     *
+     * The SerialPort8080 component has the following component-specific (parmsSerial) properties:
+     *
+     *      adapter: 0 if not defined
+     *
+     *      binding: name of a control (based on its "binding" attribute) to bind to this port's I/O
+     *
+     *      tabSize: set to a non-zero number to convert tabs to spaces (applies only to output to
+     *      the above binding); default is 0 (no conversion)
+     *
+     * In the future, we may support 'port' and 'irq' properties that allow the machine to define a
+     * non-standard serial port configuration, instead of only our pre-defined 'adapter' configurations.
+     *
+     * NOTE: Since the XSL file defines 'adapter' as a number, not a string, there's no need to use
+     * parseInt(), and as an added benefit, we don't need to worry about whether a hex or decimal format
+     * was used.
+     *
+     * @this {SerialPort8080}
+     * @param {Object} parmsSerial
+     */
+    constructor(parmsSerial)
+    {
+        super("SerialPort", parmsSerial, Messages8080.SERIAL);
+
+        this.iAdapter = +parmsSerial['adapter'];
+
+        switch (this.iAdapter) {
+        case 0:
+            this.portBase = 0;
+            this.nIRQ = 2;
+            break;
+        default:
+            Component.warning("Unrecognized serial adapter #" + this.iAdapter);
+            return;
+        }
+        /**
+         * consoleOutput becomes a string that records serial port output if the 'binding' property is set to the
+         * reserved name "console".  Nothing is written to the console, however, until a linefeed (0x0A) is output
+         * or the string length reaches a threshold (currently, 1024 characters).
+         *
+         * @type {string|null}
+         */
+        this.consoleOutput = null;
+
+        /**
+         * controlIOBuffer is a DOM element bound to the port (currently used for output only; see transmitByte()).
+         *
+         * @type {Object}
+         */
+        this.controlIOBuffer = null;
+
+        /*
+         * If controlIOBuffer is being used AND 'tabSize' is set, then we make an attempt to monitor the characters
+         * being echoed via transmitByte(), maintain a logical column position, and convert any tabs into the appropriate
+         * number of spaces.
+         *
+         * charBOL, if nonzero, is a character to automatically output at the beginning of every line.  This probably
+         * isn't generally useful; I use it internally to preformat serial output.
+         */
+        this.tabSize = parmsSerial['tabSize'];
+        this.charBOL = parmsSerial['charBOL'];
+        this.iLogicalCol = 0;
+
+        /*
+         * fAutoXOFF enables some experimental auto-XOFF/XON processing.  It assumes if the VT100 firmware
+         * issues an XOFF, receiveByte() should stop accepting more data until the firmware issues an XOFF.
+         *
+         * The downside is that this doesn't really do anything to stem the flow of incoming data; it just
+         * prevents the VT100's internal buffer from overflowing.  TODO: Eliminate the need for this hack
+         * and add some *real* flow-control interfaces between connected SerialPort components.
+         */
+        this.fAutoXOFF = true;
+        this.fAutoStop = false;
+        this.fNullModem = true;
+
+        var sBinding = parmsSerial['binding'];
+        if (sBinding == "console") {
+            this.consoleOutput = "";
+        } else {
+            /*
+             * NOTE: If sBinding is not the name of a valid Control Panel DOM element, this call does nothing.
+             */
+            Component.bindExternalControl(this, sBinding, SerialPort8080.sIOBuffer);
+        }
+
+        /*
+         * No connection until initConnection() is called.
+         */
+        this.sDataReceived = "";
+        this.connection = this.sendData = this.updateStatus = null;
+
+        /*
+         * Export all functions required by initConnection().
+         */
+        this['exports'] = {
+            'connect': this.initConnection,
+            'receiveData': this.receiveData,
+            'receiveStatus': this.receiveStatus
+        };
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * @this {SerialPort8080}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "buffer")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        var serial = this;
+
+        switch (sBinding) {
+        case SerialPort8080.sIOBuffer:
+            this.bindings[sBinding] = this.controlIOBuffer = control;
+
+            /*
+             * By establishing an onkeypress handler here, we make it possible for DOS commands like
+             * "CTTY COM1" to more or less work (use "CTTY CON" to restore control to the DOS console).
+             */
+            control.onkeydown = function onKeyDown(event) {
+                /*
+                 * This is required in addition to onkeypress, because it's the only way to prevent
+                 * BACKSPACE (keyCode 8) from being interpreted by the browser as a "Back" operation;
+                 * moreover, not all browsers generate an onkeypress notification for BACKSPACE.
+                 *
+                 * A related problem exists for Ctrl-key combinations in most Windows-based browsers
+                 * (eg, IE, Edge, Chrome for Windows, etc), because keys like Ctrl-C and Ctrl-S have
+                 * special meanings (eg, Copy, Save).  To the extent the browser will allow it, we
+                 * attempt to disable that default behavior when this control receives an onkeydown
+                 * event for one of those keys (probably the only event the browser generates for them).
+                 */
+                event = event || window.event;
+                var keyCode = event.keyCode;
+                if (keyCode === 0x08 || event.ctrlKey && keyCode >= 0x41 && keyCode <= 0x5A) {
+                    if (event.preventDefault) event.preventDefault();
+                    if (keyCode > 0x40) keyCode -= 0x40;
+                    serial.receiveByte(keyCode);
+                }
+                return true;
+            };
+
+            control.onkeypress = function onKeyPress(event) {
+                /*
+                 * Browser-independent keyCode extraction; refer to onKeyPress() and the other key event
+                 * handlers in keyboard.js.
+                 */
+                event = event || window.event;
+                var keyCode = event.which || event.keyCode;
+                serial.receiveByte(keyCode);
+                /*
+                 * Since we're going to remove the "readonly" attribute from the <textarea> control
+                 * (so that the soft keyboard activates on iOS), instead of calling preventDefault() for
+                 * selected keys (eg, the SPACE key, whose default behavior is to scroll the page), we must
+                 * now call it for *all* keys, so that the keyCode isn't added to the control immediately,
+                 * on top of whatever the machine is echoing back, resulting in double characters.
+                 */
+                if (event.preventDefault) event.preventDefault();
+                return true;
+            };
+
+            /*
+             * Now that we've added an onkeypress handler that calls preventDefault() for ALL keys, the control
+             * itself no longer needs the "readonly" attribute; we primarily need to remove it for iOS browsers,
+             * so that the soft keyboard will activate, but it shouldn't hurt to remove the attribute for all browsers.
+             */
+            control.removeAttribute("readonly");
+            return true;
+
+        default:
+            if (sValue) {
+                /*
+                 * Instead of just having a dedicated "test" control, we now treat any unrecognized control with
+                 * a "value" attribute as a test control.  The only caveat is that such controls must have binding IDs
+                 * that do not conflict with predefined controls (which, of course, is the only way you can get here).
+                 */
+                this.bindings[sBinding] = control;
+
+                /*
+                 * Backslash sequences like \n, \r, and \\ have already been converted to LF, CR and backslash
+                 * characters, by virtue of the eval() function that all our component parameter strings pass through;
+                 * eval() treats strings like "source code", so any backslash sequence that JavaScript supports is
+                 * automatically converted.
+                 *
+                 * The complete list of backslash sequences supported by JavaScript:
+                 *
+                 *      \0  \'  \"  \\  \n  \r  \v  \t  \b  \f  \uXXXX \xXX
+                 *                      ^J  ^M  ^K  ^I  ^H  ^L
+                 *
+                 * To support any other non-printable 8-bit character, such as ESC, you should use \xXX, where XX
+                 * is the ASCII code in hex.  For ESC, that would \x1B.
+                 */
+                control.onclick = function onClickTest(event) {
+                    serial.receiveData(sValue);
+                    /*
+                     * Give focus back to the machine (since clicking the button takes focus away).
+                     *
+                     *      if (serial.cmp) serial.cmp.updateFocus();
+                     *
+                     * iOS Usability Improvement: NOT calling updateFocus() keeps the soft keyboard down
+                     * (assuming it was already down).
+                     */
+                    return true;
+                };
+                return true;
+            }
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * echoByte(b)
+     *
+     * @this {SerialPort8080}
+     * @param {number} b
+     * @return {boolean} true if echo, false if not
+     */
+    echoByte(b)
+    {
+        var fEchoed = false;
+
+        if (this.controlIOBuffer) {
+            if (b == 0x08) {
+                this.controlIOBuffer.value = this.controlIOBuffer.value.slice(0, -1);
+                /*
+                 * TODO: Back up the correct number of columns if the character erased was a tab.
+                 */
+                if (this.iLogicalCol > 0) this.iLogicalCol--;
+            }
+            else {
+                var s = Str.toASCIICode(b);
+                var nChars = s.length;
+                if (b == 0x09) {
+                    var tabSize = this.tabSize || 8;
+                    nChars = tabSize - (this.iLogicalCol % tabSize);
+                    if (this.tabSize) s = Str.pad("", nChars);
+                }
+                else if (b == 0x0D) {
+                    this.iLogicalCol = nChars = 0;
+                    s = "\n";
+                }
+                if (this.charBOL && !this.iLogicalCol && nChars) s = String.fromCharCode(this.charBOL) + s;
+                this.controlIOBuffer.value += s;
+                this.controlIOBuffer.scrollTop = this.controlIOBuffer.scrollHeight;
+                this.iLogicalCol += nChars;
+            }
+            fEchoed = true;
+        }
+        else if (this.consoleOutput != null) {
+            if (b == 0x0A || this.consoleOutput.length >= 1024) {
+                this.println(this.consoleOutput);
+                this.consoleOutput = "";
+            }
+            if (b != 0x0A) {
+                this.consoleOutput += String.fromCharCode(b);
+            }
+            fEchoed = true;
+        }
+
+        return fEchoed;
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {SerialPort8080}
+     * @param {Computer8080} cmp
+     * @param {Bus8080} bus
+     * @param {CPUState8080} cpu
+     * @param {Debugger8080} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cmp = cmp;
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+
+        var serial = this;
+        this.timerReceiveNext = this.cpu.addTimer(function() {
+            serial.receiveData();
+        });
+        this.timerTransmitNext = this.cpu.addTimer(function() {
+            serial.transmitData();
+        });
+
+        this.chipset = /** @type {ChipSet8080} */ (cmp.getMachineComponent("ChipSet"));
+
+        bus.addPortInputTable(this, SerialPort8080.aPortInput, this.portBase);
+        bus.addPortOutputTable(this, SerialPort8080.aPortOutput, this.portBase);
+
+        this.setReady();
+    }
+
+    /**
+     * initConnection(fNullModem)
+     *
+     * If a machine 'connection' parameter exists of the form "{sourcePort}->{targetMachine}.{targetPort}",
+     * and "{sourcePort}" matches our idComponent, then look for a component with id "{targetMachine}.{targetPort}".
+     *
+     * If the target component is found, then verify that it has exported functions with the following names:
+     *
+     *      receiveData(data): called when we have data to transmit; aliased internally to sendData(data)
+     *      receiveStatus(pins): called when our control signals have changed; aliased internally to updateStatus(pins)
+     *
+     * For now, we're not going to worry about communication in the other direction, because when the target component
+     * performs its own initConnection(), it will find our receiveData() and receiveStatus() functions, at which point
+     * communication in both directions should be established, and the circle of life complete.
+     *
+     * For added robustness, if the target machine initializes much more slowly than we do, and our connection attempt
+     * fails, that's OK, because when it finally initializes, its initConnection() will call our initConnection();
+     * if we've already initialized, no harm done.
+     *
+     * @this {SerialPort8080}
+     * @param {boolean} [fNullModem] (caller's null-modem setting, to ensure our settings are in agreement)
+     */
+    initConnection(fNullModem)
+    {
+        if (!this.connection) {
+            var sConnection = this.cmp.getMachineParm("connection");
+            if (sConnection) {
+                var asParts = sConnection.split('->');
+                if (asParts.length == 2) {
+                    var sSourceID = Str.trim(asParts[0]);
+                    if (sSourceID != this.idComponent) return;  // this connection string is intended for another instance
+                    var sTargetID = Str.trim(asParts[1]);
+                    this.connection = Component.getComponentByID(sTargetID);
+                    if (this.connection) {
+                        var exports = this.connection['exports'];
+                        if (exports) {
+                            var fnConnect = exports['connect'];
+                            if (fnConnect) fnConnect.call(this.connection, this.fNullModem);
+                            this.sendData = exports['receiveData'];
+                            if (this.sendData) {
+                                this.fNullModem = fNullModem;
+                                this.updateStatus = exports['receiveStatus'];
+                                this.status("Connected " + this.idMachine + '.' + sSourceID + " to " + sTargetID);
+                                return;
+                            }
+                        }
+                    }
+                }
+                /*
+                 * Changed from notice() to status() because sometimes a connection fails simply because one of us is a laggard.
+                 */
+                this.status("Unable to establish connection: " + sConnection);
+            }
+        }
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {SerialPort8080}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+
+            /*
+             * This is as late as we can currently wait to make our first inter-machine connection attempt;
+             * even so, the target machine's initialization process may still be ongoing, so any connection
+             * may be not fully resolved until the target machine performs its own initConnection(), which will
+             * in turn invoke our initConnection() again.
+             */
+            this.initConnection(this.fNullModem);
+
+            if (!data || !this.restore) {
+                this.reset();
+            } else {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {SerialPort8080}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * reset()
+     *
+     * @this {SerialPort8080}
+     */
+    reset()
+    {
+        this.initState();
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the SerialPort8080 component.
+     *
+     * @this {SerialPort8080}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, this.saveRegisters());
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the SerialPort8080 component.
+     *
+     * @this {SerialPort8080}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        return this.initState(data[0]);
+    }
+
+    /**
+     * initState(data)
+     *
+     * @this {SerialPort8080}
+     * @param {Array} [data]
+     * @return {boolean} true if successful, false if failure
+     */
+    initState(data)
+    {
+        var i = 0;
+        if (data === undefined) {
+            data = SerialPort8080.UART8251.INIT;
+        }
+        this.fReady     = data[i++];
+        this.bDataIn    = data[i++];
+        this.bDataOut   = data[i++];
+        this.bStatus    = data[i++];
+        this.bMode      = data[i++];
+        this.bCommand   = data[i++];
+        this.bBaudRates = data[i];
+        return true;
+    }
+
+    /**
+     * saveRegisters()
+     *
+     * @this {SerialPort8080}
+     * @return {Array}
+     */
+    saveRegisters()
+    {
+        var i = 0;
+        var data = [];
+        data[i++] = this.fReady;
+        data[i++] = this.bDataIn;
+        data[i++] = this.bDataOut;
+        data[i++] = this.bStatus;
+        data[i++] = this.bMode;
+        data[i++] = this.bCommand;
+        data[i]   = this.bBaudRates;
+        return data;
+    }
+
+    /**
+     * getBaudTimeout(maskRate)
+     *
+     * @this {SerialPort8080}
+     * @param {number} maskRate (either SerialPort8080.UART8251.BAUDRATES.RECV_RATE or SerialPort8080.UART8251.BAUDRATES.XMIT_RATE)
+     * @return {number} (number of milliseconds per byte)
+     */
+    getBaudTimeout(maskRate)
+    {
+        var indexRate = (this.bBaudRates & maskRate);
+        if (!(maskRate & 0xf)) indexRate >>= 4;
+        var nBaud = SerialPort8080.UART8251.BAUDTABLE[indexRate];
+        var nBits = ((this.bMode & SerialPort8080.UART8251.MODE.DATA_BITS) >> 2) + 6;   // includes an extra +1 for start bit
+        if (this.bMode & SerialPort8080.UART8251.MODE.PARITY_ENABLE) nBits++;
+        nBits += ((((this.bMode & SerialPort8080.UART8251.MODE.STOP_BITS) >> 6) + 1) >> 1);
+        var nBytesPerSecond = Math.round(nBaud / nBits);
+        return 1000 / nBytesPerSecond;
+    }
+
+    /**
+     * receiveByte(b)
+     *
+     * @this {SerialPort8080}
+     * @param {number} b
+     * @return {boolean}
+     */
+    receiveByte(b)
+    {
+        if (MAXDEBUG) this.echoByte(b);
+        this.printMessage("receiveByte(" + Str.toHexByte(b) + "), status=" + Str.toHexByte(this.bStatus));
+        if (!this.fAutoStop && !(this.bStatus & SerialPort8080.UART8251.STATUS.RECV_FULL)) {
+            this.bDataIn = b;
+            this.bStatus |= SerialPort8080.UART8251.STATUS.RECV_FULL;
+            this.cpu.requestINTR(this.nIRQ);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * receiveData(data)
+     *
+     * Helper for clocking received data at the expected RECV_RATE.
+     *
+     * When we're cramming test data down the terminal's throat, that data will typically be in the form
+     * of a string.  When we're called by another component, data will typically be a number (ie, byte).  If no
+     * data is specified at all, then all we do is "clock" any remaining data into the receiver.
+     *
+     * @this {SerialPort8080}
+     * @param {number|string|undefined} [data]
+     * @return {boolean} true if received, false if not
+     */
+    receiveData(data)
+    {
+        if (data != null) {
+            if (typeof data != "number") {
+                this.sDataReceived = data;
+            } else {
+                this.sDataReceived += String.fromCharCode(data);
+            }
+        }
+        if (this.sDataReceived) {
+            if (this.receiveByte(this.sDataReceived.charCodeAt(0))) {
+                this.sDataReceived = this.sDataReceived.substr(1);
+            }
+            if (this.sDataReceived && this.cpu) {
+                this.cpu.setTimer(this.timerReceiveNext, this.getBaudTimeout(SerialPort8080.UART8251.BAUDRATES.RECV_RATE));
+            }
+        }
+        return true;                // for now, return true regardless, since we're buffering everything anyway
+    }
+
+    /**
+     * receiveStatus(pins)
+     *
+     * NOTE: Prior to the addition of this interface, the DSR bit was initialized set and remained set for the life
+     * of the machine.  It is entirely appropriate that this is the only way the bit can be changed, because it represents
+     * an external control signal.
+     *
+     * @this {SerialPort8080}
+     * @param {number} pins
+     */
+    receiveStatus(pins)
+    {
+        this.bStatus &= ~SerialPort8080.UART8251.STATUS.DSR;
+        if (pins & RS232.DSR.MASK) this.bStatus |= SerialPort8080.UART8251.STATUS.DSR;
+    }
+
+    /**
+     * transmitByte(b)
+     *
+     * @this {SerialPort8080}
+     * @param {number} b
+     * @return {boolean} true if transmitted, false if not
+     */
+    transmitByte(b)
+    {
+        var fTransmitted = false;
+
+        this.printMessage("transmitByte(" + Str.toHexByte(b) + ")");
+
+        if (this.fAutoXOFF) {
+            if (b == 0x13) {        // XOFF
+                this.fAutoStop = true;
+                return false;
+            }
+            if (b == 0x11) {        // XON
+                this.fAutoStop = false;
+                return false;
+            }
+        }
+
+        if (this.sendData) {
+            if (this.sendData.call(this.connection, b)) {
+                fTransmitted = true;
+            }
+        }
+
+        if (this.echoByte(b)) {
+            fTransmitted = true;
+        }
+
+        return fTransmitted;
+    }
+
+    /**
+     * transmitData(sData)
+     *
+     * Helper for clocking transmitted data at the expected XMIT_RATE.
+     *
+     * When timerTransmitNext fires, we have honored the programmed XMIT_RATE period, so we can
+     * set XMIT_READY (and XMIT_EMPTY), which signals the firmware that another byte can be transmitted.
+     *
+     * @this {SerialPort8080}
+     * @param {string} [sData]
+     * @return {boolean} true if successful, false if not
+     */
+    transmitData(sData)
+    {
+        this.bStatus |= (SerialPort8080.UART8251.STATUS.XMIT_READY | SerialPort8080.UART8251.STATUS.XMIT_EMPTY);
+        if (sData) {
+            return this.sendData? this.sendData.call(this.connection, sData) : false;
+        }
+        return true;
+    }
+
+    /**
+     * isTransmitterReady()
+     *
+     * Called whenever a ChipSet circuit needs the SerialPort8080 UART's transmitter status.
+     *
+     * @this {SerialPort8080}
+     * @return {boolean} (true if ready, false if not)
+     */
+    isTransmitterReady()
+    {
+        return !!(this.bStatus & SerialPort8080.UART8251.STATUS.XMIT_READY);
+    }
+
+    /**
+     * inData(port, addrFrom)
+     *
+     * @this {SerialPort8080}
+     * @param {number} port (0x0)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inData(port, addrFrom)
+    {
+        var b = this.bDataIn;
+        this.printMessageIO(port, null, addrFrom, "DATA", b);
+        this.bStatus &= ~SerialPort8080.UART8251.STATUS.RECV_FULL;
+        return b;
+    }
+
+    /**
+     * inControl(port, addrFrom)
+     *
+     * @this {SerialPort8080}
+     * @param {number} port (0x1)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inControl(port, addrFrom)
+    {
+        var b = this.bStatus;
+        this.printMessageIO(port, null, addrFrom, "STATUS", b);
+        return b;
+    }
+
+    /**
+     * outData(port, bOut, addrFrom)
+     *
+     * @this {SerialPort8080}
+     * @param {number} port (0x0)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outData(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "DATA");
+        this.bDataOut = bOut;
+        this.bStatus &= ~(SerialPort8080.UART8251.STATUS.XMIT_READY | SerialPort8080.UART8251.STATUS.XMIT_EMPTY);
+        /*
+         * If we're transmitting to a virtual device that has no measurable delay, this code may clear XMIT_READY
+         * too quickly:
+         *
+         *      if (this.transmitByte(bOut)) {
+         *          this.bStatus |= (SerialPort8080.UART8251.STATUS.XMIT_READY | SerialPort8080.UART8251.STATUS.XMIT_EMPTY);
+         *      }
+         *
+         * A better solution is to arm a timer based on the XMIT_RATE baud rate, and clear the above bits when that
+         * timer fires.  Consequently, we no longer care what transmitByte() reports.
+         */
+        this.transmitByte(bOut);
+        if (this.cpu) {
+            this.cpu.setTimer(this.timerTransmitNext, this.getBaudTimeout(SerialPort8080.UART8251.BAUDRATES.XMIT_RATE));
+        }
+    }
+
+    /**
+     * outControl(port, bOut, addrFrom)
+     *
+     * Writes to the CONTROL port (0x1) are either MODE or COMMAND bytes.  If the device has just
+     * been powered or reset, it is in a "not ready" state and is waiting for a MODE byte.  Once it
+     * has received that initial byte, the device is marked "ready", and all further bytes are
+     * interpreted as COMMAND bytes (until/unless a COMMAND byte with the INTERNAL_RESET bit is set).
+     *
+     * @this {SerialPort8080}
+     * @param {number} port (0x1)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outControl(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "CONTROL");
+        if (!this.fReady) {
+            this.bMode = bOut;
+            this.fReady = true;
+        } else {
+            /*
+             * Whenever DTR or RTS changes, we also want to notify any connected machine, via updateStatus().
+             */
+            if (this.updateStatus) {
+                var delta = (bOut ^ this.bCommand);
+                if (delta & (SerialPort8080.UART8251.COMMAND.RTS | SerialPort8080.UART8251.COMMAND.DTR)) {
+                    var pins = 0;
+                    if (this.fNullModem) {
+                        pins |= (bOut & SerialPort8080.UART8251.COMMAND.RTS)? RS232.CTS.MASK : 0;
+                        pins |= (bOut & SerialPort8080.UART8251.COMMAND.DTR)? (RS232.DSR.MASK | RS232.CD.MASK): 0;
+                    } else {
+                        pins |= (bOut & SerialPort8080.UART8251.COMMAND.RTS)? RS232.RTS.MASK : 0;
+                        pins |= (bOut & SerialPort8080.UART8251.COMMAND.DTR)? RS232.DTR.MASK : 0;
+                    }
+                    this.updateStatus.call(this.connection, pins);
+                }
+            }
+            this.bCommand = bOut;
+            if (this.bCommand & SerialPort8080.UART8251.COMMAND.INTERNAL_RESET) {
+                this.fReady = false;
+            }
+        }
+    }
+
+    /**
+     * outBaudRates(port, bOut, addrFrom)
+     *
+     * @this {SerialPort8080}
+     * @param {number} port (0x2)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outBaudRates(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "BAUDRATES");
+        this.bBaudRates = bOut;
+    }
+
+    /**
+     * SerialPort8080.init()
+     *
+     * This function operates on every HTML element of class "serial", extracting the
+     * JSON-encoded parameters for the SerialPort8080 constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a SerialPort8080 component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeSerial = Component.getElementsByClass(document, PC8080.APPCLASS, "serial");
+        for (var iSerial = 0; iSerial < aeSerial.length; iSerial++) {
+            var eSerial = aeSerial[iSerial];
+            var parmsSerial = Component.getComponentParms(eSerial);
+            var serial = new SerialPort8080(parmsSerial);
+            Component.bindComponentControls(serial, eSerial, PC8080.APPCLASS);
+        }
+    }
+}
+
+/*
+ * class SerialPort8080
+ * property {number} iAdapter
+ * property {number} portBase
+ * property {number} nIRQ
+ * property {Object} controlIOBuffer is a DOM element bound to the port (for rudimentary output; see transmitByte())
+ *
+ * NOTE: This class declaration started as a way of informing the code inspector of the controlIOBuffer property,
+ * which remained undefined until a setBinding() call set it later, but I've since decided that explicitly
+ * initializing such properties in the constructor is a better way to go -- even though it's more code -- because
+ * JavaScript compilers are supposed to be happier when the underlying object structures aren't constantly changing.
+ *
+ * Besides, I'm not sure I want to get into documenting every property this way, for this or any/every other class,
+ * let alone getting into which ones should be considered private or protected, because PCjs isn't really a library
+ * for third-party apps.
+ */
+
+SerialPort8080.UART8251 = {
+    /*
+     * Format of MODE byte written to CONTROL port 0x1
+     */
+    MODE: {
+        BAUD_FACTOR:    0x03,       // 00=SYNC, 01=1x, 10=16x, 11=64x
+        DATA_BITS:      0x0C,       // 00=5, 01=6, 10=7, 11=8
+        PARITY_ENABLE:  0x10,
+        EVEN_PARITY:    0x20,
+        STOP_BITS:      0xC0,       // 00=invalid, 01=1, 10=1.5, 11=2
+        INIT:           0x8E        // 16x baud rate, 8 data bits, no parity, 1.5 stop bits
+    },
+    /*
+     * Format of COMMAND byte written to CONTROL port 0x1
+     */
+    COMMAND: {
+        XMIT_ENABLE:    0x01,
+        DTR:            0x02,       // Data Terminal Ready
+        RECV_ENABLE:    0x04,
+        SEND_BREAK:     0x08,
+        ERROR_RESET:    0x10,
+        RTS:            0x20,       // Request To Send
+        INTERNAL_RESET: 0x40,
+        HUNT_MODE:      0x80,
+        INIT:           0x27        // XMIT_ENABLE | DTR | RECV_ENABLE | RTS
+    },
+    /*
+     * Format of STATUS byte read from CONTROL port 0x1
+     */
+    STATUS: {
+        XMIT_READY:     0x01,
+        RECV_FULL:      0x02,
+        XMIT_EMPTY:     0x04,
+        PARITY_ERROR:   0x08,
+        OVERRUN_ERROR:  0x10,
+        FRAMING_ERROR:  0x20,
+        BREAK_DETECT:   0x40,
+        DSR:            0x80,       // Data Set Ready
+        INIT:           0x85        // XMIT_READY | XMIT_EMPTY | DSR
+    },
+    /*
+     * Format of BAUDRATES byte written to port 0x2
+     *
+     * Each nibble is an index (0x0-0xF) into a set of internal CPU clock divisors that yield the
+     * following baud rates:
+     *
+     *      Index   Divisor     Baud Rate
+     *      -----   -------     ---------
+     *      0x0      3456       50
+     *      0x1      2304       75
+     *      0x2      1571       110
+     *      0x3      1285       134.5
+     *      0x4      1152       150
+     *      0x5      864        200
+     *      0x6      576        300
+     *      0x7      288        600
+     *      0x8      144        1200
+     *      0x9      96         1800
+     *      0xA      86         2000
+     *      0xB      72         2400
+     *      0xC      48         3600
+     *      0xD      36         4800
+     *      0xE      18         9600    (default)
+     *      0xF      9          19200
+     *
+     * NOTE: This is a VT100-specific port and baud rate table.
+     */
+    BAUDRATES: {
+        RECV_RATE:      0x0F,
+        XMIT_RATE:      0xF0,
+        INIT:           0xEE        // default to 9600 (0xE) for both XMIT and RECV
+    },
+    BAUDTABLE: [
+        50, 75, 110, 134.5, 150, 200, 300, 600, 1200, 1800, 2000, 2400, 3600, 4800, 9600, 19200
+    ]
+};
+
+SerialPort8080.UART8251.INIT = [
+    false,
+    0,
+    0,
+    SerialPort8080.UART8251.STATUS.INIT,
+    SerialPort8080.UART8251.MODE.INIT,
+    SerialPort8080.UART8251.COMMAND.INIT,
+    SerialPort8080.UART8251.BAUDRATES.INIT
+];
+
+/*
+ * Internal name used for the I/O buffer control, if any, that we bind to a SerialPort8080.
+ *
+ * Alternatively, if SerialPort8080 wants to use another component's control (eg, the Panel's
+ * "print" control), it can specify the name of that control with the 'binding' property.
+ *
+ * For that binding to succeed, we also need to know the target component; for now, that's
+ * been hard-coded to "Panel", in part because that's one of the few components we can rely
+ * upon initializing before we do, but it would be a simple matter to include a component type
+ * or ID as part of the 'binding' property as well, if we need more flexibility later.
+ */
+SerialPort8080.sIOBuffer = "buffer";
+
+/*
+ * Port input notification table
+ */
+SerialPort8080.aPortInput = {
+    0x0: SerialPort8080.prototype.inData,
+    0x1: SerialPort8080.prototype.inControl
+
+};
+
+/*
+ * Port output notification table
+ */
+SerialPort8080.aPortOutput = {
+    0x0: SerialPort8080.prototype.outData,
+    0x1: SerialPort8080.prototype.outControl,
+    0x2: SerialPort8080.prototype.outBaudRates
+};
+
+/*
+ * Initialize every SerialPort8080 module on the page.
+ */
+Web.onInit(SerialPort8080.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/debugger.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * Debugger Address Object
+ *
+ * This is the basic structure; other debuggers may extend it.
+ *
+ *      addr            address
+ *      fTemporary      true if this is a temporary breakpoint address
+ *      sCmd            set for breakpoint addresses if there's an associated command string
+ *      aCmds           preprocessed commands (from sCmd)
+ *
+ * @typedef {{
+ *      addr:(number|undefined),
+ *      fTemporary:(boolean|undefined),
+ *      sCmd:(string|undefined),
+ *      aCmds:(Array.<string>|undefined)
+ * }}
+ */
+var DbgAddr;
+
+/**
+ * Since the Closure Compiler treats ES6 classes as @struct rather than @dict by default,
+ * it deters us from defining named properties on our components; eg:
+ *
+ *      this['exports'] = {...}
+ *
+ * results in an error:
+ *
+ *      Cannot do '[]' access on a struct
+ *
+ * So, in order to define 'exports', we must override the @struct assumption by annotating
+ * the class as @unrestricted (or @dict).  Note that this must be done both here and in the
+ * subclass (eg, SerialPort), because otherwise the Compiler won't allow us to *reference*
+ * the named property either.
+ *
+ * TODO: Consider marking ALL our classes unrestricted, because otherwise it forces us to
+ * define every single property the class uses in its constructor, which results in a fair
+ * bit of redundant initialization, since many properties aren't (and don't need to be) fully
+ * initialized until the appropriate init(), reset(), restore(), etc. function is called.
+ *
+ * The upside, however, may be that since the structure of the class is completely defined by
+ * the constructor, JavaScript engines may be able to optimize and run more efficiently.
+ *
+ * @unrestricted
+ */
+class Debugger extends Component
+{
+    /**
+     * Debugger(parmsDbg)
+     *
+     * The Debugger component supports the following optional (parmsDbg) properties:
+     *
+     *      base: the base to use for most numeric input/output (default is 16)
+     *
+     * The Debugger component is a shared component containing a subset of functionality used by
+     * the other CPU-specific Debuggers (eg, DebuggerX86).  Over time, the goal is to factor out as
+     * much common debugging support as possible from those components into this one.
+     *
+     * @param {Object} parmsDbg
+     */
+    constructor(parmsDbg)
+    {
+        if (DEBUGGER) {
+
+            super("Debugger", parmsDbg);
+
+            /*
+             * Default base used to display all values; modified with the "s base" command.
+             */
+            this.nBase = +parmsDbg['base'] || 16;
+
+            /*
+             * Default number of bits of integer precision; it can be overridden by the Debugger
+             * but there is no command to adjust it.
+             */
+            this.nBits = 32;
+
+            this.achGroup = ['{','}'];
+            this.achAddress = ['[',']'];
+
+            /*
+             * These keep track of instruction activity, but only when tracing or when Debugger checks
+             * have been enabled (eg, one or more breakpoints have been set).
+             *
+             * They are zeroed by the reset() notification handler.  cInstructions is advanced by
+             * stepCPU() and checkInstruction() calls.  nCycles is updated by every stepCPU() or stop()
+             * call and simply represents the number of cycles performed by the last run of instructions.
+             */
+            this.nCycles = 0;
+            this.cOpcodes = this.cOpcodesStart = 0;
+
+            /*
+             * fAssemble is true when "assemble mode" is active, false when not.
+             */
+            this.fAssemble = false;
+
+            /*
+             * This maintains command history.  New commands are inserted at index 0 of the array.
+             * When Enter is pressed on an empty input buffer, we default to the command at aPrevCmds[0].
+             */
+            this.iPrevCmd = -1;
+            this.aPrevCmds = [];
+
+            /*
+             * aVariables is an object with properties that grow as setVariable() assigns more variables;
+             * each property corresponds to one variable, where the property name is the variable name (ie,
+             * a string beginning with a non-digit, followed by zero or more symbol characters and/or digits)
+             * and the property value is the variable's numeric value.  See doVar() and setVariable() for
+             * details.
+             *
+             * Note that parseValue() parses variables before numbers, so any variable that looks like a
+             * unprefixed hex value (eg, "a5" as opposed to "0xa5") will trump the numeric value.  Unprefixed
+             * hex values are a convenience of parseValue(), which always calls Str.parseInt() with a default
+             * base of 16; however, that default be overridden with a variety of explicit prefixes or suffixes
+             * (eg, a leading "0o" to indicate octal, a trailing period to indicate decimal, etc.)
+             *
+             * See Str.parseInt() for more details about supported numbers.
+             */
+            this.aVariables = {};
+
+        }   // endif DEBUGGER
+    }
+
+    /**
+     * getRegIndex(sReg, off)
+     *
+     * NOTE: This must be implemented by the individual debuggers.
+     *
+     * @this {Debugger}
+     * @param {string} sReg
+     * @param {number} [off] optional offset into sReg
+     * @return {number} register index, or -1 if not found
+     */
+    getRegIndex(sReg, off)
+    {
+        return -1;
+    }
+
+    /**
+     * getRegValue(iReg)
+     *
+     * NOTE: This must be implemented by the individual debuggers.
+     *
+     * @this {Debugger}
+     * @param {number} iReg
+     * @return {number|undefined}
+     */
+    getRegValue(iReg)
+    {
+        return undefined;
+    }
+
+    /**
+     * parseAddrReference(s, sAddr)
+     *
+     * Returns the given string with the given address reference replaced with the contents of that address.
+     *
+     * NOTE: This must be implemented by the individual debuggers.
+     *
+     * @this {Debugger}
+     * @param {string} s
+     * @param {string} sAddr
+     * @return {string}
+     */
+    parseAddrReference(s, sAddr)
+    {
+        return s.replace('[' + sAddr + ']', "unimplemented");
+    }
+
+    /**
+     * getNextCommand()
+     *
+     * @this {Debugger}
+     * @return {string}
+     */
+    getNextCommand()
+    {
+        var sCmd;
+        if (this.iPrevCmd > 0) {
+            sCmd = this.aPrevCmds[--this.iPrevCmd];
+        } else {
+            sCmd = "";
+            this.iPrevCmd = -1;
+        }
+        return sCmd;
+    }
+
+    /**
+     * getPrevCommand()
+     *
+     * @this {Debugger}
+     * @return {string|null}
+     */
+    getPrevCommand()
+    {
+        var sCmd = null;
+        if (this.iPrevCmd < this.aPrevCmds.length - 1) {
+            sCmd = this.aPrevCmds[++this.iPrevCmd];
+        }
+        return sCmd;
+    }
+
+    /**
+     * parseCommand(sCmd, fSave, chSep)
+     *
+     * @this {Debugger}
+     * @param {string|undefined} sCmd
+     * @param {boolean} [fSave] is true to save the command, false if not
+     * @param {string} [chSep] is the command separator character (default is ';')
+     * @return {Array.<string>}
+     */
+    parseCommand(sCmd, fSave, chSep)
+    {
+        if (fSave) {
+            if (!sCmd) {
+                if (this.fAssemble) {
+                    sCmd = "end";
+                } else {
+                    sCmd = this.aPrevCmds[this.iPrevCmd+1];
+                }
+            } else {
+                if (this.iPrevCmd < 0 && this.aPrevCmds.length) {
+                    this.iPrevCmd = 0;
+                }
+                if (this.iPrevCmd < 0 || sCmd != this.aPrevCmds[this.iPrevCmd]) {
+                    this.aPrevCmds.splice(0, 0, sCmd);
+                    this.iPrevCmd = 0;
+                }
+                this.iPrevCmd--;
+            }
+        }
+        var a = [];
+        if (sCmd) {
+            /*
+             * With the introduction of breakpoint commands (ie, quoted command sequences
+             * associated with a breakpoint), we can no longer perform simplistic splitting.
+             *
+             *      a = sCmd.split(chSep || ';');
+             *      for (var i = 0; i < a.length; i++) a[i] = Str.trim(a[i]);
+             *
+             * We may now split on semi-colons ONLY if they are outside a quoted sequence.
+             *
+             * Also, to allow quoted strings *inside* breakpoint commands, we first replace all
+             * DOUBLE double-quotes with single quotes.
+             */
+            sCmd = sCmd.replace(/""/g, "'");
+
+            var iPrev = 0;
+            var chQuote = null;
+            chSep = chSep || ';';
+            /*
+             * NOTE: Processing charAt() up to and INCLUDING length is not a typo; we're taking
+             * advantage of the fact that charAt() with an invalid index returns an empty string,
+             * allowing us to use the same substring() call to capture the final portion of sCmd.
+             *
+             * In a sense, it allows us to pretend that the string ends with a zero terminator.
+             */
+            for (var i = 0; i <= sCmd.length; i++) {
+                var ch = sCmd.charAt(i);
+                if (ch == '"' || ch == "'") {
+                    if (!chQuote) {
+                        chQuote = ch;
+                    } else if (ch == chQuote) {
+                        chQuote = null;
+                    }
+                }
+                else if (ch == chSep && !chQuote || !ch) {
+                    /*
+                     * Recall that substring() accepts starting (inclusive) and ending (exclusive)
+                     * indexes, whereas substr() accepts a starting index and a length.  We need the former.
+                     */
+                    a.push(Str.trim(sCmd.substring(iPrev, i)));
+                    iPrev = i + 1;
+                }
+            }
+        }
+        return a;
+    }
+
+    /**
+     * evalAND(dst, src)
+     *
+     * Adapted from /modules/pdp10/lib/cpuops.js:PDP10.AND().
+     *
+     * Performs the bitwise "and" (AND) of two operands > 32 bits.
+     *
+     * @this {Debugger}
+     * @param {number} dst
+     * @param {number} src
+     * @return {number} (dst & src)
+     */
+    evalAND(dst, src)
+    {
+        /*
+         * We AND the low 32 bits separately from the higher bits, and then combine them with addition.
+         * Since all bits above 32 will be zero, and since 0 AND 0 is 0, no special masking for the higher
+         * bits is required.
+         *
+         * WARNING: When using JavaScript's 32-bit operators with values that could set bit 31 and produce a
+         * negative value, it's critical to perform a final right-shift of 0, ensuring that the final result is
+         * positive.
+         */
+        if (this.nBits <= 32) {
+            return dst & src;
+        }
+        /*
+         * Negative values don't yield correct results when dividing, so pass them through an unsigned truncate().
+         */
+        dst = this.truncate(dst, 0, true);
+        src = this.truncate(src, 0, true);
+        return ((((dst / Debugger.TWO_POW32)|0) & ((src / Debugger.TWO_POW32)|0)) * Debugger.TWO_POW32) + ((dst & src) >>> 0);
+    }
+
+    /**
+     * evalIOR(dst, src)
+     *
+     * Adapted from /modules/pdp10/lib/cpuops.js:PDP10.IOR().
+     *
+     * Performs the logical "inclusive-or" (OR) of two operands > 32 bits.
+     *
+     * @this {Debugger}
+     * @param {number} dst
+     * @param {number} src
+     * @return {number} (dst | src)
+     */
+    evalIOR(dst, src)
+    {
+        /*
+         * We OR the low 32 bits separately from the higher bits, and then combine them with addition.
+         * Since all bits above 32 will be zero, and since 0 OR 0 is 0, no special masking for the higher
+         * bits is required.
+         *
+         * WARNING: When using JavaScript's 32-bit operators with values that could set bit 31 and produce a
+         * negative value, it's critical to perform a final right-shift of 0, ensuring that the final result is
+         * positive.
+         */
+        if (this.nBits <= 32) {
+            return dst | src;
+        }
+        /*
+         * Negative values don't yield correct results when dividing, so pass them through an unsigned truncate().
+         */
+        dst = this.truncate(dst, 0, true);
+        src = this.truncate(src, 0, true);
+        return ((((dst / Debugger.TWO_POW32)|0) | ((src / Debugger.TWO_POW32)|0)) * Debugger.TWO_POW32) + ((dst | src) >>> 0);
+    }
+
+    /**
+     * evalXOR(dst, src)
+     *
+     * Adapted from /modules/pdp10/lib/cpuops.js:PDP10.XOR().
+     *
+     * Performs the logical "exclusive-or" (XOR) of two operands > 32 bits.
+     *
+     * @this {Debugger}
+     * @param {number} dst
+     * @param {number} src
+     * @return {number} (dst ^ src)
+     */
+    evalXOR(dst, src)
+    {
+        /*
+         * We XOR the low 32 bits separately from the higher bits, and then combine them with addition.
+         * Since all bits above 32 will be zero, and since 0 XOR 0 is 0, no special masking for the higher
+         * bits is required.
+         *
+         * WARNING: When using JavaScript's 32-bit operators with values that could set bit 31 and produce a
+         * negative value, it's critical to perform a final right-shift of 0, ensuring that the final result is
+         * positive.
+         */
+        if (this.nBits <= 32) {
+            return dst | src;
+        }
+        /*
+         * Negative values don't yield correct results when dividing, so pass them through an unsigned truncate().
+         */
+        dst = this.truncate(dst, 0, true);
+        src = this.truncate(src, 0, true);
+        return ((((dst / Debugger.TWO_POW32)|0) ^ ((src / Debugger.TWO_POW32)|0)) * Debugger.TWO_POW32) + ((dst ^ src) >>> 0);
+    }
+
+    /**
+     * evalMUL(dst, src)
+     *
+     * I could have adapted the code from /modules/pdp10/lib/cpuops.js:PDP10.doMUL(), but it was simpler to
+     * write this base method and let the PDP-10 Debugger override it with a call to the *actual* doMUL() method.
+     *
+     * @this {Debugger}
+     * @param {number} dst
+     * @param {number} src
+     * @return {number} (dst * src)
+     */
+    evalMUL(dst, src)
+    {
+        return dst * src;
+    }
+
+    /**
+     * truncate(v, nBits, fUnsigned)
+     *
+     * @this {Debugger}
+     * @param {number} v
+     * @param {number} [nBits]
+     * @param {boolean} [fUnsigned]
+     * @return {number}
+     */
+    truncate(v, nBits, fUnsigned)
+    {
+        var limit, vNew = v;
+        nBits = nBits || this.nBits;
+
+        if (fUnsigned) {
+            if (nBits == 32) {
+                vNew = v >>> 0;
+            }
+            else if (nBits < 32) {
+                vNew = v & ((1 << nBits) - 1);
+            }
+            else {
+                limit = Math.pow(2, nBits);
+                if (v < 0 || v >= limit) {
+                    vNew = v % limit;
+                    if (vNew < 0) vNew += limit;
+                }
+            }
+        }
+        else {
+            if (nBits <= 32) {
+                vNew = (v << (32 - nBits)) >> (32 - nBits);
+            }
+            else {
+                limit = Math.pow(2, nBits - 1);
+                if (v >= limit) {
+                    vNew = (v % limit);
+                    if (((v / limit)|0) & 1) vNew -= limit;
+                } else if (v < -limit) {
+                    vNew = (v % limit);
+                    if ((((-v - 1) / limit) | 0) & 1) {
+                        if (vNew) vNew += limit;
+                    }
+                    else {
+                        if (!vNew) vNew -= limit;
+                    }
+                }
+            }
+        }
+        if (v != vNew) {
+            if (MAXDEBUG) this.println("warning: value " + v + " truncated to " + vNew);
+            v = vNew;
+        }
+        return v;
+    }
+
+    /**
+     * evalOps(aVals, aOps, cOps)
+     *
+     * Some of our clients want a specific number of bits of integer precision.  If that precision is
+     * greater than 32, some of the operations below will fail; for example, JavaScript bitwise operators
+     * always truncate the result to 32 bits, so beware when using shift operations.  Similarly, it would
+     * be wrong to always "|0" the final result, which is why we rely on truncate() now.
+     *
+     * Note that JavaScript integer precision is limited to 52 bits.  For example, in Node, if you set a
+     * variable to 0x80000001:
+     *
+     *      foo=0x80000001|0
+     *
+     * then calculate foo*foo and display the result in binary using "(foo*foo).toString(2)":
+     *
+     *      '11111111111111111111111111111100000000000000000000000000000000'
+     *
+     * which is slightly incorrect because it has overflowed JavaScript's floating-point precision.
+     *
+     * 0x80000001 in decimal is -2147483647, so the product is 4611686014132420609, which is 0x3FFFFFFF00000001.
+     *
+     * @this {Debugger}
+     * @param {Array.<number>} aVals
+     * @param {Array.<string>} aOps
+     * @param {number} [cOps] (default is -1 for all)
+     * @return {boolean} true if successful, false if error
+     */
+    evalOps(aVals, aOps, cOps = -1)
+    {
+        while (cOps-- && aOps.length) {
+            var chOp = aOps.pop();
+            if (aVals.length < 2) return false;
+            var valNew;
+            var val2 = aVals.pop();
+            var val1 = aVals.pop();
+            switch(chOp) {
+            case '*':
+                valNew = this.evalMUL(val1, val2);
+                break;
+            case '/':
+                if (!val2) return false;
+                valNew = Math.trunc(val1 / val2);
+                break;
+            case '^/':
+                if (!val2) return false;
+                valNew = val1 % val2;
+                break;
+            case '+':
+                valNew = val1 + val2;
+                break;
+            case '-':
+                valNew = val1 - val2;
+                break;
+            case '<<':
+                valNew = val1 << val2;
+                break;
+            case '>>':
+                valNew = val1 >> val2;
+                break;
+            case '>>>':
+                valNew = val1 >>> val2;
+                break;
+            case '<':
+                valNew = (val1 < val2? 1 : 0);
+                break;
+            case '<=':
+                valNew = (val1 <= val2? 1 : 0);
+                break;
+            case '>':
+                valNew = (val1 > val2? 1 : 0);
+                break;
+            case '>=':
+                valNew = (val1 >= val2? 1 : 0);
+                break;
+            case '==':
+                valNew = (val1 == val2? 1 : 0);
+                break;
+            case '!=':
+                valNew = (val1 != val2? 1 : 0);
+                break;
+            case '&':
+                valNew = this.evalAND(val1, val2);
+                break;
+            case '!':           // alias for MACRO-10 to perform a bitwise inclusive-or (OR)
+            case '|':
+                valNew = this.evalIOR(val1, val2);
+                break;
+            case '^!':          // since MACRO-10 uses '^' for base overrides, '^!' is used for bitwise exclusive-or (XOR)
+                valNew = this.evalXOR(val1, val2);
+                break;
+            case '&&':
+                valNew = (val1 && val2? 1 : 0);
+                break;
+            case '||':
+                valNew = (val1 || val2? 1 : 0);
+                break;
+            case ',,':
+                valNew = this.truncate(val1, 18, true) * Math.pow(2, 18) + this.truncate(val2, 18, true);
+                break;
+            case '_':
+            case '^_':
+                valNew = val1;
+                /*
+                 * While we always try to avoid assuming any particular number of bits of precision, the 'B' shift
+                 * operator (which we've converted to '^_') is unique to the MACRO-10 environment, which imposes the
+                 * following restrictions on the shift count.
+                 */
+                if (chOp == '^_') val2 = 35 - (val2 & 0xff);
+                if (val2) {
+                    /*
+                     * Since binary shifting is a logical (not arithmetic) operation, and since shifting by division only
+                     * works properly with positive numbers, we call truncate() to produce an unsigned value.
+                     */
+                    valNew = this.truncate(valNew, 0, true);
+                    if (val2 > 0) {
+                        valNew *= Math.pow(2, val2);
+                    } else {
+                        valNew = Math.trunc(valNew / Math.pow(2, -val2));
+                    }
+                }
+                break;
+            default:
+                return false;
+            }
+            aVals.push(this.truncate(valNew));
+        }
+        return true;
+    }
+
+    /**
+     * parseArray(asValues, iValue, iLimit, nBase, aUndefined)
+     *
+     * parseExpression() takes a complete expression and divides it into array elements, where even elements
+     * are values (which may be empty if two or more operators appear consecutively) and odd elements are operators.
+     *
+     * For example, if the original expression was "2*{3+{4/2}}", parseExpression() would call parseArray() with:
+     *
+     *      0   1   2   3   4   5   6   7   8   9  10  11  12  13  14
+     *      -   -   -   -   -   -   -   -   -   -  --  --  --  --  --
+     *      2   *       {   3   +       {   4   /   2   }       }
+     *
+     * This function takes care of recursively processing grouped expressions, by processing subsets of the array,
+     * as well as handling certain base overrides (eg, temporarily switching to base-10 for binary shift suffixes).
+     *
+     * @param {Array.<string>} asValues
+     * @param {number} iValue
+     * @param {number} iLimit
+     * @param {number} nBase
+     * @param {Array|undefined} [aUndefined]
+     * @return {number|undefined}
+     */
+    parseArray(asValues, iValue, iLimit, nBase, aUndefined)
+    {
+        var value;
+        var sValue, sOp;
+        var fError = false;
+        var nUnary = 0;
+        var aVals = [], aOps = [];
+
+        var nBasePrev = this.nBase;
+        this.nBase = nBase;
+
+        while (iValue < iLimit) {
+            var v;
+            sValue = asValues[iValue++].trim();
+            sOp = (iValue < iLimit? asValues[iValue++] : "");
+
+            if (sValue) {
+                v = this.parseValue(sValue, null, aUndefined, nUnary);
+            } else {
+                if (sOp == '{') {
+                    var cOpen = 1;
+                    var iStart = iValue;
+                    while (iValue < iLimit) {
+                        sValue = asValues[iValue++].trim();
+                        sOp = (iValue < asValues.length? asValues[iValue++] : "");
+                        if (sOp == '{') {
+                            cOpen++;
+                        } else if (sOp == '}') {
+                            if (!--cOpen) break;
+                        }
+                    }
+                    v = this.parseArray(asValues, iStart, iValue-1, this.nBase, aUndefined);
+                    if (v != null && nUnary) {
+                        v = this.parseUnary(v, nUnary);
+                    }
+                    sValue = (iValue < iLimit? asValues[iValue++].trim() : "");
+                    sOp = (iValue < iLimit? asValues[iValue++] : "");
+                }
+                else {
+                    /*
+                     * When parseExpression() calls us, it has collapsed all runs of whitespace into single spaces,
+                     * and although it allows single spaces to divide the elements of the expression, a space is neither
+                     * a unary nor binary operator.  It's essentially a no-op.  If we encounter it here, then it followed
+                     * another operator and is easily ignored (although perhaps it should still trigger a reset of nBase
+                     * and nUnary -- TBD).
+                     */
+                    if (sOp == ' ') {
+                        continue;
+                    }
+                    if (sOp == '^B') {
+                        this.nBase = 2;
+                        continue;
+                    }
+                    if (sOp == '^O') {
+                        this.nBase = 8;
+                        continue;
+                    }
+                    if (sOp == '^D') {
+                        this.nBase = 10;
+                        continue;
+                    }
+                    if (!(nUnary & (0xC0000000|0))) {
+                        if (sOp == '+') {
+                            continue;
+                        }
+                        if (sOp == '-') {
+                            nUnary = (nUnary << 2) | 1;
+                            continue;
+                        }
+                        if (sOp == '~' || sOp == '^-') {
+                            nUnary = (nUnary << 2) | 2;
+                            continue;
+                        }
+                        if (sOp == '^L') {
+                            nUnary = (nUnary << 2) | 3;
+                            continue;
+                        }
+                    }
+                    fError = true;
+                    break;
+                }
+            }
+
+            if (v === undefined) {
+                if (aUndefined) {
+                    aUndefined.push(sValue);
+                    v = 0;
+                } else {
+                    fError = true;
+                    aUndefined = [];
+                    break;
+                }
+            }
+
+            aVals.push(this.truncate(v));
+
+            /*
+             * When parseExpression() calls us, it has collapsed all runs of whitespace into single spaces,
+             * and although it allows single spaces to divide the elements of the expression, a space is neither
+             * a unary nor binary operator.  It's essentially a no-op.  If we encounter it here, then it followed
+             * a value, and since we don't want to misinterpret the next operator as a unary operator, we look
+             * ahead and grab the next operator if it's not preceded by a value.
+             */
+            if (sOp == ' ') {
+                if (iValue < asValues.length - 1 && !asValues[iValue]) {
+                    iValue++;
+                    sOp = asValues[iValue++]
+                } else {
+                    fError = true;
+                    break;
+                }
+            }
+
+            if (!sOp) break;
+
+            var aBinOp = (this.achGroup[0] == '<'? Debugger.aDECOpPrecedence : Debugger.aBinOpPrecedence);
+            if (!aBinOp[sOp]) {
+                fError = true;
+                break;
+            }
+            if (aOps.length && aBinOp[sOp] <= aBinOp[aOps[aOps.length - 1]]) {
+                this.evalOps(aVals, aOps, 1);
+            }
+            aOps.push(sOp);
+
+            /*
+             * The MACRO-10 binary shifting operator assumes a base-10 shift count, regardless of the current
+             * base, so we must override the current base to ensure the count is parsed correctly.
+             */
+            this.nBase = (sOp == '^_')? 10 : nBase;
+            nUnary = 0;
+        }
+
+        if (fError || !this.evalOps(aVals, aOps) || aVals.length != 1) {
+            fError = true;
+        }
+
+        if (!fError) {
+            value = aVals.pop();
+
+        } else if (!aUndefined) {
+            this.println("parse error (" + (sValue || sOp) + ")");
+        }
+
+        this.nBase = nBasePrev;
+        return value;
+    }
+
+    /**
+     * parseASCII(sExp, chDelim, nBits, cchMax)
+     *
+     * @this {Debugger}
+     * @param {string} sExp
+     * @param {string} chDelim
+     * @param {number} nBits
+     * @param {number} cchMax
+     * @return {string|undefined}
+     */
+    parseASCII(sExp, chDelim, nBits, cchMax)
+    {
+        var i;
+        while ((i = sExp.indexOf(chDelim)) >= 0) {
+            var v = 0;
+            var j = i + 1;
+            var cch = cchMax;
+            while (j < sExp.length) {
+                var ch = sExp[j++];
+                if (ch == chDelim) {
+                    cch = -1;
+                    break;
+                }
+                if (!cch) break;
+                cch--;
+                var c = ch.charCodeAt(0);
+                if (nBits == 7) {
+                    c &= 0x7F;
+                } else {
+                    c = (c - 0x20) & 0x3F;
+                }
+                v = this.truncate(v * Math.pow(2, nBits) + c, nBits * cchMax, true);
+            }
+            if (cch >= 0) {
+                this.println("parse error (" + chDelim + sExp + chDelim + ")");
+                return undefined;
+            } else {
+                sExp = sExp.substr(0, i) + this.toStrBase(v, -1) + sExp.substr(j);
+            }
+        }
+        return sExp;
+    }
+
+    /**
+     * parseExpression(sExp, fQuiet)
+     *
+     * A quick-and-dirty expression parser.  It takes an expression like:
+     *
+     *      EDX+EDX*4+12345678
+     *
+     * and builds a value stack in aVals and a "binop" (binary operator) stack in aOps:
+     *
+     *      aVals       aOps
+     *      -----       ----
+     *      EDX         +
+     *      EDX         *
+     *      4           +
+     *      ...
+     *
+     * We pop 1 "binop" from aOps and 2 values from aVals whenever a "binop" of lower priority than its
+     * predecessor is encountered, evaluate, and push the result back onto aVals.  Only selected unary
+     * operators are supported (eg, negate and complement); no ternary operators like '?:' are supported.
+     *
+     * fQuiet can be used to pass an array that collects any undefined variables that parseExpression()
+     * encounters; the value of an undefined variable is zero.  This mode was added for components that need
+     * to support expressions containing "fixups" (ie, values that must be determined later).
+     *
+     * @this {Debugger}
+     * @param {string|undefined} sExp
+     * @param {Array|undefined|boolean} [fQuiet]
+     * @return {number|undefined} numeric value, or undefined if sExp contains any undefined or invalid values
+     */
+    parseExpression(sExp, fQuiet)
+    {
+        var value = undefined;
+        var fPrint = (fQuiet === false);
+        var aUndefined = Array.isArray(fQuiet)? fQuiet : undefined;
+
+        if (sExp) {
+
+            /*
+             * The default delimiting characters for grouped expressions are braces; they can be changed by altering
+             * achGroup, but when that happens, instead of changing our regular expressions and operator tables,
+             * we simply replace all achGroup characters with braces in the given expression.
+             *
+             * Why not use parentheses for grouped expressions?  Because some debuggers use parseReference() to perform
+             * parenthetical value replacements in message strings, and they don't want parentheses taking on a different
+             * meaning.  And for some machines, like the PDP-10, the convention is to use parentheses for other things,
+             * like indexed addressing, and to use angle brackets for grouped expressions.
+             */
+            if (this.achGroup[0] != '{') {
+                sExp = sExp.split(this.achGroup[0]).join('{').split(this.achGroup[1]).join('}');
+            }
+
+            /*
+             * Quoted ASCII characters can have a numeric value, too, which must be converted now, to avoid any
+             * conflicts with the operators below.
+             */
+            sExp = this.parseASCII(sExp, '"', 7, 5);    // MACRO-10 packs up to 5 7-bit ASCII codes into a value
+            if (!sExp) return value;
+            sExp = this.parseASCII(sExp, "'", 6, 6);    // MACRO-10 packs up to 6 6-bit ASCII (SIXBIT) codes into a value
+            if (!sExp) return value;
+
+            /*
+             * All browsers (including, I believe, IE9 and up) support the following idiosyncrasy of a RegExp split():
+             * when the RegExp uses a capturing pattern, the resulting array will include entries for all the pattern
+             * matches along with the non-matches.  This effectively means that, in the set of expressions that we
+             * support, all even entries in asValues will contain "values" and all odd entries will contain "operators".
+             *
+             * Although I started listing the operators in the RegExp in "precedential" order, that's not important;
+             * what IS important is listing operators than contain shorter operators first.  For example, bitwise
+             * shift operators must be listed BEFORE the logical less-than or greater-than operators.  The aBinOp tables
+             * (aBinOpPrecedence and aDECOpPrecedence) are what determine precedence, not the RegExp.
+             *
+             * Also, to better accommodate MACRO-10 syntax, I've replaced the single '^' for XOR with '^!', and I've
+             * added '!' as an alias for '|' (bitwise inclusive-or), '^-' as an alias for '~' (one's complement operator),
+             * and '_' as a shift operator (+/- values specify a left/right shift, and the count is not limited to 32).
+             *
+             * And to avoid conflicts with MACRO-10 syntax, I've replaced the original mod operator ('%') with '^/'.
+             *
+             * The MACRO-10 binary shifting suffix ('B') is a bit more problematic, since a capital B can also appear
+             * inside symbols, or inside hex values.  So if the default base is NOT 16, then I pre-scan for that suffix
+             * and replace all non-symbolic occurrences with an internal shift operator ('^_').
+             *
+             * Note that Str.parseInt(), which parseValue() relies on, supports both the MACRO-10 base prefix overrides
+             * and the binary shifting suffix ('B'), but since that suffix can also be a bracketed expression, we have to
+             * support it here as well.
+             *
+             * MACRO-10 supports only a subset of all the PCjs operators; for example, MACRO-10 doesn't support any of
+             * the boolean logical/compare operators.  But unless we run into conflicts, I prefer sticking with this
+             * common set of operators.
+             *
+             * All whitespace in the expression is collapsed to single spaces, and space has been added to the list
+             * of "operators", but its sole function is as a separator, not as an operator.  parseArray() will ignore
+             * single spaces as long as they are preceded and/or followed by a "real" operator.  It would be dangerous
+             * to remove spaces entirely, because if an operator-less expression like "A B" was passed in, we would want
+             * that to generate an error; if we converted it to "AB", evaluation might inadvertently succeed.
+             */
+            var regExp = /({|}|\|\||&&|\||\^!|\^B|\^O|\^D|\^L|\^-|~|\^_|_|&|!=|!|==|>=|>>>|>>|>|<=|<<|<|-|\+|\^\/|\/|\*|,,| )/;
+            if (this.nBase != 16) {
+                sExp = sExp.replace(/(^|[^A-Z0-9$%.])([0-9]+)B/, "$1$2^_").replace(/\s+/g, ' ');
+            }
+            var asValues = sExp.split(regExp);
+            value = this.parseArray(asValues, 0, asValues.length, this.nBase, aUndefined);
+            if (value !== undefined && fPrint) {
+                this.printValue(null, value);
+            }
+        }
+        return value;
+    }
+
+    /**
+     * parseReference(s)
+     *
+     * Returns the given string with any "{expression}" sequences replaced with the value of the expression,
+     * and any "[address]" references replaced with the contents of the address.  Expressions are parsed BEFORE
+     * addresses.
+     *
+     * @this {Debugger}
+     * @param {string} s
+     * @return {string|undefined}
+     */
+    parseReference(s)
+    {
+        var a;
+        var chOpen = this.achGroup[0];
+        var chClose = this.achGroup[1];
+        var chEscape = (chOpen == '(' || chOpen == '{' || chOpen == '[')? '\\' : '';
+        var chInnerEscape = (chOpen == '['? '\\' : '');
+        var reSubExp = new RegExp(chEscape + chOpen + "([^" + chInnerEscape + chOpen + chInnerEscape + chClose + "]+)" + chEscape + chClose);
+        while (a = s.match(reSubExp)) {
+            var value = this.parseExpression(a[1]);
+            if (value === undefined) return undefined;
+            var sSearch = chOpen + a[1] + chClose;
+            var sReplace = value != null? this.toStrBase(value) : "undefined";
+            /*
+             * Note that by default, the String replace() method only replaces the FIRST occurrence,
+             * and there MIGHT be more than one occurrence of the expression we just parsed, so we could
+             * do this instead:
+             *
+             *      s = s.split(sSearch).join(sReplace);
+             *
+             * However, that's knd of an expensive (slow) solution, and it's not strictly necessary, since
+             * any additional identical expressions will be picked up on a subsequent iteration through this loop.
+             */
+            s = s.replace(sSearch, sReplace);
+        }
+        if (this.achAddress.length) {
+            chOpen = this.achAddress[0];
+            chClose = this.achAddress[1];
+            chEscape = (chOpen == '(' || chOpen == '{' || chOpen == '[')? '\\' : '';
+            chInnerEscape = (chOpen == '['? '\\' : '');
+            reSubExp = new RegExp(chEscape + chOpen + "([^" + chInnerEscape + chOpen + chInnerEscape + chClose + "]+)" + chEscape + chClose);
+            while (a = s.match(reSubExp)) {
+                s = this.parseAddrReference(s, a[1]);
+            }
+        }
+        return this.parseSysVars(s);
+    }
+
+    /**
+     * parseSysVars(s)
+     *
+     * Returns the given string with any recognized "$var" replaced with its value; eg:
+     *
+     *      $ops: the number of opcodes executed since the last time it was displayed (or reset)
+     *
+     * @this {Debugger}
+     * @param {string} s
+     * @return {string}
+     */
+    parseSysVars(s)
+    {
+        var a;
+        while (a = s.match(/\$([a-z]+)/i)) {
+            var v = null;
+            switch(a[1].toLowerCase()) {
+            case "ops":
+                v = this.cOpcodes - this.cOpcodesStart;
+                break;
+            }
+            if (v == null) break;
+            s = s.replace(a[0], v.toString());
+        }
+        return s;
+    }
+
+    /**
+     * parseUnary(value, nUnary)
+     *
+     * nUnary is actually a small "stack" of unary operations encoded in successive pairs of bits.
+     * As parseExpression() encounters each unary operator, nUnary is shifted left 2 bits, and the
+     * new unary operator is encoded in bits 0 and 1 (0b00 is none, 0b01 is negate, 0b10 is complement,
+     * and 0b11 is reserved).  Here, we process the bits in reverse order (hence the stack-like nature),
+     * ensuring that we process the unary operators associated with this value right-to-left.
+     *
+     * Since bitwise operators see only 32 bits, more than 16 unary operators cannot be supported
+     * using this method.  We'll let parseExpression() worry about that; if it ever happens in practice,
+     * then we'll have to switch to a more "expensive" approach (eg, an actual array of unary operators).
+     *
+     * @this {Debugger}
+     * @param {number} value
+     * @param {number} nUnary
+     * @return {number}
+     */
+    parseUnary(value, nUnary)
+    {
+        while (nUnary) {
+            switch(nUnary & 0o3) {
+            case 1:
+                value = -this.truncate(value);
+                break;
+            case 2:
+                value = this.evalXOR(value, -1);        // this is easier than adding an evalNOT()...
+                break;
+            case 3:
+                var bit = 35;                           // simple left-to-right zero-bit-counting loop...
+                while (bit >= 0 && !this.evalAND(value, Math.pow(2, bit))) bit--;
+                value = 35 - bit;
+                break;
+            }
+            nUnary >>>= 2;
+        }
+        return value;
+    }
+
+    /**
+     * parseValue(sValue, sName, fQuiet, nUnary)
+     *
+     * @this {Debugger}
+     * @param {string|undefined} sValue
+     * @param {string|null} [sName] is the name of the value, if any
+     * @param {Array|undefined|boolean} [fQuiet]
+     * @param {number} [nUnary] (0 for none, 1 for negate, 2 for complement, 3 for leading zeros)
+     * @return {number|undefined} numeric value, or undefined if sValue is either undefined or invalid
+     */
+    parseValue(sValue, sName, fQuiet, nUnary = 0)
+    {
+        var value;
+        var aUndefined = Array.isArray(fQuiet)? fQuiet : undefined;
+
+        if (sValue != null) {
+            var iReg = this.getRegIndex(sValue);
+            if (iReg >= 0) {
+                value = this.getRegValue(iReg);
+            } else {
+                value = this.getVariable(sValue);
+                if (value != null) {
+                    var sUndefined = this.getVariableFixup(sValue);
+                    if (sUndefined) {
+                        if (aUndefined) {
+                            aUndefined.push(sUndefined);
+                        } else {
+                            var valueUndefined = this.parseExpression(sUndefined, fQuiet);
+                            if (valueUndefined !== undefined) {
+                                value += valueUndefined;
+                            } else {
+                                if (!fQuiet) {
+                                    this.println("undefined " + (sName || "value") + ": " + sValue + " (" + sUndefined + ")");
+                                }
+                                value = undefined;
+                            }
+                        }
+                    }
+                } else {
+                    /*
+                     * A feature of MACRO-10 is that any single-digit number is automatically interpreted as base-10.
+                     */
+                    value = Str.parseInt(sValue, sValue.length > 1 || this.nBase > 10? this.nBase : 10);
+                }
+            }
+            if (value != null) {
+                value = this.truncate(this.parseUnary(value, nUnary));
+            } else {
+                if (!fQuiet) {
+                    this.println("invalid " + (sName || "value") + ": " + sValue);
+                }
+            }
+        } else {
+            if (!fQuiet) {
+                this.println("missing " + (sName || "value"));
+            }
+        }
+        return value;
+    }
+
+    /**
+     * printValue(sVar, value)
+     *
+     * @this {Debugger}
+     * @param {string|null} sVar
+     * @param {number|undefined} value
+     * @return {boolean} true if value defined, false if not
+     */
+    printValue(sVar, value)
+    {
+        var sValue;
+        var fDefined = false;
+        if (value !== undefined) {
+            fDefined = true;
+            if (this.nBase == 8) {
+                sValue = this.toStrBase(value, this.nBits, 8, 1) + "  " + value + '.';
+            } else {
+                sValue = this.toStrBase(value, this.nBits, 16, 1) + "  " + this.toStrBase(value, this.nBits, 8, 1) + "  " + this.toStrBase(value, this.nBits, 2, this.nBits <= 32? 8 : 6) + "  " + value + '.';
+            }
+            if (value >= 0x20 && value < 0x7F) {
+                sValue += " '" + String.fromCharCode(value) + "'";
+            }
+        }
+        sVar = (sVar != null? (sVar + ": ") : "");
+        this.println(sVar + sValue);
+        return fDefined;
+    }
+
+    /**
+     * resetVariables()
+     *
+     * @this {Debugger}
+     * @return {Object}
+     */
+    resetVariables()
+    {
+        var a = this.aVariables;
+        this.aVariables = {};
+        return a;
+    }
+
+    /**
+     * restoreVariables(a)
+     *
+     * @this {Debugger}
+     * @param {Object} a (from previous resetVariables() call)
+     */
+    restoreVariables(a)
+    {
+        this.aVariables = a;
+    }
+
+    /**
+     * printVariable(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} [sVar]
+     * @return {boolean} true if all value(s) defined, false if not
+     */
+    printVariable(sVar)
+    {
+        var cVariables = 0;
+        if (this.aVariables) {
+            if (sVar) {
+                return this.printValue(sVar, this.aVariables[sVar] && this.aVariables[sVar].value);
+            }
+            var aVars = Object.keys(this.aVariables);
+            aVars.sort();
+            for (var i = 0; i < aVars.length; i++) {
+                this.printValue(aVars[i], this.aVariables[aVars[i]].value);
+                cVariables++;
+            }
+        }
+        return cVariables > 0;
+    }
+
+    /**
+     * delVariable(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     */
+    delVariable(sVar)
+    {
+        delete this.aVariables[sVar];
+    }
+
+    /**
+     * getVariable(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     * @return {number|undefined}
+     */
+    getVariable(sVar)
+    {
+        if (this.aVariables[sVar]) {
+            return this.aVariables[sVar].value;
+        }
+        sVar = sVar.substr(0, 6);
+        return this.aVariables[sVar] && this.aVariables[sVar].value;
+    }
+
+    /**
+     * getVariableFixup(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     * @return {string|undefined}
+     */
+    getVariableFixup(sVar)
+    {
+        return this.aVariables[sVar] && this.aVariables[sVar].sUndefined;
+    }
+
+    /**
+     * isVariable(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     * @return {boolean}
+     */
+    isVariable(sVar)
+    {
+        return this.aVariables[sVar] !== undefined;
+    }
+
+    /**
+     * setVariable(sVar, value, sUndefined)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     * @param {number} value
+     * @param {string|undefined} [sUndefined]
+     */
+    setVariable(sVar, value, sUndefined)
+    {
+        this.aVariables[sVar] = {value, sUndefined};
+    }
+
+    /**
+     * toStrBase(n, nBits, nBase, nGrouping)
+     *
+     * Use this instead of Str's toOct()/toDec()/toHex() to convert numbers to the Debugger's default base.
+     *
+     * @this {Debugger}
+     * @param {number|null|undefined} n
+     * @param {number} [nBits] (-1 to strip leading zeros, 0 to allow a variable number of digits)
+     * @param {number} [nBase]
+     * @param {number} [nGrouping] (if nBase is 2, this is a grouping; otherwise, it's a prefix condition)
+     * @return {string}
+     */
+    toStrBase(n, nBits = 0, nBase = 0, nGrouping = 0)
+    {
+        var s;
+        switch(nBase || this.nBase) {
+        case 2:
+            s = Str.toBin(n, nBits > 0? nBits : 0, nGrouping);
+            break;
+        case 8:
+            s = Str.toOct(n, nBits > 0? ((nBits + 2)/3)|0 : 0, !!nGrouping);
+            break;
+        case 10:
+            /*
+             * The multiplier is actually Math.log(2)/Math.log(10), but an approximation is more than adequate.
+             */
+            s = Str.toDec(n, nBits > 0? Math.ceil(nBits * 0.3) : 0);
+            break;
+        case 16:
+        default:
+            s = Str.toHex(n, nBits > 0? ((nBits + 3) >> 2) : 0, !!nGrouping);
+            break;
+        }
+        return (nBits < 0? Str.stripLeadingZeros(s) : s);
+    }
+}
+
+if (DEBUGGER) {
+
+    /*
+     * These are our operator precedence tables.  Operators toward the bottom (with higher values) have
+     * higher precedence.  aBinOpPrecedence was our original table; we had to add aDECOpPrecedence because
+     * the precedence of operators in DEC's MACRO-10 expressions differ.  Having separate tables also allows
+     * us to remove operators that shouldn't be supported, but unless some operator creates a problem,
+     * I prefer to keep as much commonality between the tables as possible.
+     *
+     * Missing from these tables are the (limited) set of unary operators we support (negate and complement),
+     * since this is only a BINARY operator precedence, not a general-purpose precedence table.  Assume that
+     * all unary operators take precedence over all binary operators.
+     */
+    Debugger.aBinOpPrecedence = {
+        '||':   5,      // logical OR
+        '&&':   6,      // logical AND
+        '!':    7,      // bitwise OR (conflicts with logical NOT, but we never supported that)
+        '|':    7,      // bitwise OR
+        '^!':   8,      // bitwise XOR (added by MACRO-10 sometime between the 1972 and 1978 versions)
+        '&':    9,      // bitwise AND
+        '!=':   10,     // inequality
+        '==':   10,     // equality
+        '>=':   11,     // greater than or equal to
+        '>':    11,     // greater than
+        '<=':   11,     // less than or equal to
+        '<':    11,     // less than
+        '>>>':  12,     // unsigned bitwise right shift
+        '>>':   12,     // bitwise right shift
+        '<<':   12,     // bitwise left shift
+        '-':    13,     // subtraction
+        '+':    13,     // addition
+        '^/':   14,     // remainder
+        '/':    14,     // division
+        '*':    14,     // multiplication
+        '_':    19,     // MACRO-10 shift operator
+        '^_':   19,     // MACRO-10 internal shift operator (converted from 'B' suffix form that MACRO-10 uses)
+        '{':    20,     // open grouped expression (converted from achGroup[0])
+        '}':    20      // close grouped expression (converted from achGroup[1])
+    };
+    Debugger.aDECOpPrecedence = {
+        ',,':   1,      // high-word,,low-word
+        '||':   5,      // logical OR
+        '&&':   6,      // logical AND
+        '!=':   10,     // inequality
+        '==':   10,     // equality
+        '>=':   11,     // greater than or equal to
+        '>':    11,     // greater than
+        '<=':   11,     // less than or equal to
+        '<':    11,     // less than
+        '>>>':  12,     // unsigned bitwise right shift
+        '>>':   12,     // bitwise right shift
+        '<<':   12,     // bitwise left shift
+        '-':    13,     // subtraction
+        '+':    13,     // addition
+        '^/':   14,     // remainder
+        '/':    14,     // division
+        '*':    14,     // multiplication
+        '!':    15,     // bitwise OR (conflicts with logical NOT, but we never supported that)
+        '|':    15,     // bitwise OR
+        '^!':   15,     // bitwise XOR (added by MACRO-10 sometime between the 1972 and 1978 versions)
+        '&':    15,     // bitwise AND
+        '_':    19,     // MACRO-10 shift operator
+        '^_':   19,     // MACRO-10 internal shift operator (converted from 'B' suffix form that MACRO-10 uses)
+        '{':    20,     // open grouped expression (converted from achGroup[0])
+        '}':    20      // close grouped expression (converted from achGroup[1])
+    };
+
+    /*
+     * Assorted constants
+     */
+    Debugger.TWO_POW32 = Math.pow(2, 32);
+
+}   // endif DEBUGGER
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pc8080/lib/debugger.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * Debugger8080 Address Object
+ *
+ *      addr            address
+ *      fTemporary      true if this is a temporary breakpoint address
+ *      sCmd            set for breakpoint addresses if there's an associated command string
+ *      aCmds           preprocessed commands (from sCmd)
+ *
+ * @typedef {{
+ *      addr:(number|undefined),
+ *      fTemporary:(boolean|undefined),
+ *      sCmd:(string|undefined),
+ *      aCmds:(Array.<string>|undefined)
+ * }}
+ */
+var DbgAddr8080;
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class Debugger8080 extends Debugger {
+    /**
+     * Debugger8080(parmsDbg)
+     *
+     * The Debugger8080 component supports the following optional (parmsDbg) properties:
+     *
+     *      commands: string containing zero or more commands, separated by ';'
+     *
+     *      messages: string containing zero or more message categories to enable;
+     *      multiple categories must be separated by '|' or ';'.  Parsed by messageInit().
+     *
+     * The Debugger8080 component is an optional component that implements a variety of user
+     * commands for controlling the CPU, dumping and editing memory, etc.
+     *
+     * @this {Debugger8080}
+     * @param {Object} parmsDbg
+     */
+    constructor(parmsDbg)
+    {
+        if (DEBUGGER) {
+
+            super(parmsDbg);
+
+            this.style = Debugger8080.STYLE_8080;
+
+            /*
+             * Most commands that require an address call parseAddr(), which defaults to dbgAddrNextCode
+             * or dbgAddrNextData when no address has been given.  doDump() and doUnassemble(), in turn,
+             * update dbgAddrNextData and dbgAddrNextCode, respectively, when they're done.
+             *
+             * For TEMPORARY breakpoint addresses, we set fTemporary to true, so that they can be automatically
+             * cleared when they're hit.
+             */
+            this.dbgAddrNextCode = this.newAddr();
+            this.dbgAddrNextData = this.newAddr();
+            this.dbgAddrAssemble = this.newAddr();
+
+            /*
+             * aSymbolTable is an array of SymbolTable objects, one per ROM or other chunk of address space,
+             * where each object contains the following properties:
+             *
+             *      sModule
+             *      addr (physical address, if any; eg, symbols for a ROM)
+             *      len
+             *      aSymbols
+             *      aOffsets
+             *
+             * See addSymbols() for more details, since that's how callers add sets of symbols to the table.
+             */
+            this.aSymbolTable = [];
+
+            /*
+             * clearBreakpoints() initializes the breakpoints lists: aBreakExec is a list of addresses
+             * to halt on whenever attempting to execute an instruction at the corresponding address,
+             * and aBreakRead and aBreakWrite are lists of addresses to halt on whenever a read or write,
+             * respectively, occurs at the corresponding address.
+             *
+             * NOTE: Curiously, after upgrading the Google Closure Compiler from v20141215 to v20150609,
+             * the resulting compiled code would crash in clearBreakpoints(), because the (renamed) aBreakRead
+             * property was already defined.  To eliminate whatever was confusing the Closure Compiler, I've
+             * explicitly initialized all the properties that clearBreakpoints() (re)initializes.
+             */
+            this.aBreakExec = this.aBreakRead = this.aBreakWrite = [];
+            this.clearBreakpoints();
+
+            /*
+             * The new "bn" command allows you to specify a number of instructions to execute and then stop;
+             * "bn 0" disables any outstanding count.
+             */
+            this.nBreakIns = 0;
+
+            /*
+             * Execution history is allocated by historyInit() whenever checksEnabled() conditions change.
+             * Execution history is updated whenever the CPU calls checkInstruction(), which will happen
+             * only when checksEnabled() returns true (eg, whenever one or more breakpoints have been set).
+             * This ensures that, by default, the CPU runs as fast as possible.
+             */
+            this.historyInit();
+
+            /*
+             * Initialize Debugger8080 message support
+             */
+            this.afnDumpers = {};
+            this.messageInit(parmsDbg['messages']);
+
+            this.sInitCommands = parmsDbg['commands'];
+
+            /*
+             * Make it easier to access Debugger8080 commands from an external REPL (eg, the WebStorm
+             * "live" console window); eg:
+             *
+             *      pc8080('r')
+             *      pc8080('dw 0:0')
+             *      pc8080('h')
+             *      ...
+             */
+            var dbg = this;
+            if (window) {
+                if (window[PC8080.APPCLASS] === undefined) {
+                    window[PC8080.APPCLASS] = function(s) { return dbg.doCommands(s); };
+                }
+            } else {
+                if (global[PC8080.APPCLASS] === undefined) {
+                    global[PC8080.APPCLASS] = function(s) { return dbg.doCommands(s); };
+                }
+            }
+
+        }   // endif DEBUGGER
+    }
+
+    /**
+     * initBus(bus, cpu, dbg)
+     *
+     * @this {Debugger8080}
+     * @param {Computer8080} cmp
+     * @param {Bus8080} bus
+     * @param {CPUState8080} cpu
+     * @param {Debugger8080} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cpu = cpu;
+        this.cmp = cmp;
+
+        /*
+         * Re-initialize Debugger message support if necessary
+         */
+        var sMessages = cmp.getMachineParm('messages');
+        if (sMessages) this.messageInit(sMessages);
+
+        this.aaOpDescs = Debugger8080.aaOpDescs;
+
+        this.messageDump(Messages8080.BUS,  function onDumpBus(asArgs) { dbg.dumpBus(asArgs); });
+
+        this.setReady();
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * @this {Debugger8080}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "debugInput")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        var dbg = this;
+        switch (sBinding) {
+
+        case "debugInput":
+            this.bindings[sBinding] = control;
+            this.controlDebug = control;
+            /*
+             * For halted machines, this is fine, but for auto-start machines, it can be annoying.
+             *
+             *      control.focus();
+             */
+            control.onkeydown = function onKeyDownDebugInput(event) {
+                var sCmd;
+                if (event.keyCode == Keys.KEYCODE.CR) {
+                    sCmd = control.value;
+                    control.value = "";
+                    dbg.doCommands(sCmd, true);
+                }
+                else if (event.keyCode == Keys.KEYCODE.ESC) {
+                    control.value = sCmd = "";
+                }
+                else {
+                    if (event.keyCode == Keys.KEYCODE.UP) {
+                        sCmd = dbg.getPrevCommand();
+                    }
+                    else if (event.keyCode == Keys.KEYCODE.DOWN) {
+                        sCmd = dbg.getNextCommand();
+                    }
+                    if (sCmd != null) {
+                        var cch = sCmd.length;
+                        control.value = sCmd;
+                        control.setSelectionRange(cch, cch);
+                    }
+                }
+                if (sCmd != null && event.preventDefault) event.preventDefault();
+            };
+            return true;
+
+        case "debugEnter":
+            this.bindings[sBinding] = control;
+            Web.onClickRepeat(
+                control,
+                500, 100,
+                function onClickDebugEnter(fRepeat) {
+                    if (dbg.controlDebug) {
+                        var sCmds = dbg.controlDebug.value;
+                        dbg.controlDebug.value = "";
+                        dbg.doCommands(sCmds, true);
+                        return true;
+                    }
+                    if (DEBUG) dbg.log("no debugger input buffer");
+                    return false;
+                }
+            );
+            return true;
+
+        case "step":
+            this.bindings[sBinding] = control;
+            Web.onClickRepeat(
+                control,
+                500, 100,
+                function onClickStep(fRepeat) {
+                    var fCompleted = false;
+                    if (!dbg.isBusy(true)) {
+                        dbg.setBusy(true);
+                        fCompleted = dbg.stepCPU(fRepeat? 1 : 0);
+                        dbg.setBusy(false);
+                    }
+                    return fCompleted;
+                }
+            );
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * updateFocus()
+     *
+     * @this {Debugger8080}
+     */
+    updateFocus()
+    {
+        if (this.controlDebug) this.controlDebug.focus();
+    }
+
+    /**
+     * getAddr(dbgAddr, fWrite, nb)
+     *
+     * @this {Debugger8080}
+     * @param {DbgAddr8080|null|undefined} dbgAddr
+     * @param {boolean} [fWrite]
+     * @param {number} [nb] number of bytes to check (1 or 2); default is 1
+     * @return {number} is the corresponding linear address, or CPUDef8080.ADDR_INVALID
+     */
+    getAddr(dbgAddr, fWrite, nb)
+    {
+        var addr = dbgAddr && dbgAddr.addr;
+        if (addr == null) {
+            addr = CPUDef8080.ADDR_INVALID;
+        }
+        return addr;
+    }
+
+    /**
+     * getByte(dbgAddr, inc)
+     *
+     * We must route all our memory requests through the CPU now, in case paging is enabled.
+     *
+     * @this {Debugger8080}
+     * @param {DbgAddr8080} dbgAddr
+     * @param {number} [inc]
+     * @return {number}
+     */
+    getByte(dbgAddr, inc)
+    {
+        var b = 0xff;
+        var addr = this.getAddr(dbgAddr, false, 1);
+        if (addr !== CPUDef8080.ADDR_INVALID) {
+            b = this.bus.getByteDirect(addr);
+            if (inc) this.incAddr(dbgAddr, inc);
+        }
+        return b;
+    }
+
+    /**
+     * getWord(dbgAddr, fAdvance)
+     *
+     * @this {Debugger8080}
+     * @param {DbgAddr8080} dbgAddr
+     * @param {boolean} [fAdvance]
+     * @return {number}
+     */
+    getWord(dbgAddr, fAdvance)
+    {
+        return this.getShort(dbgAddr, fAdvance? 2 : 0);
+    }
+
+    /**
+     * getShort(dbgAddr, inc)
+     *
+     * @this {Debugger8080}
+     * @param {DbgAddr8080} dbgAddr
+     * @param {number} [inc]
+     * @return {number}
+     */
+    getShort(dbgAddr, inc)
+    {
+        var w = 0xffff;
+        var addr = this.getAddr(dbgAddr, false, 2);
+        if (addr !== CPUDef8080.ADDR_INVALID) {
+            w = this.bus.getShortDirect(addr);
+            if (inc) this.incAddr(dbgAddr, inc);
+        }
+        return w;
+    }
+
+    /**
+     * setByte(dbgAddr, b, inc)
+     *
+     * @this {Debugger8080}
+     * @param {DbgAddr8080} dbgAddr
+     * @param {number} b
+     * @param {number} [inc]
+     */
+    setByte(dbgAddr, b, inc)
+    {
+        var addr = this.getAddr(dbgAddr, true, 1);
+        if (addr !== CPUDef8080.ADDR_INVALID) {
+            this.bus.setByteDirect(addr, b);
+            if (inc) this.incAddr(dbgAddr, inc);
+            this.cpu.updateCPU(true);           // we set fForce to true in case video memory was the target
+        }
+    }
+
+    /**
+     * setShort(dbgAddr, w, inc)
+     *
+     * @this {Debugger8080}
+     * @param {DbgAddr8080} dbgAddr
+     * @param {number} w
+     * @param {number} [inc]
+     */
+    setShort(dbgAddr, w, inc)
+    {
+        var addr = this.getAddr(dbgAddr, true, 2);
+        if (addr !== CPUDef8080.ADDR_INVALID) {
+            this.bus.setShortDirect(addr, w);
+            if (inc) this.incAddr(dbgAddr, inc);
+            this.cpu.updateCPU(true);           // we set fForce to true in case video memory was the target
+        }
+    }
+
+    /**
+     * newAddr(addr)
+     *
+     * Returns a NEW DbgAddr8080 object, initialized with specified values and/or defaults.
+     *
+     * @this {Debugger8080}
+     * @param {number} [addr]
+     * @return {DbgAddr8080}
+     */
+    newAddr(addr)
+    {
+        return {addr: addr, fTemporary: false};
+    }
+
+    /**
+     * setAddr(dbgAddr, addr)
+     *
+     * Updates an EXISTING DbgAddr8080 object, initialized with specified values and/or defaults.
+     *
+     * @this {Debugger8080}
+     * @param {DbgAddr8080} dbgAddr
+     * @param {number} addr
+     * @return {DbgAddr8080}
+     */
+    setAddr(dbgAddr, addr)
+    {
+        dbgAddr.addr = addr;
+        dbgAddr.fTemporary = false;
+        return dbgAddr;
+    }
+
+    /**
+     * packAddr(dbgAddr)
+     *
+     * Packs a DbgAddr8080 object into an Array suitable for saving in a machine state object.
+     *
+     * @this {Debugger8080}
+     * @param {DbgAddr8080} dbgAddr
+     * @return {Array}
+     */
+    packAddr(dbgAddr)
+    {
+        return [dbgAddr.addr, dbgAddr.fTemporary];
+    }
+
+    /**
+     * unpackAddr(aAddr)
+     *
+     * Unpacks a DbgAddr8080 object from an Array created by packAddr() and restored from a saved machine state.
+     *
+     * @this {Debugger8080}
+     * @param {Array} aAddr
+     * @return {DbgAddr8080}
+     */
+    unpackAddr(aAddr)
+    {
+        return {addr: aAddr[0], fTemporary: aAddr[1]};
+    }
+
+    /**
+     * parseAddr(sAddr, fCode, fNoChecks)
+     *
+     * Address evaluation and validation (eg, range checks) are no longer performed at this stage.  That's
+     * done later, by getAddr(), which returns CPUDef8080.ADDR_INVALID for invalid segments, out-of-range offsets,
+     * etc.  The Debugger's low-level get/set memory functions verify all getAddr() results, but even if an
+     * invalid address is passed through to the Bus memory interfaces, the address will simply be masked with
+     * Bus8080.nBusLimit; in the case of CPUDef8080.ADDR_INVALID, that will generally refer to the top of the physical
+     * address space.
+     *
+     * @this {Debugger8080}
+     * @param {string|undefined} sAddr
+     * @param {boolean} [fCode] (true if target is code, false if target is data)
+     * @param {boolean} [fNoChecks] (true when setting breakpoints that may not be valid now, but will be later)
+     * @return {DbgAddr8080|null|undefined}
+     */
+    parseAddr(sAddr, fCode, fNoChecks)
+    {
+        var dbgAddr;
+        var dbgAddrNext = (fCode? this.dbgAddrNextCode : this.dbgAddrNextData);
+        var addr = dbgAddrNext.addr;
+        if (sAddr !== undefined) {
+            sAddr = this.parseReference(sAddr) || sAddr;
+            dbgAddr = this.findSymbolAddr(sAddr);
+            if (dbgAddr) return dbgAddr;
+            addr = this.parseExpression(sAddr);
+        }
+        if (addr != null) {
+            dbgAddr = this.newAddr(addr);
+        }
+        return dbgAddr;
+    }
+
+    /**
+     * parseAddrOptions(dbdAddr, sOptions)
+     *
+     * @this {Debugger8080}
+     * @param {DbgAddr8080} dbgAddr
+     * @param {string} [sOptions]
+     */
+    parseAddrOptions(dbgAddr, sOptions)
+    {
+        if (sOptions) {
+            var a = sOptions.match(/(['"])(.*?)\1/);
+            if (a) {
+                dbgAddr.aCmds = this.parseCommand(dbgAddr.sCmd = a[2]);
+            }
+        }
+    }
+
+    /**
+     * incAddr(dbgAddr, inc)
+     *
+     * @this {Debugger8080}
+     * @param {DbgAddr8080} dbgAddr
+     * @param {number} [inc] contains value to increment dbgAddr by (default is 1)
+     */
+    incAddr(dbgAddr, inc)
+    {
+        if (dbgAddr.addr != null) {
+            dbgAddr.addr += (inc || 1);
+        }
+    }
+
+    /**
+     * toHexOffset(off)
+     *
+     * @this {Debugger8080}
+     * @param {number|null|undefined} [off]
+     * @return {string} the hex representation of off
+     */
+    toHexOffset(off)
+    {
+        return Str.toHex(off, 4);
+    }
+
+    /**
+     * toHexAddr(dbgAddr)
+     *
+     * @this {Debugger8080}
+     * @param {DbgAddr8080} dbgAddr
+     * @return {string} the hex representation of the address
+     */
+    toHexAddr(dbgAddr)
+    {
+        return this.toHexOffset(dbgAddr.addr);
+    }
+
+    /**
+     * getSZ(dbgAddr, cchMax)
+     *
+     * Gets zero-terminated (aka "ASCIIZ") string from dbgAddr.  It also stops at the first '$', in case this is
+     * a '$'-terminated string -- mainly because I'm lazy and didn't feel like writing a separate get() function.
+     * Yes, a zero-terminated string containing a '$' will be prematurely terminated, and no, I don't care.
+     *
+     * @this {Debugger8080}
+     * @param {DbgAddr8080} dbgAddr
+     * @param {number} [cchMax] (default is 256)
+     * @return {string} (and dbgAddr advanced past the terminating zero)
+     */
+    getSZ(dbgAddr, cchMax)
+    {
+        var s = "";
+        cchMax = cchMax || 256;
+        while (s.length < cchMax) {
+            var b = this.getByte(dbgAddr, 1);
+            if (!b || b == 0x24 || b >= 127) break;
+            s += (b >= 32? String.fromCharCode(b) : '.');
+        }
+        return s;
+    }
+
+    /**
+     * dumpBlocks(aBlocks, sAddr)
+     *
+     * @this {Debugger8080}
+     * @param {Array} aBlocks
+     * @param {string} [sAddr] (optional block address)
+     */
+    dumpBlocks(aBlocks, sAddr)
+    {
+        var addr = 0, i = 0, n = aBlocks.length;
+
+        if (sAddr) {
+            addr = this.getAddr(this.parseAddr(sAddr));
+            if (addr === CPUDef8080.ADDR_INVALID) {
+                this.println("invalid address: " + sAddr);
+                return;
+            }
+            i = addr >>> this.bus.nBlockShift;
+            n = 1;
+        }
+
+        this.println("blockid   physical   blockaddr   used    size    type");
+        this.println("--------  ---------  ----------  ------  ------  ----");
+
+        var typePrev = -1, cPrev = 0;
+        while (n--) {
+            var block = aBlocks[i];
+            if (block.type == typePrev) {
+                if (!cPrev++) this.println("...");
+            } else {
+                typePrev = block.type;
+                var sType = Memory8080.TYPE.NAMES[typePrev];
+                if (block) {
+                    this.println(Str.toHex(block.id) + "  %" + Str.toHex(i << this.bus.nBlockShift) + "  %%" + Str.toHex(block.addr) + "  " + Str.toHexWord(block.used) + "  " + Str.toHexWord(block.size) + "  " + sType);
+                }
+                if (typePrev != Memory8080.TYPE.NONE) typePrev = -1;
+                cPrev = 0;
+            }
+            addr += this.bus.nBlockSize;
+            i++;
+        }
+    }
+
+    /**
+     * dumpBus(asArgs)
+     *
+     * Dumps Bus allocations.
+     *
+     * @this {Debugger8080}
+     * @param {Array.<string>} asArgs (asArgs[0] is an optional block address)
+     */
+    dumpBus(asArgs)
+    {
+        this.dumpBlocks(this.bus.aMemBlocks, asArgs[0]);
+    }
+
+    /**
+     * dumpHistory(sPrev, sLines)
+     *
+     * If sLines is not a number, it can be a instruction filter.  However, for the moment, the only
+     * supported filter is "call", which filters the history buffer for all CALL and RET instructions
+     * from the specified previous point forward.
+     *
+     * @this {Debugger8080}
+     * @param {string} [sPrev] is a (decimal) number of instructions to rewind to (default is 10)
+     * @param {string} [sLines] is a (decimal) number of instructions to print (default is, again, 10)
+     */
+    dumpHistory(sPrev, sLines)
+    {
+        var sMore = "";
+        var cHistory = 0;
+        var iHistory = this.iOpcodeHistory;
+        var aHistory = this.aOpcodeHistory;
+
+        if (aHistory.length) {
+            var nPrev = +sPrev || this.nextHistory;
+            var nLines = +sLines || 10;
+
+            if (isNaN(nPrev)) {
+                nPrev = nLines;
+            } else {
+                sMore = "more ";
+            }
+
+            if (nPrev > aHistory.length) {
+                this.println("note: only " + aHistory.length + " available");
+                nPrev = aHistory.length;
+            }
+
+            iHistory -= nPrev;
+            if (iHistory < 0) {
+                /*
+                 * If the dbgAddr of the last aHistory element contains a valid selector, wrap around.
+                 */
+                if (aHistory[aHistory.length - 1].addr == null) {
+                    nPrev = iHistory + nPrev;
+                    iHistory = 0;
+                } else {
+                    iHistory += aHistory.length;
+                }
+            }
+
+            var aFilters = [];
+            if (sLines == "call") {
+                nLines = 100000;
+                aFilters = ["CALL"];
+            }
+
+            if (sPrev !== undefined) {
+                this.println(nPrev + " instructions earlier:");
+            }
+
+            /*
+             * TODO: The following is necessary to prevent dumpHistory() from causing additional (or worse, recursive)
+             * faults due to segmented addresses that are no longer valid, but the only alternative is to dramatically
+             * increase the amount of memory used to store instruction history (eg, storing copies of all the instruction
+             * bytes alongside the execution addresses).
+             *
+             * For now, we're living dangerously, so that our history dumps actually work.
+             *
+             *      this.nSuppressBreaks++;
+             *
+             * If you re-enable this protection, be sure to re-enable the decrement below, too.
+             */
+            while (nLines > 0 && iHistory != this.iOpcodeHistory) {
+
+                var dbgAddr = aHistory[iHistory++];
+                if (dbgAddr.addr == null) break;
+
+                /*
+                 * We must create a new dbgAddr from the address in aHistory, because dbgAddr was
+                 * a reference, not a copy, and we don't want getInstruction() modifying the original.
+                 */
+                var dbgAddrNew = this.newAddr(dbgAddr.addr);
+
+                var sComment = "history";
+                var nSequence = nPrev--;
+                if (DEBUG && dbgAddr.cycleCount != null) {
+                    sComment = "cycles";
+                    nSequence = dbgAddr.cycleCount;
+                }
+
+                var sInstruction = this.getInstruction(dbgAddrNew, sComment, nSequence);
+
+                if (!aFilters.length || sInstruction.indexOf(aFilters[0]) >= 0) {
+                    this.println(sInstruction);
+                }
+
+                /*
+                 * If there were OPERAND or ADDRESS overrides on the previous instruction, getInstruction()
+                 * will have automatically disassembled additional bytes, so skip additional history entries.
+                 */
+                if (dbgAddrNew.cOverrides) {
+                    iHistory += dbgAddrNew.cOverrides; nLines -= dbgAddrNew.cOverrides; nPrev -= dbgAddrNew.cOverrides;
+                }
+
+                if (iHistory >= aHistory.length) iHistory = 0;
+                this.nextHistory = nPrev;
+                cHistory++;
+                nLines--;
+            }
+            /*
+             * See comments above.
+             *
+             *      this.nSuppressBreaks--;
+             */
+        }
+
+        if (!cHistory) {
+            this.println("no " + sMore + "history available");
+            this.nextHistory = undefined;
+        }
+    }
+
+    /**
+     * messageInit(sEnable)
+     *
+     * @this {Debugger8080}
+     * @param {string|undefined} sEnable contains zero or more message categories to enable, separated by '|'
+     */
+    messageInit(sEnable)
+    {
+        this.dbg = this;
+        this.bitsMessage = this.bitsWarning = Messages8080.WARN;
+        this.sMessagePrev = null;
+        this.aMessageBuffer = [];
+        /*
+         * Internally, we use "key" instead of "keys", since the latter is a method on JavasScript objects,
+         * but externally, we allow the user to specify "keys"; "kbd" is also allowed as shorthand for "keyboard".
+         */
+        var aEnable = this.parseCommand(sEnable.replace("keys","key").replace("kbd","keyboard"), false, '|');
+        if (aEnable.length) {
+            for (var m in Messages8080.CATEGORIES) {
+                if (Usr.indexOf(aEnable, m) >= 0) {
+                    this.bitsMessage |= Messages8080.CATEGORIES[m];
+                    this.println(m + " messages enabled");
+                }
+            }
+        }
+    }
+
+    /**
+     * messageDump(bitMessage, fnDumper)
+     *
+     * @this {Debugger8080}
+     * @param {number} bitMessage is one Messages category flag
+     * @param {function(Array.<string>)} fnDumper is a function the Debugger can use to dump data for that category
+     * @return {boolean} true if successfully registered, false if not
+     */
+    messageDump(bitMessage, fnDumper)
+    {
+        for (var m in Messages8080.CATEGORIES) {
+            if (bitMessage == Messages8080.CATEGORIES[m]) {
+                this.afnDumpers[m] = fnDumper;
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * getRegIndex(sReg, off)
+     *
+     * @this {Debugger8080}
+     * @param {string} sReg
+     * @param {number} [off] optional offset into sReg
+     * @return {number} register index, or -1 if not found
+     */
+    getRegIndex(sReg, off)
+    {
+        var i;
+        sReg = sReg.toUpperCase();
+        if (off == null) {
+            i = Usr.indexOf(Debugger8080.REGS, sReg);
+        } else {
+            i = Usr.indexOf(Debugger8080.REGS, sReg.substr(off, 2));
+            if (i < 0) i = Usr.indexOf(Debugger8080.REGS, sReg.substr(off, 1));
+        }
+        return i;
+    }
+
+    /**
+     * getRegString(iReg)
+     *
+     * @this {Debugger8080}
+     * @param {number} iReg
+     * @return {string}
+     */
+    getRegString(iReg)
+    {
+        var cch = 0;
+        var n = this.getRegValue(iReg);
+        if (n !== undefined) {
+            switch(iReg) {
+            case Debugger8080.REG_A:
+            case Debugger8080.REG_B:
+            case Debugger8080.REG_C:
+            case Debugger8080.REG_D:
+            case Debugger8080.REG_E:
+            case Debugger8080.REG_H:
+            case Debugger8080.REG_L:
+            case Debugger8080.REG_M:
+                cch = 2;
+                break;
+            case Debugger8080.REG_BC:
+            case Debugger8080.REG_DE:
+            case Debugger8080.REG_HL:
+            case Debugger8080.REG_SP:
+            case Debugger8080.REG_PC:
+            case Debugger8080.REG_PS:
+            case Debugger8080.REG_PSW:
+                cch = 4;
+                break;
+            }
+        }
+        return cch? Str.toHex(n, cch) : "??";
+    }
+
+    /**
+     * getRegValue(iReg)
+     *
+     * @this {Debugger8080}
+     * @param {number} iReg
+     * @return {number|undefined}
+     */
+    getRegValue(iReg)
+    {
+        var n;
+        if (iReg >= 0) {
+            var cpu = this.cpu;
+            switch(iReg) {
+            case Debugger8080.REG_A:
+                n = cpu.regA;
+                break;
+            case Debugger8080.REG_B:
+                n = cpu.regB;
+                break;
+            case Debugger8080.REG_C:
+                n = cpu.regC;
+                break;
+            case Debugger8080.REG_BC:
+                n = cpu.getBC();
+                break;
+            case Debugger8080.REG_D:
+                n = cpu.regD;
+                break;
+            case Debugger8080.REG_E:
+                n = cpu.regE;
+                break;
+            case Debugger8080.REG_DE:
+                n = cpu.getDE();
+                break;
+            case Debugger8080.REG_H:
+                n = cpu.regH;
+                break;
+            case Debugger8080.REG_L:
+                n = cpu.regL;
+                break;
+            case Debugger8080.REG_HL:
+                n = cpu.getHL();
+                break;
+            case Debugger8080.REG_M:
+                n = cpu.getByte(cpu.getHL());
+                break;
+            case Debugger8080.REG_SP:
+                n = cpu.getSP();
+                break;
+            case Debugger8080.REG_PC:
+                n = cpu.getPC();
+                break;
+            case Debugger8080.REG_PS:
+                n = cpu.getPS();
+                break;
+            case Debugger8080.REG_PSW:
+                n = cpu.getPSW();
+                break;
+            default:
+                break;
+            }
+        }
+        return n;
+    }
+
+    /**
+     * replaceRegs(s)
+     *
+     * @this {Debugger8080}
+     * @param {string} s
+     * @return {string}
+     */
+    replaceRegs(s)
+    {
+        /*
+         * Replace any references first; this means that register references inside the reference
+         * do NOT need to be prefixed with '@'.
+         */
+        s = this.parseReference(s) || s;
+
+        /*
+         * Replace every @XX (or @XXX), where XX (or XXX) is a register, with the register's value.
+         */
+        var i = 0;
+        var b, sChar, sAddr, dbgAddr, sReplace;
+        while ((i = s.indexOf('@', i)) >= 0) {
+            var iReg = this.getRegIndex(s, i + 1);
+            if (iReg >= 0) {
+                s = s.substr(0, i) + this.getRegString(iReg) + s.substr(i + 1 + Debugger8080.REGS[iReg].length);
+            }
+            i++;
+        }
+        /*
+         * Replace every #XX, where XX is a hex byte value, with the corresponding ASCII character (if printable).
+         */
+        i = 0;
+        while ((i = s.indexOf('#', i)) >= 0) {
+            sChar = s.substr(i+1, 2);
+            b = Str.parseInt(sChar, 16);
+            if (b != null && b >= 32 && b < 128) {
+                sReplace = sChar + " '" + String.fromCharCode(b) + "'";
+                s = s.replace('#' + sChar, sReplace);
+                i += sReplace.length;
+                continue;
+            }
+            i++;
+        }
+        /*
+         * Replace every $XXXX:XXXX, where XXXX:XXXX is a segmented address, with the zero-terminated string at that address.
+         */
+        i = 0;
+        while ((i = s.indexOf('$', i)) >= 0) {
+            sAddr = s.substr(i+1, 9);
+            dbgAddr = this.parseAddr(sAddr);
+            if (dbgAddr) {
+                sReplace = sAddr + ' "' + this.getSZ(dbgAddr) + '"';
+                s = s.replace('$' + sAddr, sReplace);
+                i += sReplace.length;
+                continue;
+            }
+            i++;
+        }
+        /*
+         * Replace every ^XXXX:XXXX, where XXXX:XXXX is a segmented address, with the FCB filename stored at that address.
+         */
+        i = 0;
+        while ((i = s.indexOf('^', i)) >= 0) {
+            sAddr = s.substr(i+1, 9);
+            dbgAddr = this.parseAddr(sAddr);
+            if (dbgAddr) {
+                this.incAddr(dbgAddr);
+                sReplace = sAddr + ' "' + this.getSZ(dbgAddr, 11) + '"';
+                s = s.replace('^' + sAddr, sReplace);
+                i += sReplace.length;
+                continue;
+            }
+            i++;
+        }
+        return s;
+    }
+
+    /**
+     * message(sMessage, fAddress)
+     *
+     * @this {Debugger8080}
+     * @param {string} sMessage is any caller-defined message string
+     * @param {boolean} [fAddress] is true to display the current CS:IP
+     */
+    message(sMessage, fAddress)
+    {
+        if (fAddress) {
+            sMessage += " at " + this.toHexAddr(this.newAddr(this.cpu.getPC()));
+        }
+
+        if (this.bitsMessage & Messages8080.BUFFER) {
+            this.aMessageBuffer.push(sMessage);
+            return;
+        }
+
+        if (this.sMessagePrev && sMessage == this.sMessagePrev) return;
+        this.sMessagePrev = sMessage;
+
+        if (this.bitsMessage & Messages8080.HALT) {
+            this.stopCPU();
+            sMessage += " (cpu halted)";
+        }
+
+        this.println(sMessage); // + " (" + this.cpu.getCycles() + " cycles)"
+
+        /*
+         * We have no idea what the frequency of println() calls might be; all we know is that they easily
+         * screw up the CPU's careful assumptions about cycles per burst.  So we call yieldCPU() after every
+         * message, to effectively end the current burst and start fresh.
+         *
+         * TODO: See CPU8080.calcStartTime() for a discussion of why we might want to call yieldCPU() *before*
+         * we display the message.
+         */
+        if (this.cpu) this.cpu.yieldCPU();
+    }
+
+    /**
+     * messageIO(component, port, bOut, addrFrom, name, bIn, bitsMessage)
+     *
+     * Most (if not all) port handlers should provide a name for their respective ports, so if no name is provided,
+     * we assume this is an unknown port, and display a message by default.
+     *
+     * @this {Debugger8080}
+     * @param {Component} component
+     * @param {number} port
+     * @param {number|null} bOut if an output operation
+     * @param {number|null} [addrFrom]
+     * @param {string|null} [name] of the port, if any
+     * @param {number|null} [bIn] is the input value, if known, on an input operation
+     * @param {number} [bitsMessage] is one or more Messages category flag(s)
+     */
+    messageIO(component, port, bOut, addrFrom, name, bIn, bitsMessage)
+    {
+        bitsMessage |= Messages8080.PORT;
+        if (name == null || (this.bitsMessage & bitsMessage) == bitsMessage) {
+            this.message(component.idComponent + '.' + (bOut != null? "outPort" : "inPort") + '(' + Str.toHexWord(port) + ',' + (name? name : "unknown") + (bOut != null? ',' + Str.toHexByte(bOut) : "") + ')' + (bIn != null? (": " + Str.toHexByte(bIn)) : "") + (addrFrom != null? (" at " + this.toHexOffset(addrFrom)) : ""));
+        }
+    }
+
+    /**
+     * init()
+     *
+     * @this {Debugger8080}
+     */
+    init()
+    {
+        this.println("Type ? for help with PC8080 Debugger commands");
+        this.updateStatus();
+        if (this.sInitCommands) {
+            var sCmds = this.sInitCommands;
+            this.sInitCommands = null;
+            this.doCommands(sCmds);
+        }
+    }
+
+    /**
+     * historyInit(fQuiet)
+     *
+     * This function is intended to be called by the constructor, reset(), addBreakpoint(), findBreakpoint()
+     * and any other function that changes the checksEnabled() criteria used to decide whether checkInstruction()
+     * should be called.
+     *
+     * That is, if the history arrays need to be allocated and haven't already been allocated, then allocate them,
+     * and if the arrays are no longer needed, then deallocate them.
+     *
+     * @this {Debugger8080}
+     * @param {boolean} [fQuiet]
+     */
+    historyInit(fQuiet)
+    {
+        var i;
+        if (!this.checksEnabled()) {
+            if (this.aOpcodeHistory && this.aOpcodeHistory.length && !fQuiet) {
+                this.println("instruction history buffer freed");
+            }
+            this.iOpcodeHistory = 0;
+            this.aOpcodeHistory = [];
+            this.aaOpcodeCounts = [];
+            return;
+        }
+        if (!this.aOpcodeHistory || !this.aOpcodeHistory.length) {
+            this.aOpcodeHistory = new Array(Debugger8080.HISTORY_LIMIT);
+            for (i = 0; i < this.aOpcodeHistory.length; i++) {
+                /*
+                 * Preallocate dummy Addr (Array) objects in every history slot, so that
+                 * checkInstruction() doesn't need to call newAddr() on every slot update.
+                 */
+                this.aOpcodeHistory[i] = this.newAddr();
+            }
+            this.iOpcodeHistory = 0;
+            if (!fQuiet) {
+                this.println("instruction history buffer allocated");
+            }
+        }
+        if (!this.aaOpcodeCounts || !this.aaOpcodeCounts.length) {
+            this.aaOpcodeCounts = new Array(256);
+            for (i = 0; i < this.aaOpcodeCounts.length; i++) {
+                this.aaOpcodeCounts[i] = [i, 0];
+            }
+        }
+    }
+
+    /**
+     * runCPU(fUpdateFocus)
+     *
+     * @this {Debugger8080}
+     * @param {boolean} [fUpdateFocus] is true to update focus
+     * @return {boolean} true if run request successful, false if not
+     */
+    runCPU(fUpdateFocus)
+    {
+        if (!this.isCPUAvail()) return false;
+        this.cpu.runCPU(fUpdateFocus);
+        return true;
+    }
+
+    /**
+     * stepCPU(nCycles, fRegs, fUpdateCPU)
+     *
+     * @this {Debugger8080}
+     * @param {number} nCycles (0 for one instruction without checking breakpoints)
+     * @param {boolean} [fRegs] is true to display registers after step (default is false)
+     * @param {boolean} [fUpdateCPU] is false to disable calls to updateCPU() (default is true)
+     * @return {boolean}
+     */
+    stepCPU(nCycles, fRegs, fUpdateCPU)
+    {
+        if (!this.isCPUAvail()) return false;
+
+        this.nCycles = 0;
+
+        if (!nCycles) {
+            /*
+             * When single-stepping, the CPU won't call checkInstruction(), which is good for
+             * avoiding breakpoints, but bad for instruction data collection if checks are enabled.
+             * So we call checkInstruction() ourselves.
+             */
+            if (this.checksEnabled()) this.checkInstruction(this.cpu.getPC(), 0);
+        }
+        try {
+            var nCyclesStep = this.cpu.stepCPU(nCycles);
+            if (nCyclesStep > 0) {
+                this.nCycles += nCyclesStep;
+                this.cpu.addCycles(nCyclesStep, true);
+                this.cpu.updateChecksum(nCyclesStep);
+                this.cOpcodes++;
+            }
+        }
+        catch(exception) {
+            if (typeof exception != "number") {
+                var e = exception;
+                this.nCycles = 0;
+                this.cpu.setError(e.stack || e.message);
+            }
+        }
+
+        /*
+         * Because we called cpu.stepCPU() and not cpu.runCPU(), we must nudge the cpu's update code,
+         * and then update our own state.  Normally, the only time fUpdateCPU will be false is when doTrace()
+         * is calling us in a loop, in which case it will perform its own updateCPU() when it's done.
+         */
+        if (fUpdateCPU !== false) this.cpu.updateCPU();
+
+        this.updateStatus(fRegs || false);
+        return (this.nCycles > 0);
+    }
+
+    /**
+     * stopCPU()
+     *
+     * @this {Debugger8080}
+     * @param {boolean} [fComplete]
+     */
+    stopCPU(fComplete)
+    {
+        if (this.cpu) this.cpu.stopCPU(fComplete);
+    }
+
+    /**
+     * updateStatus(fRegs)
+     *
+     * @this {Debugger8080}
+     * @param {boolean} [fRegs] (default is true)
+     */
+    updateStatus(fRegs)
+    {
+        if (fRegs === undefined) fRegs = true;
+
+        this.dbgAddrNextCode = this.newAddr(this.cpu.getPC());
+        /*
+         * this.nStep used to be a simple boolean, but now it's 0 (or undefined)
+         * if inactive, 1 if stepping over an instruction without a register dump, or 2
+         * if stepping over an instruction with a register dump.
+         */
+        if (!fRegs || this.nStep == 1)
+            this.doUnassemble();
+        else {
+            this.doRegisters();
+        }
+    }
+
+    /**
+     * isCPUAvail()
+     *
+     * Make sure the CPU is ready (finished initializing), not busy (already running), and not in an error state.
+     *
+     * @this {Debugger8080}
+     * @return {boolean}
+     */
+    isCPUAvail()
+    {
+        if (!this.cpu)
+            return false;
+        if (!this.cpu.isReady())
+            return false;
+        if (!this.cpu.isPowered())
+            return false;
+        if (this.cpu.isBusy())
+            return false;
+        return !this.cpu.isError();
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {Debugger8080}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            /*
+             * Because Debugger save/restore support is somewhat limited (and didn't always exist),
+             * we deviate from the typical save/restore design pattern: instead of reset OR restore,
+             * we always reset and then perform a (potentially limited) restore.
+             */
+            this.reset(true);
+
+            // this.println(data? "resuming" : "powering up");
+
+            if (data && this.restore) {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {Debugger8080}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean}
+     */
+    powerDown(fSave, fShutdown)
+    {
+        if (fShutdown) this.println(fSave? "suspending" : "shutting down");
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * reset(fQuiet)
+     *
+     * This is a notification handler, called by the Computer, to inform us of a reset.
+     *
+     * @this {Debugger8080}
+     * @param {boolean} fQuiet (true only when called from our own powerUp handler)
+     */
+    reset(fQuiet)
+    {
+        this.historyInit();
+        this.cOpcodes = this.cOpcodesStart = 0;
+        this.sMessagePrev = null;
+        this.nCycles = 0;
+        this.dbgAddrNextCode = this.newAddr(this.cpu.getPC());
+        /*
+         * fRunning is set by start() and cleared by stop().  In addition, we clear
+         * it here, so that if the CPU is reset while running, we can prevent stop()
+         * from unnecessarily dumping the CPU state.
+         */
+        this.flags.running = false;
+        this.clearTempBreakpoint();
+        if (!fQuiet) this.updateStatus();
+    }
+
+    /**
+     * save()
+     *
+     * This implements (very rudimentary) save support for the Debugger component.
+     *
+     * @this {Debugger8080}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, this.packAddr(this.dbgAddrNextCode));
+        state.set(1, this.packAddr(this.dbgAddrAssemble));
+        state.set(2, [this.aPrevCmds, this.fAssemble, this.bitsMessage]);
+        state.set(3, this.aSymbolTable);
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements (very rudimentary) restore support for the Debugger component.
+     *
+     * @this {Debugger8080}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        var i = 0;
+        if (data[2] !== undefined) {
+            this.dbgAddrNextCode = this.unpackAddr(data[i++]);
+            this.dbgAddrAssemble = this.unpackAddr(data[i++]);
+            this.aPrevCmds = data[i][0];
+            if (typeof this.aPrevCmds == "string") this.aPrevCmds = [this.aPrevCmds];
+            this.fAssemble = data[i][1];
+            this.bitsMessage |= data[i][2];     // keep our current message bits set, and simply "add" any extra bits defined by the saved state
+        }
+        if (data[3]) this.aSymbolTable = data[3];
+        return true;
+    }
+
+    /**
+     * start(ms, nCycles)
+     *
+     * This is a notification handler, called by the Computer, to inform us the CPU has started.
+     *
+     * @this {Debugger8080}
+     * @param {number} ms
+     * @param {number} nCycles
+     */
+    start(ms, nCycles)
+    {
+        if (!this.nStep) this.println("running");
+        this.flags.running = true;
+        this.msStart = ms;
+        this.nCyclesStart = nCycles;
+    }
+
+    /**
+     * stop(ms, nCycles)
+     *
+     * This is a notification handler, called by the Computer, to inform us the CPU has now stopped.
+     *
+     * @this {Debugger8080}
+     * @param {number} ms
+     * @param {number} nCycles
+     */
+    stop(ms, nCycles)
+    {
+        if (this.flags.running) {
+            this.flags.running = false;
+            this.nCycles = nCycles - this.nCyclesStart;
+            if (!this.nStep) {
+                var sStopped = "stopped";
+                if (this.nCycles) {
+                    var msTotal = ms - this.msStart;
+                    var nCyclesPerSecond = (msTotal > 0? Math.round(this.nCycles * 1000 / msTotal) : 0);
+                    sStopped += " (";
+                    if (this.checksEnabled()) {
+                        sStopped += this.cOpcodes + " opcodes, ";
+                        /*
+                         * $ops displays progress by calculating cOpcodes - cOpcodesStart, so before
+                         * zeroing cOpcodes, we should subtract cOpcodes from cOpcodesStart (since we're
+                         * effectively subtracting cOpcodes from cOpcodes as well).
+                         */
+                        this.cOpcodesStart -= this.cOpcodes;
+                        this.cOpcodes = 0;
+                    }
+                    sStopped += this.nCycles + " cycles, " + msTotal + " ms, " + nCyclesPerSecond + " hz)";
+                } else {
+                    if (this.messageEnabled(Messages8080.HALT)) {
+                        /*
+                         * It's possible the user is trying to 'g' past a fault that was blocked by helpCheckFault()
+                         * for the Debugger's benefit; if so, it will continue to be blocked, so try displaying a helpful
+                         * message (another helpful tip would be to simply turn off the "halt" message category).
+                         */
+                        sStopped += " (use the 't' command to execute blocked faults)";
+                    }
+                }
+                this.println(sStopped);
+            }
+            this.updateStatus(true);
+            this.updateFocus();
+            this.clearTempBreakpoint(this.cpu.getPC());
+        }
+    }
+
+    /**
+     * checksEnabled(fRelease)
+     *
+     * This "check" function is called by the CPU; we indicate whether or not every instruction needs to be checked.
+     *
+     * Originally, this returned true even when there were only read and/or write breakpoints, but those breakpoints
+     * no longer require the intervention of checkInstruction(); the Bus component automatically swaps in/out appropriate
+     * "checked" Memory access functions to deal with those breakpoints in the corresponding Memory blocks.  So I've
+     * simplified the test below.
+     *
+     * @this {Debugger8080}
+     * @param {boolean} [fRelease] is true for release criteria only; default is false (any criteria)
+     * @return {boolean} true if every instruction needs to pass through checkInstruction(), false if not
+     */
+    checksEnabled(fRelease)
+    {
+        return ((DEBUG && !fRelease)? true : (this.aBreakExec.length > 1 || !!this.nBreakIns));
+    }
+
+    /**
+     * checkInstruction(addr, nState)
+     *
+     * This "check" function is called by the CPU to inform us about the next instruction to be executed,
+     * giving us an opportunity to look for "exec" breakpoints and update opcode frequencies and instruction history.
+     *
+     * @this {Debugger8080}
+     * @param {number} addr
+     * @param {number} nState is < 0 if stepping, 0 if starting, or > 0 if running
+     * @return {boolean} true if breakpoint hit, false if not
+     */
+    checkInstruction(addr, nState)
+    {
+        var cpu = this.cpu;
+
+        if (nState > 0) {
+            if (this.nBreakIns && !--this.nBreakIns) {
+                return true;
+            }
+            if (this.checkBreakpoint(addr, 1, this.aBreakExec)) {
+                return true;
+            }
+        }
+
+        /*
+         * The rest of the instruction tracking logic can only be performed if historyInit() has allocated the
+         * necessary data structures.  Note that there is no explicit UI for enabling/disabling history, other than
+         * adding/removing breakpoints, simply because it's breakpoints that trigger the call to checkInstruction();
+         * well, OK, and a few other things now, like enabling Messages8080.INT messages.
+         */
+        if (nState >= 0 && this.aaOpcodeCounts.length) {
+            this.cOpcodes++;
+            var bOpcode = this.bus.getByteDirect(addr);
+            if (bOpcode != null) {
+                this.aaOpcodeCounts[bOpcode][1]++;
+                var dbgAddr = this.aOpcodeHistory[this.iOpcodeHistory];
+                this.setAddr(dbgAddr, cpu.getPC());
+                if (DEBUG) dbgAddr.cycleCount = cpu.getCycles();
+                if (++this.iOpcodeHistory == this.aOpcodeHistory.length) this.iOpcodeHistory = 0;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * checkMemoryRead(addr, nb)
+     *
+     * This "check" function is called by a Memory block to inform us that a memory read occurred, giving us an
+     * opportunity to track the read if we want, and look for a matching "read" breakpoint, if any.
+     *
+     * In the "old days", it would be an error for this call to fail to find a matching Debugger breakpoint, but now
+     * Memory blocks have no idea whether the Debugger or the machine's Debug register(s) triggered this "checked" read.
+     *
+     * If we return true, we "trump" the machine's Debug register(s); false allows normal Debug register processing.
+     *
+     * @this {Debugger8080}
+     * @param {number} addr
+     * @param {number} [nb] (# of bytes; default is 1)
+     * @return {boolean} true if breakpoint hit, false if not
+     */
+    checkMemoryRead(addr, nb)
+    {
+        if (this.checkBreakpoint(addr, nb || 1, this.aBreakRead)) {
+            this.stopCPU(true);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * checkMemoryWrite(addr, nb)
+     *
+     * This "check" function is called by a Memory block to inform us that a memory write occurred, giving us an
+     * opportunity to track the write if we want, and look for a matching "write" breakpoint, if any.
+     *
+     * In the "old days", it would be an error for this call to fail to find a matching Debugger breakpoint, but now
+     * Memory blocks have no idea whether the Debugger or the machine's Debug register(s) triggered this "checked" write.
+     *
+     * If we return true, we "trump" the machine's Debug register(s); false allows normal Debug register processing.
+     *
+     * @this {Debugger8080}
+     * @param {number} addr
+     * @param {number} [nb] (# of bytes; default is 1)
+     * @return {boolean} true if breakpoint hit, false if not
+     */
+    checkMemoryWrite(addr, nb)
+    {
+        if (this.checkBreakpoint(addr, nb || 1, this.aBreakWrite)) {
+            this.stopCPU(true);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * checkPortInput(port, size, data)
+     *
+     * This "check" function is called by the Bus component to inform us that port input occurred.
+     *
+     * @this {Debugger8080}
+     * @param {number} port
+     * @param {number} size
+     * @param {number} data
+     * @return {boolean} true if breakpoint hit, false if not
+     */
+    checkPortInput(port, size, data)
+    {
+        /*
+         * We trust that the Bus component won't call us unless we told it to, so we halt unconditionally
+         */
+        this.println("break on input from port " + Str.toHexWord(port) + ": " + Str.toHex(data));
+        this.stopCPU(true);
+        return true;
+    }
+
+    /**
+     * checkPortOutput(port, size, data)
+     *
+     * This "check" function is called by the Bus component to inform us that port output occurred.
+     *
+     * @this {Debugger8080}
+     * @param {number} port
+     * @param {number} size
+     * @param {number} data
+     * @return {boolean} true if breakpoint hit, false if not
+     */
+    checkPortOutput(port, size, data)
+    {
+        /*
+         * We trust that the Bus component won't call us unless we told it to, so we halt unconditionally
+         */
+        this.println("break on output to port " + Str.toHexWord(port) + ": " + Str.toHex(data));
+        this.stopCPU(true);
+        return true;
+    }
+
+    /**
+     * clearBreakpoints()
+     *
+     * @this {Debugger8080}
+     */
+    clearBreakpoints()
+    {
+        var i, dbgAddr;
+        this.aBreakExec = ["bp"];
+        if (this.aBreakRead !== undefined) {
+            for (i = 1; i < this.aBreakRead.length; i++) {
+                dbgAddr = this.aBreakRead[i];
+                this.bus.removeMemBreak(this.getAddr(dbgAddr), false);
+            }
+        }
+        this.aBreakRead = ["br"];
+        if (this.aBreakWrite !== undefined) {
+            for (i = 1; i < this.aBreakWrite.length; i++) {
+                dbgAddr = this.aBreakWrite[i];
+                this.bus.removeMemBreak(this.getAddr(dbgAddr), true);
+            }
+        }
+        this.aBreakWrite = ["bw"];
+        /*
+         * nSuppressBreaks ensures we can't get into an infinite loop where a breakpoint lookup requires
+         * reading a segment descriptor via getSegment(), and that triggers more memory reads, which triggers
+         * more breakpoint checks.
+         */
+        this.nSuppressBreaks = 0;
+    }
+
+    /**
+     * addBreakpoint(aBreak, dbgAddr, fTemporary)
+     *
+     * In case you haven't already figured this out, all our breakpoint commands use the address
+     * to identify a breakpoint, not an incrementally assigned breakpoint index like other debuggers;
+     * see doBreak() for details.
+     *
+     * This has a few implications, one being that you CANNOT set more than one kind of breakpoint
+     * on a single address.  In practice, that's rarely a problem, because you can almost always set
+     * a different breakpoint on a neighboring address.
+     *
+     * Also, there is one exception to the "one address, one breakpoint" rule, and that involves
+     * temporary breakpoints (ie, one-time execution breakpoints that either a "p" or "g" command
+     * may create to step over a chunk of code).  Those breakpoints automatically clear themselves,
+     * so there usually isn't any need to refer to them using breakpoint commands.
+     *
+     * TODO: Consider supporting the more "traditional" breakpoint index syntax; the current
+     * address-based syntax was implemented solely for expediency and consistency.  At the same time,
+     * also consider a more WDEB386-like syntax, where "br" is used to set a variety of access-specific
+     * breakpoints, using modifiers like "r1", "r2", "w1", "w2, etc.
+     *
+     * @this {Debugger8080}
+     * @param {Array} aBreak
+     * @param {DbgAddr8080} dbgAddr
+     * @param {boolean} [fTemporary]
+     * @return {boolean} true if breakpoint added, false if already exists
+     */
+    addBreakpoint(aBreak, dbgAddr, fTemporary)
+    {
+        var fSuccess = true;
+
+        // this.nSuppressBreaks++;
+
+        /*
+         * Instead of complaining that a breakpoint already exists (as we used to do), we now
+         * allow breakpoints to be re-set; this makes it easier to update any commands that may
+         * be associated with the breakpoint.
+         *
+         * The only exception: we DO allow a temporary breakpoint at an address where there may
+         * already be a breakpoint, so that you can easily step ("p" or "g") over such addresses.
+         */
+        if (!fTemporary) {
+            this.findBreakpoint(aBreak, dbgAddr, true, false, true);
+        }
+
+        if (aBreak != this.aBreakExec) {
+            var addr = this.getAddr(dbgAddr);
+            if (addr === CPUDef8080.ADDR_INVALID) {
+                this.println("invalid address: " + this.toHexAddr(dbgAddr));
+                fSuccess = false;
+            } else {
+                this.bus.addMemBreak(addr, aBreak == this.aBreakWrite);
+            }
+        }
+
+        if (fSuccess) {
+            aBreak.push(dbgAddr);
+            if (fTemporary) {
+                dbgAddr.fTemporary = true;
+            }
+            else {
+                this.printBreakpoint(aBreak, aBreak.length-1, "set");
+                this.historyInit();
+            }
+        }
+
+        // this.nSuppressBreaks--;
+
+        return fSuccess;
+    }
+
+    /**
+     * findBreakpoint(aBreak, dbgAddr, fRemove, fTemporary, fQuiet)
+     *
+     * @this {Debugger8080}
+     * @param {Array} aBreak
+     * @param {DbgAddr8080} dbgAddr
+     * @param {boolean} [fRemove]
+     * @param {boolean} [fTemporary]
+     * @param {boolean} [fQuiet]
+     * @return {boolean} true if found, false if not
+     */
+    findBreakpoint(aBreak, dbgAddr, fRemove, fTemporary, fQuiet)
+    {
+        var fFound = false;
+        var addr = this.getAddr(dbgAddr);
+        for (var i = 1; i < aBreak.length; i++) {
+            var dbgAddrBreak = aBreak[i];
+            if (addr == this.getAddr(dbgAddrBreak)) {
+                if (!fTemporary || dbgAddrBreak.fTemporary) {
+                    fFound = true;
+                    if (fRemove) {
+                        if (!dbgAddrBreak.fTemporary && !fQuiet) {
+                            this.printBreakpoint(aBreak, i, "cleared");
+                        }
+                        aBreak.splice(i, 1);
+                        if (aBreak != this.aBreakExec) {
+                            this.bus.removeMemBreak(addr, aBreak == this.aBreakWrite);
+                        }
+                        /*
+                         * We'll mirror the logic in addBreakpoint() and leave the history buffer alone if this
+                         * was a temporary breakpoint.
+                         */
+                        if (!dbgAddrBreak.fTemporary) {
+                            this.historyInit();
+                        }
+                        break;
+                    }
+                    if (!fQuiet) this.printBreakpoint(aBreak, i, "exists");
+                    break;
+                }
+            }
+        }
+        return fFound;
+    }
+
+    /**
+     * listBreakpoints(aBreak)
+     *
+     * @this {Debugger8080}
+     * @param {Array} aBreak
+     * @return {number} of breakpoints listed, 0 if none
+     */
+    listBreakpoints(aBreak)
+    {
+        for (var i = 1; i < aBreak.length; i++) {
+            this.printBreakpoint(aBreak, i);
+        }
+        return aBreak.length - 1;
+    }
+
+    /**
+     * printBreakpoint(aBreak, i, sAction)
+     *
+     * @this {Debugger8080}
+     * @param {Array} aBreak
+     * @param {number} i
+     * @param {string} [sAction]
+     */
+    printBreakpoint(aBreak, i, sAction)
+    {
+        var dbgAddr = aBreak[i];
+        this.println(aBreak[0] + ' ' + this.toHexAddr(dbgAddr) + (sAction? (' ' + sAction) : (dbgAddr.sCmd? (' "' + dbgAddr.sCmd + '"') : '')));
+    }
+
+    /**
+     * setTempBreakpoint(dbgAddr)
+     *
+     * @this {Debugger8080}
+     * @param {DbgAddr8080} dbgAddr of new temp breakpoint
+     */
+    setTempBreakpoint(dbgAddr)
+    {
+        this.addBreakpoint(this.aBreakExec, dbgAddr, true);
+    }
+
+    /**
+     * clearTempBreakpoint(addr)
+     *
+     * @this {Debugger8080}
+     * @param {number|undefined} [addr] clear all temp breakpoints if no address specified
+     */
+    clearTempBreakpoint(addr)
+    {
+        if (addr !== undefined) {
+            this.checkBreakpoint(addr, 1, this.aBreakExec, true);
+            this.nStep = 0;
+        } else {
+            for (var i = 1; i < this.aBreakExec.length; i++) {
+                var dbgAddrBreak = this.aBreakExec[i];
+                if (dbgAddrBreak.fTemporary) {
+                    if (!this.findBreakpoint(this.aBreakExec, dbgAddrBreak, true, true)) break;
+                    i = 0;
+                }
+            }
+        }
+    }
+
+    /**
+     * checkBreakpoint(addr, nb, aBreak, fTemporary)
+     *
+     * @this {Debugger8080}
+     * @param {number} addr
+     * @param {number} nb (# of bytes)
+     * @param {Array} aBreak
+     * @param {boolean} [fTemporary]
+     * @return {boolean} true if breakpoint has been hit, false if not
+     */
+    checkBreakpoint(addr, nb, aBreak, fTemporary)
+    {
+        /*
+         * Time to check for execution breakpoints; note that this should be done BEFORE updating frequency
+         * or history data (see checkInstruction), since we might not actually execute the current instruction.
+         */
+        var fBreak = false;
+
+        if (!this.nSuppressBreaks++) {
+
+            for (var i = 1; !fBreak && i < aBreak.length; i++) {
+
+                var dbgAddrBreak = aBreak[i];
+
+                if (fTemporary && !dbgAddrBreak.fTemporary) continue;
+
+                /*
+                 * We used to calculate the linear address of the breakpoint at the time the
+                 * breakpoint was added, so that a breakpoint set in one mode (eg, in real-mode)
+                 * would still work as intended if the mode changed later (eg, to protected-mode).
+                 *
+                 * However, that created difficulties setting protected-mode breakpoints in segments
+                 * that might not be defined yet, or that could move in physical memory.
+                 *
+                 * If you want to create a real-mode breakpoint that will break regardless of mode,
+                 * use the physical address of the real-mode memory location instead.
+                 */
+                var addrBreak = this.getAddr(dbgAddrBreak);
+                for (var n = 0; n < nb; n++) {
+                    if (addr + n == addrBreak) {
+                        var a;
+                        fBreak = true;
+                        if (dbgAddrBreak.fTemporary) {
+                            this.findBreakpoint(aBreak, dbgAddrBreak, true, true);
+                            fTemporary = true;
+                        }
+                        if (a = dbgAddrBreak.aCmds) {
+                            /*
+                             * When one or more commands are attached to a breakpoint, we don't halt by default.
+                             * Instead, we set fBreak to true only if, at the completion of all the commands, the
+                             * CPU is halted; in other words, you should include "h" as one of the breakpoint commands
+                             * if you want the breakpoint to stop execution.
+                             *
+                             * Another useful command is "if", which will return false if the expression is false,
+                             * at which point we'll jump ahead to the next "else" command, and if there isn't an "else",
+                             * we abort.
+                             */
+                            fBreak = false;
+                            for (var j = 0; j < a.length; j++) {
+                                if (!this.doCommand(a[j], true)) {
+                                    if (a[j].indexOf("if")) {
+                                        fBreak = true;          // the failed command wasn't "if", so abort
+                                        break;
+                                    }
+                                    var k = j + 1;
+                                    for (; k < a.length; k++) {
+                                        if (!a[k].indexOf("else")) break;
+                                        j++;
+                                    }
+                                    if (k == a.length) {        // couldn't find an "else" after the "if", so abort
+                                        fBreak = true;
+                                        break;
+                                    }
+                                    /*
+                                     * If we're still here, we'll execute the "else" command (which is just a no-op),
+                                     * followed by any remaining commands.
+                                     */
+                                }
+                            }
+                            if (!this.cpu.isRunning()) fBreak = true;
+                        }
+                        if (fBreak) {
+                            if (!fTemporary) this.printBreakpoint(aBreak, i, "hit");
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+
+        this.nSuppressBreaks--;
+
+        return fBreak;
+    }
+
+    /**
+     * getInstruction(dbgAddr, sComment, nSequence)
+     *
+     * @this {Debugger8080}
+     * @param {DbgAddr8080} dbgAddr
+     * @param {string} [sComment] is an associated comment
+     * @param {number|null} [nSequence] is an associated sequence number, undefined if none
+     * @return {string} (and dbgAddr is updated to the next instruction)
+     */
+    getInstruction(dbgAddr, sComment, nSequence)
+    {
+        var dbgAddrIns = this.newAddr(dbgAddr.addr);
+
+        var bOpcode = this.getByte(dbgAddr, 1);
+
+        var asOpcodes = this.style != Debugger8080.STYLE_8086? Debugger8080.INS_NAMES : Debugger8080.INS_NAMES_8086;
+        var aOpDesc = this.aaOpDescs[bOpcode];
+        var iIns = aOpDesc[0];
+
+        var sOperands = "";
+        var sOpcode = asOpcodes[iIns];
+        var cOperands = aOpDesc.length - 1;
+        var typeSizeDefault = Debugger8080.TYPE_NONE, type;
+
+        for (var iOperand = 1; iOperand <= cOperands; iOperand++) {
+
+            var disp, off, cch;
+            var sOperand = "";
+
+            type = aOpDesc[iOperand];
+            if (type === undefined) continue;
+            if ((type & Debugger8080.TYPE_OPT) && this.style == Debugger8080.STYLE_8080) continue;
+
+            var typeMode = type & Debugger8080.TYPE_MODE;
+            if (!typeMode) continue;
+
+            var typeSize = type & Debugger8080.TYPE_SIZE;
+            if (!typeSize) {
+                type |= typeSizeDefault;
+            } else {
+                typeSizeDefault = typeSize;
+            }
+
+            var typeOther = type & Debugger8080.TYPE_OTHER;
+            if (!typeOther) {
+                type |= (iOperand == 1? Debugger8080.TYPE_OUT : Debugger8080.TYPE_IN);
+            }
+
+            if (typeMode & Debugger8080.TYPE_IMM) {
+                sOperand = this.getImmOperand(type, dbgAddr);
+            }
+            else if (typeMode & Debugger8080.TYPE_REG) {
+                sOperand = this.getRegOperand((type & Debugger8080.TYPE_IREG) >> 8, type, dbgAddr);
+            }
+            else if (typeMode & Debugger8080.TYPE_INT) {
+                sOperand = ((bOpcode >> 3) & 0x7).toString();
+            }
+
+            if (!sOperand || !sOperand.length) {
+                sOperands = "INVALID";
+                break;
+            }
+            if (sOperands.length > 0) sOperands += ',';
+            sOperands += (sOperand || "???");
+        }
+
+        var sBytes = "";
+        var sLine = this.toHexAddr(dbgAddrIns) + ' ';
+        if (dbgAddrIns.addr !== CPUDef8080.ADDR_INVALID && dbgAddr.addr !== CPUDef8080.ADDR_INVALID) {
+            do {
+                sBytes += Str.toHex(this.getByte(dbgAddrIns, 1), 2);
+                if (dbgAddrIns.addr == null) break;
+            } while (dbgAddrIns.addr != dbgAddr.addr);
+        }
+
+        sLine += Str.pad(sBytes, 10);
+        sLine += (type & Debugger8080.TYPE_UNDOC)? '*' : ' ';
+        sLine += Str.pad(sOpcode, 7);
+        if (sOperands) sLine += ' ' + sOperands;
+
+        if (sComment) {
+            sLine = Str.pad(sLine, 40) + ';' + sComment;
+            if (!this.cpu.flags.checksum) {
+                sLine += (nSequence != null? '=' + nSequence.toString() : "");
+            } else {
+                var nCycles = this.cpu.getCycles();
+                sLine += "cycles=" + nCycles.toString() + " cs=" + Str.toHex(this.cpu.nChecksum);
+            }
+        }
+        return sLine;
+    }
+
+    /**
+     * getImmOperand(type, dbgAddr)
+     *
+     * @this {Debugger8080}
+     * @param {number} type
+     * @param {DbgAddr8080} dbgAddr
+     * @return {string} operand
+     */
+    getImmOperand(type, dbgAddr)
+    {
+        var sOperand = ' ';
+        var typeSize = type & Debugger8080.TYPE_SIZE;
+
+        switch (typeSize) {
+        case Debugger8080.TYPE_BYTE:
+            sOperand = Str.toHex(this.getByte(dbgAddr, 1), 2);
+            break;
+        case Debugger8080.TYPE_SBYTE:
+            sOperand = Str.toHex((this.getByte(dbgAddr, 1) << 24) >> 24, 4);
+            break;
+        case Debugger8080.TYPE_WORD:
+            sOperand = Str.toHex(this.getShort(dbgAddr, 2), 4);
+            break;
+        default:
+            return "imm(" + Str.toHexWord(type) + ')';
+        }
+        if (this.style == Debugger8080.STYLE_8086 && (type & Debugger8080.TYPE_MEM)) {
+            sOperand = '[' + sOperand + ']';
+        } else if (!(type & Debugger8080.TYPE_REG)) {
+            sOperand = (this.style == Debugger8080.STYLE_8080? '$' : "0x") + sOperand;
+        }
+        return sOperand;
+    }
+
+    /**
+     * getRegOperand(iReg, type, dbgAddr)
+     *
+     * @this {Debugger8080}
+     * @param {number} iReg
+     * @param {number} type
+     * @param {DbgAddr8080} dbgAddr
+     * @return {string} operand
+     */
+    getRegOperand(iReg, type, dbgAddr)
+    {
+        /*
+         * Although this breaks with 8080 assembler conventions, I'm going to experiment with some different
+         * mnemonics; specifically, "[HL]" instead of "M".  This is also more in keeping with how getImmOperand()
+         * displays memory references (ie, by enclosing them in brackets).
+         */
+        var sOperand = Debugger8080.REGS[iReg];
+        if (this.style == Debugger8080.STYLE_8086 && (type & Debugger8080.TYPE_MEM)) {
+            if (iReg == Debugger8080.REG_M) {
+                sOperand = "HL";
+            }
+            sOperand = '[' + sOperand + ']';
+        }
+        return sOperand;
+    }
+
+    /**
+     * parseInstruction(sOp, sOperand, addr)
+     *
+     * TODO: Unimplemented.  See parseInstruction() in modules/c1pjs/lib/debugger.js for a working implementation.
+     *
+     * @this {Debugger8080}
+     * @param {string} sOp
+     * @param {string|undefined} sOperand
+     * @param {DbgAddr8080} dbgAddr of memory where this instruction is being assembled
+     * @return {Array.<number>} of opcode bytes; if the instruction can't be parsed, the array will be empty
+     */
+    parseInstruction(sOp, sOperand, dbgAddr)
+    {
+        var aOpBytes = [];
+        this.println("not supported yet");
+        return aOpBytes;
+    }
+
+    /**
+     * getFlagOutput(sFlag)
+     *
+     * @this {Debugger8080}
+     * @param {string} sFlag
+     * @return {string} value of flag
+     */
+    getFlagOutput(sFlag)
+    {
+        var b;
+        switch (sFlag) {
+        case "IF":
+            b = this.cpu.getIF();
+            break;
+        case "SF":
+            b = this.cpu.getSF();
+            break;
+        case "ZF":
+            b = this.cpu.getZF();
+            break;
+        case "AF":
+            b = this.cpu.getAF();
+            break;
+        case "PF":
+            b = this.cpu.getPF();
+            break;
+        case "CF":
+            b = this.cpu.getCF();
+            break;
+        default:
+            b = 0;
+            break;
+        }
+        return sFlag.charAt(0) + (b? '1' : '0') + ' ';
+    }
+
+    /**
+     * getRegOutput(iReg)
+     *
+     * @this {Debugger8080}
+     * @param {number} iReg
+     * @return {string}
+     */
+    getRegOutput(iReg)
+    {
+        var sReg = Debugger8080.REGS[iReg];
+        return sReg + '=' + this.getRegString(iReg) + ' ';
+    }
+
+    /**
+     * getRegDump()
+     *
+     * Sample 8080 register dump:
+     *
+     *      A=00 BC=0000 DE=0000 HL=0000 SP=0000 I0 S0 Z0 A0 P0 C0
+     *      0000 00         NOP
+     *
+     * @this {Debugger8080}
+     * @return {string}
+     */
+    getRegDump()
+    {
+        var s;
+        s = this.getRegOutput(Debugger8080.REG_A) +
+            this.getRegOutput(Debugger8080.REG_BC) +
+            this.getRegOutput(Debugger8080.REG_DE) +
+            this.getRegOutput(Debugger8080.REG_HL) +
+            this.getRegOutput(Debugger8080.REG_SP) +
+            this.getFlagOutput("IF") + this.getFlagOutput("SF") + this.getFlagOutput("ZF") +
+            this.getFlagOutput("AF") + this.getFlagOutput("PF") + this.getFlagOutput("CF");
+        return s;
+    }
+
+    /**
+     * comparePairs(p1, p2)
+     *
+     * @this {Debugger8080}
+     * @param {number|string|Array|Object} p1
+     * @param {number|string|Array|Object} p2
+     * @return {number}
+     */
+    comparePairs(p1, p2)
+    {
+        return p1[0] > p2[0]? 1 : p1[0] < p2[0]? -1 : 0;
+    }
+
+    /**
+     * addSymbols(sModule, addr, len, aSymbols)
+     *
+     * As filedump.js (formerly convrom.php) explains, aSymbols is a JSON-encoded object whose properties consist
+     * of all the symbols (in upper-case), and the values of those properties are objects containing any or all of
+     * the following properties:
+     *
+     *      'v': the value of an absolute (unsized) value
+     *      'b': either 1, 2, 4 or undefined if an unsized value
+     *      's': either a hard-coded segment or undefined
+     *      'o': the offset of the symbol within the associated address space
+     *      'l': the original-case version of the symbol, present only if it wasn't originally upper-case
+     *      'a': annotation for the specified offset; eg, the original assembly language, with optional comment
+     *
+     * To that list of properties, we also add:
+     *
+     *      'p': the physical address (calculated whenever both 's' and 'o' properties are defined)
+     *
+     * Note that values for any 'v', 'b', 's' and 'o' properties are unquoted decimal values, and the values
+     * for any 'l' or 'a' properties are quoted strings. Also, if double-quotes were used in any of the original
+     * annotation ('a') values, they will have been converted to two single-quotes, so we're responsible for
+     * converting them back to individual double-quotes.
+     *
+     * For example:
+     *      {
+     *          'HF_PORT': {
+     *              'v':800
+     *          },
+     *          'HDISK_INT': {
+     *              'b':4, 's':0, 'o':52
+     *          },
+     *          'ORG_VECTOR': {
+     *              'b':4, 's':0, 'o':76
+     *          },
+     *          'CMD_BLOCK': {
+     *              'b':1, 's':64, 'o':66
+     *          },
+     *          'DISK_SETUP': {
+     *              'o':3
+     *          },
+     *          '.40': {
+     *              'o':40, 'a':"MOV AX,WORD PTR ORG_VECTOR ;GET DISKETTE VECTOR"
+     *          }
+     *      }
+     *
+     * If a symbol only has an offset, then that offset value can be assigned to the symbol property directly:
+     *
+     *          'DISK_SETUP': 3
+     *
+     * The last property is an example of an "anonymous" entry, for offsets where there is no associated symbol.
+     * Such entries are identified by a period followed by a unique number (usually the offset of the entry), and
+     * they usually only contain offset ('o') and annotation ('a') properties.  I could eliminate the leading
+     * period, but it offers a very convenient way of quickly discriminating among genuine vs. anonymous symbols.
+     *
+     * We add all these entries to our internal symbol table, which is an array of 4-element arrays, each of which
+     * look like:
+     *
+     *      [addr, len, aSymbols, aOffsets]
+     *
+     * There are two basic symbol operations: findSymbol(), which takes an address and finds the symbol, if any,
+     * at that address, and findSymbolAddr(), which takes a string and attempts to match it to a non-anonymous
+     * symbol with a matching offset ('o') property.
+     *
+     * To implement findSymbol() efficiently, addSymbols() creates an array of [offset, sSymbol] pairs
+     * (aOffsets), one pair for each symbol that corresponds to an offset within the specified address space.
+     *
+     * We guarantee the elements of aOffsets are in offset order, because we build it using binaryInsert();
+     * it's quite likely that the MAP file already ordered all its symbols in offset order, but since they're
+     * hand-edited files, we can't assume that, and we need to ensure that findSymbol()'s binarySearch() operates
+     * properly.
+     *
+     * @this {Debugger8080}
+     * @param {string|null} sModule
+     * @param {number|null} addr (physical address where the symbols are located, if the memory is physical; eg, ROM)
+     * @param {number} len (the size of the region, in bytes)
+     * @param {Object} aSymbols (collection of symbols in this group; the format of this collection is described below)
+     */
+    addSymbols(sModule, addr, len, aSymbols)
+    {
+        var dbgAddr = {};
+        var aOffsets = [];
+        for (var sSymbol in aSymbols) {
+            var symbol = aSymbols[sSymbol];
+            if (typeof symbol == "number") {
+                aSymbols[sSymbol] = symbol = {'o': symbol};
+            }
+            var offSymbol = symbol['o'];
+            var sAnnotation = symbol['a'];
+            if (offSymbol !== undefined) {
+                Usr.binaryInsert(aOffsets, [offSymbol >>> 0, sSymbol], this.comparePairs);
+            }
+            if (sAnnotation) symbol['a'] = sAnnotation.replace(/''/g, "\"");
+        }
+        var symbolTable = {
+            sModule: sModule,
+            addr: addr,
+            len: len,
+            aSymbols: aSymbols,
+            aOffsets: aOffsets
+        };
+        this.aSymbolTable.push(symbolTable);
+    }
+
+    /**
+     * dumpSymbols()
+     *
+     * TODO: Add "numerical" and "alphabetical" dump options. This is simply dumping them in whatever
+     * order they appeared in the original MAP file.
+     *
+     * @this {Debugger8080}
+     */
+    dumpSymbols()
+    {
+        for (var iTable = 0; iTable < this.aSymbolTable.length; iTable++) {
+            var symbolTable = this.aSymbolTable[iTable];
+            for (var sSymbol in symbolTable.aSymbols) {
+                if (sSymbol.charAt(0) == '.') continue;
+                var symbol = symbolTable.aSymbols[sSymbol];
+                var offSymbol = symbol['o'];
+                if (offSymbol === undefined) continue;
+                var sSymbolOrig = symbolTable.aSymbols[sSymbol]['l'];
+                if (sSymbolOrig) sSymbol = sSymbolOrig;
+                this.println(this.toHexOffset(offSymbol) + ' ' + sSymbol);
+            }
+        }
+    }
+
+    /**
+     * findSymbol(dbgAddr, fNearest)
+     *
+     * Search aSymbolTable for dbgAddr, and return an Array for the corresponding symbol (empty if not found).
+     *
+     * If fNearest is true, and no exact match was found, then the Array returned will contain TWO sets of
+     * entries: [0]-[3] will refer to closest preceding symbol, and [4]-[7] will refer to the closest subsequent symbol.
+     *
+     * @this {Debugger8080}
+     * @param {DbgAddr8080} dbgAddr
+     * @param {boolean} [fNearest]
+     * @return {Array} where [0] == symbol name, [1] == symbol value, [2] == any annotation, and [3] == any associated comment
+     */
+    findSymbol(dbgAddr, fNearest)
+    {
+        var aSymbol = [];
+        var addrSymbol = this.getAddr(dbgAddr) >>> 0;
+        for (var iTable = 0; iTable < this.aSymbolTable.length; iTable++) {
+            var symbolTable = this.aSymbolTable[iTable];
+            var addr = symbolTable.addr >>> 0;
+            var len = symbolTable.len;
+            if (addrSymbol >= addr && addrSymbol < addr + len) {
+                var offSymbol = addrSymbol - addr;
+                var result = Usr.binarySearch(symbolTable.aOffsets, [offSymbol], this.comparePairs);
+                if (result >= 0) {
+                    this.returnSymbol(iTable, result, aSymbol);
+                }
+                else if (fNearest) {
+                    result = ~result;
+                    this.returnSymbol(iTable, result-1, aSymbol);
+                    this.returnSymbol(iTable, result, aSymbol);
+                }
+                break;
+            }
+        }
+        return aSymbol;
+    }
+
+    /**
+     * findSymbolAddr(sSymbol)
+     *
+     * Search aSymbolTable for sSymbol, and if found, return a dbgAddr (same as parseAddr())
+     *
+     * @this {Debugger8080}
+     * @param {string} sSymbol
+     * @return {DbgAddr8080|undefined}
+     */
+    findSymbolAddr(sSymbol)
+    {
+        var dbgAddr;
+        if (sSymbol.match(/^[a-z_][a-z0-9_]*$/i)) {
+            var sUpperCase = sSymbol.toUpperCase();
+            for (var iTable = 0; iTable < this.aSymbolTable.length; iTable++) {
+                var symbolTable = this.aSymbolTable[iTable];
+                var symbol = symbolTable.aSymbols[sUpperCase];
+                if (symbol !== undefined) {
+                    var offSymbol = symbol['o'];
+                    if (offSymbol !== undefined) {
+                        /*
+                         * We assume that every ROM is ORG'ed at 0x0000, and therefore unless the symbol has an
+                         * explicitly-defined segment, we return the segment associated with the entire group; for
+                         * a ROM, that segment is normally "addrROM >>> 4".  Down the road, we may want/need to
+                         * support a special symbol entry (eg, ".ORG") that defines an alternate origin.
+                         */
+                        dbgAddr = this.newAddr(offSymbol);
+                    }
+                    /*
+                     * The symbol matched, but it wasn't for an address (no 'o' offset), and there's no point
+                     * looking any farther, since each symbol appears only once, so we indicate it's an unknown symbol.
+                     */
+                    break;
+                }
+            }
+        }
+        return dbgAddr;
+    }
+
+    /**
+     * returnSymbol(iTable, iOffset, aSymbol)
+     *
+     * Helper function for findSymbol().
+     *
+     * @param {number} iTable
+     * @param {number} iOffset
+     * @param {Array} aSymbol is updated with the specified symbol, if it exists
+     */
+    returnSymbol(iTable, iOffset, aSymbol)
+    {
+        var symbol = {};
+        var aOffsets = this.aSymbolTable[iTable].aOffsets;
+        var offset = 0, sSymbol = null;
+        if (iOffset >= 0 && iOffset < aOffsets.length) {
+            offset = aOffsets[iOffset][0];
+            sSymbol = aOffsets[iOffset][1];
+        }
+        if (sSymbol) {
+            symbol = this.aSymbolTable[iTable].aSymbols[sSymbol];
+            sSymbol = (sSymbol.charAt(0) == '.'? null : (symbol['l'] || sSymbol));
+        }
+        aSymbol.push(sSymbol);
+        aSymbol.push(offset);
+        aSymbol.push(symbol['a']);
+        aSymbol.push(symbol['c']);
+    }
+
+    /**
+     * doHelp()
+     *
+     * @this {Debugger8080}
+     */
+    doHelp()
+    {
+        var s = "commands:";
+        for (var sCommand in Debugger8080.COMMANDS) {
+            s += '\n' + Str.pad(sCommand, 9) + Debugger8080.COMMANDS[sCommand];
+        }
+        if (!this.checksEnabled()) s += "\nnote: frequency/history disabled if no exec breakpoints";
+        this.println(s);
+    }
+
+    /**
+     * doAssemble(asArgs)
+     *
+     * This always receives the complete argument array, where the order of the arguments is:
+     *
+     *      [0]: the assemble command (assumed to be "a")
+     *      [1]: the target address (eg, "200")
+     *      [2]: the operation code, aka instruction name (eg, "adc")
+     *      [3]: the operation mode operand, if any (eg, "14", "[1234]", etc)
+     *
+     * The Debugger enters "assemble mode" whenever only the first (or first and second) arguments are present.
+     * As long as "assemble mode is active, the user can omit the first two arguments on all later assemble commands
+     * until "assemble mode" is cancelled with an empty command line; the command processor automatically prepends "a"
+     * and the next available target address to the argument array.
+     *
+     * Entering "assemble mode" is optional; one could enter a series of fully-qualified assemble commands; eg:
+     *
+     *      a ff00 cld
+     *      a ff01 ldx 28
+     *      ...
+     *
+     * without ever entering "assemble mode", but of course, that requires more typing and doesn't take advantage
+     * of automatic target address advancement (see dbgAddrAssemble).
+     *
+     * NOTE: As the previous example implies, you can even assemble new instructions into ROM address space;
+     * as our setByte() function explains, the ROM write-notification handlers only refuse writes from the CPU.
+     *
+     * @this {Debugger8080}
+     * @param {Array.<string>} asArgs is the complete argument array, beginning with the "a" command in asArgs[0]
+     */
+    doAssemble(asArgs)
+    {
+        var dbgAddr = this.parseAddr(asArgs[1], true);
+        if (!dbgAddr) return;
+
+        this.dbgAddrAssemble = dbgAddr;
+        if (asArgs[2] === undefined) {
+            this.println("begin assemble at " + this.toHexAddr(dbgAddr));
+            this.fAssemble = true;
+            this.cpu.updateCPU();
+            return;
+        }
+
+        var aOpBytes = this.parseInstruction(asArgs[2], asArgs[3], dbgAddr);
+        if (aOpBytes.length) {
+            for (var i = 0; i < aOpBytes.length; i++) {
+                this.setByte(dbgAddr, aOpBytes[i], 1);
+            }
+            /*
+             * Since getInstruction() also updates the specified address, dbgAddrAssemble is automatically advanced.
+             */
+            this.println(this.getInstruction(this.dbgAddrAssemble));
+        }
+    }
+
+    /**
+     * doBreak(sCmd, sAddr, sOptions)
+     *
+     * As the "help" output below indicates, the following breakpoint commands are supported:
+     *
+     *      bp [a]  set exec breakpoint on linear addr [a]
+     *      br [a]  set read breakpoint on linear addr [a]
+     *      bw [a]  set write breakpoint on linear addr [a]
+     *      bc [a]  clear breakpoint on linear addr [a] (use "*" for all breakpoints)
+     *      bl      list breakpoints
+     *
+     * to which we have recently added the following I/O breakpoint commands:
+     *
+     *      bi [p]  toggle input breakpoint on port [p] (use "*" for all input ports)
+     *      bo [p]  toggle output breakpoint on port [p] (use "*" for all output ports)
+     *
+     * These two new commands operate as toggles so that if "*" is used to trap all input (or output),
+     * you can also use these commands to NOT trap specific ports.
+     *
+     *      bn [n]  break after [n] instructions
+     *
+     * TODO: Update the "bl" command to include any/all I/O breakpoints, and the "bc" command to
+     * clear them.  Because "bi" and "bo" commands are piggy-backing on Bus functions, those breakpoints
+     * are currently outside the realm of what the "bl" and "bc" commands are aware of.
+     *
+     * @this {Debugger8080}
+     * @param {string} sCmd
+     * @param {string|undefined} [sAddr]
+     * @param {string} [sOptions] (the rest of the breakpoint command-line)
+     */
+    doBreak(sCmd, sAddr, sOptions)
+    {
+        if (sAddr == '?') {
+            this.println("breakpoint commands:");
+            this.println("\tbi [p]\ttoggle break on input port [p]");
+            this.println("\tbo [p]\ttoggle break on output port [p]");
+            this.println("\tbp [a]\tset exec breakpoint at addr [a]");
+            this.println("\tbr [a]\tset read breakpoint at addr [a]");
+            this.println("\tbw [a]\tset write breakpoint at addr [a]");
+            this.println("\tbc [a]\tclear breakpoint at addr [a]");
+            this.println("\tbl\tlist all breakpoints");
+            this.println("\tbn [n]\tbreak after [n] instruction(s)");
+            return;
+        }
+
+        var sParm = sCmd.charAt(1);
+        if (sParm == 'l') {
+            var cBreaks = 0;
+            cBreaks += this.listBreakpoints(this.aBreakExec);
+            cBreaks += this.listBreakpoints(this.aBreakRead);
+            cBreaks += this.listBreakpoints(this.aBreakWrite);
+            if (!cBreaks) this.println("no breakpoints");
+            return;
+        }
+
+        if (sParm == 'n') {
+            this.nBreakIns = this.parseValue(sAddr);
+            this.println("break after " + this.nBreakIns + " instruction(s)");
+            return;
+        }
+
+        if (sAddr === undefined) {
+            this.println("missing breakpoint address");
+            return;
+        }
+
+        var dbgAddr = this.newAddr();
+        if (sAddr != '*') {
+            dbgAddr = this.parseAddr(sAddr, true, true);
+            if (!dbgAddr) return;
+        }
+
+        sAddr = Str.toHexWord(dbgAddr.addr);
+
+        if (sParm == 'c') {
+            if (dbgAddr.addr == null) {
+                this.clearBreakpoints();
+                this.println("all breakpoints cleared");
+                return;
+            }
+            if (this.findBreakpoint(this.aBreakExec, dbgAddr, true))
+                return;
+            if (this.findBreakpoint(this.aBreakRead, dbgAddr, true))
+                return;
+            if (this.findBreakpoint(this.aBreakWrite, dbgAddr, true))
+                return;
+            this.println("breakpoint missing: " + this.toHexAddr(dbgAddr));
+            return;
+        }
+
+        if (sParm == 'i') {
+            this.println("breakpoint " + (this.bus.addPortInputBreak(dbgAddr.addr)? "enabled" : "cleared") + ": port " + sAddr + " (input)");
+            return;
+        }
+
+        if (sParm == 'o') {
+            this.println("breakpoint " + (this.bus.addPortOutputBreak(dbgAddr.addr)? "enabled" : "cleared") + ": port " + sAddr + " (output)");
+            return;
+        }
+
+        if (dbgAddr.addr == null) return;
+
+        this.parseAddrOptions(dbgAddr, sOptions);
+
+        if (sParm == 'p') {
+            this.addBreakpoint(this.aBreakExec, dbgAddr);
+            return;
+        }
+        if (sParm == 'r') {
+            this.addBreakpoint(this.aBreakRead, dbgAddr);
+            return;
+        }
+        if (sParm == 'w') {
+            this.addBreakpoint(this.aBreakWrite, dbgAddr);
+            return;
+        }
+        this.println("unknown breakpoint command: " + sParm);
+    }
+
+    /**
+     * doClear(sCmd)
+     *
+     * @this {Debugger8080}
+     * @param {string} [sCmd] (eg, "cls" or "clear")
+     */
+    doClear(sCmd)
+    {
+        /*
+         * TODO: There should be a clear() component method that the Control Panel overrides to perform this function.
+         */
+        if (this.controlPrint) this.controlPrint.value = "";
+    }
+
+    /**
+     * doDump(asArgs)
+     *
+     * The length parameter is interpreted as a number of bytes, in hex, which we convert to the appropriate number
+     * of lines, because we always display whole lines.  If the length is omitted/undefined, it defaults to 0x80 (128.)
+     * bytes, which normally translates to 8 lines.
+     *
+     * @this {Debugger8080}
+     * @param {Array.<string>} asArgs (formerly sCmd, [sAddr], [sLen] and [sBytes])
+     */
+    doDump(asArgs)
+    {
+        var m;
+        var sCmd = asArgs[0];
+        var sAddr = asArgs[1];
+        var sLen = asArgs[2];
+        var sBytes = asArgs[3];
+
+        if (sAddr == '?') {
+            var sDumpers = "";
+            for (m in Messages8080.CATEGORIES) {
+                if (this.afnDumpers[m]) {
+                    if (sDumpers) sDumpers += ',';
+                    sDumpers = sDumpers + m;
+                }
+            }
+            sDumpers += ",state,symbols";
+            this.println("dump memory commands:");
+            this.println("\tdb [a] [#]    dump # bytes at address a");
+            this.println("\tdw [a] [#]    dump # words at address a");
+            this.println("\tdd [a] [#]    dump # dwords at address a");
+            this.println("\tdh [#] [#]    dump # instructions from history");
+            if (sDumpers.length) this.println("dump extension commands:\n\t" + sDumpers);
+            return;
+        }
+
+        if (sAddr == "state") {
+            var sState = this.cmp.powerOff(true);
+            if (sLen == "console") {
+                /*
+                 * Console buffers are notoriously small, and even the following code, which breaks the
+                 * data into parts (eg, "d state console 1", "d state console 2", etc) just isn't that helpful.
+                 *
+                 *      var nPart = +sBytes;
+                 *      if (nPart) sState = sState.substr(1000000 * (nPart-1), 1000000);
+                 *
+                 * So, the best way to capture a large machine state is to use the new "Save Machine" link
+                 * that downloads a machine's entire state.  Alternatively, run your own local server and use
+                 * server-side storage.  Take a look at the "Save" binding in computer.js, which binds an HTML
+                 * control to the computer.powerOff() and computer.saveServerState() functions.
+                 */
+                console.log(sState);
+            } else {
+                this.doClear();
+                if (sState) this.println(sState);
+            }
+            return;
+        }
+
+        if (sAddr == "symbols") {
+            this.dumpSymbols();
+            return;
+        }
+
+        if (sCmd == "d") {
+            for (m in Messages8080.CATEGORIES) {
+                if (asArgs[1] == m) {
+                    var fnDumper = this.afnDumpers[m];
+                    if (fnDumper) {
+                        asArgs.shift();
+                        asArgs.shift();
+                        fnDumper(asArgs);
+                    } else {
+                        this.println("no dump registered for " + sAddr);
+                    }
+                    return;
+                }
+            }
+            if (!sAddr) sCmd = this.sCmdDumpPrev || "db";
+        } else {
+            this.sCmdDumpPrev = sCmd;
+        }
+
+        if (sCmd == "dh") {
+            this.dumpHistory(sAddr, sLen);
+            return;
+        }
+
+        var dbgAddr = this.parseAddr(sAddr);
+        if (!dbgAddr) return;
+
+        var len = 0;                            // 0 is not a default; it triggers the appropriate default below
+        if (sLen) {
+            if (sLen.charAt(0) == 'l') {
+                sLen = sLen.substr(1) || sBytes;
+            }
+            len = this.parseValue(sLen) >>> 0;  // negative lengths not allowed
+            if (len > 0x10000) len = 0x10000;   // prevent bad user (or variable) input from producing excessive output
+        }
+
+        var sDump = "";
+        var size = (sCmd == "dd"? 4 : (sCmd == "dw"? 2 : 1));
+        var cb = (size * len) || 128;
+        var cLines = ((cb + 15) >> 4) || 1;
+
+        while (cLines-- && cb > 0) {
+            var data = 0, iByte = 0, i;
+            var sData = "", sChars = "";
+            sAddr = this.toHexAddr(dbgAddr);
+            for (i = 16; i > 0 && cb > 0; i--) {
+                var b = this.getByte(dbgAddr, 1);
+                data |= (b << (iByte++ << 3));
+                if (iByte == size) {
+                    sData += Str.toHex(data, size * 2);
+                    sData += (size == 1? (i == 9? '-' : ' ') : "  ");
+                    data = iByte = 0;
+                }
+                sChars += (b >= 32 && b < 128? String.fromCharCode(b) : '.');
+                cb--;
+            }
+            if (sDump) sDump += '\n';
+            sDump += sAddr + "  " + sData + ((i == 0)? (' ' + sChars) : "");
+        }
+
+        if (sDump) this.println(sDump);
+        this.dbgAddrNextData = dbgAddr;
+    }
+
+    /**
+     * doEdit(asArgs)
+     *
+     * @this {Debugger8080}
+     * @param {Array.<string>} asArgs
+     */
+    doEdit(asArgs)
+    {
+        var size = 1;
+        var mask = 0xff;
+        var fnGet = this.getByte;
+        var fnSet = this.setByte;
+        if (asArgs[0] == "ew") {
+            size = 2;
+            mask = 0xffff;
+            fnGet = this.getShort;
+            fnSet = this.setShort;
+        }
+        var cch = size << 1;
+
+        var sAddr = asArgs[1];
+        if (sAddr == null) {
+            this.println("edit memory commands:");
+            this.println("\teb [a] [...]  edit bytes at address a");
+            this.println("\tew [a] [...]  edit words at address a");
+            return;
+        }
+
+        var dbgAddr = this.parseAddr(sAddr);
+        if (!dbgAddr) return;
+
+        for (var i = 2; i < asArgs.length; i++) {
+            var vNew = this.parseExpression(asArgs[i]);
+            if (vNew === undefined) {
+                this.println("unrecognized value: " + asArgs[i]);
+                break;
+            }
+            if (vNew & ~mask) {
+                this.println("warning: " + Str.toHex(vNew) + " exceeds " + size + "-byte value");
+            }
+            var vOld = fnGet.call(this, dbgAddr);
+            this.println("changing " + this.toHexAddr(dbgAddr) + " from " + Str.toHex(vOld, cch, true) + " to " + Str.toHex(vNew, cch, true));
+            fnSet.call(this, dbgAddr, vNew, size);
+        }
+    }
+
+    /**
+     * doFreqs(sParm)
+     *
+     * @this {Debugger8080}
+     * @param {string|undefined} sParm
+     */
+    doFreqs(sParm)
+    {
+        if (sParm == '?') {
+            this.println("frequency commands:");
+            this.println("\tclear\tclear all frequency counts");
+            return;
+        }
+        var i;
+        var cData = 0;
+        if (this.aaOpcodeCounts) {
+            if (sParm == "clear") {
+                for (i = 0; i < this.aaOpcodeCounts.length; i++)
+                    this.aaOpcodeCounts[i] = [i, 0];
+                this.println("frequency data cleared");
+                cData++;
+            }
+            else if (sParm !== undefined) {
+                this.println("unknown frequency command: " + sParm);
+                cData++;
+            }
+            else {
+                var aaSortedOpcodeCounts = this.aaOpcodeCounts.slice();
+                aaSortedOpcodeCounts.sort(function(p, q) {
+                    return q[1] - p[1];
+                });
+                var asOpcodes = this.style != Debugger8080.STYLE_8086? Debugger8080.INS_NAMES : Debugger8080.INS_NAMES_8086;
+                for (i = 0; i < aaSortedOpcodeCounts.length; i++) {
+                    var bOpcode = aaSortedOpcodeCounts[i][0];
+                    var cFreq = aaSortedOpcodeCounts[i][1];
+                    if (cFreq) {
+                        this.println((asOpcodes[this.aaOpDescs[bOpcode][0]] + "  ").substr(0, 5) + " (" + Str.toHexByte(bOpcode) + "): " + cFreq + " times");
+                        cData++;
+                    }
+                }
+            }
+        }
+        if (!cData) {
+            this.println("no frequency data available");
+        }
+    }
+
+    /**
+     * doHalt(fQuiet)
+     *
+     * @this {Debugger8080}
+     * @param {boolean} [fQuiet]
+     */
+    doHalt(fQuiet)
+    {
+        var sMsg;
+        if (this.flags.running) {
+            sMsg = "halting";
+            this.stopCPU();
+        } else {
+            if (this.isBusy(true)) return;
+            sMsg = "already halted";
+        }
+        if (!fQuiet) this.println(sMsg);
+    }
+
+    /**
+     * doIf(sCmd, fQuiet)
+     *
+     * NOTE: Don't forget that the default base for all numeric constants is 16 (hex), so when you evaluate
+     * an expression like "a==10", it will compare the value of the variable "a" to 0x10; use a trailing period
+     * (eg, "10.") if you really intend decimal.
+     *
+     * Also, if no variable named "a" exists, "a" will evaluate to 0x0A, so the expression "a==10" becomes
+     * "0x0A==0x10" (false), whereas the expression "a==10." becomes "0x0A==0x0A" (true).
+     *
+     * @this {Debugger8080}
+     * @param {string} sCmd
+     * @param {boolean} [fQuiet]
+     * @return {boolean} true if expression is non-zero, false if zero (or undefined due to a parse error)
+     */
+    doIf(sCmd, fQuiet)
+    {
+        sCmd = Str.trim(sCmd);
+        if (!this.parseExpression(sCmd)) {
+            if (!fQuiet) this.println("false: " + sCmd);
+            return false;
+        }
+        if (!fQuiet) this.println("true: " + sCmd);
+        return true;
+    }
+
+    /**
+     * doInfo(asArgs)
+     *
+     * @this {Debugger8080}
+     * @param {Array.<string>} asArgs
+     * @return {boolean} true only if the instruction info command ("n") is supported
+     */
+    doInfo(asArgs)
+    {
+        if (DEBUG) {
+            this.println("msPerYield: " + this.cpu.msPerYield);
+            this.println("nCyclesPerYield: " + this.cpu.nCyclesPerYield);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * doInput(sPort)
+     *
+     * Simulate a 1-byte port input operation.
+     *
+     * @this {Debugger8080}
+     * @param {string|undefined} sPort
+     */
+    doInput(sPort)
+    {
+        if (!sPort || sPort == '?') {
+            this.println("input commands:");
+            this.println("\ti [p]\tread port [p]");
+            /*
+             * TODO: Regarding this warning, consider adding an "unchecked" version of
+             * bus.checkPortInputNotify(), since all Debugger memory accesses are unchecked, too.
+             *
+             * All port I/O handlers ARE aware when the Debugger is calling (addrFrom is undefined),
+             * but changing them all to be non-destructive would take time, and situations where you
+             * actually want to affect the hardware state are just as likely as not....
+             */
+            this.println("warning: port accesses can affect hardware state");
+            return;
+        }
+        var port = this.parseValue(sPort);
+        if (port !== undefined) {
+            var bIn = this.bus.checkPortInputNotify(port, 1);
+            this.println(Str.toHexWord(port) + ": " + Str.toHexByte(bIn));
+        }
+    }
+
+    /**
+     * doInt(sLevel)
+     *
+     * @this {Debugger8080}
+     * @param {string} sLevel
+     * @return {boolean} true if success, false if error
+     */
+    doInt(sLevel)
+    {
+        if (!this.cpu.getIF()) {
+            this.println("interrupts disabled (use rif=1 to enable)");
+            return false;
+        }
+        var nLevel = this.parseExpression(sLevel);
+        if (nLevel == null) return false;
+        this.println("requesting interrupt level " + nLevel);
+        this.cpu.requestINTR(nLevel);
+        return true;
+    }
+
+    /**
+     * doVar(sCmd)
+     *
+     * The command must be of the form "{variable} = [{expression}]", where expression may contain constants,
+     * operators, registers, symbols, other variables, or nothing at all; in the latter case, the variable, if
+     * any, is deleted.
+     *
+     * Other supported shorthand: "var" with no parameters prints the values of all variables, and "var {variable}"
+     * prints the value of the specified variable.
+     *
+     * @this {Debugger8080}
+     * @param {string} sCmd
+     * @return {boolean} true if valid "var" assignment, false if not
+     */
+    doVar(sCmd)
+    {
+        var a = sCmd.match(/^\s*([A-Z_]?[A-Z0-9_]*)\s*(=?)\s*(.*)$/i);
+        if (a) {
+            if (!a[1]) {
+                if (!this.printVariable()) this.println("no variables");
+                return true;    // it's not considered an error to print an empty list of variables
+            }
+            if (!a[2]) {
+                return this.printVariable(a[1]);
+            }
+            if (!a[3]) {
+                this.delVariable(a[1]);
+                return true;    // it's not considered an error to delete a variable that didn't exist
+            }
+            var v = this.parseExpression(a[3]);
+            if (v !== undefined) {
+                this.setVariable(a[1], v);
+                return true;
+            }
+            return false;
+        }
+        this.println("invalid assignment:" + sCmd);
+        return false;
+    }
+
+    /**
+     * doList(sAddr, fPrint)
+     *
+     * @this {Debugger8080}
+     * @param {string} sAddr
+     * @param {boolean} [fPrint]
+     * @return {string|null}
+     */
+    doList(sAddr, fPrint)
+    {
+        var sSymbol = null;
+
+        var dbgAddr = this.parseAddr(sAddr, true);
+        if (dbgAddr) {
+            var addr = this.getAddr(dbgAddr);
+            var aSymbol = this.findSymbol(dbgAddr, true);
+            if (aSymbol.length) {
+                var nDelta, sDelta, s;
+                if (aSymbol[0]) {
+                    sDelta = "";
+                    nDelta = dbgAddr.addr - aSymbol[1];
+                    if (nDelta) sDelta = " + " + Str.toHexWord(nDelta);
+                    s = aSymbol[0] + " (" + this.toHexOffset(aSymbol[1]) + ')' + sDelta;
+                    if (fPrint) this.println(s);
+                    sSymbol = s;
+                }
+                if (aSymbol.length > 4 && aSymbol[4]) {
+                    sDelta = "";
+                    nDelta = aSymbol[5] - dbgAddr.addr;
+                    if (nDelta) sDelta = " - " + Str.toHexWord(nDelta);
+                    s = aSymbol[4] + " (" + this.toHexOffset(aSymbol[5]) + ')' + sDelta;
+                    if (fPrint) this.println(s);
+                    if (!sSymbol) sSymbol = s;
+                }
+            } else {
+                if (fPrint) this.println("no symbols");
+            }
+        }
+        return sSymbol;
+    }
+
+    /**
+     * doMessages(asArgs)
+     *
+     * @this {Debugger8080}
+     * @param {Array.<string>} asArgs
+     */
+    doMessages(asArgs)
+    {
+        var m;
+        var fCriteria = null;
+        var sCategory = asArgs[1];
+        if (sCategory == '?') sCategory = undefined;
+
+        if (sCategory !== undefined) {
+            var bitsMessage = 0;
+            if (sCategory == "all") {
+                bitsMessage = (0xffffffff|0) & ~(Messages8080.HALT | Messages8080.KEYS | Messages8080.LOG);
+                sCategory = null;
+            } else if (sCategory == "on") {
+                fCriteria = true;
+                sCategory = null;
+            } else if (sCategory == "off") {
+                fCriteria = false;
+                sCategory = null;
+            } else {
+                /*
+                 * Internally, we use "key" instead of "keys", since the latter is a method on JavasScript objects,
+                 * but externally, we allow the user to specify "keys"; "kbd" is also allowed as shorthand for "keyboard".
+                 */
+                if (sCategory == "keys") sCategory = "key";
+                if (sCategory == "kbd") sCategory = "keyboard";
+                for (m in Messages8080.CATEGORIES) {
+                    if (sCategory == m) {
+                        bitsMessage = Messages8080.CATEGORIES[m];
+                        fCriteria = !!(this.bitsMessage & bitsMessage);
+                        break;
+                    }
+                }
+                if (!bitsMessage) {
+                    this.println("unknown message category: " + sCategory);
+                    return;
+                }
+            }
+            if (bitsMessage) {
+                if (asArgs[2] == "on") {
+                    this.bitsMessage |= bitsMessage;
+                    fCriteria = true;
+                }
+                else if (asArgs[2] == "off") {
+                    this.bitsMessage &= ~bitsMessage;
+                    fCriteria = false;
+                    if (bitsMessage == Messages8080.BUFFER) {
+                        for (var i = 0; i < this.aMessageBuffer.length; i++) {
+                            this.println(this.aMessageBuffer[i]);
+                        }
+                        this.aMessageBuffer = [];
+                    }
+                }
+            }
+        }
+
+        /*
+         * Display those message categories that match the current criteria (on or off)
+         */
+        var n = 0;
+        var sCategories = "";
+        for (m in Messages8080.CATEGORIES) {
+            if (!sCategory || sCategory == m) {
+                var bitMessage = Messages8080.CATEGORIES[m];
+                var fEnabled = !!(this.bitsMessage & bitMessage);
+                if (fCriteria !== null && fCriteria != fEnabled) continue;
+                if (sCategories) sCategories += ',';
+                if (!(++n % 10)) sCategories += "\n\t";     // jshint ignore:line
+                /*
+                 * Internally, we use "key" instead of "keys", since the latter is a method on JavasScript objects,
+                 * but externally, we allow the user to specify "keys".
+                 */
+                if (m == "key") m = "keys";
+                sCategories += m;
+            }
+        }
+
+        if (sCategory === undefined) {
+            this.println("message commands:\n\tm [category] [on|off]\tturn categories on/off");
+        }
+
+        this.println((fCriteria !== null? (fCriteria? "messages on:  " : "messages off: ") : "message categories:\n\t") + (sCategories || "none"));
+
+        this.historyInit();     // call this just in case Messages8080.INT was turned on
+    }
+
+    /**
+     * doOptions(asArgs)
+     *
+     * @this {Debugger8080}
+     * @param {Array.<string>} asArgs
+     */
+    doOptions(asArgs)
+    {
+        switch (asArgs[1]) {
+        case "8080":
+            this.style = Debugger8080.STYLE_8080;
+            break;
+
+        case "8086":
+            this.style = Debugger8080.STYLE_8086;
+            break;
+
+        case "cs":
+            var nCycles;
+            if (asArgs[3] !== undefined) nCycles = +asArgs[3];          // warning: decimal instead of hex conversion
+            switch (asArgs[2]) {
+                case "int":
+                    this.cpu.nCyclesChecksumInterval = nCycles;
+                    break;
+                case "start":
+                    this.cpu.nCyclesChecksumStart = nCycles;
+                    break;
+                case "stop":
+                    this.cpu.nCyclesChecksumStop = nCycles;
+                    break;
+                default:
+                    this.println("unknown cs option");
+                    return;
+            }
+            if (nCycles !== undefined) {
+                this.cpu.resetChecksum();
+            }
+            this.println("checksums " + (this.cpu.flags.checksum? "enabled" : "disabled"));
+            return;
+
+        case "sp":
+            if (asArgs[2] !== undefined) {
+                if (!this.cpu.setSpeed(+asArgs[2])) {
+                    this.println("warning: using 1x multiplier, previous target not reached");
+                }
+            }
+            this.println("target speed: " + this.cpu.getSpeedTarget() + " (" + this.cpu.getSpeed() + "x)");
+            return;
+
+        case "?":
+            this.println("debugger options:");
+            this.println("\t8080\t\tselect 8080-style mnemonics");
+            this.println("\t8086\t\tselect 8086-style mnemonics");
+            this.println("\tcs int #\tset checksum cycle interval to #");
+            this.println("\tcs start #\tset checksum cycle start count to #");
+            this.println("\tcs stop #\tset checksum cycle stop count to #");
+            this.println("\tsp #\t\tset speed multiplier to #");
+            break;
+
+        default:
+            if (asArgs[1]) {
+                this.println("unknown option: " + asArgs[1]);
+                return;
+            }
+            break;
+        }
+        this.println(this.style + "-style mnemonics enabled");
+    }
+
+    /**
+     * doOutput(sPort, sByte)
+     *
+     * Simulate a 1-byte port output operation.
+     *
+     * @this {Debugger8080}
+     * @param {string|undefined} sPort
+     * @param {string|undefined} sByte (string representation of 1 byte)
+     */
+    doOutput(sPort, sByte)
+    {
+        if (!sPort || sPort == '?') {
+            this.println("output commands:");
+            this.println("\to [p] [b]\twrite byte [b] to port [p]");
+            /*
+             * TODO: Regarding this warning, consider adding an "unchecked" version of
+             * bus.checkPortOutputNotify(), since all Debugger memory accesses are unchecked, too.
+             *
+             * All port I/O handlers ARE aware when the Debugger is calling (addrFrom is undefined),
+             * but changing them all to be non-destructive would take time, and situations where you
+             * actually want to affect the hardware state are just as likely as not....
+             */
+            this.println("warning: port accesses can affect hardware state");
+            return;
+        }
+        var port = this.parseValue(sPort, "port #");
+        var bOut = this.parseValue(sByte);
+        if (port !== undefined && bOut !== undefined) {
+            this.bus.checkPortOutputNotify(port, 1, bOut);
+            this.println(Str.toHexWord(port) + ": " + Str.toHexByte(bOut));
+        }
+    }
+
+    /**
+     * doRegisters(asArgs, fInstruction)
+     *
+     * @this {Debugger8080}
+     * @param {Array.<string>} [asArgs]
+     * @param {boolean} [fInstruction] (true to include the current instruction; default is true)
+     */
+    doRegisters(asArgs, fInstruction)
+    {
+        if (asArgs && asArgs[1] == '?') {
+            this.println("register commands:");
+            this.println("\tr\tdump registers");
+            this.println("\trx [#]\tset flag or register x to [#]");
+            return;
+        }
+
+        var cpu = this.cpu;
+        if (fInstruction == null) fInstruction = true;
+
+        if (asArgs != null && asArgs.length > 1) {
+            var sReg = asArgs[1];
+            var sValue = null;
+            var i = sReg.indexOf('=');
+            if (i > 0) {
+                sValue = sReg.substr(i + 1);
+                sReg = sReg.substr(0, i);
+            }
+            else if (asArgs.length > 2) {
+                sValue = asArgs[2];
+            }
+            else {
+                this.println("missing value for " + asArgs[1]);
+                return;
+            }
+
+            var w = this.parseExpression(sValue);
+            if (w === undefined) return;
+
+            var sRegMatch = sReg.toUpperCase();
+            switch (sRegMatch) {
+            case "A":
+                cpu.regA = w & 0xff;
+                break;
+            case "B":
+                cpu.regB = w & 0xff;
+                break;
+            case "BC":
+                cpu.regB = ((w >> 8) & 0xff);
+                /* falls through */
+            case "C":
+                cpu.regC = w & 0xff;
+                break;
+            case "D":
+                cpu.regD = w & 0xff;
+                break;
+            case "DE":
+                cpu.regD = ((w >> 8) & 0xff);
+                /* falls through */
+            case "E":
+                cpu.regE = w & 0xff;
+                break;
+            case "H":
+                cpu.regH = w & 0xff;
+                break;
+            case "HL":
+                cpu.regH = ((w >> 8) & 0xff);
+                /* falls through */
+            case "L":
+                cpu.regL = w & 0xff;
+                break;
+            case "SP":
+                cpu.setSP(w);
+                break;
+            case "PC":
+                cpu.setPC(w);
+                this.dbgAddrNextCode = this.newAddr(cpu.getPC());
+                break;
+            case "PS":
+                cpu.setPS(w);
+                break;
+            case "PSW":
+                cpu.setPSW(w);
+                break;
+            case "CF":
+                if (w) cpu.setCF(); else cpu.clearCF();
+                break;
+            case "PF":
+                if (w) cpu.setPF(); else cpu.clearPF();
+                break;
+            case "AF":
+                if (w) cpu.setAF(); else cpu.clearAF();
+                break;
+            case "ZF":
+                if (w) cpu.setZF(); else cpu.clearZF();
+                break;
+            case "SF":
+                if (w) cpu.setSF(); else cpu.clearSF();
+                break;
+            case "IF":
+                if (w) cpu.setIF(); else cpu.clearIF();
+                break;
+            default:
+                this.println("unknown register: " + sReg);
+                return;
+            }
+            cpu.updateCPU();
+            this.println("updated registers:");
+        }
+
+        this.println(this.getRegDump());
+
+        if (fInstruction) {
+            this.dbgAddrNextCode = this.newAddr(cpu.getPC());
+            this.doUnassemble(this.toHexAddr(this.dbgAddrNextCode));
+        }
+    }
+
+    /**
+     * doRun(sCmd, sAddr, sOptions, fQuiet)
+     *
+     * @this {Debugger8080}
+     * @param {string} sCmd
+     * @param {string|undefined} [sAddr]
+     * @param {string} [sOptions] (the rest of the breakpoint command-line)
+     * @param {boolean} [fQuiet]
+     */
+    doRun(sCmd, sAddr, sOptions, fQuiet)
+    {
+        if (sCmd == "gt") {
+            this.fIgnoreNextCheckFault = true;
+        }
+        if (sAddr !== undefined) {
+            var dbgAddr = this.parseAddr(sAddr, true);
+            if (!dbgAddr) return;
+            this.parseAddrOptions(dbgAddr, sOptions);
+            this.setTempBreakpoint(dbgAddr);
+        }
+        if (!this.runCPU(true)) {
+            if (!fQuiet) this.println("cpu busy or unavailable, run command ignored");
+        }
+    }
+
+    /**
+     * doPrint(sCmd)
+     *
+     * NOTE: If the string to print is a quoted string, then we run it through replaceRegs(), so that
+     * you can take advantage of all the special replacement options used for software interrupt logging.
+     *
+     * @this {Debugger8080}
+     * @param {string} sCmd
+     */
+    doPrint(sCmd)
+    {
+        sCmd = Str.trim(sCmd);
+        var a = sCmd.match(/^(['"])(.*?)\1$/);
+        if (!a) {
+            this.parseExpression(sCmd, false);
+        } else {
+            this.println(this.replaceRegs(a[2]));
+        }
+    }
+
+    /**
+     * doStep(sCmd)
+     *
+     * @this {Debugger8080}
+     * @param {string} [sCmd] "p" or "pr"
+     */
+    doStep(sCmd)
+    {
+        var fCallStep = true;
+        var fRegs = (sCmd == "pr"? 1 : 0);
+        /*
+         * Set up the value for this.nStep (ie, 1 or 2) depending on whether the user wants
+         * a subsequent register dump ("pr") or not ("p").
+         */
+        var nStep = 1 + fRegs;
+        if (!this.nStep) {
+            var dbgAddr = this.newAddr(this.cpu.getPC());
+            var bOpcode = this.getByte(dbgAddr);
+
+            switch (bOpcode) {
+            case CPUDef8080.OPCODE.CALL:
+                if (fCallStep) {
+                    this.nStep = nStep;
+                    this.incAddr(dbgAddr, 3);
+                }
+                break;
+            default:
+                break;
+            }
+
+            if (this.nStep) {
+                this.setTempBreakpoint(dbgAddr);
+                if (!this.runCPU()) {
+                    if (this.cmp) this.cmp.updateFocus();
+                    this.nStep = 0;
+                }
+                /*
+                 * A successful run will ultimately call stop(), which will in turn call clearTempBreakpoint(),
+                 * which will clear nStep, so there's your assurance that nStep will be reset.  Now we may have
+                 * stopped for reasons unrelated to the temporary breakpoint, but that's OK.
+                 */
+            } else {
+                this.doTrace(fRegs? "tr" : "t");
+            }
+        } else {
+            this.println("step in progress");
+        }
+    }
+
+    /**
+     * getCall(dbgAddr)
+     *
+     * Given a possible return address (typically from the stack), look for a matching CALL (or INT) that
+     * immediately precedes that address.
+     *
+     * @this {Debugger8080}
+     * @param {DbgAddr8080} dbgAddr
+     * @return {string|null} CALL instruction at or near dbgAddr, or null if none
+     */
+    getCall(dbgAddr)
+    {
+        var sCall = null;
+        var addr = dbgAddr.addr;
+        var addrOrig = addr;
+        for (var n = 1; n <= 6 && !!addr; n++) {
+            if (n > 2) {
+                dbgAddr.addr = addr;
+                var s = this.getInstruction(dbgAddr);
+                if (s.indexOf("CALL") >= 0) {
+                    /*
+                     * Verify that the length of this CALL (or INT), when added to the address of the CALL (or INT),
+                     * matches the original return address.  We do this by getting the string index of the opcode bytes,
+                     * subtracting that from the string index of the next space, and dividing that difference by two,
+                     * to yield the length of the CALL (or INT) instruction, in bytes.
+                     */
+                    var i = s.indexOf(' ');
+                    var j = s.indexOf(' ', i+1);
+                    if (addr + (j - i - 1)/2 == addrOrig) {
+                        sCall = s;
+                        break;
+                    }
+                }
+            }
+            addr--;
+        }
+        dbgAddr.addr = addrOrig;
+        return sCall;
+    }
+
+    /**
+     * doStackTrace(sCmd, sAddr)
+     *
+     * Use "k" for a normal stack trace and "ks" for a stack trace with symbolic info.
+     *
+     * @this {Debugger8080}
+     * @param {string} [sCmd]
+     * @param {string} [sAddr] (not used yet)
+     */
+    doStackTrace(sCmd, sAddr)
+    {
+        if (sAddr == '?') {
+            this.println("stack trace commands:");
+            this.println("\tk\tshow frame addresses");
+            this.println("\tks\tshow symbol information");
+            return;
+        }
+
+        var nFrames = 10, cFrames = 0;
+        var dbgAddrCall = this.newAddr();
+        var dbgAddrStack = this.newAddr(this.cpu.getSP());
+        this.println("stack trace for " + this.toHexAddr(dbgAddrStack));
+
+        while (cFrames < nFrames) {
+            var sCall = null, sCallPrev = null, cTests = 256;
+            while ((dbgAddrStack.addr >>> 0) < 0x10000) {
+                dbgAddrCall.addr = this.getWord(dbgAddrStack, true);
+                /*
+                 * Because we're using the auto-increment feature of getWord(), and because that will automatically
+                 * wrap the offset around the end of the segment, we must also check the addr property to detect the wrap.
+                 */
+                if (dbgAddrStack.addr == null || !cTests--) break;
+                sCall = this.getCall(dbgAddrCall);
+                if (sCall) break;
+            }
+            /*
+             * The sCallPrev check eliminates duplicate sequential calls, which are usually (but not always)
+             * indicative of a false positive, in which case the previous call is probably bogus as well, but
+             * at least we won't duplicate that mistake.  Of course, there are always exceptions, recursion
+             * being one of them, but it's rare that we're debugging recursive code.
+             */
+            if (!sCall || sCall == sCallPrev) break;
+            var sSymbol = null;
+            if (sCmd == "ks") {
+                var a = sCall.match(/[0-9A-F]+$/);
+                if (a) sSymbol = this.doList(a[0]);
+            }
+            sCall = Str.pad(sCall, 50) + "  ;" + (sSymbol || "stack=" + this.toHexAddr(dbgAddrStack)); // + " return=" + this.toHexAddr(dbgAddrCall));
+            this.println(sCall);
+            sCallPrev = sCall;
+            cFrames++;
+        }
+        if (!cFrames) this.println("no return addresses found");
+    }
+
+    /**
+     * doTrace(sCmd, sCount)
+     *
+     * The "t" and "tr" commands interpret the count as a number of instructions, and since
+     * we call the Debugger's stepCPU() for each iteration, a single instruction includes
+     * any/all prefixes; the CPU's stepCPU() treats prefixes as discrete operations.  The only
+     * difference between "t" and "tr": the former displays only the next instruction, while
+     * the latter also displays the (updated) registers.
+     *
+     * The "tc" command interprets the count as a number of cycles rather than instructions,
+     * allowing you to quickly execute large chunks of instructions with a single command; it
+     * doesn't display anything until the the chunk has finished.
+     *
+     * However, generally a more useful command is "bn", which allows you to break after some
+     * number of instructions have been executed (as opposed to some number of cycles).
+     *
+     * @this {Debugger8080}
+     * @param {string} [sCmd] ("t", "tc", or "tr")
+     * @param {string} [sCount] # of instructions to step
+     */
+    doTrace(sCmd, sCount)
+    {
+        var dbg = this;
+        var fRegs = (sCmd != "t");
+        var nCount = this.parseValue(sCount, null, true) || 1;
+        var nCycles = (nCount == 1? 0 : 1);
+        if (sCmd == "tc") {
+            nCycles = nCount;
+            nCount = 1;
+        }
+        Web.onCountRepeat(
+            nCount,
+            function onCountStep() {
+                return dbg.setBusy(true) && dbg.stepCPU(nCycles, fRegs, false);
+            },
+            function onCountStepComplete() {
+                /*
+                 * We explicitly called stepCPU() with fUpdateCPU === false, because repeatedly
+                 * calling updateCPU() can be very slow, especially when fDisplayLiveRegs is true,
+                 * so once the repeat count has been exhausted, we must perform a final updateCPU().
+                 */
+                dbg.cpu.updateCPU();
+                dbg.setBusy(false);
+            }
+        );
+    }
+
+    /**
+     * doUnassemble(sAddr, sAddrEnd, n)
+     *
+     * @this {Debugger8080}
+     * @param {string} [sAddr]
+     * @param {string} [sAddrEnd]
+     * @param {number} [n]
+     */
+    doUnassemble(sAddr, sAddrEnd, n)
+    {
+        var dbgAddr = this.parseAddr(sAddr, true);
+        if (!dbgAddr) return;
+
+        if (n === undefined) n = 1;
+
+        var cb = 0x100;
+        if (sAddrEnd !== undefined) {
+
+            var dbgAddrEnd = this.parseAddr(sAddrEnd, true);
+            if (!dbgAddrEnd || dbgAddrEnd.addr < dbgAddr.addr) return;
+
+            cb = dbgAddrEnd.addr - dbgAddr.addr;
+            if (!DEBUG && cb > 0x100) {
+                /*
+                 * Limiting the amount of disassembled code to 256 bytes in non-DEBUG builds is partly to
+                 * prevent the user from wedging the browser by dumping too many lines, but also a recognition
+                 * that, in non-DEBUG builds, this.println() keeps print output buffer truncated to 8Kb anyway.
+                 */
+                this.println("range too large");
+                return;
+            }
+            n = -1;
+        }
+
+        var cLines = 0;
+        var sInstruction;
+
+        while (cb > 0 && n--) {
+
+            var nSequence = (this.isBusy(false) || this.nStep)? this.nCycles : null;
+            var sComment = (nSequence != null? "cycles" : null);
+            var aSymbol = this.findSymbol(dbgAddr);
+
+            var addr = dbgAddr.addr;    // we snap dbgAddr.addr *after* calling findSymbol(), which re-evaluates it
+
+            if (aSymbol[0] && n) {
+                if (!cLines && n || aSymbol[0].indexOf('+') < 0) {
+                    var sLabel = aSymbol[0] + ':';
+                    if (aSymbol[2]) sLabel += ' ' + aSymbol[2];
+                    this.println(sLabel);
+                }
+            }
+
+            if (aSymbol[3]) {
+                sComment = aSymbol[3];
+                nSequence = null;
+            }
+
+            sInstruction = this.getInstruction(dbgAddr, sComment, nSequence);
+
+            this.println(sInstruction);
+            this.dbgAddrNextCode = dbgAddr;
+            cb -= dbgAddr.addr - addr;
+            cLines++;
+        }
+    }
+
+    /**
+     * parseCommand(sCmd, fSave, chSep)
+     *
+     * @this {Debugger8080}
+     * @param {string|undefined} sCmd
+     * @param {boolean} [fSave] is true to save the command, false if not
+     * @param {string} [chSep] is the command separator character (default is ';')
+     * @return {Array.<string>}
+     */
+    parseCommand(sCmd, fSave, chSep)
+    {
+        if (fSave) {
+            if (!sCmd) {
+                if (this.fAssemble) {
+                    sCmd = "end";
+                } else {
+                    sCmd = this.aPrevCmds[this.iPrevCmd+1];
+                }
+            } else {
+                if (this.iPrevCmd < 0 && this.aPrevCmds.length) {
+                    this.iPrevCmd = 0;
+                }
+                if (this.iPrevCmd < 0 || sCmd != this.aPrevCmds[this.iPrevCmd]) {
+                    this.aPrevCmds.splice(0, 0, sCmd);
+                    this.iPrevCmd = 0;
+                }
+                this.iPrevCmd--;
+            }
+        }
+        var a = [];
+        if (sCmd) {
+            /*
+             * With the introduction of breakpoint commands (ie, quoted command sequences
+             * associated with a breakpoint), we can no longer perform simplistic splitting.
+             *
+             *      a = sCmd.split(chSep || ';');
+             *      for (var i = 0; i < a.length; i++) a[i] = str.trim(a[i]);
+             *
+             * We may now split on semi-colons ONLY if they are outside a quoted sequence.
+             *
+             * Also, to allow quoted strings *inside* breakpoint commands, we first replace all
+             * DOUBLE double-quotes with single quotes.
+             */
+            sCmd = sCmd.toLowerCase().replace(/""/g, "'");
+
+            var iPrev = 0;
+            var chQuote = null;
+            chSep = chSep || ';';
+            /*
+             * NOTE: Processing charAt() up to and INCLUDING length is not a typo; we're taking
+             * advantage of the fact that charAt() with an invalid index returns an empty string,
+             * allowing us to use the same substring() call to capture the final portion of sCmd.
+             *
+             * In a sense, it allows us to pretend that the string ends with a zero terminator.
+             */
+            for (var i = 0; i <= sCmd.length; i++) {
+                var ch = sCmd.charAt(i);
+                if (ch == '"' || ch == "'") {
+                    if (!chQuote) {
+                        chQuote = ch;
+                    } else if (ch == chQuote) {
+                        chQuote = null;
+                    }
+                }
+                else if (ch == chSep && !chQuote || !ch) {
+                    /*
+                     * Recall that substring() accepts starting (inclusive) and ending (exclusive)
+                     * indexes, whereas substr() accepts a starting index and a length.  We need the former.
+                     */
+                    a.push(Str.trim(sCmd.substring(iPrev, i)));
+                    iPrev = i + 1;
+                }
+            }
+        }
+        return a;
+    }
+
+    /**
+     * shiftArgs(asArgs)
+     *
+     * Used with any command (eg, "r") that allows but doesn't require whitespace between command and first argument.
+     *
+     * @this {Debugger8080}
+     * @param {Array.<string>} asArgs
+     * @return {Array.<string>}
+     */
+    shiftArgs(asArgs)
+    {
+        if (asArgs && asArgs.length) {
+            var s0 = asArgs[0];
+            var ch0 = s0.charAt(0);
+            for (var i = 1; i < s0.length; i++) {
+                var ch = s0.charAt(i);
+                if (ch0 == '?' || ch0 == 'r' || ch < 'a' || ch > 'z') {
+                    asArgs[0] = s0.substr(i);
+                    asArgs.unshift(s0.substr(0, i));
+                    break;
+                }
+            }
+        }
+        return asArgs;
+    }
+
+    /**
+     * doCommand(sCmd, fQuiet)
+     *
+     * @this {Debugger8080}
+     * @param {string} sCmd
+     * @param {boolean} [fQuiet]
+     * @return {boolean} true if command processed, false if unrecognized
+     */
+    doCommand(sCmd, fQuiet)
+    {
+        var result = true;
+
+        try {
+            if (!sCmd.length || sCmd == "end") {
+                if (this.fAssemble) {
+                    this.println("ended assemble at " + this.toHexAddr(this.dbgAddrAssemble));
+                    this.dbgAddrNextCode = this.dbgAddrAssemble;
+                    this.fAssemble = false;
+                }
+                sCmd = "";
+            }
+            else if (!fQuiet) {
+                var sPrompt = ">> ";
+                this.println(sPrompt + sCmd);
+            }
+
+            var ch = sCmd.charAt(0);
+            if (ch == '"' || ch == "'") return true;
+
+            /*
+             * Zap the previous message buffer to ensure the new command's output is not tossed out as a repeat.
+             */
+            this.sMessagePrev = null;
+
+            /*
+             * I've relaxed the !isBusy() requirement, to maximize our ability to issue Debugger commands externally.
+             */
+            if (this.isReady() /* && !this.isBusy(true) */ && sCmd.length > 0) {
+
+                if (this.fAssemble) {
+                    sCmd = "a " + this.toHexAddr(this.dbgAddrAssemble) + ' ' + sCmd;
+                }
+
+                var asArgs = this.shiftArgs(sCmd.replace(/ +/g, ' ').split(' '));
+
+                switch (asArgs[0].charAt(0)) {
+                case 'a':
+                    this.doAssemble(asArgs);
+                    break;
+                case 'b':
+                    this.doBreak(asArgs[0], asArgs[1], sCmd);
+                    break;
+                case 'c':
+                    this.doClear(asArgs[0]);
+                    break;
+                case 'd':
+                    if (!COMPILED && sCmd == "debug") {
+                        window.DEBUG = true;
+                        this.println("DEBUG checks on");
+                        break;
+                    }
+                    this.doDump(asArgs);
+                    break;
+                case 'e':
+                    if (asArgs[0] == "else") break;
+                    this.doEdit(asArgs);
+                    break;
+                case 'f':
+                    this.doFreqs(asArgs[1]);
+                    break;
+                case 'g':
+                    this.doRun(asArgs[0], asArgs[1], sCmd, fQuiet);
+                    break;
+                case 'h':
+                    this.doHalt(fQuiet);
+                    break;
+                case 'i':
+                    if (asArgs[0] == "if") {
+                        if (!this.doIf(sCmd.substr(2), fQuiet)) {
+                            result = false;
+                        }
+                        break;
+                    }
+                    if (asArgs[0] == "int") {
+                        if (!this.doInt(asArgs[1])) {
+                            result = false;
+                        }
+                        break;
+                    }
+                    this.doInput(asArgs[1]);
+                    break;
+                case 'k':
+                    this.doStackTrace(asArgs[0], asArgs[1]);
+                    break;
+                case 'l':
+                    if (asArgs[0] == "ln") {
+                        this.doList(asArgs[1], true);
+                        break;
+                    }
+                    break;
+                case 'm':
+                    this.doMessages(asArgs);
+                    break;
+                case 'o':
+                    this.doOutput(asArgs[1], asArgs[2]);
+                    break;
+                case 'p':
+                    if (asArgs[0] == "print") {
+                        this.doPrint(sCmd.substr(5));
+                        break;
+                    }
+                    this.doStep(asArgs[0]);
+                    break;
+                case 'r':
+                    if (sCmd == "reset") {
+                        if (this.cmp) this.cmp.reset();
+                        break;
+                    }
+                    this.doRegisters(asArgs);
+                    break;
+                case 's':
+                    this.doOptions(asArgs);
+                    break;
+                case 't':
+                    this.doTrace(asArgs[0], asArgs[1]);
+                    break;
+                case 'u':
+                    this.doUnassemble(asArgs[1], asArgs[2], 8);
+                    break;
+                case 'v':
+                    if (asArgs[0] == "var") {
+                        if (!this.doVar(sCmd.substr(3))) {
+                            result = false;
+                        }
+                        break;
+                    }
+                    this.println((PC8080.APPNAME || "PC8080") + " version " + (XMLVERSION || PC8080.APPVERSION) + " (" + this.cpu.model + (PC8080.COMPILED? ",RELEASE" : (PC8080.DEBUG? ",DEBUG" : ",NODEBUG")) + (PC8080.TYPEDARRAYS? ",TYPEDARRAYS" : (PC8080.BYTEARRAYS? ",BYTEARRAYS" : ",LONGARRAYS")) + ')');
+                    this.println(Web.getUserAgent());
+                    break;
+                case '?':
+                    if (asArgs[1]) {
+                        this.doPrint(sCmd.substr(1));
+                        break;
+                    }
+                    this.doHelp();
+                    break;
+                case 'n':
+                    if (!COMPILED && sCmd == "nodebug") {
+                        window.DEBUG = false;
+                        this.println("DEBUG checks off");
+                        break;
+                    }
+                    if (this.doInfo(asArgs)) break;
+                    /* falls through */
+                default:
+                    this.println("unknown command: " + sCmd);
+                    result = false;
+                    break;
+                }
+            }
+        } catch(e) {
+            this.println("debugger error: " + (e.stack || e.message));
+            result = false;
+        }
+        return result;
+    }
+
+    /**
+     * doCommands(sCmds, fSave)
+     *
+     * @this {Debugger8080}
+     * @param {string} sCmds
+     * @param {boolean} [fSave]
+     * @return {boolean} true if all commands processed, false if not
+     */
+    doCommands(sCmds, fSave)
+    {
+        var a = this.parseCommand(sCmds, fSave);
+        for (var s in a) {
+            if (!this.doCommand(a[+s])) return false;
+        }
+        return true;
+    }
+
+    /**
+     * Debugger8080.init()
+     *
+     * This function operates on every HTML element of class "debugger", extracting the
+     * JSON-encoded parameters for the Debugger constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a Debugger component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeDbg = Component.getElementsByClass(document, PC8080.APPCLASS, "debugger");
+        for (var iDbg = 0; iDbg < aeDbg.length; iDbg++) {
+            var eDbg = aeDbg[iDbg];
+            var parmsDbg = Component.getComponentParms(eDbg);
+            var dbg = new Debugger8080(parmsDbg);
+            Component.bindComponentControls(dbg, eDbg, PC8080.APPCLASS);
+        }
+    }
+}
+
+if (DEBUGGER) {
+
+    /*
+     * NOTE: Every Debugger8080 property from here to the first prototype function definition (initBus()) is
+     * considered a "class constant"; most of them use our "all-caps" convention (and all of them SHOULD, but
+     * that wouldn't help us catch any bugs).
+     *
+     * Technically, all of them should ALSO be preceded by a "@const" annotation, but that's a lot of work and it
+     * really clutters the code.  I wish the Closure Compiler had a way to annotate every definition with a given
+     * section with a single annotation....
+     *
+     * Bugs can slip through the cracks without those annotations; for example, I unthinkingly redefined TYPE_SIZE
+     * at one point, and if all the definitions had been preceded by an "@const", that mistake would have been
+     * caught at compile-time.
+     */
+
+    Debugger8080.COMMANDS = {
+        '?':        "help/print",
+        'a [#]':    "assemble",             // TODO: Implement this command someday
+        'b [#]':    "breakpoint",           // multiple variations (use b? to list them)
+        'c':        "clear output",
+        'd [#]':    "dump memory",          // additional syntax: d [#] [l#], where l# is a number of bytes to dump
+        'e [#]':    "edit memory",
+        'f':        "frequencies",
+        'g [#]':    "go [to #]",
+        'h':        "halt",
+        'i [#]':    "input port #",
+        'if':       "eval expression",
+        'int [#]':  "request interrupt",
+        'k':        "stack trace",
+        "ln":       "list nearest symbol(s)",
+        'm':        "messages",
+        'o [#]':    "output port #",
+        'p':        "step over",            // other variations: pr (step and dump registers)
+        'print':    "print expression",
+        'r':        "dump/set registers",
+        'reset':    "reset machine",
+        's':        "set options",
+        't [#]':    "trace",                // other variations: tr (trace and dump registers)
+        'u [#]':    "unassemble",
+        'v':        "print version",
+        'var':      "assign variable"
+    };
+
+    Debugger8080.STYLE_8080 = 8080;
+    Debugger8080.STYLE_8086 = 8086;
+
+    /*
+     * CPU instruction ordinals
+     */
+    Debugger8080.INS = {
+        NONE:   0,  ACI:    1,  ADC:    2,  ADD:    3,  ADI:    4,  ANA:    5,  ANI:    6,  CALL:   7,
+        CC:     8,  CM:     9,  CNC:   10,  CNZ:   11,  CP:    12,  CPE:   13,  CPO:   14,  CZ:    15,
+        CMA:   16,  CMC:   17,  CMP:   18,  CPI:   19,  DAA:   20,  DAD:   21,  DCR:   22,  DCX:   23,
+        DI:    24,  EI:    25,  HLT:   26,  IN:    27,  INR:   28,  INX:   29,  JMP:   30,  JC:    31,
+        JM:    32,  JNC:   33,  JNZ:   34,  JP:    35,  JPE:   36,  JPO:   37,  JZ:    38,  LDA:   39,
+        LDAX:  40,  LHLD:  41,  LXI:   42,  MOV:   43,  MVI:   44,  NOP:   45,  ORA:   46,  ORI:   47,
+        OUT:   48,  PCHL:  49,  POP:   50,  PUSH:  51,  RAL:   52,  RAR:   53,  RET:   54,  RC:    55,
+        RM:    56,  RNC:   57,  RNZ:   58,  RP:    59,  RPE:   60,  RPO:   61,  RZ:    62,  RLC:   63,
+        RRC:   64,  RST:   65,  SBB:   66,  SBI:   67,  SHLD:  68,  SPHL:  69,  STA:   70,  STAX:  71,
+        STC:   72,  SUB:   73,  SUI:   74,  XCHG:  75,  XRA:   76,  XRI:   77,  XTHL:  78
+    };
+
+    /*
+     * CPU instruction names (mnemonics), indexed by CPU instruction ordinal (above)
+     *
+     * If you change the default style, using the "s" command (eg, "s 8086"), then the 8086 table
+     * will be used instead.  TODO: Add a "s z80" command for Z80-style mnemonics.
+     */
+    Debugger8080.INS_NAMES = [
+        "NONE",     "ACI",      "ADC",      "ADD",      "ADI",      "ANA",      "ANI",      "CALL",
+        "CC",       "CM",       "CNC",      "CNZ",      "CP",       "CPE",      "CPO",      "CZ",
+        "CMA",      "CMC",      "CMP",      "CPI",      "DAA",      "DAD",      "DCR",      "DCX",
+        "DI",       "EI",       "HLT",      "IN",       "INR",      "INX",      "JMP",      "JC",
+        "JM",       "JNC",      "JNZ",      "JP",       "JPE",      "JPO",      "JZ",       "LDA",
+        "LDAX",     "LHLD",     "LXI",      "MOV",      "MVI",      "NOP",      "ORA",      "ORI",
+        "OUT",      "PCHL",     "POP",      "PUSH",     "RAL",      "RAR",      "RET",      "RC",
+        "RM",       "RNC",      "RNZ",      "RP",       "RPE",      "RPO",      "RZ",       "RLC",
+        "RRC",      "RST",      "SBB",      "SBI",      "SHLD",     "SPHL",     "STA",      "STAX",
+        "STC",      "SUB",      "SUI",      "XCHG",     "XRA",      "XRI",      "XTHL"
+    ];
+
+    Debugger8080.INS_NAMES_8086 = [
+        "NONE",     "ADC",      "ADC",      "ADD",      "ADD",      "AND",      "AND",      "CALL",
+        "CALLC",    "CALLS",    "CALLNC",   "CALLNZ",   "CALLNS",   "CALLP",    "CALLNP",   "CALLZ",
+        "NOT",      "CMC",      "CMP",      "CMP",      "DAA",      "ADD",      "DEC",      "DEC",
+        "CLI",      "STI",      "HLT",      "IN",       "INC",      "INC",      "JMP",      "JC",
+        "JS",       "JNC",      "JNZ",      "JNS",      "JP",       "JNP",      "JZ",       "MOV",
+        "MOV",      "MOV",      "MOV",      "MOV",      "MOV",      "NOP",      "OR",       "OR",
+        "OUT",      "JMP",      "POP",      "PUSH",     "RCL",      "RCR",      "RET",      "RETC",
+        "RETS",     "RETNC",    "RETNZ",    "RETNS",    "RETP",     "RETNP",    "RETZ",     "ROL",
+        "ROR",      "RST",      "SBB",      "SBB",      "MOV",      "MOV",      "MOV",      "MOV",
+        "STC",      "SUB",      "SUB",      "XCHG",     "XOR",      "XOR",      "XCHG"
+    ];
+
+    Debugger8080.REG_B      = 0x00;
+    Debugger8080.REG_C      = 0x01;
+    Debugger8080.REG_D      = 0x02;
+    Debugger8080.REG_E      = 0x03;
+    Debugger8080.REG_H      = 0x04;
+    Debugger8080.REG_L      = 0x05;
+    Debugger8080.REG_M      = 0x06;
+    Debugger8080.REG_A      = 0x07;
+    Debugger8080.REG_BC     = 0x08;
+    Debugger8080.REG_DE     = 0x09;
+    Debugger8080.REG_HL     = 0x0A;
+    Debugger8080.REG_SP     = 0x0B;
+    Debugger8080.REG_PC     = 0x0C;
+    Debugger8080.REG_PS     = 0x0D;
+    Debugger8080.REG_PSW    = 0x0E;         // aka AF if Z80-style mnemonics
+
+    /*
+     * NOTE: "PS" is the complete processor status, which includes bits like the Interrupt flag (IF),
+     * which is NOT the same as "PSW", which is the low 8 bits of "PS" combined with "A" in the high byte.
+     */
+    Debugger8080.REGS = [
+        "B", "C", "D", "E", "H", "L", "M", "A", "BC", "DE", "HL", "SP", "PC", "PS", "PSW"
+    ];
+
+    /*
+     * Operand type descriptor masks and definitions
+     */
+    Debugger8080.TYPE_SIZE  = 0x000F;       // size field
+    Debugger8080.TYPE_MODE  = 0x00F0;       // mode field
+    Debugger8080.TYPE_IREG  = 0x0F00;       // implied register field
+    Debugger8080.TYPE_OTHER = 0xF000;       // "other" field
+
+    /*
+     * TYPE_SIZE values
+     */
+    Debugger8080.TYPE_NONE  = 0x0000;       // (all other TYPE fields ignored)
+    Debugger8080.TYPE_BYTE  = 0x0001;       // byte, regardless of operand size
+    Debugger8080.TYPE_SBYTE = 0x0002;       // byte sign-extended to word
+    Debugger8080.TYPE_WORD  = 0x0003;       // word (16-bit value)
+
+    /*
+     * TYPE_MODE values
+     */
+    Debugger8080.TYPE_REG   = 0x0010;       // register
+    Debugger8080.TYPE_IMM   = 0x0020;       // immediate data
+    Debugger8080.TYPE_ADDR  = 0x0033;       // immediate (word) address
+    Debugger8080.TYPE_MEM   = 0x0040;       // memory reference
+    Debugger8080.TYPE_INT   = 0x0080;       // interrupt level encoded in instruction (bits 3-5)
+
+    /*
+     * TYPE_IREG values, based on the REG_* constants.
+     *
+     * Note that TYPE_M isn't really a register, just an alternative form of TYPE_HL | TYPE_MEM.
+     */
+    Debugger8080.TYPE_A     = (Debugger8080.REG_A  << 8 | Debugger8080.TYPE_REG | Debugger8080.TYPE_BYTE);
+    Debugger8080.TYPE_B     = (Debugger8080.REG_B  << 8 | Debugger8080.TYPE_REG | Debugger8080.TYPE_BYTE);
+    Debugger8080.TYPE_C     = (Debugger8080.REG_C  << 8 | Debugger8080.TYPE_REG | Debugger8080.TYPE_BYTE);
+    Debugger8080.TYPE_D     = (Debugger8080.REG_D  << 8 | Debugger8080.TYPE_REG | Debugger8080.TYPE_BYTE);
+    Debugger8080.TYPE_E     = (Debugger8080.REG_E  << 8 | Debugger8080.TYPE_REG | Debugger8080.TYPE_BYTE);
+    Debugger8080.TYPE_H     = (Debugger8080.REG_H  << 8 | Debugger8080.TYPE_REG | Debugger8080.TYPE_BYTE);
+    Debugger8080.TYPE_L     = (Debugger8080.REG_L  << 8 | Debugger8080.TYPE_REG | Debugger8080.TYPE_BYTE);
+    Debugger8080.TYPE_M     = (Debugger8080.REG_M  << 8 | Debugger8080.TYPE_REG | Debugger8080.TYPE_BYTE | Debugger8080.TYPE_MEM);
+    Debugger8080.TYPE_BC    = (Debugger8080.REG_BC << 8 | Debugger8080.TYPE_REG | Debugger8080.TYPE_WORD);
+    Debugger8080.TYPE_DE    = (Debugger8080.REG_DE << 8 | Debugger8080.TYPE_REG | Debugger8080.TYPE_WORD);
+    Debugger8080.TYPE_HL    = (Debugger8080.REG_HL << 8 | Debugger8080.TYPE_REG | Debugger8080.TYPE_WORD);
+    Debugger8080.TYPE_SP    = (Debugger8080.REG_SP << 8 | Debugger8080.TYPE_REG | Debugger8080.TYPE_WORD);
+    Debugger8080.TYPE_PC    = (Debugger8080.REG_PC << 8 | Debugger8080.TYPE_REG | Debugger8080.TYPE_WORD);
+    Debugger8080.TYPE_PSW   = (Debugger8080.REG_PSW<< 8 | Debugger8080.TYPE_REG | Debugger8080.TYPE_WORD);
+
+    /*
+     * TYPE_OTHER bit definitions
+     */
+    Debugger8080.TYPE_IN    = 0x1000;       // operand is input
+    Debugger8080.TYPE_OUT   = 0x2000;       // operand is output
+    Debugger8080.TYPE_BOTH  = (Debugger8080.TYPE_IN | Debugger8080.TYPE_OUT);
+    Debugger8080.TYPE_OPT   = 0x4000;       // optional operand (ie, normally omitted in 8080 assembly language)
+    Debugger8080.TYPE_UNDOC = 0x8000;       // opcode is an undocumented alternative encoding
+
+    /*
+     * The aaOpDescs array is indexed by opcode, and each element is a sub-array (aOpDesc) that describes
+     * the corresponding opcode. The sub-elements are as follows:
+     *
+     *      [0]: {number} of the opcode name (see INS.*)
+     *      [1]: {number} containing the destination operand descriptor bit(s), if any
+     *      [2]: {number} containing the source operand descriptor bit(s), if any
+     *      [3]: {number} containing the occasional third operand descriptor bit(s), if any
+     *
+     * These sub-elements are all optional. If [0] is not present, the opcode is undefined; if [1] is not
+     * present (or contains zero), the opcode has no (or only implied) operands; if [2] is not present, the
+     * opcode has only a single operand.  And so on.
+     *
+     * Additional default rules:
+     *
+     *      1) If no TYPE_OTHER bits are specified for the first (destination) operand, TYPE_OUT is assumed;
+     *      2) If no TYPE_OTHER bits are specified for the second (source) operand, TYPE_IN is assumed;
+     *      3) If no size is specified for the second operand, the size is assumed to match the first operand.
+     */
+    Debugger8080.aaOpDescs = [
+    /* 0x00 */  [Debugger8080.INS.NOP],
+    /* 0x01 */  [Debugger8080.INS.LXI,   Debugger8080.TYPE_BC,    Debugger8080.TYPE_IMM],
+    /* 0x02 */  [Debugger8080.INS.STAX,  Debugger8080.TYPE_BC   | Debugger8080.TYPE_MEM, Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT],
+    /* 0x03 */  [Debugger8080.INS.INX,   Debugger8080.TYPE_BC],
+    /* 0x04 */  [Debugger8080.INS.INR,   Debugger8080.TYPE_B],
+    /* 0x05 */  [Debugger8080.INS.DCR,   Debugger8080.TYPE_B],
+    /* 0x06 */  [Debugger8080.INS.MVI,   Debugger8080.TYPE_B,     Debugger8080.TYPE_IMM],
+    /* 0x07 */  [Debugger8080.INS.RLC],
+    /* 0x08 */  [Debugger8080.INS.NOP,   Debugger8080.TYPE_UNDOC],
+    /* 0x09 */  [Debugger8080.INS.DAD,   Debugger8080.TYPE_HL   | Debugger8080.TYPE_OPT, Debugger8080.TYPE_BC],
+    /* 0x0A */  [Debugger8080.INS.LDAX,  Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_BC   | Debugger8080.TYPE_MEM],
+    /* 0x0B */  [Debugger8080.INS.DCX,   Debugger8080.TYPE_BC],
+    /* 0x0C */  [Debugger8080.INS.INR,   Debugger8080.TYPE_C],
+    /* 0x0D */  [Debugger8080.INS.DCR,   Debugger8080.TYPE_C],
+    /* 0x0E */  [Debugger8080.INS.MVI,   Debugger8080.TYPE_C,     Debugger8080.TYPE_IMM],
+    /* 0x0F */  [Debugger8080.INS.RRC],
+    /* 0x10 */  [Debugger8080.INS.NOP,   Debugger8080.TYPE_UNDOC],
+    /* 0x11 */  [Debugger8080.INS.LXI,   Debugger8080.TYPE_DE,    Debugger8080.TYPE_IMM],
+    /* 0x12 */  [Debugger8080.INS.STAX,  Debugger8080.TYPE_DE   | Debugger8080.TYPE_MEM, Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT],
+    /* 0x13 */  [Debugger8080.INS.INX,   Debugger8080.TYPE_DE],
+    /* 0x14 */  [Debugger8080.INS.INR,   Debugger8080.TYPE_D],
+    /* 0x15 */  [Debugger8080.INS.DCR,   Debugger8080.TYPE_D],
+    /* 0x16 */  [Debugger8080.INS.MVI,   Debugger8080.TYPE_D,     Debugger8080.TYPE_IMM],
+    /* 0x17 */  [Debugger8080.INS.RAL],
+    /* 0x18 */  [Debugger8080.INS.NOP,   Debugger8080.TYPE_UNDOC],
+    /* 0x19 */  [Debugger8080.INS.DAD,   Debugger8080.TYPE_HL   | Debugger8080.TYPE_OPT, Debugger8080.TYPE_DE],
+    /* 0x1A */  [Debugger8080.INS.LDAX,  Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_DE   | Debugger8080.TYPE_MEM],
+    /* 0x1B */  [Debugger8080.INS.DCX,   Debugger8080.TYPE_DE],
+    /* 0x1C */  [Debugger8080.INS.INR,   Debugger8080.TYPE_E],
+    /* 0x1D */  [Debugger8080.INS.DCR,   Debugger8080.TYPE_E],
+    /* 0x1E */  [Debugger8080.INS.MVI,   Debugger8080.TYPE_E,     Debugger8080.TYPE_IMM],
+    /* 0x1F */  [Debugger8080.INS.RAR],
+    /* 0x20 */  [Debugger8080.INS.NOP,   Debugger8080.TYPE_UNDOC],
+    /* 0x21 */  [Debugger8080.INS.LXI,   Debugger8080.TYPE_HL,    Debugger8080.TYPE_IMM],
+    /* 0x22 */  [Debugger8080.INS.SHLD,  Debugger8080.TYPE_ADDR | Debugger8080.TYPE_MEM, Debugger8080.TYPE_HL   | Debugger8080.TYPE_OPT],
+    /* 0x23 */  [Debugger8080.INS.INX,   Debugger8080.TYPE_HL],
+    /* 0x24 */  [Debugger8080.INS.INR,   Debugger8080.TYPE_H],
+    /* 0x25 */  [Debugger8080.INS.DCR,   Debugger8080.TYPE_H],
+    /* 0x26 */  [Debugger8080.INS.MVI,   Debugger8080.TYPE_H,     Debugger8080.TYPE_IMM],
+    /* 0x27 */  [Debugger8080.INS.DAA],
+    /* 0x28 */  [Debugger8080.INS.NOP,   Debugger8080.TYPE_UNDOC],
+    /* 0x29 */  [Debugger8080.INS.DAD,   Debugger8080.TYPE_HL   | Debugger8080.TYPE_OPT, Debugger8080.TYPE_HL],
+    /* 0x2A */  [Debugger8080.INS.LHLD,  Debugger8080.TYPE_HL   | Debugger8080.TYPE_OPT, Debugger8080.TYPE_ADDR | Debugger8080.TYPE_MEM],
+    /* 0x2B */  [Debugger8080.INS.DCX,   Debugger8080.TYPE_HL],
+    /* 0x2C */  [Debugger8080.INS.INR,   Debugger8080.TYPE_L],
+    /* 0x2D */  [Debugger8080.INS.DCR,   Debugger8080.TYPE_L],
+    /* 0x2E */  [Debugger8080.INS.MVI,   Debugger8080.TYPE_L,     Debugger8080.TYPE_IMM],
+    /* 0x2F */  [Debugger8080.INS.CMA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT],
+    /* 0x30 */  [Debugger8080.INS.NOP,   Debugger8080.TYPE_UNDOC],
+    /* 0x31 */  [Debugger8080.INS.LXI,   Debugger8080.TYPE_SP,    Debugger8080.TYPE_IMM],
+    /* 0x32 */  [Debugger8080.INS.STA,   Debugger8080.TYPE_ADDR | Debugger8080.TYPE_MEM, Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT],
+    /* 0x33 */  [Debugger8080.INS.INX,   Debugger8080.TYPE_SP],
+    /* 0x34 */  [Debugger8080.INS.INR,   Debugger8080.TYPE_M],
+    /* 0x35 */  [Debugger8080.INS.DCR,   Debugger8080.TYPE_M],
+    /* 0x36 */  [Debugger8080.INS.MVI,   Debugger8080.TYPE_M,     Debugger8080.TYPE_IMM],
+    /* 0x37 */  [Debugger8080.INS.STC],
+    /* 0x38 */  [Debugger8080.INS.NOP,   Debugger8080.TYPE_UNDOC],
+    /* 0x39 */  [Debugger8080.INS.DAD,   Debugger8080.TYPE_HL   | Debugger8080.TYPE_OPT, Debugger8080.TYPE_SP],
+    /* 0x3A */  [Debugger8080.INS.LDA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_ADDR | Debugger8080.TYPE_MEM],
+    /* 0x3B */  [Debugger8080.INS.DCX,   Debugger8080.TYPE_SP],
+    /* 0x3C */  [Debugger8080.INS.INR,   Debugger8080.TYPE_A],
+    /* 0x3D */  [Debugger8080.INS.DCR,   Debugger8080.TYPE_A],
+    /* 0x3E */  [Debugger8080.INS.MVI,   Debugger8080.TYPE_A,     Debugger8080.TYPE_IMM],
+    /* 0x3F */  [Debugger8080.INS.CMC],
+    /* 0x40 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_B,     Debugger8080.TYPE_B],
+    /* 0x41 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_B,     Debugger8080.TYPE_C],
+    /* 0x42 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_B,     Debugger8080.TYPE_D],
+    /* 0x43 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_B,     Debugger8080.TYPE_E],
+    /* 0x44 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_B,     Debugger8080.TYPE_H],
+    /* 0x45 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_B,     Debugger8080.TYPE_L],
+    /* 0x46 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_B,     Debugger8080.TYPE_M],
+    /* 0x47 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_B,     Debugger8080.TYPE_A],
+    /* 0x48 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_C,     Debugger8080.TYPE_B],
+    /* 0x49 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_C,     Debugger8080.TYPE_C],
+    /* 0x4A */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_C,     Debugger8080.TYPE_D],
+    /* 0x4B */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_C,     Debugger8080.TYPE_E],
+    /* 0x4C */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_C,     Debugger8080.TYPE_H],
+    /* 0x4D */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_C,     Debugger8080.TYPE_L],
+    /* 0x4E */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_C,     Debugger8080.TYPE_M],
+    /* 0x4F */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_C,     Debugger8080.TYPE_A],
+    /* 0x50 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_D,     Debugger8080.TYPE_B],
+    /* 0x51 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_D,     Debugger8080.TYPE_C],
+    /* 0x52 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_D,     Debugger8080.TYPE_D],
+    /* 0x53 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_D,     Debugger8080.TYPE_E],
+    /* 0x54 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_D,     Debugger8080.TYPE_H],
+    /* 0x55 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_D,     Debugger8080.TYPE_L],
+    /* 0x56 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_D,     Debugger8080.TYPE_M],
+    /* 0x57 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_D,     Debugger8080.TYPE_A],
+    /* 0x58 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_E,     Debugger8080.TYPE_B],
+    /* 0x59 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_E,     Debugger8080.TYPE_C],
+    /* 0x5A */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_E,     Debugger8080.TYPE_D],
+    /* 0x5B */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_E,     Debugger8080.TYPE_E],
+    /* 0x5C */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_E,     Debugger8080.TYPE_H],
+    /* 0x5D */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_E,     Debugger8080.TYPE_L],
+    /* 0x5E */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_E,     Debugger8080.TYPE_M],
+    /* 0x5F */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_E,     Debugger8080.TYPE_A],
+    /* 0x60 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_H,     Debugger8080.TYPE_B],
+    /* 0x61 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_H,     Debugger8080.TYPE_C],
+    /* 0x62 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_H,     Debugger8080.TYPE_D],
+    /* 0x63 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_H,     Debugger8080.TYPE_E],
+    /* 0x64 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_H,     Debugger8080.TYPE_H],
+    /* 0x65 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_H,     Debugger8080.TYPE_L],
+    /* 0x66 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_H,     Debugger8080.TYPE_M],
+    /* 0x67 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_H,     Debugger8080.TYPE_A],
+    /* 0x68 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_L,     Debugger8080.TYPE_B],
+    /* 0x69 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_L,     Debugger8080.TYPE_C],
+    /* 0x6A */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_L,     Debugger8080.TYPE_D],
+    /* 0x6B */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_L,     Debugger8080.TYPE_E],
+    /* 0x6C */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_L,     Debugger8080.TYPE_H],
+    /* 0x6D */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_L,     Debugger8080.TYPE_L],
+    /* 0x6E */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_L,     Debugger8080.TYPE_M],
+    /* 0x6F */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_L,     Debugger8080.TYPE_A],
+    /* 0x70 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_M,     Debugger8080.TYPE_B],
+    /* 0x71 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_M,     Debugger8080.TYPE_C],
+    /* 0x72 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_M,     Debugger8080.TYPE_D],
+    /* 0x73 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_M,     Debugger8080.TYPE_E],
+    /* 0x74 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_M,     Debugger8080.TYPE_H],
+    /* 0x75 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_M,     Debugger8080.TYPE_L],
+    /* 0x76 */  [Debugger8080.INS.HLT],
+    /* 0x77 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_M,     Debugger8080.TYPE_A],
+    /* 0x78 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_A,     Debugger8080.TYPE_B],
+    /* 0x79 */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_A,     Debugger8080.TYPE_C],
+    /* 0x7A */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_A,     Debugger8080.TYPE_D],
+    /* 0x7B */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_A,     Debugger8080.TYPE_E],
+    /* 0x7C */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_A,     Debugger8080.TYPE_H],
+    /* 0x7D */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_A,     Debugger8080.TYPE_L],
+    /* 0x7E */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_A,     Debugger8080.TYPE_M],
+    /* 0x7F */  [Debugger8080.INS.MOV,   Debugger8080.TYPE_A,     Debugger8080.TYPE_A],
+    /* 0x80 */  [Debugger8080.INS.ADD,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_B],
+    /* 0x81 */  [Debugger8080.INS.ADD,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_C],
+    /* 0x82 */  [Debugger8080.INS.ADD,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_D],
+    /* 0x83 */  [Debugger8080.INS.ADD,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_E],
+    /* 0x84 */  [Debugger8080.INS.ADD,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_H],
+    /* 0x85 */  [Debugger8080.INS.ADD,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_L],
+    /* 0x86 */  [Debugger8080.INS.ADD,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_M],
+    /* 0x87 */  [Debugger8080.INS.ADD,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_A],
+    /* 0x88 */  [Debugger8080.INS.ADC,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_B],
+    /* 0x89 */  [Debugger8080.INS.ADC,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_C],
+    /* 0x8A */  [Debugger8080.INS.ADC,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_D],
+    /* 0x8B */  [Debugger8080.INS.ADC,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_E],
+    /* 0x8C */  [Debugger8080.INS.ADC,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_H],
+    /* 0x8D */  [Debugger8080.INS.ADC,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_L],
+    /* 0x8E */  [Debugger8080.INS.ADC,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_M],
+    /* 0x8F */  [Debugger8080.INS.ADC,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_A],
+    /* 0x90 */  [Debugger8080.INS.SUB,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_B],
+    /* 0x91 */  [Debugger8080.INS.SUB,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_C],
+    /* 0x92 */  [Debugger8080.INS.SUB,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_D],
+    /* 0x93 */  [Debugger8080.INS.SUB,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_E],
+    /* 0x94 */  [Debugger8080.INS.SUB,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_H],
+    /* 0x95 */  [Debugger8080.INS.SUB,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_L],
+    /* 0x96 */  [Debugger8080.INS.SUB,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_M],
+    /* 0x97 */  [Debugger8080.INS.SUB,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_A],
+    /* 0x98 */  [Debugger8080.INS.SBB,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_B],
+    /* 0x99 */  [Debugger8080.INS.SBB,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_C],
+    /* 0x9A */  [Debugger8080.INS.SBB,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_D],
+    /* 0x9B */  [Debugger8080.INS.SBB,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_E],
+    /* 0x9C */  [Debugger8080.INS.SBB,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_H],
+    /* 0x9D */  [Debugger8080.INS.SBB,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_L],
+    /* 0x9E */  [Debugger8080.INS.SBB,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_M],
+    /* 0x9F */  [Debugger8080.INS.SBB,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_A],
+    /* 0xA0 */  [Debugger8080.INS.ANA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_B],
+    /* 0xA1 */  [Debugger8080.INS.ANA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_C],
+    /* 0xA2 */  [Debugger8080.INS.ANA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_D],
+    /* 0xA3 */  [Debugger8080.INS.ANA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_E],
+    /* 0xA4 */  [Debugger8080.INS.ANA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_H],
+    /* 0xA5 */  [Debugger8080.INS.ANA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_L],
+    /* 0xA6 */  [Debugger8080.INS.ANA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_M],
+    /* 0xA7 */  [Debugger8080.INS.ANA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_A],
+    /* 0xA8 */  [Debugger8080.INS.XRA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_B],
+    /* 0xA9 */  [Debugger8080.INS.XRA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_C],
+    /* 0xAA */  [Debugger8080.INS.XRA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_D],
+    /* 0xAB */  [Debugger8080.INS.XRA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_E],
+    /* 0xAC */  [Debugger8080.INS.XRA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_H],
+    /* 0xAD */  [Debugger8080.INS.XRA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_L],
+    /* 0xAE */  [Debugger8080.INS.XRA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_M],
+    /* 0xAF */  [Debugger8080.INS.XRA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_A],
+    /* 0xB0 */  [Debugger8080.INS.ORA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_B],
+    /* 0xB1 */  [Debugger8080.INS.ORA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_C],
+    /* 0xB2 */  [Debugger8080.INS.ORA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_D],
+    /* 0xB3 */  [Debugger8080.INS.ORA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_E],
+    /* 0xB4 */  [Debugger8080.INS.ORA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_H],
+    /* 0xB5 */  [Debugger8080.INS.ORA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_L],
+    /* 0xB6 */  [Debugger8080.INS.ORA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_M],
+    /* 0xB7 */  [Debugger8080.INS.ORA,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_A],
+    /* 0xB8 */  [Debugger8080.INS.CMP,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_B],
+    /* 0xB9 */  [Debugger8080.INS.CMP,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_C],
+    /* 0xBA */  [Debugger8080.INS.CMP,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_D],
+    /* 0xBB */  [Debugger8080.INS.CMP,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_E],
+    /* 0xBC */  [Debugger8080.INS.CMP,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_H],
+    /* 0xBD */  [Debugger8080.INS.CMP,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_L],
+    /* 0xBE */  [Debugger8080.INS.CMP,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_M],
+    /* 0xBF */  [Debugger8080.INS.CMP,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_A],
+    /* 0xC0 */  [Debugger8080.INS.RNZ],
+    /* 0xC1 */  [Debugger8080.INS.POP,   Debugger8080.TYPE_BC],
+    /* 0xC2 */  [Debugger8080.INS.JNZ,   Debugger8080.TYPE_ADDR],
+    /* 0xC3 */  [Debugger8080.INS.JMP,   Debugger8080.TYPE_ADDR],
+    /* 0xC4 */  [Debugger8080.INS.CNZ,   Debugger8080.TYPE_ADDR],
+    /* 0xC5 */  [Debugger8080.INS.PUSH,  Debugger8080.TYPE_BC],
+    /* 0xC6 */  [Debugger8080.INS.ADI,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_IMM | Debugger8080.TYPE_BYTE],
+    /* 0xC7 */  [Debugger8080.INS.RST,   Debugger8080.TYPE_INT],
+    /* 0xC8 */  [Debugger8080.INS.RZ],
+    /* 0xC9 */  [Debugger8080.INS.RET],
+    /* 0xCA */  [Debugger8080.INS.JZ,    Debugger8080.TYPE_ADDR],
+    /* 0xCB */  [Debugger8080.INS.JMP,   Debugger8080.TYPE_ADDR | Debugger8080.TYPE_UNDOC],
+    /* 0xCC */  [Debugger8080.INS.CZ,    Debugger8080.TYPE_ADDR],
+    /* 0xCD */  [Debugger8080.INS.CALL,  Debugger8080.TYPE_ADDR],
+    /* 0xCE */  [Debugger8080.INS.ACI,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_IMM | Debugger8080.TYPE_BYTE],
+    /* 0xCF */  [Debugger8080.INS.RST,   Debugger8080.TYPE_INT],
+    /* 0xD0 */  [Debugger8080.INS.RNC],
+    /* 0xD1 */  [Debugger8080.INS.POP,   Debugger8080.TYPE_DE],
+    /* 0xD2 */  [Debugger8080.INS.JNC,   Debugger8080.TYPE_ADDR],
+    /* 0xD3 */  [Debugger8080.INS.OUT,   Debugger8080.TYPE_IMM  | Debugger8080.TYPE_BYTE,Debugger8080.TYPE_A   | Debugger8080.TYPE_OPT],
+    /* 0xD4 */  [Debugger8080.INS.CNC,   Debugger8080.TYPE_ADDR],
+    /* 0xD5 */  [Debugger8080.INS.PUSH,  Debugger8080.TYPE_DE],
+    /* 0xD6 */  [Debugger8080.INS.SUI,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_IMM | Debugger8080.TYPE_BYTE],
+    /* 0xD7 */  [Debugger8080.INS.RST,   Debugger8080.TYPE_INT],
+    /* 0xD8 */  [Debugger8080.INS.RC],
+    /* 0xD9 */  [Debugger8080.INS.RET,   Debugger8080.TYPE_UNDOC],
+    /* 0xDA */  [Debugger8080.INS.JC,    Debugger8080.TYPE_ADDR],
+    /* 0xDB */  [Debugger8080.INS.IN,    Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_IMM | Debugger8080.TYPE_BYTE],
+    /* 0xDC */  [Debugger8080.INS.CC,    Debugger8080.TYPE_ADDR],
+    /* 0xDD */  [Debugger8080.INS.CALL,  Debugger8080.TYPE_ADDR | Debugger8080.TYPE_UNDOC],
+    /* 0xDE */  [Debugger8080.INS.SBI,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_IMM | Debugger8080.TYPE_BYTE],
+    /* 0xDF */  [Debugger8080.INS.RST,   Debugger8080.TYPE_INT],
+    /* 0xE0 */  [Debugger8080.INS.RPO],
+    /* 0xE1 */  [Debugger8080.INS.POP,   Debugger8080.TYPE_HL],
+    /* 0xE2 */  [Debugger8080.INS.JPO,   Debugger8080.TYPE_ADDR],
+    /* 0xE3 */  [Debugger8080.INS.XTHL,  Debugger8080.TYPE_SP   | Debugger8080.TYPE_MEM| Debugger8080.TYPE_OPT,  Debugger8080.TYPE_HL | Debugger8080.TYPE_OPT],
+    /* 0xE4 */  [Debugger8080.INS.CPO,   Debugger8080.TYPE_ADDR],
+    /* 0xE5 */  [Debugger8080.INS.PUSH,  Debugger8080.TYPE_HL],
+    /* 0xE6 */  [Debugger8080.INS.ANI,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_IMM | Debugger8080.TYPE_BYTE],
+    /* 0xE7 */  [Debugger8080.INS.RST,   Debugger8080.TYPE_INT],
+    /* 0xE8 */  [Debugger8080.INS.RPE],
+    /* 0xE9 */  [Debugger8080.INS.PCHL,  Debugger8080.TYPE_HL],
+    /* 0xEA */  [Debugger8080.INS.JPE,   Debugger8080.TYPE_ADDR],
+    /* 0xEB */  [Debugger8080.INS.XCHG,  Debugger8080.TYPE_HL   | Debugger8080.TYPE_OPT, Debugger8080.TYPE_DE  | Debugger8080.TYPE_OPT],
+    /* 0xEC */  [Debugger8080.INS.CPE,   Debugger8080.TYPE_ADDR],
+    /* 0xED */  [Debugger8080.INS.CALL,  Debugger8080.TYPE_ADDR | Debugger8080.TYPE_UNDOC],
+    /* 0xEE */  [Debugger8080.INS.XRI,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_IMM | Debugger8080.TYPE_BYTE],
+    /* 0xEF */  [Debugger8080.INS.RST,   Debugger8080.TYPE_INT],
+    /* 0xF0 */  [Debugger8080.INS.RP],
+    /* 0xF1 */  [Debugger8080.INS.POP,   Debugger8080.TYPE_PSW],
+    /* 0xF2 */  [Debugger8080.INS.JP,    Debugger8080.TYPE_ADDR],
+    /* 0xF3 */  [Debugger8080.INS.DI],
+    /* 0xF4 */  [Debugger8080.INS.CP,    Debugger8080.TYPE_ADDR],
+    /* 0xF5 */  [Debugger8080.INS.PUSH,  Debugger8080.TYPE_PSW],
+    /* 0xF6 */  [Debugger8080.INS.ORI,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_IMM | Debugger8080.TYPE_BYTE],
+    /* 0xF7 */  [Debugger8080.INS.RST,   Debugger8080.TYPE_INT],
+    /* 0xF8 */  [Debugger8080.INS.RM],
+    /* 0xF9 */  [Debugger8080.INS.SPHL,  Debugger8080.TYPE_SP   | Debugger8080.TYPE_OPT, Debugger8080.TYPE_HL  | Debugger8080.TYPE_OPT],
+    /* 0xFA */  [Debugger8080.INS.JM,    Debugger8080.TYPE_ADDR],
+    /* 0xFB */  [Debugger8080.INS.EI],
+    /* 0xFC */  [Debugger8080.INS.CM,    Debugger8080.TYPE_ADDR],
+    /* 0xFD */  [Debugger8080.INS.CALL,  Debugger8080.TYPE_ADDR | Debugger8080.TYPE_UNDOC],
+    /* 0xFE */  [Debugger8080.INS.CPI,   Debugger8080.TYPE_A    | Debugger8080.TYPE_OPT, Debugger8080.TYPE_IMM | Debugger8080.TYPE_BYTE],
+    /* 0xFF */  [Debugger8080.INS.RST,   Debugger8080.TYPE_INT]
+    ];
+
+    Debugger8080.HISTORY_LIMIT = DEBUG? 100000 : 1000;
+
+    /*
+     * Initialize every Debugger module on the page (as IF there's ever going to be more than one ;-))
+     */
+    Web.onInit(Debugger8080.init);
+
+}   // endif DEBUGGER
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pc8080/lib/computer.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class Computer8080 extends Component {
+    /**
+     * Computer8080(parmsComputer, parmsMachine, fSuspended)
+     *
+     * The Computer8080 component has no required (parmsComputer) properties, but it does
+     * support the following:
+     *
+     *      autoPower: true to automatically power the computer (default), false to wait;
+     *      false is honored only if a "power" button binding exists.
+     *
+     *      busWidth: number of memory address lines (address bits) on the computer's "bus";
+     *      20 is the minimum (and the default), which implies 8086/8088 real-mode addressing,
+     *      while 24 is required for 80286 protected-mode addressing.  This value is passed
+     *      directly through to the Bus component; see that component for more details.
+     *
+     *      resume: one of the Computer8080.RESUME constants, which are as follows:
+     *          '0' if resume disabled (default)
+     *          '1' if enabled without prompting
+     *          '2' if enabled with prompting
+     *          '3' if enabled with prompting and auto-delete
+     *          or a string containing the path of a predefined JSON-encoded state
+     *
+     *      state: the path to JSON-encoded state file (see details regarding 'state' below)
+     *
+     * The parmsMachine object, if provided, may contain any of:
+     *
+     *      autoMount: if set, this should override any 'autoMount' property in the FDC's
+     *      parmsFDC object.
+     *
+     *      autoPower: if set, this should override any 'autoPower' property in the Computer8080's
+     *      parmsComputer object.
+     *
+     *      messages: if set, this should override any 'messages' property in the Debugger's
+     *      parmsDbg object.
+     *
+     *      state: if set, this should override any 'state' property in the Computer8080's
+     *      parmsComputer object.
+     *
+     *      url: the location of the machine XML file
+     *
+     * If a predefined state is supplied AND it's successfully loaded, then resume behavior
+     * defaults to '1' (ie, resume enabled without prompting).
+     *
+     * This component insures that all components are ready before "powering" them.
+     *
+     * Different components become ready at different times, and initialization order (ie,
+     * the order the scripts are combined on the page) only partially determines readiness.
+     * This is because components like ROM and Video must finish loading their resource files
+     * before they are ready.  Other components become ready after we call their initBus()
+     * function, because they have a Bus or CPU dependency, such as access to memory management
+     * functions.  And other components, like CPU and Panel, are ready as soon as their
+     * constructor finishes.
+     *
+     * Once a component has indicated it's ready, we call its powerUp() notification
+     * function (if it has one--it's optional).  We call the CPU's powerUp() function last,
+     * so that the CPU is assured that all other components are ready and "powered".
+     *
+     * @this {Computer8080}
+     * @param {Object} parmsComputer
+     * @param {Object} [parmsMachine]
+     * @param {boolean} [fSuspended]
+     */
+    constructor(parmsComputer, parmsMachine, fSuspended)
+    {
+        super("Computer", parmsComputer, Messages8080.COMPUTER);
+
+        this.flags.powered = false;
+
+        this.setMachineParms(parmsMachine);
+
+        this.fAutoPower = this.getMachineParm('autoPower', parmsComputer);
+
+        /*
+         * nPowerChange is 0 while the power state is stable, 1 while power is transitioning
+         * to "on", and -1 while power is transitioning to "off".
+         */
+        this.nPowerChange = 0;
+
+        /*
+         * TODO: Deprecate 'buswidth' (it should have always used camelCase)
+         */
+        this.nBusWidth = parmsComputer['busWidth'] || parmsComputer['buswidth'];
+
+        this.resume = Computer8080.RESUME_NONE;
+        this.sStateData = null;
+        this.fStateData = false;            // remembers if sStateData was loaded
+        this.fServerState = false;
+
+        this.url = this.getMachineParm('url') || "";
+
+        /*
+         * Generate a random number x (where 0 <= x < 1), add 0.1 so that it's guaranteed to be
+         * non-zero, convert to base 36, and chop off the leading digit and "decimal" point.
+         */
+        this.sMachineID = (Math.random() + 0.1).toString(36).substr(2,12);
+        this.sUserID = this.queryUserID();
+
+        /*
+         * Find the appropriate CPU (and Debugger and Control Panel, if any)
+         *
+         * CLOSURE COMPILER TIP: To override the type of a right-hand expression (as we need to do here,
+         * where we know getComponentByType() will only return an CPUState object or null), wrap the expression
+         * in parentheses.  I never knew this until I stumbled across it in "Closure: The Definitive Guide".
+         */
+        this.cpu = /** @type {CPUState8080} */ (Component.getComponentByType("CPU", this.id));
+        if (!this.cpu) {
+            Component.error("Unable to find CPU component");
+            return;
+        }
+        this.dbg = /** @type {Debugger8080} */ (Component.getComponentByType("Debugger", this.id));
+
+        /*
+         * Enumerate all Video components for future updateVideo() calls.
+         */
+        this.aVideo = [];
+        for (var video = null; (video = this.getMachineComponent("Video", video));) {
+            this.aVideo.push(video);
+        }
+
+        /*
+         * Initialize the Bus component
+         */
+        this.bus = new Bus8080({'id': this.idMachine + '.bus', 'busWidth': this.nBusWidth}, this.cpu, this.dbg);
+
+        /*
+         * Iterate through all the components and connect them to the Control Panel, if any
+         */
+        var iComponent, component;
+        var aComponents = Component.getComponents(this.id);
+        this.panel = /** @type {Panel8080} */ (Component.getComponentByType("Panel", this.id));
+
+        if (this.panel && this.panel.controlPrint) {
+            for (iComponent = 0; iComponent < aComponents.length; iComponent++) {
+                component = aComponents[iComponent];
+                /*
+                 * I can think of many "cleaner" ways for the Control Panel component to pass its
+                 * notice(), println(), etc, overrides on to all the other components, but it's just
+                 * too darn convenient to slam those overrides into the components directly.
+                 */
+                component.notice = this.panel.notice;
+                component.println = this.panel.println;
+                component.controlPrint = this.panel.controlPrint;
+            }
+        }
+
+        this.println(PC8080.APPNAME + " v" + (XMLVERSION || PC8080.APPVERSION) + "\n" + COPYRIGHT + "\n" + LICENSE);
+
+        if (DEBUG && this.messageEnabled()) this.printMessage("TYPEDARRAYS: " + TYPEDARRAYS);
+
+        /*
+         * Iterate through all the components again and call their initBus() handler, if any
+         */
+        for (iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            component = aComponents[iComponent];
+            if (component.initBus) component.initBus(this, this.bus, this.cpu, this.dbg);
+        }
+
+        var sStatePath = null;
+        var sResume = this.getMachineParm('resume', parmsComputer);
+        if (sResume !== undefined) {
+            /*
+             * Decide whether the 'resume' property is a number or the path of a state file to resume.
+             */
+            if (sResume.length > 1) {
+                sStatePath = this.sResumePath = sResume;
+            } else {
+                this.resume = parseInt(sResume, 10);
+            }
+        }
+
+        /*
+         * The Computer 'state' property allows a state file to be specified independent of the 'resume' feature;
+         * previously, you could only use 'resume' to load a state file -- which we still support, but loading a state
+         * file that way prevents the machine's state from being saved, since we always resume from the 'resume' file.
+         *
+         * The other wrinkle is on the restore side: we need to IGNORE the 'state' property if a saved state now exists.
+         * So we have to peek at localStorage, and unfortunately, the only way to "peek" is to actually load the data,
+         * but we're not ready to use it yet, so powerUp() has been changed to use any existing stateComputer that we've
+         * already loaded.
+         *
+         * However, there's now a wrinkle to the wrinkle: if a 'state' parameter has been passed via the URL, then that
+         * OVERRIDES everything; it overrides any 'state' Computer parameter AND it disables resume of any saved state in
+         * localStorage (in other words, it prevents fAllowResume from being true, and forcing resume off).
+         */
+        var fAllowResume;
+        var sState = this.getMachineParm('state') || (fAllowResume = true) && parmsComputer['state'];
+
+        if (sState) {
+            sStatePath = this.sStatePath = sState;
+            if (!fAllowResume) {
+                this.fServerState = true;
+                this.resume = Computer8080.RESUME_NONE;
+            }
+            if (this.resume) {
+                this.stateComputer = new State(this, PC8080.APPVERSION);
+                if (this.stateComputer.load()) {
+                    sStatePath = null;
+                } else {
+                    delete this.stateComputer;
+                }
+            }
+        }
+
+        /*
+         * If sStatePath is set, we must use it.  But if there's no sStatePath AND resume is set,
+         * then we have the option of resuming from a server-side state, assuming a valid USERID.
+         */
+        if (!sStatePath && this.resume) {
+            sStatePath = this.getServerStatePath();
+            if (sStatePath) this.fServerState = true;
+        }
+
+        if (!sStatePath) {
+            this.setReady();
+        } else {
+            var cmp = this;
+            Web.getResource(sStatePath, null, true, function(sURL, sResource, nErrorCode) {
+                cmp.doneLoad(sURL, sResource, nErrorCode);
+            });
+        }
+
+        if (!this.bindings["power"]) this.fAutoPower = true;
+
+        /*
+         * Power on the computer, giving every component the opportunity to reset or restore itself.
+         */
+        if (!fSuspended && this.fAutoPower) this.wait(this.powerOn);
+    }
+
+    /**
+     * getMachineID()
+     *
+     * @this {Computer8080}
+     * @return {string}
+     */
+    getMachineID()
+    {
+        return this.sMachineID;
+    }
+
+    /**
+     * setMachineParms(parmsMachine)
+     *
+     * If no explicit machine parms were provided, then we check for 'parms' in the bundled resources (if any).
+     *
+     * @this {Computer8080}
+     * @param {Object} [parmsMachine]
+     */
+    setMachineParms(parmsMachine)
+    {
+        if (!parmsMachine) {
+            var sParms;
+            if (typeof resources == 'object' && (sParms = resources['parms'])) {
+                try {
+                    parmsMachine = /** @type {Object} */ (eval("(" + sParms + ")"));
+                } catch(e) {
+                    Component.error(e.message + " (" + sParms + ")");
+                }
+            }
+        }
+        this.parmsMachine = parmsMachine;
+    }
+
+    /**
+     * getMachineParm(sParm, parmsComponent)
+     *
+     * If the machine parameter doesn't exist, we check for a matching component parameter (if parmsComponent is provided),
+     * and failing that, we check the bundled resources (if any).
+     *
+     * At the moment, the only bundled resource request we expect to encounter is 'state'; if it exists, then we return
+     * 'state' back to the caller (ie, the name of the resource), so that the caller will then attempt to load the 'state'
+     * resource to obtain the actual state.
+     *
+     * @this {Computer8080}
+     * @param {string} sParm
+     * @param {Object} [parmsComponent]
+     * @return {string|undefined}
+     */
+    getMachineParm(sParm, parmsComponent)
+    {
+        /*
+         * When using getURLParm(), the check is allowed be a bit looser, because URL parameters are
+         * user-supplied, whereas most other parameters are developer-supplied.  Granted, a developer
+         * may also be sloppy and neglect to use correct case (eg, 'automount' instead of 'autoMount'),
+         * but there are limits to my paranoia.
+         */
+        var sParmLC = sParm.toLowerCase();
+        var value = Web.getURLParm(sParm) || Web.getURLParm(sParmLC);
+
+        if (value === undefined && this.parmsMachine) {
+            value = this.parmsMachine[sParm];
+        }
+        if (value === undefined && parmsComponent) {
+            value = parmsComponent[sParm];
+        }
+        if (value === undefined && typeof resources == 'object' && resources[sParm]) {
+            value = sParm;
+        }
+        return value;
+    }
+
+    /**
+     * saveMachineParms()
+     *
+     * @this {Computer8080}
+     * @return {string|null}
+     */
+    saveMachineParms()
+    {
+        return this.parmsMachine? JSON.stringify(this.parmsMachine) : null;
+    }
+
+    /**
+     * getUserID()
+     *
+     * @this {Computer8080}
+     * @return {string}
+     */
+    getUserID()
+    {
+        return this.sUserID || "";
+    }
+
+    /**
+     * doneLoad(sURL, sStateData, nErrorCode)
+     *
+     * @this {Computer8080}
+     * @param {string} sURL
+     * @param {string} sStateData
+     * @param {number} nErrorCode
+     */
+    doneLoad(sURL, sStateData, nErrorCode)
+    {
+        if (!nErrorCode) {
+            this.sStateData = sStateData;
+            this.fStateData = true;
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage("loaded state file " + sURL.replace(this.sUserID || "xxx", "xxx"));
+            }
+        } else {
+            this.sResumePath = null;
+            this.fServerState = false;
+            this.notice('Unable to load machine state from server (error ' + nErrorCode + (sStateData? ': ' + Str.trim(sStateData) : '') + ')');
+        }
+        this.setReady();
+    }
+
+    /**
+     * wait(fn, parms)
+     *
+     * wait() waits until every component is ready (including ourselves, the last component we check), then calls the
+     * specified Computer method.
+     *
+     * TODO: The Closure Compiler makes it difficult for us to define a function type for "fn" that works in all cases;
+     * sometimes we want to pass a function that takes only a "number", and other times we want to pass a function that
+     * takes only an "Array" (the type will mirror that of the "parms" parameter).  However, the Closure Compiler insists
+     * that both functions must be declared as accepting both types of parameters.  So once again, we must use an untyped
+     * function declaration, instead of something stricter like:
+     *
+     *      param {function(this:Computer, (number|Array|undefined)): undefined} fn
+     *
+     * @this {Computer8080}
+     * @param {function(...)} fn
+     * @param {number|Array} [parms] optional parameters
+     */
+    wait(fn, parms)
+    {
+        var computer = this;
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent <= aComponents.length; iComponent++) {
+            var component = (iComponent < aComponents.length ? aComponents[iComponent] : this);
+            if (!component.isReady()) {
+                component.isReady(function onComponentReady() {
+                    computer.wait(fn, parms);
+                });
+                return;
+            }
+        }
+        if (DEBUG && this.messageEnabled()) this.printMessage("Computer8080.wait(ready)");
+        fn.call(this, parms);
+    }
+
+    /**
+     * validateState(stateComputer)
+     *
+     * NOTE: We clear() stateValidate only when there's no stateComputer.
+     *
+     * @this {Computer8080}
+     * @param {State|null} [stateComputer]
+     * @return {boolean} true if state passes validation, false if not
+     */
+    validateState(stateComputer)
+    {
+        var fValid = true;
+        var stateValidate = new State(this, PC8080.APPVERSION, Computer8080.STATE_VALIDATE);
+        if (stateValidate.load() && stateValidate.parse()) {
+            var sTimestampValidate = stateValidate.get(Computer8080.STATE_TIMESTAMP);
+            var sTimestampComputer = stateComputer? stateComputer.get(Computer8080.STATE_TIMESTAMP) : "unknown";
+            if (sTimestampValidate != sTimestampComputer) {
+                this.notice("Machine state may be out-of-date\n(" + sTimestampValidate + " vs. " + sTimestampComputer + ")\nCheck your browser's local storage limits");
+                fValid = false;
+                if (!stateComputer) stateValidate.clear();
+            } else {
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage("Last state: " + sTimestampComputer + " (validate: " + sTimestampValidate + ")");
+                }
+            }
+        }
+        return fValid;
+    }
+
+    /**
+     * powerOn(resume)
+     *
+     * Power every component "up", applying any previously available state information.
+     *
+     * @this {Computer8080}
+     * @param {number} [resume] is a valid RESUME value; default is this.resume
+     */
+    powerOn(resume)
+    {
+        if (resume === undefined) {
+            resume = this.resume || (this.sStateData? Computer8080.RESUME_AUTO : Computer8080.RESUME_NONE);
+        }
+
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("Computer8080.powerOn(" + (resume == Computer8080.RESUME_REPOWER ? "repower" : (resume ? "resume" : "")) + ")");
+        }
+
+        if (this.nPowerChange) {
+            return;
+        }
+        this.nPowerChange++;
+
+        var fRepower = false;
+        var fRestore = false;
+        this.fRestoreError = false;
+        var stateComputer = this.stateComputer || new State(this, PC8080.APPVERSION);
+
+        if (resume == Computer8080.RESUME_REPOWER) {
+            fRepower = true;
+        }
+        else if (resume > Computer8080.RESUME_NONE) {
+            if (stateComputer.load(this.sStateData)) {
+                /*
+                 * Since we're resuming something (either a predefined state or a state from localStorage), let's
+                 * create a "failsafe" checkpoint in localStorage, and destroy it at the end of a successful powerOn().
+                 * Which means, of course, that if a previous "failsafe" checkpoint already exists, something bad
+                 * may have happened the last time around.
+                 */
+                this.stateFailSafe = new State(this, PC8080.APPVERSION, Computer8080.STATE_FAILSAFE);
+                if (this.stateFailSafe.load()) {
+                    this.powerReport(stateComputer);
+                    /*
+                     * We already know resume is something other than RESUME_NONE, so we'll go ahead and bump it
+                     * all the way to RESUME_PROMPT, so that the user will be prompted, and if the user declines to
+                     * restore, the state will be removed.
+                     */
+                    resume = Computer8080.RESUME_PROMPT;
+                    /*
+                     * To ensure that the set() below succeeds, we need to call unload(), otherwise it may fail
+                     * with a "read only" error (eg, "TypeError: Cannot assign to read only property 'timestamp'").
+                     */
+                    this.stateFailSafe.unload();
+                }
+
+                this.stateFailSafe.set(Computer8080.STATE_TIMESTAMP, Usr.getTimestamp());
+                this.stateFailSafe.store();
+
+                var fValidate = this.resume && !this.fServerState;
+                if (resume == Computer8080.RESUME_AUTO || Component.confirmUser("Click OK to restore the previous " + PC8080.APPNAME + " machine state, or CANCEL to reset the machine.")) {
+                    fRestore = stateComputer.parse();
+                    if (fRestore) {
+                        var sCode = /** @type {string} */ (stateComputer.get(UserAPI.RES.CODE));
+                        var sData = /** @type {string} */ (stateComputer.get(UserAPI.RES.DATA));
+                        if (sCode) {
+                            if (sCode == UserAPI.CODE.OK) {
+                                stateComputer.load(sData);
+                            } else {
+                                /*
+                                 * A missing (or not yet created) state file is no cause for alarm, but other errors might be
+                                 */
+                                if (sCode == UserAPI.CODE.FAIL && sData != UserAPI.FAIL.NOSTATE) {
+                                    this.notice("Error: " + sData);
+                                    if (sData == UserAPI.FAIL.VERIFY) this.resetUserID();
+                                } else {
+                                    this.println(sCode + ": " + sData);
+                                }
+                                /*
+                                 * Try falling back to the state that we should have saved in localStorage, as a backup to the
+                                 * server-side state.
+                                 */
+                                stateComputer.unload();     // discard the invalid server-side state first
+                                if (stateComputer.load()) {
+                                    fRestore = stateComputer.parse();
+                                    fValidate = true;
+                                } else {
+                                    fRestore = false;       // hmmm, there was nothing in localStorage either
+                                }
+                            }
+                        }
+                    }
+                    /*
+                     * If the load/parse was successful, and it was from localStorage (not sStateData),
+                     * then we should to try verify that localStorage snapshot is current.  One reason it may
+                     * NOT be current is if localStorage was full and we got a quota error during the last
+                     * powerOff().
+                     */
+                    if (fValidate) this.validateState(fRestore? stateComputer : null);
+                } else {
+                    /*
+                     * RESUME_PROMPT indicates we should delete the state if they clicked Cancel to confirm() above.
+                     */
+                    if (resume == Computer8080.RESUME_PROMPT) stateComputer.clear();
+                }
+            } else {
+                /*
+                 * If there's no state, then there should also be no validation timestamp; if there is, then once again,
+                 * we're probably dealing with a quota error.
+                 */
+                this.validateState();
+            }
+            delete this.sStateData;
+            delete this.stateComputer;
+        }
+
+        /*
+         * Start powering all components, including any data they may need to restore their state;
+         * we restore power to the CPU last.
+         */
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component !== this && component != this.cpu) {
+                fRestore = this.powerRestore(component, stateComputer, fRepower, fRestore);
+            }
+        }
+
+        /*
+         * Assuming this is not a repower, we must perform another wait, because some components may
+         * have marked themselves as "not ready" again (eg, the FDC component, if the restore forced it
+         * to mount one or more additional disk images).
+         */
+        var aParms = [stateComputer, resume, fRestore];
+
+        if (resume != Computer8080.RESUME_REPOWER) {
+            this.wait(this.donePowerOn, aParms);
+            return;
+        }
+        this.donePowerOn(aParms);
+    }
+
+    /**
+     * powerRestore(component, stateComputer, fRepower, fRestore)
+     *
+     * @this {Computer8080}
+     * @param {Component} component
+     * @param {State} stateComputer
+     * @param {boolean} fRepower
+     * @param {boolean} fRestore
+     * @return {boolean} true if restore should continue, false if not
+     */
+    powerRestore(component, stateComputer, fRepower, fRestore)
+    {
+        if (!component.flags.powered) {
+
+            component.flags.powered = true;
+
+            if (component.powerUp) {
+
+                var data = null;
+                if (fRestore) {
+                    data = stateComputer.get(component.id);
+                    if (!data) {
+                        /*
+                         * This is a hack that makes it possible for a machine whose ID has been
+                         * supplemented with a suffix (a single letter or digit) to find object IDs
+                         * in states created from a machine without the suffix.
+                         *
+                         * For example, if a state file was created from a machine with ID "ibm5160"
+                         * but the current machine is "ibm5160a", this attempts a second lookup with
+                         * "ibm5160", enabling us to find objects that match the original machine ID
+                         * (eg, "ibm5160.romEGA").
+                         */
+                        data = stateComputer.get(component.id.replace(/[a-z0-9]\./i, '.'));
+                    }
+                }
+
+                /*
+                 * State.get() will return whatever was originally passed to State.set() (eg, an
+                 * Object or a string), but components are supposed to store only Objects, so if a
+                 * string comes back, something went wrong.  By explicitly eliminating "string" data,
+                 * the Closure Compiler stops complaining that we might be passing strings to our
+                 * powerUp() functions (even though we know we're not).
+                 *
+                 * TODO: Determine if there's some way to coerce the Closure Compiler into treating
+                 * data as Object or null, without having to include this runtime check.  An assert
+                 * would be a good idea, but this is overkill.
+                 */
+                if (typeof data === "string") data = null;
+
+                /*
+                 * If computer is null, this is simply a repower notification, which most components
+                 * don't do anything with.  Exceptions include: CPU (since it may be halted) and Video
+                 * (since its screen may be "turned off").
+                 */
+                if (!component.powerUp(data, fRepower) && data) {
+
+                    Component.error("Unable to restore state for " + component.type);
+                    /*
+                     * If this is a resume error for a machine that also has a predefined state
+                     * AND we're not restoring from that state, then throw away the current state,
+                     * prevent any new state from being created, and then force a reload, which will
+                     * hopefully restore us to the functioning predefined state.
+                     *
+                     * TODO: Considering doing this in ALL cases, not just in situations where a
+                     * 'state' exists but we're not actually resuming from it.
+                     */
+                    if (this.sStatePath && !this.fStateData) {
+                        stateComputer.clear();
+                        this.resume = Computer8080.RESUME_NONE;
+                        Web.reloadPage();
+                    } else {
+                        /*
+                         * In all other cases, we set fRestoreError, which should trigger a call to
+                         * powerReport() and then delete the offending state.
+                         */
+                        this.fRestoreError = true;
+                    }
+                    /*
+                     * Any failure triggers an automatic to call powerUp() again, without any state,
+                     * in the hopes that the component can recover by performing a reset.
+                     */
+                    component.powerUp(null);
+                    /*
+                     * We also disable the rest of the restore operation, because it's not clear
+                     * the remaining state information can be trusted;  the machine is already in an
+                     * inconsistent state, so we're not likely to make things worse, and the only
+                     * alternative (starting over and performing a state-less reset) isn't likely to make
+                     * the user any happier.  But, we'll see... we need some experience with the code.
+                     */
+                    fRestore = false;
+                }
+            }
+
+            if (!fRepower && component.comment) {
+                var asComments = component.comment.split("|");
+                for (var i = 0; i < asComments.length; i++) {
+                    component.status(asComments[i]);
+                }
+            }
+        }
+        return fRestore;
+    }
+
+    /**
+     * donePowerOn(aParms)
+     *
+     * This is nothing more than a continuation of powerOn(), giving us the option of calling wait() one more time.
+     *
+     * @this {Computer8080}
+     * @param {Array} aParms containing [stateComputer, resume, fRestore]
+     */
+    donePowerOn(aParms)
+    {
+        var stateComputer = aParms[0];
+        var fRepower = (aParms[1] < 0);
+        var fRestore = aParms[2];
+
+        if (DEBUG && this.flags.powered && this.messageEnabled()) {
+            this.printMessage("Computer8080.donePowerOn(): redundant");
+        }
+
+        this.fInitialized = true;
+        this.flags.powered = true;
+        var controlPower = this.bindings["power"];
+        if (controlPower) controlPower.textContent = "Shutdown";
+
+        /*
+         * Once we get to this point, we're guaranteed that all components are ready, so it's safe to power the CPU;
+         * the CPU should begin executing immediately, unless a debugger is attached.
+         */
+        if (this.cpu) {
+            /*
+             * TODO: Do we not care about the return value here? (ie, is checking fRestoreError sufficient)?
+             */
+            this.powerRestore(this.cpu, stateComputer, fRepower, fRestore);
+            this.cpu.autoStart();
+        }
+
+        /*
+         * If the state was bad, offer to report it and then delete it.  Deleting may be moot, since invariably a new
+         * state will be created on powerOff() before the next powerOn(), but it seems like good paranoia all the same.
+         */
+        if (this.fRestoreError) {
+            this.powerReport(stateComputer);
+            stateComputer.clear();
+        }
+
+        if (!fRepower && this.stateFailSafe) {
+            this.stateFailSafe.clear();
+            delete this.stateFailSafe;
+        }
+
+        this.nPowerChange = 0;
+    }
+
+    /**
+     * checkPower()
+     *
+     * @this {Computer8080}
+     * @return {boolean} true if the computer is fully powered, false otherwise
+     */
+    checkPower()
+    {
+        if (this.flags.powered) return true;
+
+        var component = null, iComponent;
+        var aComponents = Component.getComponents(this.id);
+        for (iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            component = aComponents[iComponent];
+            if (component !== this && !component.flags.ready) break;
+        }
+        if (iComponent == aComponents.length) {
+            for (iComponent = 0; iComponent < aComponents.length; iComponent++) {
+                component = aComponents[iComponent];
+                if (component !== this && !component.flags.powered) break;
+            }
+        }
+        if (iComponent == aComponents.length) component = this;
+        var s = "The " + component.type + " component (" + component.id + ") is not " + (!component.flags.ready? "ready yet" + (component.fnReady? " (waiting for notification)" : "") : "powered yet") + ".";
+        Component.alertUser(s);
+        return false;
+    }
+
+    /**
+     * powerReport(stateComputer)
+     *
+     * @this {Computer8080}
+     * @param {State} stateComputer
+     */
+    powerReport(stateComputer)
+    {
+        if (Component.confirmUser("There may be a problem with your " + PC8080.APPNAME + " machine.\n\nTo help us diagnose it, click OK to send this " + PC8080.APPNAME + " machine state to http://" + SITEHOST + ".")) {
+            Web.sendReport(PC8080.APPNAME, PC8080.APPVERSION, this.url, this.getUserID(), ReportAPI.TYPE.BUG, stateComputer.toString());
+        }
+    }
+
+    /**
+     * powerOff(fSave, fShutdown)
+     *
+     * Power every component "down" and optionally save the machine state.
+     *
+     * There's one scenario that powerOff() isn't currently able to deal with very effectively: what to do when
+     * the user switches away while it's still being restored, causing Disk getResource() calls to fail.  The
+     * Disk component calls notify() when that happens -- see Disk.mount() -- but the FDC and HDC controllers don't
+     * notify *us* of those problems, so Computer assumes that the restore was completely successful, when in fact
+     * it was only partially successful.
+     *
+     * Then we immediately arrive here to perform a save, following that incomplete restore.  It would be wrong to
+     * deal with that incomplete restore by setting fRestoreError, because we don't want to trigger a powerReport()
+     * and the deletion of the previous state, because the state itself was presumably OK.  Unfortunately, the new
+     * state we now save will no longer include manually mounted disk images whose remounts were interrupted, so future
+     * restores won't remount them either.
+     *
+     * We could perhaps solve this by having the Disk component notify us in those situations, set a new flag
+     * (fRestoreIncomplete?), and set fSave to false if that's ever set.  Be careful though: when fSave is false,
+     * that means MORE than not saving; it also means deleting any previous state, which is NOT what you'd want to
+     * do in a "fRestoreIncomplete" situation.  Also, we have to worry about Disk operations that fail for other reasons,
+     * making sure those failures don't interfere with the save process in the same way.
+     *
+     * As it stands, the worst that happens is any manually mounted disk images might have to be manually remounted,
+     * which doesn't seem like a huge problem.
+     *
+     * @this {Computer8080}
+     * @param {boolean} [fSave] is true to request a saved state
+     * @param {boolean} [fShutdown] is true if the machine is being shut down
+     * @return {string|null} string representing the saved state (or null if error)
+     */
+    powerOff(fSave, fShutdown)
+    {
+        var data;
+        var sState = "none";
+
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("Computer8080.powerOff(" + (fSave ? "save" : "nosave") + (fShutdown ? ",shutdown" : "") + ")");
+        }
+
+        if (this.nPowerChange) {
+            return null;
+        }
+        this.nPowerChange--;
+
+        var stateComputer = new State(this, PC8080.APPVERSION);
+        var stateValidate = new State(this, PC8080.APPVERSION, Computer8080.STATE_VALIDATE);
+
+        var sTimestamp = Usr.getTimestamp();
+        stateValidate.set(Computer8080.STATE_TIMESTAMP, sTimestamp);
+        stateComputer.set(Computer8080.STATE_TIMESTAMP, sTimestamp);
+        stateComputer.set(Computer8080.STATE_VERSION, APPVERSION);
+        stateComputer.set(Computer8080.STATE_HOSTURL, Web.getHostURL());
+        stateComputer.set(Computer8080.STATE_BROWSER, Web.getUserAgent());
+
+        /*
+         * Always power the CPU "down" first, just to help insure it doesn't ask other components to do anything
+         * after they're no longer ready.
+         */
+        if (this.cpu && this.cpu.powerDown) {
+            if (fShutdown) this.cpu.stopCPU();
+            data = this.cpu.powerDown(fSave, fShutdown);
+            if (typeof data === "object") stateComputer.set(this.cpu.id, data);
+            if (fShutdown) {
+                this.cpu.flags.powered = false;
+                if (data === false) sState = null;
+            }
+        }
+
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component.flags.powered) {
+                if (component.powerDown) {
+                    data = component.powerDown(fSave, fShutdown);
+                    if (typeof data === "object") stateComputer.set(component.id, data);
+                }
+                if (fShutdown) {
+                    component.flags.powered = false;
+                    if (data === false) sState = null;
+                }
+            }
+        }
+
+        if (sState) {
+            if (fShutdown) {
+                var fClear = false;
+                var fClearAll = false;
+                if (fSave) {
+                    if (this.sUserID) {
+                        this.saveServerState(this.sUserID, stateComputer.toString());
+                    }
+                    if (!stateValidate.store() || !stateComputer.store()) {
+                        sState = null;
+                        /*
+                         * New behavior as of v1.13.2:  if it appears that localStorage is full, we blow it ALL away.
+                         * Dedicated server-side storage is the only way we'll ever be able to reliably preserve a
+                         * particular machine's state.  Historically, attempting to limp along with whatever localStorage
+                         * is left just generates the same useless and annoying warnings over and over.
+                         */
+                        fClear = fClearAll = true;
+                    }
+                }
+                else {
+                    /*
+                     * I used to ALWAYS clear (ie, delete) any associated computer state, but now I do this only if the
+                     * current machine is "resumable", because there are situations where I have two configurations
+                     * for the same machine -- one resumable and one not -- and I don't want the latter throwing away the
+                     * state of the former.
+                     *
+                     * So this code is here now strictly for callers to delete the state of a "resumable" machine, not as
+                     * some paranoid clean-up operation.
+                     *
+                     * An undocumented feature of this operation is that if your configuration uses the special 'resume="3"'
+                     * value, and you click the "Reset" button, and then you click OK to reset the everything, this will
+                     * actually reset EVERYTHING (ie, all localStorage for ALL configs will be reclaimed).
+                     */
+                    if (this.resume) {
+                        fClear = true;
+                        fClearAll = (this.resume == Computer8080.RESUME_DELETE);
+                    }
+                }
+                if (fClear) {
+                    stateComputer.clear(fClearAll);
+                }
+            } else {
+                sState = stateComputer.toString();
+            }
+        }
+
+        if (fShutdown) {
+            this.flags.powered = false;
+            var controlPower = this.bindings["power"];
+            if (controlPower) controlPower.textContent = "Power";
+        }
+
+        this.nPowerChange = 0;
+
+        return sState;
+    }
+
+    /**
+     * reset()
+     *
+     * Notify all (other) components with a reset() method that the Computer is being reset.
+     *
+     * NOTE: We'd like to reset the Bus first (due to the importance of the A20 line), but since we
+     * allocated the Bus object ourselves, after all the other components were allocated, it ends
+     * up near the end of Component's list of components.  Hence the special case for this.bus below.
+     *
+     * @this {Computer8080}
+     */
+    reset()
+    {
+        if (this.bus && this.bus.reset) {
+            /*
+             * TODO: Why does WebStorm think that this.bus.type is undefined? The base class (Component)
+             * constructor defines it.
+             */
+            this.printMessage("Resetting " + this.bus.type);
+            this.bus.reset();
+        }
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component !== this && component !== this.bus && component.reset) {
+                this.printMessage("Resetting " + component.type);
+                component.reset();
+            }
+        }
+    }
+
+    /**
+     * start(ms, nCycles)
+     *
+     * Notify all (other) components with a start() method that the CPU has started.
+     *
+     * Note that we're called by runCPU(), which is why we exclude the CPU component,
+     * as well as ourselves.
+     *
+     * @this {Computer8080}
+     * @param {number} ms
+     * @param {number} nCycles
+     */
+    start(ms, nCycles)
+    {
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component.type == "CPU" || component === this) continue;
+            if (component.start) {
+                component.start(ms, nCycles);
+            }
+        }
+    }
+
+    /**
+     * stop(ms, nCycles)
+     *
+     * Notify all (other) components with a stop() method that the CPU has stopped.
+     *
+     * Note that we're called by runCPU(), which is why we exclude the CPU component,
+     * as well as ourselves.
+     *
+     * @this {Computer8080}
+     * @param {number} ms
+     * @param {number} nCycles
+     */
+    stop(ms, nCycles)
+    {
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component.type == "CPU" || component === this) continue;
+            if (component.stop) {
+                component.stop(ms, nCycles);
+            }
+        }
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * @this {Computer8080}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "reset")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        var computer = this;
+
+        switch (sBinding) {
+        case "power":
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickPower() {
+                computer.onPower();
+            };
+            return true;
+
+        case "reset":
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickReset() {
+                computer.onReset();
+            };
+            return true;
+
+        /*
+         * Technically, this binding should now be called "saveState", to clearly distinguish it from
+         * the "Save Machine" control that's normally bound to the savePC() function in save.js.  Saving
+         * an entire machine includes everything needed to start/restore the machine; eg, the machine
+         * XML configuration file(s) *and* the JSON-encoded machine state.
+         */
+        case "save":
+            /*
+             * Since this feature depends on the server supporting the PCjs User API (see userapi.js),
+             * and since pcjs.org is no longer running a Node web server, we disable the feature for that
+             * particular host.
+             */
+            if (Str.endsWith(Web.getHost(), "pcjs.org")) {
+                if (DEBUG) this.log("Remote user API not available");
+                /*
+                 * We could also simply hide the control; eg:
+                 *
+                 *      control.style.display = "none";
+                 *
+                 * but removing the control altogether seems better.
+                 */
+                control.parentNode.removeChild(/** @type {Node} */ (control));
+                return false;
+            }
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickSave() {
+                var sUserID = computer.queryUserID(true);
+                if (sUserID) {
+                    /*
+                     * I modified the test to include a check for sStatePath so that I could save new states
+                     * for machines with existing states; otherwise, I'd have no (easy) way of capturing and
+                     * updating their state.  Making the machine (even temporarily) resumable would have been
+                     * one work-around, but it's not appropriate for some machines, as their state is simply
+                     * too large (for localStorage anyway, which is the default storage solution).
+                     */
+                    var fSave = !!(computer.resume && !computer.sResumePath || computer.sStatePath);
+                    var sState = computer.powerOff(fSave);
+                    if (fSave) {
+                        computer.saveServerState(sUserID, sState);
+                    } else {
+                        computer.notice("Resume disabled, machine state not saved");
+                    }
+                }
+                /*
+                 * This seemed like a handy alternative, but it turned out to be a no-go, at least for large states:
+                 *
+                 *      var sState = computer.powerOff(true);
+                 *      if (sState) {
+                 *          sState = "data:text/json;charset=utf-8," + encodeURIComponent(sState);
+                 *          window.open(sState);
+                 *      }
+                 *
+                 * Perhaps if I embedded the data in a link on the current page instead; eg:
+                 *
+                 *      $('<a href="' + sState + '" download="state.json">Download</a>').appendTo('#container');
+                 */
+            };
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * resetUserID()
+     */
+    resetUserID()
+    {
+        Web.setLocalStorageItem(Computer8080.STATE_USERID, "");
+        this.sUserID = null;
+    }
+
+    /**
+     * queryUserID(fPrompt)
+     *
+     * @param {boolean} [fPrompt]
+     * @returns {string|null|undefined}
+     */
+    queryUserID(fPrompt)
+    {
+        var sUserID = this.sUserID;
+        if (!sUserID) {
+            sUserID = Web.getLocalStorageItem(Computer8080.STATE_USERID);
+            if (sUserID !== undefined) {
+                if (!sUserID && fPrompt) {
+                    /*
+                     * NOTE: Warning the user here that "Save" operations are not currently supported by pcjs.org is
+                     * merely a precaution, because ordinarily, setBinding() should have already determined if we are
+                     * running from pcjs.org and disabled any "Save" button.
+                     */
+                    sUserID = Component.promptUser("Saving machine states on the pcjs.org server is currently unsupported.\n\nIf you're running your own server, enter your user ID below.");
+                    if (sUserID) {
+                        sUserID = this.verifyUserID(sUserID);
+                        if (!sUserID) this.notice("The user ID is invalid.");
+                    }
+                }
+            } else if (fPrompt) {
+                this.notice("Browser local storage is not available");
+            }
+        }
+        return sUserID;
+    }
+
+    /**
+     * verifyUserID(sUserID)
+     *
+     * @this {Computer8080}
+     * @param {string} sUserID
+     * @return {string} validated user ID, or null if error
+     */
+    verifyUserID(sUserID)
+    {
+        this.sUserID = null;
+        var fMessages = DEBUG && this.messageEnabled();
+        if (fMessages) this.printMessage("verifyUserID(" + sUserID + ")");
+        var sRequest = Web.getHost() + UserAPI.ENDPOINT + '?' + UserAPI.QUERY.REQ + '=' + UserAPI.REQ.VERIFY + '&' + UserAPI.QUERY.USER + '=' + sUserID;
+        var response = Web.getResource(sRequest);
+        var nErrorCode = response[0];
+        var sResponse = response[1];
+        if (!nErrorCode && sResponse) {
+            try {
+                response = eval("(" + sResponse + ")");
+                if (response.code && response.code == UserAPI.CODE.OK) {
+                    Web.setLocalStorageItem(Computer8080.STATE_USERID, response.data);
+                    if (fMessages) this.printMessage(Computer8080.STATE_USERID + " updated: " + response.data);
+                    this.sUserID = response.data;
+                } else {
+                    if (fMessages) this.printMessage(response.code + ": " + response.data);
+                }
+            } catch (e) {
+                Component.error(e.message + " (" + sResponse + ")");
+            }
+        } else {
+            if (fMessages) this.printMessage("invalid response (error " + nErrorCode + ")");
+        }
+        return this.sUserID;
+    }
+
+    /**
+     * getServerStatePath()
+     *
+     * @this {Computer8080}
+     * @return {string|null} sStatePath (null if no localStorage or no USERID stored in localStorage)
+     */
+    getServerStatePath()
+    {
+        var sStatePath = null;
+        if (this.sUserID) {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage(Computer8080.STATE_USERID + " for load: " + this.sUserID);
+            }
+            sStatePath = Web.getHost() + UserAPI.ENDPOINT + '?' + UserAPI.QUERY.REQ + '=' + UserAPI.REQ.LOAD + '&' + UserAPI.QUERY.USER + '=' + this.sUserID + '&' + UserAPI.QUERY.STATE + '=' + State.key(this, PC8080.APPVERSION);
+        } else {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage(Computer8080.STATE_USERID + " unavailable");
+            }
+        }
+        return sStatePath;
+    }
+
+    /**
+     * saveServerState(sUserID, sState)
+     *
+     * @param {string} sUserID
+     * @param {string|null} sState
+     */
+    saveServerState(sUserID, sState)
+    {
+        /*
+         * We must pass fSync == true, because (as I understand it) browsers will blow off any async
+         * requests when a page is being closed.  Since our request is synchronous, storeServerState()
+         * should also return a result, but there's not much we can do with it, since browsers ALSO
+         * tend to blow off alerts() and the like when closing down.
+         */
+        if (sState) {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage("size of server state: " + sState.length + " bytes");
+            }
+            var response = this.storeServerState(sUserID, sState, true);
+            if (response && response[UserAPI.RES.CODE] == UserAPI.CODE.OK) {
+                this.notice("Machine state saved to server");
+            } else if (sState) {
+                var sError = (response && response[UserAPI.RES.DATA]) || UserAPI.FAIL.BADSTORE;
+                if (response[UserAPI.RES.CODE] == UserAPI.CODE.FAIL) {
+                    sError = "Error: " + sError;
+                } else {
+                    sError = "Error " + response[UserAPI.RES.CODE] + ": " + sError;
+                }
+                this.notice(sError);
+                this.resetUserID();
+            }
+        } else {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage("no state to store");
+            }
+        }
+    }
+
+    /**
+     * storeServerState(sUserID, sState, fSync)
+     *
+     * @this {Computer8080}
+     * @param {string} sUserID
+     * @param {string} sState
+     * @param {boolean} [fSync] is true if we're powering down and should perform a synchronous request (default is async)
+     * @return {*} server response if fSync is true and a response was received; otherwise null
+     */
+    storeServerState(sUserID, sState, fSync)
+    {
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage(Computer8080.STATE_USERID + " for store: " + sUserID);
+        }
+        /*
+         * TODO: Determine whether or not any browsers cancel our request if we're called during a browser "shutdown" event,
+         * and whether or not it matters if we do an async request (currently, we're not, to try to ensure the request goes through).
+         */
+        var dataPost = {};
+        dataPost[UserAPI.QUERY.REQ] = UserAPI.REQ.STORE;
+        dataPost[UserAPI.QUERY.USER] = sUserID;
+        dataPost[UserAPI.QUERY.STATE] = State.key(this, PC8080.APPVERSION);
+        dataPost[UserAPI.QUERY.DATA] = sState;
+        var sRequest = Web.getHost() + UserAPI.ENDPOINT;
+        if (!fSync) {
+            Web.getResource(sRequest, dataPost, true);
+        } else {
+            var response = Web.getResource(sRequest, dataPost);
+            var sResponse = response[0];
+            if (response[1]) {
+                if (sResponse) {
+                    var i = sResponse.indexOf('\n');
+                    if (i > 0) sResponse = sResponse.substr(0, i);
+                    if (!sResponse.indexOf("Error: ")) sResponse = sResponse.substr(7);
+                }
+                sResponse = '{"' + UserAPI.RES.CODE + '":' + response[1] + ',"' + UserAPI.RES.DATA + '":"' + sResponse + '"}';
+            }
+            if (DEBUG && this.messageEnabled()) this.printMessage(sResponse);
+            return JSON.parse(sResponse);
+        }
+        return null;
+    }
+
+    /**
+     * onPower()
+     *
+     * This handles UI requests to toggle the computer's power (eg, see the "power" button binding).
+     *
+     * @this {Computer8080}
+     */
+    onPower()
+    {
+        if (!this.nPowerChange) {
+            if (!this.flags.powered) {
+                this.wait(this.powerOn);
+            } else {
+                this.powerOff(false, true);
+            }
+        }
+    }
+
+    /**
+     * onReset()
+     *
+     * This handles UI requests to reset the computer's state (eg, see the "reset" button binding).
+     *
+     * @this {Computer8080}
+     */
+    onReset()
+    {
+        /*
+         * I'm going to start with the presumption that it makes little sense for an "unpowered" computer to be "reset";
+         * ditto if the power state is currently being changed.
+         */
+        if (!this.flags.powered || this.nPowerChange) return;
+
+        /*
+         * If this is a "resumable" machine (and it's not using a predefined state), then we overload the reset
+         * operation to offer an explicit "save or discard" option first.  This is currently the only UI we offer to
+         * discard a machine's state, including any disk changes.  The traditional "reset" operation is still available
+         * for non-resumable machines.
+         *
+         * TODO: Break this behavior out into a separate "discard" operation, in case the designer of the machine really
+         * wants to clutter the UI with confusing options. ;-)
+         */
+        if (this.resume && !this.sResumePath) {
+            /*
+             * I used to bypass the prompt if this.resume == Computer8080.RESUME_AUTO, setting fSave to true automatically,
+             * but that gives the user no means of resetting a resumable machine that contains errors in its resume state.
+             */
+            var fSave = (/* this.resume == Computer8080.RESUME_AUTO || */ Component.confirmUser("Click OK to save changes to this " + PC8080.APPNAME + " machine.\n\nWARNING: If you CANCEL, all disk changes will be discarded."));
+            this.powerOff(fSave, true);
+            /*
+             * Forcing the page to reload is an expedient option, but ugly. It's preferable to call powerOn()
+             * and rely on all the components to reset themselves to their default state.  The components with
+             * the greatest burden here are FDC and HDC, which must rely on the fReload flag to determine whether
+             * or not to unload/reload all their original auto-mounted disk images.
+             *
+             * However, if we started with a predefined state (ie, sStatePath is set), we take this shortcut, because
+             * we don't (yet) have code in place to gracefully reload the initial state (requires calling getResource()
+             * again); alternatively, we could avoid throwing that state away, but it seems better to save the memory.
+             *
+             * TODO: Make this more graceful, so that we can stop using the reloadPage() sledgehammer.
+             */
+            if (!fSave && this.sStatePath) {
+                Web.reloadPage();
+                return;
+            }
+            if (!fSave) this.fReload = true;
+            this.powerOn(Computer8080.RESUME_NONE);
+            this.fReload = false;
+        } else {
+            this.reset();
+            if (this.cpu) this.cpu.autoStart();
+        }
+    }
+
+    /**
+     * getMachineComponent(sType, componentPrev)
+     *
+     * @this {Computer8080}
+     * @param {string} sType
+     * @param {Component|null} [componentPrev] of previously returned component, if any
+     * @return {Component|null}
+     */
+    getMachineComponent(sType, componentPrev)
+    {
+        var componentLast = componentPrev;
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (componentPrev) {
+                if (componentPrev == component) componentPrev = null;
+                continue;
+            }
+            if (component.type == sType) return component;
+        }
+        if (!componentLast) Component.log("Machine component type '" + sType + "' not found", "warning");
+        return null;
+    }
+
+    /**
+     * updateFocus(fScroll)
+     *
+     * NOTE: When soft keyboard buttons call us to return focus to the machine (and away from the button),
+     * the browser's default behavior is to scroll the element into view, which can be annoying, especially on iOS,
+     * where the display is more constrained, so we no longer do it by default (fScroll must be true).
+     *
+     * @this {Computer8080}
+     * @param {boolean} [fScroll] (true if you really want the control scrolled into view)
+     */
+    updateFocus(fScroll)
+    {
+        if (this.aVideo.length) {
+            /*
+             * This seems to be recommended work-around to prevent the browser from scrolling the focused element
+             * into view.  The CPU is not a visual component, so when the CPU wants to set focus, the primary intent
+             * is to ensure that keyboard input is fielded properly.
+             */
+            var x = 0, y = 0;
+            if (!fScroll && window) {
+                x = window.scrollX;
+                y = window.scrollY;
+            }
+
+            /*
+             * TODO: We need a mechanism to determine the "active" display, instead of hard-coding this to aVideo[0].
+             */
+            this.aVideo[0].setFocus();
+
+            if (!fScroll && window) {
+                window.scrollTo(x, y);
+            }
+        }
+    }
+
+    /**
+     * updateStatus(fForce)
+     *
+     * If any DOM controls were bound to the CPU, then we need to call its updateStatus() handler; if there are no
+     * such bindings, then cpu.updateStatus() does nothing.
+     *
+     * Similarly, if there's a Panel, then we need to call its updateStatus() handler, in case it created its own canvas
+     * and implemented its own register display (eg, dumpRegisters()); if not, then panel.updateStatus() also does nothing.
+     *
+     * In practice, there will *either* be a Panel with a custom canvas *or* a set of DOM controls bound to the CPU *or*
+     * neither.  In theory, there could be BOTH, but that would be unusual.
+     *
+     * TODO: Consider alternate approaches to these largely register-oriented display updates.  Ordinarily, we like to
+     * separate logic from presentation, and currently the CPUState contains both, since it's the component that intimately
+     * knows the names, number, sizes, etc, of all the active registers.  The Panel component is the logical candidate,
+     * but Panel is an optional component; generally, only machines that include Debugger also include Panel.
+     *
+     * @this {Computer8080}
+     * @param {boolean} [fForce] (true will display registers even if the CPU is running and "live" registers are not enabled)
+      */
+    updateStatus(fForce)
+    {
+        /*
+         * fForce is generally set to true whenever the CPU is transitioning to/from a running state, in which case
+         * cpu.updateStatus() will definitely want to hide/show register contents; however, at other times, when the
+         * CPU is running, constantly updating the DOM controls too frequently can adversely impact overall performance.
+         *
+         * So fForce serves as a hint to help cpu.updateStatus() make a more informed decision.  panel.updateStatus()
+         * currently doesn't care, on the theory that canvas updates should be significantly faster than DOM updates,
+         * but we still pass fForce on.
+         */
+        if (this.cpu) this.cpu.updateStatus(fForce);
+        if (this.panel) this.panel.updateStatus(fForce);
+    }
+
+    /**
+     * updateVideo(fForced)
+     *
+     * Any high-frequency updates should be performed here (avoid updating DOM elements).
+     *
+     * @this {Computer8080}
+     * @param {boolean} [fForced]
+     */
+    updateVideo(fForced)
+    {
+        for (var i = 0; i < this.aVideo.length; i++) {
+            this.aVideo[i].updateScreen(fForced);
+        }
+    }
+
+    /**
+     * Computer8080.init()
+     *
+     * For every machine represented by an HTML element of class "pc8080-machine", this function
+     * locates the HTML element of class "computer", extracting the JSON-encoded parameters for the
+     * Computer constructor from the element's "data-value" attribute, invoking the constructor to
+     * create a Computer component, and then binding any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        /*
+         * In non-COMPILED builds, embedMachine() may have set XMLVERSION.
+         */
+        if (!COMPILED && XMLVERSION) PC8080.APPVERSION = XMLVERSION;
+
+        var aeMachines = Component.getElementsByClass(document, PC8080.APPCLASS + "-machine");
+
+        for (var iMachine = 0; iMachine < aeMachines.length; iMachine++) {
+
+            var eMachine = aeMachines[iMachine];
+            var parmsMachine = Component.getComponentParms(eMachine);
+
+            var aeComputers = Component.getElementsByClass(eMachine, PC8080.APPCLASS, "computer");
+
+            for (var iComputer = 0; iComputer < aeComputers.length; iComputer++) {
+
+                var eComputer = aeComputers[iComputer];
+                var parmsComputer = Component.getComponentParms(eComputer);
+
+                /*
+                 * We set fSuspended in the Computer constructor because we want to "power up" the
+                 * computer ourselves, after any/all bindings are in place.
+                 */
+                var computer = new Computer8080(parmsComputer, parmsMachine, true);
+
+                if (DEBUG && computer.messageEnabled()) {
+                    computer.printMessage("onInit(" + computer.flags.powered + ")");
+                }
+
+                /*
+                 * Bind any "power", "reset" and "save" buttons.  An "erase" button was also considered,
+                 * but "reset" now provides a way to force the machine to start from scratch again, so "erase"
+                 * may be redundant now.
+                 */
+                Component.bindComponentControls(computer, eComputer, PC8080.APPCLASS);
+
+                /*
+                 * Power on the computer, giving every component the opportunity to reset or restore itself.
+                 */
+                if (computer.fAutoPower) computer.wait(computer.powerOn);
+            }
+        }
+    }
+
+    /**
+     * Computer8080.show()
+     *
+     * When exit() is using an "onbeforeunload" handler, this "onpageshow" handler allows us to repower everything,
+     * without either resetting or restoring.  We call powerOn() with a special resume value (RESUME_REPOWER) if the
+     * computer is already marked as "ready", meaning the browser didn't change anything.  This "repower" process
+     * should be very quick, essentially just marking all components as powered again (so that, for example, the Video
+     * component will start drawing again) and firing the CPU up again.
+     */
+    static show()
+    {
+        var aeComputers = Component.getElementsByClass(document, PC8080.APPCLASS, "computer");
+        for (var iComputer = 0; iComputer < aeComputers.length; iComputer++) {
+            var eComputer = aeComputers[iComputer];
+            var parmsComputer = Component.getComponentParms(eComputer);
+            var computer = /** @type {Computer8080} */ (Component.getComponentByType("Computer", parmsComputer['id']));
+            if (computer) {
+
+                if (DEBUG && computer.messageEnabled()) {
+                    computer.printMessage("onShow(" + computer.fInitialized + "," + computer.flags.powered + ")");
+                }
+
+                /*
+                 * Note that the FIRST 'onpageshow' event, and therefore the first show() callback, occurs
+                 * AFTER the the initial 'onload' event, and at that point in time, fInitialized will not be set yet.
+                 * So, practically speaking, the first show() callback isn't all that useful.
+                 */
+                if (computer.fInitialized && !computer.flags.powered) {
+                    /**
+                     * Repower the computer, notifying every component to continue running as-is.
+                     */
+                    computer.powerOn(Computer8080.RESUME_REPOWER);
+                }
+            }
+        }
+    }
+
+    /**
+     * Computer8080.exit()
+     *
+     * The Computer is currently the only component that uses an "exit" handler, which web.onExit() defines as
+     * either an "unload" or "onbeforeunload" handler.  This gives us the opportunity to save the machine state,
+     * using our powerOff() function, before the page goes away.
+     *
+     * It's worth noting that "onbeforeunload" offers one nice feature when used instead of "onload": the entire
+     * page (and therefore this entire application) is retained in its current state by the browser (well, some
+     * browsers), so that if you go to a new URL, either by entering a new URL in the same window/tab, or by pressing
+     * the FORWARD button, and then you press the BACK button, the page is immediately restored to its previous state.
+     *
+     * In fact, that's how some browsers operate whether you have an "onbeforeunload" handler or not; in other words,
+     * an "onbeforeunload" handler doesn't change the page retention behavior of the browser.  By contrast, the mere
+     * presence of an "onunload" handler generally causes a browser to throw the page away once the handler returns.
+     *
+     * However, in order to safely use "onbeforeunload", we must add yet another handler ("onpageshow") to repower
+     * everything, without either resetting or restoring.  Hence, the Computer8080.show() function, which calls powerOn()
+     * with a special resume value (RESUME_REPOWER) if the computer is already marked as "ready", meaning the browser
+     * didn't change anything.  This "repower" process should be very quick, essentially just marking all components as
+     * powered again (so that, for example, the Video component will start drawing again) and firing the CPU up again.
+     *
+     * Reportedly, some browsers (eg, Opera) don't support "onbeforeunload", in which case Component will have to use
+     * "unload" instead.  But even when the page must be rebuilt from scratch, the combination of browser cache and
+     * localStorage means the simulation should be restored and become operational almost immediately.
+     */
+    static exit()
+    {
+        var aeComputers = Component.getElementsByClass(document, PC8080.APPCLASS, "computer");
+        for (var iComputer = 0; iComputer < aeComputers.length; iComputer++) {
+            var eComputer = aeComputers[iComputer];
+            var parmsComputer = Component.getComponentParms(eComputer);
+            var computer = /** @type {Computer8080} */ (Component.getComponentByType("Computer", parmsComputer['id']));
+            if (computer) {
+
+                if (DEBUG && computer.messageEnabled()) {
+                    computer.printMessage("onExit(" + computer.flags.powered + ")");
+                }
+
+                if (computer.flags.powered) {
+                    /**
+                     * Power off the computer, giving every component an opportunity to save its state,
+                     * but only if 'resume' has been set AND there is no valid resume path (because if a valid resume
+                     * path exists, we'll always load our state from there, and not from whatever we save here).
+                     */
+                    computer.powerOff(!!(computer.resume && !computer.sResumePath), true);
+                }
+            }
+        }
+    }
+}
+
+Computer8080.STATE_FAILSAFE  = "failsafe";
+Computer8080.STATE_VALIDATE  = "validate";
+Computer8080.STATE_TIMESTAMP = "timestamp";
+Computer8080.STATE_VERSION   = "version";
+Computer8080.STATE_HOSTURL   = "url";
+Computer8080.STATE_BROWSER   = "browser";
+Computer8080.STATE_USERID    = "user";
+
+/*
+ * The following constants define all the resume options.  Negative values (eg, RESUME_REPOWER) are for
+ * internal use only, and RESUME_DELETE is not documented (it provides a way of deleting ALL saved states
+ * whenever a resume is declined).  As a result, the only "end-user" values are 0, 1 and 2.
+ */
+Computer8080.RESUME_REPOWER  = -1;  // resume without changing any state (for internal use only)
+Computer8080.RESUME_NONE     =  0;  // default (no resume)
+Computer8080.RESUME_AUTO     =  1;  // automatically save/restore state
+Computer8080.RESUME_PROMPT   =  2;  // automatically save but conditionally restore (WARNING: if restore is declined, any state is discarded)
+Computer8080.RESUME_DELETE   =  3;  // same as RESUME_PROMPT but discards ALL machines states whenever ANY machine restore is declined (undocumented)
+
+/*
+ * Initialize every Computer on the page.
+ */
+Web.onInit(Computer8080.init);
+Web.onShow(Computer8080.show);
+Web.onExit(Computer8080.exit);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/state.js (C) Jeff Parsons 2012-2017
+ */
+
+
+class State {
+    /**
+     * State(component, sVersion, sSuffix)
+     *
+     * State objects are used by components to save/restore their state.
+     *
+     * During a save operation, components add data to a State object via set(), and then return
+     * the resulting data using data().
+     *
+     * During a restore operation, the Computer component passes the results of each data() call
+     * back to the originating component.
+     *
+     * WARNING: Since State objects are low-level objects that have no UI requirements, they do not
+     * inherit from the Component class, so you should only use class methods of Component, such as
+     * Component.assert() (or Debugger methods if the Debugger is available).
+     *
+     * NOTE: 1.01 is the first version to provide limited save/restore support using localStorage.
+     * From that point on, care must be taken to insure that any new version that's incompatible with
+     * previous localStorage data be released with a version number that is at least 1 greater,
+     * since we're tagging the localStorage data with the integer portion of the version string.
+     *
+     * @param {Component} component
+     * @param {string} [sVersion] is used to append a major version number to the key
+     * @param {string} [sSuffix] is used to append any additional suffixes to the key
+     */
+    constructor(component, sVersion, sSuffix)
+    {
+        this.id = component.id;
+        this.dbg = component.dbg;
+        this.json = "";
+        this.state = {};
+        this.fLoaded = this.fParsed = false;
+        this.key = State.key(component, sVersion, sSuffix);
+        this.unload(component.parms);
+    }
+
+    /**
+     * set(id, data)
+     *
+     * @this {State}
+     * @param {number|string} id
+     * @param {Object|string} data
+     */
+    set(id, data)
+    {
+        try {
+            this.state[id] = data;
+        } catch(e) {
+            Component.log(e.message);
+        }
+    }
+
+    /**
+     * get(id)
+     *
+     * @this {State}
+     * @param {number|string} id
+     * @return {Object|string|null}
+     */
+    get(id)
+    {
+        return this.state[id] || null;
+    }
+
+    /**
+     * data()
+     *
+     * @this {State}
+     * @return {Object}
+     */
+    data()
+    {
+        return this.state;
+    }
+
+    /**
+     * load(json)
+     *
+     * WARNING: Make sure you follow this call with either a call to parse() or unload(),
+     * because any stringified data that we've loaded isn't usable until it's been parsed.
+     *
+     * @this {State}
+     * @param {string|null} [json]
+     * @return {boolean} true if state exists in localStorage, false if not
+     */
+    load(json)
+    {
+        if (json) {
+            this.json = json;
+            this.fLoaded = true;
+            this.fParsed = false;
+            return true;
+        }
+        if (this.fLoaded) {
+            /*
+             * This is assumed to be a redundant load().
+             */
+            return true;
+        }
+        if (Web.hasLocalStorage()) {
+            var s = Web.getLocalStorageItem(this.key);
+            if (s) {
+                this.json = s;
+                this.fLoaded = true;
+                if (DEBUG) Component.log("localStorage(" + this.key + "): " + s.length + " bytes loaded");
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * parse()
+     *
+     * This completes the load() operation, by parsing what was loaded, on the assumption there
+     * might be some benefit to deferring parsing until we've given the user a chance to confirm.
+     * Otherwise, load() could have just as easily done this, too.
+     *
+     * @this {State}
+     * @return {boolean} true if successful, false if error
+     */
+    parse()
+    {
+        var fSuccess = true;
+        if (!this.fParsed) {
+            try {
+                this.state = JSON.parse(this.json);
+                this.fParsed = true;
+            } catch (e) {
+                Component.error(e.message || e);
+                fSuccess = false;
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * store()
+     *
+     * @this {State}
+     * @return {boolean} true if successful, false if error
+     */
+    store()
+    {
+        var fSuccess = true;
+        if (Web.hasLocalStorage()) {
+            var s = JSON.stringify(this.state);
+            if (Web.setLocalStorageItem(this.key, s)) {
+                if (DEBUG) Component.log("localStorage(" + this.key + "): " + s.length + " bytes stored");
+            } else {
+                /*
+                 * WARNING: Because browsers tend to disable all alerts() during an "unload" operation,
+                 * it's unlikely anyone will ever see the "quota" errors that occur at this point.  Need to
+                 * think of some way to notify the user that there's a problem, and offer a way of cleaning
+                 * up old states.
+                 */
+                Component.error("Unable to store " + s.length + " bytes in browser local storage");
+                fSuccess = false;
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * toString()
+     *
+     * @this {State}
+     * @return {string} JSON-encoded state
+     */
+    toString()
+    {
+        return this.state? JSON.stringify(this.state) : this.json;
+    }
+
+    /**
+     * unload(parms)
+     *
+     * This discards any data saved via set() or loaded via load(), creating an empty State object.
+     * Note that you have to follow this call with an explicit call to store() if you want to remove
+     * the state from localStorage as well.
+     *
+     * @this {State}
+     * @param {Object} [parms]
+     */
+    unload(parms)
+    {
+        this.json = "";
+        this.state = {};
+        this.fLoaded = this.fParsed = false;
+        if (parms) this.set("parms", parms);
+    }
+
+    /**
+     * clear(fAll)
+     *
+     * This unloads the current state, and then clears ALL localStorage for the current machine,
+     * independent of version, to reduce the chance of orphaned states wasting part of our limited allocation.
+     *
+     * @this {State}
+     * @param {boolean} [fAll] true to unconditionally clear ALL localStorage for the current domain
+     */
+    clear(fAll)
+    {
+        this.unload();
+        var aKeys = Web.getLocalStorageKeys();
+        for (var i = 0; i < aKeys.length; i++) {
+            var sKey = aKeys[i];
+            if (sKey && (fAll || sKey.substr(0, this.key.length) == this.key)) {
+                Web.removeLocalStorageItem(sKey);
+                if (DEBUG) Component.log("localStorage(" + sKey + ") removed");
+                aKeys.splice(i, 1);
+                i = 0;
+            }
+        }
+    }
+
+    /**
+     * State.key(component, sVersion, sSuffix)
+     *
+     * This encapsulates the key generation code.
+     *
+     * @param {Component} component
+     * @param {string} [sVersion] is used to append a major version number to the key
+     * @param {string} [sSuffix] is used to append any additional suffixes to the key
+     * @return {string} key
+     */
+    static key(component, sVersion, sSuffix)
+    {
+        var key = component.id;
+        if (sVersion) {
+            var i = sVersion.indexOf('.');
+            if (i > 0) key += ".v" + sVersion.substr(0, i);
+        }
+        if (sSuffix) {
+            key += "." + sSuffix;
+        }
+        return key;
+    }
+
+    /**
+     * State.compress(aSrc)
+     *
+     * @param {Array.<number>|null} aSrc
+     * @return {Array.<number>|null} is either the original array (aSrc), or a smaller array of "count, value" pairs (aComp)
+     */
+    static compress(aSrc)
+    {
+        if (aSrc) {
+            var iSrc = 0;
+            var iComp = 0;
+            var aComp = [];
+            while (iSrc < aSrc.length) {
+                var n = aSrc[iSrc];
+
+                var iCompare = iSrc + 1;
+                while (iCompare < aSrc.length && aSrc[iCompare] === n) iCompare++;
+                aComp[iComp++] = iCompare - iSrc;
+                aComp[iComp++] = n;
+                iSrc = iCompare;
+            }
+            if (aComp.length < aSrc.length) return aComp;
+        }
+        return aSrc;
+    }
+
+    /**
+     * State.decompress(aComp)
+     *
+     * @param {Array.<number>} aComp
+     * @param {number} nLength is expected length of decompressed data
+     * @return {Array.<number>}
+     */
+    static decompress(aComp, nLength)
+    {
+        var iDst = 0;
+        var aDst = new Array(nLength);
+        var iComp = 0;
+        while (iComp < aComp.length - 1) {
+            var c = aComp[iComp++];
+            var n = aComp[iComp++];
+            while (c--) {
+                aDst[iDst++] = n;
+            }
+        }
+
+        return aDst;
+    }
+
+    /**
+     * State.compressEvenOdd(aSrc)
+     *
+     * This is a very simple variation on compress() that compresses all the EVEN elements of aSrc first,
+     * followed by all the ODD elements.  This tends to work better on EGA video memory, because when odd/even
+     * addressing is enabled (eg, for text modes), the DWORD values tend to alternate, which is the worst case
+     * for compress(), but the best case for compressEvenOdd().
+     *
+     * One wrinkle we support: if the first element is uninitialized, then we assume the entire array is undefined,
+     * and return an empty compressed array.  Conversely, decompressEvenOdd() will take an empty compressed array
+     * and return an uninitialized array.
+     *
+     * @param {Array.<number>|null} aSrc
+     * @return {Array.<number>|null} is either the original array (aSrc), or a smaller array of "count, value" pairs (aComp)
+     */
+    static compressEvenOdd(aSrc)
+    {
+        if (aSrc) {
+            var iComp = 0, aComp = [];
+            if (aSrc[0] !== undefined) {
+                for (var off = 0; off < 2; off++) {
+                    var iSrc = off;
+                    while (iSrc < aSrc.length) {
+                        var n = aSrc[iSrc];
+                        var iCompare = iSrc + 2;
+                        while (iCompare < aSrc.length && aSrc[iCompare] === n) iCompare += 2;
+                        aComp[iComp++] = (iCompare - iSrc) >> 1;
+                        aComp[iComp++] = n;
+                        iSrc = iCompare;
+                    }
+                }
+            }
+            if (aComp.length < aSrc.length) return aComp;
+        }
+        return aSrc;
+    }
+
+    /**
+     * State.decompressEvenOdd(aComp, nLength)
+     *
+     * This is the counterpart to compressEvenOdd().  Note that because there's nothing in the compressed sequence
+     * that differentiates a compress() sequence from a compressEvenOdd() sequence, you simply have to be consistent:
+     * if you used even/odd compression, then you must use even/odd decompression.
+     *
+     * @param {Array.<number>} aComp
+     * @param {number} nLength is expected length of decompressed data
+     * @return {Array.<number>}
+     */
+    static decompressEvenOdd(aComp, nLength)
+    {
+        var iDst = 0;
+        var aDst = new Array(nLength);
+        var iComp = 0;
+        while (iComp < aComp.length - 1) {
+            var c = aComp[iComp++];
+            var n = aComp[iComp++];
+            while (c--) {
+                aDst[iDst] = n;
+                iDst += 2;
+            }
+            /*
+             * The output of a "count,value" pair will never exceed the end of the output array, so as soon as we reach it
+             * the first time, we know it's time to switch to ODD elements, and as soon as we reach it again, we should be
+             * done.
+             */
+
+            if (iDst == nLength) iDst = 1;
+        }
+
+        return aDst;
+    }
+}
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/embed.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * We now support asynchronous XML and XSL file loads; simply set fAsync (below) to true.
+ *
+ * NOTE: For that support to work, we have to keep track of the number of machines on the page
+ * (ie, how many embedMachine() calls were issued), reduce the count as each machine XML file
+ * is fully transformed into HTML, and when the count finally returns to zero, notify all the
+ * machine component init() handlers.
+ *
+ * Also, to prevent those init() handlers from running prematurely, we must disable all page
+ * notification events at the start of the embedding process (Web.enablePageEvents(false)) and
+ * re-enable them at the end (Web.enablePageEvents(true)).
+ */
+var fAsync = true;
+var cAsyncMachines = 0;
+
+/**
+ * loadXML(sFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+ *
+ * This is the preferred way to load all XML and XSL files. It uses getResource()
+ * to load them as strings, which parseXML() can massage before parsing/transforming them.
+ *
+ * For example, since I've been unable to get the XSLT document() function to work inside any
+ * XSL document loaded by JavaScript's XSLT processor, that has prevented me from dynamically
+ * loading any XML machine file that uses the "ref" attribute to refer to and incorporate
+ * another XML document.
+ *
+ * To solve that, I've added an fResolve parameter that tells parseXML() to fetch any
+ * referenced documents ITSELF and insert them into the XML string prior to parsing, instead
+ * of relying on the XSLT template to pull them in.  That fetching is handled by resolveXML(),
+ * which iterates over the XML until all "refs" have been resolved (including any nested
+ * references).
+ *
+ * Also, XSL files with a <!DOCTYPE [...]> cause MSIE's Microsoft.XMLDOM.loadXML() function
+ * to choke, so I strip that out prior to parsing as well.
+ *
+ * TODO: Figure out why the XSLT document() function works great when the web browser loads an
+ * XML file (and the associated XSL file) itself, but does not work when loading documents via
+ * JavaScript XSLT support. Is it broken, is it a security issue, or am I just calling it wrong?
+ *
+ * @param {string} sXMLFile
+ * @param {string|null|undefined} idMachine
+ * @param {string|null|undefined} sAppName
+ * @param {string|null|undefined} sAppClass
+ * @param {string|null|undefined} sParms
+ * @param {boolean} fResolve is true to resolve any "ref" attributes
+ * @param {function(string)} display
+ * @param {function(string,Object)} done (string contains the unparsed XML string data, and Object contains a parsed XML object)
+ */
+function loadXML(sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+{
+    var doneLoadXML = function(sURLName, sXML, nErrorCode) {
+        if (nErrorCode) {
+            if (!sXML) sXML = "unable to load " + sXMLFile + " (" + nErrorCode + ")";
+            done(sXML, null);
+            return;
+        }
+        parseXML(sXML, sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done);
+    };
+    display("Loading " + sXMLFile + "...");
+    Web.getResource(sXMLFile, null, fAsync, doneLoadXML);
+}
+
+/**
+ * parseXML(sXML, sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+ *
+ * Generates an XML document from an XML string. This function also provides a work-around for XSLT's
+ * lack of support for the document() function (at least on some browsers), by replacing every reference
+ * tag (ie, a tag with a "ref" attribute) with the contents of the referenced file.
+ *
+ * @param {string} sXML
+ * @param {string|null} sXMLFile
+ * @param {string|null|undefined} idMachine
+ * @param {string|null|undefined} sAppName
+ * @param {string|null|undefined} sAppClass
+ * @param {string|null|undefined} sParms
+ * @param {boolean} fResolve is true to resolve any "ref" attributes; default is false
+ * @param {function(string)} display
+ * @param {function(string,Object)} done (string contains the unparsed XML string data, and Object contains a parsed XML object)
+ */
+function parseXML(sXML, sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+{
+    var buildXML = function(sXML, sError) {
+        if (sError) {
+            done(sError, null);
+            return;
+        }
+        if (idMachine) {
+
+            /*
+             * A more sensible place to record the machine XML would be embedMachine(), like we do for the
+             * XSL file, but since we're about to modify the original machine XML, it's best to record it now.
+             */
+            Component.addMachineResource(idMachine, sXMLFile, sXML);
+
+            var sURL = sXMLFile;
+            if (sURL && sURL.indexOf('/') < 0 && window.location.pathname.slice(-1) == '/') {
+                sURL = window.location.pathname + sURL;
+            }
+            /*
+             * We embed the URL of the XML file both as a separate "xml" attribute for easy access from the
+             * XSL file, and as part of the "parms" attribute for easy access from machines (see getMachineParm()).
+             */
+            if (!sParms) {
+                sParms = '{';
+            } else if (sParms.slice(-1) == '}') {
+                sParms = sParms.slice(0, -1);
+                if (sParms.length > 1) sParms += ',';
+            } else {            // sParms must just be a "state" file, so encode it as a "state" property
+                sParms = '{state:"' + sParms + '",';
+            }
+            sParms += 'url:"' + sURL + '"}';
+            /*
+             * Note that while we no longer generate a machine XML file with a "state" attribute (because it's
+             * encoded inside the "parms" attribute), the XSL file must still cope with "state" attributes inside
+             * other XML files; for example, manifest XML files like /apps/pc/1981/visicalc/manifest.xml contain
+             * machine elements with "state" attributes that must still be passed down to the computer element
+             * "the old fashioned way".
+             *
+             * Until/unless that changes, components.xsl cannot be simplified as much as I might have hoped.
+             */
+            if (typeof resources == 'object') sURL = null;      // turn off URL inclusion if we have embedded resources
+            sXML = sXML.replace(/(<machine[^>]*\sid=)(['"]).*?\2/, "$1$2" + idMachine + "$2" + (sParms? " parms='" + sParms + "'" : "") + (sURL? ' url="' + sURL + '"' : ''));
+        }
+
+        if (!fResolve) {
+            /*
+             * I'm trying to switch to a shared components.xsl (at least for all PC-class machines),
+             * but in the interim, that means hacking the XSL file on the fly to reflect the actual class.
+             */
+            sXML = sXML.replace(/(<xsl:variable name="APPNAME">).*?(<\/xsl:variable>)/, "$1" + sAppName + "$2");
+            sXML = sXML.replace(/(<xsl:variable name="APPCLASS">).*?(<\/xsl:variable>)/, "$1" + sAppClass + "$2");
+
+            /*
+             * Non-COMPILED kludge to replace the version number template in the XSL file (which we assume we're reading,
+             * since fResolve is false) with whatever XMLVERSION we extracted from the XML file (see corresponding kludge below).
+             *
+             * ES6 ALERT: Template strings.
+             */
+            if (!COMPILED && XMLVERSION) {
+                sXML = sXML.replace(/<xsl:variable name="APPVERSION">1.x.x<\/xsl:variable>/, `<xsl:variable name="APPVERSION">${XMLVERSION}</xsl:variable>`);
+            }
+        }
+
+        /*
+         * If the resource we requested is not really an XML file (or the file didn't exist and the server simply returned
+         * a message like "Cannot GET /devices/pc/machine/5150/cga/64kb/donkey/machine.xml"), we'd like to display a more
+         * meaningful message, because the XML DOM parsers will blithely return a document that contains nothing useful; eg:
+         *
+         *      This page contains the following errors:error on line 1 at column 1:
+         *      Document is empty Below is a rendering of the page up to the first error.
+         *
+         * Supposedly, the IE XML DOM parser will throw an exception, but I haven't tested that, and unless all other
+         * browsers do that, that's not helpful.
+         *
+         * The best I can do at this stage (assuming Web.getResource() didn't drop any error information on the floor)
+         * is verify that the requested resource "looks like" valid XML (in other words, it begins with a '<').
+         */
+        var xmlDoc = null;
+        if (sXML.charAt(0) == '<') {
+            try {
+                /*
+                 * Another hack for MSIE, which fails to load XSL documents containing a <!DOCTYPE [...]> tag.
+                 *
+                 * This is also why the XSLTProcessor 'transformToFragment' method in Microsoft Edge silently failed,
+                 * so I had pull this hack out of the "ActiveXObject" code.  And rather than add yet-another Microsoft
+                 * browser check, I'm going to try doing this across the board, and hope that none of the other XSLT
+                 * processors fail *without* the DOCTYPE tag.
+                 */
+                if (!fResolve) {
+                    sXML = sXML.replace(/<!DOCTYPE(.|[\r\n])*]>\s*/g, "");
+                }
+                /*
+                 * Beginning with Microsoft Edge and the corresponding release of Windows 10, all the
+                 * 'ActiveXObject' crud has gone away; but of course, this code must remain in place if
+                 * we want to continue supporting older Internet Explorer browsers (ie, back to IE9).
+                 */
+                /** @namespace window.ActiveXObject */
+                if (window.ActiveXObject || 'ActiveXObject' in window) {        // second test is required for IE11 on Windows 8.1
+                    xmlDoc = new window.ActiveXObject("Microsoft.XMLDOM");
+                    xmlDoc.async = false;
+                    xmlDoc['loadXML'](sXML);
+                } else {
+                    /** @namespace window.DOMParser */
+                    xmlDoc = (new window.DOMParser()).parseFromString(sXML, "text/xml");
+                }
+            } catch(e) {
+                xmlDoc = null;
+                sXML = e.message;
+            }
+        } else {
+            sXML = "unrecognized XML: " + (sXML.length > 255? sXML.substr(0, 255) + "..." : sXML);
+        }
+        done(sXML, xmlDoc);
+    };
+    if (sXML) {
+        if (PRIVATE) sXML = sXML.replace(/\/library.xml/, "/private/library.xml");
+        if (fResolve) {
+            resolveXML(sXML, display, buildXML);
+            return;
+        }
+        buildXML(sXML, null);
+        return;
+    }
+    done("no data" + (sXMLFile? " for file: " + sXMLFile : ""), null);
+}
+
+/**
+ * resolveXML(sXML, display, done)
+ *
+ * Replaces every tag with a "ref" attribute with the contents of the corresponding file.
+ *
+ * TODO: Fix some of the limitations of this code, such as: 1) requiring the "ref" attribute
+ * to appear as the tag's first attribute, 2) requiring the "ref" attribute to be double-quoted,
+ * and 3) requiring the "ref" tag to be self-closing.
+ *
+ * @param {string} sXML
+ * @param {function(string)} display
+ * @param {function(string,(string|null))} done (the first string contains the resolved XML data, the second is for any error message)
+ */
+function resolveXML(sXML, display, done)
+{
+    var matchRef;
+    var reRef = /<([a-z]+)\s+ref="(.*?)"(.*?)\/>/g;
+
+    if ((matchRef = reRef.exec(sXML))) {
+
+        var sRefFile = matchRef[2];
+
+        var doneReadXML = function(sURLName, sXMLRef, nErrorCode) {
+            if (nErrorCode || !sXMLRef) {
+                done(sXML, "unable to resolve XML reference: " + matchRef[0] + " (" + nErrorCode + ")");
+                return;
+            }
+            /*
+             * If there are additional attributes in the "referring" XML tag, we want to insert them
+             * into the "referred" XML tag; attributes that don't exist in the referred tag should be
+             * appended, and attributes that DO exist should be overwritten.
+             */
+            var sRefAttrs = matchRef[3];
+            if (sRefAttrs) {
+                var aXMLRefTag = sXMLRef.match(new RegExp("<" + matchRef[1] + "[^>]*>"));
+                if (aXMLRefTag) {
+                    var sXMLNewTag = aXMLRefTag[0];
+                    /*
+                     * Iterate over all the attributes in the "referring" XML tag (sRefAttrs)
+                     */
+                    var matchAttr;
+                    var reAttr = /( [a-z]+=)(['"])(.*?)\2/g;
+                    while ((matchAttr = reAttr.exec(sRefAttrs))) {
+                        if (sXMLNewTag.indexOf(matchAttr[1]) < 0) {
+                            /*
+                             * This is the append case
+                             */
+                            sXMLNewTag = sXMLNewTag.replace(">", matchAttr[0] + ">");
+                        } else {
+                            /*
+                             * This is the overwrite case
+                             */
+                            sXMLNewTag = sXMLNewTag.replace(new RegExp(matchAttr[1] + "(['\"])(.*?)\\1"), matchAttr[0]);
+                        }
+                    }
+                    if (aXMLRefTag[0] != sXMLNewTag) {
+                        sXMLRef = sXMLRef.replace(aXMLRefTag[0], sXMLNewTag);
+                    }
+                } else {
+                    done(sXML, "missing <" + matchRef[1] + "> in " + sRefFile);
+                    return;
+                }
+            }
+
+            /*
+             * Apparently when a Windows Azure server delivers one of my XML files, it may modify the first line:
+             *
+             *      <?xml version="1.0" encoding="UTF-8"?>\n
+             *
+             * I didn't determine exactly what it was doing at this point (probably just changing the \n to \r\n),
+             * but in any case, relaxing the following replace() solved it.
+             */
+            sXMLRef = sXMLRef.replace(/<\?xml[^>]*>[\r\n]*/, "");
+
+            sXML = sXML.replace(matchRef[0], sXMLRef);
+
+            resolveXML(sXML, display, done);
+        };
+
+        display("Loading " + sRefFile + "...");
+        Web.getResource(sRefFile, null, fAsync, doneReadXML);
+        return;
+    }
+    done(sXML, null);
+}
+
+/**
+ * embedMachine(sAppName, sAppClass, sVersion, idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * This allows to you embed a machine on a web page, by transforming the machine XML into HTML.
+ *
+ * @param {string} sAppName is the app name (eg, "PCx86")
+ * @param {string} sAppClass is the app class (eg, "pcx86"); also known as the machine class
+ * @param {string} sVersion is the app version (eg, "1.15.7")
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedMachine(sAppName, sAppClass, sVersion, idMachine, sXMLFile, sXSLFile, sParms)
+{
+    var eMachine, eWarning, fSuccess = true;
+
+    cAsyncMachines++;
+    Component.addMachine(idMachine);
+
+    var doneMachine = function() {
+
+        if (!--cAsyncMachines) {
+            if (fAsync) Web.enablePageEvents(true);
+        }
+    };
+
+    var displayError = function(sError) {
+        Component.log(sError);
+        displayMessage("Error: " + sError);
+        if (fSuccess) doneMachine();
+        fSuccess = false;
+    };
+
+    var displayMessage = function(sMessage) {
+        if (eWarning === undefined) {
+            /*
+             * Our MarkOut module (in convertMDMachineLinks()) creates machine containers that look like:
+             *
+             *      <div id="' + sMachineID + '" class="machine-placeholder"><p>Embedded PC</p><p class="machine-warning">...</p></div>
+             *
+             * with the "machine-warning" paragraph pre-populated with a warning message that the user will
+             * see if nothing at all happens.  But hopefully, in the normal case (and especially the error case),
+             * *something* will have happened.
+             *
+             * Note that it is the HTMLOut module (in processMachines()) that ultimately decides which scripts to
+             * include and then generates the embedXXX() call.
+             */
+            var aeWarning = (eMachine && Component.getElementsByClass(eMachine, "machine-warning"));
+            eWarning = (aeWarning && aeWarning[0]) || eMachine;
+        }
+        if (eWarning) eWarning.innerHTML = Str.escapeHTML(sMessage);
+    };
+
+    try {
+        eMachine = document.getElementById(idMachine);
+        if (eMachine) {
+
+            /*
+             * If we have a 'css' resource, add it to the page first.
+             */
+            var css;
+            if (typeof resources == "object" && (css = resources['css'])) {
+                var head = document.head || document.getElementsByTagName('head')[0];
+                var style = document.createElement('style');
+                style.type = 'text/css';
+                if (style.styleSheet) {
+                    style.styleSheet.cssText = css;
+                } else {
+                    style.appendChild(document.createTextNode(css));
+                }
+                head.appendChild(style);
+            }
+
+            if (!sXSLFile) {
+                /*
+                 * Now that PCjs is an open-source project, we can make the following test more flexible,
+                 * and revert to the internal template if DEBUG *or* internal version (instead of *and*).
+                 *
+                 * Third-party sites that don't use the PCjs server will ALWAYS want to specify a fully-qualified
+                 * path to the XSL file, unless they choose to mirror our folder structure.
+                 */
+                var sAppFolder = sAppClass;
+                if (DEBUG || sVersion == "1.x.x") {
+                    sXSLFile = "/modules/" + sAppFolder + "/templates/components.xsl";
+                } else {
+                    if (sAppClass.substr(0, 3) == "pdp") sAppFolder = "pdpjs";
+                    sXSLFile = "/versions/" + sAppFolder + "/" + sVersion + "/components.xsl";
+                }
+            }
+
+            var processXML = function(sXML, xml) {
+                if (!xml) {
+                    displayError(sXML);
+                    return;
+                }
+
+                /*
+                 * Non-COMPILED kludge to extract the version number from the stylesheet path in the machine XML file;
+                 * we don't need this code in COMPILED (non-DEBUG) releases, because APPVERSION is hard-coded into them.
+                 */
+                if (!COMPILED) {
+                    var aMatch = sXML.match(/<\?xml-stylesheet[^>]* href=(['"])[^'"]*?\/([0-9.]*)\/([^'"]*)\1/);
+                    if (aMatch) XMLVERSION = aMatch[2];
+                }
+
+                var transformXML = function(sXSL, xsl) {
+                    if (!xsl) {
+                        displayError(sXSL);
+                        return;
+                    }
+
+                    /*
+                     * Record the XSL file, in case someone wants to save the entire machine later.
+                     */
+                    Component.addMachineResource(idMachine, sXSLFile, sXSL);
+
+                    /*
+                     * The <machine> template in components.xsl now generates a "machine div" that makes
+                     * the div we required the caller of embedMachine() to provide redundant, so instead
+                     * of appending this fragment to the caller's node, we REPLACE the caller's node.
+                     * This works only because because we ALSO inject the caller's "machine div" ID into
+                     * the fragment's ID during parseXML().
+                     *
+                     *      eMachine.innerHTML = sFragment;
+                     *
+                     * Also, if the transform function fails, make sure you're using the appropriate
+                     * "components.xsl" and not a "machine.xsl", because the latter will not produce valid
+                     * embeddable HTML (and is the most common cause of failure at this final stage).
+                     */
+                    displayMessage("Processing " + sXMLFile + "...");
+
+                    /*
+                     * Beginning with Microsoft Edge and the corresponding release of Windows 10, all the
+                     * 'ActiveXObject' crud has gone away; but of course, this code must remain in place if
+                     * we want to continue supporting older Internet Explorer browsers (ie, back to IE9).
+                     */
+                    if (window.ActiveXObject || 'ActiveXObject' in window) {        // second test is required for IE11 on Windows 8.1
+                        var sFragment = xml['transformNode'](xsl);
+                        if (sFragment) {
+                            eMachine.outerHTML = sFragment;
+                            doneMachine();
+                        } else {
+                            displayError("transformNodeToObject failed");
+                        }
+                    }
+                    else if (document.implementation && document.implementation.createDocument) {
+                        var xsltProcessor = new XSLTProcessor();
+                        xsltProcessor['importStylesheet'](xsl);
+                        var eFragment = xsltProcessor['transformToFragment'](xml, document);
+                        if (eFragment) {
+                            /*
+                             * This fails in Microsoft Edge...
+                             *
+                            var machine = eFragment.getElementById(idMachine);
+                            if (!machine) {
+                                displayError("machine generation failed: " + idMachine);
+                            } else
+                            */
+                            if (eMachine.parentNode) {
+                                eMachine.parentNode.replaceChild(eFragment, eMachine);
+                                doneMachine();
+                            } else {
+                                /*
+                                 * NOTE: This error can occur if our Node web server, when processing a folder with
+                                 * both a manifest.xml with a machine.xml reference AND a README.md containing a
+                                 * machine link, generates duplicate embedXXX() calls for the same machine; if the
+                                 * first embedXXX() call finds its target, subsequent calls for the same target will
+                                 * fail.
+                                 *
+                                 * Technically, such a folder is in a misconfigured state, but it happens, in part
+                                 * because when we switched to the Jekyll web server, we had to add machine links to
+                                 * all README.md files where we had previously relied on manifest.xml or machine.xml
+                                 * processing.  This is because the Jekyll web server currently doesn't process XML
+                                 * files, nor is support for that likely to be added any time soon; it was a nice
+                                 * feature of the Node web server, but it's not clear that it's worth doing for Jekyll.
+                                 */
+                                displayError("invalid machine element: " + idMachine);
+                            }
+                        } else {
+                            displayError("transformToFragment failed");
+                        }
+                    } else {
+                        /*
+                         * Perhaps I should have performed this test at the outset; on the other hand, I'm
+                         * not aware of any browsers don't support one or both of the above XSLT transformation
+                         * methods, so treat this as a bug.
+                         */
+                        displayError("unable to transform XML: unsupported browser");
+                    }
+                };
+                loadXML(sXSLFile, null, sAppName, sAppClass, null, false, displayMessage, transformXML);
+            };
+
+            if (sXMLFile.charAt(0) != '<') {
+                loadXML(sXMLFile, idMachine, sAppName, sAppClass, sParms, true, displayMessage, processXML);
+            } else {
+                parseXML(sXMLFile, null, idMachine, sAppName, sAppClass, sParms, false, displayMessage, processXML);
+            }
+        } else {
+            displayError("missing machine element: " + idMachine);
+        }
+    } catch(e) {
+        displayError(e.message);
+    }
+    return fSuccess;
+}
+
+/**
+ * embedC1P(idMachine, sXMLFile, sXSLFile)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @return {boolean} true if successful, false if error
+ */
+function embedC1P(idMachine, sXMLFile, sXSLFile)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("C1Pjs", "c1pjs", APPVERSION, idMachine, sXMLFile, sXSLFile);
+}
+
+/**
+ * embedPCx86(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPCx86(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PCx86", "pcx86", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * embedPC8080(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPC8080(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PC8080", "pc8080", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * embedPDP10(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPDP10(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PDPjs", "pdp10", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * embedPDP11(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPDP11(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PDPjs", "pdp11", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * findMachineComponent(idMachine, sType)
+ *
+ * @param {string} idMachine
+ * @param {string} sType
+ * @return {Component|null}
+ */
+function findMachineComponent(idMachine, sType)
+{
+    return Component.getComponentByType(sType, idMachine + ".machine");
+}
+
+/**
+ * processMachineScript(idMachine, sScript)
+ *
+ * @param {string} idMachine
+ * @param {string} sScript
+ * @return {boolean}
+ */
+function processMachineScript(idMachine, sScript)
+{
+    return Component.processScript(idMachine, sScript);
+}
+
+/**
+ * Prevent the Closure Compiler from renaming functions we want to export, by adding them as global properties.
+ *
+ * TODO: Consider making all these functions properties on a single global object (eg, 'PCjs'), to minimize global
+ * pollution and risk of name collision.
+ */
+if (APPNAME == "C1Pjs") {
+    window['embedC1P']    = embedC1P;
+}
+if (APPNAME == "PCx86") {
+    window['embedPC']     = embedPCx86;         // WARNING: embedPC() deprecated as of v1.23.0
+    window['embedPCx86']  = embedPCx86;
+}
+if (APPNAME == "PC8080") {
+    window['embedPC8080'] = embedPC8080;
+}
+if (APPNAME == "PDPjs") {
+    window['embedPDP10']  = embedPDP10;
+    window['embedPDP11']  = embedPDP11;
+}
+
+window['findMachineComponent'] = findMachineComponent;
+window['processMachineScript'] = processMachineScript;
+
+window['enableEvents'] = Web.enablePageEvents;
+window['sendEvent']    = Web.sendPageEvent;
diff --git a/versions/pc8080/1.35.0/pc8080.js b/versions/pc8080/1.35.0/pc8080.js
index 052430991..45ec7329f 100644
--- a/versions/pc8080/1.35.0/pc8080.js
+++ b/versions/pc8080/1.35.0/pc8080.js
@@ -219,4 +219,4 @@ a=a.replace(d[0],g);Oe(a,b,c)}})}else c(a,null)}
 function Pe(a,b,c,d){function e(a){if(void 0===h){var b=g&&A(g,"machine-warning");h=b&&b[0]||g}h&&(h.innerHTML=pa(a))}function f(a){e("Error: "+a);m&&(--Le||Ka(!0));m=!1}var g,h,m=!0;Le++;Pa[a]={};try{if(g=document.getElementById(a)){var q;if("object"==typeof resources&&(q=resources.css)){var x=document.head||document.getElementsByTagName("head")[0],w=document.createElement("style");w.type="text/css";w.styleSheet?w.styleSheet.cssText=q:w.appendChild(document.createTextNode(q));x.appendChild(w)}c||
 (c="/versions/pc8080/1.35.0/components.xsl");q=function(d,h){h?Me(c,null,null,!1,e,function(d,m){m?(Oa(a,c,d),e("Processing "+b+"..."),window.ActiveXObject||"ActiveXObject"in window?(m=h.transformNode(m))?(g.outerHTML=m,--Le||Ka(!0)):f("transformNodeToObject failed"):document.implementation&&document.implementation.createDocument?(d=new XSLTProcessor,d.importStylesheet(m),(m=d.transformToFragment(h,document))?g.parentNode?(g.parentNode.replaceChild(m,g),--Le||Ka(!0)):f("invalid machine element: "+
 a):f("transformToFragment failed")):f("unable to transform XML: unsupported browser")):f(d)}):f(d)};"<"!=b.charAt(0)?Me(b,a,d,!0,e,q):Ne(b,null,a,d,!1,e,q)}else f("missing machine element: "+a)}catch(L){f(L.message)}return m}window.embedPC8080=function(a,b,c,d){Ka(!1);return Pe(a,b,c,d)};window.findMachineComponent=function(a,b){return Ua(b,a+".machine")};
-window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==typeof b&&!Ya[a]){for(var c=!0,d=Ya,e=a,f=b.length,g=[],h=[],m="",q=null,x=0;x<f;x++){var w=b[x];if('"'==w||"'"==w)q&&w!=q?m+=w:(q?q=null:q=w,m&&(h.push(m),m=""));else{if(!q){if("\r"==w||"\n"==w)w=";";if(" "==w||"\t"==w||";"==w){m&&(h.push(m),m="");";"==w&&h.length&&(g.push(h),h=[]);continue}}m+=w}}m&&h.push(m);h.length&&g.push(h);d[e]=g;Xa(a)||(c=!1)}return c};window.enableEvents=Ka;window.sendEvent=Ma;})();
+window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==typeof b&&!Ya[a]){for(var c=!0,d=Ya,e=a,f=b.length,g=[],h=[],m="",q=null,x=0;x<f;x++){var w=b[x];if('"'==w||"'"==w)q&&w!=q?m+=w:(q?q=null:q=w,m&&(h.push(m),m=""));else{if(!q){if("\r"==w||"\n"==w)w=";";if(" "==w||"\t"==w||";"==w){m&&(h.push(m),m="");";"==w&&h.length&&(g.push(h),h=[]);continue}}m+=w}}m&&h.push(m);h.length&&g.push(h);d[e]=g;Xa(a)||(c=!1)}return c};window.enableEvents=Ka;window.sendEvent=Ma;})();//# sourceMappingURL=/versions/pc8080/1.35.0/pc8080.map
diff --git a/versions/pcx86/1.35.0/pcx86-dbg.js b/versions/pcx86/1.35.0/pcx86-dbg.js
index 65ab7e752..124e8b65d 100644
--- a/versions/pcx86/1.35.0/pcx86-dbg.js
+++ b/versions/pcx86/1.35.0/pcx86-dbg.js
@@ -893,4 +893,4 @@ window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==ty
 function uC(a,b,c,d){if(!c&&b){d.push(b);a=pb[d[0]];b=null;for(var e in a)if(wa(e,"components.xsl")){b=e.replace(".xsl",".css");break}b?Ka(b,null,!0,function(a,b){vC(b,d)}):vC(null,d)}else gb("Error ("+c+") requesting "+a)}
 function vC(a,b){var c,d,e,f=b[0],g=b[1];c=b[4];c=c.match(/^(\s*\(function\(\)\{)([\s\S]*)(}\)\(\);\s*)$/);var h=pb[f],k={},m;for(m in h){var p=h[m],v=va(m);if("xml"==v){for(v=/[ \t]*<disk [^>]*path=(['"])(.*?)\1.*?<\/disk>\n?/g;d=v.exec(h[m]);){var u=d[2];u&&(h[u]||(p=p.replace(d[0],"")))}d=m=ta(m)}else"xsl"==v&&(e=m=ta(m));k[m]=p}a&&(k[m="css"]=a);b[2]&&(k[m="parms"]=b[2]);b[3]&&(k[m="state"]=b[3]);d&&e?(a=JSON.stringify(k),g+=".js",c=c[1]+"var resources="+a+";"+c[2]+c[3],c=c.replace(/\u00A9/g,
 "&#xA9;"),a=Wa(c,"javascript",!1,g),a=a+(', copy it to your web server as "'+g+'", and then add the following to your web page:\n\n')+('<div id="'+f+'"></div>\n')+"...\n",a=a+('<script type="text/javascript" src="'+g+'">\x3c/script>\n')+('<script type="text/javascript">embedPC("'+f+'","'+d+'","'+e+'");\x3c/script>\n\n')+"The machine should appear where the <div> is located.",gb(a)):gb("Missing XML/XSL resources")}
-window.savePC=function(a,b,c){var d=ub("Computer",a),e=ub("Debugger",a);if(d){var f=lB(d,!0),g=d.J?JSON.stringify(d.J):null;b||(b="/versions/pcx86/1.35.0/pcx86"+(e?"-dbg":"")+".js");if(c&&c({state:f,Pk:g}))return!0;Ka(b,null,!0,function(c,d,e){uC(c,d,e,[a,ta(b,!0),g,f])});return!0}gb("Unable to identify machine '"+a+"'");return!1};})();
+window.savePC=function(a,b,c){var d=ub("Computer",a),e=ub("Debugger",a);if(d){var f=lB(d,!0),g=d.J?JSON.stringify(d.J):null;b||(b="/versions/pcx86/1.35.0/pcx86"+(e?"-dbg":"")+".js");if(c&&c({state:f,Pk:g}))return!0;Ka(b,null,!0,function(c,d,e){uC(c,d,e,[a,ta(b,!0),g,f])});return!0}gb("Unable to identify machine '"+a+"'");return!1};})();//# sourceMappingURL=/versions/pcx86/1.35.0/pcx86-dbg.map
diff --git a/versions/pcx86/1.35.0/pcx86-uncompiled.js b/versions/pcx86/1.35.0/pcx86-uncompiled.js
new file mode 100644
index 000000000..c88f050e9
--- /dev/null
+++ b/versions/pcx86/1.35.0/pcx86-uncompiled.js
@@ -0,0 +1,76498 @@
+"use strict";
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/defines.js (C) Jeff Parsons 2012-2017
+ */
+
+/**
+ * @define {string}
+ */
+var APPVERSION = "1.x.x";       // this @define is overridden by the Closure Compiler with the version in package.json
+
+var XMLVERSION = null;          // this is set in non-COMPILED builds by embedMachine() if a version number was found in the machine XML
+
+var COPYRIGHT = "Copyright © 2012-2017 Jeff Parsons <Jeff@pcjs.org>";
+
+var LICENSE = "License: GPL version 3 or later <http://gnu.org/licenses/gpl.html>";
+
+var CSSCLASS = "pcjs";
+
+/**
+ * @define {string}
+ */
+var SITEHOST = "localhost:8088";// this @define is overridden by the Closure Compiler with "www.pcjs.org"
+
+/**
+ * @define {boolean}
+ */
+var COMPILED = false;           // this @define is overridden by the Closure Compiler (to true)
+
+/**
+ * @define {boolean}
+ */
+var DEBUG = true;               // this @define is overridden by the Closure Compiler (to false) to remove DEBUG-only code
+
+/**
+ * @define {boolean}
+ */
+var MAXDEBUG = false;           // this @define is overridden by the Closure Compiler (to false) to remove MAXDEBUG-only code
+
+/**
+ * @define {boolean}
+ */
+var PRIVATE = false;            // this @define is overridden by the Closure Compiler (to false) to enable PRIVATE code
+
+/*
+ * RS-232 DB-25 Pin Definitions, mapped to bits 1-25 in a 32-bit status value.
+ *
+ * SerialPorts in PCjs machines are considered DTE (Data Terminal Equipment), which means they should be "virtually"
+ * connected to each other via a null-modem cable, which assumes the following cross-wiring:
+ *
+ *     G       1  <->  1        G       (Ground)
+ *     TD      2  <->  3        RD      (Received Data)
+ *     RD      3  <->  2        TD      (Transmitted Data)
+ *     RTS     4  <->  5        CTS     (Clear To Send)
+ *     CTS     5  <->  4        RTS     (Request To Send)
+ *     DSR   6+8  <->  20       DTR     (Data Terminal Ready)
+ *     SG      7  <->  7        SG      (Signal Ground)
+ *     DTR    20  <->  6+8      DSR     (Data Set Ready + Carrier Detect)
+ *     RI     22  <->  22       RI      (Ring Indicator)
+ *
+ * TODO: Move these definitions to a more appropriate shared file at some point.
+ */
+var RS232 = {
+    RTS: {
+        PIN:  4,
+        MASK: 0x00000010
+    },
+    CTS: {
+        PIN:  5,
+        MASK: 0x00000020
+    },
+    DSR: {
+        PIN:  6,
+        MASK: 0x00000040
+    },
+    CD: {
+        PIN:  8,
+        MASK: 0x00000100
+    },
+    DTR: {
+        PIN:  20,
+        MASK: 0x00100000
+    },
+    RI: {
+        PIN:  22,
+        MASK: 0x00400000
+    }
+};
+
+/*
+ * NODE should be true if we're running under NodeJS (eg, command-line), false if not (eg, web browser)
+ */
+var NODE = false;
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/diskapi.js (C) Jeff Parsons 2012-2017
+ */
+
+/*
+ * Our "DiskIO API" looks like:
+ *
+ *      http://www.pcjs.org/api/v1/disk?action=open&volume=*10mb.img&mode=demandrw&chs=c:h:s&machine=xxx&user=yyy
+ */
+var DiskAPI = {
+    ENDPOINT:       "/api/v1/disk",
+    QUERY: {
+        ACTION:     "action",   // value is one of DiskAPI.ACTION.*
+        VOLUME:     "volume",   // value is path of a disk image
+        MODE:       "mode",     // value is one of DiskAPI.MODE.*
+        CHS:        "chs",      // value is cylinders:heads:sectors:bytes
+        ADDR:       "addr",     // value is cylinder:head:sector:count
+        MACHINE:    "machine",  // value is machine token
+        USER:       "user",     // value is user ID
+        DATA:       "data"      // value is data to be written
+    },
+    ACTION: {
+        OPEN:       "open",
+        READ:       "read",
+        WRITE:      "write",
+        CLOSE:      "close"
+    },
+    MODE: {
+        LOCAL:      "local",    // this mode implies no API (at best, localStorage backing only)
+        PRELOAD:    "preload",  // this mode implies use of the DumpAPI
+        DEMANDRW:   "demandrw",
+        DEMANDRO:   "demandro"
+    },
+    FAIL: {
+        BADACTION:  "invalid action",
+        BADUSER:    "invalid user",
+        BADVOL:     "invalid volume",
+        OPENVOL:    "unable to open volume",
+        CREATEVOL:  "unable to create volume",
+        WRITEVOL:   "unable to write volume",
+        REVOKED:    "access revoked"
+    }
+};
+
+/*
+ * TODO: Eventually, our tools will need to support looking up disk formats by "model" rather than by raw disk size,
+ * because obviously multiple disk geometries can yield the same raw disk size.  For each conflict that arises, I'll
+ * probably create a fake (approximate) disk size entry above, and then create a mapping to that approximate size below.
+ */
+DiskAPI.MODELS = {
+    "RL01": 5242880,
+    "RL02": 10485760
+};
+
+DiskAPI.MBR = {
+    PARTITIONS: {
+        OFFSET:     0x1BE,
+        ENTRY: {
+            STATUS:         0x00,   // 0x80 if active
+            CHS_FIRST:      0x01,   // 3-byte CHS specifier
+            TYPE:           0x04,   // see TYPE.*
+            CHS_LAST:       0x05,   // 3-byte CHS specifier
+            LBA_FIRST:      0x08,
+            LBA_TOTAL:      0x0C,
+            LENGTH:         0x10
+        },
+        STATUS: {
+            ACTIVE:         0x80
+        },
+        TYPE: {
+            EMPTY:          0x00,
+            FAT12_PRIMARY:  0x01,   // DOS 2.0 and up (12-bit FAT)
+            FAT16_PRIMARY:  0x04    // DOS 3.0 and up (16-bit FAT)
+        }
+    },
+    SIG_OFFSET:     0x1FE,
+    SIGNATURE:      0xAA55          // to be clear, the low byte (at offset 0x1FE) is 0x55 and the high byte (at offset 0x1FF) is 0xAA
+};
+
+/*
+ * Boot sector offsets (and assorted constants) in DOS-compatible boot sectors (DOS 2.0 and up)
+ *
+ * WARNING: I've heard apocryphal stories about SIGNATURE being improperly reversed on some systems
+ * (ie, 0x55AA instead 0xAA55) -- perhaps by a dyslexic programmer -- so be careful out there.
+ */
+DiskAPI.BOOT = {
+    JMP_OPCODE:     0x000,      // 1 byte for a JMP opcode, followed by a 1 or 2-byte offset
+    OEM_STRING:     0x003,      // 8 bytes
+    SIG_OFFSET:     0x1FE,
+    SIGNATURE:      0xAA55      // to be clear, the low byte (at offset 0x1FE) is 0x55 and the high byte (at offset 0x1FF) is 0xAA
+};
+
+/*
+ * BIOS Parameter Block (BPB) offsets in DOS-compatible boot sectors (DOS 2.x and up)
+ *
+ * NOTE: DOS 2.x OEM documentation says that the words starting at offset 0x018 (TRACK_SECS, TOTAL_HEADS, and HIDDEN_SECS)
+ * are optional, but even the DOS 2.0 FORMAT utility initializes all three of those words.  There may be some OEM media out
+ * there with BPBs that are only valid up to offset 0x018, but I've not run across any media like that.
+ *
+ * DOS 3.20 added LARGE_SECS, but unfortunately, it was added as a 2-byte value at offset 0x01E.  DOS 3.31 decided
+ * to make both HIDDEN_SECS and LARGE_SECS 4-byte values, which meant that LARGE_SECS had to move from 0x01E to 0x020.
+ */
+DiskAPI.BPB = {
+    SECTOR_BYTES:   0x00B,      // 2 bytes: bytes per sector (eg, 0x200 or 512)
+    CLUSTER_SECS:   0x00D,      // 1 byte: sectors per cluster (eg, 1)
+    RESERVED_SECS:  0x00E,      // 2 bytes: reserved sectors; ie, # sectors preceding the first FAT--usually just the boot sector (eg, 1)
+    TOTAL_FATS:     0x010,      // 1 byte: FAT copies (eg, 2)
+    ROOT_DIRENTS:   0x011,      // 2 bytes: root directory entries (eg, 0x40 or 64) 0x40 * 0x20 = 0x800 (1 sector is 0x200 bytes, total of 4 sectors)
+    TOTAL_SECS:     0x013,      // 2 bytes: number of sectors (eg, 0x140 or 320); if zero, refer to LARGE_SECS
+    MEDIA_TYPE:     0x015,      // 1 byte: media type (see DiskAPI.FAT.MEDIA_*)
+    FAT_SECS:       0x016,      // 2 bytes: sectors per FAT (eg, 1)
+    TRACK_SECS:     0x018,      // 2 bytes: sectors per track (eg, 8)
+    TOTAL_HEADS:    0x01A,      // 2 bytes: number of heads (eg, 1)
+    HIDDEN_SECS:    0x01C,      // 2 bytes (DOS 2.x) or 4 bytes (DOS 3.31 and up): number of hidden sectors (always 0 for non-partitioned media)
+    LARGE_SECS:     0x020       // 4 bytes (DOS 3.31 and up): number of sectors if TOTAL_SECS is zero
+};
+
+/*
+ * Common (supported) diskette geometries.
+ *
+ * Each entry in GEOMETRIES is an array of values in "CHS" order:
+ *
+ *      [# cylinders, # heads, # sectors/track, # bytes/sector, media type]
+ *
+ * If the 4th value is omitted, the sector size is assumed to be 512.  The order of these "geometric" values mirrors
+ * the structure of our JSON-encoded disk images, which consist of an array of cylinders, each of which is an array of
+ * heads, each of which is an array of sector objects.
+ */
+DiskAPI.GEOMETRIES = {
+    163840:  [40,1,8,,0xFE],    // media type 0xFE: 40 cylinders, 1 head (single-sided),   8 sectors/track, ( 320 total sectors x 512 bytes/sector ==  163840)
+    184320:  [40,1,9,,0xFC],    // media type 0xFC: 40 cylinders, 1 head (single-sided),   9 sectors/track, ( 360 total sectors x 512 bytes/sector ==  184320)
+    327680:  [40,2,8,,0xFF],    // media type 0xFF: 40 cylinders, 2 heads (double-sided),  8 sectors/track, ( 640 total sectors x 512 bytes/sector ==  327680)
+    368640:  [40,2,9,,0xFD],    // media type 0xFD: 40 cylinders, 2 heads (double-sided),  9 sectors/track, ( 720 total sectors x 512 bytes/sector ==  368640)
+    737280:  [80,2,9,,0xF9],    // media type 0xF9: 80 cylinders, 2 heads (double-sided),  9 sectors/track, (1440 total sectors x 512 bytes/sector ==  737280)
+    1228800: [80,2,15,,0xF9],   // media type 0xF9: 80 cylinders, 2 heads (double-sided), 15 sectors/track, (2400 total sectors x 512 bytes/sector == 1228800)
+    1474560: [80,2,18,,0xF0],   // media type 0xF0: 80 cylinders, 2 heads (double-sided), 18 sectors/track, (2880 total sectors x 512 bytes/sector == 1474560)
+    2949120: [80,2,36,,0xF0],   // media type 0xF0: 80 cylinders, 2 heads (double-sided), 36 sectors/track, (5760 total sectors x 512 bytes/sector == 2949120)
+    /*
+     * The following are some common disk sizes and their CHS values, since missing or bogus MBR and/or BPB values
+     * might mislead us when attempting to determine the exact disk geometry.
+     */
+    10653696:[306,4,17],        // PC XT 10Mb hard drive (type 3)
+    21411840:[615,4,17],        // PC AT 20Mb hard drive (type 2)
+    /*
+     * Assorted DEC disk formats.
+     */
+    256256:  [77, 1,26,128],    // RX01 single-platter diskette: 77 tracks, 1 head, 26 sectors/track, 128 bytes/sector, for a total of 256256 bytes
+    2494464: [203,2,12,512],    // RK03 single-platter disk cartridge: 203 tracks, 2 heads, 12 sectors/track, 512 bytes/sector, for a total of 2494464 bytes
+    5242880: [256,2,40,256],    // RL01K single-platter disk cartridge: 256 tracks, 2 heads, 40 sectors/track, 256 bytes/sector, for a total of 5242880 bytes
+    10485760:[512,2,40,256]     // RL02K single-platter disk cartridge: 512 tracks, 2 heads, 40 sectors/track, 256 bytes/sector, for a total of 10485760 bytes
+};
+
+/*
+ * Media descriptor bytes for DOS-compatible FAT-formatted disks (stored in the first byte of the FAT)
+ */
+DiskAPI.FAT = {
+    MEDIA_160KB:    0xFE,       // 5.25-inch, 1-sided,  8-sector, 40-track
+    MEDIA_180KB:    0xFC,       // 5.25-inch, 1-sided,  9-sector, 40-track
+    MEDIA_320KB:    0xFF,       // 5.25-inch, 2-sided,  8-sector, 40-track
+    MEDIA_360KB:    0xFD,       // 5.25-inch, 2-sided,  9-sector, 40-track
+    MEDIA_720KB:    0xF9,       //  3.5-inch, 2-sided,  9-sector, 80-track
+    MEDIA_1200KB:   0xF9,       //  3.5-inch, 2-sided, 15-sector, 80-track
+    MEDIA_FIXED:    0xF8,       // fixed disk (aka hard drive)
+    MEDIA_1440KB:   0xF0,       //  3.5-inch, 2-sided, 18-sector, 80-track
+    MEDIA_2880KB:   0xF0        //  3.5-inch, 2-sided, 36-sector, 80-track
+};
+
+/*
+ * Cluster constants for 12-bit FATs (CLUSNUM_FREE, CLUSNUM_RES and CLUSNUM_MIN are the same for all FATs)
+ */
+DiskAPI.FAT12 = {
+    MAX_CLUSTERS:   4084,
+    CLUSNUM_FREE:   0,          // this should NEVER appear in cluster chain (except at the start of an empty chain)
+    CLUSNUM_RES:    1,          // reserved; this should NEVER appear in cluster chain
+    CLUSNUM_MIN:    2,          // smallest valid cluster number
+    CLUSNUM_MAX:    0xFF6,      // largest valid cluster number
+    CLUSNUM_BAD:    0xFF7,      // bad cluster; this should NEVER appear in cluster chain
+    CLUSNUM_EOC:    0xFF8       // end of chain (actually, anything from 0xFF8-0xFFF indicates EOC)
+};
+
+/*
+ * Cluster constants for 16-bit FATs (CLUSNUM_FREE, CLUSNUM_RES and CLUSNUM_MIN are the same for all FATs)
+ */
+DiskAPI.FAT16 = {
+    MAX_CLUSTERS:   65524,
+    CLUSNUM_FREE:   0,          // this should NEVER appear in cluster chain (except at the start of an empty chain)
+    CLUSNUM_RES:    1,          // reserved; this should NEVER appear in cluster chain
+    CLUSNUM_MIN:    2,          // smallest valid cluster number
+    CLUSNUM_MAX:    0xFFF6,     // largest valid cluster number
+    CLUSNUM_BAD:    0xFFF7,     // bad cluster; this should NEVER appear in cluster chain
+    CLUSNUM_EOC:    0xFFF8      // end of chain (actually, anything from 0xFFF8-0xFFFF indicates EOC)
+};
+
+/*
+ * Directory Entry offsets (and assorted constants) in FAT disk images
+ *
+ * NOTE: Versions of DOS prior to 2.0 use INVALID exclusively to mark available directory entries; any entry marked
+ * UNUSED will actually be considered USED.  In DOS 2.0 and up, UNUSED was added to indicate that all remaining entries
+ * are unused, relieving it from having to initialize the rest of the sectors in the directory cluster(s).  And in fact,
+ * you WILL encounter garbage in subsequent directory sectors if you attempt to read past an UNUSED entry.
+ */
+DiskAPI.DIRENT = {
+    NAME:           0x000,      // 8 bytes
+    EXT:            0x008,      // 3 bytes
+    ATTR:           0x00B,      // 1 byte
+    MODTIME:        0x016,      // 2 bytes
+    MODDATE:        0x018,      // 2 bytes
+    CLUSTER:        0x01A,      // 2 bytes
+    SIZE:           0x01C,      // 4 bytes (typically zero for subdirectories)
+    LENGTH:         0x20,       // 32 bytes total
+    UNUSED:         0x00,       // indicates this and all subsequent directory entries are unused
+    INVALID:        0xE5        // indicates this directory entry is unused
+};
+
+/*
+ * Possible values for DIRENT.ATTR
+ */
+DiskAPI.ATTR = {
+    READONLY:       0x01,       // PC-DOS 2.0 and up
+    HIDDEN:         0x02,
+    SYSTEM:         0x04,
+    LABEL:          0x08,       // PC-DOS 2.0 and up
+    SUBDIR:         0x10,       // PC-DOS 2.0 and up
+    ARCHIVE:        0x20        // PC-DOS 2.0 and up
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/dumpapi.js (C) Jeff Parsons 2012-2017
+ */
+
+/*
+ * Our "DiskDump API", such as it was, used to look like:
+ *
+ *      http://jsmachines.net/bin/convdisk.php?disk=/disks/pc/dos/ibm/2.00/PCDOS200-DISK1.json&format=img
+ *
+ * To make it (a bit) more "REST-like", the above request now looks like:
+ *
+ *      http://www.pcjs.org/api/v1/dump?disk=/disks/pc/dos/ibm/2.00/PCDOS200-DISK1.json&format=img
+ *
+ * Similarly, our "FileDump API" used to look like:
+ *
+ *      http://jsmachines.net/bin/convrom.php?rom=/devices/pc/rom/5150/1981-04-24/PCBIOS-REV1.rom&format=json
+ *
+ * and that request now looks like:
+ *
+ *      http://www.pcjs.org/api/v1/dump?file=/devices/pc/rom/5150/1981-04-24/PCBIOS-REV1.rom&format=json
+ *
+ * I don't think it makes sense to avoid "query" parameters, because blending the path of a disk image with the
+ * the rest of the URL would be (a) confusing, and (b) more work to parse.
+ */
+var DumpAPI = {
+    ENDPOINT:       "/api/v1/dump",
+    QUERY: {
+        DIR:        "dir",      // value is path of a directory (DiskDump only)
+        DISK:       "disk",     // value is path of a disk image (DiskDump only)
+        FILE:       "file",     // value is path of a ROM image file (FileDump only)
+        IMG:        "img",      // alias for DISK
+        PATH:       "path",     // value is path of a one or more files (DiskDump only)
+        FORMAT:     "format",   // value is one of FORMAT values below
+        COMMENTS:   "comments", // value is either "true" or "false"
+        DECIMAL:    "decimal",  // value is either "true" to force all numbers to decimal, "false" or undefined otherwise
+        MBHD:       "mbhd",     // value is hard drive size in Mb (formerly "mbsize") (DiskDump only) (DEPRECATED)
+        SIZE:       "size"      // value is target disk size in Kb (supersedes "mbhd") (DiskDump only)
+    },
+    FORMAT: {
+        JSON:       "json",     // default
+        JSON_GZ:    "gz",       // gzip is currently used ONLY for compressed JSON
+        DATA:       "data",     // same as "json", but built without JSON.stringify() (DiskDump only)
+        HEX:        "hex",      // deprecated
+        OCTAL:      "octal",    // displays data as octal words
+        BYTES:      "bytes",    // displays data as hex bytes; normally used only when comments are enabled
+        WORDS:      "words",    // displays data as hex words; normally used only when comments are enabled
+        LONGS:      "longs",    // displays data as dwords
+        IMG:        "img",      // returns the raw disk data (ie, using a Buffer object) (DiskDump only)
+        ROM:        "rom"       // returns the raw file data (ie, using a Buffer object) (FileDump only)
+    }
+};
+
+/*
+ * Because we use an overloaded API endpoint (ie, one that's shared with the FileDump module), we must
+ * also provide a list of commands which, when combined with the endpoint, define a unique request.
+ */
+DumpAPI.asDiskCommands = [DumpAPI.QUERY.DIR, DumpAPI.QUERY.DISK, DumpAPI.QUERY.PATH];
+DumpAPI.asFileCommands = [DumpAPI.QUERY.FILE];
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/reportapi.js (C) Jeff Parsons 2012-2017
+ */
+
+var ReportAPI = {
+    ENDPOINT:       "/api/v1/report",
+    QUERY: {
+        APP:        "app",
+        VER:        "ver",
+        URL:        "url",
+        USER:       "user",
+        TYPE:       "type",
+        DATA:       "data"
+    },
+    TYPE: {
+        BUG:        "bug"
+    },
+    RES: {
+        OK:         "Thank you"
+    }
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/userapi.js (C) Jeff Parsons 2012-2017
+ */
+
+/*
+ * Examples of User API requests:
+ *
+ *      web.getHost() + UserAPI.ENDPOINT + '?' + UserAPI.QUERY.REQ + '=' + UserAPI.REQ.VERIFY + '&' + UserAPI.QUERY.USER + '=' + sUser;
+ */
+var UserAPI = {
+    ENDPOINT:       "/api/v1/user",
+    QUERY: {
+        REQ:        "req",      // specifies a request
+        USER:       "user",     // specifies a user ID
+        STATE:      "state",    // specifies a state ID
+        DATA:       "data"      // specifies state data
+    },
+    REQ: {
+        CREATE:     "create",   // creates a user ID
+        VERIFY:     "verify",   // requests verification of a user ID
+        STORE:      "store",    // stores a machine state on the server
+        LOAD:       "load"      // loads a machine state from the server
+    },
+    RES: {
+        CODE:       "code",
+        DATA:       "data"
+    },
+    CODE: {
+        OK:         "ok",
+        FAIL:       "error"
+    },
+    FAIL: {
+        DUPLICATE:  "user already exists",
+        VERIFY:     "unable to verify user",
+        BADSTATE:   "invalid state parameter",
+        NOSTATE:    "no machine state",
+        BADLOAD:    "unable to load machine state",
+        BADSTORE:   "unable to save machine state"
+    }
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/keys.js (C) Jeff Parsons 2012-2017
+ */
+
+var Keys = {
+    /*
+     * Keys and/or key combinations that generate common ASCII codes.
+     *
+     * NOTE: If you're looking for a general-purpose ASCII code table, see Str.ASCII in strlib.js;
+     * if something's missing, that's probably the more appropriate table to add it to.
+     *
+     * TODO: The Closure Compiler doesn't inline all references to these values, at least those with
+     * quoted property names, which is why I've 'unquoted' as many of them as possible.  One solution
+     * would be to add mnemonics for all of them, not just the non-printable ones (eg, SPACE instead
+     * of ' ', AMP instead of '&', etc.)
+     */
+    ASCII: {
+          BREAK:  0, CTRL_A:  1, CTRL_B:  2, CTRL_C:  3, CTRL_D:  4, CTRL_E:  5, CTRL_F:  6, CTRL_G:  7,
+         CTRL_H:  8, CTRL_I:  9, CTRL_J: 10, CTRL_K: 11, CTRL_L: 12, CTRL_M: 13, CTRL_N: 14, CTRL_O: 15,
+         CTRL_P: 16, CTRL_Q: 17, CTRL_R: 18, CTRL_S: 19, CTRL_T: 20, CTRL_U: 21, CTRL_V: 22, CTRL_W: 23,
+         CTRL_X: 24, CTRL_Y: 25, CTRL_Z: 26,
+            ' ': 32,    '!': 33,    '"': 34,    '#': 35,    '$': 36,    '%': 37,    '&': 38,    "'": 39,
+            '(': 40,    ')': 41,    '*': 42,    '+': 43,    ',': 44,    '-': 45,    '.': 46,    '/': 47,
+            '0': 48,    '1': 49,    '2': 50,    '3': 51,    '4': 52,    '5': 53,    '6': 54,    '7': 55,
+            '8': 56,    '9': 57,    ':': 58,    ';': 59,    '<': 60,    '=': 61,    '>': 62,    '?': 63,
+            '@': 64,     A:  65,     B:  66,     C:  67,     D:  68,     E:  69,     F:  70,     G:  71,
+             H:  72,     I:  73,     J:  74,     K:  75,     L:  76,     M:  77,     N:  78,     O:  79,
+             P:  80,     Q:  81,     R:  82,     S:  83,     T:  84,     U:  85,     V:  86,     W:  87,
+             X:  88,     Y:  89,     Z:  90,    '[': 91,    '\\':92,    ']': 93,    '^': 94,    '_': 95,
+            '`': 96,     a:  97,     b:  98,     c:  99,     d: 100,     e: 101,     f: 102,     g: 103,
+             h:  104,    i: 105,     j: 106,     k: 107,     l: 108,     m: 109,     n: 110,     o: 111,
+             p:  112,    q: 113,     r: 114,     s: 115,     t: 116,     u: 117,     v: 118,     w: 119,
+             x:  120,    y: 121,     z: 122,    '{':123,    '|':124,    '}':125,    '~':126,   DEL: 127
+    },
+    /*
+     * Browser keyCodes we must pay particular attention to.  For the most part, these are non-alphanumeric
+     * or function keys, some which may require special treatment (eg, preventDefault() if returning false on
+     * the initial keyDown event is insufficient).
+     *
+     * keyCodes for most common ASCII keys can simply use the appropriate ASCII code above.
+     *
+     * Most of these represent non-ASCII keys (eg, the LEFT arrow key), yet for some reason, browsers defined
+     * them using ASCII codes (eg, the LEFT arrow key uses the ASCII code for '%' or 37).
+     */
+    KEYCODE: {
+        /* 0x08 */ BS:          8,          // BACKSPACE        (ASCII.CTRL_H)
+        /* 0x09 */ TAB:         9,          // TAB              (ASCII.CTRL_I)
+        /* 0x0A */ LF:          10,         // LINE FEED        (ASCII.CTRL_J) (TODO: Determine if any key actually generates this)
+        /* 0x0D */ CR:          13,         // CARRIAGE RETURN  (ASCII.CTRL_M)
+        /* 0x10 */ SHIFT:       16,
+        /* 0x11 */ CTRL:        17,
+        /* 0x12 */ ALT:         18,
+        /* 0x13 */ PAUSE:       19,         // PAUSE/BREAK
+        /* 0x14 */ CAPS_LOCK:   20,
+        /* 0x1B */ ESC:         27,
+        /* 0x20 */ SPACE:       32,
+        /* 0x21 */ PGUP:        33,
+        /* 0x22 */ PGDN:        34,
+        /* 0x23 */ END:         35,
+        /* 0x24 */ HOME:        36,
+        /* 0x25 */ LEFT:        37,
+        /* 0x26 */ UP:          38,
+        /* 0x27 */ RIGHT:       39,
+        /* 0x27 */ FF_QUOTE:    39,
+        /* 0x28 */ DOWN:        40,
+        /* 0x2C */ FF_COMMA:    44,
+        /* 0x2C */ PRTSC:       44,
+        /* 0x2D */ INS:         45,
+        /* 0x2E */ DEL:         46,
+        /* 0x2E */ FF_PERIOD:   46,
+        /* 0x2F */ FF_SLASH:    47,
+        /* 0x30 */ ZERO:        48,
+        /* 0x31 */ ONE:         49,
+        /* 0x32 */ TWO:         50,
+        /* 0x33 */ THREE:       51,
+        /* 0x34 */ FOUR:        52,
+        /* 0x35 */ FIVE:        53,
+        /* 0x36 */ SIX:         54,
+        /* 0x37 */ SEVEN:       55,
+        /* 0x38 */ EIGHT:       56,
+        /* 0x39 */ NINE:        57,
+        /* 0x3B */ FF_SEMI:     59,
+        /* 0x3D */ FF_EQUALS:   61,
+        /* 0x5B */ CMD:         91,         // aka WIN
+        /* 0x5B */ FF_LBRACK:   91,
+        /* 0x5C */ FF_BSLASH:   92,
+        /* 0x5D */ RCMD:        93,         // aka MENU
+        /* 0x5D */ FF_RBRACK:   93,
+        /* 0x60 */ NUM_0:       96,
+        /* 0x60 */ NUM_INS:     96,
+        /* 0x60 */ FF_BQUOTE:   96,
+        /* 0x61 */ NUM_1:       97,
+        /* 0x61 */ NUM_END:     97,
+        /* 0x62 */ NUM_2:       98,
+        /* 0x62 */ NUM_DOWN:    98,
+        /* 0x63 */ NUM_3:       99,
+        /* 0x63 */ NUM_PGDN:    99,
+        /* 0x64 */ NUM_4:       100,
+        /* 0x64 */ NUM_LEFT:    100,
+        /* 0x65 */ NUM_5:       101,
+        /* 0x65 */ NUM_CENTER:  101,
+        /* 0x66 */ NUM_6:       102,
+        /* 0x66 */ NUM_RIGHT:   102,
+        /* 0x67 */ NUM_7:       103,
+        /* 0x67 */ NUM_HOME:    103,
+        /* 0x68 */ NUM_8:       104,
+        /* 0x68 */ NUM_UP:      104,
+        /* 0x69 */ NUM_9:       105,
+        /* 0x69 */ NUM_PGUP:    105,
+        /* 0x6A */ NUM_MUL:     106,
+        /* 0x6B */ NUM_ADD:     107,
+        /* 0x6D */ NUM_SUB:     109,
+        /* 0x6E */ NUM_DEL:     110,        // aka PERIOD
+        /* 0x6F */ NUM_DIV:     111,
+        /* 0x70 */ F1:          112,
+        /* 0x71 */ F2:          113,
+        /* 0x72 */ F3:          114,
+        /* 0x73 */ F4:          115,
+        /* 0x74 */ F5:          116,
+        /* 0x75 */ F6:          117,
+        /* 0x76 */ F7:          118,
+        /* 0x77 */ F8:          119,
+        /* 0x78 */ F9:          120,
+        /* 0x79 */ F10:         121,
+        /* 0x7A */ F11:         122,
+        /* 0x7B */ F12:         123,
+        /* 0x90 */ NUM_LOCK:    144,
+        /* 0x91 */ SCROLL_LOCK: 145,
+        /* 0xAD */ FF_DASH:     173,
+        /* 0xBA */ SEMI:        186,        // Firefox:  59 (FF_SEMI)
+        /* 0xBB */ EQUALS:      187,        // Firefox:  61 (FF_EQUALS)
+        /* 0xBC */ COMMA:       188,
+        /* 0xBD */ DASH:        189,        // Firefox: 173 (FF_DASH)
+        /* 0xBE */ PERIOD:      190,
+        /* 0xBF */ SLASH:       191,
+        /* 0xC0 */ BQUOTE:      192,
+        /* 0xDB */ LBRACK:      219,
+        /* 0xDC */ BSLASH:      220,
+        /* 0xDD */ RBRACK:      221,
+        /* 0xDE */ QUOTE:       222,
+        /* 0xE0 */ FF_CMD:      224,        // Firefox only (used for both CMD and RCMD)
+        //
+        // The following biases use what I'll call Decimal Coded Binary or DCB (the opposite of BCD),
+        // where the thousands digit is used to store the sum of "binary" digits 1 and/or 2 and/or 4.
+        //
+        // Technically, that makes it DCO (Decimal Coded Octal), but then again, BCD should have really
+        // been called HCD (Hexadecimal Coded Decimal), so if "they" can take liberties, so can I.
+        //
+        // ONDOWN is a bias we add to browser keyCodes that we want to handle on "down" rather than on "press".
+        //
+        ONDOWN:                 1000,
+        //
+        // ONRIGHT is a bias we add to browser keyCodes that need to check for a "right" location (default is "left")
+        //
+        ONRIGHT:                2000,
+        //
+        // FAKE is a bias we add to signal these are fake keyCodes corresponding to internal keystroke combinations.
+        // The actual values are for internal use only and merely need to be unique and used consistently.
+        //
+        FAKE:                   4000
+    },
+    /*
+     * The set of values that a browser may store in the 'location' property of a keyboard event object
+     * which we also support.
+     */
+    LOCATION: {
+        LEFT:                   1,
+        RIGHT:                  2,
+        NUMPAD:                 3
+    }
+};
+
+/*
+ * Check the event object's 'location' property for a non-zero value for the following ONRIGHT keys.
+ */
+Keys.KEYCODE.NUM_CR = Keys.KEYCODE.CR + Keys.KEYCODE.ONRIGHT;
+
+
+/*
+ * Maps Firefox keyCodes to their more common keyCode counterparts; a number of entries in this table
+ * are no longer valid (if indeed they ever were), so they've been commented out.  It's likely that I
+ * simply extended this table to resolve additional differences in other browsers (ie, Opera), but without
+ * browser-specific checks, it's not safe to perform all the mappings shown below.
+ */
+Keys.FF_KEYCODES = {};
+Keys.FF_KEYCODES[Keys.KEYCODE.FF_SEMI]   = Keys.KEYCODE.SEMI;           //  59 -> 186
+Keys.FF_KEYCODES[Keys.KEYCODE.FF_EQUALS] = Keys.KEYCODE.EQUALS;         //  61 -> 187
+Keys.FF_KEYCODES[Keys.KEYCODE.FF_DASH]   = Keys.KEYCODE.DASH;           // 173 -> 189
+Keys.FF_KEYCODES[Keys.KEYCODE.FF_CMD]    = Keys.KEYCODE.CMD;            // 224 -> 91
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_COMMA]  = Keys.KEYCODE.COMMA;       //  44 -> 188
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_PERIOD] = Keys.KEYCODE.PERIOD;      //  46 -> 190
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_SLASH]  = Keys.KEYCODE.SLASH;       //  47 -> 191
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_BQUOTE] = Keys.KEYCODE.BQUOTE;      //  96 -> 192
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_LBRACK  = Keys.KEYCODE.LBRACK;      //  91 -> 219
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_BSLASH] = Keys.KEYCODE.BSLASH;      //  92 -> 220
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_RBRACK] = Keys.KEYCODE.RBRACK;      //  93 -> 221
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_QUOTE]  = Keys.KEYCODE.QUOTE;       //  39 -> 222
+
+/*
+ * Maps non-ASCII keyCodes to their ASCII counterparts
+ */
+Keys.NONASCII_KEYCODES = {};
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.FF_DASH] = Keys.ASCII['-'];         // 173 -> 45
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.SEMI]    = Keys.ASCII[';'];         // 186 -> 59
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.EQUALS]  = Keys.ASCII['='];         // 187 -> 61
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.DASH]    = Keys.ASCII['-'];         // 189 -> 45
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.COMMA]   = Keys.ASCII[','];         // 188 -> 44
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.PERIOD]  = Keys.ASCII['.'];         // 190 -> 46
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.SLASH]   = Keys.ASCII['/'];         // 191 -> 47
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.BQUOTE]  = Keys.ASCII['`'];         // 192 -> 96
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.LBRACK]  = Keys.ASCII['['];         // 219 -> 91
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.BSLASH]  = Keys.ASCII['\\'];        // 220 -> 92
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.RBRACK]  = Keys.ASCII[']'];         // 221 -> 93
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.QUOTE]   = Keys.ASCII["'"];         // 222 -> 39
+
+/*
+ * Maps unshifted keyCodes to their shifted counterparts; to be used when a shift-key is down.
+ * Alphabetic characters are handled in code, since they must also take CAPS_LOCK into consideration.
+ */
+Keys.SHIFTED_KEYCODES = {};
+Keys.SHIFTED_KEYCODES[Keys.ASCII['1']]     = Keys.ASCII['!'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['2']]     = Keys.ASCII['@'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['3']]     = Keys.ASCII['#'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['4']]     = Keys.ASCII['$'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['5']]     = Keys.ASCII['%'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['6']]     = Keys.ASCII['^'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['7']]     = Keys.ASCII['&'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['8']]     = Keys.ASCII['*'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['9']]     = Keys.ASCII['('];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['0']]     = Keys.ASCII[')'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.SEMI]   = Keys.ASCII[':'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.EQUALS] = Keys.ASCII['+'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.COMMA]  = Keys.ASCII['<'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.DASH]   = Keys.ASCII['_'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.PERIOD] = Keys.ASCII['>'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.SLASH]  = Keys.ASCII['?'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.BQUOTE] = Keys.ASCII['~'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.LBRACK] = Keys.ASCII['{'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.BSLASH] = Keys.ASCII['|'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.RBRACK] = Keys.ASCII['}'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.QUOTE]  = Keys.ASCII['"'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.FF_DASH]   = Keys.ASCII['_'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.FF_EQUALS] = Keys.ASCII['+'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.FF_SEMI]   = Keys.ASCII[':'];
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/strlib.js (C) Jeff Parsons 2012-2017
+ */
+
+class Str {
+    /**
+     * isValidInt(s, base)
+     *
+     * The built-in parseInt() function has the annoying feature of returning a partial value (ie,
+     * up to the point where it encounters an invalid character); eg, parseInt("foo", 16) returns 0xf.
+     *
+     * So it's best to use our own Str.parseInt() function, which will in turn use this function to
+     * validate the entire string.
+     *
+     * @param {string} s is the string representation of some number
+     * @param {number} [base] is the radix to use (default is 10); only 2, 8, 10 and 16 are supported
+     * @return {boolean} true if valid, false if invalid (or the specified base isn't supported)
+     */
+    static isValidInt(s, base)
+    {
+        if (!base || base == 10) return s.match(/^-?[0-9]+$/) !== null;
+        if (base == 16) return s.match(/^-?[0-9a-f]+$/i) !== null;
+        if (base == 8) return s.match(/^-?[0-7]+$/) !== null;
+        if (base == 2) return s.match(/^-?[01]+$/) !== null;
+        return false;
+    }
+
+    /**
+     * parseInt(s, base)
+     *
+     * This is a wrapper around the built-in parseInt() function.  Our wrapper recognizes certain prefixes
+     * ('$' or "0x" for hex, '#' or "0o" for octal) and suffixes ('.' for decimal, 'h' for hex, 'y' for
+     * binary), and then calls isValidInt() to ensure we don't convert strings that contain partial values;
+     * see isValidInt() for details.
+     *
+     * The use of multiple prefix/suffix combinations is undefined (although for the record, we process
+     * prefixes first).  We do NOT support the "0b" prefix to indicate binary UNLESS one or more commas are
+     * also present (because "0b" is also a valid hex sequence), and we do NOT support a single leading zero
+     * to indicate octal (because such a number could also be decimal or hex).  Any number of commas are
+     * allowed; we remove them all before calling the built-in parseInt().
+     *
+     * More recently, we've added support for "^D", "^O", and "^B" prefixes to accommodate the base overrides
+     * that the PDP-10's MACRO-10 assembly language supports (decimal, octal, and binary, respectively).
+     * If this support turns out to adversely affect other debuggers, then it will have to be "conditionalized".
+     * Similarly, we've added support for "K", "M", and "G" MACRO-10-style suffixes that add 3, 6, or 9 zeros
+     * to the value to be parsed, respectively.
+     *
+     * @param {string} s is the string representation of some number
+     * @param {number} [base] is the radix to use (default is 10); can be overridden by prefixes/suffixes
+     * @return {number|undefined} corresponding value, or undefined if invalid
+     */
+    static parseInt(s, base)
+    {
+        var value;
+
+        if (s) {
+            if (!base) base = 10;
+
+            var ch, chPrefix, chSuffix;
+            var fCommas = (s.indexOf(',') > 0);
+            if (fCommas) s = s.replace(/,/g, '');
+
+            ch = chPrefix = s.charAt(0);
+            if (chPrefix == '#') {
+                base = 8;
+                chPrefix = '';
+            }
+            else if (chPrefix == '$') {
+                base = 16;
+                chPrefix = '';
+            }
+            if (ch != chPrefix) {
+                s = s.substr(1);
+            }
+            else {
+                ch = chPrefix = s.substr(0, 2);
+                if (chPrefix == '0b' && fCommas || chPrefix == '^B') {
+                    base = 2;
+                    chPrefix = '';
+                }
+                else if (chPrefix == '0o' || chPrefix == '^O') {
+                    base = 8;
+                    chPrefix = '';
+                }
+                else if (chPrefix == '^D') {
+                    base = 10;
+                    chPrefix = '';
+                }
+                else if (chPrefix == '0x') {
+                    base = 16;
+                    chPrefix = '';
+                }
+                if (ch != chPrefix) s = s.substr(2);
+            }
+            ch = chSuffix = s.slice(-1);
+            if (chSuffix == 'Y' || chSuffix == 'y') {
+                base = 2;
+                chSuffix = '';
+            }
+            else if (chSuffix == '.') {
+                base = 10;
+                chSuffix = '';
+            }
+            else if (chSuffix == 'H' || chSuffix == 'h') {
+                base = 16;
+                chSuffix = '';
+            }
+            else if (chSuffix == 'K') {
+                chSuffix = '000';
+            }
+            else if (chSuffix == 'M') {
+                chSuffix = '000000';
+            }
+            else if (chSuffix == 'G') {
+                chSuffix = '000000000';
+            }
+            if (ch != chSuffix) s = s.slice(0, -1) + chSuffix;
+            /*
+             * This adds support for the MACRO-10 binary shifting (Bn) suffix, which must be stripped from the
+             * number before parsing, and then applied to the value after parsing.  If n is omitted, 35 is assumed,
+             * which is a net shift of zero.  If n < 35, then a left shift of (35 - n) is required; if n > 35, then
+             * a right shift of -(35 - n) is required.
+             */
+            var v, shift = 0;
+            if (base <= 10) {
+                var match = s.match(/(-?[0-9]+)B([0-9]*)/);
+                if (match) {
+                    s = match[1];
+                    shift = 35 - ((match[2] || 35) & 0xff);
+                }
+            }
+            if (Str.isValidInt(s, base) && !isNaN(v = parseInt(s, base))) {
+                /*
+                 * With the need to support larger (eg, 36-bit) integers, truncating to 32 bits is no longer helpful.
+                 *
+                 *      value = v|0;
+                 */
+                if (shift) {
+                    /*
+                     * Since binary shifting is a logical operation, and since shifting by division only works properly
+                     * with positive numbers, we must convert a negative value to a positive value, by computing the two's
+                     * complement.
+                     */
+                    if (v < 0) v += Math.pow(2, 36);
+                    if (shift > 0) {
+                        v *= Math.pow(2, shift);
+                    } else {
+                        v = Math.trunc(v / Math.pow(2, -shift));
+                    }
+                }
+                value = v;
+            }
+        }
+        return value;
+    }
+
+    /**
+     * toBase(n, radix, cch, sPrefix, nGrouping)
+     *
+     * Displays the given number as an unsigned integer using the specified radix and number of digits.
+     *
+     * @param {number|null|undefined} n
+     * @param {number} radix (ie, the base)
+     * @param {number} cch (the desired number of digits)
+     * @param {string} [sPrefix] (default is none)
+     * @param {number} [nGrouping]
+     * @return {string}
+     */
+    static toBase(n, radix, cch, sPrefix = "", nGrouping = 0)
+    {
+        /*
+         * An initial "falsey" check for null takes care of both null and undefined;
+         * we can't rely entirely on isNaN(), because isNaN(null) returns false, oddly enough.
+         *
+         * Alternatively, we could mask and shift n regardless of whether it's null/undefined/NaN,
+         * since JavaScript coerces such operands to zero, but I think there's "value" in seeing those
+         * values displayed differently.
+         */
+        var s = "";
+        if (isNaN(n)) {
+            n = null;
+        } else if (n != null) {
+            /*
+             * Callers that produced an input by dividing by a power of two rather than shifting (in order
+             * to access more than 32 bits) may produce a fractional result, which ordinarily we would simply
+             * ignore, but if the integer portion is zero and the sign is negative, we should probably treat
+             * this value as a sign-extension.
+             */
+            if (n < 0 && n > -1) n = -1;
+            /*
+             * Negative values should be two's complemented according to the number of digits; for example,
+             * 12 octal digits implies an upper limit 8^12.
+             */
+            if (n < 0) {
+                n += Math.pow(radix, cch);
+            }
+            if (n >= Math.pow(radix, cch)) {
+                cch = Math.ceil(Math.log(n) / Math.log(radix));
+            }
+        }
+        var g = nGrouping || -1;
+        while (cch-- > 0) {
+            if (!g) {
+                s = ',' + s;
+                g = nGrouping;
+            }
+            if (n == null) {
+                s = '?' + s;
+            } else {
+                var d = n % radix;
+                d += (d >= 0 && d <= 9? 0x30 : 0x41 - 10);
+                s = String.fromCharCode(d) + s;
+                n = Math.trunc(n / radix);
+            }
+            g--;
+        }
+        return sPrefix + s;
+    }
+
+    /**
+     * toBin(n, cch, nGrouping)
+     *
+     * Converts an integer to binary, with the specified number of digits (up to a maximum of 36).
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of binary digits (0 or undefined for default of either 8, 18, or 36)
+     * @param {number} [nGrouping]
+     * @return {string} the binary representation of n
+     */
+    static toBin(n, cch, nGrouping)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.LN2) || 1;
+            var v = Math.abs(n);
+            if (v <= 0b11111111) {
+                cch = 8;
+            } else if (v <= 0b111111111111111111) {
+                cch = 18;
+            } else {
+                cch = 36;
+            }
+        } else if (cch > 36) cch = 36;
+        return Str.toBase(n, 2, cch, "", nGrouping);
+    }
+
+    /**
+     * toBinBytes(n, cb, fPrefix)
+     *
+     * Converts an integer to binary, with the specified number of bytes (up to the default of 4).
+     *
+     * @param {number|null|undefined} n (interpreted as a 32-bit value)
+     * @param {number} [cb] is the desired number of binary bytes (4 is both the default and the maximum)
+     * @param {boolean} [fPrefix]
+     * @return {string} the binary representation of n
+     */
+    static toBinBytes(n, cb, fPrefix)
+    {
+        var s = "";
+        if (!cb || cb > 4) cb = 4;
+        for (var i = 0; i < cb; i++) {
+            if (s) s = ',' + s;
+            s = Str.toBin(n & 0xff, 8) + s;
+            n >>= 8;
+        }
+        return (fPrefix? "0b" : "") + s;
+    }
+
+    /**
+     * toOct(n, cch, fPrefix)
+     *
+     * Converts an integer to octal, with the specified number of digits (default of 6; max of 12)
+     *
+     * You might be tempted to use the built-in n.toString(8) instead, but it doesn't zero-pad and it
+     * doesn't properly convert negative values.  Moreover, if n is undefined, n.toString() will throw
+     * an exception, whereas this function will return '?' characters.
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of octal digits (0 or undefined for default of either 6, 8, or 12)
+     * @param {boolean} [fPrefix]
+     * @return {string} the octal representation of n
+     */
+    static toOct(n, cch, fPrefix)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.log(8)) || 1;
+            var v = Math.abs(n);
+            if (v <= 0o777777) {
+                cch = 6;
+            } else if (v <= 0o77777777) {
+                cch = 8;
+            } else {
+                cch = 12;
+            }
+        } else if (cch > 12) cch = 12;
+        return Str.toBase(n, 8, cch, fPrefix? "0o" : "");
+    }
+
+    /**
+     * toDec(n, cch)
+     *
+     * Converts an integer to decimal, with the specified number of digits (default of 5; max of 11)
+     *
+     * You might be tempted to use the built-in n.toString(10) instead, but it doesn't zero-pad and it
+     * doesn't properly convert negative values.  Moreover, if n is undefined, n.toString() will throw
+     * an exception, whereas this function will return '?' characters.
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of decimal digits (0 or undefined for default of either 5 or 11)
+     * @return {string} the decimal representation of n
+     */
+    static toDec(n, cch)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.LN10) || 1;
+            var v = Math.abs(n);
+            if (v <= 99999) {
+                cch = 5;
+            } else {
+                cch = 11;
+            }
+        } else if (cch > 11) cch = 11;
+        return Str.toBase(n, 10, cch);
+    }
+
+    /**
+     * toHex(n, cch, fPrefix)
+     *
+     * Converts an integer to hex, with the specified number of digits (default of 4 or 8, max of 9).
+     *
+     * You might be tempted to use the built-in n.toString(16) instead, but it doesn't zero-pad and it
+     * doesn't properly convert negative values; for example, if n is -2147483647, then n.toString(16)
+     * will return "-7fffffff" instead of "80000001".  Moreover, if n is undefined, n.toString() will
+     * throw an exception, whereas this function will return '?' characters.
+     *
+     * NOTE: The following work-around (adapted from code found on StackOverflow) would be another solution,
+     * taking care of negative values, zero-padding, and upper-casing, but not null/undefined/NaN values:
+     *
+     *      s = (n < 0? n + 0x100000000 : n).toString(16);
+     *      s = "00000000".substr(0, 8 - s.length) + s;
+     *      s = s.substr(0, cch).toUpperCase();
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of hex digits (0 or undefined for default of either 4, 8, or 9)
+     * @param {boolean} [fPrefix]
+     * @return {string} the hex representation of n
+     */
+    static toHex(n, cch, fPrefix)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.log(16)) || 1;
+            var v = Math.abs(n);
+            if (v <= 0xffff) {
+                cch = 4;
+            } else if (v <= 0xffffffff) {
+                cch = 8;
+            } else {
+                cch = 9;
+            }
+        } else if (cch > 9) cch = 9;
+        return Str.toBase(n, 16, cch, fPrefix? "0x" : "");
+    }
+
+    /**
+     * toHexByte(b)
+     *
+     * Alias for Str.toHex(b, 2, true)
+     *
+     * @param {number|null|undefined} b is a byte value
+     * @return {string} the hex representation of b
+     */
+    static toHexByte(b)
+    {
+        return Str.toHex(b, 2, true);
+    }
+
+    /**
+     * toHexWord(w)
+     *
+     * Alias for Str.toHex(w, 4, true)
+     *
+     * @param {number|null|undefined} w is a word (16-bit) value
+     * @return {string} the hex representation of w
+     */
+    static toHexWord(w)
+    {
+        return Str.toHex(w, 4, true);
+    }
+
+    /**
+     * toHexLong(l)
+     *
+     * Alias for Str.toHex(l, 8, true)
+     *
+     * @param {number|null|undefined} l is a dword (32-bit) value
+     * @return {string} the hex representation of w
+     */
+    static toHexLong(l)
+    {
+        return Str.toHex(l, 8, true);
+    }
+
+    /**
+     * getBaseName(sFileName, fStripExt)
+     *
+     * This is a poor-man's version of Node's path.basename(), which Node-only components should use instead.
+     *
+     * Note that if fStripExt is true, this strips ANY extension, whereas path.basename() strips the extension only
+     * if it matches the second parameter (eg, path.basename("/foo/bar/baz/asdf/quux.html", ".html") returns "quux").
+     *
+     * @param {string} sFileName
+     * @param {boolean} [fStripExt]
+     * @return {string}
+     */
+    static getBaseName(sFileName, fStripExt)
+    {
+        var sBaseName = sFileName;
+
+        var i = sFileName.lastIndexOf('/');
+        if (i >= 0) sBaseName = sFileName.substr(i + 1);
+
+        /*
+         * This next bit is a kludge to clean up names that are part of a URL that includes unsightly query parameters.
+         */
+        i = sBaseName.indexOf('&');
+        if (i > 0) sBaseName = sBaseName.substr(0, i);
+
+        if (fStripExt) {
+            i = sBaseName.lastIndexOf(".");
+            if (i > 0) {
+                sBaseName = sBaseName.substring(0, i);
+            }
+        }
+        return sBaseName;
+    }
+
+    /**
+     * getExtension(sFileName)
+     *
+     * This is a poor-man's version of Node's path.extname(), which Node-only components should use instead.
+     *
+     * Note that we EXCLUDE the period from the returned extension, whereas path.extname() includes it.
+     *
+     * @param {string} sFileName
+     * @return {string} the filename's extension (in lower-case and EXCLUDING the "."), or an empty string
+     */
+    static getExtension(sFileName)
+    {
+        var sExtension = "";
+        var i = sFileName.lastIndexOf(".");
+        if (i >= 0) {
+            sExtension = sFileName.substr(i + 1).toLowerCase();
+        }
+        return sExtension;
+    }
+
+    /**
+     * endsWith(s, sSuffix)
+     *
+     * @param {string} s
+     * @param {string} sSuffix
+     * @return {boolean} true if s ends with sSuffix, false if not
+     */
+    static endsWith(s, sSuffix)
+    {
+        return s.indexOf(sSuffix, s.length - sSuffix.length) !== -1;
+    }
+
+    /**
+     * escapeHTML(sHTML)
+     *
+     * @param {string} sHTML
+     * @return {string} with HTML entities "escaped", similar to PHP's htmlspecialchars()
+     */
+    static escapeHTML(sHTML)
+    {
+        return sHTML.replace(/[&<>"']/g, function(m)
+        {
+            return Str.aHTMLEscapeMap[m];
+        });
+    }
+
+    /**
+     * replaceAll(sFind, sReplace, s)
+     *
+     * @param {string} sFind
+     * @param {string} sReplace
+     * @param {string} s
+     * @return {string}
+     */
+    static replaceAll(sFind, sReplace, s)
+    {
+        var a = {};
+        a[sFind] = sReplace;
+        return Str.replaceArray(a, s);
+    }
+
+    /**
+     * replaceArray(a, s)
+     *
+     * @param {Object} a
+     * @param {string} s
+     * @return {string}
+     */
+    static replaceArray(a, s)
+    {
+        var sMatch = "";
+        for (var k in a) {
+            /*
+             * As noted in:
+             *
+             *      http://www.regexguru.com/2008/04/escape-characters-only-when-necessary/
+             *
+             * inside character classes, only backslash, caret, hyphen and the closing bracket need to be
+             * escaped.  And in fact, if you ensure that the closing bracket is first, the caret is not first,
+             * and the hyphen is last, you can avoid escaping those as well.
+             */
+            k = k.replace(/([\\[\]*{}().+?])/g, "\\$1");
+            sMatch += (sMatch? '|' : '') + k;
+        }
+        return s.replace(new RegExp('(' + sMatch + ')', "g"), function(m)
+        {
+            return a[m];
+        });
+    }
+
+    /**
+     * pad(s, cch, fPadLeft)
+     *
+     * NOTE: the maximum amount of padding currently supported is 40 spaces.
+     *
+     * @param {string} s is a string
+     * @param {number} cch is desired length
+     * @param {boolean} [fPadLeft] (default is padding on the right)
+     * @return {string} the original string (s) with spaces padding it to the specified length
+     */
+    static pad(s, cch, fPadLeft)
+    {
+        var sPadding = "                                        ";
+        return fPadLeft? (sPadding + s).slice(-cch) : (s + sPadding).slice(0, cch);
+    }
+
+    /**
+     * stripLeadingZeros(s, fPad)
+     *
+     * @param {string} s
+     * @param {boolean} [fPad]
+     * @return {string}
+     */
+    static stripLeadingZeros(s, fPad)
+    {
+        var cch = s.length;
+        s = s.replace(/^0+([0-9A-F]+)$/i, "$1");
+        if (fPad) s = Str.pad(s, cch, true);
+        return s;
+    }
+
+    /**
+     * trim(s)
+     *
+     * @param {string} s
+     * @return {string}
+     */
+    static trim(s)
+    {
+        if (String.prototype.trim) {
+            return s.trim();
+        }
+        return s.replace(/^\s+|\s+$/g, "");
+    }
+
+    /**
+     * toASCIICode(b)
+     *
+     * @param {number} b
+     * @return {string}
+     */
+    static toASCIICode(b)
+    {
+        var s;
+        if (b != Str.ASCII.CR && b != Str.ASCII.LF) {
+            s = Str.aASCIICodes[b];
+        }
+        if (s) {
+            s = '<' + s + '>';
+        } else {
+            s = String.fromCharCode(b);
+        }
+        return s;
+    }
+}
+
+Str.aHTMLEscapeMap = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#039;'
+};
+
+/*
+ * Future home of a general-purpose ASCII table.  TODO: Flesh it out.
+ */
+Str.ASCII = {
+    LF:     0x0A,
+    CR:     0x0D
+};
+
+/*
+ * Table for converting "unprintable" ASCII codes into mnemonics, to more clearly see what's being printed.
+ */
+Str.aASCIICodes = {
+    0x00:   "NUL",
+    0x01:   "SOH",      // (CTRL_A) Start of Heading
+    0x02:   "STX",      // (CTRL_B) Start of Text
+    0x03:   "ETX",      // (CTRL_C) End of Text
+    0x04:   "EOT",      // (CTRL_D) End of Transmission
+    0x05:   "ENQ",      // (CTRL_E) Enquiry
+    0x06:   "ACK",      // (CTRL_F) Acknowledge
+    0x07:   "BEL",      // (CTRL_G) Bell
+    0x08:   "BS",       // (CTRL_H) Backspace
+    0x09:   "TAB",      // (CTRL_I) Horizontal Tab
+    0x0A:   "LF",       // (CTRL_J) Line Feed (New Line)
+    0x0B:   "VT",       // (CTRL_K) Vertical Tab
+    0x0C:   "FF",       // (CTRL_L) Form Feed (New Page)
+    0x0D:   "CR",       // (CTRL_M) Carriage Return
+    0x0E:   "SO",       // (CTRL_N) Shift Out
+    0x0F:   "SI",       // (CTRL_O) Shift In
+    0x10:   "DLE",      // (CTRL_P) Data Link Escape
+    0x11:   "XON",      // (CTRL_Q) Device Control 1 (aka DC1)
+    0x12:   "DC2",      // (CTRL_R) Device Control 2
+    0x13:   "XOFF",     // (CTRL_S) Device Control 3 (aka DC3)
+    0x14:   "DC4",      // (CTRL_T) Device Control 4
+    0x15:   "NAK",      // (CTRL_U) Negative Acknowledge
+    0x16:   "SYN",      // (CTRL_V) Synchronous Idle
+    0x17:   "ETB",      // (CTRL_W) End of Transmission Block
+    0x18:   "CAN",      // (CTRL_X) Cancel
+    0x19:   "EM",       // (CTRL_Y) End of Medium
+    0x1A:   "SUB",      // (CTRL_Z) Substitute
+    0x1B:   "ESC",      // Escape
+    0x1C:   "FS",       // File Separator
+    0x1D:   "GS",       // Group Separator
+    0x1E:   "RS",       // Record Separator
+    0x1F:   "US"        // Unit Separator
+};
+
+Str.TYPES = {
+    NULL:       0,
+    BYTE:       1,
+    WORD:       2,
+    DWORD:      3,
+    NUMBER:     4,
+    STRING:     5,
+    BOOLEAN:    6,
+    OBJECT:     7,
+    ARRAY:      8
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/usrlib.js (C) Jeff Parsons 2012-2017
+ */
+
+/**
+ * @typedef {{
+ *  mask:       number,
+ *  shift:      number
+ * }}
+ */
+var BitField;
+
+/**
+ * @typedef {Object.<BitField>}
+ */
+var BitFields;
+
+class Usr {
+    /**
+     * binarySearch(a, v, fnCompare)
+     *
+     * @param {Array} a is an array
+     * @param {number|string|Array|Object} v
+     * @param {function((number|string|Array|Object), (number|string|Array|Object))} [fnCompare]
+     * @return {number} the index of matching entry if non-negative, otherwise the index of the insertion point
+     */
+    static binarySearch(a, v, fnCompare)
+    {
+        var left = 0;
+        var right = a.length;
+        var found = 0;
+        if (fnCompare === undefined) {
+            fnCompare = function(a, b)
+            {
+                return a > b ? 1 : a < b ? -1 : 0;
+            };
+        }
+        while (left < right) {
+            var middle = (left + right) >> 1;
+            var compareResult;
+            compareResult = fnCompare(v, a[middle]);
+            if (compareResult > 0) {
+                left = middle + 1;
+            } else {
+                right = middle;
+                found = !compareResult;
+            }
+        }
+        return found ? left : ~left;
+    }
+
+    /**
+     * binaryInsert(a, v, fnCompare)
+     *
+     * If element v already exists in array a, the array is unchanged (we don't allow duplicates); otherwise, the
+     * element is inserted into the array at the appropriate index.
+     *
+     * @param {Array} a is an array
+     * @param {number|string|Array|Object} v is the value to insert
+     * @param {function((number|string|Array|Object), (number|string|Array|Object))} [fnCompare]
+     */
+    static binaryInsert(a, v, fnCompare)
+    {
+        var index = Usr.binarySearch(a, v, fnCompare);
+        if (index < 0) {
+            a.splice(-(index + 1), 0, v);
+        }
+    }
+
+    /**
+     * getTimestamp()
+     *
+     * @return {string} timestamp containing the current date and time ("yyyy-mm-dd hh:mm:ss")
+     */
+    static getTimestamp()
+    {
+        var date = new Date();
+        var padNum = function(n)
+        {
+            return (n < 10 ? "0" : "") + n;
+        };
+        return date.getFullYear() + "-" + padNum(date.getMonth() + 1) + "-" + padNum(date.getDate()) + " " + padNum(date.getHours()) + ":" + padNum(date.getMinutes()) + ":" + padNum(date.getSeconds());
+    }
+
+    /**
+     * getMonthDays(nMonth, nYear)
+     *
+     * Note that if we're being called on behalf of the RTC, its year is always truncated to two digits (mod 100),
+     * so we have no idea what century the year 0 might refer to.  When using the normal leap-year formula, 0 fails
+     * the mod 100 test but passes the mod 400 test, so as far as the RTC is concerned, every century year is a leap
+     * year.  Since we're most likely dealing with the year 2000, that's fine, since 2000 was also a leap year.
+     *
+     * TODO: There IS a separate CMOS byte that's supposed to be set to CMOS_ADDR.CENTURY_DATE; it's always BCD,
+     * so theoretically it will contain values like 0x19 or 0x20 (for the 20th and 21st centuries, respectively), and
+     * we could add that as another parameter to this function, to improve the accuracy, but that would go beyond what
+     * a real RTC actually does.
+     *
+     * @param {number} nMonth (1-12)
+     * @param {number} nYear (normally a 4-digit year, but it may also be mod 100)
+     * @return {number} the maximum (1-based) day allowed for the specified month and year
+     */
+    static getMonthDays(nMonth, nYear)
+    {
+        var nDays = Usr.aMonthDays[nMonth - 1];
+        if (nDays == 28) {
+            if ((nYear % 4) === 0 && ((nYear % 100) || (nYear % 400) === 0)) {
+                nDays++;
+            }
+        }
+        return nDays;
+    }
+
+    /**
+     * formatDate(sFormat, date)
+     *
+     * @param {string} sFormat (eg, "F j, Y", "Y-m-d H:i:s")
+     * @param {Date} [date] (default is the current time)
+     * @return {string}
+     *
+     * Supported identifiers in sFormat include:
+     *
+     *      a:  lowercase ante meridiem and post meridiem (am or pm)
+     *      d:  day of the month, 2 digits with leading zeros (01,...,31)
+     *      g:  hour in 12-hour format, without leading zeros (1,...,12)
+     *      i:  minutes, with leading zeros (00,...,59)
+     *      j:  day of the month, without leading zeros (1,...,31)
+     *      l:  day of the week ("Sunday",...,"Saturday")
+     *      m:  month, with leading zeros (01,...,12)
+     *      s:  seconds, with leading zeros (00,...,59)
+     *      F:  month ("January",...,"December")
+     *      H:  hour in 24-hour format, with leading zeros (00,...,23)
+     *      Y:  year (eg, 2014)
+     *
+     * For more inspiration, see: http://php.net/manual/en/function.date.php
+     */
+    static formatDate(sFormat, date)
+    {
+        var sDate = "";
+        if (!date) date = new Date();
+        var iHour = date.getHours();
+        var iDay = date.getDate();
+        var iMonth = date.getMonth() + 1;
+        for (var i = 0; i < sFormat.length; i++) {
+            var ch;
+            switch ((ch = sFormat.charAt(i))) {
+            case 'a':
+                sDate += (iHour < 12 ? "am" : "pm");
+                break;
+            case 'd':
+                sDate += ('0' + iDay).slice(-2);
+                break;
+            case 'g':
+                sDate += (!iHour ? 12 : (iHour > 12 ? iHour - 12 : iHour));
+                break;
+            case 'i':
+                sDate += ('0' + date.getMinutes()).slice(-2);
+                break;
+            case 'j':
+                sDate += iDay;
+                break;
+            case 'l':
+                sDate += Usr.asDays[date.getDay()];
+                break;
+            case 'm':
+                sDate += ('0' + iMonth).slice(-2);
+                break;
+            case 's':
+                sDate += ('0' + date.getSeconds()).slice(-2);
+                break;
+            case 'F':
+                sDate += Usr.asMonths[iMonth - 1];
+                break;
+            case 'H':
+                sDate += ('0' + iHour).slice(-2);
+                break;
+            case 'Y':
+                sDate += date.getFullYear();
+                break;
+            default:
+                sDate += ch;
+                break;
+            }
+        }
+        return sDate;
+    }
+
+    /**
+     * defineBitFields(bfs)
+     *
+     * Prepares a bit field definition for use with getBitField() and setBitField(); eg:
+     *
+     *      var bfs = Usr.defineBitFields({num:20, count:8, btmod:1, type:3});
+     *
+     * The above defines a set of bit fields containing four fields: num (bits 0-19), count (bits 20-27), btmod (bit 28), and type (bits 29-31).
+     *
+     *      Usr.setBitField(bfs.num, n, 1);
+     *
+     * The above set bit field "bfs.num" in numeric variable "n" to the value 1.
+     *
+     * @param {Object} bfs
+     * @return {BitFields}
+     */
+    static defineBitFields(bfs)
+    {
+        var bit = 0;
+        for (var f in bfs) {
+            var width = bfs[f];
+            var mask = ((1 << width) - 1) << bit;
+            bfs[f] = {mask: mask, shift: bit};
+            bit += width;
+        }
+        return bfs;
+    }
+
+    /**
+     * initBitFields(bfs, ...)
+     *
+     * @param {BitFields} bfs
+     * @param {...number} var_args
+     * @return {number} a value containing all supplied bit fields
+     */
+    static initBitFields(bfs, var_args)
+    {
+        var v = 0, i = 1;
+        for (var f in bfs) {
+            if (i >= arguments.length) break;
+            v = Usr.setBitField(bfs[f], v, arguments[i++]);
+        }
+        return v;
+    }
+
+    /**
+     * getBitField(bf, v)
+     *
+     * @param {BitField} bf
+     * @param {number} v is a value containing bit fields
+     * @return {number} the value of the bit field in v defined by bf
+     */
+    static getBitField(bf, v)
+    {
+        return (v & bf.mask) >> bf.shift;
+    }
+
+    /**
+     * setBitField(bf, v, n)
+     *
+     * @param {BitField} bf
+     * @param {number} v is a value containing bit fields
+     * @param {number} n is a value to store in v in the bit field defined by bf
+     * @return {number} updated v
+     */
+    static setBitField(bf, v, n)
+    {
+        return (v & ~bf.mask) | ((n << bf.shift) & bf.mask);
+    }
+
+    /**
+     * indexOf(a, t, i)
+     *
+     * Use this instead of Array.prototype.indexOf() if you can't be sure the browser supports it.
+     *
+     * @param {Array} a
+     * @param {*} t
+     * @param {number} [i]
+     * @returns {number}
+     */
+    static indexOf(a, t, i)
+    {
+        if (Array.prototype.indexOf) {
+            return a.indexOf(t, i);
+        }
+        i = i || 0;
+        if (i < 0) i += a.length;
+        if (i < 0) i = 0;
+        for (var n = a.length; i < n; i++) {
+            if (i in a && a[i] === t) return i;
+        }
+        return -1;
+    }
+}
+
+Usr.asDays = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
+Usr.asMonths = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
+Usr.aMonthDays = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+
+/**
+ * getTime()
+ *
+ * @return {number} the current time, in milliseconds
+ */
+Usr.getTime = Date.now || function() { return +new Date(); };
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/weblib.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * According to http://www.w3schools.com/jsref/jsref_obj_global.asp, these are the *global* properties
+ * and functions of JavaScript-in-the-Browser:
+ *
+ * Property             Description
+ * ---
+ * Infinity             A numeric value that represents positive/negative infinity
+ * NaN                  "Not-a-Number" value
+ * undefined            Indicates that a variable has not been assigned a value
+ *
+ * Function             Description
+ * ---
+ * decodeURI()          Decodes a URI
+ * decodeURIComponent() Decodes a URI component
+ * encodeURI()          Encodes a URI
+ * encodeURIComponent() Encodes a URI component
+ * escape()             Deprecated in version 1.5. Use encodeURI() or encodeURIComponent() instead
+ * eval()               Evaluates a string and executes it as if it was script code
+ * isFinite()           Determines whether a value is a finite, legal number
+ * isNaN()              Determines whether a value is an illegal number
+ * Number()             Converts an object's value to a number
+ * parseFloat()         Parses a string and returns a floating point number
+ * parseInt()           Parses a string and returns an integer
+ * String()             Converts an object's value to a string
+ * unescape()           Deprecated in version 1.5. Use decodeURI() or decodeURIComponent() instead
+ *
+ * And according to http://www.w3schools.com/jsref/obj_window.asp, these are the properties and functions
+ * of the *window* object.
+ *
+ * Property             Description
+ * ---
+ * closed               Returns a Boolean value indicating whether a window has been closed or not
+ * defaultStatus        Sets or returns the default text in the statusbar of a window
+ * document             Returns the Document object for the window (See Document object)
+ * frames               Returns an array of all the frames (including iframes) in the current window
+ * history              Returns the History object for the window (See History object)
+ * innerHeight          Returns the inner height of a window's content area
+ * innerWidth           Returns the inner width of a window's content area
+ * length               Returns the number of frames (including iframes) in a window
+ * location             Returns the Location object for the window (See Location object)
+ * name                 Sets or returns the name of a window
+ * navigator            Returns the Navigator object for the window (See Navigator object)
+ * opener               Returns a reference to the window that created the window
+ * outerHeight          Returns the outer height of a window, including toolbars/scrollbars
+ * outerWidth           Returns the outer width of a window, including toolbars/scrollbars
+ * pageXOffset          Returns the pixels the current document has been scrolled (horizontally) from the upper left corner of the window
+ * pageYOffset          Returns the pixels the current document has been scrolled (vertically) from the upper left corner of the window
+ * parent               Returns the parent window of the current window
+ * screen               Returns the Screen object for the window (See Screen object)
+ * screenLeft           Returns the x coordinate of the window relative to the screen
+ * screenTop            Returns the y coordinate of the window relative to the screen
+ * screenX              Returns the x coordinate of the window relative to the screen
+ * screenY              Returns the y coordinate of the window relative to the screen
+ * self                 Returns the current window
+ * status               Sets or returns the text in the statusbar of a window
+ * top                  Returns the topmost browser window
+ *
+ * Method               Description
+ * ---
+ * alert()              Displays an alert box with a message and an OK button
+ * atob()               Decodes a base-64 encoded string
+ * blur()               Removes focus from the current window
+ * btoa()               Encodes a string in base-64
+ * clearInterval()      Clears a timer set with setInterval()
+ * clearTimeout()       Clears a timer set with setTimeout()
+ * close()              Closes the current window
+ * confirm()            Displays a dialog box with a message and an OK and a Cancel button
+ * createPopup()        Creates a pop-up window
+ * focus()              Sets focus to the current window
+ * moveBy()             Moves a window relative to its current position
+ * moveTo()             Moves a window to the specified position
+ * open()               Opens a new browser window
+ * print()              Prints the content of the current window
+ * prompt()             Displays a dialog box that prompts the visitor for input
+ * resizeBy()           Resizes the window by the specified pixels
+ * resizeTo()           Resizes the window to the specified width and height
+ * scroll()             This method has been replaced by the scrollTo() method.
+ * scrollBy()           Scrolls the content by the specified number of pixels
+ * scrollTo()           Scrolls the content to the specified coordinates
+ * setInterval()        Calls a function or evaluates an expression at specified intervals (in milliseconds)
+ * setTimeout()         Calls a function or evaluates an expression after a specified number of milliseconds
+ * stop()               Stops the window from loading
+ */
+
+class Web {
+    /**
+     * log(s, type)
+     *
+     * For diagnostic output only.  DEBUG must be true (or "--debug" specified via the command-line)
+     * for Component.log() to display anything.
+     *
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     */
+    static log(s, type)
+    {
+        Component.log(s, type);
+    }
+
+    /**
+     * notice(s, fPrintOnly, id)
+     *
+     * @param {string} s is the message text
+     * @param {boolean} [fPrintOnly]
+     * @param {string} [id] is the caller's ID, if any
+     */
+    static notice(s, fPrintOnly, id)
+    {
+        Component.notice(s, fPrintOnly, id);
+    }
+
+    /**
+     * getResource(sURL, dataPost, fAsync, done)
+     *
+     * Request the specified resource (sURL), and once the request is complete, notify done().
+     *
+     * If fAsync is true, a done() callback should ALWAYS be supplied; otherwise, you'll have no
+     * idea when the request is complete or what the response was.  done() is passed three parameters:
+     *
+     *      done(sURL, sResource, nErrorCode)
+     *
+     * If nErrorCode is zero, sResource should contain the requested data; otherwise, an error occurred.
+     *
+     * If dataPost is set to a string, that string can be used to control the response format;
+     * by default, the response format is plain text, but you can specify "bytes" to request arbitrary
+     * binary data, which should come back as a string of bytes.
+     *
+     * TODO: The "bytes" option works by calling overrideMimeType(), which was never a best practice.
+     * Instead, we should implement supported response types ("text" and "arraybuffer", at a minimum)
+     * by setting xmlHTTP.responseType to one of those values before calling xmlHTTP.send().
+     *
+     * @param {string} sURL
+     * @param {string|Object|null} [dataPost] for a POST request (default is a GET request)
+     * @param {boolean} [fAsync] is true for an asynchronous request
+     * @param {function(string,string,number)} [done]
+     * @return {Array|null} Array containing [sResource, nErrorCode], or null if no response yet
+     */
+    static getResource(sURL, dataPost, fAsync = false, done)
+    {
+        var nErrorCode = 0, sResource = null, response = null;
+
+        if (typeof resources == 'object' && (sResource = resources[sURL])) {
+            if (done) done(sURL, sResource, nErrorCode);
+            return [sResource, nErrorCode];
+        }
+        else if (fAsync && typeof resources == 'function') {
+            resources(sURL, function(sResource, nErrorCode)
+            {
+                if (done) done(sURL, sResource, nErrorCode);
+            });
+            return response;
+        }
+
+        if (DEBUG) {
+            /*
+             * The larger resources we put on archive.pcjs.org should also be available locally...
+             */
+            sURL = sURL.replace(/^http:\/\/archive.pcjs.org(\/.*)\/([^\/]*)$/, "$1/archive/$2");
+        }
+
+
+        var xmlHTTP = (window.XMLHttpRequest? new window.XMLHttpRequest() : new window.ActiveXObject("Microsoft.XMLHTTP"));
+        if (fAsync) {
+            xmlHTTP.onreadystatechange = function()
+            {
+                if (xmlHTTP.readyState === 4) {
+                    /*
+                     * The following line was recommended for WebKit, as a work-around to prevent the handler firing multiple
+                     * times when debugging.  Unfortunately, that's not the only XMLHttpRequest problem that occurs when
+                     * debugging, so I think the WebKit problem is deeper than that.  When we have multiple XMLHttpRequests
+                     * pending, any debugging activity means most of them simply get dropped on floor, so what may actually be
+                     * happening are mis-notifications rather than redundant notifications.
+                     *
+                     *      xmlHTTP.onreadystatechange = undefined;
+                     */
+                    sResource = xmlHTTP.responseText;
+                    /*
+                     * The normal "success" case is an HTTP status code of 200, but when testing with files loaded
+                     * from the local file system (ie, when using the "file:" protocol), we have to be a bit more "flexible".
+                     */
+                    if (xmlHTTP.status == 200 || !xmlHTTP.status && sResource.length && Web.getHostProtocol() == "file:") {
+                        if (MAXDEBUG) Web.log("xmlHTTP.onreadystatechange(" + sURL + "): returned " + sResource.length + " bytes");
+                    }
+                    else {
+                        nErrorCode = xmlHTTP.status || -1;
+                        Web.log("xmlHTTP.onreadystatechange(" + sURL + "): error code " + nErrorCode);
+                    }
+                    if (done) done(sURL, sResource, nErrorCode);
+                }
+            };
+        }
+
+        if (dataPost && typeof dataPost == "object") {
+            var sDataPost = "";
+            for (var p in dataPost) {
+                if (!dataPost.hasOwnProperty(p)) continue;
+                if (sDataPost) sDataPost += "&";
+                sDataPost += p + '=' + encodeURIComponent(dataPost[p]);
+            }
+            sDataPost = sDataPost.replace(/%20/g, '+');
+            if (MAXDEBUG) Web.log("Web.getResource(POST " + sURL + "): " + sDataPost.length + " bytes");
+            xmlHTTP.open("POST", sURL, fAsync);     // ensure that fAsync is a valid boolean (Internet Explorer xmlHTTP functions insist on it)
+            xmlHTTP.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
+            xmlHTTP.send(sDataPost);
+        } else {
+            if (MAXDEBUG) Web.log("Web.getResource(GET " + sURL + ")");
+            xmlHTTP.open("GET", sURL, fAsync);      // ensure that fAsync is a valid boolean (Internet Explorer xmlHTTP functions insist on it)
+            if (dataPost == "bytes") {
+                xmlHTTP.overrideMimeType("text/plain; charset=x-user-defined");
+            }
+            xmlHTTP.send();
+        }
+
+        if (!fAsync) {
+            sResource = xmlHTTP.responseText;
+            if (xmlHTTP.status == 200) {
+                if (MAXDEBUG) Web.log("Web.getResource(" + sURL + "): returned " + sResource.length + " bytes");
+            } else {
+                nErrorCode = xmlHTTP.status || -1;
+                Web.log("Web.getResource(" + sURL + "): error code " + nErrorCode);
+            }
+            if (done) done(sURL, sResource, nErrorCode);
+            response = [sResource, nErrorCode];
+        }
+        return response;
+    }
+
+    /**
+     * parseMemoryResource(sURL, sData)
+     *
+     * This converts a variety of JSON-style data streams into an Object with the following properties:
+     *
+     *      aBytes
+     *      aSymbols
+     *      addrLoad
+     *      addrExec
+     *
+     * If the source data contains a 'bytes' array, it's passed through to 'aBytes'; alternatively, if
+     * it contains a 'words' array, the values are converted from 16-bit to 8-bit and stored in 'aBytes',
+     * and if it contains a 'longs' array, the values are converted from 32-bit longs into bytes and
+     * stored in 'aBytes'.
+     *
+     * Alternatively, if the source data contains a 'data' array, we simply pass that through to the output
+     * object as:
+     *
+     *      aData
+     *
+     * @param {string} sURL
+     * @param {string} sData
+     * @return {Object|null} (resource)
+     */
+    static parseMemoryResource(sURL, sData)
+    {
+        var i;
+        var resource = {
+            aBytes: null,
+            aSymbols: null,
+            addrLoad: null,
+            addrExec: null
+        };
+
+        if (sData.charAt(0) == "[" || sData.charAt(0) == "{") {
+            try {
+                var a, ib, data;
+
+                if (sData.substr(0, 1) == "<") {    // if the "data" begins with a "<"...
+                    /*
+                     * Early server configs reported an error (via the nErrorCode parameter) if a tape URL was invalid,
+                     * but more recent server configs now display a somewhat friendlier HTML error page.  The downside,
+                     * however, is that the original error has been buried, and we've received "data" that isn't actually
+                     * tape data.  So if the data we've received appears to be "HTML-like", we treat it as an error message.
+                     */
+                    throw new Error(sData);
+                }
+
+                /*
+                 * TODO: IE9 is rather unfriendly and restrictive with regard to how much data it's willing to
+                 * eval().  In particular, the 10Mb disk image we use for the Windows 1.01 demo config fails in
+                 * IE9 with an "Out of memory" exception.  One work-around would be to chop the data into chunks
+                 * (perhaps one track per chunk, using regular expressions) and then manually re-assemble it.
+                 *
+                 * However, it turns out that using JSON.parse(sDiskData) instead of eval("(" + sDiskData + ")")
+                 * is a much easier fix. The only drawback is that we must first quote any unquoted property names
+                 * and remove any comments, because while eval() was cool with them, JSON.parse() is more particular;
+                 * the following RegExp replacements take care of those requirements.
+                 *
+                 * The use of hex values is something else that eval() was OK with, but JSON.parse() is not, and
+                 * while I've stopped using hex values in DumpAPI responses (at least when "format=json" is specified),
+                 * I can't guarantee they won't show up in "legacy" images, and there's no simple RegExp replacement
+                 * for transforming hex values into decimal values, so I cop out and fall back to eval() if I detect
+                 * any hex prefixes ("0x") in the sequence.  Ditto for error messages, which appear like so:
+                 *
+                 *      ["unrecognized disk path: test.img"]
+                 */
+                if (sData.indexOf("0x") < 0 && sData.indexOf("0o") < 0 && sData.substr(0, 2) != '["') {
+                    data = JSON.parse(sData.replace(/([a-z]+):/gm, '"$1":').replace(/\/\/[^\n]*/gm, ""));
+                } else {
+                    data = eval("(" + sData + ")");
+                }
+
+                resource.addrLoad = data['load'];
+                resource.addrExec = data['exec'];
+
+                if (a = data['bytes']) {
+                    resource.aBytes = a;
+                }
+                else if (a = data['words']) {
+                    /*
+                     * Convert all words into bytes
+                     */
+                    resource.aBytes = new Array(a.length * 2);
+                    for (i = 0, ib = 0; i < a.length; i++) {
+                        resource.aBytes[ib++] = a[i] & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 8) & 0xff;
+
+                    }
+                }
+                else if (a = data['longs']) {
+                    /*
+                     * Convert all dwords (longs) into bytes
+                     */
+                    resource.aBytes = new Array(a.length * 4);
+                    for (i = 0, ib = 0; i < a.length; i++) {
+                        resource.aBytes[ib++] = a[i] & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 8) & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 16) & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 24) & 0xff;
+                    }
+                }
+                else if (a = data['data']) {
+                    resource.aData = a;
+                }
+                else {
+                    resource.aBytes = data;
+                }
+
+                if (resource.aBytes) {
+                    if (!resource.aBytes.length) {
+                        Component.error("Empty resource: " + sURL);
+                        resource = null;
+                    }
+                    else if (resource.aBytes.length == 1) {
+                        Component.error(resource.aBytes[0]);
+                        resource = null;
+                    }
+                }
+                resource.aSymbols = data['symbols'];
+
+            } catch (e) {
+                Component.error("Resource data error (" + sURL + "): " + e.message);
+                resource = null;
+            }
+        }
+        else {
+            /*
+             * Parse the data manually; we assume it's a series of hex byte-values separated by whitespace.
+             */
+            var ab = [];
+            var sHexData = sData.replace(/\n/gm, " ").replace(/ +$/, "");
+            var asHexData = sHexData.split(" ");
+            for (i = 0; i < asHexData.length; i++) {
+                var n = parseInt(asHexData[i], 16);
+                if (isNaN(n)) {
+                    Component.error("Resource data error (" + sURL + "): invalid hex byte (" + asHexData[i] + ")");
+                    break;
+                }
+                ab.push(n & 0xff);
+            }
+            if (i == asHexData.length) resource.aBytes = ab;
+        }
+        return resource;
+    }
+
+    /**
+     * sendReport(sApp, sVer, sURL, sUser, sType, sReport, sHostName)
+     *
+     * Send a report (eg, bug report) to the server.
+     *
+     * @param {string} sApp (eg, "PCjs")
+     * @param {string} sVer (eg, "1.02")
+     * @param {string} sURL (eg, "/devices/pc/machine/5150/mda/64kb/machine.xml")
+     * @param {string} sUser (ie, the user key, if any)
+     * @param {string} sType (eg, "bug"); one of ReportAPI.TYPE.*
+     * @param {string} sReport (eg, unparsed state data)
+     * @param {string} [sHostName] (default is http://SITEHOST)
+     */
+    static sendReport(sApp, sVer, sURL, sUser, sType, sReport, sHostName)
+    {
+        var dataPost = {};
+        dataPost[ReportAPI.QUERY.APP] = sApp;
+        dataPost[ReportAPI.QUERY.VER] = sVer;
+        dataPost[ReportAPI.QUERY.URL] = sURL;
+        dataPost[ReportAPI.QUERY.USER] = sUser;
+        dataPost[ReportAPI.QUERY.TYPE] = sType;
+        dataPost[ReportAPI.QUERY.DATA] = sReport;
+        var sReportURL = (sHostName? sHostName : "http://" + SITEHOST) + ReportAPI.ENDPOINT;
+        Web.getResource(sReportURL, dataPost, true);
+    }
+
+    /**
+     * getHost()
+     *
+     * @return {string}
+     */
+    static getHost()
+    {
+        return ("http://" + (window? window.location.host : SITEHOST));
+    }
+
+    /**
+     * getHostURL()
+     *
+     * @return {string|null}
+     */
+    static getHostURL()
+    {
+        return (window? window.location.href : null);
+    }
+
+    /**
+     * getHostProtocol()
+     *
+     * @return {string}
+     */
+    static getHostProtocol()
+    {
+        return (window? window.location.protocol : "file:");
+    }
+
+    /**
+     * getUserAgent()
+     *
+     * @return {string}
+     */
+    static getUserAgent()
+    {
+        return (window? window.navigator.userAgent : "");
+    }
+
+    /**
+     * hasLocalStorage
+     *
+     * true if localStorage support exists, is enabled, and works; false otherwise
+     *
+     * @return {boolean}
+     */
+    static hasLocalStorage()
+    {
+        if (Web.fLocalStorage == null) {
+            var f = false;
+            if (window) {
+                try {
+                    window.localStorage.setItem(Web.sLocalStorageTest, Web.sLocalStorageTest);
+                    f = (window.localStorage.getItem(Web.sLocalStorageTest) == Web.sLocalStorageTest);
+                    window.localStorage.removeItem(Web.sLocalStorageTest);
+                } catch (e) {
+                    Web.logLocalStorageError(e);
+                    f = false;
+                }
+            }
+            Web.fLocalStorage = f;
+        }
+        return Web.fLocalStorage;
+    }
+
+    /**
+     * logLocalStorageError(e)
+     *
+     * @param {Error} e is an exception
+     */
+    static logLocalStorageError(e)
+    {
+        Web.log(e.message, "localStorage error");
+    }
+
+    /**
+     * getLocalStorageItem(sKey)
+     *
+     * Returns the requested key value, or null if the key does not exist, or undefined if localStorage is not available
+     *
+     * @param {string} sKey
+     * @return {string|null|undefined} sValue
+     */
+    static getLocalStorageItem(sKey)
+    {
+        var sValue;
+        if (window) {
+            try {
+                sValue = window.localStorage.getItem(sKey);
+            } catch (e) {
+                Web.logLocalStorageError(e);
+            }
+        }
+        return sValue;
+    }
+
+    /**
+     * setLocalStorageItem(sKey, sValue)
+     *
+     * @param {string} sKey
+     * @param {string} sValue
+     * @return {boolean} true if localStorage is available, false if not
+     */
+    static setLocalStorageItem(sKey, sValue)
+    {
+        try {
+            window.localStorage.setItem(sKey, sValue);
+            return true;
+        } catch (e) {
+            Web.logLocalStorageError(e);
+        }
+        return false;
+    }
+
+    /**
+     * removeLocalStorageItem(sKey)
+     *
+     * @param {string} sKey
+     */
+    static removeLocalStorageItem(sKey)
+    {
+        try {
+            window.localStorage.removeItem(sKey);
+        } catch (e) {
+            Web.logLocalStorageError(e);
+        }
+    }
+
+    /**
+     * getLocalStorageKeys()
+     *
+     * @return {Array}
+     */
+    static getLocalStorageKeys()
+    {
+        var a = [];
+        try {
+            for (var i = 0, c = window.localStorage.length; i < c; i++) {
+                a.push(window.localStorage.key(i));
+            }
+        } catch (e) {
+            Web.logLocalStorageError(e);
+        }
+        return a;
+    }
+
+    /**
+     * reloadPage()
+     */
+    static reloadPage()
+    {
+        if (window) window.location.reload();
+    }
+
+    /**
+     * isUserAgent(s)
+     *
+     * Check the browser's user-agent string for the given substring; "iOS" and "MSIE" are special values you can
+     * use that will match any iOS or MSIE browser, respectively (even IE11, in the case of "MSIE").
+     *
+     * 2013-11-06: In a questionable move, MSFT changed the user-agent reported by IE11 on Windows 8.1, eliminating
+     * the "MSIE" string (which MSDN calls a "version token"; see http://msdn.microsoft.com/library/ms537503.aspx);
+     * they say "public websites should rely on feature detection, rather than browser detection, in order to design
+     * their sites for browsers that don't support the features used by the website." So, in IE11, we get a user-agent
+     * that tries to fool apps into thinking the browser is more like WebKit or Gecko:
+     *
+     *      Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
+     *
+     * That's a nice idea, but in the meantime, they hosed the XSL transform code in embed.js, which contained
+     * some very critical browser-specific code; turning on IE's "Compatibility Mode" didn't help either, because
+     * that's a sledgehammer solution which restores the old user-agent string but also disables other features like
+     * HTML5 canvas support. As an interim solution, I'm treating any "MSIE" check as a check for either "MSIE" or
+     * "Trident".
+     *
+     * UPDATE: I've since found ways to make the code in embed.js more browser-agnostic, so for now, there's isn't
+     * any code that cares about "MSIE", but I've left the change in place, because I wouldn't be surprised if I'll
+     * need more IE-specific code in the future, perhaps for things like copy/paste functionality, or mouse capture.
+     *
+     * @param {string} s is a substring to search for in the user-agent; as noted above, "iOS" and "MSIE" are special values
+     * @return {boolean} is true if the string was found, false if not
+     */
+    static isUserAgent(s)
+    {
+        if (window) {
+            var userAgent = Web.getUserAgent();
+            /*
+             * Here's one case where we have to be careful with Component, because when isUserAgent() is called by
+             * the init code below, component.js hasn't been loaded yet.  The simple solution for now is to remove the call.
+             *
+             *      Web.log("agent: " + userAgent);
+             *
+             * And yes, it would be pointless to use the conditional (?) operator below, if not for the Google Closure
+             * Compiler (v20130823) failing to detect the entire expression as a boolean.
+             */
+            return s == "iOS" && !!userAgent.match(/(iPod|iPhone|iPad)/) && !!userAgent.match(/AppleWebKit/) || s == "MSIE" && !!userAgent.match(/(MSIE|Trident)/) || (userAgent.indexOf(s) >= 0);
+        }
+        return false;
+    }
+
+    /**
+     * isMobile()
+     *
+     * Check the browser's user-agent string for the substring "Mobi", as per Mozilla recommendation:
+     *
+     *      https://developer.mozilla.org/en-US/docs/Browser_detection_using_the_user_agent
+     *
+     * @return {boolean} is true if the browser appears to be a mobile (ie, non-desktop) web browser, false if not
+     */
+    static isMobile()
+    {
+        return Web.isUserAgent("Mobi");
+    }
+
+    /**
+     * getURLParm(sParm)
+     *
+     * @param {string} sParm
+     * @return {string|undefined}
+     */
+    static getURLParm(sParm)
+    {
+        if (!Web.parmsURL) {
+            Web.parmsURL = Web.parseURLParms();
+        }
+        return Web.parmsURL[sParm];
+    }
+
+    /**
+     * parseURLParms(sParms)
+     *
+     * @param {string} [sParms] containing the parameter portion of a URL (ie, after the '?')
+     * @return {Object} containing properties for each parameter found
+     */
+    static parseURLParms(sParms)
+    {
+        var aParms = {};
+        if (window) {       // an alternative to "if (typeof module === 'undefined')" if require("defines") was used
+            if (!sParms) {
+                /*
+                 * Note that window.location.href returns the entire URL, whereas window.location.search
+                 * returns only the parameters, if any (starting with the '?', which we skip over with a substr() call).
+                 */
+                sParms = window.location.search.substr(1);
+            }
+            var match;
+            var pl = /\+/g; // RegExp for replacing addition symbol with a space
+            var search = /([^&=]+)=?([^&]*)/g;
+            var decode = function(s)
+            {
+                return decodeURIComponent(s.replace(pl, " "));
+            };
+
+            while ((match = search.exec(sParms))) {
+                aParms[decode(match[1])] = decode(match[2]);
+            }
+        }
+        return aParms;
+    }
+
+    /**
+     * downloadFile(sData, sType, fBase64, sFileName)
+     *
+     * @param {string} sData
+     * @param {string} sType
+     * @param {boolean} [fBase64]
+     * @param {string} [sFileName]
+     */
+    static downloadFile(sData, sType, fBase64, sFileName)
+    {
+        var link = null, sAlert;
+        var sURI = "data:application/" + sType + (fBase64? ";base64" : "") + ",";
+
+        if (!Web.isUserAgent("Firefox")) {
+            sURI += (fBase64? sData : encodeURI(sData));
+        } else {
+            sURI += (fBase64? sData : encodeURIComponent(sData));
+        }
+        if (sFileName) {
+            link = document.createElement('a');
+            if (typeof link.download != 'string') link = null;
+        }
+        if (link) {
+            link.href = sURI;
+            link.download = sFileName;
+            document.body.appendChild(link);    // Firefox allegedly requires the link to be in the body
+            link.click();
+            document.body.removeChild(link);
+            sAlert = 'Check your Downloads folder for ' + sFileName + '.';
+        } else {
+            window.open(sURI);
+            sAlert = 'Check your browser for a new window/tab containing the requested data' + (sFileName? (' (' + sFileName + ')') : '') + '.';
+        }
+        return sAlert;
+    }
+
+    /**
+     * onCountRepeat(n, fnRepeat, fnComplete, msDelay)
+     *
+     * Call fnRepeat() n times with an msDelay millisecond delay between calls,
+     * then call fnComplete() when n has been exhausted OR fnRepeat() returns false.
+     *
+     * @param {number} n
+     * @param {function()} fnRepeat
+     * @param {function()} fnComplete
+     * @param {number} [msDelay]
+     */
+    static onCountRepeat(n, fnRepeat, fnComplete, msDelay)
+    {
+        var fnTimeout = function doCountRepeat()
+        {
+            n -= 1;
+            if (n >= 0) {
+                if (!fnRepeat()) n = 0;
+            }
+            if (n > 0) {
+                setTimeout(fnTimeout, msDelay || 0);
+                return;
+            }
+            fnComplete();
+        };
+        fnTimeout();
+    }
+
+    /**
+     * onClickRepeat(e, msDelay, msRepeat, fn)
+     *
+     * Repeatedly call fn() with an initial msDelay, and an msRepeat delay thereafter,
+     * as long as HTML control Object e has an active "down" event and fn() returns true.
+     *
+     * @param {Object} e
+     * @param {number} msDelay
+     * @param {number} msRepeat
+     * @param {function(boolean)} fn is passed false on the first call, true on all repeated calls
+     */
+    static onClickRepeat(e, msDelay, msRepeat, fn)
+    {
+        var ms = 0, timer = null, fIgnoreMouseEvents = false;
+
+        var fnRepeat = function doClickRepeat()
+        {
+            if (fn(ms === msRepeat)) {
+                timer = setTimeout(fnRepeat, ms);
+                ms = msRepeat;
+            }
+        };
+        e.onmousedown = function()
+        {
+            // Web.log("onMouseDown()");
+            if (!fIgnoreMouseEvents) {
+                if (!timer) {
+                    ms = msDelay;
+                    fnRepeat();
+                }
+            }
+        };
+        e.ontouchstart = function()
+        {
+            // Web.log("onTouchStart()");
+            if (!timer) {
+                ms = msDelay;
+                fnRepeat();
+            }
+        };
+        e.onmouseup = e.onmouseout = function()
+        {
+            // Web.log("onMouseUp()/onMouseOut()");
+            if (timer) {
+                clearTimeout(timer);
+                timer = null;
+            }
+        };
+        e.ontouchend = e.ontouchcancel = function()
+        {
+            // Web.log("onTouchEnd()/onTouchCancel()");
+            if (timer) {
+                clearTimeout(timer);
+                timer = null;
+            }
+            /*
+             * Devices that generate ontouch* events ALSO generate onmouse* events,
+             * and generally do so immediately after all the touch events are complete,
+             * so unless we want double the action, we need to ignore mouse events.
+             */
+            fIgnoreMouseEvents = true;
+        };
+    }
+
+    /**
+     * onPageEvent(sName, fn)
+     *
+     * For 'onload', 'onunload', and 'onpageshow' events, most callers should NOT use this function, but
+     * instead use Web.onInit(), Web.onShow(), and Web.onExit(), respectively.
+     *
+     * The only components that should still use onPageEvent() are THIS component (see the bottom of this file)
+     * and components that need to capture other events (eg, the 'onresize' event in the Video component).
+     *
+     * This function creates a chain of callbacks, allowing multiple JavaScript modules to define handlers
+     * for the same event, which wouldn't be possible if everyone modified window['onload'], window['onunload'],
+     * etc, themselves.  However, that's less of a concern now, because assuming everyone else is now using
+     * onInit(), onExit(), etc, then there really IS only one component setting the window callback: this one.
+     *
+     * NOTE: It's risky to refer to obscure event handlers with "dot" names, because the Closure Compiler may
+     * erroneously replace them (eg, window.onpageshow is a good example).
+     *
+     * @param {string} sFunc
+     * @param {function()} fn
+     */
+    static onPageEvent(sFunc, fn)
+    {
+        if (window) {
+            var fnPrev = window[sFunc];
+            if (typeof fnPrev !== 'function') {
+                window[sFunc] = fn;
+            } else {
+                /*
+                 * TODO: Determine whether there's any value in receiving/sending the Event object that the
+                 * browser provides when it generates the original event.
+                 */
+                window[sFunc] = function onWindowEvent()
+                {
+                    if (fnPrev) fnPrev();
+                    fn();
+                };
+            }
+        }
+    };
+
+    /**
+     * onInit(fn)
+     *
+     * Use this instead of setting window.onload.  Allows multiple JavaScript modules to define their own 'onload' event handler.
+     *
+     * @param {function()} fn
+     */
+    static onInit(fn)
+    {
+        Web.aPageEventHandlers['init'].push(fn);
+    };
+
+    /**
+     * onShow(fn)
+     *
+     * @param {function()} fn
+     *
+     * Use this instead of setting window.onpageshow.  Allows multiple JavaScript modules to define their own 'onpageshow' event handler.
+     */
+    static onShow(fn)
+    {
+        Web.aPageEventHandlers['show'].push(fn);
+    };
+
+    /**
+     * onExit(fn)
+     *
+     * @param {function()} fn
+     *
+     * Use this instead of setting window.onunload.  Allows multiple JavaScript modules to define their own 'onunload' event handler.
+     */
+    static onExit(fn)
+    {
+        Web.aPageEventHandlers['exit'].push(fn);
+    };
+
+    /**
+     * doPageEvent(afn)
+     *
+     * @param {Array.<function()>} afn
+     */
+    static doPageEvent(afn)
+    {
+        if (Web.fPageEventsEnabled) {
+            try {
+                for (var i = 0; i < afn.length; i++) {
+                    afn[i]();
+                }
+            } catch (e) {
+                Web.notice("An unexpected exception occurred:\n\n" + e.message + "\n\nPlease send this information to support@pcjs.org. Thanks.");
+            }
+        }
+    };
+
+    /**
+     * enablePageEvents(fEnable)
+     *
+     * @param {boolean} fEnable is true to enable page events, false to disable (they're enabled by default)
+     */
+    static enablePageEvents(fEnable)
+    {
+        if (!Web.fPageEventsEnabled && fEnable) {
+            Web.fPageEventsEnabled = true;
+            if (Web.fPageLoaded) Web.sendPageEvent('init');
+            if (Web.fPageShowed) Web.sendPageEvent('show');
+            return;
+        }
+        Web.fPageEventsEnabled = fEnable;
+    }
+
+    /**
+     * sendPageEvent(sEvent)
+     *
+     * This allows us to manually trigger page events.
+     *
+     * @param {string} sEvent (one of 'init', 'show' or 'exit')
+     */
+    static sendPageEvent(sEvent)
+    {
+        if (Web.aPageEventHandlers[sEvent]) {
+            Web.doPageEvent(Web.aPageEventHandlers[sEvent]);
+        }
+    }
+}
+
+Web.parmsURL = null;            // initialized on first call to parseURLParms()
+
+Web.aPageEventHandlers = {
+    'init': [],                 // list of window 'onload' handlers
+    'show': [],                 // list of window 'onpageshow' handlers
+    'exit': []                  // list of window 'onunload' handlers (although we prefer to use 'onbeforeunload' if possible)
+};
+
+Web.fPageLoaded = false;        // set once the page's first 'onload' event has occurred
+Web.fPageShowed = false;        // set once the page's first 'onpageshow' event has occurred
+Web.fPageEventsEnabled = true;  // default is true, set to false (or true) by enablePageEvents()
+
+/**
+ * fLocalStorage
+ *
+ * true if localStorage support exists, is enabled, and works; "falsey" otherwise
+ *
+ * @type {boolean|null}
+ */
+Web.fLocalStorage = null;
+
+/**
+ * TODO: Is there any way to get the Closure Compiler to stop inlining this string?  This isn't cutting it.
+ *
+ * @const {string}
+ */
+Web.sLocalStorageTest = "PCjs.localStorage";
+
+Web.onPageEvent('onload', function onPageLoad() {
+    Web.fPageLoaded = true;
+    Web.doPageEvent(Web.aPageEventHandlers['init']);
+});
+
+Web.onPageEvent('onpageshow', function onPageShow() {
+    Web.fPageShowed = true;
+    Web.doPageEvent(Web.aPageEventHandlers['show']);
+});
+
+Web.onPageEvent(Web.isUserAgent("Opera") || Web.isUserAgent("iOS")? 'onunload' : 'onbeforeunload', function onPageUnload() {
+    Web.doPageEvent(Web.aPageEventHandlers['exit']);
+});
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/component.js (C) Jeff Parsons 2012-2017
+ */
+
+/*
+ * All PCjs components now use JSDoc types, primarily so that Google's Closure Compiler will compile
+ * everything with zero warnings when ADVANCED_OPTIMIZATIONS are enabled.  For more information about
+ * the JSDoc types supported by the Closure Compiler:
+ *
+ *      https://developers.google.com/closure/compiler/docs/js-for-compiler#types
+ *
+ * I also attempted to validate this code with JSLint, but it complained too much; eg, it didn't like
+ * "while (true)", a tried and "true" programming convention for decades, and it wanted me to replace
+ * all "++" and "--" operators with "+= 1" and "-= 1", use "(s || '')" instead of "(s? s : '')", etc.
+ *
+ * I prefer sticking with traditional C-style idioms, in part because they are more portable.  That
+ * does NOT mean I'm trying to write "portable JavaScript," but some of this code was ported from C code
+ * I'd written long ago, so portability is good, and I'm not going to throw that away if there's no need.
+ *
+ * UPDATE: I've since switched from JSLint to JSHint, which seems to have more reasonable defaults.
+ * And for new code, I have adopted some popular JavaScript idioms, like "(s || '')", although the need
+ * for those kinds of expressions will be reduced as I also start adopting some ES6 features, like
+ * default parameters.
+ */
+
+
+/**
+ * Since the Closure Compiler treats ES6 classes as @struct rather than @dict by default,
+ * it deters us from defining named properties on our components; eg:
+ *
+ *      this['exports'] = {...}
+ *
+ * results in an error:
+ *
+ *      Cannot do '[]' access on a struct
+ *
+ * So, in order to define 'exports', we must override the @struct assumption by annotating
+ * the class as @unrestricted (or @dict).  Note that this must be done both here and in the
+ * subclass (eg, SerialPort), because otherwise the Compiler won't allow us to *reference*
+ * the named property either.
+ *
+ * TODO: Consider marking ALL our classes unrestricted, because otherwise it forces us to
+ * define every single property the class uses in its constructor, which results in a fair
+ * bit of redundant initialization, since many properties aren't (and don't need to be) fully
+ * initialized until the appropriate init(), reset(), restore(), etc. function is called.
+ *
+ * The upside, however, may be that since the structure of the class is completely defined by
+ * the constructor, JavaScript engines may be able to optimize and run more efficiently.
+ *
+ * @unrestricted
+ */
+class Component {
+    /**
+     * Component(type, parms, bitsMessage)
+     *
+     * A Component object requires:
+     *
+     *      type: a user-defined type name (eg, "CPU")
+     *
+     * and accepts any or all of the following (parms) properties:
+     *
+     *      id: component ID (default is "")
+     *      name: component name (default is ""; if blank, toString() will use the type name only)
+     *      comment: component comment string (default is undefined)
+     *
+     * Component subclasses will usually have additional (parms) properties.
+     *
+     * @param {string} type
+     * @param {Object} [parms]
+     * @param {number} [bitsMessage] selects message(s) that the component wants to enable (default is 0)
+     */
+    constructor(type, parms, bitsMessage)
+    {
+        this.type = type;
+
+        if (!parms) parms = {'id': "", 'name': ""};
+
+        this.id = parms['id'] || "";
+        this.name = parms['name'];
+        this.comment = parms['comment'];
+        this.parms = parms;
+
+        /*
+         * The following Component properties need to be accessible by other machines and/or command scripts;
+         * well, OK, or we could have exported some new functions to walk the contents of these properties, as we
+         * did with findMachineComponent(), but this works just as well.
+         *
+         * Also, while the double-assignment looks silly (ie, using both dot and bracket property notation), it
+         * resolves a complaint from the Closure Compiler, because if we use ONLY bracket notation here, then the
+         * Compiler wants us to change all the other references to bracket notation as well.
+         */
+        this.exports = this['exports'] = {};
+        this.bindings = this['bindings'] = {};
+
+        var i = this.id.indexOf('.');
+        if (i < 0) {
+            this.idComponent = this.id;
+        } else {
+            this.idMachine = this.id.substr(0, i);
+            this.idComponent = this.id.substr(i + 1);
+        }
+
+        /*
+         * Gather all the various component flags (booleans) into a single "flags" object, and encourage
+         * subclasses to do the same, to reduce the property clutter we have to wade through while debugging.
+         */
+        this.flags = {
+            ready:      false,
+            busy:       false,
+            busyCancel: false,
+            powered:    false,
+            error:      false
+        };
+
+        this.fnReady = null;
+        this.clearError();
+        this.bitsMessage = bitsMessage || 0;
+
+        /** @type {Object|null} controlPrint is the HTML control, if any, that we can print to */
+        this.controlPrint = null;
+
+        this.cmp = null;
+        this.bus = null;
+        this.cpu = null;
+        this.dbg = null;
+
+        /*
+         * TODO: Consider adding another parameter to the Component() constructor that allows components to tell
+         * us if they support single or multiple instances per machine.  For example, there can be multiple SerialPort
+         * components per machine, but only one CPU component (some machines also support an FPU, but that component
+         * is considered separate from the CPU).
+         *
+         * It's not critical, but it would help catch machine configuration errors; for example, a machine that mistakenly
+         * includes two CPU components may, aside from wasting memory, end up with odd side-effects, like unresponsive
+         * CPU controls.
+         */
+        Component.add(this);
+    }
+
+    /**
+     * Component.add(component)
+     *
+     * @param {Component} component
+     */
+    static add(component)
+    {
+        /*
+         * This just generates a lot of useless noise, handy in the early days, not so much these days....
+         *
+         *      if (DEBUG) Component.log("Component.add(" + component.type + "," + component.id + ")");
+         */
+        Component.components.push(component);
+    }
+
+    /**
+     * Component.addMachine(idMachine)
+     *
+     * @param {string} idMachine
+     */
+    static addMachine(idMachine)
+    {
+        Component.machines[idMachine] = {};
+    }
+
+    /**
+     * Component.addMachineResource(idMachine, sName, data)
+     *
+     * @param {string} idMachine
+     * @param {string|null} sName (name of the resource)
+     * @param {*} data
+     */
+    static addMachineResource(idMachine, sName, data)
+    {
+        /*
+         * I used to assert(Component.machines[idMachine]), but when we're running as a Node app, embed.js is not used,
+         * so addMachine() is never called, so resources do not need to be recorded.
+         */
+        if (Component.machines[idMachine] && sName) {
+            Component.machines[idMachine][sName] = data;
+        }
+    }
+
+    /**
+     * Component.getMachineResources(idMachine)
+     *
+     * @param {string} idMachine
+     * @return {Object|undefined}
+     */
+    static getMachineResources(idMachine)
+    {
+        return Component.machines[idMachine];
+    }
+
+    /**
+     * Component.getTime()
+     *
+     * @return {number} the current time, in milliseconds
+     */
+    static getTime()
+    {
+        return Date.now() || +new Date();
+    }
+
+    /**
+     * Component.log(s, type)
+     *
+     * For diagnostic output only.
+     *
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     */
+    static log(s, type)
+    {
+        if (!COMPILED) {
+            if (s) {
+                var sElapsed = "", sMsg = (type? (type + ": ") : "") + s;
+                if (typeof Usr != "undefined") {
+                    if (Component.msStart === undefined) {
+                        Component.msStart = Component.getTime();
+                    }
+                    sElapsed = (Component.getTime() - Component.msStart) + "ms: ";
+                }
+                if (window && window.console) console.log(sElapsed + sMsg.replace(/\n/g, " "));
+            }
+        }
+    }
+
+    /**
+     * Component.assert(f, s)
+     *
+     * Verifies conditions that must be true (for DEBUG builds only).
+     *
+     * The Closure Compiler should automatically remove all references to Component.assert() in non-DEBUG builds.
+     * TODO: Add a task to the build process that "asserts" there are no instances of "assertion failure" in RELEASE builds.
+     *
+     * @param {boolean} f is the expression we are asserting to be true
+     * @param {string} [s] is description of the assertion on failure
+     */
+    static assert(f, s)
+    {
+        if (DEBUG) {
+            if (!f) {
+                if (!s) s = "assertion failure";
+                Component.log(s);
+                throw new Error(s);
+            }
+        }
+    }
+
+    /**
+     * Component.println(s, type, id)
+     *
+     * For non-diagnostic messages, which components may override to control the destination/appearance of their output.
+     *
+     * Components that inherit from this class should use the instance method, this.println(), rather than Component.println(),
+     * because if a Control Panel is loaded, it will override only the instance method, not the class method (overriding the class
+     * method would improperly affect any other machines loaded on the same page).
+     *
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     * @param {string} [id] is the caller's ID, if any
+     */
+    static println(s, type, id)
+    {
+        if (!COMPILED) {
+            Component.log((id? (id + ": ") : "") + (s? ("\"" + s + "\"") : ""), type);
+        }
+    }
+
+    /**
+     * Component.notice(s, fPrintOnly, id)
+     *
+     * notice() is like println() but implies a need for user notification, so we alert() as well.
+     *
+     * @param {string} s is the message text
+     * @param {boolean} [fPrintOnly]
+     * @param {string} [id] is the caller's ID, if any
+     */
+    static notice(s, fPrintOnly, id)
+    {
+        if (!COMPILED) {
+            Component.println(s, "notice", id);
+        }
+        if (!fPrintOnly) Component.alertUser((id? (id + ": ") : "") + s);
+    }
+
+    /**
+     * Component.warning(s)
+     *
+     * @param {string} s describes the warning
+     */
+    static warning(s)
+    {
+        if (!COMPILED) {
+            Component.println(s, "warning");
+        }
+        Component.alertUser(s);
+    }
+
+    /**
+     * Component.error(s)
+     *
+     * @param {string} s describes the error; an alert() is displayed as well
+     */
+    static error(s)
+    {
+        if (!COMPILED) {
+            Component.println(s, "error");
+        }
+        Component.alertUser(s);
+    }
+
+    /**
+     * Component.alertUser(sMessage)
+     *
+     * @param {string} sMessage
+     */
+    static alertUser(sMessage)
+    {
+        if (window) {
+            window.alert(sMessage);
+        } else {
+            Component.log(sMessage);
+        }
+    };
+
+    /**
+     * Component.confirmUser(sPrompt)
+     *
+     * @param {string} sPrompt
+     * @returns {boolean} true if the user clicked OK, false if Cancel/Close
+     */
+    static confirmUser(sPrompt)
+    {
+        var fResponse = false;
+        if (window) {
+            fResponse = window.confirm(sPrompt);
+        }
+        return fResponse;
+    }
+
+    /**
+     * Component.promptUser()
+     *
+     * @param {string} sPrompt
+     * @param {string} [sDefault]
+     * @returns {string|null}
+     */
+    static promptUser(sPrompt, sDefault)
+    {
+        var sResponse = null;
+        if (window) {
+            sResponse = window.prompt(sPrompt, sDefault === undefined? "" : sDefault);
+        }
+        return sResponse;
+    }
+
+    /**
+     * Component.getComponents(idRelated)
+     *
+     * We could store components as properties, using the component's ID, and change
+     * this linear lookup into a property lookup, but some components may have no ID.
+     *
+     * @param {string} [idRelated] of related component
+     * @return {Array} of components
+     */
+    static getComponents(idRelated)
+    {
+        var i;
+        var aComponents = [];
+        /*
+         * getComponentByID(id, idRelated)
+         *
+         * If idRelated is provided, we check it for a machine prefix, and use any
+         * existing prefix to constrain matches to IDs with the same prefix, in order to
+         * avoid matching components belonging to other machines.
+         */
+        if (idRelated) {
+            if ((i = idRelated.indexOf('.')) > 0)
+                idRelated = idRelated.substr(0, i + 1);
+            else
+                idRelated = "";
+        }
+        for (i = 0; i < Component.components.length; i++) {
+            var component = Component.components[i];
+            if (!idRelated || !component.id.indexOf(idRelated)) {
+                aComponents.push(component);
+            }
+        }
+        return aComponents;
+    }
+
+    /**
+     * Component.getComponentByID(id, idRelated)
+     *
+     * We could store components as properties, using the component's ID, and change
+     * this linear lookup into a property lookup, but some components may have no ID.
+     *
+     * @param {string} id of the desired component
+     * @param {string} [idRelated] of related component
+     * @return {Component|null}
+     */
+    static getComponentByID(id, idRelated)
+    {
+        if (id !== undefined) {
+            var i;
+            /*
+             * If idRelated is provided, we check it for a machine prefix, and use any
+             * existing prefix to constrain matches to IDs with the same prefix, in order to
+             * avoid matching components belonging to other machines.
+             */
+            if (idRelated && (i = idRelated.indexOf('.')) > 0) {
+                id = idRelated.substr(0, i + 1) + id;
+            }
+            for (i = 0; i < Component.components.length; i++) {
+                if (Component.components[i].id === id) {
+                    return Component.components[i];
+                }
+            }
+            if (Component.components.length) {
+                Component.log("Component ID '" + id + "' not found", "warning");
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Component.getComponentByType(sType, idRelated, componentPrev)
+     *
+     * @param {string} sType of the desired component
+     * @param {string} [idRelated] of related component
+     * @param {Component|null} [componentPrev] of previously returned component, if any
+     * @return {Component|null}
+     */
+    static getComponentByType(sType, idRelated, componentPrev)
+    {
+        if (sType !== undefined) {
+            var i;
+            /*
+             * If idRelated is provided, we check it for a machine prefix, and use any
+             * existing prefix to constrain matches to IDs with the same prefix, in order to
+             * avoid matching components belonging to other machines.
+             */
+            if (idRelated) {
+                if ((i = idRelated.indexOf('.')) > 0) {
+                    idRelated = idRelated.substr(0, i + 1);
+                } else {
+                    idRelated = "";
+                }
+            }
+            for (i = 0; i < Component.components.length; i++) {
+                if (componentPrev) {
+                    if (componentPrev == Component.components[i]) componentPrev = null;
+                    continue;
+                }
+                if (sType == Component.components[i].type && (!idRelated || !Component.components[i].id.indexOf(idRelated))) {
+                    return Component.components[i];
+                }
+            }
+            Component.log("Component type '" + sType + "' not found", "warning");
+        }
+        return null;
+    }
+
+    /**
+     * Component.getComponentParms(element)
+     *
+     * @param {Object} element from the DOM
+     */
+    static getComponentParms(element)
+    {
+        var parms = null;
+        var sParms = element.getAttribute("data-value");
+        if (sParms) {
+            try {
+                parms = eval("(" + sParms + ")");   // jshint ignore:line
+                /*
+                 * We can no longer invoke removeAttribute() because some components (eg, Panel) need
+                 * to run their initXXX() code more than once, to avoid initialization-order dependencies.
+                 *
+                 *      if (!DEBUG) {
+                 *          element.removeAttribute("data-value");
+                 *      }
+                 */
+            } catch(e) {
+                Component.error(e.message + " (" + sParms + ")");
+            }
+        }
+        return parms;
+    }
+
+    /**
+     * Component.bindExternalControl(component, sControl, sBinding, sType)
+     *
+     * @param {Component} component
+     * @param {string} sControl
+     * @param {string} sBinding
+     * @param {string} [sType] is the external component type
+     */
+    static bindExternalControl(component, sControl, sBinding, sType)
+    {
+        if (sControl) {
+            if (sType === undefined) sType = "Panel";
+            var target = Component.getComponentByType(sType, component.id);
+            if (target) {
+                var eBinding = target.bindings[sControl];
+                if (eBinding) {
+                    component.setBinding(null, sBinding, eBinding);
+                }
+            }
+        }
+    }
+
+    /**
+     * Component.bindComponentControls(component, element, sAppClass)
+     *
+     * @param {Component} component
+     * @param {Object} element from the DOM
+     * @param {string} sAppClass
+     */
+    static bindComponentControls(component, element, sAppClass)
+    {
+        var aeControls = Component.getElementsByClass(element.parentNode, sAppClass + "-control");
+
+        for (var iControl = 0; iControl < aeControls.length; iControl++) {
+
+            var aeChildNodes = aeControls[iControl].childNodes;
+
+            for (var iNode = 0; iNode < aeChildNodes.length; iNode++) {
+                var control = aeChildNodes[iNode];
+                if (control.nodeType !== 1 /* document.ELEMENT_NODE */) {
+                    continue;
+                }
+                var sClass = control.getAttribute("class");
+                if (!sClass) continue;
+                var aClasses = sClass.split(" ");
+                for (var iClass = 0; iClass < aClasses.length; iClass++) {
+                    var parms;
+                    sClass = aClasses[iClass];
+                    switch (sClass) {
+                        case sAppClass + "-binding":
+                            parms = Component.getComponentParms(control);
+                            if (parms && parms['binding']) {
+                                component.setBinding(parms['type'], parms['binding'], control, parms['value']);
+                            } else if (!parms || parms['type'] != "description") {
+                                Component.log("Component '" + component.toString() + "' missing binding" + (parms? " for " + parms['type'] : ""), "warning");
+                            }
+                            iClass = aClasses.length;
+                            break;
+                        default:
+                            // if (DEBUG) Component.log("Component.bindComponentControls(" + component.toString() + "): unrecognized control class \"" + sClass + "\"", "warning");
+                            break;
+                    }
+                }
+            }
+        }
+    }
+
+    /**
+     * Component.getElementsByClass(element, sClass, sObjClass)
+     *
+     * This is a cross-browser helper function, since not all browser's support getElementsByClassName()
+     *
+     * TODO: This should probably be moved into weblib.js at some point, along with the control binding functions above,
+     * to keep all the browser-related code together.
+     *
+     * @param {Object} element from the DOM
+     * @param {string} sClass
+     * @param {string} [sObjClass]
+     * @return {Array|NodeList}
+     */
+    static getElementsByClass(element, sClass, sObjClass)
+    {
+        if (sObjClass) sClass += '-' + sObjClass + "-object";
+        /*
+         * Use the browser's built-in getElementsByClassName() if it appears to be available
+         * (for example, it's not available in IE8, but it should be available in IE9 and up)
+         */
+        if (element.getElementsByClassName) {
+            return element.getElementsByClassName(sClass);
+        }
+        var i, j, ae = [];
+        var aeAll = element.getElementsByTagName("*");
+        var re = new RegExp('(^| )' + sClass + '( |$)');
+        for (i = 0, j = aeAll.length; i < j; i++) {
+            if (re.test(aeAll[i].className)) {
+                ae.push(aeAll[i]);
+            }
+        }
+        if (!ae.length) {
+            Component.log('No elements of class "' + sClass + '" found');
+        }
+        return ae;
+    }
+
+    /**
+     * Component.getScriptCommands(sScript)
+     *
+     * This is a simple parser that breaks sScript into an array of commands, where each command
+     * is an array of tokens, where tokens are sequences of characters separated by any of: tab, space,
+     * carriage-return (CR), line-feed (LF), semicolon, single-quote, or double-quote;  if a quote is
+     * used, all characters up to the next matching quote become part of the token, allowing any of the
+     * other separators to be part of the token.  CR, LF and semicolon also serve to terminate a command,
+     * with semicolon being preferred, because it's 1) more visible, and 2) essential when the entire
+     * script is a multi-line string where all CR/LF were replaced by spaces (which is what Jekyll does,
+     * and since we can't change Jekyll, it's what our own MarkDown Front Matter parser does as well;
+     * see convertMD() in markout.js, where the aCommandDefs array is built).
+     *
+     * Backslash sequences like \n, \r, and \\ have already been converted to LF, CR and backslash
+     * characters, since the entire script string is injected into a JavaScript function call, so any
+     * backslash sequence that JavaScript supports is automatically converted:
+     *
+     *      \0  \'  \"  \\  \n  \r  \v  \t  \b  \f  \uXXXX \xXX
+     *                      ^J  ^M  ^K  ^I  ^H  ^L
+     *
+     * To support any other non-printable 8-bit character, such as ESC, you should use \xXX, where XX
+     * is the ASCII code in hex.  For ESC, that would \x1B.
+     *
+     * @param {string} sScript
+     * @return {Array}
+     */
+    static getScriptCommands(sScript)
+    {
+        var cch = sScript.length;
+        var aCommands = [], aTokens = [], sToken = "", chQuote = null;
+        for (var i = 0; i < cch; i++) {
+            var ch = sScript[i];
+            if (ch == '"' || ch == "'") {
+                if (chQuote && ch != chQuote) {
+                    sToken += ch;
+                    continue;
+                }
+                if (!chQuote) {
+                    chQuote = ch;
+                } else {
+                    chQuote = null;
+                }
+                if (sToken) {
+                    aTokens.push(sToken);
+                    sToken = "";
+                }
+                continue;
+            }
+            if (!chQuote) {
+                if (ch == '\r' || ch == '\n') {
+                    ch = ';';
+                }
+                if (ch == ' ' || ch == '\t' || ch == ';') {
+                    if (sToken) {
+                        aTokens.push(sToken);
+                        sToken = "";
+                    }
+                    if (ch == ';' && aTokens.length) {
+                        aCommands.push(aTokens);
+                        aTokens = [];
+                    }
+                    continue;
+                }
+            }
+            sToken += ch;
+        }
+        if (sToken) {
+            aTokens.push(sToken);
+        }
+        if (aTokens.length) {
+            aCommands.push(aTokens);
+        }
+        return aCommands;
+    }
+
+    /**
+     * Component.processScript(idMachine, sScript)
+     *
+     * @param {string} idMachine
+     * @param {string} sScript
+     * @return {boolean}
+     */
+    static processScript(idMachine, sScript)
+    {
+        var fSuccess = false;
+        idMachine += ".machine";
+        if (typeof sScript == "string" && !Component.commands[idMachine]) {
+            fSuccess = true;
+            Component.commands[idMachine] = Component.getScriptCommands(sScript);
+            if (!Component.processCommands(idMachine)) {
+                fSuccess = false;
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * Component.processCommands(idMachine)
+     *
+     * @param {string} idMachine
+     * @return {boolean}
+     */
+    static processCommands(idMachine)
+    {
+        var fSuccess = true;
+        var aCommands = Component.commands[idMachine];
+
+     // var dbg = Component.getComponentByType("Debugger", idMachine);
+
+        while (aCommands && aCommands.length) {
+
+            var aTokens = aCommands.splice(0, 1)[0];
+            var sCommand = aTokens[0];
+
+            /*
+             * It's possible to route this output to the Debugger window with dbg.println()
+             * instead, but it's a bit too confusing mingling script output in a window that
+             * already mingles Debugger and machine output.
+             */
+            Component.println('script: ' + aTokens.join(' '));
+
+            var fnCallReady = null;
+            if (Component.asyncCommands.indexOf(sCommand) >= 0) {
+                fnCallReady = function processNextCommand() {
+                    return function() {
+                        Component.processCommands(idMachine);
+                    }
+                }();
+            }
+
+            var fnCommand = Component.globalCommands[sCommand];
+            if (fnCommand) {
+                if (!fnCallReady) {
+                    fSuccess = fnCommand(aTokens[1], aTokens[2], aTokens[3]);
+                } else {
+                    if (!fnCommand(fnCallReady, aTokens[1], aTokens[2], aTokens[3])) break;
+                }
+            }
+            else {
+                fSuccess = false;
+                var component = Component.getComponentByType(aTokens[1], idMachine);
+                if (component) {
+                    fnCommand = Component.componentCommands[sCommand];
+                    if (fnCommand) {
+                        fSuccess = fnCommand(component, aTokens[2], aTokens[3]);
+                    }
+                    else {
+                        var exports = component['exports'];
+                        if (exports) {
+                            fnCommand = exports[sCommand];
+                            if (fnCommand) {
+                                fSuccess = true;
+                                if (!fnCallReady) {
+                                    fSuccess = fnCommand.call(component, aTokens[2], aTokens[3]);
+                                } else {
+                                    if (!fnCommand.call(component, fnCallReady, aTokens[2], aTokens[3])) break;
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+
+            if (!fSuccess) {
+                Component.alertUser("Script error: " + sCommand + (fnCommand? " failed" : " unrecognized"));
+                break;
+            }
+        }
+
+        if (aCommands && !aCommands.length) {
+            delete Component.commands[idMachine];
+        }
+
+        return fSuccess;
+    }
+
+    /**
+     * Component.scriptAlert(sMessage)
+     *
+     * @param {string} sMessage
+     * @return {boolean}
+     */
+    static scriptAlert(sMessage)
+    {
+        Component.alertUser(sMessage);
+        return true;
+    }
+
+    /**
+     * Component.scriptSelect(component, sBinding, sValue)
+     *
+     * @param {Component} component
+     * @param {string} sBinding
+     * @param {string} sValue
+     * @return {boolean}
+     */
+    static scriptSelect(component, sBinding, sValue)
+    {
+        var fSuccess = false;
+        var aBindings = component['bindings'];
+        var control = aBindings[sBinding];
+        if (control) {
+            for (var i = 0; i < control.options.length; i++) {
+                if (control.options[i].textContent == sValue) {
+                    if (control.selectedIndex != i) {
+                        control.selectedIndex = i;
+                    }
+                    fSuccess = true;
+                    break;
+                }
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * Component.scriptSleep(fnCallback, sDelay)
+     *
+     * @param {function()} fnCallback
+     * @param {string} sDelay (in milliseconds)
+     * @return {boolean}
+     */
+    static scriptSleep(fnCallback, sDelay)
+    {
+        setTimeout(fnCallback, +sDelay);
+        return false;
+    }
+
+    /**
+     * toString()
+     *
+     * @this {Component}
+     * @return {string}
+     */
+    toString() {
+        return (this.name? this.name : (this.id || this.type));
+    }
+
+    /**
+     * getMachineNum()
+     *
+     * @this {Component}
+     * @return {number} unique machine number
+     */
+    getMachineNum() {
+        var nMachine = 1;
+        if (this.idMachine) {
+            var aDigits = this.idMachine.match(/\d+/);
+            if (aDigits !== null)
+                nMachine = parseInt(aDigits[0], 10);
+        }
+        return nMachine;
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * Component's setBinding() method is intended to be overridden by subclasses.
+     *
+     * @this {Component}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "reset")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue) {
+        switch (sBinding) {
+        case "clear":
+            if (!this.bindings[sBinding]) {
+                this.bindings[sBinding] = control;
+                control.onclick = (function(component) {
+                    return function clearPanel() {
+                        if (component.bindings['print']) {
+                            component.bindings['print'].value = "";
+                        }
+                    };
+                }(this));
+            }
+            return true;
+        case "print":
+            if (!this.bindings[sBinding]) {
+                this.bindings[sBinding] = control;
+                /*
+                 * HACK: Save this particular HTML element so that the Debugger can access it, too
+                 */
+                this.controlPrint = control;
+                /*
+                 * This was added for Firefox (Safari automatically clears the <textarea> on a page reload,
+                 * but Firefox does not).
+                 */
+                control.value = "";
+                this.println = (function(control) {
+                    return function printPanel(s, type) {
+                        s = (type !== undefined? (type + ": ") : "") + (s || "");
+                        /*
+                         * Prevent the <textarea> from getting too large; otherwise, printing becomes slower and slower.
+                         */
+                        if (COMPILED) {
+                            if (control.value.length > 8192) {
+                                control.value = control.value.substr(control.value.length - 4096);
+                            }
+                        }
+                        control.value += s + "\n";
+                        control.scrollTop = control.scrollHeight;
+                        if (!COMPILED && window && window.console) console.log(s);
+                    };
+                }(control));
+                /**
+                 * Override this.notice() with a replacement function that eliminates the Component.alertUser() call
+                 *
+                 * @this {Component}
+                 * @param {string} s
+                 * @param {boolean} [fPrintOnly]
+                 * @param {string} [id]
+                 */
+                this.notice = function noticePanel(s, fPrintOnly, id) {
+                    this.println(s, this.idComponent);
+                };
+            }
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    /**
+     * log(s, type)
+     *
+     * For diagnostic output only.
+     *
+     * WARNING: Even though this function's body is completely wrapped in DEBUG, that won't prevent the Closure Compiler
+     * from including it, so all calls must still be prefixed with "if (DEBUG) ....".  For this reason, the class method,
+     * Component.log(), is preferred, because the compiler IS smart enough to remove those calls.
+     *
+     * @this {Component}
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     */
+    log(s, type) {
+        if (!COMPILED) {
+            Component.log(s, type || this.id || this.type);
+        }
+    }
+
+    /**
+     * assert(f, s)
+     *
+     * Verifies conditions that must be true (for DEBUG builds only).
+     *
+     * WARNING: Make sure you preface all calls to this.assert() with "if (DEBUG)", because unlike Component.assert(),
+     * the Closure Compiler can't be sure that this instance method hasn't been overridden, so it refuses to treat it as
+     * dead code in non-DEBUG builds.
+     *
+     * TODO: Add a task to the build process that "asserts" there are no instances of "assertion failure" in RELEASE builds.
+     *
+     * @this {Component}
+     * @param {boolean|number} f is the expression asserted to be true
+     * @param {string} [s] is a description of the assertion to be displayed or logged on failure
+     */
+    assert(f, s) {
+        if (DEBUG) {
+            if (!f) {
+                s = "assertion failure in " + (this.id || this.type) + (s? ": " + s : "");
+                if (DEBUGGER && this.dbg) {
+                    this.dbg.stopCPU();
+                    /*
+                     * Why do we throw an Error only to immediately catch and ignore it?  Simply to give
+                     * any IDE the opportunity to inspect the application's state.  Even when the IDE has
+                     * control, you should still be able to invoke Debugger commands from the IDE's REPL,
+                     * using the '$' global function that the Debugger constructor defines; eg:
+                     *
+                     *      $('r')
+                     *      $('dw 0:0')
+                     *      $('h')
+                     *      ...
+                     *
+                     * If you have no desire to stop on assertions, consider this a no-op.  However, another
+                     * potential benefit of creating an Error object is that, for browsers like Chrome, we get
+                     * a stack trace, too.
+                     */
+                    try {
+                        throw new Error(s);
+                    } catch(e) {
+                        this.println(e.stack || e.message);
+                    }
+                    return;
+                }
+                this.log(s);
+                throw new Error(s);
+            }
+        }
+    }
+
+    /**
+     * println(s, type)
+     *
+     * For non-diagnostic messages, which components may override to control the destination/appearance of their output.
+     *
+     * Components using this.println() should wait until after their constructor has run to display any messages, because
+     * if a Control Panel has been loaded, its override will not take effect until its own constructor has run.
+     *
+     * @this {Component}
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     * @param {string} [id] is the caller's ID, if any
+     */
+    println(s, type, id) {
+        Component.println(s, type, id || this.id);
+    }
+
+    /**
+     * status(s)
+     *
+     * status() is like println() but it also includes information about the component (ie, the component ID),
+     * which is why there is no corresponding Component.status() function.
+     *
+     * @param {string} s is the message text
+     */
+    status(s) {
+        this.println(this.idComponent + ": " + s);
+    }
+
+    /**
+     * notice(s, fPrintOnly)
+     *
+     * notice() is like println() but implies a need for user notification, so we alert() as well; however, if this.println()
+     * is overridden, this.notice will be replaced with a similar override, on the assumption that the override is taking care
+     * of alerting the user.
+     *
+     * @this {Component}
+     * @param {string} s is the message text
+     * @param {boolean} [fPrintOnly]
+     * @param {string} [id] is the caller's ID, if any
+     */
+    notice(s, fPrintOnly, id) {
+        Component.notice(s, fPrintOnly, id || this.type);
+    }
+
+    /**
+     * setError(s)
+     *
+     * Set a fatal error condition
+     *
+     * @this {Component}
+     * @param {string} s describes a fatal error condition
+     */
+    setError(s) {
+        this.flags.error = true;
+        this.notice(s);         // TODO: Any cases where we should still prefix this string with "Fatal error: "?
+    }
+
+    /**
+     * clearError()
+     *
+     * Clear any fatal error condition
+     *
+     * @this {Component}
+     */
+    clearError() {
+        this.flags.error = false;
+    }
+
+    /**
+     * isError()
+     *
+     * Report any fatal error condition
+     *
+     * @this {Component}
+     * @return {boolean} true if a fatal error condition exists, false if not
+     */
+    isError() {
+        if (this.flags.error) {
+            this.println(this.toString() + " error");
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * isReady(fnReady)
+     *
+     * Return the "ready" state of the component; if the component is not ready, it will queue the optional
+     * notification function, otherwise it will immediately call the notification function, if any, without queuing it.
+     *
+     * NOTE: Since only the Computer component actually cares about the "readiness" of other components, the so-called
+     * "queue" of notification functions supports exactly one function.  This keeps things nice and simple.
+     *
+     * @this {Component}
+     * @param {function()} [fnReady]
+     * @return {boolean} true if the component is in a "ready" state, false if not
+     */
+    isReady(fnReady) {
+        if (fnReady) {
+            if (this.flags.ready) {
+                fnReady();
+            } else {
+                if (MAXDEBUG) this.log("NOT ready");
+                this.fnReady = fnReady;
+            }
+        }
+        return this.flags.ready;
+    }
+
+    /**
+     * setReady(fReady)
+     *
+     * Set the "ready" state of the component to true, and call any queued notification functions.
+     *
+     * @this {Component}
+     * @param {boolean} [fReady] is assumed to indicate "ready" unless EXPLICITLY set to false
+     */
+    setReady(fReady) {
+        if (!this.flags.error) {
+            this.flags.ready = (fReady !== false);
+            if (this.flags.ready) {
+                if (MAXDEBUG /* || this.name */) this.log("ready");
+                var fnReady = this.fnReady;
+                this.fnReady = null;
+                if (fnReady) fnReady();
+            }
+        }
+    }
+
+    /**
+     * isBusy(fCancel)
+     *
+     * Return the "busy" state of the component
+     *
+     * @this {Component}
+     * @param {boolean} [fCancel] is set to true to cancel a "busy" state
+     * @return {boolean} true if "busy", false if not
+     */
+    isBusy(fCancel) {
+        if (this.flags.busy) {
+            if (fCancel) {
+                this.flags.busyCancel = true;
+            } else if (fCancel === undefined) {
+                this.println(this.toString() + " busy");
+            }
+        }
+        return this.flags.busy;
+    }
+
+    /**
+     * setBusy(fBusy)
+     *
+     * Update the current busy state; if a busyCancel request is pending, it will be honored now.
+     *
+     * @this {Component}
+     * @param {boolean} fBusy
+     * @return {boolean}
+     */
+    setBusy(fBusy) {
+        if (this.flags.busyCancel) {
+            this.flags.busy = false;
+            this.flags.busyCancel = false;
+            return false;
+        }
+        if (this.flags.error) {
+            this.println(this.toString() + " error");
+            return false;
+        }
+        this.flags.busy = fBusy;
+        return this.flags.busy;
+    }
+
+    /**
+     * powerUp(fSave)
+     *
+     * @this {Component}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower] is true if this is "repower" notification
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower) {
+        this.flags.powered = true;
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {Component}
+     * @param {boolean} fSave
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown) {
+        if (fShutdown) this.flags.powered = false;
+        return true;
+    }
+
+    /**
+     * messageEnabled(bitsMessage)
+     *
+     * If bitsMessage is not specified, the component's MESSAGE category is used.
+     *
+     * @this {Component}
+     * @param {number} [bitsMessage] is zero or more MESSAGE_* category flag(s)
+     * @return {boolean} true if all specified message enabled, false if not
+     */
+    messageEnabled(bitsMessage) {
+        if (DEBUGGER && this.dbg) {
+            if (this === this.dbg) {
+                bitsMessage |= 0;
+            } else {
+                bitsMessage = bitsMessage || this.bitsMessage;
+            }
+            var bitsEnabled = this.dbg.bitsMessage & bitsMessage;
+            return (!!bitsMessage && bitsEnabled === bitsMessage || !!(bitsEnabled & this.dbg.bitsWarning));
+        }
+        return false;
+    }
+
+    /**
+     * printMessage(sMessage, bitsMessage, fAddress)
+     *
+     * If bitsMessage is not specified, the component's MESSAGE category is used.
+     * If bitsMessage is true, the message is displayed regardless.
+     *
+     * @this {Component}
+     * @param {string} sMessage is any caller-defined message string
+     * @param {number|boolean} [bitsMessage] is zero or more MESSAGE_* category flag(s)
+     * @param {boolean} [fAddress] is true to display the current address
+     */
+    printMessage(sMessage, bitsMessage, fAddress) {
+        if (DEBUGGER && this.dbg) {
+            if (bitsMessage === true || this.messageEnabled(bitsMessage | 0)) {
+                this.dbg.message(sMessage, fAddress);
+            }
+        }
+    }
+
+    /**
+     * printMessageIO(port, bOut, addrFrom, name, bIn, bitsMessage)
+     *
+     * If bitsMessage is not specified, the component's MESSAGE category is used.
+     * If bitsMessage is true, the message is displayed as long as MESSAGE.PORT is enabled.
+     *
+     * @this {Component}
+     * @param {number} port
+     * @param {number|null} bOut if an output operation
+     * @param {number|null} [addrFrom]
+     * @param {string|null} [name] of the port, if any
+     * @param {number|null} [bIn] is the input value, if known, on an input operation
+     * @param {number|boolean} [bitsMessage] is zero or more MESSAGE_* category flag(s)
+     */
+    printMessageIO(port, bOut, addrFrom, name, bIn, bitsMessage) {
+        if (DEBUGGER && this.dbg) {
+            if (bitsMessage === true) {
+                bitsMessage = 0;
+            } else if (bitsMessage == null) {
+                bitsMessage = this.bitsMessage;
+            }
+            this.dbg.messageIO(this, port, bOut, addrFrom, name, bIn, bitsMessage);
+        }
+    }
+}
+
+/*
+ * Every component created on the current page is recorded in this array (see Component.add()),
+ * enabling any component to locate another component by ID (see Component.getComponentByID())
+ * or by type (see Component.getComponentByType()).
+ *
+ * Every machine on the page are now recorded as well, by their machine ID.  We then record the
+ * various resources used by that machine.
+ *
+ * Includes a fallback for non-browser-based environments (ie, Node).  TODO: This will need to be
+ * tailored to Node, probably using the global object instead of the window object, if we ever want
+ * to support multi-machine configs in that environment.
+ */
+if (window) {
+    if (!window['PCjs']) window['PCjs'] = {};
+    if (!window['PCjs']['Machines']) window['PCjs']['Machines'] = {};
+    if (!window['PCjs']['Components']) window['PCjs']['Components'] = [];
+    if (!window['PCjs']['Commands']) window['PCjs']['Commands'] = {};
+}
+Component.machines = window? window['PCjs']['Machines'] : {};
+Component.components = window? window['PCjs']['Components'] : [];
+Component.commands = window? window['PCjs']['Commands'] : {};
+
+Component.asyncCommands = [
+    'hold', 'sleep', 'wait'
+];
+Component.globalCommands = {
+    'alert': Component.scriptAlert,
+    'sleep': Component.scriptSleep
+};
+Component.componentCommands = {
+    'select':   Component.scriptSelect
+};
+
+/*
+ * The following polyfills provide ES5 functionality that's missing in older browsers (eg, IE8),
+ * allowing PCjs apps to run without slamming into exceptions; however, due to the lack of HTML5 canvas
+ * support in those browsers, all you're likely to see are "soft" errors (eg, "Missing <canvas> support").
+ *
+ * Perhaps we can implement a text-only faux video display for a fun retro-browser experience someday.
+ *
+ * TODO: Come up with a better place to put these polyfills.  We will likely have more if we decide to
+ * make the leap from ES5 to ES6 features.
+ */
+
+/*
+ * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/indexOf
+ */
+if (!Array.prototype.indexOf) {
+    Array.prototype.indexOf = function(obj, start) {
+        for (var i = (start || 0), j = this.length; i < j; i++) {
+            if (this[i] === obj) { return i; }
+        }
+        return -1;
+    }
+}
+
+/*
+ * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/isArray
+ */
+if (!Array.isArray) {
+    Array.isArray = function(arg) {
+        return Object.prototype.toString.call(arg) === '[object Array]';
+    };
+}
+
+/*
+ * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/bind
+ */
+if (!Function.prototype.bind) {
+    Function.prototype.bind = function(obj) {
+        if (typeof this != "function") {
+            // Closest thing possible to the ECMAScript 5 internal IsCallable function
+            throw new TypeError("Function.prototype.bind: non-callable object");
+        }
+        var args = Array.prototype.slice.call(arguments, 1);
+        var fToBind = this;
+        var fnNOP = /** @constructor */ (function() {});
+        var fnBound = function() {
+            return fToBind.apply(this instanceof fnNOP && obj? this : obj, args.concat(Array.prototype.slice.call(arguments)));
+        };
+        fnNOP.prototype = this.prototype;
+        fnBound.prototype = new fnNOP();
+        return fnBound;
+    };
+}
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/defines.js (C) Jeff Parsons 2012-2017
+ */
+
+/**
+ * @define {string}
+ */
+var APPCLASS = "pcx86";         // this @define is the default application class (eg, "pcx86", "c1pjs")
+
+/**
+ * @define {string}
+ */
+var APPNAME = "PCx86";          // this @define is the default application name (eg, "PCx86", "C1Pjs")
+
+/**
+ * @define {boolean}
+ *
+ * WARNING: DEBUGGER needs to accurately reflect whether or not the Debugger component is (or will be) loaded.
+ * In the compiled case, we rely on the Closure Compiler to override DEBUGGER as appropriate.  When it's *false*,
+ * nearly all of debugger.js will be conditionally removed by the compiler, reducing it to little more than a
+ * "type skeleton", which also solves some type-related warnings we would otherwise have if we tried to remove
+ * debugger.js from the compilation process altogether.
+ *
+ * However, when we're in "development mode" and running uncompiled code in debugger-less configurations,
+ * I would like to skip loading debugger.js altogether.  When doing that, we must ALSO arrange for an additional file
+ * (nodebugger.js) to be loaded immediately after this file, which *explicitly* overrides DEBUGGER with *false*.
+ */
+var DEBUGGER = true;            // this @define is overridden by the Closure Compiler to remove Debugger-related support
+
+/**
+ * @define {boolean}
+ *
+ * PREFETCH enables the use of a prefetch queue.  As of v1.20.0, PREFETCH support has been updated and retested,
+ * but as currently implemented, it does not yield as much improvement as I'd hoped when paging is enabled, so PREFETCH
+ * is still off by default.
+ */
+var PREFETCH = false;
+
+/**
+ * @define {boolean}
+ *
+ * BYTEARRAYS is a Closure Compiler compile-time option that allocates an Array of numbers for every Memory block,
+ * where each a number represents ONE byte; very wasteful, but potentially slightly faster.
+ *
+ * See the Memory component for details.
+ */
+var BYTEARRAYS = false;
+
+/**
+ * TYPEDARRAYS enables use of typed arrays for Memory blocks.  This used to be a compile-time-only option, but I've
+ * added Memory access functions for typed arrays (see Memory.afnTypedArray), so support can be enabled dynamically now.
+ *
+ * See the Memory component for details.
+ */
+var TYPEDARRAYS = (typeof ArrayBuffer !== 'undefined');
+
+/**
+ * @define {boolean}
+ *
+ * BACKTRACK enables backtracking: a mechanism that allows us to tag every byte of incoming data and follow the
+ * flow of that data.
+ *
+ * This is set to !COMPILED, disabling backtracking in all compiled versions, but we may eventually set it to
+ * match the DEBUGGER setting -- unless it slows down machines using the built-in Debugger too much, in which case
+ * we'll have to rethink that choice OR provide a Debugger command that dynamically enables/disables as much of
+ * the backtracking support as possible.
+ *
+ * TODO: BACKTRACK support is currently completely disabled until we have a chance to investigate the problem
+ * discussed in Bus.addBackTrackObject().
+ */
+var BACKTRACK = !COMPILED && DEBUGGER;
+
+/**
+ * @define {boolean}
+ *
+ * SYMBOLS enables automatic symbol generation from known DLL, EXE and VXD file formats.  It's currently
+ * enabled whenever DEBUGGER support is enabled.
+ */
+var SYMBOLS = DEBUGGER;
+
+/**
+ * @define {boolean}
+ *
+ * BUGS_8086 enables support for known 8086 bugs.  It's turned off by default, because 1) it adds overhead, and
+ * 2) it's hard to imagine any software actually being dependent on any of the bugs covered by this (eg, the failure
+ * to properly restart string instructions with multiple prefixes, or the failure to inhibit hardware interrupts
+ * following SS segment loads).
+ */
+var BUGS_8086 = false;
+
+/**
+ * @define {boolean}
+ *
+ * I386 enables 80386 support.  My preference continues to be one "binary" that supports all implemented CPUs, but
+ * I'm providing this to enable a slimmed-down binary, at least until 80386 support is actually finished; at the
+ * moment, there's just a lot of scaffolding that bloats the compiled version without adding any real functionality.
+ */
+var I386 = true;
+
+/**
+ * @define {boolean}
+ *
+ * DESKPRO386 enables COMPAQ DeskPro 386 support.  Requires I386 support as well (duh).
+ */
+var DESKPRO386 = I386;
+
+/**
+ * @define {boolean}
+ *
+ * PAGEBLOCKS enables 80386 paging support with assistance from the Bus component.  This affects how the Bus component
+ * defines physical memory parameters for a 32-bit bus.  With the 8086 and 80286 processors, the Bus component was free
+ * to choose any block size for physical memory allocations that made sense for the bus width (eg, 4Kb blocks for a
+ * 20-bit bus, or 16Kb blocks for a 24-bit bus).
+ *
+ * However, for the 80386 processor, it makes more sense to choose a block size that matches the page size (ie, 4Kb),
+ * because then we have the option of altering the address-to-memory mapping for any block to match whatever page table
+ * mapping is in effect for that address, if any, without requiring another layer of address translation.
+ */
+var PAGEBLOCKS = I386;
+
+/*
+ * Combine all the shared globals and machine-specific globals into one machine-specific global object,
+ * which all machine components should start using; eg: "if (PCX86.DEBUG) ..." instead of "if (DEBUG) ...".
+ */
+var PCX86 = {
+    APPCLASS:    APPCLASS,
+    APPNAME:     APPNAME,
+    APPVERSION:  APPVERSION,    // shared
+    BACKTRACK:   BACKTRACK,
+    BUGS_8086:   BUGS_8086,
+    BYTEARRAYS:  BYTEARRAYS,
+    COMPILED:    COMPILED,      // shared
+    CSSCLASS:    CSSCLASS,      // shared
+    DEBUG:       DEBUG,         // shared
+    DEBUGGER:    DEBUGGER,
+    DESKPRO386:  DESKPRO386,
+    I386:        I386,
+    MAXDEBUG:    MAXDEBUG,      // shared
+    PAGEBLOCKS:  PAGEBLOCKS,
+    PREFETCH:    PREFETCH,
+    PRIVATE:     PRIVATE,       // shared
+    TYPEDARRAYS: TYPEDARRAYS,
+    SITEHOST:    SITEHOST,      // shared
+    SYMBOLS:     SYMBOLS,
+    XMLVERSION:  XMLVERSION     // shared
+};
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/x86.js (C) Jeff Parsons 2012-2017
+ */
+
+var X86 = {
+    /*
+     * CPU model numbers (supported)
+     */
+    MODEL_8086:     8086,
+    MODEL_8088:     8088,
+    MODEL_80186:    80186,
+    MODEL_80188:    80188,
+    MODEL_80286:    80286,
+    MODEL_80386:    80386,
+
+    /*
+     * 80386 CPU stepping identifiers (supported)
+     */
+    STEPPING_80386_A0: (80386+0xA0),    // we have very little information about this stepping...
+    STEPPING_80386_A1: (80386+0xA1),    // we know much more about the A1 stepping (see /blog/2015/02/23/README.md)
+    STEPPING_80386_B0: (80386+0xB0),    // for now, the only B0 difference in PCx86 is support for XBTS and IBTS
+    STEPPING_80386_B1: (80386+0xB1),    // our implementation of the B1 stepping also includes the infamous 32-bit multiplication bug
+    STEPPING_80386_B2: (80386+0xB2),    // this is an imaginary stepping that simply means "B1 without the 32-bit multiplication bug" (ie, a B1 with the "double sigma" stamp)
+    STEPPING_80386_C0: (80386+0xC0),    // this presumably fixed lots of B1 issues, but it seems to have been quickly superseded by the D0
+    STEPPING_80386_D0: (80386+0xD0),    // we don't have any detailed information (eg, errata) for these later steppings
+    STEPPING_80386_D1: (80386+0xD1),
+    STEPPING_80386_D2: (80386+0xD2),
+
+    /*
+     * This constant is used to mark points in the code where the physical address being returned
+     * is invalid and should not be used.  TODO: There are still functions that will use an invalid
+     * address, which is why we've tried to choose a value that causes the least harm, but ultimately,
+     * we must add checks to those functions or throw special JavaScript exceptions to bypass them.
+     *
+     * This value is also used to indicate non-existent EA address calculations, which are usually
+     * detected with "regEA === ADDR_INVALID" and "regEAWrite === ADDR_INVALID" tests.  In a 32-bit
+     * CPU, -1 (ie, 0xffffffff) could actually be a valid address, so consider changing ADDR_INVALID
+     * to NaN or null (which is also why all ADDR_INVALID tests should use strict equality operators).
+     *
+     * The main reason I'm NOT using NaN or null now is my concern that, by mixing non-numbers
+     * (specifically, values outside the range of signed 32-bit integers), performance may suffer.
+     *
+     * WARNING: Like many of the properties defined here, ADDR_INVALID is a common constant, which the
+     * Closure Compiler will happily inline (with or without @const annotations; in fact, I've yet to
+     * see a @const annotation EVER improve automatic inlining).  However, if you don't make ABSOLUTELY
+     * certain that this file is included BEFORE the first reference to any of these properties, that
+     * automatic inlining will no longer occur.
+     */
+    ADDR_INVALID: -1,
+
+    /*
+     * Processor Exception Interrupts
+     *
+     * Of the following exceptions, all are designed to be restartable, except for 0x08 and 0x09 (and 0x0D
+     * after an attempt to write to a read-only segment).
+     *
+     * Error codes are pushed onto the stack for 0x08 (always 0) and 0x0A through 0x0E.
+     *
+     * Priority: Instruction exception, TRAP, NMI, Processor Extension Segment Overrun, and finally INTR.
+     *
+     * All exceptions can also occur in real-mode, except where noted.  A GP_FAULT in real-mode can be triggered
+     * by "any memory reference instruction that attempts to reference [a] 16-bit word at offset 0xFFFF".
+     *
+     * Interrupts beyond 0x10 (up through 0x1F) are reserved for future exceptions.
+     *
+     * Implementation Detail: For any opcode we know must generate a UD_FAULT interrupt, we invoke opInvalid(),
+     * NOT opUndefined().  UD_FAULT is for INVALID opcodes, Intel's choice of term "undefined" notwithstanding.
+     *
+     * We reserve the term "undefined" for opcodes that require more investigation, and we invoke opUndefined()
+     * ONLY until an opcode's behavior has finally been defined, at which point it becomes either valid or invalid.
+     * The term "illegal" seems completely superfluous; we don't need a third way of describing invalid opcodes.
+     *
+     * The term "undocumented" should be limited to operations that are valid but Intel simply never documented.
+     */
+    EXCEPTION: {
+        DE_EXC:     0x00,       // Divide Error Exception                   (#DE: fault, no error code)
+        DB_EXC:     0x01,       // Debug (aka Single Step Trap) Exception   (#DB: fault or trap)
+        NMI:        0x02,       // Non-Maskable Interrupt
+        BP_TRAP:    0x03,       // Breakpoint Exception                     (#BP: trap)
+        OF_TRAP:    0x04,       // INTO Overflow Exception                  (#OF: trap)
+        BR_FAULT:   0x05,       // BOUND Error Exception                    (#BR: fault, no error code)
+        UD_FAULT:   0x06,       // Invalid (aka Undefined/Illegal) Opcode   (#UD: fault, no error code)
+        NM_FAULT:   0x07,       // No Math Unit Available; see ESC or WAIT  (#NM: fault, no error code)
+        DF_FAULT:   0x08,       // Double Fault; see LIDT                   (#DF: fault, with error code)
+        MP_FAULT:   0x09,       // Math Unit Protection Fault; see ESC      (#MP: fault, no error code)
+        TS_FAULT:   0x0A,       // Invalid Task State Segment Fault         (#TS: fault, with error code; protected-mode only)
+        NP_FAULT:   0x0B,       // Not Present Fault                        (#NP: fault, with error code; protected-mode only)
+        SS_FAULT:   0x0C,       // Stack Fault                              (#SS: fault, with error code; protected-mode only)
+        GP_FAULT:   0x0D,       // General Protection Fault                 (#GP: fault, with error code)
+        PF_FAULT:   0x0E,       // Page Fault                               (#PF: fault, with error code)
+        MF_FAULT:   0x10        // Math Fault; see ESC or WAIT              (#MF: fault, no error code)
+    },
+    /*
+     * Processor Status flag definitions (stored in regPS)
+     */
+    PS: {
+        CF:     0x0001,     // bit 0: Carry flag
+        BIT1:   0x0002,     // bit 1: reserved, always set
+        PF:     0x0004,     // bit 2: Parity flag
+        BIT3:   0x0008,     // bit 3: reserved, always clear
+        AF:     0x0010,     // bit 4: Auxiliary Carry flag (aka Arithmetic flag)
+        BIT5:   0x0020,     // bit 5: reserved, always clear
+        ZF:     0x0040,     // bit 6: Zero flag
+        SF:     0x0080,     // bit 7: Sign flag
+        TF:     0x0100,     // bit 8: Trap flag
+        IF:     0x0200,     // bit 9: Interrupt flag
+        DF:     0x0400,     // bit 10: Direction flag
+        OF:     0x0800,     // bit 11: Overflow flag
+        IOPL: {
+         MASK:  0x3000,     // bits 12-13: I/O Privilege Level (always set on 8086/80186; clear on 80286 reset)
+         SHIFT: 12
+        },
+        NT:     0x4000,     // bit 14: Nested Task flag (always set on 8086/80186; clear on 80286 reset)
+        BIT15:  0x8000,     // bit 15: reserved (always set on 8086/80186; clear otherwise)
+        RF:    0x10000,     // bit 16: Resume Flag (temporarily disables debug exceptions; 80386 only)
+        VM:    0x20000      // bit 17: Virtual 8086 Mode (80386 only)
+    },
+    CR0: {
+        /*
+         * Machine Status Word (MSW) bit definitions
+         */
+        MSW: {
+            PE:     0x0001, // protected-mode enabled
+            MP:     0x0002, // monitor processor extension (ie, coprocessor)
+            EM:     0x0004, // emulate processor extension
+            TS:     0x0008, // task switch indicator
+            ON:     0xFFF0, // on the 80286, these bits are always on (TODO: Verify)
+            MASK:   0xFFFF  // these are the only (MSW) bits that the 80286 can access (within CR0)
+        },
+        ET: 0x00000010,     // coprocessor type (80287 or 80387); always 1 on post-80386 CPUs
+        PG: 0x80000000|0    // 0: paging disabled
+    },
+    DR7: {                  // Debug Control Register
+        L0:     0x00000001,
+        G0:     0x00000002,
+        L1:     0x00000004,
+        G1:     0x00000008,
+        L2:     0x00000010,
+        G2:     0x00000020,
+        L3:     0x00000040,
+        G3:     0x00000080,
+        ENABLE: 0x000000FF,
+        LE:     0x00000100,
+        GE:     0x00000200,
+        RW0:    0x00030000, // 00: exec-only  01: write-only  10: undefined  11: read/write-only
+        LEN0:   0x000C0000, // 00: one-byte,  01: two-byte,   10: undefined  11: four-byte
+        RW1:    0x00300000, // 00: exec-only  01: write-only  10: undefined  11: read/write-only
+        LEN1:   0x00C00000, // 00: one-byte,  01: two-byte,   10: undefined  11: four-byte
+        RW2:    0x03000000, // 00: exec-only  01: write-only  10: undefined  11: read/write-only
+        LEN2:   0x0C000000, // 00: one-byte,  01: two-byte,   10: undefined  11: four-byte
+        RW3:    0x30000000, // 00: exec-only  01: write-only  10: undefined  11: read/write-only
+        LEN3:   0xC0000000|0// 00: one-byte,  01: two-byte,   10: undefined  11: four-byte
+    },
+    DR6: {                  // Debug Status Register
+        B0:     0x00000001,
+        B1:     0x00000002,
+        B2:     0x00000004,
+        B3:     0x00000008,
+        BD:     0x00002000, // set if the next instruction will read or write one of the eight debug registers and ICE-386 is also using them
+        BS:     0x00004000, // set if the debug handler is entered due to the TF (trap flag) bit set in the EFLAGS register
+        BT:     0x00008000  // set before entering the DEBUG handler if a task switch has occurred and the T-bit of the new TSS is set
+    },
+    SEL: {
+        RPL:    0x0003,     // requested privilege level (0-3)
+        LDT:    0x0004,     // table indicator (0: GDT, 1: LDT)
+        MASK:   0xFFF8      // table offset
+    },
+    DESC: {                 // Descriptor Table Entry
+        LIMIT: {            // LIMIT bits 0-15 (or OFFSET if this is an INTERRUPT or TRAP gate)
+            OFFSET:     0x0
+        },
+        BASE: {             // BASE bits 0-15 (or SELECTOR if this is a TASK, INTERRUPT or TRAP gate)
+            OFFSET:     0x2
+        },
+        ACC: {              // bit definitions for the access word (offset 0x4)
+            OFFSET:     0x4,
+            BASE1623:                       0x00FF,     // (not used if this a TASK, INTERRUPT or TRAP gate; bits 0-5 are parm count for CALL gates)
+            TYPE: {
+                OFFSET: 0x5,
+                MASK:                       0x1F00,
+                SEG:                        0x1000,
+                NONSEG:                     0x0F00,
+                /*
+                 * The following bits apply only when SEG is set
+                 */
+                CODE:                       0x0800,     // set for CODE, clear for DATA
+                ACCESSED:                   0x0100,     // set if accessed, clear if not accessed
+                READABLE:                   0x0200,     // CODE: set if readable, clear if exec-only
+                WRITABLE:                   0x0200,     // DATA: set if writable, clear if read-only
+                CONFORMING:                 0x0400,     // CODE: set if conforming, clear if not
+                EXPDOWN:                    0x0400,     // DATA: set if expand-down, clear if not
+                /*
+                 * Assorted bits that apply only within NONSEG values
+                 */
+                TSS_BUSY:                   0x0200,
+                NONSEG_386:                 0x0800,     // 80386 and up
+                /*
+                 * The following are all the possible (valid) types (well, except for the variations
+                 * of DATA and CODE where the ACCESSED bit (0x0100) may also be set)
+                 */
+                TSS286:                     0x0100,
+                LDT:                        0x0200,
+                TSS286_BUSY:                0x0300,
+                GATE_CALL:                  0x0400,
+                GATE_TASK:                  0x0500,
+                GATE286_INT:                0x0600,
+                GATE286_TRAP:               0x0700,
+                TSS386:                     0x0900,     // 80386 and up
+                TSS386_BUSY:                0x0B00,     // 80386 and up
+                GATE386_CALL:               0x0C00,     // 80386 and up
+                GATE386_INT:                0x0E00,     // 80386 and up
+                GATE386_TRAP:               0x0F00,     // 80386 and up
+                CODE_OR_DATA:               0x1E00,
+                DATA_READONLY:              0x1000,
+                DATA_WRITABLE:              0x1200,
+                DATA_EXPDOWN:               0x1400,
+                DATA_EXPDOWN_WRITABLE:      0x1600,
+                CODE_EXECONLY:              0x1800,
+                CODE_READABLE:              0x1A00,
+                CODE_CONFORMING:            0x1C00,
+                CODE_CONFORMING_READABLE:   0x1E00
+            },
+            DPL: {
+                MASK:                       0x6000,
+                SHIFT:                      13
+            },
+            PRESENT:                        0x8000,
+            INVALID:    0   // use X86.DESC.ACC.INVALID for invalid ACC values
+        },
+        EXT: {              // descriptor extension word (reserved on the 80286; "must be zero")
+            OFFSET:     0x6,
+            LIMIT1619:                      0x000F,
+            AVAIL:                          0x0010,     // NOTE: set in various descriptors in OS/2
+            /*
+             * The BIG bit is known as the D bit for code segments; when set, all addresses and operands
+             * in that code segment are assumed to be 32-bit.
+             *
+             * The BIG bit is known as the B bit for data segments; when set, it indicates: 1) all pushes,
+             * pops, calls and returns use ESP instead of SP, and 2) the upper bound of an expand-down segment
+             * is 0xffffffff instead of 0xffff.
+             */
+            BIG:                            0x0040,     // clear if default operand/address size is 16-bit, set if 32-bit
+            LIMITPAGES:                     0x0080,     // clear if limit granularity is bytes, set if limit granularity is 4Kb pages
+            BASE2431:                       0xFF00
+        },
+        INVALID: 0          // use X86.DESC.INVALID for invalid DESC values
+    },
+    LADDR: {                // linear address
+        PDE: {              // index of page directory entry
+            MASK:   0xFFC00000|0,
+            SHIFT:  20      // (addr & DIR.MASK) >>> DIR.SHIFT yields a page directory offset (ie, index * 4)
+        },
+        PTE: {              // index of page table entry
+            MASK:   0x003FF000,
+            SHIFT:  10      // (addr & PAGE.MASK) >>> PAGE.SHIFT yields a page table offset (ie, index * 4)
+        },
+        OFFSET:     0x00000FFF
+    },
+    PTE: {
+        FRAME:      0xFFFFF000|0,
+        DIRTY:      0x00000040,         // page has been modified
+        ACCESSED:   0x00000020,         // page has been accessed
+        USER:       0x00000004,         // set for user level (CPL 3), clear for supervisor level (CPL 0-2)
+        READWRITE:  0x00000002,         // set for read/write, clear for read-only (affects CPL 3 only)
+        PRESENT:    0x00000001          // set for present page, clear for not-present page
+    },
+    TSS286: {
+        PREV_TSS:   0x00,
+        CPL0_SP:    0x02,   // start of values altered by task switches
+        CPL0_SS:    0x04,
+        CPL1_SP:    0x06,
+        CPL1_SS:    0x08,
+        CPL2_SP:    0x0A,
+        CPL2_SS:    0x0C,
+        TASK_IP:    0x0E,
+        TASK_PS:    0x10,
+        TASK_AX:    0x12,
+        TASK_CX:    0x14,
+        TASK_DX:    0x16,
+        TASK_BX:    0x18,
+        TASK_SP:    0x1A,
+        TASK_BP:    0x1C,
+        TASK_SI:    0x1E,
+        TASK_DI:    0x20,
+        TASK_ES:    0x22,
+        TASK_CS:    0x24,
+        TASK_SS:    0x26,
+        TASK_DS:    0x28,   // end of values altered by task switches
+        TASK_LDT:   0x2A
+    },
+    TSS386: {
+        PREV_TSS:   0x00,
+        CPL0_ESP:   0x04,   // start of values altered by task switches
+        CPL0_SS:    0x08,
+        CPL1_ESP:   0x0c,
+        CPL1_SS:    0x10,
+        CPL2_ESP:   0x14,
+        CPL2_SS:    0x18,
+        TASK_CR3:   0x1C,   // (not in TSS286)
+        TASK_EIP:   0x20,
+        TASK_PS:    0x24,
+        TASK_EAX:   0x28,
+        TASK_ECX:   0x2C,
+        TASK_EDX:   0x30,
+        TASK_EBX:   0x34,
+        TASK_ESP:   0x38,
+        TASK_EBP:   0x3C,
+        TASK_ESI:   0x40,
+        TASK_EDI:   0x44,
+        TASK_ES:    0x48,
+        TASK_CS:    0x4C,
+        TASK_SS:    0x50,
+        TASK_DS:    0x54,
+        TASK_FS:    0x58,   // (not in TSS286)
+        TASK_GS:    0x5C,   // (not in TSS286) end of values altered by task switches
+        TASK_LDT:   0x60,
+        TASK_IOPM:  0x64    // (not in TSS286)
+    },
+    ERRCODE: {
+        EXT:        0x0001,
+        IDT:        0x0002,
+        LDT:        0x0004,
+        SELMASK:    0xFFFC
+    },
+    RESULT: {
+        /*
+         * Flags were originally computed using 16-bit result registers:
+         *
+         *      CF: resultZeroCarry & resultSize (ie, 0x100 or 0x10000)
+         *      PF: resultParitySign & 0xff
+         *      AF: (resultParitySign ^ resultAuxOverflow) & 0x0010
+         *      ZF: resultZeroCarry & (resultSize - 1)
+         *      SF: resultParitySign & (resultSize >> 1)
+         *      OF: (resultParitySign ^ resultAuxOverflow ^ (resultParitySign >> 1)) & (resultSize >> 1)
+         *
+         * I386 support requires that we now rely on 32-bit result registers:
+         *
+         *      resultDst, resultSrc, resultArith, resultLogic and resultType
+         *
+         * and flags are now computed as follows:
+         *
+         *      CF: ((resultDst ^ ((resultDst ^ resultSrc) & (resultSrc ^ resultArith))) & resultType)
+         *      PF: (resultLogic & 0xff)
+         *      AF: ((resultArith ^ (resultDst ^ resultSrc)) & 0x0010)
+         *      ZF: (resultLogic & ((resultType - 1) | resultType))
+         *      SF: (resultLogic & resultType)
+         *      OF: (((resultDst ^ resultArith) & (resultSrc ^ resultArith)) & resultType)
+         *
+         * where resultType contains both a size, which must be one of BYTE (0x80), WORD (0x8000),
+         * or DWORD (0x80000000), along with bits for each of the arithmetic and/or logical flags that
+         * are currently "cached" in the result registers (eg, X86.RESULT.CF for carry, X86.RESULT.OF
+         * for overflow, etc).
+         *
+         * WARNING: Do not confuse these RESULT flag definitions with the PS flag definitions.  RESULT
+         * flags are used only as "cached" flag indicators, packed into bits 0-5 of resultType; they do
+         * not match the actual flag bit definitions within the Processor Status (PS) register.
+         *
+         * Arithmetic operations should call:
+         *
+         *      setArithResult(dst, src, value, type)
+         * eg:
+         *      setArithResult(dst, src, dst+src, X86.RESULT.BYTE | X86.RESULT.ALL)
+         *
+         * and logical operations should call:
+         *
+         *      setLogicResult(value, type [, carry [, overflow]])
+         *
+         * Since most logical operations clear both CF and OF, most calls to setLogicResult() can omit the
+         * last two optional parameters.
+         *
+         * The type parameter of these methods indicates both the size of the result (BYTE, WORD or DWORD)
+         * and which of the flags should now be considered "cached" by the result registers.  If the previous
+         * resultType specifies any flags not present in the new type parameter, then those flags are
+         * calculated and written to the appropriate regPS bit(s) *before* the result registers are updated.
+         *
+         * Arithmetic operations are assumed to represent an "added" result; if a "subtracted" result is
+         * provided instead (eg, from CMP, DEC, SUB, etc), then setArithResult() must include a 5th parameter
+         * (fSubtract); eg:
+         *
+         *      setArithResult(dst, src, dst-src, X86.RESULT.BYTE | X86.RESULT.ALL, true)
+         *
+         * TODO: Consider separating setArithResult() into two functions: setAddResult() and setSubResult().
+         */
+        BYTE:       0x80,       // result is byte value
+        WORD:       0x8000,     // result is word value
+        DWORD:      0x80000000|0,
+        TYPE:       0x80008080|0,
+        CF:         0x01,       // carry flag is cached
+        PF:         0x02,       // parity flag is cached
+        AF:         0x04,       // aux carry flag is cached
+        ZF:         0x08,       // zero flag is cached
+        SF:         0x10,       // sign flag is cached
+        OF:         0x20,       // overflow flag is cached
+        ALL:        0x3F,       // all result flags are cached
+        LOGIC:      0x1A,       // all logical flags are cached; see setLogicResult()
+        NOTCF:      0x3E        // all result flags EXCEPT carry are cached
+    },
+    /*
+     * Bit values for opFlags, which are all reset to zero prior to each instruction
+     */
+    OPFLAG: {
+        NOREAD:     0x0001,     // disable memory reads for the remainder of the current instruction
+        NOWRITE:    0x0002,     // disable memory writes for the remainder of the current instruction
+        NOINTR:     0x0004,     // a segreg has been set, or a prefix, or an STI (delay INTR acknowledgement)
+        SEG:        0x0010,     // segment override
+        LOCK:       0x0020,     // lock prefix
+        REPZ:       0x0040,     // repeat while Z (NOTE: this value MUST match PS.ZF; see opCMPSb/opCMPSw/opSCASb/opSCASw)
+        REPNZ:      0x0080,     // repeat while NZ
+        REPEAT:     0x0100,     // an instruction is being repeated (ie, some iteration AFTER the first)
+        PUSHSP:     0x0200,     // the SP register is potentially being referenced by a PUSH SP opcode, adjustment may be required
+        DATASIZE:   0x0400,     // data size override
+        ADDRSIZE:   0x0800,     // address size override
+        FAULT:      0x1000,     // a fault occurred during the current instruction
+        DBEXC:      0x2000      // a DB_EXC exception occurred during the current instruction
+    },
+    /*
+     * Bit values for intFlags
+     */
+    INTFLAG: {
+        NONE:       0x00,
+        INTR:       0x01,       // h/w interrupt requested
+        TRAP:       0x02,       // trap (INT 0x01) requested
+        HALT:       0x04,       // halt (HLT) requested
+        DMA:        0x08        // async DMA operation in progress
+    },
+    /*
+     * Common opcodes (and/or any opcodes we need to refer to explicitly)
+     */
+    OPCODE: {
+        ES:         0x26,       // opES()
+        CS:         0x2E,       // opCS()
+        SS:         0x36,       // opSS()
+        DS:         0x3E,       // opDS()
+        PUSHSP:     0x54,       // opPUSHSP()
+        PUSHA:      0x60,       // opPUSHA()    (80186 and up)
+        POPA:       0x61,       // opPOPA()     (80186 and up)
+        BOUND:      0x62,       // opBOUND()    (80186 and up)
+        ARPL:       0x63,       // opARPL()     (80286 and up)
+        FS:         0x64,       // opFS()       (80386 and up)
+        GS:         0x65,       // opGS()       (80386 and up)
+        OS:         0x66,       // opOS()       (80386 and up)
+        AS:         0x67,       // opAS()       (80386 and up)
+        PUSHN:      0x68,       // opPUSHn()    (80186 and up)
+        IMULN:      0x69,       // opIMULn()    (80186 and up)
+        PUSH8:      0x6A,       // opPUSH8()    (80186 and up)
+        IMUL8:      0x6B,       // opIMUL8()    (80186 and up)
+        INSB:       0x6C,       // opINSb()     (80186 and up)
+        INSW:       0x6D,       // opINSw()     (80186 and up)
+        OUTSB:      0x6E,       // opOUTSb()    (80186 and up)
+        OUTSW:      0x6F,       // opOUTSw()    (80186 and up)
+        ENTER:      0xC8,       // opENTER()    (80186 and up)
+        LEAVE:      0xC9,       // opLEAVE()    (80186 and up)
+        CALLF:      0x9A,       // opCALLF()
+        MOVSB:      0xA4,       // opMOVSb()
+        MOVSW:      0xA5,       // opMOVSw()
+        CMPSB:      0xA6,       // opCMPSb()
+        CMPSW:      0xA7,       // opCMPSw()
+        STOSB:      0xAA,       // opSTOSb()
+        STOSW:      0xAB,       // opSTOSw()
+        LODSB:      0xAC,       // opLODSb()
+        LODSW:      0xAD,       // opLODSw()
+        SCASB:      0xAE,       // opSCASb()
+        SCASW:      0xAF,       // opSCASw()
+        INT3:       0xCC,       // opINT3()
+        INTN:       0xCD,       // opINTn()
+        INTO:       0xCE,       // opINTO()
+        IRET:       0xCF,       // opIRET()
+        ESC0:       0xD8,       // opESC0()
+        ESC1:       0xD9,       // opESC1()
+        ESC2:       0xDA,       // opESC2()
+        ESC3:       0xDB,       // opESC3()
+        ESC4:       0xDC,       // opESC4()
+        ESC5:       0xDD,       // opESC5()
+        ESC6:       0xDE,       // opESC6()
+        ESC7:       0xDF,       // opESC7()
+        LOOPNZ:     0xE0,       // opLOOPNZ()
+        LOOPZ:      0xE1,       // opLOOPZ()
+        LOOP:       0xE2,       // opLOOP()
+        CALL:       0xE8,       // opCALL()
+        JMP:        0xE9,       // opJMP()      (2-byte displacement)
+        JMPF:       0xEA,       // opJMPF()
+        JMPS:       0xEB,       // opJMPs()     (1-byte displacement)
+        LOCK:       0xF0,       // opLOCK()
+        REPNZ:      0xF2,       // opREPNZ()
+        REPZ:       0xF3,       // opREPZ()
+        GRP4W:      0xFF,
+        CALLW:      0x10FF,     // GRP4W: fnCALLw()
+        CALLFDW:    0x18FF,     // GRP4W: fnCALLFdw()
+        CALLMASK:   0x38FF,     // mask 2-byte GRP4W opcodes with this before comparing to CALLW or CALLFDW
+        UD2:        0x0B0F      // UD2 (invalid opcode "guaranteed" to generate UD_FAULT on all post-8086 processors)
+    },
+    /*
+     * Floating Point Unit (FPU), aka Numeric Data Processor (NDP), aka Numeric Processor Extension (NPX), aka Coprocessor definitions
+     */
+    FPU: {
+        MODEL_8087:     8087,
+        MODEL_80287:    80287,
+        MODEL_80287XL:  80387,  // internally, the 80287XL was an 80387SX, so generally, we treat this as MODEL_80387
+        MODEL_80387:    80387,
+        CONTROL: {              // FPU Control Word
+            IM:     0x0001,     // bit 0: Invalid Operation Mask
+            DM:     0x0002,     // bit 1: Denormalized Operand Mask
+            ZM:     0x0004,     // bit 2: Zero Divide Mask
+            OM:     0x0008,     // bit 3: Overflow Mask
+            UM:     0x0010,     // bit 4: Underflow Mask
+            PM:     0x0020,     // bit 5: Precision Mask
+            EXC:    0x003F,     // all of the above exceptions
+            IEM:    0x0080,     // bit 7: Interrupt Enable Mask (0 enables interrupts, 1 masks them; 8087 only)
+            PC:     0x0300,     // bits 8-9: Precision Control
+            RC: {               // bits 10-11: Rounding Control
+              NEAR: 0x0000,
+              DOWN: 0x0400,
+              UP:   0x0800,
+              CHOP: 0x0C00,
+              MASK: 0x0C00
+            },
+            IC:     0x1000,     // bit 12: Infinity Control (0 for Projective, 1 for Affine)
+            UNUSED: 0xE040,     // bits 6,13-15: unused
+            INIT:   0x03BF      // X86.FPU.CONTROL.IM | X86.FPU.CONTROL.DM | X86.FPU.CONTROL.ZM | X86.FPU.CONTROL.OM | X86.FPU.CONTROL.UM | X86.FPU.CONTROL.PM | X86.FPU.CONTROL.IEM | X86.FPU.CONTROL.PC
+        },
+        STATUS: {               // FPU Status Word
+            IE:     0x0001,     // bit 0: Invalid Operation
+            DE:     0x0002,     // bit 1: Denormalized Operand
+            ZE:     0x0004,     // bit 2: Zero Divide
+            OE:     0x0008,     // bit 3: Overflow
+            UE:     0x0010,     // bit 4: Underflow
+            PE:     0x0020,     // bit 5: Precision
+            SF:     0x0040,     // bit 6: Stack Fault (80387 and later; triggers an Invalid Operation exception)
+            EXC:    0x007F,     // all of the above exceptions
+            ES:     0x0080,     // bit 7: Error/Exception Status/Summary (Interrupt Request on 8087)
+            C0:     0x0100,     // bit 8: Condition Code 0
+            C1:     0x0200,     // bit 9: Condition Code 1
+            C2:     0x0400,     // bit 10: Condition Code 2
+            ST:     0x3800,     // bits 11-13: Stack Top
+            ST_SHIFT: 11,
+            C3:     0x4000,     // bit 14: Condition Code 3
+            CC:     0x4700,     // all condition code bits
+            BUSY:   0x8000      // bit 15: Busy
+        },
+        TAGS: {
+            VALID:  0x0,
+            ZERO:   0x1,
+            SPECIAL:0x2,
+            EMPTY:  0x3,
+            MASK:   0x3
+        }
+        /*
+            C3 C2 C1 C0     Condition Code (CC) values following an Examine
+
+            0  0  0  0      Valid, positive unnormalized (+Unnormal)
+            0  0  0  1      Invalid, positive, exponent=0 (+NaN)
+            0  0  1  0      Valid, negative, unnormalized (-Unnormal)
+            0  0  1  1      Invalid, negative, exponent=0 (-NaN)
+            0  1  0  0      Valid, positive, normalized (+Normal)
+            0  1  0  1      Infinity, positive (+Infinity)
+            0  1  1  0      Valid, negative, normalized (-Normal)
+            0  1  1  1      Infinity, negative (-Infinity)
+            1  0  0  0      Zero, positive (+0)
+            1  0  0  1      Empty
+            1  0  1  0      Zero, negative (-0)
+            1  0  1  1      Empty
+            1  1  0  0      Invalid, positive, exponent=0 (+Denormal)
+            1  1  0  1      Empty
+            1  1  1  0      Invalid, negative, exponent=0 (-Denormal)
+            1  1  1  1      Empty
+
+                            Condition Code (CC) values following an FCOM or FTST
+
+            0  0  ?  0      ST > source operand (FCOM); ST > 0 (FTST)
+            0  0  ?  1      ST < source operand (FCOM); ST < 0 (FTST)
+            1  0  ?  0      ST = source operand (FCOM); ST = 0 (FTST)
+            1  1  ?  1      ST is not comparable
+
+                            Condition Code (CC) values following a Remainder
+
+            Q1 0  Q0 Q2     Complete reduction (he three low bits of the quotient stored in C0, C3, and C1)
+            ?  1  ?  ?      Incomplete reduction
+         */
+    },
+    CYCLES_8088: {
+        nWordCyclePenalty:          4,      // NOTE: accurate for the 8088/80188 only (on the 8086/80186, it applies to odd addresses only)
+        nEACyclesBase:              5,      // base or index only (BX, BP, SI or DI)
+        nEACyclesDisp:              6,      // displacement only
+        nEACyclesBaseIndex:         7,      // base + index (BP+DI and BX+SI)
+        nEACyclesBaseIndexExtra:    8,      // base + index (BP+SI and BX+DI require an extra cycle)
+        nEACyclesBaseDisp:          9,      // base or index + displacement
+        nEACyclesBaseIndexDisp:     11,     // base + index + displacement (BP+DI+n and BX+SI+n)
+        nEACyclesBaseIndexDispExtra:12,     // base + index + displacement (BP+SI+n and BX+DI+n require an extra cycle)
+        nOpCyclesAAA:               4,      // AAA, AAS, DAA, DAS, TEST acc,imm
+        nOpCyclesAAD:               60,
+        nOpCyclesAAM:               83,
+        nOpCyclesArithRR:           3,      // ADC, ADD, AND, OR, SBB, SUB, XOR and CMP reg,reg cycle time
+        nOpCyclesArithRM:           9,      // ADC, ADD, AND, OR, SBB, SUB, and XOR reg,mem (and CMP mem,reg) cycle time
+        nOpCyclesArithMR:           16,     // ADC, ADD, AND, OR, SBB, SUB, and XOR mem,reg cycle time
+        nOpCyclesArithMID:          1,      // ADC, ADD, AND, OR, SBB, SUB, XOR and CMP mem,imm cycle delta
+        nOpCyclesCall:              19,
+        nOpCyclesCallF:             28,
+        nOpCyclesCallWR:            16,
+        nOpCyclesCallWM:            21,
+        nOpCyclesCallDM:            37,
+        nOpCyclesCLI:               2,
+        nOpCyclesCompareRM:         9,      // CMP reg,mem cycle time (same as nOpCyclesArithRM on an 8086 but not on a 80286)
+        nOpCyclesCWD:               5,
+        nOpCyclesBound:             33,     // N/A if 8086/8088, 33-35 if 80186/80188 (TODO: Determine what the range means for an 80186/80188)
+        nOpCyclesInP:               10,
+        nOpCyclesInDX:              8,
+        nOpCyclesIncR:              3,      // INC reg, DEC reg
+        nOpCyclesIncM:              15,     // INC mem, DEC mem
+        nOpCyclesInt:               51,
+        nOpCyclesInt3D:             1,
+        nOpCyclesIntOD:             2,
+        nOpCyclesIntOFall:          4,
+        nOpCyclesIRet:              32,
+        nOpCyclesJmp:               15,
+        nOpCyclesJmpF:              15,
+        nOpCyclesJmpC:              16,
+        nOpCyclesJmpCFall:          4,
+        nOpCyclesJmpWR:             11,
+        nOpCyclesJmpWM:             18,
+        nOpCyclesJmpDM:             24,
+        nOpCyclesLAHF:              4,      // LAHF, SAHF, MOV reg,imm
+        nOpCyclesLEA:               2,
+        nOpCyclesLS:                16,     // LDS, LES
+        nOpCyclesLoop:              17,     // LOOP, LOOPNZ
+        nOpCyclesLoopZ:             18,     // LOOPZ, JCXZ
+        nOpCyclesLoopNZ:            19,     // LOOPNZ
+        nOpCyclesLoopFall:          5,      // LOOP
+        nOpCyclesLoopZFall:         6,      // LOOPZ, JCXZ
+        nOpCyclesMovRR:             2,
+        nOpCyclesMovRM:             8,
+        nOpCyclesMovMR:             9,
+        nOpCyclesMovRI:             10,
+        nOpCyclesMovMI:             10,
+        nOpCyclesMovAM:             10,
+        nOpCyclesMovMA:             10,
+        nOpCyclesDivBR:             80,     // range of 80-90
+        nOpCyclesDivWR:             144,    // range of 144-162
+        nOpCyclesDivBM:             86,     // range of 86-96
+        nOpCyclesDivWM:             154,    // range of 154-172
+        nOpCyclesIDivBR:            101,    // range of 101-112
+        nOpCyclesIDivWR:            165,    // range of 165-184
+        nOpCyclesIDivBM:            107,    // range of 107-118
+        nOpCyclesIDivWM:            171,    // range of 171-190
+        nOpCyclesMulBR:             70,     // range of 70-77
+        nOpCyclesMulWR:             113,    // range of 113-118
+        nOpCyclesMulBM:             76,     // range of 76-83
+        nOpCyclesMulWM:             124,    // range of 124-139
+        nOpCyclesIMulBR:            80,     // range of 80-98
+        nOpCyclesIMulWR:            128,    // range of 128-154
+        nOpCyclesIMulBM:            86,     // range of 86-104
+        nOpCyclesIMulWM:            134,    // range of 134-160
+        nOpCyclesNegR:              3,      // NEG reg, NOT reg
+        nOpCyclesNegM:              16,     // NEG mem, NOT mem
+        nOpCyclesOutP:              10,
+        nOpCyclesOutDX:             8,
+        nOpCyclesPopAll:            51,     // N/A if 8086/8088, 51 if 80186, 83 if 80188 (TODO: Verify)
+        nOpCyclesPopReg:            8,
+        nOpCyclesPopMem:            17,
+        nOpCyclesPushAll:           36,     // N/A if 8086/8088, 36 if 80186, 68 if 80188 (TODO: Verify)
+        nOpCyclesPushReg:           11,     // NOTE: "The 8086 Book" claims this is 10, but it's an outlier....
+        nOpCyclesPushMem:           16,
+        nOpCyclesPushSeg:           10,
+        nOpCyclesPrefix:            2,
+        nOpCyclesCmpS:              18,
+        nOpCyclesCmpSr0:            9-2,    // reduced by nOpCyclesPrefix
+        nOpCyclesCmpSrn:            17-2,   // reduced by nOpCyclesPrefix
+        nOpCyclesLodS:              12,
+        nOpCyclesLodSr0:            9-2,    // reduced by nOpCyclesPrefix
+        nOpCyclesLodSrn:            13-2,   // reduced by nOpCyclesPrefix
+        nOpCyclesMovS:              18,
+        nOpCyclesMovSr0:            9-2,    // reduced by nOpCyclesPrefix
+        nOpCyclesMovSrn:            17-2,   // reduced by nOpCyclesPrefix
+        nOpCyclesScaS:              15,
+        nOpCyclesScaSr0:            9-2,    // reduced by nOpCyclesPrefix
+        nOpCyclesScaSrn:            15-2,   // reduced by nOpCyclesPrefix
+        nOpCyclesStoS:              11,
+        nOpCyclesStoSr0:            9-2,    // reduced by nOpCyclesPrefix
+        nOpCyclesStoSrn:            10-2,   // reduced by nOpCyclesPrefix
+        nOpCyclesRet:               8,
+        nOpCyclesRetn:              12,
+        nOpCyclesRetF:              18,
+        nOpCyclesRetFn:             17,
+        nOpCyclesShift1M:           15,     // ROL/ROR/RCL/RCR/SHL/SHR/SAR reg,1
+        nOpCyclesShiftCR:           8,      // ROL/ROR/RCL/RCR/SHL/SHR/SAR reg,CL
+        nOpCyclesShiftCM:           20,     // ROL/ROR/RCL/RCR/SHL/SHR/SAR mem,CL
+        nOpCyclesShiftCS:           2,      // this is the left-shift value used to convert the count to the cycle cost
+        nOpCyclesTestRR:            3,
+        nOpCyclesTestRM:            9,
+        nOpCyclesTestRI:            5,
+        nOpCyclesTestMI:            11,
+        nOpCyclesXchgRR:            4,
+        nOpCyclesXchgRM:            17,
+        nOpCyclesXLAT:              11
+    },
+    CYCLES_80286: {
+        nWordCyclePenalty:          0,
+        nEACyclesBase:              0,
+        nEACyclesDisp:              0,
+        nEACyclesBaseIndex:         0,
+        nEACyclesBaseIndexExtra:    0,
+        nEACyclesBaseDisp:          0,
+        nEACyclesBaseIndexDisp:     1,
+        nEACyclesBaseIndexDispExtra:1,
+        nOpCyclesAAA:               3,
+        nOpCyclesAAD:               14,
+        nOpCyclesAAM:               16,
+        nOpCyclesArithRR:           2,
+        nOpCyclesArithRM:           7,
+        nOpCyclesArithMR:           7,
+        nOpCyclesArithMID:          0,
+        nOpCyclesCall:              7,      // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesCallF:             13,     // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesCallWR:            7,      // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesCallWM:            11,     // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesCallDM:            16,     // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesCLI:               3,
+        nOpCyclesCompareRM:         6,
+        nOpCyclesCWD:               2,
+        nOpCyclesBound:             13,
+        nOpCyclesInP:               5,
+        nOpCyclesInDX:              5,
+        nOpCyclesIncR:              2,
+        nOpCyclesIncM:              7,
+        nOpCyclesInt:               23,     // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesInt3D:             0,
+        nOpCyclesIntOD:             1,
+        nOpCyclesIntOFall:          3,
+        nOpCyclesIRet:              17,     // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesJmp:               7,      // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesJmpF:              11,     // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesJmpC:              7,      // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesJmpCFall:          3,
+        nOpCyclesJmpWR:             7,      // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesJmpWM:             11,     // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesJmpDM:             15,     // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesLAHF:              2,
+        nOpCyclesLEA:               3,
+        nOpCyclesLS:                7,
+        nOpCyclesLoop:              8,      // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesLoopZ:             8,      // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesLoopNZ:            8,      // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesLoopFall:          4,
+        nOpCyclesLoopZFall:         4,
+        nOpCyclesMovRR:             2,      // this is actually the same as the 8086...
+        nOpCyclesMovRM:             3,
+        nOpCyclesMovMR:             5,
+        nOpCyclesMovRI:             2,
+        nOpCyclesMovMI:             3,
+        nOpCyclesMovAM:             5,      // this is actually slower than the MOD/RM form of MOV AX,mem (see nOpCyclesMovRM)
+        nOpCyclesMovMA:             3,
+        nOpCyclesDivBR:             14,
+        nOpCyclesDivWR:             22,
+        nOpCyclesDivBM:             17,
+        nOpCyclesDivWM:             25,
+        nOpCyclesIDivBR:            17,
+        nOpCyclesIDivWR:            25,
+        nOpCyclesIDivBM:            20,
+        nOpCyclesIDivWM:            28,
+        nOpCyclesMulBR:             13,
+        nOpCyclesMulWR:             21,
+        nOpCyclesMulBM:             16,
+        nOpCyclesMulWM:             24,
+        nOpCyclesIMulBR:            13,
+        nOpCyclesIMulWR:            21,
+        nOpCyclesIMulBM:            16,
+        nOpCyclesIMulWM:            24,
+        nOpCyclesNegR:              2,
+        nOpCyclesNegM:              7,
+        nOpCyclesOutP:              5,
+        nOpCyclesOutDX:             5,
+        nOpCyclesPopAll:            19,
+        nOpCyclesPopReg:            5,
+        nOpCyclesPopMem:            5,
+        nOpCyclesPushAll:           17,
+        nOpCyclesPushReg:           3,
+        nOpCyclesPushMem:           5,
+        nOpCyclesPushSeg:           3,
+        nOpCyclesPrefix:            0,
+        nOpCyclesCmpS:              8,
+        nOpCyclesCmpSr0:            5,
+        nOpCyclesCmpSrn:            9,
+        nOpCyclesLodS:              5,
+        nOpCyclesLodSr0:            5,
+        nOpCyclesLodSrn:            4,
+        nOpCyclesMovS:              5,
+        nOpCyclesMovSr0:            5,
+        nOpCyclesMovSrn:            4,
+        nOpCyclesScaS:              7,
+        nOpCyclesScaSr0:            5,
+        nOpCyclesScaSrn:            8,
+        nOpCyclesStoS:              3,
+        nOpCyclesStoSr0:            4,
+        nOpCyclesStoSrn:            3,
+        nOpCyclesRet:               11,     // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesRetn:              11,     // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesRetF:              15,     // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesRetFn:             15,     // on the 80286, this ALSO includes the number of bytes in the target instruction
+        nOpCyclesShift1M:           7,
+        nOpCyclesShiftCR:           5,
+        nOpCyclesShiftCM:           8,
+        nOpCyclesShiftCS:           0,
+        nOpCyclesTestRR:            2,
+        nOpCyclesTestRM:            6,
+        nOpCyclesTestRI:            3,
+        nOpCyclesTestMI:            6,
+        nOpCyclesXchgRR:            3,
+        nOpCyclesXchgRM:            5,
+        nOpCyclesXLAT:              5
+    },
+    /*
+     * TODO: All 80386 cycle counts are based on 80286 counts until I have time to hand-generate an 80386-specific table;
+     * the values below are used by selected 32-bit opcode handlers only.
+     */
+    CYCLES_80386: {
+        nEACyclesBase:              0,
+        nEACyclesDisp:              0,
+        nEACyclesBaseIndex:         0,
+        nEACyclesBaseIndexExtra:    0,
+        nEACyclesBaseDisp:          0,
+        nEACyclesBaseIndexDisp:     1,
+        nEACyclesBaseIndexDispExtra:1
+    }
+};
+
+/*
+ * BACKTRACK-related definitions (used only if BACKTRACK is defined)
+ */
+X86.BTINFO = {
+    SP_LO:  0,
+    SP_HI:  0
+};
+
+/*
+ * These PS flags are always stored directly in regPS for the 8086/8088, hence the
+ * "direct" designation; other processors must adjust these bits accordingly.  The final
+ * adjusted value is stored in PS_DIRECT (ie, 80286 and up also include PS.IOPL.MASK and
+ * PS.NT in PS_DIRECT).
+ */
+X86.PS_DIRECT_8086 = (X86.PS.TF | X86.PS.IF | X86.PS.DF);
+
+/*
+ * These are the default "always set" PS bits for the 8086/8088; other processors must
+ * adjust these bits accordingly.  The final adjusted value is stored in PS_SET.
+ */
+X86.PS_SET_8086 = (X86.PS.BIT1 | X86.PS.IOPL.MASK | X86.PS.NT | X86.PS.BIT15);
+
+/*
+ * These PS arithmetic and logical flags may be "cached" across several result registers;
+ * whether or not they're currently cached depends on the RESULT bits in resultType.
+ */
+X86.PS_CACHED = (X86.PS.CF | X86.PS.PF | X86.PS.AF | X86.PS.ZF | X86.PS.SF | X86.PS.OF);
+
+/*
+ * PS_SAHF is a subset of the arithmetic flags, and refers only to those flags that the
+ * SAHF and LAHF "8080 legacy" opcodes affect.
+ */
+X86.PS_SAHF = (X86.PS.CF | X86.PS.PF | X86.PS.AF | X86.PS.ZF | X86.PS.SF);
+
+/*
+ * Before we zero opFlags, we first see if any of the following PREFIX bits were set.  If any were set,
+ * they are OR'ed into opPrefixes; otherwise, opPrefixes is zeroed as well.  This gives prefix-conscious
+ * instructions like LODS, MOVS, STOS, CMPS, etc, a way of determining which prefixes, if any, immediately
+ * preceded them.
+ */
+X86.OPFLAG_PREFIXES = (X86.OPFLAG.SEG | X86.OPFLAG.LOCK | X86.OPFLAG.REPZ | X86.OPFLAG.REPNZ | X86.OPFLAG.DATASIZE | X86.OPFLAG.ADDRSIZE);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/interrupts.js (C) Jeff Parsons 2012-2017
+ */
+
+var Interrupts = {
+    VIDEO:      0x10,
+    DISK:       0x13,
+    CASSETTE:   0x15,
+    KBD:        0x16,
+    RTC:        0x1A,
+    ALT_TIMER:  0x1C,               // invoked by the BIOS timer interrupt handler (vector 0x08)
+    DOS:        0x21,
+    DOS_IDLE:   0x28,
+    DOS_NETBIOS:0x2A,
+    MOUSE:      0x33,
+    ALT_DISK:   0x40,               // HDC BIOS saves original FDC BIOS vector here
+    HD0_PARMS:  0x41,               // parameter table for hard drive 0
+    HD1_PARMS:  0x46,               // parameter table for hard drive 1
+    HD_PARMS: {
+        MAX_CYL:    0x00,           // maximum cylinders (2 bytes)
+        MAX_HEADS:  0x02,           // maximum heads (1 byte)
+        WP_CYL:     0x05,           // write precompensation cylinder (2 bytes)
+        MAX_ECC:    0x07,           // max ECC burst (1 byte)
+        DRIVE_CTRL: 0x08,           // drive control (1 byte)
+        PARK_CYL:   0x0C,           // landing zone cylinder (2 bytes)
+        SEC_TRACK:  0x0E            // sectors per track (1 byte)
+    },
+    ALT_VIDEO:  0x6D,               // IBM VGA BIOS saves original video BIOS vector here
+    WINCB: {
+        VECTOR:     0x30            // Windows PM call-back interface (aka Transfer Space Fault)
+    },
+    WINDBG: {                       // Windows Debugger protected-mode interface
+        VECTOR:     0x41,           // (AX==command)
+        IS_LOADED:  0x004F,         // DS_DebLoaded
+        LOADED:     0xF386,         // DS_DebPresent (returned in AX if Windows Debugger loaded)
+        LOADSEG:    0x0050,         // DS_LoadSeg (SI==0 if code, 1 if data; BX==segnum-1; CX==selector; ES:[E]DI->module name)
+        FREESEG:    0x0052,         // DS_FreeSeg (BX==segment)
+        KRNLVARS:   0x005A,         // DS_Kernel_Vars
+        RELSEG:     0x005C,         // DS_ReleaseSeg (same as DS_FreeSeg but "restores any breakpoints first")
+        LOADHIGH:   0x005D,         // D386_LoadCodeDataHigh
+        EXITCALL:   0x0062,         // DS_EXITCALL
+        LOADDLL:    0x0064,         // DS_LOADDLL
+        DELMODULE:  0x0065,         // DS_DELMODULE
+        UNKNOWN66:  0x0066,         // Unknown (but I suspect it isn't good)
+        UNKNOWN67:  0x0067,         // Unknown (but I suspect it isn't good)
+        REGDOTCMD:  0x0070,         // DS_RegisterDotCommand
+        CHECKFAULT: 0x007F,         // DS_CheckFault (BX==fault #, CX==FAULTTYPE bits; return AX=0 to handle fault normally, 1 to issue TRAPFAULT)
+        FAULTTYPE: {
+            V86:    0x0001,
+            PM:     0x0002,
+            RING0:  0x0004,
+            FIRST:  0x0008,
+            LAST:   0x0010
+        },
+        TRAPFAULT:  0x0083,         // DS_TrapFault (BX==fault #, CX==faulting CS, EDX==faulting EIP, ESI==fault error, EDI==fault flags)
+        GETSYMBOL:  0x008D,         // DS_GetSymbol (DS:ESI->symbol; return AX=0 if success, 1 if not found, 2 if memory not loaded yet)
+        LOADSEG32:  0x0150,         // DS_LoadSeg_32 (SI==0 if code, 1 if data; DX:EBX->D386_Device_Params)
+        FREESEG32:  0x0152,         // DS_FreeSeg_32 (BX==segment, DX:EDI->module name)
+        CONDBP:     0xF001,         // DS_CondBP (break here if WDEB386 was run with /B; ESI -> string to display)
+        ENABLED:    true            // support for WINDBG interrupts can be disabled (but NOT if WINDBGRM is enabled)
+    },
+    WINDBGRM: {                     // Windows Debugger real-mode interface
+        VECTOR:     0x68,           // (AH==command)
+        IS_LOADED:  0x43,           // D386_Identify
+        LOADED:     0xF386,         // D386_Id (returned in AX if Windows Debugger loaded)
+        PREP_PMODE: 0x44,           // D386_Prepare_PMode (must return a 16:32 address in ES:EDI to a "PMinit" handler)
+        FREESEG:    0x48,           // D386_Free_Segment (BX==real-mode segment)
+        REMOVESEGS: 0x4F,           // D386_Remove_Segs (remove any undefined segments from the named module at ES:DI)
+        LOADSEG:    0x50,           // D386_Load_Segment (AL=segment type, ES:DI->D386_Device_Params)
+        ENABLED:    true            // support for WINDBGRM interrupts can be disabled
+    },
+    FUNCS: {}                       // filled in only if DEBUGGER is true
+};
+
+if (DEBUGGER) {
+    Interrupts.BIOS_DATA = {
+        0x400:  ["RS232_BASE",8],       // BASE ADDRESSES OF RS232 ADAPTERS
+        0x408:  ["PRINTER_BASE",8],     // BASE ADDRESSES OF PRINTER ADAPTERS
+        0x410:  ["EQUIP_FLAG",2],       // INSTALLED HARDWARE FLAGS
+        0x412:  ["MFG_TST",1],          // INITIALIZATION FLAGS
+        0x413:  ["MEMORY_SIZE",2],      // BASE MEMORY SIZE IN K BYTES  (X 1024)
+        0x415:  ["MFG_ERR_FLAG",2],     // SCRATCHPAD FOR MANUFACTURING ERROR CODES
+        0x417:  ["KB_FLAG",1],          // KEYBOARD SHIFT STATE AND STATUS FLAGS
+        0x418:  ["KB_FLAG_1",1],        // SECOND BYTE OF KEYBOARD STATUS
+        0x419:  ["ALT_INPUT",1],        // STORAGE FOR ALTERNATE KEY PAD ENTRY
+        0x41A:  ["BUFFER_HEAD",2],      // POINTER TO HEAD OF KEYBOARD BUFFER
+        0x41C:  ["BUFFER_TAIL",2],      // POINTER TO TAIL OF KEYBOARD BUFFER
+        0x41E:  ["KB_BUFFER",32],       // ROOM FOR 15 SCAN CODE ENTRIES
+        0x43E:  ["SEEK_STATUS",1],      // DRIVE RECALIBRATION STATUS (BIT 3-0 = DRIVE 3-0 RECALIBRATION BEFORE NEXT SEEK IF BIT IS = 0)
+        0x43F:  ["MOTOR_STATUS",1],     // MOTOR STATUS (BIT 3-0 = DRIVE 3-0 CURRENTLY RUNNING, BIT 7 = CURRENT OPERATION IS A WRITE)
+        0x440:  ["MOTOR_COUNT",1],      // TIME OUT COUNTER FOR MOTOR(S) TURN OFF
+        0x441:  ["DISKETTE_STATUS",1],  // RETURN CODE STATUS BYTE
+        0x442:  ["NEC_STATUS",7],       // STATUS BYTES FROM DISKETTE OPERATION
+        0x449:  ["CRT_MODE",1],         // CURRENT DISPLAY MODE (TYPE)
+        0x44A:  ["CRT_COLS",2],         // NUMBER OF COLUMNS ON SCREEN
+        0x44C:  ["CRT_LEN",2],          // LENGTH OF REGEN BUFFER IN BYTES
+        0x44E:  ["CRT_START",2],        // STARTING ADDRESS IN REGEN BUFFER
+        0x450:  ["CURSOR_POSN",16],     // CURSOR FOR EACH OF UP TO 8 PAGES
+        0x460:  ["CURSOR_MODE",2],      // CURRENT CURSOR MODE SETTING
+        0x462:  ["ACTIVE_PAGE",1],      // CURRENT PAGE BEING DISPLAYED
+        0x463:  ["ADDR_6845",2],        // BASE ADDRESS FOR ACTIVE DISPLAY CARD
+        0x465:  ["CRT_MODE_SET",1],     // CURRENT SETTING OF THE 3X8 REGISTER
+        0x466:  ["CRT_PALETTE",1],      // CURRENT PALETTE SETTING - COLOR CARD
+        0x467:  ["IO_ROM_INIT",2],      // POINTER TO ROM INITIALIZATION ROUTINE
+        0x469:  ["IO_ROM_SEG",2],       // POINTER TO I/O ROM SEGMENT
+        0x46B:  ["INTR_FLAG",1],        // FLAG INDICATING AN INTERRUPT HAPPENED
+        0x46C:  ["TIMER_LOW",2],        // LOW WORD OF TIMER COUNT
+        0x46E:  ["TIMER_HIGH",2],       // HIGH WORD OF TIMER COUNT
+        0x470:  ["TIMER_OFL",1],        // TIMER HAS ROLLED OVER SINCE LAST READ
+        0x471:  ["BIOS_BREAK",1],       // BIT 7=1 IF BREAK KEY HAS BEEN PRESSED
+        0x472:  ["RESET_FLAG",2],       // WORD=1234H IF KEYBOARD RESET UNDERWAY
+        0x474:  ["DISK_STATUS1",1],     // FIXED DISK STATUS
+        0x475:  ["HF_NUM",1],           // COUNT OF FIXED DISK DRIVES
+        0x476:  ["CONTROL_BYTE",1],     // HEAD CONTROL BYTE
+        0x477:  ["PORT_OFF",1],         // RESERVED (PORT OFFSET)
+        0x478:  ["PRINT_TIM_OUT",4],    // TIME OUT COUNTERS FOR PRINTER RESPONSE
+        0x47C:  ["RS232_TIM_OUT",4],    // TIME OUT COUNTERS FOR RS232 RESPONSE
+        0x480:  ["BUFFER_START",2],     // OFFSET OF KEYBOARD BUFFER START
+        0x482:  ["BUFFER_END",2],       // OFFSET OF END OF BUFFER
+        0x484:  ["ROWS",1],             // ROWS ON THE ACTIVE SCREEN (LESS 1)
+        0x485:  ["POINTS",2],           // BYTES PER CHARACTER
+        0x487:  ["INFO",1],             // MODE OPTIONS
+        0x488:  ["INFO_3",3],           // FEATURE BIT SWITCHES
+        0x48B:  ["LASTRATE",1],         // LAST DISKETTE DATA RATE SELECTED
+        0x48C:  ["HF_STATUS",1],        // STATUS REGISTER
+        0x48D:  ["HF_ERROR",1],         // ERROR REGISTER
+        0x48E:  ["HF_INT_FLAG",1],      // FIXED DISK INTERRUPT FLAG
+        0x48F:  ["HF_CNTRL",1],         // COMBO FIXED DISK/DISKETTE CARD BIT 0=1
+        0x490:  ["DSK_STATE",4],        // DRIVE 0 MEDIA STATE, DRIVE 1 MEDIA STATE, DRIVE 0 OPERATION START STATE, DRIVE 1 OPERATION START STATE
+        0x494:  ["DSK_TRK",2],          // DRIVE 0 PRESENT CYLINDER, DRIVE 1 PRESENT CYLINDER
+        0x496:  ["KB_FLAG_3",1],        // KEYBOARD MODE STATE AND TYPE FLAGS
+        0x497:  ["KB_FLAG_2",1],        // KEYBOARD LED FLAGS
+        0x498:  ["USER_FLAG",2],        // OFFSET ADDRESS OF USERS WAIT FLAG
+        0x49A:  ["USER_FLAG_SEG",2],    // SEGMENT ADDRESS OF USER WAIT FLAG
+        0x49C:  ["RTC_LOW",2],          // LOW WORD OF USER WAIT FLAG
+        0x49E:  ["RTC_HIGH",2],         // HIGH WORD OF USER WAIT FLAG
+        0x4A0:  ["RTC_WAIT_FLAG",1],    // WAIT ACTIVE FLAG (01=BUSY, 80=POSTED) (00=POST ACKNOWLEDGED)
+        0x4A1:  ["NET",7],              // RESERVED FOR NETWORK ADAPTERS
+        0x4A8:  ["SAVE_PTR",4]          // POINTER TO EGA PARAMETER CONTROL BLOCK
+    },
+    /*
+     * See DebuggerX86.prototype.replaceRegs() for the rules governing how register contents are replaced in the strings below.
+     *
+     * Replacements occur in the following order:
+     *
+     *      Replace every @XX (or @XXX), where XX (or XXX) is a register, with the register's value.
+     *      Replace every #XX, where XX is a hex byte value, with the corresponding ASCII character (if printable).
+     *      Replace every $XXXX:XXXX, where XXXX:XXXX is a segmented address, with the zero-terminated string at that address.
+     *      Replace every ^XXXX:XXXX, where XXXX:XXXX is a segmented address, with the FCB filename stored at that address.
+     *
+     * The last replacement is obviously DOS-specific, since FCBs are DOS constructs.
+     */
+    Interrupts.FUNCS[Interrupts.DISK] = {
+        0x00: "disk reset",
+        0x01: "get status",
+        0x02: "read drive @DL (@CH:@DH:@CL,@AL) into @ES:@BX",
+        0x03: "write drive @DL (@CH:@DH:@CL,@AL) from @ES:@BX",
+        0x04: "verify drive @DL (@CH:@DH:@CL,@AL)",
+        0x05: "format drive @DL using @ES:@BX",
+        0x08: "read drive @DL parameters",
+        0x15: "get drive @DL DASD type",
+        0x16: "get drive @DL change line status",
+        0x17: "set drive @DL DASD type",
+        0x18: "set drive @DL media type"
+        /*
+         * Here's an additional function reference, previously in the HDC component, but moved here
+         * because our components are hardware emulations, not BIOS emulations, so this information is
+         * really only of interest to the Debugger (or the casual observer).
+         *
+         *      RESET:          0x00,
+         *      GET_STATUS:     0x01,
+         *      READ_SECTORS:   0x02,
+         *      WRITE_SECTORS:  0x03,
+         *      VERIFY_SECTORS: 0x04,
+         *      FORMAT_TRK:     0x05,
+         *      FORMAT_BAD:     0x06,
+         *      FORMAT_DRIVE:   0x07,
+         *      GET_DRIVEPARMS: 0x08,
+         *      SET_DRIVEPARMS: 0x09,
+         *      READ_LONG:      0x0A,
+         *      WRITE_LONG:     0x0B,
+         *      SEEK:           0x0C,
+         *      ALT_RESET:      0x0D,
+         *      READ_BUFFER:    0x0E,
+         *      WRITE_BUFFER:   0x0F,
+         *      TEST_READY:     0x10,
+         *      RECALIBRATE:    0x11,
+         *      RAM_DIAGNOSTIC: 0x12,
+         *      DRV_DIAGNOSTIC: 0x13,
+         *      CTL_DIAGNOSTIC: 0x14
+         */
+    };
+    Interrupts.FUNCS[Interrupts.CASSETTE] = {
+        0x80: "open device",
+        0x81: "close device",
+        0x82: "program termination",
+        0x83: "wait @CX:@DXus for event",
+        0x84: "joystick support",
+        0x85: "SYSREQ pressed",
+        0x86: "wait @CX:@DXus",
+        0x87: "move block (@CX words)",
+        0x88: "get extended memory size",
+        0x89: "processor to virtual mode",
+        0x90: "device busy loop",
+        0x91: "interrupt complete flag set"
+    };
+    Interrupts.FUNCS[Interrupts.DOS] = {
+        0x00: "terminate program",
+        0x01: "read character (AL) from stdin with echo",
+        0x02: "write character #@DL to stdout",
+        0x03: "read character (AL) from stdaux",                                // eg, COM1
+        0x04: "write character #@DL to stdaux",                                 // eg, COM1
+        0x05: "write character #@DL to stdprn",                                 // eg, LPT1
+        0x06: "direct console output (input if @DL=FF)",
+        0x07: "direct console input without echo",
+        0x08: "read character (AL) from stdin without echo",
+        0x09: "write string $@DS:@DX to stdout",
+        0x0A: "buffered input (DS:DX)",                                         // byte 0 is maximum chars, byte 1 is number of previous characters, byte 2 is number of characters read
+        0x0B: "get stdin status",
+        0x0C: "flush buffer and read stdin",                                    // AL is a function # (0x01, 0x06, 0x07, 0x08, or 0x0A)
+        0x0D: "disk reset",
+        0x0E: "select default drive @DL",                                       // returns # of available drives in AL
+        0x0F: "open file using FCB ^@DS:@DX",                                   // DS:DX -> unopened File Control Block
+        0x10: "close file using FCB ^@DS:@DX",
+        0x11: "find first matching file using FCB ^@DS:@DX",
+        0x12: "find next matching file using FCB ^@DS:@DX",
+        0x13: "delete file using FCB ^@DS:@DX",
+        0x14: "sequential read from file using FCB ^@DS:@DX",
+        0x15: "sequential write to file using FCB ^@DS:@DX",
+        0x16: "create or truncate file using FCB ^@DS:@DX",
+        0x17: "rename file using FCB ^@DS:@DX",
+        0x19: "get current default drive (AL)",
+        0x1A: "set disk transfer area (DTA=@DS:@DX)",
+        0x1B: "get allocation information for default drive",
+        0x1C: "get allocation information for specific drive @DL",
+        0x1F: "get drive parameter block for default drive",
+        0x21: "read random record from file using FCB ^@DS:@DX",
+        0x22: "write random record to file using FCB ^@DS:@DX",
+        0x23: "get file size using FCB ^@DS:@DX",
+        0x24: "set random record number for FCB ^@DS:@DX",
+        0x25: "set address @DS:@DX of interrupt vector @AL",
+        0x26: "create new PSP at segment @DX",
+        0x27: "random block read from file using FCB ^@DS:@DX",
+        0x28: "random block write to file using FCB ^@DS:@DX",
+        0x29: "parse filename $@DS:@SI into FCB @ES:@DI using @AL",
+        0x2A: "get system date (year=CX, mon=DH, day=DL)",
+        0x2B: "set system date (year=@CX, mon=@DH, day=@DL)",
+        0x2C: "get system time (hour=CH, min=CL, sec=DH, 100ths=DL)",
+        0x2D: "set system time (hour=@CH, min=@CL, sec=@DH, 100ths=@DL)",
+        0x2E: "set verify flag @AL",
+        0x2F: "get disk transfer area (DTA=ES:BX)",                             // DOS 2.00+
+        0x30: "get DOS version (AL=major, AH=minor)",
+        0x31: "terminate and stay resident",
+        0x32: "get drive parameter block (DPB=DS:BX) for drive @DL",
+        0x33: "extended break check",
+        0x34: "get address (ES:BX) of InDOS flag",
+        0x35: "get address (ES:BX) of interrupt vector @AL",
+        0x36: "get free disk space of drive @DL",
+        0x37: "get(0)/set(1) switch character @DL (@AL)",
+        0x38: "get country-specific information",
+        0x39: "create subdirectory $@DS:@DX",
+        0x3A: "remove subdirectory $@DS:@DX",
+        0x3B: "set current directory $@DS:@DX",
+        0x3C: "create or truncate file $@DS:@DX with attributes @CX",
+        0x3D: "open file $@DS:@DX with mode @AL",
+        0x3E: "close file @BX",
+        0x3F: "read @CX bytes from file @BX into buffer @DS:@DX",
+        0x40: "write @CX bytes to file @BX from buffer @DS:@DX",
+        0x41: "delete file $@DS:@DX",
+        0x42: "set position @CX:@DX of file @BX relative to @AL",
+        0x43: "get(0)/set(1) attributes @CX of file $@DS:@DX (@AL)",
+        0x44: "get device information (IOCTL)",
+        0x45: "duplicate file handle @BX",
+        0x46: "force file handle @CX to duplicate file handle @BX",
+        0x47: "get current directory (DS:SI) for drive @DL",
+        0x48: "allocate memory segment with @BX paragraphs",
+        0x49: "free memory segment @ES",
+        0x4A: "resize memory segment @ES to @BX paragraphs",
+        0x4B: "load program $@DS:@DX using parameter block @ES:@BX",
+        0x4C: "terminate with return code @AL",
+        0x4D: "get return code (AL)",
+        0x4E: "find first matching file $@DS:@DX with attributes @CX",
+        0x4F: "find next matching file",
+        0x50: "set current PSP @BX",
+        0x51: "get current PSP (bx)",
+        0x52: "get system variables (ES:BX)",
+        0x53: "translate BPB @DS:@SI to DPB (ES:BP)",
+        0x54: "get verify flag (AL)",
+        0x55: "create child PSP at segment @DX",
+        0x56: "rename file $@DS:@DX to $@ES:@DI",
+        0x57: "get(0)/set(1) file @BX date @DX and time @CX (@AL)",
+        0x58: "get(0)/set(1) memory allocation strategy (@AL)",                 // DOS 2.11+
+        0x59: "get extended error information",                                 // DOS 3.00+
+        0x5A: "create temporary file $@DS:@DX with attributes @CX",             // DOS 3.00+
+        0x5B: "create file $@DS:@DX with attributes @CX",                       // DOS 3.00+ (doesn't truncate existing files like 0x3C)
+        0x5C: "lock(0)/unlock(1) file @BX region @CX:@DX length @SI:@DI (@AL)", // DOS 3.00+
+        0x5D: "critical error information (@AL)",                               // DOS 3.00+ (undocumented)
+        0x60: "get fully-qualified filename from $@DS:@SI",                     // DOS 3.00+ (undocumented)
+        0x63: "get lead byte table (@AL)",                                      // DOS 2.25 and 3.20+
+        0x6C: "extended open file $@DS:@SI"                                     // DOS 4.00+
+    };
+    Interrupts.FUNCS[Interrupts.WINDBG.VECTOR] = {
+        0x004F: "check debugger loaded"         // WINDBG.IS_LOADED returns WINDBG.LOADED (0xF386) if debugger loaded
+    };
+}
+
+/*
+ * DOS function reference (from https://sites.google.com/site/pcdosretro/dosfuncs)
+ *
+ *      INT 20 Program terminate (1.0+)
+ *      Entry: CS=PSP
+ *      Exit:  Does not return to caller
+ *
+ *      INT 21 Execute DOS function
+ *      00 Program terminate (1.0+)
+ *         Entry: CS=PSP
+ *         Exit:  Does not return to caller
+ *      01 Character input (1.0+)
+ *         Entry: None
+ *         Exit:  AL=character
+ *      02 Character output (1.0+)
+ *         Entry: DL=character
+ *         Exit:  None
+ *      03 Auxiliary input (1.0+)
+ *         Entry: None
+ *         Exit:  AL=character
+ *      04 Auxiliary output (1.0+)
+ *         Entry: DL=character
+ *         Exit:  None
+ *      05 Printer output (1.0+)
+ *         Entry: DL=character
+ *         Exit:  None
+ *      06 Direct console I/O (1.0+)
+ *         Entry: DL=FF for console input
+ *                DL=character for console output
+ *         Exit:  ZF=0 if a character is ready, AL=character
+ *                ZF=1 if no character is ready
+ *      07 Direct console input without echo (1.0+)
+ *         Entry: None
+ *         Exit:  AL=character
+ *      08 Console input without echo (1.0+)
+ *         Entry: None
+ *         Exit:  AL=character
+ *      09 Display string (1.0+)
+ *         Entry: DS:DX-&gt;string ending with $
+ *         Exit:  None
+ *      0A Buffered keyboard input (1.0+)
+ *         Entry: DS:DX-&gt;input buffer (first byte of buffer=maximum input length)
+ *         Exit:  second byte of buffer=actual input length
+ *      0B Get input status (1.0+)
+ *         Entry: None
+ *         Exit:  AL=00 no character available
+ *                AL=FF character available
+ *      0C Flush input buffer and input (1.0+)
+ *         Entry: AL=function number (01,06,07,08,or 0A otherwise flush only)
+ *                DS:DX-&gt;input buffer if function 0A
+ *         Exit:  AL=character unless function 0A
+ *      0D Disk reset (1.0+)
+ *         Entry: None
+ *         Exit:  None
+ *      0E Set default drive (1.0+)
+ *         Entry: DL=drive code (0=A)
+ *         Exit:  AL=number of logical drives
+ *      0F Open file (1.0+)
+ *         Entry: DS:DX-&gt;unopened FCB
+ *         Exit:  AL=00 file opened
+ *                AL=FF file not found
+ *      10 Close file (1.0+)
+ *         Entry: DS:DX-&gt;opened FCB
+ *         Exit:  AL=00 file closed
+ *                AL=FF file not found
+ *      11 Find first file (1.0+)
+ *         Entry: DS:DX-&gt;unopened FCB
+ *         Exit:  AL=00 matching filename found
+ *                      buffer at DTA receives an unopened FCB and directory entry
+ *                      original FCB contents:
+ *                      FCB    search drive code (1=A)
+ *                      FCB+1  specified filespec
+ *                      FCB+12 search attribute byte
+ *                      FCB+13 directory entry offset
+ *                      FCB+15 directory cluster (0=root)
+ *                      FCB+17 unused
+ *                      FCB+21 actual drive code (1=A)
+ *                AL=FF matching filename not found
+ *         Note:  The file's directory entry is returned after the FCB drive code.
+ *                If a character device is found then the directory attribute byte
+ *                is set to 40h.
+ *      12 Find next file (1.0+)
+ *         Entry: DS:DX-&gt;unopened FCB from previous 11 or 12 call
+ *         Exit:  AL=00 matching filename found
+ *                      buffer at DTA receives an unopened FCB and directory entry
+ *                AL=FF matching filename not found
+ *         Note:  The file's directory entry is returned after the FCB drive code.
+ *      13 Delete file (1.0+)
+ *         Entry: DS:DX-&gt;unopened FCB
+ *         Exit:  AL=00 file deleted
+ *                AL=FF matching filename not found or files are read-only
+ *      14 Sequential read (1.0+)
+ *         Entry: DS:DX-&gt;opened FCB
+ *         Exit:  AL=00 file was read
+ *                AL=01 EOF (no data read)
+ *                AL=02 segment wrap
+ *                AL=03 EOF (partial read)
+ *      15 Sequential write (1.0+)
+ *         Entry: DS:DX-&gt;opened FCB
+ *         Exit:  AL=00 file was written
+ *                AL=01 disk full
+ *                AL=02 segment wrap
+ *      16 Create or truncate file (1.0+)
+ *         Entry: DS:DX-&gt;unopened FCB
+ *         Exit:  AL=00 file created
+ *                AL=FF directory full
+ *      17 Rename file (1.0+)
+ *         Entry: DS:DX-&gt;rename FCB (FCB+11h-&gt;new filename)
+ *         Exit:  AL=00 file renamed
+ *                AL=FF no matching files found or new filename already exists
+ *      18 Reserved
+ *      19 Get default drive (1.0+)
+ *         Entry: None
+ *         Exit:  AL=drive code (0=A)
+ *      1A Set disk transfer address (1.0+)
+ *         Entry: DS:DX=new DTA
+ *         Exit:  None
+ *      1B Get allocation info for default drive (1.0+)
+ *         Entry: None
+ *         Exit:  AL=sectors per cluster
+ *                CX=bytes per sector
+ *                DX=clusters per drive
+ *                DS:BX-&gt;media descriptor byte
+ *                AL=FF invalid drive
+ *      1C Get allocation info for specified drive (1.1+)
+ *         Entry: DL=drive code (0=default)
+ *         Exit:  Same as function 1B
+ *      1D Reserved
+ *      1E Reserved
+ *      1F Get disk parameter block for default drive (1.1+)
+ *         Entry: None
+ *         Exit:  AL=00 drive valid
+ *                DS:BX-&gt;disk parameter block
+ *                   0 drive code (0=A)             13 maximum cluster number
+ *                   1 unit code                    15 sectors per FAT
+ *                   2 bytes per sector             17 first directory sector
+ *                   4 sectors per cluster-1        19 pointer to device driver
+ *                   5 cluster shift factor         23 media descriptor byte
+ *                   6 first FAT sector             24 access flag (0=accessed)
+ *                   8 number of FATs               25 pointer to next DPB
+ *                   9 number of directory entries  29 last cluster allocated
+ *                  11 first data sector            31 free clusters (-1=unknown)
+ *                AL=FF drive invalid
+ *         Note:  (3.x) The sectors per FAT field is one byte and all following
+ *                fields are moved back one byte.
+ *      20 Reserved
+ *      21 Random read (1.0+)
+ *         Entry: DS:DX-&gt;opened FCB
+ *         Exit:  AL=00 file was read
+ *                AL=01 EOF (no data read)
+ *                AL=02 segment wrap
+ *                AL=03 EOF (partial read)
+ *      22 Random write (1.0+)
+ *         Entry: DS:DX-&gt;opened FCB
+ *         Exit:  AL=00 file was written
+ *                AL=01 disk full
+ *                AL=02 segment wrap
+ *      23 Get file size in records (1.0+)
+ *         Entry: DS:DX-&gt;unopened FCB
+ *         Exit:  AL=00 random record field is set by dividing the file size by the
+ *                      specified record size
+ *                AL=FF file not found
+ *      24 Set random record number (1.0+)
+ *         Entry: DS:DX-&gt;opened FCB
+ *         Exit:  random record field is set based on record size, current record,
+ *                and current block
+ *      25 Set interrupt vector (1.0+)
+ *         Entry: DS:DX=new address
+ *                AL=interrupt number
+ *         Exit:  None
+ *      26 Create PSP (1.0+)
+ *         Entry: CS=PSP
+ *                DX=segment for new PSP
+ *         Exit:  None
+ *      27 Random block read (1.0+)
+ *         Entry: DS:DX-&gt;opened FCB
+ *                CX=number of records to read
+ *         Exit:  AL=00 file was read
+ *                AL=01 EOF (no data read)
+ *                AL=02 segment wrap
+ *                AL=03 EOF (partial read)
+ *                CX=actual number of records read
+ *      28 Random block write (1.0+)
+ *         Entry: DS:DX-&gt;opened FCB
+ *                CX=number of records to write
+ *         Exit:  AL=00 file was written
+ *                AL=01 disk full
+ *                AL=02 segment wrap
+ *                CX=actual number of records written
+ *      29 Parse filename (1.0+)
+ *         Entry: DS:SI-&gt;string to parse
+ *                ES:DI-&gt;buffer for unopened FCB
+ *                AL=flags
+ *                   Bit 0 1=ignore leading separators
+ *                       1 1=modify FCB drive code byte only if a drive is specified
+ *                       2 1=modify FCB filename only if a filename is specified
+ *                       3 1=modify FCB extension only if an extension is specified
+ *         Exit:  DS:SI-&gt;first character after parsed filename
+ *                AL=00 no wildcard characters in string
+ *                AL=01 wildcard characters in string
+ *                AL=FF invalid drive
+ *      2A Get date (1.0+)
+ *         Entry: None
+ *         Exit:  AL=weekday (0=Sunday)
+ *                CX=year
+ *                DH=month
+ *                DL=day
+ *      2B Set date (1.0+)
+ *         Entry: CX=year
+ *                DH=month
+ *                DL=day
+ *         Exit:  AL=00 date set
+ *                AL=FF invalid date
+ *      2C Get time (1.0+)
+ *         Entry: None
+ *         Exit:  CH=hours
+ *                CL=minutes
+ *                DH=seconds
+ *                DL=hundredths
+ *      2D Set time (1.0+)
+ *         Entry: CH=hours
+ *                CL=minutes
+ *                DH=seconds
+ *                DL=hundredths
+ *         Exit:  AL=00 time set
+ *                AL=FF invalid time
+ *      2E Set verify flag (1.1+)
+ *         Entry: AL=verify flag (0=off,1=on)
+ *         Exit:  None
+ *      2F Get disk transfer address (2.0+)
+ *         Entry: None
+ *         Exit:  ES:BX=DTA
+ *      30 Get DOS version (2.0+)
+ *         Entry: AL=0 return OEM number (5.0+)
+ *                AL=1 return version flag (5.0+)
+ *         Exit:  AL=major version number
+ *                AH=minor version number
+ *                BH=OEM number or version flag (00=RAM,08=ROM)
+ *                BL:CX=24-bit serial number or 0
+ *      31 Terminate and stay resident (2.0+)
+ *         Entry: AL=return code
+ *                DX=memory size in paragraphs (minimum 6)
+ *         Exit:  Does not return to caller
+ *      32 Get disk parameter block for specified drive (2.0+)
+ *         Entry: DL=drive code (0=default)
+ *         Exit:  Same as function 1F
+ *      33 Get or set Ctrl-Break (2.0+)
+ *         Entry: AL=0 get break
+ *                AL=1 set break
+ *                AL=2 swap break (*) (3.1+)
+ *                AL=5 get boot drive (4.0+)
+ *                AL=6 get DOS version (5.0+)
+ *                DL=break flag if set or swap (0=off,1=on)
+ *         Exit:  if function 00 or 02:
+ *                   DL=break flag
+ *                if function 05:
+ *                   DL=boot drive code (1=A)
+ *                if function 06:
+ *                   BL=major version
+ *                   BH=minor version
+ *                   DL=revision (0=A)
+ *                   DH=version flag (00=low,08=ROM,10=HMA)
+ *      34 Get InDOS flag pointer (2.0+)
+ *         Entry: None
+ *         Exit:  ES:BX-&gt;InDOS flag
+ *         Note:  The DOS critical error flag immediately precedes this byte.
+ *      35 Get interrupt vector (2.0+)
+ *         Entry: AL=interrupt number
+ *         Exit:  ES:BX=interrupt address
+ *      36 Get free disk space (2.0+)
+ *         Entry: DL=drive code (0=default)
+ *         Exit:  AX=sectors per cluster
+ *                BX=free clusters
+ *                CX=bytes per sector
+ *                DX=clusters per drive
+ *                AX=FFFF if drive invalid
+ *      37 Get or set switch character (*) (2.0+)
+ *         Entry: AL=0 get switch character
+ *                AL=1 set switch character
+ *                DL=switch character if set
+ *         Exit:  DL=switch character if get
+ *         Note:  (5.0+) Function 3701 has been disabled.
+ *      38 Get or set country info (2.0+)
+ *         Entry: AL=country code (0=default)
+ *                BX=country code if AL=FF (3.0+)
+ *                DX=FFFF if set request (2.11+)
+ *                DS:DX-&gt;buffer if get request
+ *         Exit:  CF=0 BX=country code if get request (3.0+)
+ *                     buffer format:
+ *                      0 date format (0=USA,1=Europe,2=Japan)
+ *                      2 currency symbol string
+ *                      7 thousands separator
+ *                      9 decimal separator
+ *                     11 date separator
+ *                     13 time separator
+ *                     15 currency format
+ *                        0 symbol before amount, no space between
+ *                        1 symbol after amount, no space between
+ *                        2 symbol before amount, 1 space between
+ *                        3 symbol after amount, 1 space between
+ *                        4 symbol replaces decimal separator
+ *                     16 digits after decimal in currency
+ *                     17 time format (0=12-hour,1=24-hour)
+ *                     18 case map call address
+ *                     22 data list separator
+ *                     24 reserved (10 bytes)
+ *                CF=1 AX=error code
+ *      39 Create directory (2.0+)
+ *         Entry: DS:DX-&gt;directory name
+ *         Exit:  CF=0 None
+ *                CF=1 AX=error code
+ *      3A Remove directory (2.0+)
+ *         Entry: DS:DX-&gt;directory name
+ *         Exit:  CF=0 None
+ *                CF=1 AX=error code
+ *      3B Change current directory (2.0+)
+ *         Entry: DS:DX-&gt;directory name
+ *         Exit:  CF=0 None
+ *                CF=1 AX=error code
+ *      3C Create or truncate file (2.0+)
+ *         Entry: DS:DX-&gt;filename
+ *                CX=file attributes
+ *         Exit:  CF=0 AX=file handle
+ *                CF=1 AX=error code
+ *      3D Open file (2.0+)
+ *         Entry: DS:DX-&gt;filename
+ *                AL=open mode
+ *                   Bit 0-2 access mode
+ *                           000=read
+ *                           001=write
+ *                           010=read/write
+ *                       4-6 sharing mode (3.0+)
+ *                           000=compatibility
+ *                           001=deny read/write access
+ *                           010=deny write access
+ *                           011=deny read access
+ *                           100=deny none access
+ *                         7 inheritance flag
+ *                           0=file inherited by EXECed programs
+ *                           1=file not inherited by EXECed programs
+ *         Exit:  CF=0 AX=file handle
+ *                CF=1 AX=error code
+ *      3E Close file (2.0+)
+ *         Entry: BX=file handle
+ *         Exit:  CF=0 None
+ *                CF=1 AX=error code
+ *      3F Read file or device (2.0+)
+ *         Entry: BX=file handle
+ *                CX=bytes to read
+ *                DS:DX-&gt;input buffer
+ *         Exit:  CF=0 AX=number of bytes read (0=EOF)
+ *                CF=1 AX=error code
+ *      40 Write file or device (2.0+)
+ *         Entry: BX=file handle
+ *                CX=bytes to write (0=truncate file)
+ *                DS:DX-&gt;output buffer
+ *         Exit:  CF=0 AX=number of bytes written (0=disk full)
+ *                CF=1 AX=error code
+ *      41 Delete file (2.0+)
+ *         Entry: DS:DX-&gt;filename
+ *         Exit:  CF=0 None
+ *                CF=1 AX=error code
+ *      42 Move file pointer (2.0+)
+ *         Entry: AL=code (0=absolute,1=relative,2=relative to EOF)
+ *                BX=file handle
+ *                CX:DX=offset
+ *         Exit:  CF=0 DX:AX=new pointer
+ *                CF=1 AX=error code
+ *      43 Get or set file attributes (2.0+)
+ *         Entry: AL=0 get attributes
+ *                AL=1 set attributes
+ *                CX=file attributes if set
+ *                   Bit 0 1=read-only
+ *                       1 1=hidden
+ *                       2 1=system
+ *                       4 1=directory (get only)
+ *                       5 1=archive
+ *                DS:DX-&gt;filename
+ *         Exit:  CF=0 CX=file attributes if get
+ *                CF=1 AX=error code
+ *      44 I/O control for devices (2.0+)
+ *         Notes: 1) Functions 02-05 work only if bit 14 of the device driver
+ *                   attribute word is set.
+ *                2) Function 08 works only if bit 11 of the device driver
+ *                   attribute word is set.
+ *                3) Functions 0C-0F work only if bit 6 of the device driver
+ *                   attribute word is set.
+ *                4) Functions 10-11 work only if bit 7 of the device driver
+ *                   attribute word is set.
+ *         00 Get device attributes (2.0+)
+ *            Entry: BX=file handle
+ *            Exit:  CF=0 DX=device attributes
+ *                        Character devices:
+ *                        Bit 0 1=console input
+ *                            1 1=console output
+ *                            2 1=NUL device
+ *                            3 1=CLOCK device
+ *                            4 1=INT 29 output (CON)
+ *                            5 0=ASCII,1=binary
+ *                            6 0=EOF on input
+ *                            7 1=character device
+ *                           11 1=open/close supported
+ *                           13 1=output until busy supported
+ *                           14 1=IOCTL supported
+ *                        Block devices:
+ *                        Bit 0-5 drive code (0=A)
+ *                              6 0=file has been written
+ *                              7 0=block device
+ *                   CF=1 AX=error code
+ *         01 Set device attributes (2.0+)
+ *            Entry: BX=file handle (character devices only)
+ *                   DX=device attributes (DH must be 0)
+ *            Exit:  CF=0 None
+ *                   CF=1 AX=error code
+ *         02 Read from character device (2.0+)
+ *         03 Write to character device (2.0+)
+ *            Entry: BX=file handle
+ *                   CX=number of bytes
+ *                   DS:DX-&gt;buffer
+ *            Exit:  CF=0 AX=number of bytes transferred
+ *                   CF=1 AX=error code
+ *         04 Read from block device (2.0+)
+ *         05 Write to block device (2.0+)
+ *            Entry: BL=drive code (0=default)
+ *                   CX=number of bytes
+ *                   DS:DX-&gt;buffer
+ *            Exit:  CF=0 AX=number of bytes transferred
+ *                   CF=1 AX=error code
+ *         06 Get input status (2.0+)
+ *         07 Get output status (2.0+)
+ *            Entry: BX=file handle
+ *            Exit:  CF=0 AL=status (00=not ready,FF=ready)
+ *                   CF=1 AX=error code
+ *         08 Removable media check (3.0+)
+ *            Entry: BL=drive code (0=default)
+ *            Exit:  CF=0 AX=value (0=removable,1=fixed)
+ *                   CF=1 AX=error code
+ *         09 Local/remote drive check (3.0+)
+ *            Entry: BL=drive code (0=default)
+ *            Exit:  CF=0 DX=device attributes
+ *                        Bit 1 1=32-bit sectors supported
+ *                            6 1=generic IOCTL calls supported
+ *                            7 1=query IOCTL call supported
+ *                            9 1=shared drive; direct I/O not allowed
+ *                           11 1=removable media call supported
+ *                           12 1=remote drive
+ *                           13 1=media descriptor in FAT required
+ *                           14 1=IOCTL calls supported
+ *                           15 1=SUBSTed
+ *                   CF=1 AX=error code
+ *         0A Local/remote handle check (3.0+)
+ *            Entry: BX=file handle
+ *            Exit:  CF=0 DX=device attributes from SFT
+ *                        Character devices:
+ *                        Bit 0 1=console input
+ *                            1 1=console output
+ *                            2 1=NUL device
+ *                            3 1=CLOCK device
+ *                            4 1=INT 29 output (CON)
+ *                            5 0=ASCII,1=binary
+ *                            6 0=EOF on input
+ *                            7 1=character device
+ *                           11 1=network spooler
+ *                           12 1=no inherit
+ *                           13 1=named pipe
+ *                           15 1=remote
+ *                        Block devices:
+ *                        Bit 0-5 drive code (0=A)
+ *                              6 0=file has been written
+ *                              7 0=block device
+ *                             12 1=no inherit
+ *                             14 1=date/time set
+ *                             15 1=remote
+ *                   CF=1 AX=error code
+ *         0B Change sharing retry count (3.0+)
+ *            Entry: CX=delay loop count
+ *                   DX=retry count
+ *            Exit:  None
+ *         0C Generic IOCTL for handles (3.2+)
+ *            Entry: BX=file handle
+ *                   CH=category code (01=AUX,03=CON,05=PRN)
+ *                   CL=function code
+ *                      45 set printer retry count
+ *                      4A set code page (3.3+)
+ *                      4C prepare start (3.3+)
+ *                      4D prepare end (3.3+)
+ *                      5F set display info (4.0+)
+ *                      65 get printer retry count
+ *                      6A get code page (3.3+)
+ *                      6B get prepare list (3.3+)
+ *                      7F get display info (4.0+)
+ *                   DS:DX-&gt;parameter block or retry count word
+ *            Exit:  CF=0 None
+ *                   CF=1 AX=error code
+ *            Get/set code page and prepare end parameter block format:
+ *               0 length (2)
+ *               2 code page
+ *            Prepare start parameter block format:
+ *               0 flags (device specific)
+ *               2 data length
+ *               4 number of code pages
+ *               6 code pages (-1=perform a refresh operation)
+ *            Get prepare list parameter block format:
+ *               0 data length
+ *               2 number of hardware code pages
+ *               4 hardware code pages
+ *               n number of prepared code pages
+ *             n+2 prepared code pages
+ *            Display info parameter block format:
+ *               0 info level (must be 0)
+ *               1 reserved
+ *               2 data length (14)
+ *               4 flags
+ *                 Bit 0 (0=blink,1=intensity)
+ *               6 mode (1=text,2=graphics)
+ *               7 reserved
+ *               8 colors
+ *              10 pixel columns
+ *              12 pixel rows
+ *              14 character columns
+ *              16 character rows
+ *         0D Generic IOCTL for drives (3.2+)
+ *            Entry: BL=drive code (0=default)
+ *                   CH=category code (08=disk)
+ *                   CL=function code
+ *                      40 set device parameters
+ *                      41 write track
+ *                      42 format track
+ *                      46 set media info (4.0+)
+ *                      47 set access flag (4.0+)
+ *                      60 get device parameters
+ *                      61 read track
+ *                      62 verify track
+ *                      66 get media info (4.0+)
+ *                      67 get access flag (4.0+)
+ *                      68 sense media type (5.0+)
+ *                   DS:DX-&gt;parameter block
+ *            Exit:  CF=0 None
+ *                   CF=1 AX=error code
+ *            Get/set device parameter block format:
+ *               0 flags (only bit 0 is used by get)
+ *                 Bit 0 0=return default BPB/build new BPB
+ *                       1=return build BPB/use device BPB
+ *                     1 0=read all fields
+ *                       1=read track layout only
+ *                     2 0=sector sizes vary
+ *                       1=sector sizes equal
+ *               1 drive type
+ *                 0=360K             5=fixed
+ *                 1=1.2M             6=tape
+ *                 2=720K             7=1.44M
+ *                 3=8" single sided  8=read/write optical
+ *                 4=8" double sided  9=2.88M
+ *               2 attributes
+ *                 Bit 0 1=non-removable
+ *                     1 1=changeline supported
+ *               4 cylinders
+ *               6 density (0=high,1=double)
+ *               7 BIOS parameter block
+ *              32 reserved
+ *              38 track layout count
+ *              40 track layout words (sector number,sector size)
+ *              Note: Track layout fields are used by set only.
+ *            Read/write parameter block format:
+ *               0 reserved
+ *               1 head
+ *               3 cylinder
+ *               5 sector
+ *               7 number of sectors
+ *               9 buffer address
+ *            Format/verify parameter block format:
+ *               0 reserved
+ *               1 head
+ *               3 cylinder
+ *            Get/set media info parameter block format:
+ *               0 info level (must be 0)
+ *               2 volume serial number
+ *               6 volume label
+ *              17 8-byte file system type
+ *            Get/set access flag parameter block format:
+ *               0 reserved
+ *               1 access flag (0=disallow disk access,1=allow disk access)
+ *            Sense media type parameter block format:
+ *               0 media type flag (0=other,1=default)
+ *               1 media type (2=720K,7=1.44M,9=2.88M)
+ *         0E Get logical drive map (3.2+)
+ *         0F Set logical drive map (3.2+)
+ *            Entry: BL=logical drive code (0=default)
+ *            Exit:  CF=0 AL=physical drive code (0=only 1 logical drive mapped)
+ *                   CF=1 AX=error code
+ *         10 Query IOCTL for handles (5.0+)
+ *            Entry: BX=file handle
+ *                   CH=category code (01=AUX,03=CON,05=PRN)
+ *                   CL=function code
+ *            Exit:  CF=0 None
+ *                   CF=1 AX=error code
+ *         11 Query IOCTL for drives (5.0+)
+ *            Entry: BL=drive code (0=default)
+ *                   CH=category code (08=disk)
+ *                   CL=function code
+ *            Exit:  CF=0 None
+ *                   CF=1 AX=error code
+ *      45 Duplicate handle (2.0+)
+ *         Entry: BX=file handle
+ *         Exit:  CF=0 AX=new file handle
+ *                CF=1 AX=error code
+ *      46 Redirect handle (2.0+)
+ *         Entry: BX=file handle
+ *                CX=file handle to redirect
+ *         Exit:  CF=0 None
+ *                CF=1 AX=error code
+ *         Note:  If the handle to redirect is opened then it is closed before
+ *                being redirected.
+ *      47 Get current directory (2.0+)
+ *         Entry: DS:SI-&gt;64-byte buffer for pathname
+ *                DL=drive code (0=default)
+ *         Exit:  CF=0 None
+ *                CF=1 AX=error code
+ *      48 Allocate memory (2.0+)
+ *         Entry: BX=number of paragraphs to allocate
+ *         Exit:  CF=0 AX=segment of allocated block
+ *                CF=1 AX=error code
+ *                     BX=size of largest available block
+ *      49 Release memory (2.0+)
+ *         Entry: ES=segment of block to release
+ *         Exit:  CF=0 None
+ *                CF=1 AX=error code
+ *      4A Reallocate memory (2.0+)
+ *         Entry: BX=number of paragraphs to allocate
+ *                ES=segment of block to reallocate
+ *         Exit:  CF=0 None
+ *                CF=1 AX=error code
+ *                     BX=size of largest available block
+ *      4B Execute program (2.0+)
+ *         Entry: AL=0 execute program
+ *                AL=1 load program
+ *                AL=3 load overlay
+ *                AL=5 enter exec state (5.0+)
+ *                DS:DX-&gt;filename or exec state parameter block
+ *                ES:BX-&gt;parameter block (unused by enter exec state)
+ *                   if function 00 or 01:
+ *                      0 environment block segment or 0
+ *                      2 command tail pointer
+ *                      6 FCB1 pointer
+ *                     10 FCB2 pointer
+ *                   if function 03:
+ *                      0 segment where file will be loaded
+ *                      2 relocation factor
+ *                   if function 05:
+ *                      0 reserved
+ *                      2 flags (0=COM,1=EXE,2=overlay)
+ *                      4 program name pointer
+ *                      8 PSP
+ *                     10 program CS:IP
+ *                     14 doubleword program size
+ *         Exit:  CF=0 BX and DX may be destroyed
+ *                     parameter block if load only:
+ *                       14 SS:SP of loaded program
+ *                       18 CS:IP of loaded program
+ *                CF=1 AX=error code
+ *         Note:  After calling function 4B01 the current PSP is set to that of
+ *                the loaded program. Before executing the program, DS and ES
+ *                should be set to the program's PSP and the INT 22 vector in the
+ *                program's PSP should be set to a valid return address.
+ *      4C Terminate with return code (2.0+)
+ *         Entry: AL=return code
+ *         Exit:  Does not return to caller
+ *      4D Get program return code (2.0+)
+ *         Entry: None
+ *         Exit:  AL=return code
+ *                AH=exit type (0=normal,1=Ctrl-C,2=critical error,3=TSR)
+ *      4E Find first file (2.0+)
+ *         Entry: DS:DX-&gt;filespec
+ *                CX=file attributes
+ *         Exit:  CF=0 DTA    search drive code (1=A)
+ *                     DTA+1  search filespec
+ *                     DTA+12 search attribute byte
+ *                     DTA+13 directory entry offset
+ *                     DTA+15 directory cluster (0=root)
+ *                     DTA+17 unused
+ *                     DTA+21 attribute byte (40h=character device)
+ *                     DTA+22 file time
+ *                     DTA+24 file date
+ *                     DTA+26 file size
+ *                     DTA+30 filename
+ *                CF=1 AX=error code
+ *      4F Find next file (2.0+)
+ *         Entry: Bytes 0-20 of buffer at DTA must be set from previous 4E or 4F call
+ *         Exit:  Same as function 4E
+ *      50 Set current PSP (2.0+)
+ *         Entry: BX=PSP segment
+ *         Exit:  None
+ *      51 Get current PSP (2.0+)
+ *         Entry: None
+ *         Exit:  BX=PSP segment
+ *      52 Get DOS internal pointers (*) (2.0+)
+ *         Entry: None
+ *         Exit:  ES:BX-&gt;DOS internal pointers
+ *                  -02h memory chain anchor
+ *                  +00h pointer to disk parameter blocks
+ *                  +04h pointer to system file tables
+ *                  +08h pointer to CLOCK$ device header
+ *                  +0Ch pointer to CON device header
+ *                  +10h disk buffer size
+ *                  +12h pointer to disk buffer chain (3.x)
+ *                       pointer to disk buffer control block (4.0+)
+ *                  +16h pointer to current directory structures
+ *                  +1Ah pointer to FCB system file tables
+ *                  +1Eh FCB keep count
+ *                  +20h number of actual drives
+ *                  +21h number of logical drives
+ *                  +22h NUL device header
+ *      53 Create disk parameter block (*) (2.0+)
+ *         Entry: DS:SI-&gt;BIOS parameter block
+ *                   0 bytes per sector
+ *                   2 sectors per cluster
+ *                   3 number of reserved sectors
+ *                   5 number of FATs
+ *                   6 number of root directory entries
+ *                   8 total number of sectors
+ *                  10 media descriptor byte
+ *                  11 sectors per FAT
+ *                  13 sectors per track
+ *                  15 number of heads
+ *                  17 number of hidden sectors
+ *                  21 32-bit number of sectors if word at 8=0
+ *                ES:BP-&gt;buffer for disk parameter block
+ *         Exit:  None
+ *      54 Get verify flag (2.0+)
+ *         Entry: None
+ *         Exit:  AL=verify flag (0=off,1=on)
+ *      55 Create program PSP (*) (2.0+)
+ *         Entry: DX=segment for new PSP
+ *                SI=new end of allocation
+ *         Exit:  None
+ *         Note:  After calling function 55 the current PSP is set to the new PSP.
+ *      56 Rename file (2.0+)
+ *         Entry: DS:DX-&gt;old filename
+ *                ES:DI-&gt;new filename
+ *         Exit:  CF=0 None
+ *                CF=1 AX=error code
+ *         Note:  This function can also rename a directory or move a file from
+ *                one directory to another.
+ *      57 Get or set file date and time (2.0+)
+ *         Entry: AL=0 get date and time
+ *                AL=1 set date and time
+ *                BX=file handle
+ *                CX=time if set
+ *                   Bits 0-4 seconds/2 (0-29)
+ *                       5-10 minutes (0-59)
+ *                      11-15 hours (0-23)
+ *                DX=date if set
+ *                   Bits 0-4 day (1-31)
+ *                        5-8 month (1-12)
+ *                       9-15 year-1980
+ *         Exit:  CF=0 CX=time if get
+ *                     DX=date if get
+ *                CF=1 AX=error code
+ *      58 Get or set allocation strategy (2.11+)
+ *         Entry: AL=0 get strategy
+ *                AL=1 set strategy
+ *                AL=2 get UMB link state (5.0+)
+ *                AL=3 set UMB link state (5.0+)
+ *                BX=strategy code or UMB link state (0=unlink,1=link)
+ *                   00=first fit
+ *                   01=best fit
+ *                   02=last fit
+ *                   40=first fit, high only (5.0+)
+ *                   41=best fit, high only (5.0+)
+ *                   42=last fit, high only (5.0+)
+ *                   80=first fit, high first (5.0+)
+ *                   81=best fit, high first (5.0+)
+ *                   82=last fit, high first (5.0+)
+ *         Exit:  CF=0 AX=strategy code or UMB link state if get
+ *                CF=1 AX=error code
+ *      59 Get extended error info (3.0+)
+ *         Entry: None
+ *         Exit:  AX=extended error code
+ *                BH=error class
+ *                BL=suggested action
+ *                CH=locus
+ *                ES:DI-&gt;volume label for invalid disk change error or 0
+ *      5A Create unique file (3.0+)
+ *         Entry: DS:DX-&gt;pathname ending with \
+ *                CX=file attributes
+ *         Exit:  CF=0 AX=file handle (filename is appended to pathname)
+ *                CF=1 AX=error code
+ *      5B Create new file (3.0+)
+ *         Entry: DS:DX-&gt;filename
+ *                CX=file attributes
+ *         Exit:  CF=0 AX=file handle
+ *                CF=1 AX=error code
+ *      5C Lock or unlock file (3.0+)
+ *         Entry: AL=0 lock
+ *                AL=1 unlock
+ *                BX=file handle
+ *                CX:DX=region offset
+ *                SI:DI=region length
+ *         Exit:  CF=0 None
+ *                CF=1 AX=error code
+ *         Note:  File sharing (SHARE.EXE) must be loaded to use this function.
+ *      5D File sharing functions (*) (3.0+)
+ *         Notes: 1) Some functions use a parameter block with the following format:
+ *                   AX,BX,CX,DX,SI,DI,DS,ES,reserved,machine #,process (PSP)
+ *                2) Functions 02-05 work only if file sharing (SHARE.EXE) is loaded.
+ *                3) Functions 07-09 work only if the redirector (REDIR.EXE) is loaded.
+ *         00 Server DOS call (*) (3.0+)
+ *            Entry: DS:DX-&gt;parameter block (AX,BX,CX,DX,SI,DI,DS,ES,machine #,process)
+ *            Exit:  Depends on called function
+ *         01 Commit all local files (*) (3.0+)
+ *            Entry: None
+ *            Exit:  None
+ *         02 Close all occurrences of file (*) (3.0+)
+ *            Entry: DS:DX-&gt;parameter block (DS:DX-&gt;qualified filespec)
+ *            Exit:  CF=0 None
+ *                   CF=1 AX=error code
+ *         03 Close all files for machine (*) (3.0+)
+ *            Entry: DS:DX-&gt;parameter block (machine #)
+ *            Exit:  CF=0 None
+ *                   CF=1 AX=error code
+ *         04 Close all files for machine and process (*) (3.0+)
+ *            Entry: DS:DX-&gt;parameter block (machine #,process)
+ *            Exit:  CF=0 None
+ *                   CF=1 AX=error code
+ *         05 Get shared file info (*) (3.0+)
+ *            Entry: DS:DX-&gt;parameter block (BX=share file table index,CX=SFT index)
+ *            Exit:  CF=0 AX=device info from SFT
+ *                        BX=machine #
+ *                        CX=lock count
+ *                        ES:DI-&gt;qualified filename
+ *                   CF=1 AX=error code
+ *         06 Get DOS swappable data area (*) (3.0+)
+ *            Entry: None
+ *            Exit:  DS:SI-&gt;DOS swappable data area
+ *                   CX=DOS swappable data area length
+ *                   DX=DOS critical data area length
+ *            Note:  The first byte of the data area is the critical error flag.
+ *         07 Get print stream state (*) (3.1+)
+ *            Entry: None
+ *            Exit:  DL=state (0=truncate off,1=truncate on)
+ *         08 Set print stream state (*) (3.1+)
+ *            Entry  DL=state (0=truncate off,1=truncate on)
+ *            Exit:  None
+ *         09 Truncate print stream (*) (3.1+)
+ *            Entry  None
+ *            Exit:  None
+ *         0A Set extended error info (3.1+)
+ *            Entry: DS:DX-&gt;parameter block (see function 59 for affected registers)
+ *            Exit:  None
+ *      5E Network functions (3.0+)
+ *         Note: Functions 02-05 work only if the redirector (REDIR.EXE) is loaded.
+ *         00 Get machine name (3.0+)
+ *            Entry: DS:DX-&gt;buffer for machine name
+ *            Exit:  CH=validity flag (0=invalid,1=valid)
+ *                   CL=netbios number
+ *         01 Set machine name (*) (3.0+)
+ *            Entry: DS:DX-&gt;machine name
+ *                   CH=validity flag (0=invalid,1=valid)
+ *                   CL=netbios number
+ *            Exit:  None
+ *         02 Set printer string (3.1+)
+ *            Entry: DS:SI-&gt;printer setup string
+ *                   BX=redirection list index
+ *                   CX=printer setup string length
+ *            Exit:  CF=0 None
+ *                   CF=1 AX=error code
+ *         03 Get printer string (3.1+)
+ *            Entry: ES:DI-&gt;buffer for printer setup string
+ *                   BX=redirection list index
+ *            Exit:  CF=0 CX=printer setup string length
+ *                   CF=1 AX=error code
+ *         04 Set print mode (*) (3.1+)
+ *            Entry: BX=redirection list index
+ *                   DX=print mode (0=text,1=binary)
+ *            Exit:  CF=0 None
+ *                   CF=1 AX=error code
+ *         05 Get print mode (*) (3.1+)
+ *            Entry: BX=redirection list index
+ *            Exit:  CF=0 DX=print mode (0=text,1=binary)
+ *                   CF=1 AX=error code
+ *      5F Network redirection functions (3.1+)
+ *         Notes: 1) Functions 00-05 work only if the redirector (REDIR.EXE) is loaded.
+ *                2) Functions 07-08 work only on builtin drives.
+ *         00 Get redirection mode (*) (3.1+)
+ *            Entry: BL=device type (3=printer,4=disk)
+ *            Exit:  CF=0 BH=redirection mode (0=off,1=on)
+ *                   CF=1 AX=error code
+ *         01 Set redirection mode (*) (3.1+)
+ *            Entry: BL=device type (3=printer,4=disk)
+ *                   BH=redirection mode (0=off,1=on)
+ *            Exit:  CF=0 None
+ *                   CF=1 AX=error code
+ *         02 Get redirection list entry (3.1+)
+ *            Entry: DS:SI-&gt;16-byte buffer for local device name
+ *                   ES:DI-&gt;128-byte buffer for remote device name
+ *                   BX=redirection list index
+ *            Exit:  CF=0 BH=status (0=valid,1=invalid)
+ *                        BL=device type (3=printer,4=disk)
+ *                        CX=user word
+ *                   CF=1 AX=error code
+ *         03 Set redirection list entry (3.1+)
+ *            Entry: DS:SI-&gt;local device name
+ *                   ES:DI-&gt;remote device name
+ *                   BL=device type (3=printer,4=disk)
+ *                   CX=user word
+ *            Exit:  CF=0 None
+ *                   CF=1 AX=error code
+ *         04 Cancel redirection list entry (3.1+)
+ *            Entry: DS:SI-&gt;local device name
+ *            Exit:  CF=0 None
+ *                   CF=1 AX=error code
+ *         05 Get redirection list entry extended (*) (4.0+)
+ *            Entry: DS:SI-&gt;16-byte buffer for local device name
+ *                   ES:DI-&gt;128-byte buffer for remote device name
+ *                   BX=redirection list index
+ *            Exit:  CF=0 BH=status (0=valid,1=invalid)
+ *                        BL=device type (3=printer,4=disk)
+ *                        CX=user word
+ *                        BP=netbios session number
+ *                   CF=1 AX=error code
+ *         07 Enable drive (*) (4.0+)
+ *            Entry: DL=drive code (0=default)
+ *            Exit:  CF=0 None
+ *                   CF=1 AX=error code
+ *         08 Disable drive (*) (4.0+)
+ *            Entry: DL=drive code (0=default)
+ *            Exit:  CF=0 None
+ *                   CF=1 AX=error code
+ *      60 Qualify filename (*) (3.0+)
+ *         Entry: DS:SI-&gt;filespec
+ *                ES:DI-&gt;buffer for qualified filespec
+ *         Exit:  CF=0 None
+ *                CF=1 AX=error code
+ *      61 Reserved
+ *      62 Get current PSP (3.0+)
+ *         Entry: None
+ *         Exit:  BX=PSP segment
+ *      63 Get DBCS lead byte table pointer (*) (3.0+)
+ *         Entry: AL must be 0
+ *         Exit:  DS:SI-&gt;DBCS lead byte table
+ *      64 Set wait for external event flag (*) (3.2+)
+ *         Entry: AL=flag (0=enable,&gt;0=disable)
+ *         Exit:  None
+ *         Note:  This function affects the PC Convertible only.
+ *                If enabled and the default console driver is being used then
+ *                INT 15 function 41 is issued while waiting for console input
+ *                during functions 01,08,0A,and 3F.
+ *      65 Get extended country info (3.3+)
+ *         Entry: AL=01 get extended country info
+ *                   02 get country uppercase table
+ *                   03 get country lowercase table (reserved until 6.2)
+ *                   04 get country filename uppercase table
+ *                   05 get country filename character table
+ *                   06 get country collating table
+ *                   07 get DBCS vector table (4.0+)
+ *                   20 uppercase character (4.0+)
+ *                   21 uppercase string (4.0+)
+ *                   22 uppercase ASCIIZ string (4.0+)
+ *                   23 yes/no check (*) (4.0+)
+ *                   A0 uppercase filename character (*) (4.0+)
+ *                   A1 uppercase filename string (*) (4.0+)
+ *                   A2 uppercase filename ASCIIZ string (*) (4.0+)
+ *                   A3 yes/no check (*) (4.0+)
+ *                if function 01-07:
+ *                   BX=code page (-1=active code page)
+ *                   CX=length to return (must be at least 5)
+ *                   DX=country code (-1=default)
+ *                   ES:DI-&gt;return buffer
+ *                if function 20,23,A0,A3:
+ *                   DL=character
+ *                if function 21,A1:
+ *                   DS:DX-&gt;string
+ *                   CX=string length
+ *                if function 22,A2:
+ *                   DS:DX-&gt;string
+ *         Exit:  CF=0 CX=data length if function 01-07
+ *                     DL=character if function 20
+ *                     AX=code if function 23,A3 (0=no,1=yes,2=neither)
+ *                CF=1 AX=error code
+ *                buffer format if function 01:
+ *                 0 info ID
+ *                 1 length
+ *                 3 country code
+ *                 5 code page
+ *                 7 country info (same format as function 38)
+ *                buffer format if function 02-07:
+ *                 0 info ID
+ *                 1 pointer to requested table (word length followed by data)
+ *      66 Get or set code page (3.3+)
+ *         Entry: AL=1 get code page
+ *                AL=2 set code page
+ *                BX=active code page if set
+ *         Exit:  CF=0 BX=active code page if get
+ *                     DX=default code page if get
+ *                CF=1 AX=error code
+ *      67 Set handle count (3.3+)
+ *         Entry: BX=handle count
+ *         Exit:  CF=0 None
+ *                CF=1 AX=error code
+ *      68 Commit file (3.3+)
+ *         Entry: BX=file handle
+ *         Exit:  CF=0 None
+ *                CF=1 AX=error code
+ *      69 Get or set media info (*) (4.0+)
+ *         Entry: AL=0 get media info
+ *                AL=1 set media info
+ *                BL=drive code (0=default)
+ *                DS:DX-&gt;media info
+ *         Exit:  CF=0 None
+ *                CF=1 AX=error code
+ *         Media info format:
+ *            0 info level (must be 0)
+ *            2 volume serial number
+ *            6 volume label
+ *           17 8-byte file system type
+ *      6A Commit file (*) (4.0+)
+ *         Entry: Same as function 68
+ *         Exit:  Same as function 68
+ *      6B Reserved
+ *      6C Extended open/create file (4.0+)
+ *         Entry: DS:SI-&gt;filename
+ *                BX=open mode
+ *                   Bit 0-2 access mode
+ *                           000=read
+ *                           001=write
+ *                           010=read/write
+ *                       4-6 sharing mode
+ *                           000=compatibility
+ *                           001=deny read/write access
+ *                           010=deny write access
+ *                           011=deny read access
+ *                           100=deny none access
+ *                         7 inheritance flag
+ *                           0=file inherited by EXECed programs
+ *                           1=file not inherited by EXECed programs
+ *                        13 critical error handling
+ *                           0=execute INT 24
+ *                           1=return error code
+ *                        14 buffering
+ *                           0=buffer writes
+ *                           1=don't buffer writes
+ *                CX=file attributes
+ *                DX=open flags
+ *                   Bit 0-3 0000=fail if exists
+ *                           0001=open if exists
+ *                           0010=truncate if exists
+ *                       4-7 0000=fail if doesn't exist
+ *                           0001=create if doesn't exist
+ *         Exit:  CF=0 AX=file handle
+ *                     CX=action code (1=file opened,2=file created,3=file truncated)
+ *                CF=1 AX=error code
+ *
+ *      INT 22 Terminate address (1.0+)
+ *             This is the address that DOS returns to after program termination.
+ *             It is set during execute program (function 4B) processing.
+ *
+ *      INT 23 Ctrl-Break handler address (1.0+)
+ *             This routine is entered when Ctrl-Break is detected by DOS.
+ *             On entry the registers are set to the values they had at the start
+ *             of the interrupted function call. Control may be returned via
+ *             IRET or FAR RET, if FAR RET is used and the carry flag is set
+ *             then the program is aborted otherwise the function is restarted.
+ *      Note:  Any DOS function may be issued from an INT 23 handler.
+ *
+ *      INT 24 Critical error handler address (1.0+)
+ *      Entry: AH=error indicator
+ *                Bit 0 0=read error
+ *                      1=write error
+ *                  1-2 disk area
+ *                      00=DOS area
+ *                      01=FAT
+ *                      10=directory
+ *                      11=data area
+ *                    3 1=fail allowed
+ *                    4 1=retry allowed
+ *                    5 1=ignore allowed
+ *                    7 0=block device error
+ *                      1=character device error
+ *             AL=drive code (0=A)
+ *             DI=error code (lower half of DI)
+ *                00=write-protect error           07=unknown media type
+ *                01=unknown unit                  08=sector not found
+ *                02=drive not ready               09=printer out of paper
+ *                03=unknown command               0A=write fault
+ *                04=data error (CRC)              0B=read fault
+ *                05=bad request structure length  0C=general failure
+ *                06=seek error                    0F=invalid disk change
+ *             BP:SI=pointer to device driver header
+ *      Exit:  Control may be returned to DOS via IRET with an action code in AL
+ *                0=ignore error (fail if ignore is unallowed)
+ *                1=retry function (fail if retry is unallowed)
+ *                2=abort program
+ *                3=fail system call (abort if fail is unallowed)
+ *             Control may be returned directly to the program by removing the
+ *             INT 24 registers (IP,CS,flags) from the stack, restoring the
+ *             program's registers (AX,BX,CX,DX,SI,DI,BP,DS,ES) and issuing
+ *             an IRET. This will leave DOS in an unstable state because the
+ *             critical error flag is set until a DOS function other than 01-0C,
+ *             33,50,51,59,62,or 64 is issued.
+ *      Note:  Only DOS functions 01-0C,33,50,51,59,62,or 64 should be issued from
+ *             an INT 24 handler.
+ *
+ *      INT 25 Absolute disk read (1.0+)
+ *      Entry: AL=drive number (0=A)
+ *             CX=number of sectors or -1 if &gt;32M partition
+ *             DX=starting sector number
+ *             DS:BX-&gt;data buffer or parameter block
+ *               parameter block (3.31+)
+ *                 0 starting sector number
+ *                 4 number of sectors
+ *                 6 data buffer
+ *      Exit:  CF=0 None
+ *             CF=1 AH=error code
+ *                     01=bad command
+ *                     02=bad address mark
+ *                     03=write-protect error
+ *                     04=sector not found
+ *                     08=DMA overrun
+ *                     10=data error (bad CRC)
+ *                     20=controller error
+ *                     40=seek error
+ *                     80=timed-out
+ *                  AL=device error code (same as lower byte of DI for INT 24)
+ *      Notes: 1) The CPU flags are still on the stack after an INT 25 or INT 26.
+ *             2) All registers except the segment registers and SP may be destroyed.
+ *
+ *      INT 26 Absolute disk write (1.0+)
+ *      Entry: Same as INT 25
+ *      Exit:  Same as INT 25
+ *
+ *      INT 27 Terminate and stay resident (1.0+)
+ *      Entry: CS=PSP
+ *             DX=number of bytes to stay resident (minimum 96)
+ *      Exit:  Does not return to caller
+ *
+ *      INT 28 Idle handler (2.0+)
+ *             This interrupt is issued by DOS during functions 01-0C to indicate
+ *             that a TSR program may safely issue a non-character I/O DOS
+ *             function even though the InDOS flag is not zero.
+ *             DOS functions 01-0C should not be issued from a INT 28 handler
+ *             unless the critical error flag is set first.
+ *
+ *      INT 29 Character output (2.0+)
+ *      Entry: AL=character
+ *      Exit:  None
+ *      Note:  This interrupt is called for character output if the console
+ *             device has bit 4 in the device attribute word set.
+ *
+ *      INT 2A Network/critical section (*) (3.0+)
+ *      00 Network installation check (3.0+)
+ *         Entry: None
+ *         Exit:  AH=00 not installed
+ *                AH=FF installed
+ *      01 Execute NETBIOS request with no error retry (*) (3.0+)
+ *         Entry: ES:BX-&gt;network control block
+ *         Exit:  AH=0 no error
+ *                AH=1 AL=error code
+ *      02 Set network printer parameters (*) (3.0+)
+ *         Entry: DS:SI-&gt;16-byte buffer for local device name
+ *                BX=characters per line (-1=use current)
+ *                CX=lines per inch (-1=use current)
+ *         Exit:  CF=0 None
+ *                CF=1 AX=error code
+ *      03 Check direct I/O (3.0+)
+ *         Entry: DS:SI-&gt;ASCIIZ disk name (d:)
+ *         Exit:  CF=0 direct I/O allowed
+ *                CF=1 direct I/O not allowed
+ *      04 Execute NETBIOS request (3.0+)
+ *         Entry: AL=error retry flag (0=retry,1=no retry)
+ *                ES:BX-&gt;network control block
+ *         Exit:  AH=0 no error
+ *                AH=1 AL=error code
+ *      05 Get network resource information (3.0+)
+ *         Entry: None
+ *         Exit:  BX=available network name count
+ *                CX=available network control block count
+ *                DX=available network session count
+ *      06 Network print stream control (3.0+)
+ *         Entry: AL=mode (1=concatenation,2=truncation,3=truncate stream)
+ *         Exit:  CF=0 None
+ *                CF=1 AX=error code
+ *      80 Begin critical section (*) (3.0+)
+ *         Entry: AL=critical section number
+ *         Exit:  None
+ *      81 End critical section (*) (3.0+)
+ *         Entry: AL=critical section number
+ *         Exit:  None
+ *      82 End all critical sections (*) (3.0+)
+ *         Entry: None
+ *         Exit:  None
+ *      84 Keyboard idle loop (*) (3.0+)
+ *         Entry: None
+ *         Exit:  None
+ *
+ *      INT 2E Execute command (*) (2.0+)
+ *      Entry: DS:SI-&gt;command string-1 followed by a carriage return
+ *      Exit:  All registers except CS and IP are destroyed
+ *      Note:  This function is not re-entrant and should not be issued from a
+ *             batch file.
+ *
+ *      INT 2F Multiplex (3.0+)
+ *      Entry: AH=program identifier
+ *             AL=function code
+ *             Other registers depend on the function
+ *      Exit:  Depends on the function
+ *
+ *      Program identifier codes:
+ *      01 Print queueing (PRINT) (3.0+)
+ *      02 Network printer control (REDIR) (3.1+)
+ *      05 Network error message lookup (REDIR) (3.0+)
+ *      06 ASSIGN (3.1+)
+ *      08 IBMBIO drive services (used by DRIVER.SYS) (3.2+)
+ *      10 File sharing (SHARE) (3.0+)
+ *      11 Redirector services (REDIR and MSCDEX) (3.0+)
+ *      12 DOS internal services (used by REDIR and MSCDEX) (3.0+)
+ *      13 Swap INT 13 vector (3.2+)
+ *      14 NLS support (NLSFUNC) (3.3+)
+ *      15 CD-ROM extensions (MSCDEX)
+ *      16 Windows services
+ *      17 Windows clipboard services
+ *      1A ANSI.SYS (4.0+)
+ *      43 XMS services (HIMEM.SYS)
+ *      46 Windows support
+ *      48 DOSKEY (5.0+)
+ *      4A DOS services (HMA, RPL), SMARTDRV (5.0+)
+ *      53 POWER (APM events broadcast) (5.02+)
+ *      54 POWER (main API) (5.02+)
+ *      55 COMMAND.COM (5.0+)
+ *      56 INTERLNK (5.02+)
+ *      AC GRAPHICS (5.0+)
+ *      AD DISPLAY.SYS, KEYB (3.3+)
+ *      AE Installable command support (APPEND) (3.3+)
+ *      B0 GRAFTABL (3.3+)
+ *      B7 APPEND (3.2+)
+ *
+ *      DOS extended error information:
+ *
+ *      Extended error code:                    Error class:
+ *      01 Invalid function number              01 Out of resource
+ *      02 File not found                       02 Temporary situation
+ *      03 Path not found                       03 Authorization error
+ *      04 Too many open files                  04 Internal DOS error
+ *      05 Access denied                        05 Hardware failure
+ *      06 Invalid handle                       06 System software failure
+ *      07 Memory control blocks destroyed      07 Application program error
+ *      08 Insufficient memory                  08 Not found
+ *      09 Invalid memory block address         09 Invalid format
+ *      0A Invalid environment                  0A File locked
+ *      0B Invalid format                       0B Media error
+ *      0C Invalid access code                  0C Already exists
+ *      0D Invalid data                         0D Unknown
+ *      0E Reserved
+ *      0F Invalid drive                        Suggested action:
+ *      10 Attempt to remove current directory  01 Retry
+ *      11 Not same device                      02 Delay and retry
+ *      12 No more files                        03 Get corrected user input
+ *      13 Write-protect error                  04 Exit with cleanup
+ *      14 Unknown unit                         05 Exit without cleanup
+ *      15 Drive not ready                      06 Ignore error
+ *      16 Unknown command                      07 Retry after user intervention
+ *      17 Data error (CRC)
+ *      18 Bad request structure length         Error locus:
+ *      19 Seek error                           01 Unknown
+ *      1A Unknown medium type                  02 Block device error
+ *      1B Sector not found                     03 Network error
+ *      1C Printer out of paper                 04 Character device error
+ *      1D Write fault                          05 Memory error
+ *      1E Read fault
+ *      1F General failure
+ *      20 Sharing violation
+ *      21 Lock violation
+ *      22 Invalid disk change
+ *      23 FCB unavailable
+ *      24 Sharing buffer overflow
+ *      25 Code page mismatch (4.0+)
+ *      26 Out of input (4.0+)
+ *      27 Insufficient disk space (4.0+)
+ *      32 Function not supported
+ *      41 Network access denied
+ *      50 File exists
+ *      51 Reserved
+ *      52 Cannot make directory entry
+ *      53 Fail on INT 24
+ *
+ * DOS table and structure reference (from https://sites.google.com/site/pcdosretro/dostables)
+ *
+ *      Program Segment Prefix (100h bytes)
+ *      00 INT 20
+ *      02 End of allocation segment
+ *      04 Reserved
+ *      05 Far call to DOS
+ *      0A Saved INT 22 vector
+ *      0E Saved INT 23 vector
+ *      12 Saved INT 24 vector (1.1+)
+ *      16 Caller PSP segment (2.0+)
+ *      18 File table (2.0+)
+ *      2C Environment segment (2.0+)
+ *      2E Stack pointer after last DOS call (2.0+)
+ *      32 File table size (3.0+)
+ *      34 Pointer to file table (3.0+)
+ *      38 Pointer to next PSP (SHARE only) (3.0+)
+ *      3C Reserved
+ *      40 DOS version (4.0+)
+ *      42 Reserved
+ *      50 INT 21,RETF (2.0+)
+ *      53 Reserved
+ *      5C FCB 1
+ *      6C FCB 2
+ *      7C Unused
+ *      80 Command tail
+ *
+ *      File Control Block (25h bytes)
+ *      00 Drive code (1=A)
+ *      01 Filename
+ *      09 Extension
+ *      0C Current block number
+ *      0E Record size
+ *      10 File size
+ *      14 Date
+ *      16 Time
+ *      18 Reserved
+ *      20 Current record number
+ *      21 Random record number
+ *
+ *      Extended FCB (2Ch bytes)
+ *      00 FF (Extended FCB indicator)
+ *      01 Reserved
+ *      06 Attribute byte
+ *      07 Standard FCB
+ *
+ *      Disk partition table entry (10h bytes)
+ *      00 Status (00=non-bootable,80=bootable)
+ *      01 Starting head
+ *      02 Starting cylinder and sector (INT 13 format)
+ *      04 Type (0=unknown,1=FAT12,4=FAT16,5=extended,6=BIGDOS)
+ *      05 Ending head
+ *      06 Ending cylinder and sector (INT 13 format)
+ *      08 Starting absolute sector
+ *      0C Number of sectors
+ *      Note: There are 4 entries starting at offset 1BE
+ *
+ *      Disk boot sector (200h bytes)
+ *      00 Jump to boot code
+ *      03 OEM name
+ *      0B Bytes per sector
+ *      0D Sectors per cluster
+ *      0E Number of reserved sectors
+ *      10 Number of FATs
+ *      11 Number of root directory entries
+ *      13 Total number of sectors
+ *      15 Media descriptor byte
+ *         F0 1.44M (2 sides,18 sectors/track,80 tracks)
+ *            2.88M (2 sides,36 sectors/track,80 tracks)
+ *         F8 fixed disk
+ *         F9 720K (2 sides,9 sectors/track,80 tracks)
+ *            1.2M (2 sides,15 sectors/track,80 tracks)
+ *         FC 180K (1 side,9 sectors/track,40 tracks)
+ *         FD 360K (2 sides,9 sectors/track,40 tracks)
+ *         FE 160K (1 side,8 sectors/track,40 tracks)
+ *         FF 320K (2 sides,8 sectors/track,40 tracks)
+ *      16 Sectors per FAT
+ *      18 Sectors per track
+ *      1A Number of heads
+ *      1C Number of hidden sectors
+ *      20 32-bit number of sectors if word at 13=0 (3.31+)
+ *      24 Drive number (4.0+)
+ *      25 Reserved (4.0+)
+ *      26 Extended boot record ID (29) (4.0+)
+ *      27 Serial number (4.0+)
+ *      2B Volume label (4.0+)
+ *      36 8-byte file system name (4.0+)
+ *      Note: Bytes 0B-23 are the BIOS parameter block
+ *
+ *      Directory entry (20h bytes)
+ *      00 Filename
+ *      08 Extension
+ *      0B Attribute byte
+ *         01=Read-only
+ *         02=Hidden
+ *         04=System
+ *         08=Volume label (2.0+)
+ *         10=Directory (2.0+)
+ *         20=Archive (2.0+)
+ *      0C Reserved
+ *      16 Time
+ *         Bits 0-4 Seconds/2 (0-29)
+ *             5-10 Minutes (0-59)
+ *            11-15 Hours (0-23)
+ *      18 Date
+ *         Bits 0-4 Day (1-31)
+ *              5-8 Month (1-12)
+ *             9-15 Year-1980
+ *      1A Starting cluster number
+ *      1C File size
+ *
+ *      Disk parameter block (20h bytes in 3.x, 21h bytes in 4.0+)
+ *      00 Drive code (0=A)
+ *      01 Unit code
+ *      02 Bytes per sector
+ *      04 Sectors per cluster-1
+ *      05 Cluster shift factor (2**n sectors per cluster)
+ *      06 First FAT sector
+ *      08 Number of FATs
+ *      09 Number of directory entries
+ *      0B First data sector
+ *      0D Maximum cluster number
+ *      0F Sectors per FAT
+ *      11 First directory sector
+ *      13 Pointer to device driver
+ *      17 Media descriptor byte
+ *      18 Access flag (00=accessed,FF=not accessed)
+ *      19 Pointer to next DPB
+ *      1D Last cluster allocated
+ *      1F Number of free clusters (-1 if unknown)
+ *      Note: (3.x) The sectors per FAT field is one byte and all following
+ *            fields are moved back one byte.
+ *
+ *      System file table (35h bytes in 3.x, 3Bh bytes in 4.0+)
+ *      00 Open count
+ *      02 Open mode
+ *         Bit 0-2 access mode
+ *                 000=read
+ *                 001=write
+ *                 010=read/write
+ *             4-6 sharing mode
+ *                 000=compatibility
+ *                 001=deny read/write
+ *                 010=deny write
+ *                 011=deny read
+ *                 100=deny none
+ *              13 critical error handling
+ *                 0=execute INT 24
+ *                 1=return error code
+ *              14 buffering
+ *                 0=buffer writes
+ *                 1=don't buffer writes
+ *              15 1=FCB SFT
+ *      04 Attribute byte
+ *      05 Device info
+ *         Character devices:          Block devices:
+ *         Bit 0 1=console input       Bit 0-5 drive code (0=A)
+ *             1 1=console output            6 0=file has been written
+ *             2 1=NUL device                7 0=block device
+ *             3 1=CLOCK device             12 1=no inherit
+ *             4 1=INT 29 output (CON)      14 1=date/time set
+ *             5 0=ASCII,1=binary           15 1=redirected file
+ *             6 0=EOF on input
+ *             7 1=character device
+ *            11 1=network spooler
+ *            12 1=no inherit
+ *            13 1=named pipe
+ *            15 1=redirected device
+ *      07 Pointer to device driver or disk parameter block
+ *      0B First cluster number
+ *      0D Time
+ *      0F Date
+ *      11 File size
+ *      15 File pointer
+ *      19 Current relative cluster number
+ *      1B 32-bit directory entry sector (4.0+)
+ *      1B Current absolute cluster number (3.x)
+ *      1D Directory entry sector (3.x)
+ *      1F Directory entry position in sector
+ *      20 Filename
+ *      28 Extension
+ *      2B Pointer to next SFT for the same file (SHARE only)
+ *      2F Machine number
+ *      31 PSP of owner
+ *      33 SHARE file table offset
+ *      35 Current absolute cluster number (4.0+)
+ *      37 Reserved (4.0+)
+ *
+ *      SHARE file table
+ *      00 Entry flag (1=open,0=unused,-1=end of list)
+ *      01 Entry length
+ *      03 Filespec checksum
+ *      04 First lock table offset
+ *      06 Pointer to system file table
+ *      0A SHARE file number
+ *      0C Filespec
+ *
+ *      SHARE lock table (10h bytes)
+ *      00 Offset to next lock table for file
+ *      02 Start of lock region
+ *      06 End of lock region
+ *      0A Pointer to system file table
+ *      0E PSP of owner
+ *
+ *      Current directory structure (51h bytes in 3.x, 58h bytes in 4.0+)
+ *      00 Current directory
+ *      43 Drive type
+ *         1000=SUBSTed drive
+ *         2000=JOINed drive
+ *         4000=valid drive
+ *         8000=redirected drive
+ *      45 Pointer to disk parameter block
+ *      49 Cluster number of current directory (0=root)
+ *      4B Reserved
+ *      4F Length of root directory name starting at offset 0
+ *      51 Reserved (4.0+)
+ *
+ *      Disk buffer header (10h bytes) (3.x)
+ *      00 Pointer to next buffer
+ *      04 Drive code (0=A,FF=unused)
+ *      05 Flags
+ *         Bit 0 reserved
+ *             1 1=FAT sector
+ *             2 1=directory sector
+ *             3 1=data sector
+ *             4 reserved
+ *             5 1=buffer read
+ *             6 1=buffer written
+ *             7 reserved
+ *      06 Sector number
+ *      08 Number of FATs (if FAT) or 1
+ *      09 Sectors per FAT (if FAT) or 0
+ *      0A Pointer to DPB
+ *      0E Reserved
+ *      10 Buffered sector
+ *
+ *      Disk buffer header (14h bytes) (4.0+)
+ *      00 Pointer to next buffer
+ *      02 Pointer to previous buffer
+ *      04 Drive code (0=A,FF=unused)
+ *      05 Flags
+ *         Bit 0 reserved
+ *             1 1=FAT sector
+ *             2 1=directory sector
+ *             3 1=data sector
+ *             4 reserved
+ *             5 1=buffer read (4.0)
+ *             6 1=buffer written
+ *             7 reserved
+ *      06 Sector number
+ *      0A Number of FATs (if FAT) or 1
+ *      0B Sectors per FAT (if FAT) or 0
+ *      0D Pointer to DPB
+ *      11 Reserved
+ *      14 Buffered sector
+ *
+ *      Disk buffer control block (4.0)
+ *      00 Pointer to buffer chain array
+ *      04 Number of chains
+ *      06 Pointer to sector lookahead buffers
+ *      0A Number of sector lookahead buffers
+ *      0C Unknown
+ *
+ *      Disk buffer control block (5.0+)
+ *      00 Pointer to buffer chain
+ *      04 Number of modified buffers
+ *      06 Pointer to sector lookahead buffers
+ *      0A Number of sector lookahead buffers
+ *      0C HMA flag (1=buffers in HMA)
+ *      0D Pointer to HMA transfer buffer
+ *
+ *      Disk buffer chain array entry (8 bytes) (4.0)
+ *      00 Reserved
+ *      02 Pointer to last accessed buffer
+ *      06 Number of modified buffers
+ *      07 Reserved
+ *
+ *      Stacks block header (12h bytes)
+ *      00 Reserved
+ *      02 Number of stacks
+ *      04 Offset of stacks
+ *      06 Stack size
+ *      08 Pointer to stacks table (descriptors followed by stacks)
+ *      0C Offset of first stacks descriptor
+ *      0E Offset of last stacks descriptor
+ *      10 Offset of current stacks descriptor
+ *
+ *      Stacks descriptor (8 bytes)
+ *      00 Flag (0=free,1=in use)
+ *      02 Save area for SS:SP
+ *      06 Offset of end of stack
+ *
+ *      Device driver header (12h bytes)
+ *      00 Pointer to next device driver or -1
+ *      04 Attribute word
+ *         Bit 0 1=console input
+ *             1 1=console output (character devices)
+ *               1=32-bit sectors supported (block devices) (3.31+)
+ *             2 1=NUL device
+ *             3 1=CLOCK device
+ *             4 1=INT 29 output (CON)
+ *             6 1=extended functions supported (13,17,18) (3.2+)
+ *             7 1=query IOCTL function supported (19) (5.0+)
+ *            11 1=open/close/removable media supported (3.0+)
+ *            13 1=output until busy supported (character devices) (3.0+)
+ *               1=media descriptor in FAT required (block devices)
+ *            14 1=IOCTL supported
+ *            15 0=block device
+ *               1=character device
+ *      06 Strategy address
+ *      08 Interrupt address
+ *      0A Device name or number of units
+ *
+ *      Device driver request header (common fields)
+ *      00 Request header length
+ *      01 Unit number
+ *      02 Command code
+ *         00=Init                   0B=Flush output buffers
+ *         01=Media check            0C=I/O control write
+ *         02=Build BPB              0D=Open (3.0+)
+ *         03=I/O control read       0E=Close (3.0+)
+ *         04=Read                   0F=Removable media check (3.0+)
+ *         05=Non-destructive read   10=Output until busy (3.0+)
+ *         06=Input status           13=Generic I/O control (3.2+)
+ *         07=Flush input buffers    17=Get drive map (3.2+)
+ *         08=Write                  18=Set drive map (3.2+)
+ *         09=Write with verify      19=Query I/O control (5.0+)
+ *         0A=Output status
+ *      03 Return status word
+ *         Bit 0-7 if error
+ *                 00=write-protect error  07=unknown medium
+ *                 01=unknown unit         08=sector not found
+ *                 02=drive not ready      09=printer out of paper
+ *                 03=unknown command      0A=write fault
+ *                 04=data error (CRC)     0B=read fault
+ *                 05=bad request length   0C=general failure
+ *                 06=seek error           0F=invalid disk change
+ *               8 1=done
+ *               9 1=busy
+ *              15 1=error
+ *      05 Reserved (8 bytes)
+ *
+ *      Device driver request headers:
+ *      Init
+ *      00 Common (length=17h in 3.x, 19h in 4.0+)
+ *      0D Number of units (set by driver)
+ *      0E End of available memory (5.0+)
+ *         End of resident code (set by driver)
+ *      12 Pointer to string after DEVICE=
+ *         BPB array pointer (set by driver)
+ *      16 Drive code of first unit (0=A)
+ *      17 Error message flag (1=display message) (4.0+)
+ *
+ *      Media check
+ *      00 Common (length=13h)
+ *      0D Media descriptor byte
+ *      0E Status (set by driver: 1=unchanged,0=unknown,-1=changed)
+ *      0F Pointer to previous disk label (set by driver if disk changed)
+ *
+ *      Build BPB
+ *      00 Common (length=16h)
+ *      0D Media descriptor byte
+ *      0E Pointer to sector buffer
+ *      12 Pointer to BPB (set by driver)
+ *      Note: The sector buffer contains the first sector of the FAT if bit 13 in the
+ *            device attribute word is zero otherwise it may be used as scratch space.
+ *
+ *      IOCTL read, Read, Write, Write with verify, IOCTL write, Output until busy
+ *      00 Common (length=14h)
+ *      0D Unused
+ *      0E Pointer to data buffer
+ *      12 Byte count (set by driver to number of bytes transferred)
+ *      Notes: 1) The IOCTL functions are called only if bit 14 in the device
+ *                attribute word is set.
+ *             2) The output until busy function is called only if bit 13 in the
+ *                device attribute word is set.
+ *
+ *      Read, Write, Write with verify
+ *      00 Common (length=16h-1Eh)
+ *      0D Media descriptor byte
+ *      0E Pointer to data buffer
+ *      12 Sector count (set by driver to number of sectors transferred)
+ *      14 Starting sector number (-1=if 32-bit sectors)
+ *      16 Pointer to previous disk label (set by driver if error 0F)
+ *      1A 32-bit starting sector number
+ *      Note: The 32-bit starting sector number is used only if bit 1 in the
+ *            device attribute word is set.
+ *
+ *      Non-destructive read
+ *      00 Common (length=0Eh)
+ *      0D Character (set by driver)
+ *      Note: This function sets the busy bit (bit 9) in the request header
+ *            if no character is ready.
+ *
+ *      Input status, Output status
+ *      00 Common (length=0Dh)
+ *      Note: These functions set the busy bit (bit 9) in the request header
+ *            to indicate device status.
+ *
+ *      Flush input buffers, Flush output buffers
+ *      00 Common (length=0Dh)
+ *
+ *      Open, Close, Removable media check
+ *      00 Common (length=0Dh)
+ *      Notes: 1) These functions are called only if bit 11 in the device
+ *                attribute word is set.
+ *             2) The removable media check function sets bit 9 in the status word
+ *                if the device is non-removable.
+ *
+ *      Generic IOCTL, Query IOCTL
+ *      00 Common (length=17h)
+ *      0D Category code
+ *      0E Function code
+ *      0F Unused
+ *      13 Parameter buffer pointer
+ *      Notes: 1) The Generic IOCTL function is called only if bit 6 in the device
+ *                attribute word is set.
+ *             2) The Query IOCTL function is called only if bit 7 in the device
+ *                attribute word is set.
+ *
+ *      Get drive map, Set drive map
+ *      00 Common (length=0Dh)
+ *      Notes: 1) These functions are called only if bit 6 in the device
+ *                attribute word is set.
+ *             2) These functions set the unit field (byte 1) in the request
+ *                header to the physical drive code.
+ *
+ *      Clock device info (6 bytes)
+ *      00 Days since 1/1/80
+ *      02 Minutes
+ *      03 Hours
+ *      04 Hundredths
+ *      05 Seconds
+ *
+ *      Memory Control Block (10h bytes)
+ *      00 Type ('M' or 'Z' if last)
+ *      01 PSP segment of owner (0=free,8=DOS)
+ *      03 Size (paragraphs)
+ *      05 Unused
+ *      08 Program name (4.0+)
+ *
+ *      EXE file header
+ *      00 'MZ'
+ *      02 Size of last page
+ *      04 File size in 512-byte pages
+ *      06 Relocation table count
+ *      08 Header size (paragraphs)
+ *      0A Minimum allocation (paragraphs)
+ *      0C Maximum allocation (paragraphs)
+ *      0E Initial SS
+ *      10 Initial SP
+ *      12 Checksum
+ *      14 Initial IP
+ *      16 Initial CS
+ *      18 Offset of relocation table
+ *         Table entry format:
+ *         0 offset of relocation
+ *         2 segment of relocation
+ *      1A Overlay number
+ *
+ *      EXEPACK header
+ *      00 Actual IP
+ *      02 Actual CS
+ *      04 0 (set to PSP+10h by unpack code)
+ *      06 Unpack code and data size (including relocation table)
+ *      08 Actual SP
+ *      0A Actual SS
+ *      0C Actual code and data size
+ *
+ *      Note: If an EXE file is packed then CS:IP-2 points to 'RB' and CS:0
+ *            points to the EXEPACK header, this is followed by the unpack code
+ *            and a relocation table containing a word count and relocation
+ *            entries for 16 segments.
+ */
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/messages.js (C) Jeff Parsons 2012-2017
+ */
+
+var Messages = {
+    CPU:        0x00000001,
+    SEG:        0x00000002,
+    DESC:       0x00000004,
+    TSS:        0x00000008,
+    INT:        0x00000010,
+    FAULT:      0x00000020,
+    BUS:        0x00000040,
+    MEM:        0x00000080,
+    PORT:       0x00000100,
+    DMA:        0x00000200,
+    PIC:        0x00000400,
+    TIMER:      0x00000800,
+    CMOS:       0x00001000,
+    RTC:        0x00002000,
+    C8042:      0x00004000,
+    CHIPSET:    0x00008000,
+    KEYBOARD:   0x00010000,
+    KEYS:       0x00020000,
+    VIDEO:      0x00040000,
+    FDC:        0x00080000,
+    HDC:        0x00100000,
+    DISK:       0x00200000,
+    PARALLEL:   0x00400000,
+    SERIAL:     0x00800000,
+    MOUSE:      0x01000000,
+    SPEAKER:    0x02000000,
+    COMPUTER:   0x04000000,
+    DOS:        0x08000000,
+    DATA:       0x10000000,
+    LOG:        0x20000000,
+    WARN:       0x40000000,
+    HALT:       0x80000000|0
+};
+
+/*
+ * Message categories supported by the messageEnabled() function and other assorted message
+ * functions. Each category has a corresponding bit value that can be combined (ie, OR'ed) as
+ * needed.  The Debugger's message command ("m") is used to turn message categories on and off,
+ * like so:
+ *
+ *      m port on
+ *      m port off
+ *      ...
+ *
+ * NOTE: The order of these categories can be rearranged, alphabetized, etc, as desired; just be
+ * aware that changing the bit values could break saved Debugger states (not a huge concern, just
+ * something to be aware of).
+ */
+Messages.CATEGORIES = {
+    "cpu":      Messages.CPU,
+    "seg":      Messages.SEG,
+    "desc":     Messages.DESC,
+    "tss":      Messages.TSS,
+    "int":      Messages.INT,
+    "fault":    Messages.FAULT,
+    "bus":      Messages.BUS,
+    "mem":      Messages.MEM,
+    "port":     Messages.PORT,
+    "dma":      Messages.DMA,
+    "pic":      Messages.PIC,
+    "timer":    Messages.TIMER,
+    "cmos":     Messages.CMOS,
+    "rtc":      Messages.RTC,
+    "8042":     Messages.C8042,
+    "chipset":  Messages.CHIPSET,       // ie, anything else in ChipSet besides DMA, PIC, TIMER, CMOS, RTC and 8042
+    "keyboard": Messages.KEYBOARD,      // "kbd" is also allowed as shorthand for "keyboard"; see doMessages()
+    "key":      Messages.KEYS,          // using "key" instead of "keys", since the latter is a method on JavasScript objects
+    "video":    Messages.VIDEO,
+    "fdc":      Messages.FDC,
+    "hdc":      Messages.HDC,
+    "disk":     Messages.DISK,
+    "parallel": Messages.PARALLEL,
+    "serial":   Messages.SERIAL,
+    "mouse":    Messages.MOUSE,
+    "speaker":  Messages.SPEAKER,
+    "computer": Messages.COMPUTER,
+    "dos":      Messages.DOS,
+    "data":     Messages.DATA,
+    "log":      Messages.LOG,
+    "warn":     Messages.WARN,
+    /*
+     * Now we turn to message actions rather than message types; for example, setting "halt"
+     * on or off doesn't enable "halt" messages, but rather halts the CPU on any message above.
+     */
+    "halt":     Messages.HALT
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/panel.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * Region object definition
+ *
+ *  iBlock:     starting block number
+ *  cBlocks:    number of blocks spanned by region
+ *  type:       type of all blocks in the region (see Memory.TYPE.*)
+ *
+ * @typedef {{
+ *  iBlock:     number,
+ *  cBlocks:    number,
+ *  type:       number
+ * }} Region
+ */
+var Region;
+
+class Color {
+    /**
+     * Color(r, g, b, a)
+     *
+     * @this {Color}
+     * @param {number} [r]
+     * @param {number} [g]
+     * @param {number} [b]
+     * @param {number} [a]
+     */
+    constructor(r, g, b, a)
+    {
+        this.rgb = [r, g, b, a];
+        this.sValue = null;
+        if (r === undefined) this.randomize();
+    }
+
+    /**
+     * getRandom(nLimit)
+     *
+     * @this {Color}
+     * @param {number} [nLimit]
+     */
+    getRandom(nLimit)
+    {
+        return (Math.random() * (nLimit || 0x100)) | 0;
+    }
+
+    /**
+     * randomize()
+     *
+     * @this {Color}
+     */
+    randomize()
+    {
+        this.rgb[0] = this.getRandom(); this.rgb[1] = this.getRandom(); this.rgb[2] = this.getRandom(); this.rgb[3] = 0xff;
+        this.sValue = null;
+    }
+
+    /**
+     * toString()
+     *
+     * @this {Color}
+     * @return {string}
+     */
+    toString()
+    {
+        if (!this.sValue) this.sValue = '#' + Str.toHex(this.rgb[0], 2) + Str.toHex(this.rgb[1], 2) + Str.toHex(this.rgb[2], 2);
+        return this.sValue;
+    }
+}
+
+class Rectangle {
+    /**
+     * Rectangle(x, y, cx, cy)
+     *
+     * @this {Rectangle}
+     * @param {number} x
+     * @param {number} y
+     * @param {number} cx
+     * @param {number} cy
+     */
+    constructor(x, y, cx, cy)
+    {
+        this.x = x;
+        this.y = y;
+        this.cx = cx;
+        this.cy = cy;
+    }
+
+    /**
+     * contains(x, y)
+     *
+     * @param {number} x
+     * @param {number} y
+     * @return {boolean} true if (x,y) lies within the rectangle, false if not
+     */
+    contains(x, y)
+    {
+        return (x >= this.x && x < this.x + this.cx && y >= this.y && y < this.y + this.cy);
+    }
+
+    /**
+     * subDivide(units, unitsTotal, fHorizontal)
+     *
+     * Return a new rectangle that is a subset of the current rectangle, based on the ratio of
+     * units to unitsTotal, and then update the dimensions of the current rectangle.  Whether the
+     * original rectangle is divided horizontally or vertically is entirely arbitrary; currently,
+     * the criteria is horizontal if the ratio is 1/4 or more, vertical otherwise.
+     *
+     * @this {Rectangle}
+     * @param {number} units
+     * @param {number} unitsTotal
+     * @param {boolean} [fHorizontal]
+     * @return {Rectangle}
+     */
+    subDivide(units, unitsTotal, fHorizontal)
+    {
+        var rect;
+        if (fHorizontal === undefined) {
+            fHorizontal = units >= (unitsTotal >> 2);
+        }
+        if (fHorizontal) {
+            rect = new Rectangle(this.x, this.y, this.cx, ((this.cy * units) / unitsTotal) | 0);
+            this.y += rect.cy;
+            this.cy -= rect.cy;
+
+        } else {
+            rect = new Rectangle(this.x, this.y, ((this.cx * units) / unitsTotal) | 0, this.cy);
+            this.x += rect.cx;
+            this.cx -= rect.cx;
+
+        }
+        return rect;
+    }
+
+    /**
+     * drawWith(context, color)
+     *
+     * @param {Object} context
+     * @param {Color|string} [color]
+     */
+    drawWith(context, color)
+    {
+        if (!color) color = new Color();
+        context.strokeStyle = "black";
+        context.strokeRect(this.x, this.y, this.cx, this.cy);
+        context.fillStyle = (typeof color == "string"? color : color.toString());
+        context.fillRect(this.x, this.y, this.cx, this.cy);
+    }
+}
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class Panel extends Component {
+    /**
+     * Panel(parmsPanel)
+     *
+     * The Panel component has no required (parmsPanel) properties.
+     *
+     * @this {Panel}
+     * @param {Object} parmsPanel
+     */
+    constructor(parmsPanel)
+    {
+        super("Panel", parmsPanel);
+
+        this.canvas = null;
+        this.lockMouse = -1;
+        this.fMouseDown = false;
+        this.xMouse = this.yMouse = -1;
+        if (BACKTRACK) {
+            this.busInfo = null;
+            this.fBackTrack = false;
+        }
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * Most panel layouts don't have bindings of their own, so we pass along all binding requests to the
+     * Computer, CPU, Keyboard and Debugger components first.  The order shouldn't matter, since any component
+     * that doesn't recognize the specified binding should simply ignore it.
+     *
+     * @this {Panel}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "reset")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        if (this.cmp && this.cmp.setBinding(sHTMLType, sBinding, control, sValue)) return true;
+        if (this.cpu && this.cpu.setBinding(sHTMLType, sBinding, control, sValue)) return true;
+        if (this.kbd && this.kbd.setBinding(sHTMLType, sBinding, control, sValue)) return true;
+        if (DEBUGGER && this.dbg && this.dbg.setBinding(sHTMLType, sBinding, control, sValue)) return true;
+
+        if (!this.canvas && sHTMLType == "canvas") {
+
+            var panel = this;
+            var fPanel = false;
+
+            if (BACKTRACK && sBinding == "btpanel") {
+                this.fBackTrack = fPanel = true;
+            }
+
+            if (fPanel) {
+                this.canvas = control;
+                this.context = this.canvas.getContext("2d");
+
+                /*
+                 * Employ the same gross onresize() hack for IE9/IE10 that we had to use for the Video canvas
+                 */
+                if (Web.getUserAgent().indexOf("MSIE") >= 0) {
+                    this.canvas.onresize = function(canvas, cx, cy) {
+                        return function onResizeVideo() {
+                            canvas.style.height = (((canvas.clientWidth * cy) / cx) | 0) + "px";
+                        };
+                    }(this.canvas, this.canvas.width, this.canvas.height);
+                    this.canvas.onresize();
+                }
+
+                this.xMem = this.yMem = 0;
+                this.cxMem = ((this.canvas.width * Panel.LIVEMEM.CX) / Panel.LIVECANVAS.CX) | 0;
+                this.cyMem = this.canvas.height;
+
+                this.xReg = this.cxMem;
+                this.yReg = 0;
+                this.cxReg = this.canvas.width - this.cxMem;
+                this.cyReg = this.canvas.height;
+
+                this.xDump = this.xReg;
+                this.yDump = ((this.canvas.height * (Panel.LIVEREGS.CY - Panel.LIVEDUMP.CY)) / Panel.LIVECANVAS.CY) | 0;
+                this.cxDump = this.cxReg;
+                this.cyDump = ((this.canvas.height * Panel.LIVEDUMP.CY) / Panel.LIVECANVAS.CY) | 0;
+
+                this.canvasLiveMem = document.createElement("canvas");
+                this.canvasLiveMem.width = Panel.LIVEMEM.CX;
+                this.canvasLiveMem.height = Panel.LIVEMEM.CY;
+                this.contextLiveMem = this.canvasLiveMem.getContext("2d");
+                this.imageLiveMem = this.contextLiveMem.createImageData(this.canvasLiveMem.width, this.canvasLiveMem.height);
+
+                this.canvasLiveRegs = document.createElement("canvas");
+                this.canvasLiveRegs.width = Panel.LIVEREGS.CX;
+                this.canvasLiveRegs.height = Panel.LIVEREGS.CY;
+                this.contextLiveRegs = this.canvasLiveRegs.getContext("2d");
+
+                this.canvas.addEventListener(
+                    'mousemove',
+                    function onMouseMove(event) {
+                        panel.moveMouse(event);
+                    },
+                    false               // we'll specify false for the 'useCapture' parameter for now...
+                );
+                this.canvas.addEventListener(
+                    'mousedown',
+                    function onMouseDown(event) {
+                        panel.clickMouse(event, true);
+                    },
+                    false               // we'll specify false for the 'useCapture' parameter for now...
+                );
+                this.canvas.addEventListener(
+                    'mouseup',
+                    function onMouseUp(event) {
+                        panel.clickMouse(event, false);
+                    },
+                    false               // we'll specify false for the 'useCapture' parameter for now...
+                );
+
+                this.fRedraw = true;
+                return true;
+            }
+        }
+        return super.setBinding(sHTMLType, sBinding, control, sValue);
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {Panel}
+     * @param {Computer} cmp
+     * @param {Bus} bus
+     * @param {X86CPU} cpu
+     * @param {DebuggerX86} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cmp = cmp;
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+        this.kbd = cmp.getMachineComponent("Keyboard");
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {Panel}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) Panel.init();
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {Panel}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return true;
+    }
+
+    /**
+     * clickMouse(event, fDown)
+     *
+     * @this {Panel}
+     * @param {Object} event object from a 'mousedown' or 'mouseup' event
+     * @param {boolean} fDown
+     */
+    clickMouse(event, fDown)
+    {
+        /*
+         * event.button is 0 for the LEFT button and 2 for the RIGHT button
+         */
+        if (!event.button) {
+            this.lockMouse = fDown? 0 : -1;
+            this.fMouseDown = fDown;
+            this.updateMouse(event, fDown);
+        }
+    }
+
+    /**
+     * moveMouse(event)
+     *
+     * @this {Panel}
+     * @param {Object} event object from a 'mousemove' event
+     */
+    moveMouse(event)
+    {
+        this.updateMouse(event);
+    }
+
+    /**
+     * updateMouse(event, fDown)
+     *
+     * MouseEvent objects contain, among other things, the following properties:
+     *
+     *      clientX
+     *      clientY
+     *
+     * I've selected the above properties because they're widely supported, not because I need
+     * client-area coordinates.  In fact, layerX and layerY are probably closer to what I really want,
+     * but I don't think they're available in all browsers.  screenX and screenY would work as well.
+     *
+     * @this {Panel}
+     * @param {Object} event object from a mouse event (specifically, a MouseEvent object)
+     * @param {boolean} [fDown] is true or false if this was a click event, otherwise it's just a move event
+     */
+    updateMouse(event, fDown)
+    {
+        /*
+         * Due to the responsive nature of our pages, the displayed size of the canvas may be smaller than the
+         * allocated size, and the coordinates we receive from mouse events are based on the currently displayed size.
+         */
+        var xScale = Panel.LIVECANVAS.CX / this.canvas.offsetWidth;
+        var yScale = Panel.LIVECANVAS.CY / this.canvas.offsetHeight;
+
+        var rect = this.canvas.getBoundingClientRect();
+        var x = ((event.clientX - rect.left) * xScale) | 0;
+        var y = ((event.clientY - rect.top) * yScale) | 0;
+
+        if (fDown == null) {
+            if (!this.lockMouse) {
+                this.lockMouse = Math.abs(this.xMouse - x) > Math.abs(this.yMouse - y)? 1 : 2;
+            }
+            if (this.lockMouse == 1) {
+                y = this.yMouse;
+            } else if (this.lockMouse == 2) {
+                x = this.xMouse;
+            }
+        }
+
+        this.xMouse = x;
+        this.yMouse = y;
+
+        if (MAXDEBUG) this.log("Panel.moveMouse(" + x + "," + y + ")");
+
+        if (x >= 0 && x < Panel.LIVECANVAS.CX && y >= 0 && y < Panel.LIVECANVAS.CY) {
+            /*
+             * Convert the mouse position into the corresponding memory address, assuming it's over the live memory area
+             */
+            var addr = this.findAddress(x, y);
+            if (addr !== X86.ADDR_INVALID) {
+                addr &= ~0xf;
+                if (addr != this.addrDumpLast) {
+                    this.dumpMemory(addr, true);
+                    this.addrDumpLast = addr;
+                }
+            }
+        }
+    }
+
+    /**
+     * findAddress(x, y)
+     *
+     * @this {Panel}
+     * @param {number} x
+     * @param {number} y
+     * @return {number} address corresponding to (x,y) canvas coordinates, or ADDR_INVALID if none
+     */
+    findAddress(x, y)
+    {
+        if (x < Panel.LIVEMEM.CX && this.busInfo && this.busInfo.aRects) {
+            var i, rect;
+            for (i = 0; i < this.busInfo.aRects.length; i++) {
+                rect = this.busInfo.aRects[i];
+                if (rect.contains(x, y)) {
+                    x -= rect.x;
+                    y -= rect.y;
+                    var region = this.busInfo.aRegions[i];
+                    var iBlock = Usr.getBitField(/** @type {BitField} */ (Bus.BlockInfo.num), this.busInfo.aBlocks[region.iBlock]);
+                    var addr = iBlock * this.bus.nBlockSize;
+                    var addrLimit = (iBlock + region.cBlocks) * this.bus.nBlockSize - 1;
+
+                    /*
+                     * If you want memory to be arranged "vertically" instead of "horizontally", do this:
+                     *
+                     *      if (x > 0) addr += rect.cy * (x - 1) * this.ratioMemoryToPixels;
+                     *      addr += (y * this.ratioMemoryToPixels);
+                     */
+                    if (y > 0) addr += rect.cx * (y - 1) * this.ratioMemoryToPixels;
+                    addr += (x * this.ratioMemoryToPixels);
+
+                    addr |= 0;
+                    if (addr > addrLimit) addr = addrLimit;
+                    if (MAXDEBUG) this.log("Panel.findAddress(" + x + "," + y + ") found type " + Memory.TYPE.NAMES[region.type] + ", address %" + Str.toHex(addr));
+                    return addr;
+                }
+            }
+        }
+        return X86.ADDR_INVALID;
+    }
+
+    /**
+     * updateAnimation()
+     *
+     * If the given Control Panel contains a canvas requiring animation (eg, "btpanel"), then this is where that happens.
+     *
+     * @this {Panel}
+     */
+    updateAnimation()
+    {
+        if (this.fRedraw) {
+
+            this.initPen(10, Panel.LIVECANVAS.FONT.CY, this.canvasLiveMem, this.contextLiveMem, this.canvas.style.color);
+
+            if (this.fBackTrack) {
+                if (DEBUG) this.log("begin scanMemory()");
+                this.busInfo = this.bus.scanMemory(this.busInfo);
+                /*
+                 * Calculate the pixel-to-memory-address ratio
+                 */
+                this.ratioMemoryToPixels = (this.busInfo.cBlocks * this.bus.nBlockSize) / (Panel.LIVEMEM.CX * Panel.LIVEMEM.CY);
+                /*
+                 * Update the BusInfo object with region information (cRegions and aRegions); return true if region
+                 * information has changed since the last call.
+                 */
+                if (this.findRegions()) {
+                    /*
+                     * For each region, I choose a slice of the LiveMem canvas and record the corresponding rectangle
+                     * within an aRects array (parallel to the aRegions array) in the BusInfo object.
+                     *
+                     * I don't need a sophisticated Treemap algorithm, because at this level, the data is not hierarchical.
+                     * subDivide() makes a simple horizontal or vertical slicing decision based on the ratio of region blocks
+                     * to remaining blocks.
+                     */
+                    var i, rect;
+                    var rectAvail = new Rectangle(0, 0, this.canvasLiveMem.width, this.canvasLiveMem.height);
+                    this.busInfo.aRects = [];
+                    var cBlocksRemaining = this.busInfo.cBlocks;
+
+                    for (i = 0; i < this.busInfo.cRegions; i++) {
+                        var cBlocksRegion = this.busInfo.aRegions[i].cBlocks;
+                        this.busInfo.aRects.push(rect = rectAvail.subDivide(cBlocksRegion, cBlocksRemaining, !i));
+                        if (MAXDEBUG) this.log("region " + i + " rectangle: (" + rect.x + "," + rect.y + " " + rect.cx + "," + rect.cy + ")");
+                        cBlocksRemaining -= cBlocksRegion;
+                    }
+
+                    /*
+                     * Assert that not only did all the specified regions account for all the specified blocks, but also that
+                     * the series of subDivide() calls exhausted the original rectangle to one of either zero width or zero height.
+                     */
+
+
+                    /*
+                     * Now draw all the rectangles produced by the series of subDivide() calls.
+                     */
+                    for (i = 0; i < this.busInfo.aRects.length; i++) {
+                        var region = this.busInfo.aRegions[i];
+                        rect = this.busInfo.aRects[i];
+                        rect.drawWith(this.contextLiveMem, Memory.TYPE.COLORS[region.type]);
+                        this.centerPen(rect);
+                        this.centerText(Memory.TYPE.NAMES[region.type] + " (" + (((region.cBlocks * this.bus.nBlockSize) / 1024) | 0) + "Kb)");
+                    }
+                }
+                if (DEBUG) this.log("end scanMemory(): total bytes: " + this.busInfo.cbTotal + ", total blocks: " + this.busInfo.cBlocks + ", total regions: " + this.busInfo.cRegions);
+            } else {
+                this.drawText("This space intentionally left blank");
+            }
+            this.context.drawImage(this.canvasLiveMem, 0, 0, this.canvasLiveMem.width, this.canvasLiveMem.height, this.xMem, this.yMem, this.cxMem, this.cyMem);
+            this.fRedraw = false;
+        }
+    }
+
+    /**
+     * updateStatus(fForce)
+     *
+     * Update function for Panels containing elements with high-frequency display requirements.
+     *
+     * For older (and slower) DOM-based display elements, those are sill being managed by the X86CPU component,
+     * so it has its own updateStatus() handler.
+     *
+     * The Computer's updateStatus() handler is currently responsible for calling both our handler and the CPU's handler.
+     *
+     * @this {Panel}
+     * @param {boolean} [fForce] (true will display registers even if the CPU is running and "live" registers are not enabled)
+     */
+    updateStatus(fForce)
+    {
+        if (this.canvas) this.dumpRegisters();
+    }
+
+    /**
+     * findRegions()
+     *
+     * This takes the BusInfo object produced by scanMemory() and adds the following:
+     *
+     *      cRegions:   number of contiguous memory regions
+     *      aRegions:   array of aBlocks [index, count, type] objects
+     *
+     * It calls addRegion() for each discrete region (set of contiguous blocks with the same type) that it finds.
+     *
+     * @this {Panel}
+     * @return {boolean} true if current region checksum differed from previous checksum (ie, one or more regions changed)
+     */
+    findRegions()
+    {
+        var checksum = 0;
+        this.busInfo.cRegions = 0;
+        if (!this.busInfo.aRegions) this.busInfo.aRegions = [];
+
+        var typeRegion = -1, iBlockRegion = 0, addrRegion = 0, nBlockPrev = -1;
+
+        for (var iBlock = 0; iBlock < this.busInfo.cBlocks; iBlock++) {
+            var blockInfo = this.busInfo.aBlocks[iBlock];
+            var typeBlock = Usr.getBitField(/** @type {BitField} */ (Bus.BlockInfo.type), blockInfo);
+            var nBlockCurr = Usr.getBitField(/** @type {BitField} */ (Bus.BlockInfo.num), blockInfo);
+            if (typeBlock != typeRegion || nBlockCurr != nBlockPrev + 1) {
+                var cBlocks = iBlock - iBlockRegion;
+                if (cBlocks) {
+                    checksum += this.addRegion(addrRegion, iBlockRegion, cBlocks, typeRegion);
+                }
+                typeRegion = typeBlock;
+                iBlockRegion = iBlock;
+                addrRegion = nBlockCurr << this.bus.nBlockShift;
+            }
+            nBlockPrev = nBlockCurr;
+        }
+
+        checksum += this.addRegion(addrRegion, iBlockRegion, iBlock - iBlockRegion, typeRegion);
+
+        var fChanged = (this.busInfo.checksumRegions != checksum);
+        this.busInfo.checksumRegions = checksum;
+        return fChanged;
+    }
+
+    /**
+     * addRegion(addr, iBlock, cBlocks, type)
+     *
+     * @this {Panel}
+     * @param {number} addr
+     * @param {number} iBlock
+     * @param {number} cBlocks
+     * @param {number} type
+     * @return {number} bitfield containing the above values (used for checksum)
+     */
+    addRegion(addr, iBlock, cBlocks, type)
+    {
+        if (DEBUG) this.log("region " + this.busInfo.cRegions + " (addr " + Str.toHexLong(addr) + ", type " + Memory.TYPE.NAMES[type] + ") contains " + cBlocks + " blocks");
+        this.busInfo.aRegions[this.busInfo.cRegions++] = {iBlock: iBlock, cBlocks: cBlocks, type: type};
+        return Usr.initBitFields(Bus.BlockInfo, iBlock, cBlocks, 0, type);
+    }
+
+    /**
+     * dumpRegisters()
+     *
+     * Updates the live register portion of the panel.
+     *
+     * @this {Panel}
+     */
+    dumpRegisters()
+    {
+        if (this.context && this.canvasLiveRegs && this.contextLiveRegs) {
+
+            var cpu = this.cpu;
+            var x = 0, y = 0, cx = this.canvasLiveRegs.width, cy = this.canvasLiveRegs.height;
+
+            this.contextLiveRegs.fillStyle = Panel.LIVEREGS.COLOR;
+            this.contextLiveRegs.fillRect(x, y, cx, cy);
+
+            this.initPen(x + 10, y + Panel.LIVECANVAS.FONT.CY, this.canvasLiveRegs, this.contextLiveRegs, this.canvas.style.color);
+            this.initCols(3);
+            this.drawText("CPU");
+            this.drawText("Target");
+            this.drawText("Current");
+            this.skipLines();
+            this.drawText(cpu.model);
+            this.drawText(cpu.getSpeedTarget());
+            this.drawText(cpu.getSpeedCurrent());
+            this.skipLines(2);
+            this.initCols(8);
+            this.initNumberFormat(16, cpu.model < X86.MODEL_80386? 4 : 8);
+            this.drawText("AX", cpu.regEAX, 2);
+            this.drawText("DS", cpu.getDS(), 0, 1);
+            this.drawText("DX", cpu.regEDX, 2);
+            this.drawText("SI", cpu.regESI, 0, 1.5);
+            this.drawText("BX", cpu.regEBX, 2);
+            this.drawText("ES", cpu.getES(), 0, 1);
+            this.drawText("CX", cpu.regECX, 2);
+            this.drawText("DI", cpu.regEDI, 0, 1.5);
+            this.drawText("CS", cpu.getCS(), 2);
+            this.drawText("SS", cpu.getSS(), 0, 1);
+            this.drawText("IP", cpu.getIP(), 2);
+            this.drawText("SP", cpu.getSP(), 0, 1.5);
+            var regPS;
+            this.drawText("PS", regPS = cpu.getPS(), 2);
+            this.drawText("BP", cpu.regEBP, 0, 1.5);
+            if (cpu.model >= X86.MODEL_80386) {
+                this.drawText("FS", cpu.getFS(), 2);
+                this.drawText("CR0", cpu.regCR0, 0, 1);
+                this.drawText("GS", cpu.getGS(), 2);
+                this.drawText("CR3", cpu.regCR3, 0, 1.5);
+            }
+            this.initCols(9);
+            this.drawText("V" + ((regPS & X86.PS.OF)? 1 : 0));
+            this.drawText("D" + ((regPS & X86.PS.DF)? 1 : 0));
+            this.drawText("I" + ((regPS & X86.PS.IF)? 1 : 0));
+            this.drawText("T" + ((regPS & X86.PS.TF)? 1 : 0));
+            this.drawText("S" + ((regPS & X86.PS.SF)? 1 : 0));
+            this.drawText("Z" + ((regPS & X86.PS.ZF)? 1 : 0));
+            this.drawText("A" + ((regPS & X86.PS.AF)? 1 : 0));
+            this.drawText("P" + ((regPS & X86.PS.PF)? 1 : 0));
+            this.drawText("C" + ((regPS & X86.PS.CF)? 1 : 0), 0, 2);
+
+            this.dumpMemory(this.addrDumpLast);
+
+            this.context.drawImage(this.canvasLiveRegs, x, y, cx, cy, this.xReg, this.yReg, this.cxReg, this.cyReg);
+        }
+    }
+
+    /**
+     * dumpMemory(addr, fDraw)
+     *
+     * @this {Panel}
+     * @param {number} addr
+     * @param {boolean} [fDraw]
+     */
+    dumpMemory(addr, fDraw)
+    {
+        if (this.context && this.canvasLiveRegs && this.contextLiveRegs) {
+
+            var x = 0, y = Panel.LIVEREGS.CY - Panel.LIVEDUMP.CY, cx = this.canvasLiveRegs.width, cy = Panel.LIVEDUMP.CY;
+
+            this.contextLiveRegs.fillStyle = Panel.LIVEREGS.COLOR;
+            this.contextLiveRegs.fillRect(x, y, cx, cy);
+
+            this.initPen(x + 10, y + Panel.LIVECANVAS.FONT.CY, this.canvasLiveRegs, this.contextLiveRegs, this.canvas.style.color);
+            this.initCols(24);
+            if (addr == null) {
+                this.drawText("Mouse over memory to dump");
+            } else {
+                this.drawText(Str.toHexLong(addr), null, 0, 1);
+                for (var iLine = 1; iLine <= 16; iLine++) {
+                    var sChars = "";
+                    for (var iCol = 1; iCol <= 8; iCol++) {
+                        var b = this.bus.getByteDirect(addr++);
+                        this.drawText(Str.toHex(b, 2), null, 1);
+                        sChars += (b >= 32 && b < 128? String.fromCharCode(b) : ".");
+                    }
+                    this.drawText(sChars, null, 0, 1);
+                }
+            }
+
+            if (fDraw) this.context.drawImage(this.canvasLiveRegs, x, y, cx, cy, this.xDump, this.yDump, this.cxDump, this.cyDump);
+        }
+    }
+
+    /**
+     * initPen(xLeft, yTop, canvas, context, sColor, cyFont, sFontFace)
+     *
+     * @this {Panel}
+     * @param {number} xLeft
+     * @param {number} yTop
+     * @param {HTMLCanvasElement} [canvas]
+     * @param {Object} [context]
+     * @param {string} [sColor]
+     * @param {number} [cyFont]
+     * @param {string} [sFontFace]
+     */
+    initPen(xLeft, yTop, canvas, context, sColor, cyFont, sFontFace)
+    {
+        this.setPen(this.xLeftMargin = xLeft, yTop);
+        this.heightText = this.heightDefault = cyFont || Panel.LIVECANVAS.FONT.CY;
+        if (!sFontFace) sFontFace = this.fontDefault || (this.heightDefault + "px " + Panel.LIVECANVAS.FONT.FACE);
+        this.fontText = this.fontDefault = sFontFace;
+        if (canvas) {
+            this.canvasText = canvas;
+        }
+        if (context) {
+            this.contextText = context;
+            this.colorText = sColor || "white";
+        }
+    }
+
+    /**
+     * setPen(x, y)
+     *
+     * @this {Panel}
+     * @param {number} x
+     * @param {number} y
+     */
+    setPen(x, y)
+    {
+        this.xText = x;
+        this.yText = y;
+    }
+
+    /**
+     * centerPen(rect)
+     *
+     * @this {Panel}
+     * @param {Rectangle} rect
+     */
+    centerPen(rect)
+    {
+        this.fontText = this.fontDefault;
+        this.heightText = this.heightDefault;
+        var x = rect.x + (rect.cx >> 1);
+        var y = rect.y + (rect.cy >> 1);
+        var maxText = rect.cy;
+        if (rect.cx < rect.cy) {
+            maxText = rect.cx;
+            this.fVerticalText = true;
+            this.contextText.save();
+            this.contextText.translate(x, y);
+            this.contextText.rotate(-Math.PI/2);
+            x = y = 0;
+        }
+        if (maxText < this.heightText) {
+            this.heightText = maxText;
+            this.fontText = this.heightText + "px " + Panel.LIVECANVAS.FONT.FACE;
+        }
+        this.setPen(x, y);
+    }
+
+    /**
+     * initCols(nCols)
+     *
+     * @this {Panel}
+     * @param {number} nCols
+     */
+    initCols(nCols)
+    {
+        this.cxColumn = (this.canvasText.width / nCols) | 0;
+    }
+
+    /**
+     * skipCols(nCols)
+     *
+     * @this {Panel}
+     * @param {number} nCols
+     */
+    skipCols(nCols)
+    {
+        this.xText += this.cxColumn * nCols;
+    }
+
+    /**
+     * skipLines(nLines)
+     *
+     * @this {Panel}
+     * @param {number} [nLines]
+     */
+    skipLines(nLines)
+    {
+        this.xText = this.xLeftMargin;
+        this.yText += (this.heightText + 2) * (nLines || 1);
+    }
+
+    /**
+     * initNumberFormat(nBase, nDigits)
+     *
+     * @this {Panel}
+     * @param {number} nBase
+     * @param {number} nDigits
+     */
+    initNumberFormat(nBase, nDigits)
+    {
+        this.nDefaultBase = nBase;
+        this.nDefaultDigits = nDigits;
+    }
+
+    /**
+     * drawText(sText)
+     *
+     * @this {Panel}
+     * @param {string} sText
+     * @param {number|null} [nValue]
+     * @param {number} [nColsSkip]
+     * @param {number} [nLinesSkip]
+     */
+    drawText(sText, nValue, nColsSkip, nLinesSkip)
+    {
+        this.contextText.font = this.fontText;
+        this.contextText.fillStyle = this.colorText;
+        this.contextText.fillText(sText, this.xText, this.yText);
+        this.xText += this.cxColumn;
+        if (nValue != null) {
+            var sValue;
+            if (this.nDefaultBase != 16) {
+                sValue = nValue.toString();
+            } else {
+                sValue = this.nDefaultDigits < 8? "0x" : "";
+                sValue += Str.toHex(nValue, this.nDefaultDigits);
+            }
+            this.contextText.fillText(sValue, this.xText, this.yText);
+            this.xText += this.cxColumn;
+        }
+        if (nColsSkip) this.skipCols(nColsSkip);
+        if (nLinesSkip) this.skipLines(nLinesSkip);
+    }
+
+    /**
+     * centerText(sText)
+     *
+     * To center text within a given Rectangle:
+     *
+     *      centerPen(rect)
+     *      centerText(sText)
+     *
+     * centerPen() sets xLeft and yTop to the center of the specified rectangle, and centerText() calculates
+     * the width of the text, adjusting the horizontal centering by its width and the vertical centering by the
+     * default font height.  Then it calls drawText().
+     *
+     * @this {Panel}
+     * @param {string} sText
+     */
+    centerText(sText)
+    {
+        this.contextText.font = this.fontText;
+        var tm = this.contextText.measureText(sText);
+        this.xText -= tm.width >> 1;
+        this.yText += (this.heightText >> 1) - 2;
+        this.drawText(sText);
+        if (this.fVerticalText) {
+            this.contextText.restore();
+            this.fVerticalText = false;
+        }
+    }
+
+    /**
+     * Panel.init()
+     *
+     * This function operates on every HTML element of class "panel", extracting the
+     * JSON-encoded parameters for the Panel constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a Panel component, and then binding
+     * any associated HTML controls to the new component.
+     *
+     * NOTE: Unlike most other component init() functions, this one is designed to be
+     * called multiple times: once at load time, so that we can bind our print()
+     * function to the panel's output control ASAP, and again when the Computer component
+     * is verifying that all components are ready and invoking their powerUp() functions.
+     *
+     * Our powerUp() method gives us a second opportunity to notify any components that
+     * that might care (eg, CPU, Keyboard, and Debugger) that we have some controls they
+     * might want to use.
+     */
+    static init()
+    {
+        var fReady = false;
+        var aePanels = Component.getElementsByClass(document, PCX86.APPCLASS, "panel");
+        for (var iPanel=0; iPanel < aePanels.length; iPanel++) {
+            var ePanel = aePanels[iPanel];
+            var parmsPanel = Component.getComponentParms(ePanel);
+            var panel = Component.getComponentByID(parmsPanel['id']);
+            if (!panel) {
+                fReady = true;
+                panel = new Panel(parmsPanel);
+            }
+            Component.bindComponentControls(panel, ePanel, PCX86.APPCLASS);
+            if (fReady) panel.setReady();
+        }
+    }
+}
+
+/*
+ * The "Live" canvases that we create internally have the following fixed dimensions, to make drawing
+ * simpler.  We then render, via drawImage(), these canvases onto the supplied canvas, which will automatically
+ * stretch the live images to fit.
+ */
+Panel.LIVECANVAS = {
+    CX:         1280,
+    CY:         720,
+    FONT:       {
+        CY:     18,
+        FACE:   "Monaco, Lucida Console, Courier New"
+    }
+};
+
+Panel.LIVEMEM = {
+    CX: (Panel.LIVECANVAS.CX * 3) >> 2,
+    CY: (Panel.LIVECANVAS.CY)
+};
+
+Panel.LIVEREGS = {
+    CX:     (Panel.LIVECANVAS.CX - Panel.LIVEMEM.CX),
+    CY:     (Panel.LIVECANVAS.CY),
+    COLOR:  "black"
+};
+
+Panel.LIVEDUMP = {
+    CX: (Panel.LIVECANVAS.CX - Panel.LIVEMEM.CX),
+    CY: (Panel.LIVECANVAS.CY >> 1)
+};
+
+/*
+ * findRegions() records block numbers in bits 0-14, a BackTrack "mod" bit in bit 15, and the block type at bit 16.
+ */
+Panel.REGION = {
+    MASK:           0x7fff,
+    BTMOD_SHIFT:    15,
+    TYPE_SHIFT:     16
+};
+
+/*
+ * Initialize every Panel module on the page.
+ */
+Web.onInit(Panel.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/bus.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class Bus extends Component {
+    /**
+     * Bus(cpu, dbg)
+     *
+     * The Bus component manages physical memory and I/O address spaces.
+     *
+     * The Bus component has no UI elements, so it does not require an init() handler,
+     * but it still inherits from the Component class and must be allocated like any
+     * other device component.  It's currently allocated by the Computer's init() handler,
+     * which then calls the initBus() method of all the other components.
+     *
+     * When initMemory() initializes the entire address space, it also passes aMemBlocks
+     * to the CPU object, so that the CPU can perform its own address-to-block calculations
+     * (essential, for example, when the CPU enables paging).
+     *
+     * For memory beyond the simple needs of the ROM and RAM components (ie, memory-mapped
+     * devices), the address space must still be allocated through the Bus component via
+     * addMemory().  If the component needs something more than simple read/write storage,
+     * it must provide a controller with getMemoryBuffer() and getMemoryAccess() methods.
+     *
+     * All port (I/O) operations are defined by external handlers; they register with us,
+     * and we manage those registrations and provide support for I/O breakpoints, but the
+     * only default I/O behavior we provide is ignoring writes to any unregistered output
+     * ports and returning 0xff from any unregistered input ports.
+     *
+     * @this {Bus}
+     * @param {Object} parmsBus
+     * @param {X86CPU} cpu
+     * @param {DebuggerX86} dbg
+     */
+    constructor(parmsBus, cpu, dbg)
+    {
+        super("Bus", parmsBus);
+
+        this.cpu = cpu;
+        this.dbg = dbg;
+
+        this.nBusWidth = parmsBus['busWidth'] || 20;
+
+        /*
+         * Compute all Bus memory block parameters, based on the width of the bus.
+         *
+         * Regarding blockTotal, we want to avoid using block overflow expressions like:
+         *
+         *      iBlock < this.nBlockTotal? iBlock : 0
+         *
+         * As long as we know that blockTotal is a power of two (eg, 256 or 0x100, in the case of
+         * nBusWidth == 20 and blockSize == 4096), we can define blockMask as (blockTotal - 1) and
+         * rewrite the previous expression as:
+         *
+         *      iBlock & this.nBlockMask
+         *
+         * Similarly, we mask addresses with busMask to enforce "A20 wrap" on 20-bit buses.
+         * For larger buses, A20 wrap can be simulated by either clearing bit 20 of busMask or by
+         * changing all the block entries for the 2nd megabyte to match those in the 1st megabyte.
+         *
+         *      Bus Property        Old hard-coded values (when nBusWidth was always 20)
+         *      ------------        ----------------------------------------------------
+         *      this.nBusLimit      0xfffff
+         *      this.nBusMask       [same as busLimit]
+         *      this.nBlockSize     4096
+         *      this.nBlockLen      (this.nBlockSize >> 2)
+         *      this.nBlockShift    12
+         *      this.nBlockLimit    0xfff
+         *      this.nBlockTotal    ((this.nBusLimit + this.nBlockSize) / this.nBlockSize) | 0
+         *      this.nBlockMask     (this.nBlockTotal - 1) [ie, 0xff]
+         *
+         * Note that we choose a nBlockShift value (and thus a physical memory block size) based on "buswidth":
+         *
+         *      Bus Width                       Block Shift     Block Size
+         *      ---------                       -----------     ----------
+         *      20 bits (1Mb address space):    12              4Kb (256 maximum blocks)
+         *      24 bits (16Mb address space):   14              16Kb (1K maximum blocks)
+         *      32 bits (4Gb address space);    15              32Kb (128K maximum blocks)
+         *
+         * The coarser block granularities (ie, 16Kb and 32Kb) may cause problems for certain RAM and/or ROM
+         * allocations that are contiguous but are allocated out of order, or that have different controller
+         * requirements.  Your choices, for the moment, are either to ensure the allocations are performed in
+         * order, or to choose smaller nBlockShift values (at the expense of a generating a larger block array).
+         *
+         * Note that if PAGEBLOCKS is set, then for a bus width of 32 bits, the block size is fixed at 4Kb.
+         */
+        this.addrTotal = Math.pow(2, this.nBusWidth);
+        this.nBusLimit = this.nBusMask = (this.addrTotal - 1) | 0;
+        this.nBlockShift = (PAGEBLOCKS && this.nBusWidth == 32 || this.nBusWidth <= 20)? 12 : (this.nBusWidth <= 24? 14 : 15);
+        this.nBlockSize = 1 << this.nBlockShift;
+        this.nBlockLen = this.nBlockSize >> 2;
+        this.nBlockLimit = this.nBlockSize - 1;
+        this.nBlockTotal = (this.addrTotal / this.nBlockSize) | 0;
+        this.nBlockMask = this.nBlockTotal - 1;
+
+
+        /*
+         * Lists of I/O notification functions: aPortInputNotify and aPortOutputNotify are arrays, indexed by
+         * port, of sub-arrays which contain:
+         *
+         *      [0]: registered function to call for every I/O access
+         *
+         * The registered function is called with the port address, and if the access was triggered by the CPU,
+         * the linear instruction pointer (LIP) at the point of access.
+         *
+         * WARNING: Unlike the (old) read and write memory notification functions, these support only one
+         * pair of input/output functions per port.  A more sophisticated architecture could support a list
+         * of chained functions across multiple components, but I doubt that will be necessary here.
+         *
+         * UPDATE: The Debugger now piggy-backs on these arrays to indicate ports for which it wants notification
+         * of I/O.  In those cases, the registered component/function elements may or may not be set, but the
+         * following additional element will be set:
+         *
+         *      [1]: true to break on I/O, false to ignore I/O
+         *
+         * The false case is important if fPortInputBreakAll and/or fPortOutputBreakAll is set, because it allows the
+         * Debugger to selectively ignore specific ports.
+         */
+        this.aPortInputNotify = [];
+        this.aPortOutputNotify = [];
+        this.fPortInputBreakAll = this.fPortOutputBreakAll = false;
+
+        /*
+         * By default, all I/O ports are 1 byte wide; ports that are wider must add themselves to one or both of
+         * these lists, using addPortInputWidth() and/or addPortOutputWidth().
+         */
+        this.aPortInputWidth = [];
+        this.aPortOutputWidth = [];
+
+        /*
+         * Allocate empty Memory blocks to span the entire physical address space.
+         */
+        this.initMemory();
+
+        if (BACKTRACK) {
+            this.abtObjects = [];
+            this.cbtDeletions = 0;
+            this.ibtLastAlloc = -1;
+            this.ibtLastDelete = 0;
+        }
+
+        this.setReady();
+    }
+
+    /**
+     * initMemory()
+     *
+     * Allocate enough (empty) Memory blocks to span the entire physical address space.
+     *
+     * @this {Bus}
+     */
+    initMemory()
+    {
+        var block = new Memory();
+        block.copyBreakpoints(this.dbg);
+        this.aMemBlocks = new Array(this.nBlockTotal);
+        for (var iBlock = 0; iBlock < this.nBlockTotal; iBlock++) {
+            this.aMemBlocks[iBlock] = block;
+        }
+        this.cpu.initMemory(this.aMemBlocks, this.nBlockShift);
+        this.cpu.setAddressMask(this.nBusMask);
+    }
+
+    /**
+     * reset()
+     *
+     * @this {Bus}
+     */
+    reset()
+    {
+        this.setA20(true);
+        if (BACKTRACK) this.ibtLastDelete = 0;
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * We don't need a powerDown() handler, because for largely historical reasons, our state (including the A20 state)
+     * is saved by saveMemory(), which called by the CPU.
+     *
+     * However, we do need a powerUp() handler, because on resumable machines, the Computer's onReset() function calls
+     * everyone's powerUp() handler rather than their reset() handler.
+     *
+     * TODO: Perhaps Computer should be smarter: if there's no powerUp() handler, then fallback to the reset() handler.
+     * In that case, however, we'd either need to remove the powerUp() stub in Component, or detect the existence of the stub.
+     *
+     * @this {Bus}
+     * @param {Object|null} data (always null because we supply no powerDown() handler)
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) this.reset();
+        return true;
+    }
+
+    /**
+     * addMemory(addr, size, type, controller)
+     *
+     * Adds new Memory blocks to the specified address range.  Any Memory blocks previously
+     * added to that range must first be removed via removeMemory(); otherwise, you'll get
+     * an allocation conflict error.  This helps prevent address calculation errors, redundant
+     * allocations, etc.
+     *
+     * We've relaxed some of the original requirements (ie, that addresses must start at a
+     * block-granular address, or that sizes must be equal to exactly one or more blocks),
+     * because machines with large block sizes can make it impossible to load certain ROMs at
+     * their required addresses.  Every allocation still allocates a whole number of blocks.
+     *
+     * Even so, Bus memory management does NOT provide a general-purpose heap.  Most memory
+     * allocations occur during machine initialization and never change.  In particular, there
+     * is NO support for removing partial-block allocations.  Typically, the only region that
+     * changes post-initialization is the Video buffer, and only in the EGA/VGA implementation.
+     *
+     * Each Memory block keeps track of a start address (addr) and length (used), indicating
+     * the used space within the block; any free space that precedes or follows that used space
+     * can be allocated later, by simply extending the beginning or ending of the previously used
+     * space.  However, any holes that might have existed between the original allocation and an
+     * extension are subsumed by the extension.
+     *
+     * @this {Bus}
+     * @param {number} addr is the starting physical address of the request
+     * @param {number} size of the request, in bytes
+     * @param {number} type is one of the Memory.TYPE constants
+     * @param {Object} [controller] is an optional memory controller component
+     * @return {boolean} true if successful, false if not
+     */
+    addMemory(addr, size, type, controller)
+    {
+        var addrNext = addr;
+        var sizeLeft = size;
+        var iBlock = addrNext >>> this.nBlockShift;
+
+        while (sizeLeft > 0 && iBlock < this.aMemBlocks.length) {
+
+            var block = this.aMemBlocks[iBlock];
+            var addrBlock = iBlock * this.nBlockSize;
+            var sizeBlock = this.nBlockSize - (addrNext - addrBlock);
+            if (sizeBlock > sizeLeft) sizeBlock = sizeLeft;
+
+            if (block && block.size) {
+                if (block.type == type && block.controller == controller) {
+                    /*
+                     * Where there is already a similar block with a non-zero size, we allow the allocation only if:
+                     *
+                     *   1) addrNext + sizeLeft <= block.addr (the request precedes the used portion of the current block), or
+                     *   2) addrNext >= block.addr + block.used (the request follows the used portion of the current block)
+                     */
+                    if (addrNext + sizeLeft <= block.addr) {
+                        block.used += (block.addr - addrNext);
+                        block.addr = addrNext;
+                        return true;
+                    }
+                    if (addrNext >= block.addr + block.used) {
+                        var sizeAvail = block.size - (addrNext - addrBlock);
+                        if (sizeAvail > sizeLeft) sizeAvail = sizeLeft;
+                        block.used = addrNext - block.addr + sizeAvail;
+                        addrNext = addrBlock + this.nBlockSize;
+                        sizeLeft -= sizeAvail;
+                        iBlock++;
+                        continue;
+                    }
+                }
+                return this.reportError(Bus.ERROR.ADD_MEM_INUSE, addrNext, sizeLeft);
+            }
+
+            var blockNew = new Memory(addrNext, sizeBlock, this.nBlockSize, type, controller);
+            blockNew.copyBreakpoints(this.dbg, block);
+            this.aMemBlocks[iBlock++] = blockNew;
+
+            addrNext = addrBlock + this.nBlockSize;
+            sizeLeft -= sizeBlock;
+        }
+        if (sizeLeft <= 0) {
+            /*
+             * If all addMemory() calls happened ONLY during device initialization, the following code would not
+             * be necessary; unfortunately, the Video component can add and remove physical memory blocks during video
+             * mode changes, so we have to kick out any PAGED blocks that could have references to those physical memory
+             * blocks.  If paging isn't enabled (or supported by the current the CPU), this call has no effect.
+             *
+             * We could handle this case with a little more, um, precision, but Video mode changes aren't frequent enough
+             * to warrant it.
+             */
+            this.cpu.flushPageBlocks();
+            if (!this.cpu.isRunning()) {        // allocation messages at "run time" are bit too much
+                this.status(Math.floor(size / 1024) + "Kb " + Memory.TYPE.NAMES[type] + " at " + Str.toHex(addr));
+            }
+            return true;
+        }
+        return this.reportError(Bus.ERROR.ADD_MEM_BADRANGE, addr, size);
+    }
+
+    /**
+     * cleanMemory(addr, size)
+     *
+     * @this {Bus}
+     * @param {number} addr
+     * @param {number} size
+     * @return {boolean} true if all blocks were clean, false if dirty; all blocks are cleaned in the process
+     */
+    cleanMemory(addr, size)
+    {
+        var fClean = true;
+        var iBlock = addr >>> this.nBlockShift;
+        while (size > 0 && iBlock < this.aMemBlocks.length) {
+            if (this.aMemBlocks[iBlock].fDirty) {
+                this.aMemBlocks[iBlock].fDirty = fClean = false;
+                this.aMemBlocks[iBlock].fDirtyEver = true;
+            }
+            size -= this.nBlockSize;
+            iBlock++;
+        }
+        return fClean;
+    }
+
+    /**
+     * scanMemory(info, addr, size)
+     *
+     * Returns a BusInfo object for the specified address range.
+     *
+     * @this {Bus}
+     * @param {Object} [info] previous BusInfo, if any
+     * @param {number} [addr] starting address of range (0 if none provided)
+     * @param {number} [size] size of range, in bytes (up to end of address space if none provided)
+     * @return {Object} updated info (or new info if no previous info provided)
+     */
+    scanMemory(info, addr, size)
+    {
+        if (addr == null) addr = 0;
+        if (size == null) size = (this.addrTotal - addr) | 0;
+        if (info == null) info = {cbTotal: 0, cBlocks: 0, aBlocks: []};
+
+        var iBlock = addr >>> this.nBlockShift;
+        var iBlockMax = ((addr + size - 1) >>> this.nBlockShift);
+
+        info.cbTotal = 0;
+        info.cBlocks = 0;
+        while (iBlock <= iBlockMax) {
+            var block = this.aMemBlocks[iBlock];
+            info.cbTotal += block.size;
+            if (block.size) {
+                var btmod = (BACKTRACK && block.modBackTrack(false)? 1 : 0);
+                info.aBlocks.push(Usr.initBitFields(Bus.BlockInfo, iBlock, 0, btmod, block.type));
+                info.cBlocks++
+            }
+            iBlock++;
+        }
+        return info;
+    }
+
+    /**
+     * getA20()
+     *
+     * @this {Bus}
+     * @return {boolean} true if enabled, false if disabled
+     */
+    getA20()
+    {
+        return !this.aBlocks2Mb && this.nBusLimit == this.nBusMask;
+    }
+
+    /**
+     * setA20(fEnable)
+     *
+     * On 32-bit bus machines, I've adopted the approach that COMPAQ took with DeskPro 386 machines,
+     * which is to map the 1st Mb to the 2nd Mb whenever A20 is disabled, rather than blindly masking
+     * the A20 address bit from all addresses; in fact, this is what the DeskPro 386 ROM BIOS requires.
+     *
+     * For 24-bit bus machines, we take the same approach that most if not all 80286 systems took, which
+     * is simply masking the A20 address bit.  A lot of 32-bit machines probably took the same approach.
+     *
+     * TODO: On machines with a 32-bit bus, look into whether we can eliminate address masking altogether,
+     * which seems feasible, provided all incoming addresses are already pre-truncated to 32 bits.  Also,
+     * confirm that DeskPro 386 machines mapped the ENTIRE 1st Mb to the 2nd, and not simply the first 64Kb,
+     * which is technically all that 8086 address wrap-around compatibility would require.
+     *
+     * @this {Bus}
+     * @param {boolean} fEnable is true to enable A20 (default), false to disable
+     */
+    setA20(fEnable)
+    {
+        if (this.nBusWidth == 32) {
+            if (fEnable) {
+                if (this.aBlocks2Mb) {
+                    this.setMemoryBlocks(0x100000, 0x100000, this.aBlocks2Mb);
+                    this.aBlocks2Mb = null;
+                }
+            } else {
+                if (!this.aBlocks2Mb) {
+                    this.aBlocks2Mb = this.getMemoryBlocks(0x100000, 0x100000);
+                    this.setMemoryBlocks(0x100000, 0x100000, this.getMemoryBlocks(0x0, 0x100000));
+                }
+            }
+        }
+        else if (this.nBusWidth > 20) {
+            var addrMask = (this.nBusMask & ~0x100000) | (fEnable? 0x100000 : 0);
+            if (addrMask != this.nBusMask) {
+                this.nBusMask = addrMask;
+                if (this.cpu) this.cpu.setAddressMask(addrMask);
+            }
+        }
+    }
+
+    /**
+     * getWidth()
+     *
+     * @this {Bus}
+     * @return {number}
+     */
+    getWidth()
+    {
+        return this.nBusWidth;
+    }
+
+    /**
+     * setMemoryAccess(addr, size, afn, fQuiet)
+     *
+     * Updates the access functions in every block of the specified address range.  Since the only components
+     * that should be dynamically modifying the memory access functions are those that use addMemory() with a custom
+     * memory controller, we require that the block(s) being updated do in fact have a controller.
+     *
+     * @this {Bus}
+     * @param {number} addr
+     * @param {number} size
+     * @param {Array.<function()>} [afn]
+     * @param {boolean} [fQuiet] (true if any error should be quietly logged)
+     * @return {boolean} true if successful, false if not
+     */
+    setMemoryAccess(addr, size, afn, fQuiet)
+    {
+        if (!(addr & this.nBlockLimit) && size && !(size & this.nBlockLimit)) {
+            var iBlock = addr >>> this.nBlockShift;
+            while (size > 0) {
+                var block = this.aMemBlocks[iBlock];
+                if (!block.controller) {
+                    return this.reportError(Bus.ERROR.SET_MEM_NOCTRL, addr, size, fQuiet);
+                }
+                block.setAccess(afn, true);
+                size -= this.nBlockSize;
+                iBlock++;
+            }
+            return true;
+        }
+        return this.reportError(Bus.ERROR.SET_MEM_BADRANGE, addr, size);
+    }
+
+    /**
+     * removeMemory(addr, size)
+     *
+     * Replaces every block in the specified address range with empty Memory blocks that ignore all reads/writes.
+     *
+     * TODO: Update the removeMemory() interface to reflect the relaxed requirements of the addMemory() interface.
+     *
+     * @this {Bus}
+     * @param {number} addr
+     * @param {number} size
+     * @return {boolean} true if successful, false if not
+     */
+    removeMemory(addr, size)
+    {
+        if (!(addr & this.nBlockLimit) && size && !(size & this.nBlockLimit)) {
+            var iBlock = addr >>> this.nBlockShift;
+            while (size > 0) {
+                var blockOld = this.aMemBlocks[iBlock];
+                var blockNew = new Memory(addr);
+                blockNew.copyBreakpoints(this.dbg, blockOld);
+                this.aMemBlocks[iBlock++] = blockNew;
+                addr = iBlock * this.nBlockSize;
+                size -= this.nBlockSize;
+            }
+            /*
+             * If all removeMemory() calls happened ONLY during device initialization, the following code would not
+             * be necessary; unfortunately, the Video component can add and remove physical memory blocks during video
+             * mode changes, so we have to kick out any PAGED blocks that could have references to those physical memory
+             * blocks.  If paging isn't enabled (or supported by the current the CPU), this call has no effect.
+             *
+             * We could handle this case with a little more, um, precision, but Video mode changes aren't frequent enough
+             * to warrant it.
+             */
+            this.cpu.flushPageBlocks();
+            return true;
+        }
+        return this.reportError(Bus.ERROR.REM_MEM_BADRANGE, addr, size);
+    }
+
+    /**
+     * getMemoryBlocks(addr, size)
+     *
+     * @this {Bus}
+     * @param {number} addr is the starting physical address
+     * @param {number} size of the request, in bytes
+     * @return {Array} of Memory blocks
+     */
+    getMemoryBlocks(addr, size)
+    {
+        var aBlocks = [];
+        var iBlock = addr >>> this.nBlockShift;
+        while (size > 0 && iBlock < this.aMemBlocks.length) {
+            aBlocks.push(this.aMemBlocks[iBlock++]);
+            size -= this.nBlockSize;
+        }
+        return aBlocks;
+    }
+
+    /**
+     * setMemoryBlocks(addr, size, aBlocks, type)
+     *
+     * If no type is specified, then specified address range uses all the provided blocks as-is;
+     * this form of setMemoryBlocks() is used for complete physical aliases.
+     *
+     * Otherwise, new blocks are allocated with the specified type; the underlying memory from the
+     * provided blocks is still used, but the new blocks may have different access to that memory.
+     *
+     * @this {Bus}
+     * @param {number} addr is the starting physical address
+     * @param {number} size of the request, in bytes
+     * @param {Array} aBlocks as returned by getMemoryBlocks()
+     * @param {number} [type] is one of the Memory.TYPE constants
+     */
+    setMemoryBlocks(addr, size, aBlocks, type)
+    {
+        var i = 0;
+        var iBlock = addr >>> this.nBlockShift;
+        while (size > 0 && iBlock < this.aMemBlocks.length) {
+            var block = aBlocks[i++];
+
+            if (!block) break;
+            if (type !== undefined) {
+                var blockNew = new Memory(addr);
+                blockNew.clone(block, type, this.dbg);
+                block = blockNew;
+            }
+            this.aMemBlocks[iBlock++] = block;
+            size -= this.nBlockSize;
+        }
+    }
+
+    /**
+     * getByte(addr)
+     *
+     * For physical addresses only; for linear addresses, use cpu.getByte().
+     *
+     * @this {Bus}
+     * @param {number} addr is a physical address
+     * @return {number} byte (8-bit) value at that address
+     */
+    getByte(addr)
+    {
+        return this.aMemBlocks[(addr & this.nBusMask) >>> this.nBlockShift].readByte(addr & this.nBlockLimit, addr);
+    }
+
+    /**
+     * getByteDirect(addr)
+     *
+     * This is useful for the Debugger and other components that want to bypass getByte() breakpoint detection.
+     *
+     * @this {Bus}
+     * @param {number} addr is a physical address
+     * @return {number} byte (8-bit) value at that address
+     */
+    getByteDirect(addr)
+    {
+        return this.aMemBlocks[(addr & this.nBusMask) >>> this.nBlockShift].readByteDirect(addr & this.nBlockLimit, addr);
+    }
+
+    /**
+     * getShort(addr)
+     *
+     * For physical addresses only; for linear addresses, use cpu.getShort().
+     *
+     * @this {Bus}
+     * @param {number} addr is a physical address
+     * @return {number} word (16-bit) value at that address
+     */
+    getShort(addr)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = (addr & this.nBusMask) >>> this.nBlockShift;
+        if (off != this.nBlockLimit) {
+            return this.aMemBlocks[iBlock].readShort(off, addr);
+        }
+        return this.aMemBlocks[iBlock++].readByte(off, addr) | (this.aMemBlocks[iBlock & this.nBlockMask].readByte(0, addr + 1) << 8);
+    }
+
+    /**
+     * getShortDirect(addr)
+     *
+     * This is useful for the Debugger and other components that want to bypass getShort() breakpoint detection.
+     *
+     * @this {Bus}
+     * @param {number} addr is a physical address
+     * @return {number} word (16-bit) value at that address
+     */
+    getShortDirect(addr)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = (addr & this.nBusMask) >>> this.nBlockShift;
+        if (off != this.nBlockLimit) {
+            return this.aMemBlocks[iBlock].readShortDirect(off, addr);
+        }
+        return this.aMemBlocks[iBlock++].readByteDirect(off, addr) | (this.aMemBlocks[iBlock & this.nBlockMask].readByteDirect(0, addr + 1) << 8);
+    }
+
+    /**
+     * getLong(addr)
+     *
+     * For physical addresses only; for linear addresses, use cpu.getLong().
+     *
+     * @this {Bus}
+     * @param {number} addr is a physical address
+     * @return {number} long (32-bit) value at that address
+     */
+    getLong(addr)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = (addr & this.nBusMask) >>> this.nBlockShift;
+        if (off < this.nBlockLimit - 2) {
+            return this.aMemBlocks[iBlock].readLong(off, addr);
+        }
+        /*
+         * I think the previous version of this function tried to be too clever (ie, reading the last
+         * long in the current block and the first long in the next block and masking/combining the results),
+         * which may have also created some undesirable side-effects for custom memory controllers.
+         * This simpler (and probably more reliable) approach is to simply read the long as individual bytes.
+         */
+        var l = 0;
+        var cb = 4, nShift = 0;
+        var cbBlock = 4 - (off & 0x3);    // (off & 0x3) will be 1, 2 or 3, so cbBlock will be 3, 2, or 1
+        while (cb--) {
+            l |= (this.aMemBlocks[iBlock].readByte(off++, addr++) << nShift);
+            if (!--cbBlock) {
+                iBlock = (iBlock + 1) & this.nBlockMask;
+                off = 0;
+            }
+            nShift += 8;
+        }
+        return l;
+    }
+
+    /**
+     * setByte(addr, b)
+     *
+     * For physical addresses only; for linear addresses, use cpu.setByte().
+     *
+     * @this {Bus}
+     * @param {number} addr is a physical address
+     * @param {number} b is the byte (8-bit) value to write (we truncate it to 8 bits to be safe)
+     */
+    setByte(addr, b)
+    {
+        this.aMemBlocks[(addr & this.nBusMask) >>> this.nBlockShift].writeByte(addr & this.nBlockLimit, b & 0xff, addr);
+    }
+
+    /**
+     * setByteDirect(addr, b)
+     *
+     * This is useful for the Debugger and other components that want to bypass breakpoint detection AND read-only
+     * memory protection (for example, this is an interface the ROM component could use to initialize ROM contents).
+     *
+     * @this {Bus}
+     * @param {number} addr is a physical address
+     * @param {number} b is the byte (8-bit) value to write (we truncate it to 8 bits to be safe)
+     */
+    setByteDirect(addr, b)
+    {
+        this.aMemBlocks[(addr & this.nBusMask) >>> this.nBlockShift].writeByteDirect(addr & this.nBlockLimit, b & 0xff, addr);
+    }
+
+    /**
+     * setShort(addr, w)
+     *
+     * For physical addresses only; for linear addresses, use cpu.setShort().
+     *
+     * @this {Bus}
+     * @param {number} addr is a physical address
+     * @param {number} w is the word (16-bit) value to write (we truncate it to 16 bits to be safe)
+     */
+    setShort(addr, w)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = (addr & this.nBusMask) >>> this.nBlockShift;
+        if (off != this.nBlockLimit) {
+            this.aMemBlocks[iBlock].writeShort(off, w & 0xffff, addr);
+            return;
+        }
+        this.aMemBlocks[iBlock++].writeByte(off, w & 0xff, addr);
+        this.aMemBlocks[iBlock & this.nBlockMask].writeByte(0, (w >> 8) & 0xff, addr + 1);
+    }
+
+    /**
+     * setShortDirect(addr, w)
+     *
+     * This is useful for the Debugger and other components that want to bypass breakpoint detection AND read-only
+     * memory protection (for example, this is an interface the ROM component could use to initialize ROM contents).
+     *
+     * @this {Bus}
+     * @param {number} addr is a physical address
+     * @param {number} w is the word (16-bit) value to write (we truncate it to 16 bits to be safe)
+     */
+    setShortDirect(addr, w)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = (addr & this.nBusMask) >>> this.nBlockShift;
+        if (off != this.nBlockLimit) {
+            this.aMemBlocks[iBlock].writeShortDirect(off, w & 0xffff, addr);
+            return;
+        }
+        this.aMemBlocks[iBlock++].writeByteDirect(off, w & 0xff, addr);
+        this.aMemBlocks[iBlock & this.nBlockMask].writeByteDirect(0, (w >> 8) & 0xff, addr + 1);
+    }
+
+    /**
+     * setLong(addr, l)
+     *
+     * For physical addresses only; for linear addresses, use cpu.setLong().
+     *
+     * @this {Bus}
+     * @param {number} addr is a physical address
+     * @param {number} l is the long (32-bit) value to write
+     */
+    setLong(addr, l)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = (addr & this.nBusMask) >>> this.nBlockShift;
+        if (off < this.nBlockLimit - 2) {
+            this.aMemBlocks[iBlock].writeLong(off, l);
+            return;
+        }
+        /*
+         * I think the previous version of this function tried to be too clever (ie, reading and rewriting
+         * the last long in the current block, and then reading and rewriting the first long in the next
+         * block), which may have also created some undesirable side-effects for custom memory controllers.
+         * This simpler (and probably more reliable) approach is to simply write the long as individual bytes.
+         */
+        var cb = 4;
+        var cbBlock = 4 - (off & 0x3);    // (off & 0x3) will be 1, 2 or 3, so cbBlock will be 3, 2, or 1
+        while (cb--) {
+            this.aMemBlocks[iBlock].writeByte(off++, l & 0xff, addr++);
+            if (!--cbBlock) {
+                iBlock = (iBlock + 1) & this.nBlockMask;
+                off = 0;
+            }
+            l >>>= 8;
+        }
+    }
+
+    /**
+     * addBackTrackObject(obj, bto, off)
+     *
+     * If bto is null, then we create bto (ie, an object that wraps obj and records off).
+     *
+     * If bto is NOT null, then we verify that off is within the given bto's range; if not,
+     * then we must create a new bto and return that instead.
+     *
+     * @this {Bus}
+     * @param {Object} obj
+     * @param {BackTrack|null} bto
+     * @param {number} off (the offset within obj that this wrapper object is relative to)
+     * @return {BackTrack|null}
+     */
+    addBackTrackObject(obj, bto, off)
+    {
+        if (BACKTRACK && obj) {
+            var cbtObjects = this.abtObjects.length;
+            if (!bto) {
+                /*
+                 * Try the most recently created bto, on the off-chance it's what the caller needs
+                 */
+                if (this.ibtLastAlloc >= 0) bto = this.abtObjects[this.ibtLastAlloc];
+            }
+            if (!bto || bto.obj != obj || off < bto.off || off >= bto.off + Bus.BTINFO.OFF_MAX) {
+
+                bto = {obj: obj, off: off, slot: 0, refs: 0};
+
+                var slot;
+                if (!this.cbtDeletions) {
+                    slot = cbtObjects;
+                } else {
+                    for (slot = this.ibtLastDelete; slot < cbtObjects; slot++) {
+                        var btoTest = this.abtObjects[slot];
+                        if (!btoTest || !btoTest.refs && !this.isBackTrackWeak(slot << Bus.BTINFO.SLOT_SHIFT)) {
+                            this.ibtLastDelete = slot + 1;
+                            this.cbtDeletions--;
+                            break;
+                        }
+                    }
+                    /*
+                     * There's no longer any guarantee that simply because cbtDeletions was non-zero that there WILL
+                     * be an available (existing) slot, because cbtDeletions also counts weak references that may still
+                     * be weak.
+                     *
+                     *
+                     */
+                }
+                /*
+                 *  I hit the following error after running in a machine with lots of disk activity:
+                 *
+                 *      Error: assertion failure in deskpro386.bus
+                 *      at Bus.Component.assert (http://pcjs:8088/modules/shared/lib/component.js:732:31)
+                 *      at Bus.addBackTrackObject (http://pcjs:8088/modules/pcx86/lib/bus.js:980:18)
+                 *      at onATCReadData (http://pcjs:8088/modules/pcx86/lib/hdc.js:1410:35)
+                 *      at HDC.readData (http://pcjs:8088/modules/pcx86/lib/hdc.js:2573:23)
+                 *      at HDC.inATCByte (http://pcjs:8088/modules/pcx86/lib/hdc.js:1398:20)
+                 *      at HDC.inATCData (http://pcjs:8088/modules/pcx86/lib/hdc.js:1487:17)
+                 *      at Bus.checkPortInputNotify (http://pcjs:8088/modules/pcx86/lib/bus.js:1457:38)
+                 *      at X86CPU.INSw (http://pcjs:8088/modules/pcx86/lib/x86ops.js:1640:26)
+                 *      at X86CPU.stepCPU (http://pcjs:8088/modules/pcx86/lib/x86cpu.js:4637:37)
+                 *      at X86CPU.CPU.runCPU (http://pcjs:8088/modules/pcx86/lib/cpu.js:1014:22)
+                 *
+                 * TODO: Investigate.  For now, BACKTRACK is completely disabled (in part because it also needs
+                 * to be revamped for machines with paging enabled).
+                 */
+
+                this.ibtLastAlloc = slot;
+                bto.slot = slot + 1;
+                if (slot == cbtObjects) {
+                    this.abtObjects.push(bto);
+                } else {
+                    this.abtObjects[slot] = bto;
+                }
+            }
+            return bto;
+        }
+        return null;
+    }
+
+    /**
+     * getBackTrackIndex(bto, off)
+     *
+     * @this {Bus}
+     * @param {BackTrack|null} bto
+     * @param {number} off
+     * @return {number}
+     */
+    getBackTrackIndex(bto, off)
+    {
+        var bti = 0;
+        if (BACKTRACK && bto) {
+            bti = (bto.slot << Bus.BTINFO.SLOT_SHIFT) | Bus.BTINFO.TYPE_DATA | (off - bto.off);
+        }
+        return bti;
+    }
+
+    /**
+     * writeBackTrackObject(addr, bto, off)
+     *
+     * @this {Bus}
+     * @param {number} addr is a physical address
+     * @param {BackTrack|null} bto
+     * @param {number} off
+     */
+    writeBackTrackObject(addr, bto, off)
+    {
+        if (BACKTRACK && bto) {
+
+            var bti = (bto.slot << Bus.BTINFO.SLOT_SHIFT) | Bus.BTINFO.TYPE_DATA | (off - bto.off);
+            this.writeBackTrack(addr, bti);
+        }
+    }
+
+    /**
+     * readBackTrack(addr)
+     *
+     * @this {Bus}
+     * @param {number} addr is a physical address
+     * @return {number}
+     */
+    readBackTrack(addr)
+    {
+        if (BACKTRACK) {
+            return this.aMemBlocks[(addr & this.nBusMask) >>> this.nBlockShift].readBackTrack(addr & this.nBlockLimit);
+        }
+        return 0;
+    }
+
+    /**
+     * writeBackTrack(addr, bti)
+     *
+     * @this {Bus}
+     * @param {number} addr is a physical address
+     * @param {number} bti
+     */
+    writeBackTrack(addr, bti)
+    {
+        if (BACKTRACK) {
+            var slot = bti >>> Bus.BTINFO.SLOT_SHIFT;
+            var iBlock = (addr & this.nBusMask) >>> this.nBlockShift;
+            var btiPrev = this.aMemBlocks[iBlock].writeBackTrack(addr & this.nBlockLimit, bti);
+            var slotPrev = btiPrev >>> Bus.BTINFO.SLOT_SHIFT;
+            if (slot != slotPrev) {
+                this.aMemBlocks[iBlock].modBackTrack(true);
+                if (btiPrev && slotPrev) {
+                    var btoPrev = this.abtObjects[slotPrev-1];
+                    if (!btoPrev) {
+                        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(Messages.WARN)) {
+                            this.dbg.message("writeBackTrack(%" + Str.toHex(addr) + ',' + Str.toHex(bti) + "): previous index (" + Str.toHex(btiPrev) + ") refers to empty slot (" + slotPrev + ")");
+                        }
+                    }
+                    else if (btoPrev.refs <= 0) {
+                        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(Messages.WARN)) {
+                            this.dbg.message("writeBackTrack(%" + Str.toHex(addr) + ',' + Str.toHex(bti) + "): previous index (" + Str.toHex(btiPrev) + ") refers to object with bad ref count (" + btoPrev.refs + ")");
+                        }
+                    } else if (!--btoPrev.refs) {
+                        /*
+                         * We used to just slam a null into the previous slot and consider it gone, but there may still
+                         * be "weak references" to that slot (ie, it may still be associated with a register bti).
+                         *
+                         * The easiest way to handle weak references is to leave the slot allocated, with the object's ref
+                         * count sitting at zero, and change addBackTrackObject() to look for both empty slots AND non-empty
+                         * slots with a ref count of zero; in the latter case, it should again check for weak references,
+                         * after which we can re-use the slot if all its weak references are now gone.
+                         */
+                        if (!this.isBackTrackWeak(btiPrev)) this.abtObjects[slotPrev-1] = null;
+                        /*
+                         * TODO: Consider what the appropriate trigger should be for resetting ibtLastDelete to zero;
+                         * if we don't OCCASIONALLY set it to zero, we may never clear out obsolete weak references,
+                         * whereas if we ALWAYS set it to zero, we may be forcing addBackTrackObject() to scan the entire
+                         * table too often.
+                         *
+                         * I'd prefer to do something like this:
+                         *
+                         *      if (this.ibtLastDelete > slotPrev-1) this.ibtLastDelete = slotPrev-1;
+                         *
+                         * or even this:
+                         *
+                         *      if (this.ibtLastDelete > slotPrev-1) this.ibtLastDelete = 0;
+                         *
+                         * But neither one of those guarantees that we will at least occasionally scan the entire table.
+                         */
+                        this.ibtLastDelete = 0;
+                        this.cbtDeletions++;
+                    }
+                }
+                if (bti && slot) {
+                    var bto = this.abtObjects[slot-1];
+                    if (bto) {
+
+                        bto.refs++;
+                    }
+                }
+            }
+        }
+    }
+
+    /**
+     * isBackTrackWeak(bti)
+     *
+     * @param {number} bti
+     * @returns {boolean} true if the given bti is still referenced by a register, false if not
+     */
+    isBackTrackWeak(bti)
+    {
+        var bt = this.cpu.backTrack;
+        var slot = bti >> Bus.BTINFO.SLOT_SHIFT;
+        return (bt.btiAL   >> Bus.BTINFO.SLOT_SHIFT == slot ||
+                bt.btiAH   >> Bus.BTINFO.SLOT_SHIFT == slot ||
+                bt.btiBL   >> Bus.BTINFO.SLOT_SHIFT == slot ||
+                bt.btiBH   >> Bus.BTINFO.SLOT_SHIFT == slot ||
+                bt.btiCL   >> Bus.BTINFO.SLOT_SHIFT == slot ||
+                bt.btiCH   >> Bus.BTINFO.SLOT_SHIFT == slot ||
+                bt.btiDL   >> Bus.BTINFO.SLOT_SHIFT == slot ||
+                bt.btiDH   >> Bus.BTINFO.SLOT_SHIFT == slot ||
+                bt.btiBPLo >> Bus.BTINFO.SLOT_SHIFT == slot ||
+                bt.btiBPHi >> Bus.BTINFO.SLOT_SHIFT == slot ||
+                bt.btiSILo >> Bus.BTINFO.SLOT_SHIFT == slot ||
+                bt.btiSIHi >> Bus.BTINFO.SLOT_SHIFT == slot ||
+                bt.btiDILo >> Bus.BTINFO.SLOT_SHIFT == slot ||
+                bt.btiDIHi >> Bus.BTINFO.SLOT_SHIFT == slot
+        );
+    }
+
+    /**
+     * updateBackTrackCode(addr, bti)
+     *
+     * @this {Bus}
+     * @param {number} addr is a physical address
+     * @param {number} bti
+     */
+    updateBackTrackCode(addr, bti)
+    {
+        if (BACKTRACK) {
+            if (bti & Bus.BTINFO.TYPE_DATA) {
+                bti = (bti & ~Bus.BTINFO.TYPE_MASK) | Bus.BTINFO.TYPE_COUNT_INC;
+            } else if ((bti & Bus.BTINFO.TYPE_MASK) < Bus.BTINFO.TYPE_COUNT_MAX) {
+                bti += Bus.BTINFO.TYPE_COUNT_INC;
+            } else {
+                return;
+            }
+            this.aMemBlocks[(addr & this.nBusMask) >>> this.nBlockShift].writeBackTrack(addr & this.nBlockLimit, bti);
+        }
+    }
+
+    /**
+     * getBackTrackObject(bti)
+     *
+     * @this {Bus}
+     * @param {number} bti
+     * @return {Object|null}
+     */
+    getBackTrackObject(bti)
+    {
+        if (BACKTRACK) {
+            var slot = bti >>> Bus.BTINFO.SLOT_SHIFT;
+            if (slot) return this.abtObjects[slot-1];
+        }
+        return null;
+    }
+
+    /**
+     * getBackTrackInfo(bti, fSymbol, fNearest)
+     *
+     * @this {Bus}
+     * @param {number} bti
+     * @param {boolean} [fSymbol] (true to return only symbol)
+     * @param {boolean} [fNearest] (true to return nearest symbol)
+     * @return {string|null}
+     */
+    getBackTrackInfo(bti, fSymbol, fNearest)
+    {
+        if (BACKTRACK) {
+            var bto = this.getBackTrackObject(bti);
+            if (bto) {
+                var off = bti & Bus.BTINFO.OFF_MASK;
+                var file = bto.obj.file;
+                if (file) {
+
+                    return file.getSymbol(bto.obj.offFile + off, fNearest);
+                }
+                if (!fSymbol || fNearest) {
+                    if (bto.obj.idComponent) {
+                        return bto.obj.idComponent + '+' + Str.toHexLong(bto.off + off);
+                    }
+                }
+            }
+        }
+        return null;
+    }
+
+    /**
+     * getSymbol(addr, fNearest)
+     *
+     * @this {Bus}
+     * @param {number} addr
+     * @param {boolean} [fNearest] (true to return nearest symbol)
+     * @return {string|null}
+     */
+    getSymbol(addr, fNearest)
+    {
+        return BACKTRACK? this.getBackTrackInfo(this.readBackTrack(addr), true, fNearest) : null;
+    }
+
+    /**
+     * saveMemory(fAll)
+     *
+     * The only memory blocks we save are those marked as dirty, but most likely all of RAM will have been marked dirty,
+     * and even if our dirty-memory flags were as smart as our dirty-sector flags (ie, were set only when a write changed
+     * what was already there), it's unlikely that would reduce the number of RAM blocks we must save/restore.  At least
+     * all the ROM blocks should be clean (except in the unlikely event that the Debugger was used to modify them).
+     *
+     * All dirty blocks will be stored in a single array, as pairs of block numbers and data arrays, like so:
+     *
+     *      [iBlock0, [dw0, dw1, ...], iBlock1, [dw0, dw1, ...], ...]
+     *
+     * In a normal 4Kb block, there will be 1K DWORD values in the data array.  Remember that each DWORD is a signed 32-bit
+     * integer (because they are formed using bitwise operator rather than floating-point math operators), so don't be
+     * surprised to see negative numbers in the data.
+     *
+     * The above example assumes "uncompressed" data arrays.  If we choose to use "compressed" data arrays, the data arrays
+     * will look like:
+     *
+     *      [count0, dw0, count1, dw1, ...]
+     *
+     * where each count indicates how many times the following DWORD value occurs.  A data array length less than 1K indicates
+     * that it's compressed, since we'll only store them in compressed form if they actually shrank, and we'll use State
+     * helper methods compress() and decompress() to create and expand the compressed data arrays.
+     *
+     * @this {Bus}
+     * @param {boolean} [fAll] (true to save all non-ROM memory blocks, regardless of their dirty flags)
+     * @return {Array} a
+     */
+    saveMemory(fAll)
+    {
+        var i = 0;
+        var a = [];
+
+        /*
+         * A quick-and-dirty work-around for 32-bit bus machines, to ensure that all blocks in the 2nd Mb are
+         * mapped in before we save.  We do this by forcing A20 on, and then turning it off again before we leave.
+         */
+        var fA20 = this.getA20();
+        if (!fA20) this.setA20(true);
+
+        for (var iBlock = 0; iBlock < this.nBlockTotal; iBlock++) {
+            var block = this.aMemBlocks[iBlock];
+            /*
+             * We have to check both fDirty and fDirtyEver, because we may have called cleanMemory() on some of
+             * the memory blocks (eg, video memory), and while cleanMemory() will clear a dirty block's fDirty flag,
+             * it also sets the dirty block's fDirtyEver flag, which is left set for the lifetime of the machine.
+             */
+            if (fAll && block.type != Memory.TYPE.ROM || block.fDirty || block.fDirtyEver) {
+                a[i++] = iBlock;
+                a[i++] = State.compress(block.save());
+            }
+        }
+
+        if (!fA20) this.setA20(false);
+        a[i] = fA20;
+
+        return a;
+    }
+
+    /**
+     * restoreMemory(a)
+     *
+     * This restores the contents of all Memory blocks; called by X86CPU.restore().
+     *
+     * In theory, we ONLY have to save/restore block contents.  Other block attributes,
+     * like the type, the memory controller (if any), and the active memory access functions,
+     * should already be restored, since every component (re)allocates all the memory blocks
+     * it was using when it's restored.  And since the CPU is guaranteed to be the last
+     * component to be restored, all those blocks (and their attributes) should be in place now.
+     *
+     * See saveMemory() for more information on how the memory block contents are saved.
+     *
+     * @this {Bus}
+     * @param {Array} a
+     * @return {boolean} true if successful, false if not
+     */
+    restoreMemory(a)
+    {
+        var i;
+        for (i = 0; i < a.length - 1; i += 2) {
+            var iBlock = a[i];
+            var adw = a[i+1];
+            if (adw && adw.length < this.nBlockLen) {
+                adw = State.decompress(adw, this.nBlockLen);
+            }
+            var block = this.aMemBlocks[iBlock];
+            if (!block || !block.restore(adw)) {
+                /*
+                 * Either the block to restore hasn't been allocated, indicating a change in the machine
+                 * configuration since it was last saved (the most likely explanation) or there's some internal
+                 * inconsistency (eg, the block size is wrong).
+                 */
+                Component.error("Unable to restore memory block " + iBlock);
+                return false;
+            }
+        }
+        if (a[i] !== undefined) this.setA20(a[i]);
+        return true;
+    }
+
+    /**
+     * addPortInputBreak(port)
+     *
+     * @this {Bus}
+     * @param {number|null} [port]
+     * @return {boolean} true if break on port input enabled, false if disabled
+     */
+    addPortInputBreak(port)
+    {
+        if (port == null) {
+            this.fPortInputBreakAll = !this.fPortInputBreakAll;
+            return this.fPortInputBreakAll;
+        }
+        if (this.aPortInputNotify[port] === undefined) {
+            this.aPortInputNotify[port] = [null, false];
+        }
+        this.aPortInputNotify[port][1] = !this.aPortInputNotify[port][1];
+        return this.aPortInputNotify[port][1];
+    }
+
+    /**
+     * addPortInputNotify(start, end, fn)
+     *
+     * Add a port input-notification handler to the list of such handlers.
+     *
+     * @this {Bus}
+     * @param {number} start port address
+     * @param {number} end port address
+     * @param {function(number,number)} fn is called with the port and LIP values at the time of the input
+     */
+    addPortInputNotify(start, end, fn)
+    {
+        if (fn !== undefined) {
+            for (var port = start; port <= end; port++) {
+                if (this.aPortInputNotify[port] !== undefined) {
+                    Component.warning("Input port " + Str.toHexWord(port) + " already registered");
+                    continue;
+                }
+                this.aPortInputNotify[port] = [fn, false];
+                if (MAXDEBUG) this.log("addPortInputNotify(" + Str.toHexWord(port) + ")");
+            }
+        }
+    }
+
+    /**
+     * addPortInputTable(component, table, offset)
+     *
+     * Add port input-notification handlers from the specified table (a batch version of addPortInputNotify)
+     *
+     * @this {Bus}
+     * @param {Component} component
+     * @param {Object} table
+     * @param {number} [offset] is an optional port offset
+     */
+    addPortInputTable(component, table, offset)
+    {
+        if (offset === undefined) offset = 0;
+        for (var port in table) {
+            this.addPortInputNotify(+port + offset, +port + offset, table[port].bind(component));
+        }
+    }
+
+    /**
+     * addPortInputWidth(port, size)
+     *
+     * By default, all input ports are 1 byte wide; ports that are wider must call this function.
+     *
+     * @this {Bus}
+     * @param {number} port
+     * @param {number} size (1, 2 or 4)
+     */
+    addPortInputWidth(port, size)
+    {
+        this.aPortInputWidth[port] = size;
+    }
+
+    /**
+     * checkPortInputNotify(port, size, addrLIP)
+     *
+     * @this {Bus}
+     * @param {number} port
+     * @param {number} size (1, 2 or 4)
+     * @param {number} [addrLIP] is the LIP value at the time of the input
+     * @return {number} simulated port data
+     *
+     * NOTE: It seems that parts of the ROM BIOS (like the RS-232 probes around F000:E5D7 in the 5150 BIOS)
+     * assume that ports for non-existent hardware return 0xff rather than 0x00, hence my new default (0xff) below.
+     */
+    checkPortInputNotify(port, size, addrLIP)
+    {
+        var data = 0, shift = 0;
+
+        while (size > 0) {
+
+            var aNotify = this.aPortInputNotify[port];
+            var sizePort = this.aPortInputWidth[port] || 1;
+            var maskPort = (sizePort == 1? 0xff : (sizePort == 2? 0xffff : -1));
+            var dataPort = maskPort;
+
+            /*
+             * TODO: We need to decide what to do about 8-bit I/O to a 16-bit port (ditto for 16-bit I/O
+             * to a 32-bit port).  We probably should pass the size through to the aNotify[0] handler,
+             * and let it decide what to do, but I don't feel like changing all the I/O handlers right now.
+             * The good news, at least, is that the 8-bit handlers would not have to do anything special.
+             * This assert will warn us if this is a pressing need.
+             */
+
+
+            if (BACKTRACK) {
+                this.cpu.backTrack.btiIO = 0;
+            }
+
+            if (aNotify !== undefined) {
+                if (aNotify[0]) {
+                    dataPort = aNotify[0](port, addrLIP);
+                    if (dataPort === undefined) {
+                        dataPort = maskPort;
+                    } else {
+                        dataPort &= maskPort;
+                    }
+                }
+                if (DEBUGGER && this.dbg && this.fPortInputBreakAll != aNotify[1]) {
+                    this.dbg.checkPortInput(port, size, dataPort);
+                }
+            }
+            else {
+                if (DEBUGGER && this.dbg) {
+                    this.dbg.messageIO(this, port, null, addrLIP);
+                    if (this.fPortInputBreakAll) this.dbg.checkPortInput(port, size, dataPort);
+                }
+            }
+
+            data |= dataPort << shift;
+            shift += (sizePort << 3);
+            port += sizePort;
+            size -= sizePort;
+        }
+
+
+        return data;
+    }
+
+    /**
+     * addPortOutputBreak(port)
+     *
+     * @this {Bus}
+     * @param {number|null} [port]
+     * @return {boolean} true if break on port output enabled, false if disabled
+     */
+    addPortOutputBreak(port)
+    {
+        if (port == null) {
+            this.fPortOutputBreakAll = !this.fPortOutputBreakAll;
+            return this.fPortOutputBreakAll;
+        }
+        if (this.aPortOutputNotify[port] === undefined) {
+            this.aPortOutputNotify[port] = [null, false];
+        }
+        this.aPortOutputNotify[port][1] = !this.aPortOutputNotify[port][1];
+        return this.aPortOutputNotify[port][1];
+    }
+
+    /**
+     * addPortOutputNotify(start, end, fn)
+     *
+     * Add a port output-notification handler to the list of such handlers.
+     *
+     * @this {Bus}
+     * @param {number} start port address
+     * @param {number} end port address
+     * @param {function(number,number)} fn is called with the port and LIP values at the time of the output
+     */
+    addPortOutputNotify(start, end, fn)
+    {
+        if (fn !== undefined) {
+            for (var port = start; port <= end; port++) {
+                if (this.aPortOutputNotify[port] !== undefined) {
+                    Component.warning("Output port " + Str.toHexWord(port) + " already registered");
+                    continue;
+                }
+                this.aPortOutputNotify[port] = [fn, false];
+                if (MAXDEBUG) this.log("addPortOutputNotify(" + Str.toHexWord(port) + ")");
+            }
+        }
+    }
+
+    /**
+     * addPortOutputTable(component, table, offset)
+     *
+     * Add port output-notification handlers from the specified table (a batch version of addPortOutputNotify)
+     *
+     * @this {Bus}
+     * @param {Component} component
+     * @param {Object} table
+     * @param {number} [offset] is an optional port offset
+     */
+    addPortOutputTable(component, table, offset)
+    {
+        if (offset === undefined) offset = 0;
+        for (var port in table) {
+            this.addPortOutputNotify(+port + offset, +port + offset, table[port].bind(component));
+        }
+    }
+
+    /**
+     * addPortOutputWidth(port, size)
+     *
+     * By default, all output ports are 1 byte wide; ports that are wider must call this function.
+     *
+     * @this {Bus}
+     * @param {number} port
+     * @param {number} size (1, 2 or 4)
+     */
+    addPortOutputWidth(port, size)
+    {
+        this.aPortOutputWidth[port] = size;
+    }
+
+    /**
+     * checkPortOutputNotify(port, size, data, addrLIP)
+     *
+     * @this {Bus}
+     * @param {number} port
+     * @param {number} size
+     * @param {number} data
+     * @param {number} [addrLIP] is the LIP value at the time of the output
+     */
+    checkPortOutputNotify(port, size, data, addrLIP)
+    {
+        var shift = 0;
+
+        while (size > 0) {
+
+            var aNotify = this.aPortOutputNotify[port];
+            var sizePort = this.aPortOutputWidth[port] || 1;
+            var maskPort = (sizePort == 1? 0xff : (sizePort == 2? 0xffff : -1));
+            var dataPort = (data >>>= shift) & maskPort;
+
+            /*
+             * TODO: We need to decide what to do about 8-bit I/O to a 16-bit port (ditto for 16-bit I/O
+             * to a 32-bit port).  We probably should pass the size through to the aNotify[0] handler,
+             * and let it decide what to do, but I don't feel like changing all the I/O handlers right now.
+             * The good news, at least, is that the 8-bit handlers would not have to do anything special.
+             * This assert will warn us if this is a pressing need.
+             */
+
+
+            if (aNotify !== undefined) {
+                if (aNotify[0]) {
+                    aNotify[0](port, dataPort, addrLIP);
+                }
+                if (DEBUGGER && this.dbg && this.fPortOutputBreakAll != aNotify[1]) {
+                    this.dbg.checkPortOutput(port, size, dataPort);
+                }
+            }
+            else {
+                if (DEBUGGER && this.dbg) {
+                    this.dbg.messageIO(this, port, dataPort, addrLIP);
+                    if (this.fPortOutputBreakAll) this.dbg.checkPortOutput(port, size, dataPort);
+                }
+            }
+
+            shift += (sizePort << 3);
+            port += sizePort;
+            size -= sizePort;
+        }
+
+    }
+
+    /**
+     * reportError(op, addr, size, fQuiet)
+     *
+     * @this {Bus}
+     * @param {number} op
+     * @param {number} addr
+     * @param {number} size
+     * @param {boolean} [fQuiet] (true if any error should be quietly logged)
+     * @return {boolean} false
+     */
+    reportError(op, addr, size, fQuiet)
+    {
+        var sError = "Memory block error (" + op + ": " + Str.toHex(addr) + "," + Str.toHex(size) + ")";
+        if (fQuiet) {
+            if (this.dbg) {
+                this.dbg.message(sError);
+            } else {
+                this.log(sError);
+            }
+        } else {
+            Component.error(sError);
+        }
+        return false;
+    }
+
+    /**
+     * getLongDirect(addr)
+     *
+     * This is useful for the Debugger and other components that want to bypass getLong() breakpoint detection.
+     *
+     * @this {Bus}
+     * @param {number} addr is a physical address
+     * @return {number} long (32-bit) value at that address
+     *
+     getLongDirect(addr)
+     {
+         var off = addr & this.nBlockLimit;
+         var iBlock = (addr & this.nBusMask) >>> this.nBlockShift;
+         if (off < this.nBlockLimit - 2) {
+             return this.aMemBlocks[iBlock].readLongDirect(off, addr);
+         }
+         //
+         // I think the previous version of this function tried to be too clever (ie, reading the last
+         // long in the current block and the first long in the next block and masking/combining the results),
+         // which may have also created some undesirable side-effects for custom memory controllers.
+         // This simpler (and probably more reliable) approach is to simply read the long as individual bytes.
+         //
+         var l = 0;
+         var cb = 4, nShift = 0;
+         var cbBlock = 4 - (off & 0x3);    // (off & 0x3) will be 1, 2 or 3, so cbBlock will be 3, 2, or 1
+         while (cb--) {
+             l |= (this.aMemBlocks[iBlock].readByteDirect(off++, addr++) << nShift);
+             if (!--cbBlock) {
+                 iBlock = (iBlock + 1) & this.nBlockMask;
+                 off = 0;
+             }
+             nShift += 8;
+         }
+         return l;
+     }
+     */
+
+    /**
+     * setLongDirect(addr, l)
+     *
+     * This is useful for the Debugger and other components that want to bypass breakpoint detection AND read-only
+     * memory protection (for example, this is an interface the ROM component could use to initialize ROM contents).
+     *
+     * @this {Bus}
+     * @param {number} addr is a physical address
+     * @param {number} l is the long (32-bit) value to write
+     *
+     setLongDirect(addr, l)
+     {
+         var off = addr & this.nBlockLimit;
+         var iBlock = (addr & this.nBusMask) >>> this.nBlockShift;
+         if (off < this.nBlockLimit - 2) {
+             this.aMemBlocks[iBlock].writeLongDirect(off, l, addr);
+             return;
+         }
+         //
+         // I think the previous version of this function tried to be too clever (ie, reading and rewriting
+         // the last long in the current block, and then reading and rewriting the first long in the next
+         // block), which may have also created some undesirable side-effects for custom memory controllers.
+         // This simpler (and probably more reliable) approach is to simply write the long as individual bytes.
+         //
+         var cb = 4;
+         var cbBlock = 4 - (off & 0x3);    // (off & 0x3) will be 1, 2 or 3, so cbBlock will be 3, 2, or 1
+         while (cb--) {
+             this.aMemBlocks[iBlock].writeByteDirect(off++, l & 0xff, addr++);
+             if (!--cbBlock) {
+                 iBlock = (iBlock + 1) & this.nBlockMask;
+                 off = 0;
+             }
+             l >>>= 8;
+         }
+     }
+     */
+
+    /**
+     * getBackTrackObjectFromAddr(addr)
+     *
+     * @this {Bus}
+     * @param {number} addr
+     * @return {Object|null}
+     *
+     getBackTrackObjectFromAddr(addr)
+     {
+         return BACKTRACK? this.getBackTrackObject(this.readBackTrack(addr)) : null;
+     }
+     */
+
+    /**
+     * getBackTrackInfoFromAddr(addr)
+     *
+     * @this {Bus}
+     * @param {number} addr
+     * @return {string|null}
+     *
+     getBackTrackInfoFromAddr(addr)
+     {
+         return BACKTRACK? this.getBackTrackInfo(this.readBackTrack(addr)) : null;
+     }
+     */
+
+    /**
+     * removePortInputNotify(start, end)
+     *
+     * Remove port input-notification handler(s) (to be ENABLED later if needed)
+     *
+     * @this {Bus}
+     * @param {number} start address
+     * @param {number} end address
+     *
+     removePortInputNotify(start, end)
+     {
+         for (var port = start; port < end; port++) {
+             if (this.aPortInputNotify[port]) {
+                 delete this.aPortInputNotify[port];
+             }
+         }
+     }
+     */
+
+    /**
+     * removePortOutputNotify(start, end)
+     *
+     * Remove port output-notification handler(s) (to be ENABLED later if needed)
+     *
+     * @this {Bus}
+     * @param {number} start address
+     * @param {number} end address
+     *
+     removePortOutputNotify(start, end)
+     {
+         for (var port = start; port < end; port++) {
+             if (this.aPortOutputNotify[port]) {
+                 delete this.aPortOutputNotify[port];
+             }
+         }
+     }
+     */
+}
+
+/*
+ * Data types used by scanMemory()
+ */
+
+/**
+ * @typedef {number}
+ */
+var BlockInfo;
+
+/**
+ * This defines the BlockInfo bit fields used by scanMemory() when it creates the aBlocks array.
+ *
+ * @typedef {{
+ *  num:    BitField,
+ *  count:  BitField,
+ *  btmod:  BitField,
+ *  type:   BitField
+ * }}
+ */
+Bus.BlockInfo = Usr.defineBitFields({num:20, count:8, btmod:1, type:3});
+
+/**
+ * BusInfo object definition (returned by scanMemory())
+ *
+ *  cbTotal:    total bytes allocated
+ *  cBlocks:    total Memory blocks allocated
+ *  aBlocks:    array of allocated Memory block numbers
+ *
+ * @typedef {{
+ *  cbTotal:    number,
+ *  cBlocks:    number,
+ *  aBlocks:    Array.<BlockInfo>
+ * }}
+ */
+var BusInfo;
+
+if (BACKTRACK) {
+    /**
+     * BackTrack object definition
+     *
+     *  obj:        reference to the source object (eg, ROM object, Sector object)
+     *  off:        the offset within the source object that this object refers to
+     *  slot:       the slot (+1) in abtObjects which this object currently occupies
+     *  refs:       the number of memory references, as recorded by writeBackTrack()
+     *
+     * @typedef {{
+     *  obj:        Object,
+     *  off:        number,
+     *  slot:       number,
+     *  refs:       number
+     * }}
+     */
+    var BackTrack;
+
+    /*
+     * BackTrack indexes are 31-bit values, where bits 0-8 store an object offset (0-511) and bits 16-30 store
+     * an object number (1-32767).  Object number 0 is reserved for dynamic data (ie, data created independent
+     * of any source); examples include zero values produced by instructions such as "SUB AX,AX" or "XOR AX,AX".
+     * We must special-case instructions like that, because even though AX will almost certainly contain some source
+     * data prior to the instruction, the result no longer has any connection to the source.  Similarly, "SBB AX,AX"
+     * may produce 0 or -1, depending on carry, but since we don't track the source of individual bits (including the
+     * carry flag), AX is now source-less.  TODO: This is an argument for maintaining source info on selected flags,
+     * even though it would be rather expensive.
+     *
+     * The 7 middle bits (9-15) record type and access information, as follows:
+     *
+     *      bit 15: set to indicate a "data" byte, clear to indicate a "code" byte
+     *
+     * All bytes start out as "data" bytes; only once they've been executed do they become "code" bytes.  For code
+     * bytes, the remaining 6 middle bits (9-14) represent an execution count that starts at 1 (on the byte's initial
+     * transition from data to code) and tops out at 63.
+     *
+     * For data bytes, the remaining middle bits indicate any transformations the data has undergone; eg:
+     *
+     *      bit 14: ADD/SUB/INC/DEC
+     *      bit 13: MUL/DIV
+     *      bit 12: OR/AND/XOR/NOT
+     *
+     * We make no attempt to record the original data or the transformation data, only that the transformation occurred.
+     *
+     * Other middle bits indicate whether the data was ever read and/or written:
+     *
+     *      bit 11: READ
+     *      bit 10: WRITE
+     *
+     * Bit 9 is reserved for now.
+     */
+    Bus.BTINFO = {
+        SLOT_MAX:       32768,
+        SLOT_SHIFT:     16,
+        TYPE_DATA:      0x8000,
+        TYPE_ADDSUB:    0x4000,
+        TYPE_MULDIV:    0x2000,
+        TYPE_LOGICAL:   0x1000,
+        TYPE_READ:      0x0800,
+        TYPE_WRITE:     0x0400,
+        TYPE_COUNT_INC: 0x0200,
+        TYPE_COUNT_MAX: 0x7E00,
+        TYPE_MASK:      0xFE00,
+        TYPE_SHIFT:     9,
+        OFF_MAX:        512,
+        OFF_MASK:       0x1FF
+    };
+}
+
+Bus.ERROR = {
+    ADD_MEM_INUSE:      1,
+    ADD_MEM_BADRANGE:   2,
+    SET_MEM_NOCTRL:     3,
+    SET_MEM_BADRANGE:   4,
+    REM_MEM_BADRANGE:   5
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/memory.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * @class DataView
+ * @property {function(number,boolean):number} getUint8
+ * @property {function(number,number,boolean)} setUint8
+ * @property {function(number,boolean):number} getUint16
+ * @property {function(number,number,boolean)} setUint16
+ * @property {function(number,boolean):number} getInt32
+ * @property {function(number,number,boolean)} setInt32
+ */
+
+var littleEndian = (TYPEDARRAYS? (function() {
+    var buffer = new ArrayBuffer(2);
+    new DataView(buffer).setUint16(0, 256, true);
+    return new Uint16Array(buffer)[0] === 256;
+})() : false);
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class Memory {
+    /**
+     * Memory(addr, used, size, type, controller)
+     *
+     * The Bus component allocates Memory objects so that each has a memory buffer with a
+     * block-granular starting address and an address range equal to bus.nBlockSize; however,
+     * the size of any given Memory object's underlying buffer can be either zero or bus.nBlockSize;
+     * memory read/write functions for empty (buffer-less) blocks are mapped to readNone/writeNone.
+     *
+     * The Bus allocates empty blocks for the entire address space during initialization, so that
+     * any reads/writes to undefined addresses will have no effect.  Later, the ROM and RAM
+     * components will ask the Bus to allocate memory for specific ranges, and the Bus will allocate
+     * as many new blockSize Memory objects as the ranges require.  Partial Memory blocks could
+     * also be supported in theory, but in practice, they're not.
+     *
+     * Because Memory blocks now allow us to have a "sparse" address space, we could choose to
+     * take the memory hit of allocating 4K arrays per block, where each element stores only one byte,
+     * instead of the more frugal but slightly slower approach of allocating arrays of 32-bit dwords
+     * (LONGARRAYS) and shifting/masking bytes/words to/from dwords; in theory, byte accesses would
+     * be faster and word accesses somewhat less faster.
+     *
+     * However, preliminary testing of that feature (BYTEARRAYS) did not yield significantly faster
+     * performance, so it is OFF by default to minimize our memory consumption.  Using TYPEDARRAYS
+     * would seem best, but as discussed in defines.js, it's off by default, because it doesn't perform
+     * as well as LONGARRAYS; the other advantage of TYPEDARRAYS is that it should theoretically use
+     * about 1/2 the memory of LONGARRAYS (32-bit elements vs 64-bit numbers), but I value speed over
+     * size at this point.  Also, not all JavaScript implementations support TYPEDARRAYS (IE9 is probably
+     * the only real outlier: it lacks typed arrays but otherwise has all the necessary HTML5 support).
+     *
+     * WARNING: Since Memory blocks are low-level objects that have no UI requirements, they
+     * do not inherit from the Component class, so if you want to use any Component class methods,
+     * such as Component.assert(), use the corresponding Debugger methods instead (assuming a debugger
+     * is available).
+     *
+     * @this {Memory}
+     * @param {number|null} [addr] of lowest used address in block
+     * @param {number} [used] portion of block in bytes (0 for none); must be a multiple of 4
+     * @param {number} [size] of block's buffer in bytes (0 for none); must be a multiple of 4
+     * @param {number} [type] is one of the Memory.TYPE constants (default is Memory.TYPE.NONE)
+     * @param {Object} [controller] is an optional memory controller component
+     * @param {X86CPU} [cpu] is required for UNPAGED memory blocks, so that the CPU can map it to a PAGED block
+     */
+    constructor(addr, used, size, type, controller, cpu)
+    {
+        var i;
+        this.id = (Memory.idBlock += 2);
+        this.adw = null;
+        this.offset = 0;
+        this.addr = addr;
+        this.used = used;
+        this.size = size || 0;
+        this.type = type || Memory.TYPE.NONE;
+        this.fReadOnly = (type == Memory.TYPE.ROM);
+        this.controller = null;
+        this.cpu = cpu;             // if a CPU reference is provided, then this must be an UNPAGED Memory block allocation
+        this.copyBreakpoints();     // initialize the block's Debugger info (eg, breakpoint totals); the caller will reinitialize
+
+        /*
+         * TODO: Study the impact of dirty block tracking.  As noted in the paged block handlers (eg, writeBytePLE),
+         * the original purposes were to allow saveMemory() to save only dirty blocks, and to enable the Video component
+         * to quickly detect changes to the video buffer.  But the benefit to saveMemory() is minimal, and the Video
+         * component has other options; for example, it now uses a custom memory controller for all EGA/VGA video modes,
+         * which performs its own dirty block tracking, and that could easily be extended to the older MDA/CGA video modes,
+         * which still use conventional memory blocks.  Alternatively, we could restrict the use of dirty block tracking
+         * to certain memory types (eg, VIDEO memory).
+         *
+         * However, a quick test with dirty block tracking disabled didn't yield a noticeable improvement in performance,
+         * so I think the overhead of our block-based architecture is swamping the impact of these micro-updates.
+         */
+        this.fDirty = this.fDirtyEver = false;
+
+        if (BACKTRACK) {
+            if (!size || controller) {
+                this.fModBackTrack = false;
+                this.readBackTrack = this.readBackTrackNone;
+                this.writeBackTrack = this.writeBackTrackNone;
+                this.modBackTrack = this.modBackTrackNone;
+            } else {
+                this.fModBackTrack = true;
+                this.readBackTrack = this.readBackTrackIndex;
+                this.writeBackTrack = this.writeBackTrackIndex;
+                this.modBackTrack = this.modBackTrackIndex;
+                this.abtIndexes = new Array(size);
+                for (i = 0; i < size; i++) this.abtIndexes[i] = 0;
+            }
+        }
+
+        /*
+         * For empty memory blocks, all we need to do is ensure all access functions
+         * are mapped to "none" handlers (or "unpaged" handlers if paging is enabled).
+         */
+        if (!size) {
+            this.setAccess();
+            return;
+        }
+
+        /*
+         * When a controller is specified, the controller must provide a buffer,
+         * via getMemoryBuffer(), and memory access functions, via getMemoryAccess().
+         */
+        if (controller) {
+            this.controller = controller;
+            var a = controller.getMemoryBuffer(addr);
+            this.adw = a[0];
+            this.offset = a[1];
+            this.setAccess(controller.getMemoryAccess());
+            return;
+        }
+
+        /*
+         * This is the normal case: allocate a buffer that provides 8 bits of data per address;
+         * no controller is required because our default memory access functions (see afnMemory)
+         * know how to deal with this simple 1-1 mapping of addresses to bytes and words.
+         *
+         * TODO: Consider initializing the memory array to random (or pseudo-random) values in DEBUG
+         * mode; pseudo-random might be best, to help make any bugs reproducible.
+         */
+        if (TYPEDARRAYS) {
+            this.buffer = new ArrayBuffer(size);
+            this.dv = new DataView(this.buffer, 0, size);
+            /*
+             * If littleEndian is true, we can use ab[], aw[] and adw[] directly; well, we can use them
+             * whenever the offset is a multiple of 1, 2 or 4, respectively.  Otherwise, we must fallback to
+             * dv.getUint8()/dv.setUint8(), dv.getUint16()/dv.setUint16() and dv.getInt32()/dv.setInt32().
+             */
+            this.ab = new Uint8Array(this.buffer, 0, size);
+            this.aw = new Uint16Array(this.buffer, 0, size >> 1);
+            this.adw = new Int32Array(this.buffer, 0, size >> 2);
+            this.setAccess(littleEndian? Memory.afnArrayLE : Memory.afnArrayBE);
+        } else {
+            if (BYTEARRAYS) {
+                this.ab = new Array(size);
+            } else {
+                /*
+                 * NOTE: This is the default mode of operation (!TYPEDARRAYS && !BYTEARRAYS), because it
+                 * seems to provide the best performance; and although in theory, that performance might
+                 * come at twice the overhead of TYPEDARRAYS, it's increasingly likely that the JavaScript
+                 * runtime will notice that all we ever store are 32-bit values, and optimize accordingly.
+                 */
+                this.adw = new Array(size >> 2);
+                for (i = 0; i < this.adw.length; i++) this.adw[i] = 0;
+            }
+            this.setAccess(Memory.afnMemory);
+        }
+    }
+
+    /**
+     * init(addr)
+     *
+     * Quick reinitializer when reusing a Memory block.
+     *
+     * @this {Memory}
+     * @param {number} addr
+     */
+    init(addr)
+    {
+        this.addr = addr;
+    }
+
+    /**
+     * clone(mem, type)
+     *
+     * Converts the current Memory block (this) into a clone of the given Memory block (mem),
+     * and optionally overrides the current block's type with the specified type.
+     *
+     * @this {Memory}
+     * @param {Memory} mem
+     * @param {number} [type]
+     * @param {DebuggerX86} [dbg]
+     */
+    clone(mem, type, dbg)
+    {
+        /*
+         * Original memory block IDs are even; cloned memory block IDs are odd;
+         * the original ID of the current block is lost, but that's OK, since it was presumably
+         * produced merely to become a clone.
+         */
+        this.id = mem.id | 0x1;
+        this.used = mem.used;
+        this.size = mem.size;
+        if (type) {
+            this.type = type;
+            this.fReadOnly = (type == Memory.TYPE.ROM);
+        }
+        if (TYPEDARRAYS) {
+            this.buffer = mem.buffer;
+            this.dv = mem.dv;
+            this.ab = mem.ab;
+            this.aw = mem.aw;
+            this.adw = mem.adw;
+            this.setAccess(littleEndian? Memory.afnArrayLE : Memory.afnArrayBE);
+        } else {
+            if (BYTEARRAYS) {
+                this.ab = mem.ab;
+            } else {
+                this.adw = mem.adw;
+            }
+            this.setAccess(Memory.afnMemory);
+        }
+        this.copyBreakpoints(dbg, mem);
+    }
+
+    /**
+     * save()
+     *
+     * This gets the contents of a Memory block as an array of 32-bit values; used by Bus.saveMemory(),
+     * which in turn is called by X86CPU.save().
+     *
+     * Memory blocks with custom memory controllers do NOT save their contents; that's the responsibility
+     * of the controller component.
+     *
+     * @this {Memory}
+     * @return {Array|Int32Array|null}
+     */
+    save()
+    {
+        var adw, i;
+        if (this.controller) {
+            adw = null;
+        }
+        else if (BYTEARRAYS) {
+            adw = new Array(this.size >> 2);
+            var off = 0;
+            for (i = 0; i < adw.length; i++) {
+                adw[i] = this.ab[off] | (this.ab[off + 1] << 8) | (this.ab[off + 2] << 16) | (this.ab[off + 3] << 24);
+                off += 4;
+            }
+        }
+        else if (TYPEDARRAYS) {
+            /*
+             * It might be tempting to just return a copy of Int32Array(this.buffer, 0, this.size >> 2),
+             * but we can't be sure of the "endianness" of an Int32Array -- which would be OK if the array
+             * was always saved/restored on the same machine, but there's no guarantee of that, either.
+             * So we use getInt32() and require little-endian values.
+             *
+             * Moreover, an Int32Array isn't treated by JSON.stringify() and JSON.parse() exactly like
+             * a normal array; it's serialized as an Object rather than an Array, so it lacks a "length"
+             * property and causes problems for State.store() and State.parse().
+             */
+            adw = new Array(this.size >> 2);
+            for (i = 0; i < adw.length; i++) {
+                adw[i] = this.dv.getInt32(i << 2, true);
+            }
+        }
+        else {
+            adw = this.adw;
+        }
+        return adw;
+    }
+
+    /**
+     * restore(adw)
+     *
+     * This restores the contents of a Memory block from an array of 32-bit values;
+     * used by Bus.restoreMemory(), which is called by X86CPU.restore(), after all other
+     * components have been restored and thus all Memory blocks have been allocated
+     * by their respective components.
+     *
+     * @this {Memory}
+     * @param {Array|null} adw
+     * @return {boolean} true if successful, false if block size mismatch
+     */
+    restore(adw)
+    {
+        if (this.controller) {
+            return (adw == null);
+        }
+        /*
+         * At this point, it's a consistency error for adw to be null; it's happened once already,
+         * when there was a restore bug in the Video component that added the frame buffer at the video
+         * card's "spec'ed" address instead of the programmed address, so there were no controller-owned
+         * memory blocks installed at the programmed address, and so we arrived here at a block with
+         * no controller AND no data.
+         */
+
+
+        if (adw && this.size == adw.length << 2) {
+            var i;
+            if (BYTEARRAYS) {
+                var off = 0;
+                for (i = 0; i < adw.length; i++) {
+                    this.ab[off] = adw[i] & 0xff;
+                    this.ab[off + 1] = (adw[i] >> 8) & 0xff;
+                    this.ab[off + 2] = (adw[i] >> 16) & 0xff;
+                    this.ab[off + 3] = (adw[i] >> 24) & 0xff;
+                    off += 4;
+                }
+            } else if (TYPEDARRAYS) {
+                for (i = 0; i < adw.length; i++) {
+                    this.dv.setInt32(i << 2, adw[i], true);
+                }
+            } else {
+                this.adw = adw;
+            }
+            this.fDirty = true;
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * setAccess(afn, fDirect)
+     *
+     * The afn parameter should be a 6-entry function table containing two byte handlers, two
+     * short handlers, and two long handlers.  See the static afnMemory table for an example.
+     *
+     * If no function table is specified, a default is selected based on the Memory type;
+     * similarly, any undefined entries in the table are filled with default handlers that fall
+     * back to the byte handlers, and if one or both byte handlers are undefined, they default
+     * to handlers that simply ignore the access.
+     *
+     * fDirect indicates that both the default AND the direct handlers should be updated.  Direct
+     * handlers normally match the default handlers, except when "checked" handlers are installed;
+     * this allows "checked" handlers to know where to dispatch the call after performing checks.
+     * Examples of checks are read/write breakpoints, but it's really up to the Debugger to decide
+     * what the check consists of.
+     *
+     * @this {Memory}
+     * @param {Array.<function()>} [afn] function table
+     * @param {boolean} [fDirect] (true to update direct access functions as well; default is true)
+     */
+    setAccess(afn, fDirect)
+    {
+        if (!afn) {
+            if (this.type == Memory.TYPE.UNPAGED) {
+                afn = Memory.afnUnpaged;
+            }
+            else if (this.type == Memory.TYPE.PAGED) {
+                afn = Memory.afnPaged;
+            } else {
+
+                afn = Memory.afnNone;
+            }
+        }
+        this.setReadAccess(afn, fDirect);
+        this.setWriteAccess(afn, fDirect);
+    }
+
+    /**
+     * setReadAccess(afn, fDirect)
+     *
+     * @this {Memory}
+     * @param {Array.<function()>} afn
+     * @param {boolean} [fDirect]
+     */
+    setReadAccess(afn, fDirect)
+    {
+        if (!fDirect || !this.cReadBreakpoints) {
+            this.readByte = afn[0] || this.readNone;
+            this.readShort = afn[2] || this.readShortDefault;
+            this.readLong = afn[4] || this.readLongDefault;
+        }
+        if (fDirect || fDirect === undefined) {
+            this.readByteDirect = afn[0] || this.readNone;
+            this.readShortDirect = afn[2] || this.readShortDefault;
+            this.readLongDirect = afn[4] || this.readLongDefault;
+        }
+    }
+
+    /**
+     * setWriteAccess(afn, fDirect)
+     *
+     * @this {Memory}
+     * @param {Array.<function()>} afn
+     * @param {boolean} [fDirect]
+     */
+    setWriteAccess(afn, fDirect)
+    {
+        if (!fDirect || !this.cWriteBreakpoints) {
+            this.writeByte = !this.fReadOnly && afn[1] || this.writeNone;
+            this.writeShort = !this.fReadOnly && afn[3] || this.writeShortDefault;
+            this.writeLong = !this.fReadOnly && afn[5] || this.writeLongDefault;
+        }
+        if (fDirect || fDirect === undefined) {
+            this.writeByteDirect = afn[1] || this.writeNone;
+            this.writeShortDirect = afn[3] || this.writeShortDefault;
+            this.writeLongDirect = afn[5] || this.writeLongDefault;
+        }
+    }
+
+    /**
+     * resetReadAccess()
+     *
+     * @this {Memory}
+     */
+    resetReadAccess()
+    {
+        this.readByte = this.readByteDirect;
+        this.readShort = this.readShortDirect;
+        this.readLong = this.readLongDirect;
+    }
+
+    /**
+     * resetWriteAccess()
+     *
+     * @this {Memory}
+     */
+    resetWriteAccess()
+    {
+        this.writeByte = this.fReadOnly? this.writeNone : this.writeByteDirect;
+        this.writeShort = this.fReadOnly? this.writeShortDefault : this.writeShortDirect;
+        this.writeLong = this.fReadOnly? this.writeLongDefault : this.writeLongDirect;
+    }
+
+    /**
+     * getPageBlock(addr, fWrite)
+     *
+     * Called for UNPAGED Memory blocks only.
+     *
+     * @this {Memory}
+     * @param {number} addr
+     * @param {boolean} fWrite (true if called for a write, false if for a read)
+     * @return {Memory}
+     */
+    getPageBlock(addr, fWrite)
+    {
+        /*
+         * Even when mapPageBlock() fails (ie, when the page is not present or has insufficient privileges), it
+         * will trigger a fault (since we don't set fSuppress), but it will still return a block (ie, an empty block).
+         */
+        return this.cpu.mapPageBlock(addr, fWrite);
+    }
+
+    /**
+     * setPhysBlock(blockPhys, blockPDE, offPDE, blockPTE, offPTE)
+     *
+     * @this {Memory}
+     * @param {Memory} blockPhys
+     * @param {Memory} blockPDE
+     * @param {number} offPDE
+     * @param {Memory} blockPTE
+     * @param {number} offPTE
+     */
+    setPhysBlock(blockPhys, blockPDE, offPDE, blockPTE, offPTE)
+    {
+        this.blockPhys = blockPhys;
+        this.blockPDE = blockPDE;
+        this.iPDE = offPDE >> 2;    // convert offPDE into iPDE (an adw index)
+        this.blockPTE = blockPTE;
+        this.iPTE = offPTE >> 2;    // convert offPTE into iPTE (an adw index)
+        /*
+         * This is an optimization for "normal" pages, installing paged memory handlers that mimic
+         * normal memory but also know how to update page tables.  If any of the criteria are not met
+         * for these special handlers, we fall back to the slower default "paged" memory handlers.
+         */
+        if (TYPEDARRAYS && littleEndian && blockPhys.adw && !blockPhys.controller && !blockPhys.cReadBreakpoints && !blockPhys.cWriteBreakpoints) {
+            this.ab = blockPhys.ab;
+            this.aw = blockPhys.aw;
+            this.adw = blockPhys.adw;
+            this.setAccess(Memory.afnPagedLE);
+        } else {
+            this.bitPTEAccessed = blockPhys? Memory.adjustEndian(X86.PTE.ACCESSED) : 0;
+            this.bitPTEDirty = blockPhys? Memory.adjustEndian(X86.PTE.ACCESSED | X86.PTE.DIRTY) : 0;
+            this.setAccess(Memory.afnPaged);
+        }
+    }
+
+    /**
+     * printAddr(sMessage)
+     *
+     * @this {Memory}
+     * @param {string} sMessage
+     */
+    printAddr(sMessage)
+    {
+        if (DEBUG && this.dbg && this.dbg.messageEnabled(Messages.MEM)) {
+            this.dbg.printMessage(sMessage + ' ' + (this.addr != null? ('%' + Str.toHex(this.addr)) : '#' + this.id), true);
+        }
+    }
+
+    /**
+     * addBreakpoint(off, fWrite, cpu)
+     *
+     * NOTE: Some Memory blocks already require access to the CPU (eg, UNPAGED blocks that need to call cpu.mapPageBlock()),
+     * while others require access only if the CPU has set a read or write breakpoint in one of its Debug registers; the latter
+     * case is handled here by virtue of the CPU parameter.
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {boolean} fWrite
+     * @param {X86CPU} [cpu] (required for breakpoints set by the CPU, as opposed to the Debugger)
+     */
+    addBreakpoint(off, fWrite, cpu)
+    {
+        if (!fWrite) {
+            if (this.cReadBreakpoints++ === 0) {
+                if (cpu) this.cpu = cpu;
+                this.setReadAccess(Memory.afnChecked, false);
+            }
+            if (DEBUG) this.printAddr("read breakpoint added to memory block");
+        }
+        else {
+            if (this.cWriteBreakpoints++ === 0) {
+                if (cpu) this.cpu = cpu;
+                this.setWriteAccess(Memory.afnChecked, false);
+            }
+            if (DEBUG) this.printAddr("write breakpoint added to memory block");
+        }
+    }
+
+    /**
+     * removeBreakpoint(off, fWrite)
+     *
+     * NOTE: If this Memory block is not an UNPAGED block that might need to call cpu.mapPageBlock()), and it no
+     * longer has any read or write breakpoints associated with it, then it no longer needs a CPU reference.  The
+     * existence of a CPU reference only impacts the performance of the "checked" memory access functions, so it's
+     * not critical to eliminate it.
+     *
+     * TODO: Another option would be to count CPU references separately from Debugger references, so that when
+     * the former goes to zero, we can unconditionally remove the CPU reference; UNPAGED blocks would automatically
+     * increment that reference count, so their CPU reference would never go away.
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {boolean} fWrite
+     */
+    removeBreakpoint(off, fWrite)
+    {
+        if (!fWrite) {
+            if (--this.cReadBreakpoints === 0) {
+                this.resetReadAccess();
+                if (DEBUG) this.printAddr("all read breakpoints removed from memory block");
+            }
+
+        }
+        else {
+            if (--this.cWriteBreakpoints === 0) {
+                this.resetWriteAccess();
+                if (DEBUG) this.printAddr("all write breakpoints removed from memory block");
+            }
+
+        }
+    }
+
+    /**
+     * copyBreakpoints(dbg, mem)
+     *
+     * @this {Memory}
+     * @param {DebuggerX86} [dbg]
+     * @param {Memory} [mem] (outgoing Memory block to copy breakpoints from, if any)
+     */
+    copyBreakpoints(dbg, mem)
+    {
+        this.dbg = dbg;
+        this.cReadBreakpoints = this.cWriteBreakpoints = 0;
+        if (mem) {
+            if (mem.cpu) this.cpu = mem.cpu;
+            if ((this.cReadBreakpoints = mem.cReadBreakpoints)) {
+                this.setReadAccess(Memory.afnChecked, false);
+            }
+            if ((this.cWriteBreakpoints = mem.cWriteBreakpoints)) {
+                this.setWriteAccess(Memory.afnChecked, false);
+            }
+        }
+    }
+
+    /**
+     * readNone(off)
+     *
+     * Previously, this always returned 0x00, but the initial memory probe by the COMPAQ DeskPro 386 ROM BIOS
+     * writes 0x0000 to the first word of every 64Kb block in the nearly 16Mb address space it supports, and
+     * if it reads back 0x0000, it will initially think that LOTS of RAM exists, only to be disappointed later
+     * when it performs a more exhaustive memory test, generating unwanted error messages in the process.
+     *
+     * TODO: Determine if we should have separate readByteNone(), readShortNone() and readLongNone() functions
+     * to return 0xff, 0xffff and 0xffffffff|0, respectively.  This seems sufficient for now, as it seems unlikely
+     * that a system would require nonexistent memory locations to return ALL bits set.
+     *
+     * Also, I'm reluctant to address that potential issue by simply returning -1, because to date, the above
+     * Memory interfaces have always returned values that are properly masked to 8, 16 or 32 bits, respectively.
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readNone(off, addr)
+    {
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(Messages.CPU | Messages.MEM) /* && !off */) {
+            this.dbg.message("attempt to read invalid block %" + Str.toHex(addr), true);
+        }
+        return 0xff;
+    }
+
+    /**
+     * writeNone(off, v, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} v (could be either a byte or word value, since we use the same handler for both kinds of accesses)
+     * @param {number} addr
+     */
+    writeNone(off, v, addr)
+    {
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(Messages.CPU | Messages.MEM) /* && !off */) {
+            this.dbg.message("attempt to write " + Str.toHexWord(v) + " to invalid block %" + Str.toHex(addr), true);
+        }
+    }
+
+    /**
+     * readShortDefault(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readShortDefault(off, addr)
+    {
+        return this.readByte(off++, addr++) | (this.readByte(off, addr) << 8);
+    }
+
+    /**
+     * readLongDefault(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readLongDefault(off, addr)
+    {
+        return this.readByte(off++, addr++) | (this.readByte(off++, addr++) << 8) | (this.readByte(off++, addr++) << 16) | (this.readByte(off, addr) << 24);
+    }
+
+    /**
+     * writeShortDefault(off, w, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} w
+     * @param {number} addr
+     */
+    writeShortDefault(off, w, addr)
+    {
+        this.writeByte(off++, w & 0xff, addr++);
+        this.writeByte(off, w >> 8, addr);
+    }
+
+    /**
+     * writeLongDefault(off, w, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} w
+     * @param {number} addr
+     */
+    writeLongDefault(off, w, addr)
+    {
+        this.writeByte(off++, w & 0xff, addr++);
+        this.writeByte(off++, (w >> 8) & 0xff, addr++);
+        this.writeByte(off++, (w >> 16) & 0xff, addr++);
+        this.writeByte(off, (w >>> 24), addr);
+    }
+
+    /**
+     * readByteMemory(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readByteMemory(off, addr)
+    {
+        if (BYTEARRAYS) {
+            return this.ab[off];
+        }
+        return ((this.adw[off >> 2] >>> ((off & 0x3) << 3)) & 0xff);
+    }
+
+    /**
+     * readShortMemory(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readShortMemory(off, addr)
+    {
+        if (BYTEARRAYS) {
+            return this.ab[off] | (this.ab[off + 1] << 8);
+        }
+        var w;
+        var idw = off >> 2;
+        var nShift = (off & 0x3) << 3;
+        var dw = (this.adw[idw] >> nShift);
+        if (nShift < 24) {
+            w = dw & 0xffff;
+        } else {
+            w = (dw & 0xff) | ((this.adw[idw + 1] & 0xff) << 8);
+        }
+        return w;
+    }
+
+    /**
+     * readLongMemory(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readLongMemory(off, addr)
+    {
+        if (BYTEARRAYS) {
+            return this.ab[off] | (this.ab[off + 1] << 8) | (this.ab[off + 2] << 16) | (this.ab[off + 3] << 24);
+        }
+        var idw = off >> 2;
+        var nShift = (off & 0x3) << 3;
+        var l = this.adw[idw];
+        if (nShift) {
+            l >>>= nShift;
+            l |= this.adw[idw + 1] << (32 - nShift);
+        }
+        return l;
+    }
+
+    /**
+     * writeByteMemory(off, b, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} b
+     * @param {number} addr
+     */
+    writeByteMemory(off, b, addr)
+    {
+        if (BYTEARRAYS) {
+            this.ab[off] = b;
+        } else {
+            var idw = off >> 2;
+            var nShift = (off & 0x3) << 3;
+            this.adw[idw] = (this.adw[idw] & ~(0xff << nShift)) | (b << nShift);
+        }
+        this.fDirty = true;
+    }
+
+    /**
+     * writeShortMemory(off, w, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} w
+     * @param {number} addr
+     */
+    writeShortMemory(off, w, addr)
+    {
+        if (BYTEARRAYS) {
+            this.ab[off] = (w & 0xff);
+            this.ab[off + 1] = (w >> 8);
+        } else {
+            var idw = off >> 2;
+            var nShift = (off & 0x3) << 3;
+            if (nShift < 24) {
+                this.adw[idw] = (this.adw[idw] & ~(0xffff << nShift)) | (w << nShift);
+            } else {
+                this.adw[idw] = (this.adw[idw] & 0x00ffffff) | (w << 24);
+                idw++;
+                this.adw[idw] = (this.adw[idw] & (0xffffff00|0)) | (w >> 8);
+            }
+        }
+        this.fDirty = true;
+    }
+
+    /**
+     * writeLongMemory(off, l, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} l
+     * @param {number} addr
+     */
+    writeLongMemory(off, l, addr)
+    {
+        if (BYTEARRAYS) {
+            this.ab[off] = (l & 0xff);
+            this.ab[off + 1] = (l >> 8) & 0xff;
+            this.ab[off + 2] = (l >> 16) & 0xff;
+            this.ab[off + 3] = (l >> 24) & 0xff;
+        } else {
+            var idw = off >> 2;
+            var nShift = (off & 0x3) << 3;
+            if (!nShift) {
+                this.adw[idw] = l;
+            } else {
+                var mask = (0xffffffff|0) << nShift;
+                this.adw[idw] = (this.adw[idw] & ~mask) | (l << nShift);
+                idw++;
+                this.adw[idw] = (this.adw[idw] & mask) | (l >>> (32 - nShift));
+            }
+        }
+        this.fDirty = true;
+    }
+
+    /**
+     * readByteChecked(off, addr)
+     *
+     * NOTE: When we're called in the context of a PAGED block (eg, with one or more DEBUGGER breakpoints set),
+     * the checkMemory functions need "this.addr + off" rather than "addr", because the former will be the physical
+     * address rather than the linear address.
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readByteChecked(off, addr)
+    {
+        if (!DEBUGGER || !this.dbg || this.addr == null || !this.dbg.checkMemoryRead(this.addr + off)) {
+            if (I386 && this.cpu) this.cpu.checkMemoryException(addr, 1, false);
+        }
+        return this.readByteDirect(off, addr);
+    }
+
+    /**
+     * readShortChecked(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readShortChecked(off, addr)
+    {
+        if (!DEBUGGER || !this.dbg || this.addr == null || !this.dbg.checkMemoryRead(this.addr + off, 2)) {
+            if (I386 && this.cpu) this.cpu.checkMemoryException(addr, 2, false);
+        }
+        return this.readShortDirect(off, addr);
+    }
+
+    /**
+     * readLongChecked(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readLongChecked(off, addr)
+    {
+        if (!DEBUGGER || !this.dbg || this.addr == null || !this.dbg.checkMemoryRead(this.addr + off, 4)) {
+            if (I386 && this.cpu) this.cpu.checkMemoryException(addr, 4, false);
+        }
+        return this.readLongDirect(off, addr);
+    }
+
+    /**
+     * writeByteChecked(off, b, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @param {number} b
+     */
+    writeByteChecked(off, b, addr)
+    {
+        if (!DEBUGGER || !this.dbg || this.addr == null || !this.dbg.checkMemoryWrite(this.addr + off)) {
+            if (I386 && this.cpu) this.cpu.checkMemoryException(addr, 1, true);
+        }
+        if (this.fReadOnly) this.writeNone(off, b, addr); else this.writeByteDirect(off, b, addr);
+    }
+
+    /**
+     * writeShortChecked(off, w, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @param {number} w
+     */
+    writeShortChecked(off, w, addr)
+    {
+        if (!DEBUGGER || !this.dbg || this.addr == null || !this.dbg.checkMemoryWrite(this.addr + off, 2)) {
+            if (I386 && this.cpu) this.cpu.checkMemoryException(addr, 2, true);
+        }
+        if (this.fReadOnly) this.writeNone(off, w, addr); else this.writeShortDirect(off, w, addr);
+    }
+
+    /**
+     * writeLongChecked(off, l, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} l
+     * @param {number} addr
+     */
+    writeLongChecked(off, l, addr)
+    {
+        if (!DEBUGGER || !this.dbg || this.addr == null || !this.dbg.checkMemoryWrite(this.addr + off, 4)) {
+            if (I386 && this.cpu) this.cpu.checkMemoryException(addr, 4, true);
+        }
+        if (this.fReadOnly) this.writeNone(off, l, addr); else this.writeLongDirect(off, l, addr);
+    }
+
+    /**
+     * readBytePaged(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readBytePaged(off, addr)
+    {
+        this.blockPDE.adw[this.iPDE] |= this.bitPTEAccessed;
+        this.blockPTE.adw[this.iPTE] |= this.bitPTEAccessed;
+        return this.blockPhys.readByte(off, addr);
+    }
+
+    /**
+     * readShortPaged(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readShortPaged(off, addr)
+    {
+        this.blockPDE.adw[this.iPDE] |= this.bitPTEAccessed;
+        this.blockPTE.adw[this.iPTE] |= this.bitPTEAccessed;
+        return this.blockPhys.readShort(off, addr);
+    }
+
+    /**
+     * readLongPaged(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readLongPaged(off, addr)
+    {
+        this.blockPDE.adw[this.iPDE] |= this.bitPTEAccessed;
+        this.blockPTE.adw[this.iPTE] |= this.bitPTEAccessed;
+        return this.blockPhys.readLong(off, addr);
+    }
+
+    /**
+     * writeBytePaged(off, b, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} b
+     * @param {number} addr
+     */
+    writeBytePaged(off, b, addr)
+    {
+        this.blockPDE.adw[this.iPDE] |= this.bitPTEAccessed;
+        this.blockPTE.adw[this.iPTE] |= this.bitPTEDirty;
+        this.blockPhys.writeByte(off, b, addr);
+    }
+
+    /**
+     * writeShortPaged(off, w, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} w
+     * @param {number} addr
+     */
+    writeShortPaged(off, w, addr)
+    {
+        this.blockPDE.adw[this.iPDE] |= this.bitPTEAccessed;
+        this.blockPTE.adw[this.iPTE] |= this.bitPTEDirty;
+        this.blockPhys.writeShort(off, w, addr);
+    }
+
+    /**
+     * writeLongPaged(off, l, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} l
+     * @param {number} addr
+     */
+    writeLongPaged(off, l, addr)
+    {
+        this.blockPDE.adw[this.iPDE] |= this.bitPTEAccessed;
+        this.blockPTE.adw[this.iPTE] |= this.bitPTEDirty;
+        this.blockPhys.writeLong(off, l, addr);
+    }
+
+    /**
+     * readByteUnpaged(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readByteUnpaged(off, addr)
+    {
+        return this.getPageBlock(addr, false).readByte(off, addr);
+    }
+
+    /**
+     * readShortUnpaged(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readShortUnpaged(off, addr)
+    {
+        return this.getPageBlock(addr, false).readShort(off, addr);
+    }
+
+    /**
+     * readLongUnpaged(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readLongUnpaged(off, addr)
+    {
+        return this.getPageBlock(addr, false).readLong(off, addr);
+    }
+
+    /**
+     * writeByteUnpaged(off, b, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} b
+     * @param {number} addr
+     */
+    writeByteUnpaged(off, b, addr)
+    {
+        this.getPageBlock(addr, true).writeByte(off, b, addr);
+    }
+
+    /**
+     * writeShortUnpaged(off, w, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} w
+     * @param {number} addr
+     */
+    writeShortUnpaged(off, w, addr)
+    {
+        this.getPageBlock(addr, true).writeShort(off, w, addr);
+    }
+
+    /**
+     * writeLongUnpaged(off, l, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} l
+     * @param {number} addr
+     */
+    writeLongUnpaged(off, l, addr)
+    {
+        this.getPageBlock(addr, true).writeLong(off, l, addr);
+    }
+
+    /**
+     * readByteBE(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readByteBE(off, addr)
+    {
+        return this.ab[off];
+    }
+
+    /**
+     * readByteLE(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readByteLE(off, addr)
+    {
+        return this.ab[off];
+    }
+
+    /**
+     * readBytePLE(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readBytePLE(off, addr)
+    {
+        this.blockPDE.adw[this.iPDE] |= X86.PTE.ACCESSED;
+        this.blockPTE.adw[this.iPTE] |= X86.PTE.ACCESSED;
+        /*
+         * TODO: Review this performance hack.  Basically, after the first read of a page,
+         * we redirect the default read handler to a faster handler.  However, if operating
+         * systems clear the PDE/PTE bits without reloading CR3, they won't get set again.
+         *
+         * We should look into creating special write handlers for pages containing PDE/PTE
+         * entries, and whenever those entries are written, reset the read/write handlers
+         * for the corresponding pages.
+         */
+        this.readByte = this.readByteLE;
+        return this.ab[off];
+    }
+
+    /**
+     * readShortBE(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readShortBE(off, addr)
+    {
+        return this.dv.getUint16(off, true);
+    }
+
+    /**
+     * readShortLE(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readShortLE(off, addr)
+    {
+        /*
+         * TODO: It remains to be seen if there's any advantage to checking the offset for an aligned read
+         * vs. always reading the bytes separately; it seems a safe bet for longs, but it's less clear for shorts.
+         */
+        return (off & 0x1)? (this.ab[off] | (this.ab[off+1] << 8)) : this.aw[off >> 1];
+    }
+
+    /**
+     * readShortPLE(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readShortPLE(off, addr)
+    {
+        /*
+         * TODO: It remains to be seen if there's any advantage to checking the offset for an aligned read
+         * vs. always reading the bytes separately; it seems a safe bet for longs, but it's less clear for shorts.
+         */
+        this.blockPDE.adw[this.iPDE] |= X86.PTE.ACCESSED;
+        this.blockPTE.adw[this.iPTE] |= X86.PTE.ACCESSED;
+        /*
+         * TODO: Review this performance hack.  Basically, after the first read of a page,
+         * we redirect the default read handler to a faster handler.  However, if operating
+         * systems clear the PDE/PTE bits without reloading CR3, they won't get set again.
+         *
+         * We should look into creating special write handlers for pages containing PDE/PTE
+         * entries, and whenever those entries are written, reset the read/write handlers
+         * for the corresponding pages.
+         */
+        this.readShort = this.readShortLE;
+        return (off & 0x1)? (this.ab[off] | (this.ab[off+1] << 8)) : this.aw[off >> 1];
+    }
+
+    /**
+     * readLongBE(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readLongBE(off, addr)
+    {
+        return this.dv.getInt32(off, true);
+    }
+
+    /**
+     * readLongLE(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readLongLE(off, addr)
+    {
+        /*
+         * TODO: It remains to be seen if there's any advantage to checking the offset for an aligned read
+         * vs. always reading the bytes separately; it seems a safe bet for longs, but it's less clear for shorts.
+         */
+        return (off & 0x3)? (this.ab[off] | (this.ab[off+1] << 8) | (this.ab[off+2] << 16) | (this.ab[off+3] << 24)) : this.adw[off >> 2];
+    }
+
+    /**
+     * readLongPLE(off, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readLongPLE(off, addr)
+    {
+        /*
+         * TODO: It remains to be seen if there's any advantage to checking the offset for an aligned read
+         * vs. always reading the bytes separately; it seems a safe bet for longs, but it's less clear for shorts.
+         */
+        this.blockPDE.adw[this.iPDE] |= X86.PTE.ACCESSED;
+        this.blockPTE.adw[this.iPTE] |= X86.PTE.ACCESSED;
+        /*
+         * TODO: Review this performance hack.  Basically, after the first read of a page,
+         * we redirect the default read handler to a faster handler.  However, if operating
+         * systems clear the PDE/PTE bits without reloading CR3, they won't get set again.
+         *
+         * We should look into creating special write handlers for pages containing PDE/PTE
+         * entries, and whenever those entries are written, reset the read/write handlers
+         * for the corresponding pages.
+         */
+        this.readLong = this.readLongLE;
+        return (off & 0x3)? (this.ab[off] | (this.ab[off+1] << 8) | (this.ab[off+2] << 16) | (this.ab[off+3] << 24)) : this.adw[off >> 2];
+    }
+
+    /**
+     * writeByteBE(off, b, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} b
+     * @param {number} addr
+     */
+    writeByteBE(off, b, addr)
+    {
+        this.ab[off] = b;
+        this.fDirty = true;
+    }
+
+    /**
+     * writeByteLE(off, b, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @param {number} b
+     */
+    writeByteLE(off, b, addr)
+    {
+        this.ab[off] = b;
+        this.fDirty = true;
+    }
+
+    /**
+     * writeBytePLE(off, b, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @param {number} b
+     */
+    writeBytePLE(off, b, addr)
+    {
+        this.ab[off] = b;
+        this.blockPDE.adw[this.iPDE] |= X86.PTE.ACCESSED;
+        this.blockPTE.adw[this.iPTE] |= X86.PTE.ACCESSED | X86.PTE.DIRTY;
+        /*
+         * TODO: Review this performance hack.  Basically, after the first write of a page,
+         * we redirect the default write handler to a faster handler.  However, if operating
+         * systems clear the PDE/PTE bits without reloading CR3, they won't get set again.
+         *
+         * We should look into creating special write handlers for pages containing PDE/PTE
+         * entries, and whenever those entries are written, reset the read/write handlers
+         * for the corresponding pages.
+         */
+        this.writeByte = this.writeByteLE;
+        /*
+         * NOTE: Technically, we should be setting the fDirty flag on blockPDE and blockPTE as well, but let's
+         * consider the two sole uses of fDirty.  First, we have cleanMemory(), which is currently used only by
+         * the Video component, and video memory should never contain page directories or page tables, so no
+         * worries there.  Second, we have saveMemory(), but the CPU now asks that function to save all physical
+         * memory blocks whenever paging is enabled, so no worries there either.
+         */
+        this.blockPhys.fDirty = true;
+    }
+
+    /**
+     * writeShortBE(off, w, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @param {number} w
+     */
+    writeShortBE(off, w, addr)
+    {
+        this.dv.setUint16(off, w, true);
+        this.fDirty = true;
+    }
+
+    /**
+     * writeShortLE(off, w, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @param {number} w
+     */
+    writeShortLE(off, w, addr)
+    {
+        /*
+         * TODO: It remains to be seen if there's any advantage to checking the offset for an aligned write
+         * vs. always writing the bytes separately; it seems a safe bet for longs, but it's less clear for shorts.
+         */
+        if (off & 0x1) {
+            this.ab[off] = w;
+            this.ab[off+1] = w >> 8;
+        } else {
+            this.aw[off >> 1] = w;
+        }
+        this.fDirty = true;
+    }
+
+    /**
+     * writeShortPLE(off, w, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} addr
+     * @param {number} w
+     */
+    writeShortPLE(off, w, addr)
+    {
+        /*
+         * TODO: It remains to be seen if there's any advantage to checking the offset for an aligned write
+         * vs. always writing the bytes separately; it seems a safe bet for longs, but it's less clear for shorts.
+         */
+        if (off & 0x1) {
+            this.ab[off] = w;
+            this.ab[off+1] = w >> 8;
+        } else {
+            this.aw[off >> 1] = w;
+        }
+        this.blockPDE.adw[this.iPDE] |= X86.PTE.ACCESSED;
+        this.blockPTE.adw[this.iPTE] |= X86.PTE.ACCESSED | X86.PTE.DIRTY;
+        /*
+         * TODO: Review this performance hack.  Basically, after the first write of a page,
+         * we redirect the default write handler to a faster handler.  However, if operating
+         * systems clear the PDE/PTE bits without reloading CR3, they won't get set again.
+         *
+         * We should look into creating special write handlers for pages containing PDE/PTE
+         * entries, and whenever those entries are written, reset the read/write handlers
+         * for the corresponding pages.
+         */
+        this.writeShort = this.writeShortLE;
+        /*
+         * NOTE: Technically, we should be setting the fDirty flag on blockPDE and blockPTE as well, but let's
+         * consider the two sole uses of fDirty.  First, we have cleanMemory(), which is currently used only by
+         * the Video component, and video memory should never contain page directories or page tables, so no
+         * worries there.  Second, we have saveMemory(), but the CPU now asks that function to save all physical
+         * memory blocks whenever paging is enabled, so no worries there either.
+         */
+        this.blockPhys.fDirty = true;
+    }
+
+    /**
+     * writeLongBE(off, l, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} l
+     * @param {number} addr
+     */
+    writeLongBE(off, l, addr)
+    {
+        this.dv.setInt32(off, l, true);
+        this.fDirty = true;
+    }
+
+    /**
+     * writeLongLE(off, l, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} l
+     * @param {number} addr
+     */
+    writeLongLE(off, l, addr)
+    {
+        /*
+         * TODO: It remains to be seen if there's any advantage to checking the offset for an aligned write
+         * vs. always writing the bytes separately; it seems a safe bet for longs, but it's less clear for shorts.
+         */
+        if (off & 0x3) {
+            this.ab[off] = l;
+            this.ab[off+1] = (l >> 8);
+            this.ab[off+2] = (l >> 16);
+            this.ab[off+3] = (l >> 24);
+        } else {
+            this.adw[off >> 2] = l;
+        }
+        this.fDirty = true;
+    }
+
+    /**
+     * writeLongPLE(off, l, addr)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} l
+     * @param {number} addr
+     */
+    writeLongPLE(off, l, addr)
+    {
+        /*
+         * TODO: It remains to be seen if there's any advantage to checking the offset for an aligned write
+         * vs. always writing the bytes separately; it seems a safe bet for longs, but it's less clear for shorts.
+         */
+        if (off & 0x3) {
+            this.ab[off] = l;
+            this.ab[off+1] = (l >> 8);
+            this.ab[off+2] = (l >> 16);
+            this.ab[off+3] = (l >> 24);
+        } else {
+            this.adw[off >> 2] = l;
+        }
+        this.blockPDE.adw[this.iPDE] |= X86.PTE.ACCESSED;
+        this.blockPTE.adw[this.iPTE] |= X86.PTE.ACCESSED | X86.PTE.DIRTY;
+        /*
+         * TODO: Review this performance hack.  Basically, after the first write of a page,
+         * we redirect the default write handler to a faster handler.  However, if operating
+         * systems clear the PDE/PTE bits without reloading CR3, they won't get set again.
+         *
+         * We should look into creating special write handlers for pages containing PDE/PTE
+         * entries, and whenever those entries are written, reset the read/write handlers
+         * for the corresponding pages.
+         */
+        this.writeLong = this.writeLongLE;
+        /*
+         * NOTE: Technically, we should be setting the fDirty flag on blockPDE and blockPTE as well, but let's
+         * consider the two sole uses of fDirty.  First, we have cleanMemory(), which is currently used only by
+         * the Video component, and video memory should never contain page directories or page tables, so no
+         * worries there.  Second, we have saveMemory(), but the CPU now asks that function to save all physical
+         * memory blocks whenever paging is enabled, so no worries there either.
+         */
+        this.blockPhys.fDirty = true;
+    }
+
+    /**
+     * readBackTrackNone(off)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @return {number}
+     */
+    readBackTrackNone(off)
+    {
+        return 0;
+    }
+
+    /**
+     * writeBackTrackNone(off, bti)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} bti
+     */
+    writeBackTrackNone(off, bti)
+    {
+    }
+
+    /**
+     * modBackTrackNone(fMod)
+     *
+     * @this {Memory}
+     * @param {boolean} fMod
+     */
+    modBackTrackNone(fMod)
+    {
+        return false;
+    }
+
+    /**
+     * readBackTrackIndex(off)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @return {number}
+     */
+    readBackTrackIndex(off)
+    {
+        return this.abtIndexes[off];
+    }
+
+    /**
+     * writeBackTrackIndex(off, bti)
+     *
+     * @this {Memory}
+     * @param {number} off
+     * @param {number} bti
+     * @return {number} previous bti (0 if none)
+     */
+    writeBackTrackIndex(off, bti)
+    {
+        var btiPrev;
+        btiPrev = this.abtIndexes[off];
+        this.abtIndexes[off] = bti;
+        return btiPrev;
+    }
+
+    /**
+     * modBackTrackIndex(fMod)
+     *
+     * @this {Memory}
+     * @param {boolean} fMod
+     * @return {boolean} previous value
+     */
+    modBackTrackIndex(fMod)
+    {
+        var fModPrev = this.fModBackTrack;
+        this.fModBackTrack = fMod;
+        return fModPrev;
+    }
+
+    /**
+     * adjustEndian(dw)
+     *
+     * @param {number} dw
+     * @return {number}
+     */
+    static adjustEndian(dw)
+    {
+        if (TYPEDARRAYS && !littleEndian) {
+            dw = (dw << 24) | ((dw << 8) & 0x00ff0000) | ((dw >> 8) & 0x0000ff00) | (dw >>> 24);
+        }
+        return dw;
+    }
+}
+
+/*
+ * Basic memory types
+ *
+ * RAM is the most conventional memory type, providing full read/write capability to x86-compatible (ie,
+ * 'little endian") storage.  ROM is equally conventional, except that the fReadOnly property is set,
+ * disabling writes.  VIDEO is treated exactly like RAM, unless a controller is provided.  Both RAM and
+ * VIDEO memory are always considered writable, and even ROM can be written using the Bus setByteDirect()
+ * interface (which in turn uses the Memory writeByteDirect() interface), allowing the ROM component to
+ * initialize its own memory.  The CTRL type is used to identify memory-mapped devices that do not need
+ * any default storage and always provide their own controller.
+ *
+ * UNPAGED and PAGED blocks are created by the CPU when paging is enabled; the role of an UNPAGED block
+ * is simply to perform page translation and replace itself with a PAGED block, which redirects read/write
+ * requests to the physical page located during translation.  UNPAGED and PAGED blocks are considered
+ * "logical" blocks that don't contain any storage of their own; all other block types represent "physical"
+ * memory (or a memory-mapped device).
+ *
+ * Unallocated regions of the address space contain a special memory block of type NONE that contains
+ * no storage.  Mapping every addressible location to a memory block allows all accesses to be routed in
+ * exactly the same manner, without resorting to any range or processor checks.
+ *
+ * Originally, the Debugger always went through the Bus interfaces, and could therefore modify ROMs as well,
+ * but with the introduction of protected mode memory segmentation (and later paging), where logical and
+ * physical addresses were no longer the same, that is no longer true.  For coherency, all Debugger memory
+ * accesses now go through X86Seg and X86CPU memory interfaces, so that the user sees the same segment
+ * and page translation that the CPU sees.  However, the Debugger uses a special probeAddr() interface to
+ * read memory, along with a special "fSuppress" flag to mapPageBlock(), to prevent its memory accesses
+ * from triggering segment and/or page faults when invalid or not-present segments or pages are accessed.
+ *
+ * These types are not mutually exclusive.  For example, VIDEO memory could be allocated as RAM, with or
+ * without a custom controller (the original Monochrome and CGA video cards used read/write storage that
+ * was indistinguishable from RAM), and CTRL memory could be allocated as an empty block of any type, with
+ * a custom controller.  A few types are required for certain features (eg, ROM is required if you want
+ * read-only memory), but the larger purpose of these types is to help document the caller's intent and to
+ * provide the Control Panel with the ability to highlight memory regions accordingly.
+ */
+Memory.TYPE = {
+    NONE:       0,
+    RAM:        1,
+    ROM:        2,
+    VIDEO:      3,
+    CTRL:       4,
+    UNPAGED:    5,
+    PAGED:      6,
+    COLORS:     ["black", "blue", "green", "cyan"],
+    NAMES:      ["NONE",  "RAM",  "ROM",   "VIDEO", "H/W", "UNPAGED", "PAGED"]
+};
+
+/*
+ * Last used block ID (used for debugging only)
+ */
+Memory.idBlock = 0;
+
+
+/*
+ * This is the effective definition of afnNone, but we need not fully define it, because setAccess() uses these
+ * defaults when any of the 6 handlers (ie, 2 byte handlers, 2 short handlers, and 2 long handlers) are undefined.
+ *
+Memory.afnNone = [
+    Memory.prototype.readNone,
+    Memory.prototype.writeNone,
+    Memory.prototype.readShortDefault,
+    Memory.prototype.writeShortDefault,
+    Memory.prototype.readLongDefault,
+    Memory.prototype.writeLongDefault
+];
+ */
+Memory.afnNone = [];
+
+Memory.afnMemory = [
+    Memory.prototype.readByteMemory,
+    Memory.prototype.writeByteMemory,
+    Memory.prototype.readShortMemory,
+    Memory.prototype.writeShortMemory,
+    Memory.prototype.readLongMemory,
+    Memory.prototype.writeLongMemory
+];
+
+Memory.afnChecked = [
+    Memory.prototype.readByteChecked,
+    Memory.prototype.writeByteChecked,
+    Memory.prototype.readShortChecked,
+    Memory.prototype.writeShortChecked,
+    Memory.prototype.readLongChecked,
+    Memory.prototype.writeLongChecked
+];
+
+if (PAGEBLOCKS) {
+    Memory.afnPaged = [
+        Memory.prototype.readBytePaged,
+        Memory.prototype.writeBytePaged,
+        Memory.prototype.readShortPaged,
+        Memory.prototype.writeShortPaged,
+        Memory.prototype.readLongPaged,
+        Memory.prototype.writeLongPaged
+    ];
+
+    Memory.afnUnpaged = [
+        Memory.prototype.readByteUnpaged,
+        Memory.prototype.writeByteUnpaged,
+        Memory.prototype.readShortUnpaged,
+        Memory.prototype.writeShortUnpaged,
+        Memory.prototype.readLongUnpaged,
+        Memory.prototype.writeLongUnpaged
+    ];
+}
+
+if (TYPEDARRAYS) {
+    Memory.afnArrayBE = [
+        Memory.prototype.readByteBE,
+        Memory.prototype.writeByteBE,
+        Memory.prototype.readShortBE,
+        Memory.prototype.writeShortBE,
+        Memory.prototype.readLongBE,
+        Memory.prototype.writeLongBE
+    ];
+
+    Memory.afnArrayLE = [
+        Memory.prototype.readByteLE,
+        Memory.prototype.writeByteLE,
+        Memory.prototype.readShortLE,
+        Memory.prototype.writeShortLE,
+        Memory.prototype.readLongLE,
+        Memory.prototype.writeLongLE
+    ];
+
+    Memory.afnPagedLE = [
+        Memory.prototype.readBytePLE,
+        Memory.prototype.writeBytePLE,
+        Memory.prototype.readShortPLE,
+        Memory.prototype.writeShortPLE,
+        Memory.prototype.readLongPLE,
+        Memory.prototype.writeLongPLE
+    ];
+}
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/cpu.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class CPU extends Component {
+    /**
+     * CPU(parmsCPU, nCyclesDefault)
+     *
+     * The CPU class supports the following (parmsCPU) properties:
+     *
+     *      cycles: the machine's base cycles per second; the X86CPU constructor will
+     *      provide us with a default (based on the CPU model) to use as a fallback.
+     *
+     *      multiplier: base cycle multiplier; default is 1.
+     *
+     *      autoStart: true to automatically start, false to not, or null if "it depends";
+     *      null is the default, which means do not autostart UNLESS there is no Debugger
+     *      and no "Run" button (ie, no way to manually start the machine).
+     *
+     *      csStart: the number of cycles that runCPU() must wait before generating
+     *      checksum records; -1 if disabled. checksum records are a diagnostic aid
+     *      used to help compare one CPU run to another.
+     *
+     *      csInterval: the number of cycles that runCPU() must execute before
+     *      generating a checksum record; -1 if disabled.
+     *
+     *      csStop: the number of cycles to stop generating checksum records.
+     *
+     * This component is primarily responsible for interfacing the CPU with the outside
+     * world (eg, Panel and Debugger components), and managing overall CPU operation.
+     *
+     * It is extended by the X86CPU component, where all the x86-specific logic resides.
+     *
+     * @this {CPU}
+     * @param {Object} parmsCPU
+     * @param {number} nCyclesDefault
+     */
+    constructor(parmsCPU, nCyclesDefault)
+    {
+        super("CPU", parmsCPU, Messages.CPU);
+
+        var nCycles = parmsCPU['cycles'] || nCyclesDefault;
+
+        var nMultiplier = parmsCPU['multiplier'] || 1;
+
+        this.aCounts = {};
+        this.aCounts.nCyclesPerSecond = nCycles;
+
+        /*
+         * nCyclesMultiplier replaces the old "speed" variable (0, 1, 2) and eliminates the need for
+         * the constants (SPEED_SLOW, SPEED_FAST and SPEED_MAX).  The UI simply doubles the multiplier
+         * until we've exceeded the host's speed limit and then starts the multiplier over at 1.
+         */
+        this.aCounts.nCyclesMultiplier = nMultiplier;
+        this.aCounts.mhzDefault = Math.round(this.aCounts.nCyclesPerSecond / 10000) / 100;
+        /*
+         * TODO: Take care of this with an initial setSpeed() call instead?
+         */
+        this.aCounts.mhzTarget = this.aCounts.mhzDefault * this.aCounts.nCyclesMultiplier;
+
+        /*
+         * We add a number of flags to the set initialized by Component
+         */
+        this.flags.running = false;
+        this.flags.starting = false;
+        this.flags.autoStart = parmsCPU['autoStart'];
+
+        /*
+         * TODO: Add some UI for displayLiveRegs (either an XML property, or a UI checkbox, or both)
+         */
+        this.flags.displayLiveRegs = false;
+
+        /*
+         * Get checksum parameters, if any. runCPU() behavior is not affected until fChecksum
+         * is true, which won't happen until resetChecksum() is called with nCyclesChecksumInterval
+         * ("csInterval") set to a positive value.
+         *
+         * As above, any of these parameters can also be set with the Debugger's execution options
+         * command ("x"); for example, "x cs int 5000" will set nCyclesChecksumInterval to 5000
+         * and call resetChecksum().
+         */
+        this.flags.checksum = false;
+        this.aCounts.nChecksum = this.aCounts.nCyclesChecksumNext = 0;
+        this.aCounts.nCyclesChecksumStart = parmsCPU["csStart"];
+        this.aCounts.nCyclesChecksumInterval = parmsCPU["csInterval"];
+        this.aCounts.nCyclesChecksumStop = parmsCPU["csStop"];
+
+        this.onRunTimeout = this.runCPU.bind(this); // function onRunTimeout() { cpu.runCPU(); };
+
+        this.setReady();
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {CPU}
+     * @param {Computer} cmp
+     * @param {Bus} bus
+     * @param {CPU} cpu
+     * @param {DebuggerX86} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cmp = cmp;
+        this.bus = bus;
+        this.dbg = dbg;
+
+        for (var i = 0; i < CPU.BUTTONS.length; i++) {
+            var control = this.bindings[CPU.BUTTONS[i]];
+            if (control) this.cmp.setBinding(null, CPU.BUTTONS[i], control);
+        }
+
+        this.fpu = cmp.getMachineComponent("FPU");
+
+        /*
+         * Attach the ChipSet component to the CPU so that it can obtain the IDT vector number
+         * of pending hardware interrupts in response to the ChipSet's updateINTR() notifications.
+         *
+         * We must also call chipset.updateAllTimers() periodically; stepCPU() takes care of that.
+         */
+        this.chipset = cmp.getMachineComponent("ChipSet");
+
+        /*
+         * We've already saved the parmsCPU 'autoStart' setting, but there may be a machine (or URL) override.
+         */
+        var sAutoStart = cmp.getMachineParm('autoStart');
+        if (sAutoStart != null) {
+            this.flags.autoStart = (sAutoStart == "true"? true : (sAutoStart  == "false"? false : !!sAutoStart));
+        }
+
+        this.setReady();
+    }
+
+    /**
+     * reset()
+     *
+     * This is a placeholder for reset (overridden by the X86CPU component).
+     *
+     * @this {CPU}
+     */
+    reset()
+    {
+    }
+
+    /**
+     * save()
+     *
+     * This is a placeholder for save support (overridden by the X86CPU component).
+     *
+     * @this {CPU}
+     * @return {Object|null}
+     */
+    save()
+    {
+        return null;
+    }
+
+    /**
+     * restore(data)
+     *
+     * This is a placeholder for restore support (overridden by the X86CPU component).
+     *
+     * @this {CPU}
+     * @param {Object} data
+     * @return {boolean} true if restore successful, false if not
+     */
+    restore(data)
+    {
+        return false;
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {CPU}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            if (!data || !this.restore) {
+                this.reset();
+            } else {
+                this.resetCycles();
+                if (!this.restore(data)) return false;
+                this.resetChecksum();
+            }
+            /*
+             * Give the Debugger a chance to do/print something once we've powered up
+             */
+            if (DEBUGGER && this.dbg) {
+                this.dbg.init();
+            } else {
+                /*
+                 * The Computer (this.cmp) knows if there's a Control Panel (this.cmp.panel), and the Control Panel
+                 * knows if there's a "print" control (this.cmp.panel.controlPrint), and if there IS a "print" control
+                 * but no debugger, the machine is probably misconfigured (most likely, the page simply neglected to
+                 * load the Debugger component).
+                 *
+                 * However, we don't actually need to check all that; it's always safe use println(), regardless whether
+                 * a Control Panel with a "print" control is present or not.
+                 */
+                this.println("No debugger detected");
+            }
+        }
+        /*
+         * The Computer component (which is responsible for all powerDown and powerUp notifications)
+         * is now responsible for managing a component's fPowered flag, not us.
+         *
+         *      this.flags.powered = true;
+         */
+        this.updateCPU();
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {CPU}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        /*
+         * The Computer component (which is responsible for all powerDown and powerUp notifications)
+         * is now responsible for managing a component's fPowered flag, not us.
+         *
+         *      this.flags.powered = false;
+         */
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * autoStart()
+     *
+     * @this {CPU}
+     * @return {boolean} true if started, false if not
+     */
+    autoStart()
+    {
+        /*
+         * Start running automatically on power-up, assuming there's no Debugger and no "Run" button
+         */
+        if (this.flags.autoStart || (!DEBUGGER || !this.dbg) && this.bindings["run"] === undefined) {
+            /*
+             * We used to also set fUpdateFocus when calling runCPU(), on the assumption that in the "auto-starting"
+             * context, a machine without focus is like a day without sunshine, but in reality, focus should only be
+             * forced when the user takes some other machine-related action.
+             */
+            this.runCPU();
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * isPowered()
+     *
+     * @this {CPU}
+     * @return {boolean}
+     */
+    isPowered()
+    {
+        if (!this.flags.powered) {
+            this.println(this.toString() + " not powered");
+            return false;
+        }
+        return true;
+    }
+
+    /**
+     * isRunning()
+     *
+     * @this {CPU}
+     * @return {boolean}
+     */
+    isRunning()
+    {
+        return this.flags.running;
+    }
+
+    /**
+     * getChecksum()
+     *
+     * This will be implemented by the X86CPU component.
+     *
+     * @this {CPU}
+     * @return {number} a 32-bit summation of key elements of the current CPU state (used by the CPU checksum code)
+     */
+    getChecksum()
+    {
+        return 0;
+    }
+
+    /**
+     * resetChecksum()
+     *
+     * If checksum generation is enabled (fChecksum is true), this resets the running 32-bit checksum and the
+     * cycle counter that will trigger the next displayChecksum(); called by resetCycles(), which is called whenever
+     * the CPU is reset or restored.
+     *
+     * @this {CPU}
+     * @return {boolean} true if checksum generation enabled, false if not
+     */
+    resetChecksum()
+    {
+        if (this.aCounts.nCyclesChecksumStart === undefined) this.aCounts.nCyclesChecksumStart = 0;
+        if (this.aCounts.nCyclesChecksumInterval === undefined) this.aCounts.nCyclesChecksumInterval = -1;
+        if (this.aCounts.nCyclesChecksumStop === undefined) this.aCounts.nCyclesChecksumStop = -1;
+        this.flags.checksum = (this.aCounts.nCyclesChecksumStart >= 0 && this.aCounts.nCyclesChecksumInterval > 0);
+        if (this.flags.checksum) {
+            this.aCounts.nChecksum = 0;
+            this.aCounts.nCyclesChecksumNext = this.aCounts.nCyclesChecksumStart - this.nTotalCycles;
+            /*
+             *  this.aCounts.nCyclesChecksumNext = this.aCounts.nCyclesChecksumStart + this.aCounts.nCyclesChecksumInterval -
+             *      (this.nTotalCycles % this.aCounts.nCyclesChecksumInterval);
+             */
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * updateChecksum(nCycles)
+     *
+     * When checksum generation is enabled (fChecksum is true), runCPU() asks stepCPU() to execute a minimum
+     * number of cycles (1), effectively limiting execution to a single instruction, and then we're called with
+     * the exact number cycles that were actually executed.  This should give us instruction-granular checksums
+     * at precise intervals that are 100% repeatable.
+     *
+     * @this {CPU}
+     * @param {number} nCycles
+     */
+    updateChecksum(nCycles)
+    {
+        if (this.flags.checksum) {
+            /*
+             * Get a 32-bit summation of the current CPU state and add it to our running 32-bit checksum
+             */
+            var fDisplay = false;
+            this.aCounts.nChecksum = (this.aCounts.nChecksum + this.getChecksum())|0;
+            this.aCounts.nCyclesChecksumNext -= nCycles;
+            if (this.aCounts.nCyclesChecksumNext <= 0) {
+                this.aCounts.nCyclesChecksumNext += this.aCounts.nCyclesChecksumInterval;
+                fDisplay = true;
+            }
+            if (this.aCounts.nCyclesChecksumStop >= 0) {
+                if (this.aCounts.nCyclesChecksumStop <= this.getCycles()) {
+                    this.aCounts.nCyclesChecksumInterval = this.aCounts.nCyclesChecksumStop = -1;
+                    this.resetChecksum();
+                    this.stopCPU();
+                    fDisplay = true;
+                }
+            }
+            if (fDisplay) this.displayChecksum();
+        }
+    }
+
+    /**
+     * displayChecksum()
+     *
+     * When checksum generation is enabled (fChecksum is true), this is called to provide a crude log of all
+     * checksums generated at the specified cycle intervals, as specified by the "csStart" and "csInterval" parmsCPU
+     * properties).
+     *
+     * @this {CPU}
+     */
+    displayChecksum()
+    {
+        this.println(this.getCycles() + " cycles: " + "checksum=" + Str.toHex(this.aCounts.nChecksum));
+    }
+
+    /**
+     * displayValue(sLabel, nValue, cch)
+     *
+     * This is principally for displaying register values, but in reality, it can be used to display any
+     * numeric (hex) value bound to the given label.
+     *
+     * @this {CPU}
+     * @param {string} sLabel
+     * @param {number} nValue
+     * @param {number} cch
+     */
+    displayValue(sLabel, nValue, cch)
+    {
+        if (this.bindings[sLabel]) {
+            if (nValue === undefined) {
+                this.setError("Value for " + sLabel + " is invalid");
+                this.stopCPU();
+            }
+            var sVal;
+            if (!this.flags.running || this.flags.displayLiveRegs) {
+                sVal = Str.toHex(nValue, cch);
+            } else {
+                sVal = "--------".substr(0, cch);
+            }
+            /*
+             * TODO: Determine if this test actually avoids any redrawing when a register hasn't changed, and/or if
+             * we should maintain our own (numeric) cache of displayed register values (to avoid creating these temporary
+             * string values that will have to garbage-collected), and/or if this is actually slower, and/or if I'm being
+             * too obsessive.
+             */
+            if (this.bindings[sLabel].textContent != sVal) this.bindings[sLabel].textContent = sVal;
+        }
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * @this {CPU}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "run")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        var cpu = this;
+        var fBound = false;
+
+        switch (sBinding) {
+        case "power":
+        case "reset":
+            /*
+             * The "power" and "reset" buttons are functions of the entire computer, not just the CPU,
+             * but it's not always convenient to stick a power button in the Computer component definition,
+             * so we record those bindings here and pass them on to the Computer component in initBus().
+             */
+            this.bindings[sBinding] = control;
+            fBound = true;
+            break;
+
+        case "run":
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickRun() {
+                if (!cpu.cmp || !cpu.cmp.checkPower()) return;
+                if (!cpu.flags.running)
+                    cpu.runCPU(true);
+                else
+                    cpu.stopCPU(true);
+            };
+            fBound = true;
+            break;
+
+        case "speed":
+            this.bindings[sBinding] = control;
+            fBound = true;
+            break;
+
+        case "setSpeed":
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickSetSpeed() {
+                cpu.setSpeed(cpu.aCounts.nCyclesMultiplier << 1, true);
+            };
+            control.textContent = this.getSpeedTarget();
+            fBound = true;
+            break;
+
+        default:
+            break;
+        }
+        return fBound;
+    }
+
+    /**
+     * setBurstCycles(nCycles)
+     *
+     * This function is used by the ChipSet component whenever a very low timer count is set,
+     * in anticipation of the timer requiring an update sooner than the normal nCyclesPerYield
+     * period in runCPU() would normally provide.
+     *
+     * @this {CPU}
+     * @param {number} nCycles is the target number of cycles to drop the current burst to
+     * @return {boolean}
+     */
+    setBurstCycles(nCycles)
+    {
+        if (this.flags.running) {
+            var nDelta = this.nStepCycles - nCycles;
+            /*
+             * NOTE: If nDelta is negative, we will actually be increasing nStepCycles and nBurstCycles.
+             * Which is OK, but if we're also taking snapshots of the cycle counts, to make sure that instruction
+             * costs are being properly assessed, then we need to update nSnapCycles as well.
+             *
+             * TODO: If the delta is negative, we could simply ignore the request, but we must first carefully
+             * consider the impact on the ChipSet timers.
+             */
+            // if (DEBUG) this.nSnapCycles -= nDelta;
+            this.nStepCycles -= nDelta;
+            this.nBurstCycles -= nDelta;
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * addCycles(nCycles, fEndStep)
+     *
+     * @this {CPU}
+     * @param {number} nCycles
+     * @param {boolean} [fEndStep]
+     */
+    addCycles(nCycles, fEndStep)
+    {
+        this.nTotalCycles += nCycles;
+        if (fEndStep) {
+            this.nBurstCycles = this.nStepCycles = 0;
+        }
+    }
+
+    /**
+     * calcCycles(fRecalc)
+     *
+     * Calculate the number of cycles to process for each "burst" of CPU activity.  The size of a burst
+     * is driven by the following values:
+     *
+     *      CPU.YIELDS_PER_SECOND (eg, 30)
+     *      CPU.VIDEO_UPDATES_PER_SECOND (eg, 60)
+     *      CPU.STATUS_UPDATES_PER_SECOND (eg, 5)
+     *
+     * The largest of the above values forces the size of the burst to its smallest value.  Let's say that
+     * largest value is 30.  Assuming nCyclesPerSecond is 1,000,000, that results in bursts of 33,333 cycles.
+     *
+     * At the end of each burst, we subtract burst cycles from yield, video, and status cycle "threshold"
+     * counters. Whenever the "next yield" cycle counter goes to (or below) zero, we compare elapsed time
+     * to the time we expected the virtual hardware to take (eg, 1000ms/50 or 20ms), and if we still have time
+     * remaining, we sleep the remaining time (or 0ms if there's no remaining time), and then restart runCPU().
+     *
+     * Similarly, whenever the "next video update" cycle counter goes to (or below) zero, we call updateVideo(),
+     * and whenever the "next status update" cycle counter goes to (or below) zero, we call updateStatus().
+     *
+     * @this {CPU}
+     * @param {boolean} [fRecalc] is true if the caller wants to recalculate thresholds based on the most recent
+     * speed calculation (see calcSpeed).
+     */
+    calcCycles(fRecalc)
+    {
+        /*
+         * Calculate the most cycles we're allowed to execute in a single "burst"
+         */
+        var nMostUpdatesPerSecond = CPU.YIELDS_PER_SECOND;
+        if (nMostUpdatesPerSecond < CPU.VIDEO_UPDATES_PER_SECOND) nMostUpdatesPerSecond = CPU.VIDEO_UPDATES_PER_SECOND;
+        if (nMostUpdatesPerSecond < CPU.STATUS_UPDATES_PER_SECOND) nMostUpdatesPerSecond = CPU.STATUS_UPDATES_PER_SECOND;
+
+        /*
+         * Calculate cycle "per" values for the yield, video update, and status update cycle counters
+         */
+        var vMultiplier = 1;
+        if (fRecalc) {
+            if (this.aCounts.nCyclesMultiplier > 1 && this.aCounts.mhz) {
+                vMultiplier = (this.aCounts.mhz / this.aCounts.mhzDefault);
+            }
+        }
+
+        this.aCounts.msPerYield = Math.round(1000 / CPU.YIELDS_PER_SECOND);
+        this.aCounts.nCyclesPerBurst = Math.floor(this.aCounts.nCyclesPerSecond / nMostUpdatesPerSecond * vMultiplier);
+        this.aCounts.nCyclesPerYield = Math.floor(this.aCounts.nCyclesPerSecond / CPU.YIELDS_PER_SECOND * vMultiplier);
+        this.aCounts.nCyclesPerVideoUpdate = Math.floor(this.aCounts.nCyclesPerSecond / CPU.VIDEO_UPDATES_PER_SECOND * vMultiplier);
+        this.aCounts.nCyclesPerStatusUpdate = Math.floor(this.aCounts.nCyclesPerSecond / CPU.STATUS_UPDATES_PER_SECOND * vMultiplier);
+
+        /*
+         * And initialize "next" yield, video update, and status update cycle "threshold" counters to those "per" values
+         */
+        if (!fRecalc) {
+            this.aCounts.nCyclesNextYield = this.aCounts.nCyclesPerYield;
+            this.aCounts.nCyclesNextVideoUpdate = this.aCounts.nCyclesPerVideoUpdate;
+            this.aCounts.nCyclesNextStatusUpdate = this.aCounts.nCyclesPerStatusUpdate;
+        }
+        this.aCounts.nCyclesRecalc = 0;
+    }
+
+    /**
+     * getCycles(fScaled)
+     *
+     * getCycles() returns the number of cycles executed so far.  Note that we can be called after
+     * runCPU() OR during runCPU(), perhaps from a handler triggered during the current run's stepCPU(),
+     * so nRunCycles must always be adjusted by number of cycles stepCPU() was asked to run (nBurstCycles),
+     * less the number of cycles it has yet to run (nStepCycles).
+     *
+     * nRunCycles is zeroed whenever the CPU is halted or the CPU speed is changed, which is why we also
+     * have nTotalCycles, which accumulates all nRunCycles before we zero it.  However, nRunCycles and
+     * nTotalCycles eventually get reset by calcSpeed(), to avoid overflow, so components that rely on
+     * getCycles() returning steadily increasing values should also be prepared for a reset at any time.
+     *
+     * @this {CPU}
+     * @param {boolean} [fScaled] is true if the caller wants a cycle count relative to a multiplier of 1
+     * @return {number}
+     */
+    getCycles(fScaled)
+    {
+        var nCycles = this.nTotalCycles + this.nRunCycles + this.nBurstCycles - this.nStepCycles;
+        if (fScaled && this.aCounts.nCyclesMultiplier > 1 && this.aCounts.mhz > this.aCounts.mhzDefault) {
+            /*
+             * We could scale the current cycle count by the current effective speed (this.aCounts.mhz); eg:
+             *
+             *      nCycles = Math.round(nCycles / (this.aCounts.mhz / this.aCounts.mhzDefault));
+             *
+             * but that speed will fluctuate somewhat: large fluctuations at first, but increasingly smaller
+             * fluctuations after each burst of instructions that runCPU() executes.
+             *
+             * Alternatively, we can scale the cycle count by the multiplier, which is good in that the
+             * multiplier doesn't vary once the user changes it, but a potential downside is that the
+             * multiplier might be set too high, resulting in a target speed that's higher than the effective
+             * speed is able to reach.
+             *
+             * Also, if multipliers were always limited to a power-of-two, then this could be calculated
+             * with a simple shift.  However, only the "setSpeed" UI binding limits it that way; the Debugger
+             * interface allows any value, as does the CPU "multiplier" parmsCPU property (from the machine's
+             * XML file).
+             */
+            nCycles = Math.round(nCycles / this.aCounts.nCyclesMultiplier);
+        }
+        return nCycles;
+    }
+
+    /**
+     * getCyclesPerSecond()
+     *
+     * This returns the CPU's "base" speed (ie, the original cycles per second defined for the machine)
+     *
+     * @this {CPU}
+     * @return {number}
+     */
+    getCyclesPerSecond()
+    {
+        return this.aCounts.nCyclesPerSecond;
+    }
+
+    /**
+     * resetCycles()
+     *
+     * Resets speed and cycle information as part of any reset() or restore(); this typically occurs during powerUp().
+     * It's important that this be called BEFORE the actual restore() call, because restore() may want to call setSpeed(),
+     * which in turn assumes that all the cycle counts have been initialized to sensible values.
+     *
+     * @this {CPU}
+     */
+    resetCycles()
+    {
+        this.aCounts.mhz = 0;
+        this.nTotalCycles = this.nRunCycles = this.nBurstCycles = this.nStepCycles = 0;
+        this.resetChecksum();
+        this.setSpeed(1);
+    }
+
+    /**
+     * getSpeed()
+     *
+     * @this {CPU}
+     * @return {number} the current speed multiplier
+     */
+    getSpeed()
+    {
+        return this.aCounts.nCyclesMultiplier;
+    }
+
+    /**
+     * getSpeedCurrent()
+     *
+     * @this {CPU}
+     * @return {string} the current speed, in mhz, as a string formatted to two decimal places
+     */
+    getSpeedCurrent()
+    {
+        /*
+         * TODO: Has toFixed() been "fixed" in all browsers (eg, IE) to return a rounded value now?
+         */
+        return ((this.flags.running && this.aCounts.mhz)? (this.aCounts.mhz.toFixed(2) + "Mhz") : "Stopped");
+    }
+
+    /**
+     * getSpeedTarget()
+     *
+     * @this {CPU}
+     * @return {string} the target speed, in mhz, as a string formatted to two decimal places
+     */
+    getSpeedTarget()
+    {
+        /*
+         * TODO: Has toFixed() been "fixed" in all browsers (eg, IE) to return a rounded value now?
+         */
+        return this.aCounts.mhzTarget.toFixed(2) + "Mhz";
+    }
+
+    /**
+     * setSpeed(nMultiplier, fUpdateFocus)
+     *
+     * NOTE: This used to return the target speed, in mhz, but no callers appear to care at this point.
+     *
+     * @this {CPU}
+     * @param {number} [nMultiplier] is the new proposed multiplier (reverts to 1 if the target was too high)
+     * @param {boolean} [fUpdateFocus] is true to update Computer focus
+     * @return {boolean} true if successful, false if not
+     *
+     * @desc Whenever the speed is changed, the running cycle count and corresponding start time must be reset,
+     * so that the next effective speed calculation obtains sensible results.  In fact, when runCPU() initially calls
+     * setSpeed() with no parameters, that's all this function does (it doesn't change the current speed setting).
+     */
+    setSpeed(nMultiplier, fUpdateFocus)
+    {
+        var fSuccess = false;
+        if (nMultiplier !== undefined) {
+            /*
+             * If we haven't reached 80% (0.8) of the current target speed, revert to a multiplier of one (1).
+             */
+            if (this.aCounts.mhz / this.aCounts.mhzTarget < 0.8) {
+                nMultiplier = 1;
+            } else {
+                fSuccess = true;
+            }
+            this.aCounts.nCyclesMultiplier = nMultiplier;
+            var mhz = this.aCounts.mhzDefault * this.aCounts.nCyclesMultiplier;
+            if (this.aCounts.mhzTarget != mhz) {
+                this.aCounts.mhzTarget = mhz;
+                var sSpeed = this.getSpeedTarget();
+                var controlSpeed = this.bindings["setSpeed"];
+                if (controlSpeed) controlSpeed.textContent = sSpeed;
+                this.println("target speed: " + sSpeed);
+            }
+            if (fUpdateFocus && this.cmp) this.cmp.updateFocus();
+        }
+        this.addCycles(this.nRunCycles);
+        this.nRunCycles = 0;
+        this.aCounts.msStartRun = Usr.getTime();
+        this.aCounts.msEndThisRun = 0;
+        this.calcCycles();
+        return fSuccess;
+    }
+
+    /**
+     * calcSpeed(nCycles, msElapsed)
+     *
+     * @this {CPU}
+     * @param {number} nCycles
+     * @param {number} msElapsed
+     */
+    calcSpeed(nCycles, msElapsed)
+    {
+        if (msElapsed) {
+            this.aCounts.mhz = Math.round(nCycles / (msElapsed * 10)) / 100;
+            if (msElapsed >= 86400000) {
+                this.nTotalCycles = 0;
+                if (this.chipset) this.chipset.updateAllTimers(true);
+                this.setSpeed();        // reset all counters once per day so that we never have to worry about overflow
+            }
+        }
+    }
+
+    /**
+     * calcStartTime()
+     *
+     * @this {CPU}
+     */
+    calcStartTime()
+    {
+        if (this.aCounts.nCyclesRecalc >= this.aCounts.nCyclesPerSecond) {
+            this.calcCycles(true);
+        }
+        this.aCounts.nCyclesThisRun = 0;
+        this.aCounts.msStartThisRun = Usr.getTime();
+
+        /*
+         * Try to detect situations where the browser may have throttled us, such as when the user switches
+         * to a different tab; in those situations, Chrome and Safari may restrict setTimeout() callbacks
+         * to roughly one per second.
+         *
+         * Another scenario: the user resizes the browser window.  setTimeout() callbacks are not throttled,
+         * but there can still be enough of a lag between the callbacks that CPU speed will be noticeably
+         * erratic if we don't compensate for it here.
+         *
+         * We can detect throttling/lagging by verifying that msEndThisRun (which was set at the end of the
+         * previous run and includes any requested sleep time) is comparable to the current msStartThisRun;
+         * if the delta is significant, we compensate by bumping msStartRun forward by that delta.
+         *
+         * This shouldn't be triggered when the Debugger halts the CPU, because setSpeed() -- which is called
+         * whenever the CPU starts running again -- zeroes msEndThisRun.
+         *
+         * This also won't do anything about other internal delays; for example, Debugger message() calls.
+         * By the time the message() function has called yieldCPU(), the cost of the message has already been
+         * incurred, so it will be end up being charged against the instruction(s) that triggered it.
+         *
+         * TODO: Consider calling yieldCPU() sooner from message(), so that it can arrange for the msEndThisRun
+         * "snapshot" to occur sooner; it's unclear, however, whether that will really improve the CPU's ability
+         * to hit its target speed, since you would expect any instruction that displays a message to be an
+         * EXTREMELY slow instruction.
+         */
+        if (this.aCounts.msEndThisRun) {
+            var msDelta = this.aCounts.msStartThisRun - this.aCounts.msEndThisRun;
+            if (msDelta > this.aCounts.msPerYield) {
+                if (MAXDEBUG) this.println("large time delay: " + msDelta + "ms");
+                this.aCounts.msStartRun += msDelta;
+                /*
+                 * Bumping msStartRun forward should NEVER cause it to exceed msStartThisRun; however, just
+                 * in case, I make absolutely sure it cannot happen, since doing so could result in negative
+                 * speed calculations.
+                 */
+
+                if (this.aCounts.msStartRun > this.aCounts.msStartThisRun) {
+                    this.aCounts.msStartRun = this.aCounts.msStartThisRun;
+                }
+            }
+        }
+    }
+
+    /**
+     * calcRemainingTime()
+     *
+     * @this {CPU}
+     * @return {number}
+     */
+    calcRemainingTime()
+    {
+        this.aCounts.msEndThisRun = Usr.getTime();
+
+        var msYield = this.aCounts.msPerYield;
+        if (this.aCounts.nCyclesThisRun) {
+            /*
+             * Normally, we would assume we executed a full quota of work over msPerYield, but since the CPU
+             * now has the option of calling yieldCPU(), that might not be true.  If nCyclesThisRun is correct, then
+             * the ratio of nCyclesThisRun/nCyclesPerYield should represent the percentage of work we performed,
+             * and so applying that percentage to msPerYield should give us a better estimate of work vs. time.
+             */
+            msYield = Math.round(msYield * this.aCounts.nCyclesThisRun / this.aCounts.nCyclesPerYield);
+        }
+
+        var msElapsedThisRun = this.aCounts.msEndThisRun - this.aCounts.msStartThisRun;
+        var msRemainsThisRun = msYield - msElapsedThisRun;
+
+        /*
+         * We could pass only "this run" results to calcSpeed():
+         *
+         *      nCycles = this.aCounts.nCyclesThisRun;
+         *      msElapsed = msElapsedThisRun;
+         *
+         * but it seems preferable to use longer time periods and hopefully get a more accurate speed.
+         *
+         * Also, if msRemainsThisRun >= 0 && this.aCounts.nCyclesMultiplier == 1, we could pass these results instead:
+         *
+         *      nCycles = this.aCounts.nCyclesThisRun;
+         *      msElapsed = this.aCounts.msPerYield;
+         *
+         * to insure that we display a smooth, constant N Mhz.  But for now, I prefer seeing any fluctuations.
+         */
+        var nCycles = this.nRunCycles;
+        var msElapsed = this.aCounts.msEndThisRun - this.aCounts.msStartRun;
+
+        if (MAXDEBUG && msRemainsThisRun < 0 && this.aCounts.nCyclesMultiplier > 1) {
+            this.println("warning: updates @" + msElapsedThisRun + "ms (prefer " + Math.round(msYield) + "ms)");
+        }
+
+        this.calcSpeed(nCycles, msElapsed);
+
+        if (msRemainsThisRun < 0 || this.aCounts.mhz < this.aCounts.mhzTarget) {
+            /*
+             * Try "throwing out" the effects of large anomalies, by moving the overall run start time up;
+             * ordinarily, this should only happen when the someone is using an external Debugger or some other
+             * tool or feature that is interfering with our overall execution.
+             */
+            if (msRemainsThisRun < -1000) {
+                this.aCounts.msStartRun -= msRemainsThisRun;
+            }
+            /*
+             * If the last burst took MORE time than we allotted (ie, it's taking more than 1 second to simulate
+             * nCyclesPerSecond), all we can do is yield for as little time as possible (ie, 0ms) and hope that the
+             * simulation is at least usable.
+             */
+            msRemainsThisRun = 0;
+        }
+
+        /*
+         * Last but not least, update nCyclesRecalc, so that when runCPU() starts up again and calls calcStartTime(),
+         * it'll be ready to decide if calcCycles() should be called again.
+         */
+        this.aCounts.nCyclesRecalc += this.aCounts.nCyclesThisRun;
+
+        if (DEBUG && this.messageEnabled(Messages.LOG) && msRemainsThisRun) {
+            this.log("calcRemainingTime: " + msRemainsThisRun + "ms to sleep after " + this.aCounts.msEndThisRun + "ms");
+        }
+
+        this.aCounts.msEndThisRun += msRemainsThisRun;
+        return msRemainsThisRun;
+    }
+
+    /**
+     * endBurst()
+     *
+     * @this {CPU}
+     */
+    endBurst()
+    {
+        this.nBurstCycles -= this.nStepCycles;
+        this.nStepCycles = 0;
+    }
+
+    /**
+     * runCPU(fUpdateFocus)
+     *
+     * @this {CPU}
+     * @param {boolean} [fUpdateFocus] is true to update Computer focus
+     */
+    runCPU(fUpdateFocus)
+    {
+        if (!this.setBusy(true)) {
+            this.updateCPU();
+            if (this.cmp) this.cmp.stop(Usr.getTime(), this.getCycles());
+            return;
+        }
+
+        this.startCPU(fUpdateFocus);
+
+        /*
+         *  calcStartTime() initializes the cycle counter and timestamp for this runCPU() invocation, and optionally
+         *  recalculates the the maximum number of cycles for each burst if the nCyclesRecalc threshold has been reached.
+         */
+        this.calcStartTime();
+        try {
+            do {
+                var nCyclesPerBurst = (this.flags.checksum? 1 : this.aCounts.nCyclesPerBurst);
+
+                if (this.chipset) {
+                    this.chipset.updateAllTimers();
+                    nCyclesPerBurst = this.chipset.getTimerCycleLimit(0, nCyclesPerBurst);
+                    nCyclesPerBurst = this.chipset.getRTCCycleLimit(nCyclesPerBurst);
+                }
+
+                /*
+                 * nCyclesPerBurst is how many cycles we WANT to run on each iteration of stepCPU(), but it may run
+                 * significantly less (or slightly more, since we can't execute partial instructions).
+                 */
+                try {
+                    this.stepCPU(nCyclesPerBurst);
+                }
+                catch(exception) {
+                    if (typeof exception != "number") throw exception;
+                    if (MAXDEBUG) this.println("CPU exception " + Str.toHexByte(exception));
+                    /*
+                     * TODO: If we ever get into a situation where every single instruction is generating a fault
+                     * (eg, if an 8088 executes opcode 0xFF 0xFF, which is incorrectly routed to helpFault() instead
+                     * of fnGRPUndefined()), the browser may hang because we're failing to yield often enough.
+                     * This is likely because the thrown exceptions are taking MUCH longer than normal instructions,
+                     * throwing off our burst calculations.  We need to either adjust the burst or break out of the
+                     * DO-WHILE loop on every exception.
+                     */
+                }
+
+                /*
+                 * nBurstCycles, less any remaining nStepCycles, is how many cycles stepCPU() ACTUALLY ran (nCycles).
+                 * We add that to nCyclesThisRun, as well as nRunCycles, which is the cycle count since the CPU first
+                 * started running.
+                 */
+                var nCycles = this.nBurstCycles - this.nStepCycles;
+                this.nRunCycles += nCycles;
+                this.aCounts.nCyclesThisRun += nCycles;
+                this.addCycles(0, true);
+                this.updateChecksum(nCycles);
+
+                this.aCounts.nCyclesNextVideoUpdate -= nCycles;
+                if (this.aCounts.nCyclesNextVideoUpdate <= 0) {
+                    this.aCounts.nCyclesNextVideoUpdate += this.aCounts.nCyclesPerVideoUpdate;
+                    if (this.cmp) this.cmp.updateVideo();
+                }
+
+                this.aCounts.nCyclesNextStatusUpdate -= nCycles;
+                if (this.aCounts.nCyclesNextStatusUpdate <= 0) {
+                    this.aCounts.nCyclesNextStatusUpdate += this.aCounts.nCyclesPerStatusUpdate;
+                    if (this.cmp) this.cmp.updateStatus();
+                }
+
+                this.aCounts.nCyclesNextYield -= nCycles;
+                if (this.aCounts.nCyclesNextYield <= 0) {
+                    this.aCounts.nCyclesNextYield += this.aCounts.nCyclesPerYield;
+                    break;
+                }
+            } while (this.flags.running);
+        }
+        catch (e) {
+            this.stopCPU();
+            this.updateCPU();
+            if (this.cmp) this.cmp.stop(Usr.getTime(), this.getCycles());
+            this.setBusy(false);
+            this.setError(e.stack || e.message);
+            return;
+        }
+        setTimeout(this.onRunTimeout, this.calcRemainingTime());
+    }
+
+    /**
+     * startCPU(fUpdateFocus)
+     *
+     * WARNING: Other components must use runCPU() to get the CPU running; this is a runCPU() helper function only.
+     *
+     * @param {boolean} [fUpdateFocus]
+     */
+    startCPU(fUpdateFocus)
+    {
+        if (!this.flags.running) {
+            /*
+             *  setSpeed() without a speed parameter leaves the selected speed in place, but also resets the
+             *  cycle counter and timestamp for the current series of runCPU() calls, calculates the maximum number
+             *  of cycles for each burst based on the last known effective CPU speed, and resets the nCyclesRecalc
+             *  threshold counter.
+             */
+            this.setSpeed();
+            if (this.cmp) this.cmp.start(this.aCounts.msStartRun, this.getCycles());
+            this.flags.running = true;
+            this.flags.starting = true;
+            if (this.chipset) this.chipset.start();
+            var controlRun = this.bindings["run"];
+            if (controlRun) controlRun.textContent = "Halt";
+            if (this.cmp) {
+                this.cmp.updateStatus(true);
+                if (fUpdateFocus) this.cmp.updateFocus(true);
+            }
+        }
+    }
+
+    /**
+     * stepCPU(nMinCycles)
+     *
+     * This will be implemented by the X86CPU component.
+     *
+     * @this {CPU}
+     * @param {number} nMinCycles (0 implies a single-step, and therefore breakpoints should be ignored)
+     * @return {number} of cycles executed; 0 indicates that the last instruction was not executed
+     */
+    stepCPU(nMinCycles)
+    {
+        return 0;
+    }
+
+    /**
+     * stopCPU(fComplete)
+     *
+     * For use by any component that wants to stop the CPU.
+     *
+     * This similar to yieldCPU(), but it doesn't need to zero nCyclesNextYield to break out of runCPU();
+     * it simply needs to clear fRunning (well, "simply" may be oversimplifying a bit....)
+     *
+     * @this {CPU}
+     * @param {boolean} [fComplete]
+     */
+    stopCPU(fComplete)
+    {
+        this.isBusy(true);
+        this.endBurst();
+        this.addCycles(this.nRunCycles);
+        this.nRunCycles = 0;
+        if (this.flags.running) {
+            this.flags.running = false;
+            if (this.chipset) this.chipset.stop();
+            var controlRun = this.bindings["run"];
+            if (controlRun) controlRun.textContent = "Run";
+        }
+        this.flags.complete = fComplete;
+    }
+
+    /**
+     * updateCPU(fForce)
+     *
+     * This used to be performed at the end of every stepCPU(), but runCPU() -- which relies upon
+     * stepCPU() -- needed to have more control over when these updates are performed.  However, for
+     * other callers of stepCPU(), such as the Debugger, the combination of stepCPU() + updateCPU()
+     * provides the old behavior.
+     *
+     * @this {CPU}
+     * @param {boolean} [fForce] (true to force a video update; used by the Debugger)
+     */
+    updateCPU(fForce)
+    {
+        if (this.cmp) {
+            this.cmp.updateVideo(fForce);
+            this.cmp.updateStatus(fForce);
+        }
+    }
+
+    /**
+     * yieldCPU()
+     *
+     * Similar to stopCPU() with regard to how it resets various cycle countdown values, but the CPU
+     * remains in a "running" state.
+     *
+     * @this {CPU}
+     */
+    yieldCPU()
+    {
+        this.endBurst();                    // this will break us out of stepCPU()
+        this.aCounts.nCyclesNextYield = 0;  // this will break us out of runCPU(), once we break out of stepCPU()
+        // if (DEBUG) this.nSnapCycles = this.nBurstCycles;
+        /*
+         * The Debugger calls yieldCPU() after every message() to ensure browser responsiveness, but it looks
+         * odd for those messages to show CPU state changes but for the CPU's own status display to not (ditto
+         * for the Video display), so I've added this call to try to keep things looking synchronized.
+         */
+        this.updateCPU();
+    }
+}
+
+/*
+ * Constants that control the frequency at which various updates should occur.
+ *
+ * These values do NOT control the simulation directly.  Instead, they are used by
+ * calcCycles(), which uses the nCyclesPerSecond passed to the constructor as a starting
+ * point and computes the following variables:
+ *
+ *      this.aCounts.nCyclesPerYield         (this.aCounts.nCyclesPerSecond / CPU.YIELDS_PER_SECOND)
+ *      this.aCounts.nCyclesPerVideoUpdate   (this.aCounts.nCyclesPerSecond / CPU.VIDEO_UPDATES_PER_SECOND)
+ *      this.aCounts.nCyclesPerStatusUpdate  (this.aCounts.nCyclesPerSecond / CPU.STATUS_UPDATES_PER_SECOND)
+ *
+ * The above variables are also multiplied by any cycle multiplier in effect, via setSpeed(),
+ * and then they're used to initialize another set of variables for each runCPU() iteration:
+ *
+ *      this.aCounts.nCyclesNextYield        <= this.aCounts.nCyclesPerYield
+ *      this.aCounts.nCyclesNextVideoUpdate  <= this.aCounts.nCyclesPerVideoUpdate
+ *      this.aCounts.nCyclesNextStatusUpdate <= this.aCounts.nCyclesPerStatusUpdate
+ */
+CPU.YIELDS_PER_SECOND         = 30;
+CPU.VIDEO_UPDATES_PER_SECOND  = 60;     // WARNING: if you change this, beware of side-effects in the Video component
+CPU.STATUS_UPDATES_PER_SECOND = 2;
+
+CPU.BUTTONS = ["power", "reset"];
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/x86seg.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * NOTE: The protected-mode support in this module was initially added for 80286 support, and is
+ * currently being upgraded for 80386 support.  In a perfect world, all 80386-related support would
+ * be disabled/skipped whenever the processor is merely an 80286.  And in fact, that's the case
+ * with some of the early changes (eg, skipping X86.DESC.EXT.BASE2431 and X86.DESC.EXT.LIMIT1619
+ * fields unless the processor is an 80386).
+ *
+ * However, the reality is that I won't always be that strict, either because I'm lazy or I don't
+ * want to risk a run-time performance hit or (more pragmatically) because any 80286 code you're likely
+ * to run probably won't attempt to use descriptor types or other features unique to the 80386 anyway,
+ * so the extra paranoia may not be worth the effort.  Ultimately, I would like to see the code tailor
+ * itself to the current CPU model, generally with model-specific functions, but that's a lot of work.
+ */
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class X86Seg {
+    /**
+     * X86Seg(cpu, sName)
+     *
+     * @this {X86Seg}
+     * @param {X86CPU} cpu
+     * @param {number} id
+     * @param {string} [sName] segment register name
+     * @param {boolean} [fProt] true if segment register used exclusively in protected-mode (eg, segLDT)
+     */
+    constructor(cpu, id, sName, fProt)
+    {
+        this.cpu = cpu;
+        this.dbg = cpu.dbg;
+        this.id = id;
+        this.sName = sName || "";
+        this.sel = 0;
+        this.limit = 0xffff;
+        this.offMax = this.limit + 1;
+        this.base = 0;
+        this.acc = this.type = 0;
+        this.ext = 0;
+        this.cpl = this.dpl = 0;
+        this.addrDesc = X86.ADDR_INVALID;
+        this.sizeData = this.sizeAddr = 2;
+        this.maskData = this.maskAddr = 0xffff;
+
+        this.loadV86 = this.loadReal;
+        this.checkReadV86 = this.checkReadReal;
+        this.checkWriteV86 = this.checkWriteReal;
+
+        /*
+         * Preallocated object for "probed" segment loads
+         */
+        this.probe = {
+            sel: -1, base: 0, limit: 0, acc: 0, type: 0, ext: 0, addrDesc: X86.ADDR_INVALID
+        };
+
+        /*
+         * The following properties are used for CODE segments only (ie, segCS); if the process of loading
+         * CS also requires a stack switch, then fStackSwitch will be set to true; additionally, if the stack
+         * switch was the result of a CALL (ie, fCall is true) and one or more (up to 32) parameters are on
+         * the old stack, they will be copied to awParms, and then once the stack is switched, the parameters
+         * will be pushed from awParms onto the new stack.
+         *
+         * The typical ways of loading a new segment into CS are JMPF, CALLF (or INT), and RETF (or IRET),
+         * via CPU functions setCSIP() and helpINT(), which use segCS.loadCode() and segCS.loadIDT(), respectively.
+         *
+         * loadCode() requires an fCall value: null means NO privilege level transition may occur, true
+         * allows a stack switch and a privilege transition to a numerically lower privilege, and false allows
+         * a stack restore and a privilege transition to a numerically greater privilege.
+         *
+         * loadIDT() sets fCall to true unconditionally in protected-mode (fCall has no meaning in real-mode).
+         */
+        if (this.id == 1) {     // X86Seg.ID.CODE (don't use until it's defined, or the Closure Compiler won't inline it)
+            this.offIP = 0;
+            this.fCall = null;
+            this.fStackSwitch = false;
+            this.awParms = new Array(32);
+            this.aCallBreaks = [];
+        }
+        this.updateMode(true, fProt);
+    }
+
+    /**
+     * addCallBreak(fn)
+     *
+     * Returns a "call break" address in an [off, sel] array.  The given function, fn(), is called
+     * whenever that address is called, and if fn() returns false, then the call is skipped.  Otherwise,
+     * the call is performed (ie, the old CS:[E]IP is pushed on the stack, and CS:[E]IP is set to the
+     * "call break" address.  Which is probably a bad idea, so your function should probably always
+     * return false.  Just sayin'.  TODO: Should probably just force all "call break" calls to be skipped.
+     *
+     * @this {X86Seg}
+     * @param {function()} fn
+     * @return {Array.<number>} containing offset and selector of call-break address
+     */
+    addCallBreak(fn)
+    {
+        this.aCallBreaks.push(fn);
+        return [this.aCallBreaks.length, X86Seg.CALLBREAK_SEL];
+    }
+
+    /**
+     * loadCode(off, sel, fCall)
+     *
+     * A simple wrapper function that encapsulates setting offIP and fCall for segCS loads.
+     *
+     * @this {X86Seg}
+     * @param {number} off
+     * @param {number} sel
+     * @param {boolean|undefined} fCall is true if CALLF in progress, false if RETF/IRET in progress, undefined otherwise
+     * @return {number} base address of selected segment, or X86.ADDR_INVALID if error
+     */
+    loadCode(off, sel, fCall)
+    {
+        this.offIP = off;
+        this.fCall = fCall;
+        return this.load(sel);
+    }
+
+    /**
+     * loadReal(sel, fProbe)
+     *
+     * The default segment load() function for real-mode.
+     *
+     * @this {X86Seg}
+     * @param {number} sel
+     * @param {boolean} [fProbe] (here only to make the function signatures of loadReal() and loadProt() match)
+     * @return {number} base address of selected segment
+     */
+    loadReal(sel, fProbe)
+    {
+        this.sel = sel & 0xffff;
+        /*
+         * Loading a new value into a segment register in real-mode alters ONLY the selector and the base;
+         * all other attributes (eg, limit, operand size, address size, etc) are unchanged.  If you run any
+         * code that switches to protected-mode, loads a 32-bit code segment, and then switches back to
+         * real-mode, it is THAT code's responsibility to load a 16-bit segment into CS before returning to
+         * real-mode; otherwise, your machine will probably be toast.
+         */
+        return this.base = this.sel << 4;
+    }
+
+    /**
+     * loadProt(sel, fProbe)
+     *
+     * This replaces the segment's default load() function whenever the segment is notified via updateMode() by the
+     * CPU's setProtMode() that the processor is now in protected-mode.
+     *
+     * Segments in protected-mode are referenced by selectors, which are indexes into descriptor tables (GDT or LDT)
+     * whose descriptors are 4-word (8-byte) entries:
+     *
+     *      word 0: segment limit (0-15)
+     *      word 1: base address low
+     *      word 2: base address high (0-7), segment type (8-11), descriptor type (12), DPL (13-14), present bit (15)
+     *      word 3: used only on 80386 and up (should be set to zero for upward compatibility)
+     *
+     * See X86.DESC for offset and bit definitions.
+     *
+     * IDT descriptor entries are handled separately by loadIDT(), which is mapped to loadIDTReal() or loadIDTProt().
+     *
+     * @this {X86Seg}
+     * @param {number} sel
+     * @param {boolean} [fProbe]
+     * @return {number} base address of selected segment, or X86.ADDR_INVALID if error
+     */
+    loadProt(sel, fProbe)
+    {
+        var addrDT;
+        var addrDTLimit;
+        var cpu = this.cpu;
+
+        /*
+         * Some instructions (eg, CALLF) load a 32-bit value for the selector, while others (eg, LDS) do not;
+         * however, in ALL cases, only the low 16 bits are significant.
+         */
+        sel &= 0xffff;
+
+        if (!(sel & X86.SEL.LDT)) {
+            addrDT = cpu.addrGDT;
+            addrDTLimit = cpu.addrGDTLimit;
+        } else {
+            addrDT = cpu.segLDT.base;
+            addrDTLimit = (addrDT + cpu.segLDT.limit)|0;
+        }
+        /*
+         * The ROM BIOS POST executes some test code in protected-mode without properly initializing the LDT,
+         * which has no bearing on the ROM's own code, because it never loads any LDT selectors, but if at the same
+         * time our Debugger attempts to validate a selector in one of its breakpoints, that could cause some grief.
+         *
+         * Fortunately, the Debugger now has its own interface, probeDesc(), so that should no longer be a concern.
+         */
+        if (addrDT) {
+            var addrDesc = (addrDT + (sel & X86.SEL.MASK))|0;
+            if ((addrDTLimit - addrDesc)|0 >= 7) {
+                /*
+                 * TODO: This is the first of many steps toward accurately counting cycles in protected mode;
+                 * I simply noted that "POP segreg" takes 5 cycles in real mode and 20 in protected mode, so I'm
+                 * starting with a 15-cycle difference.  Obviously the difference will vary with the instruction,
+                 * and will be much greater whenever the load fails.
+                 */
+                cpu.nStepCycles -= 15;
+                return this.loadDesc8(addrDesc, sel, fProbe);
+            }
+            if (this.id < X86Seg.ID.VER) {
+                X86.helpFault.call(cpu, fProbe && this.id == X86Seg.ID.STACK? X86.EXCEPTION.TS_FAULT : X86.EXCEPTION.GP_FAULT, sel & X86.ERRCODE.SELMASK);
+            }
+        }
+        return X86.ADDR_INVALID;
+    }
+
+    /**
+     * loadIDTReal(nIDT)
+     *
+     * @this {X86Seg}
+     * @param {number} nIDT
+     * @return {number} address from selected vector
+     */
+    loadIDTReal(nIDT)
+    {
+        var cpu = this.cpu;
+        /*
+         * NOTE: The COMPAQ DeskPro 386 ROM loads the IDTR for the real-mode IDT with a limit of 0xffff instead
+         * of the normal 0x3ff.  A limit higher than 0x3ff is OK, since all real-mode IDT entries are 4 bytes, and
+         * there's no way to issue an interrupt with a vector > 0xff.  Just something to be aware of.
+         */
+
+        /*
+         * Intel documentation for INT/INTO under "REAL ADDRESS MODE EXCEPTIONS" says:
+         *
+         *      "[T]he 80286 will shut down if the SP = 1, 3, or 5 before executing the INT or INTO instruction--due to lack of stack space"
+         *
+         * TODO: Verify that 80286 real-mode actually enforces the above.  See http://www.pcjs.org/pubs/pc/reference/intel/80286/progref/#page-260
+         */
+        var addrIDT = cpu.addrIDT + (nIDT << 2);
+        var off = cpu.getShort(addrIDT);
+        cpu.regPS &= ~(X86.PS.TF | X86.PS.IF);
+        return (this.load(cpu.getShort(addrIDT + 2)) + off)|0;
+    }
+
+    /**
+     * loadIDTProt(nIDT)
+     *
+     * @this {X86Seg}
+     * @param {number} nIDT
+     * @return {number} address from selected vector, or X86.ADDR_INVALID if error
+     */
+    loadIDTProt(nIDT)
+    {
+        var cpu = this.cpu;
+
+
+        nIDT <<= 3;
+        var addrDesc = (cpu.addrIDT + nIDT)|0;
+        if (((cpu.addrIDTLimit - addrDesc)|0) >= 7) {
+            this.fCall = true;
+            var addr = this.loadDesc8(addrDesc, nIDT);
+            if (addr !== X86.ADDR_INVALID) addr += this.offIP;
+            return addr;
+        }
+        X86.helpFault.call(cpu, X86.EXCEPTION.GP_FAULT, nIDT | X86.ERRCODE.IDT);
+        return X86.ADDR_INVALID;
+    }
+
+    /**
+     * checkReadReal(off, cb)
+     *
+     * TODO: Invoke X86.helpFault.call(this.cpu, X86.EXCEPTION.GP_FAULT) if off+cb is beyond offMax on 80186 and up;
+     * also, determine whether helpFault() call should include an error code, since this is happening in real-mode.
+     *
+     * @this {X86Seg}
+     * @param {number} off is a segment-relative offset
+     * @param {number} cb is number of bytes to check (1, 2 or 4)
+     * @return {number} corresponding linear address if valid, or X86.ADDR_INVALID if error (TODO: No error conditions yet)
+     */
+    checkReadReal(off, cb)
+    {
+        return (this.base + off)|0;
+    }
+
+    /**
+     * checkWriteReal(off, cb)
+     *
+     * TODO: Invoke X86.helpFault.call(this.cpu, X86.EXCEPTION.GP_FAULT) if off+cb is beyond offMax on 80186 and up;
+     * also, determine whether helpFault() call should include an error code, since this is happening in real-mode.
+     *
+     * @this {X86Seg}
+     * @param {number} off is a segment-relative offset
+     * @param {number} cb is number of bytes to check (1, 2 or 4)
+     * @return {number} corresponding linear address if valid, or X86.ADDR_INVALID if error (TODO: No error conditions yet)
+     */
+    checkWriteReal(off, cb)
+    {
+        return (this.base + off)|0;
+    }
+
+    /**
+     * checkReadProt(off, cb)
+     *
+     * @this {X86Seg}
+     * @param {number} off is a segment-relative offset
+     * @param {number} cb is number of bytes to check (1, 2 or 4)
+     * @return {number} corresponding linear address if valid, or X86.ADDR_INVALID if not
+     */
+    checkReadProt(off, cb)
+    {
+        /*
+         * Since off could be a 32-bit value with the sign bit (bit 31) set, we must convert
+         * it to an unsigned value using ">>>"; offMax was already converted at segment load time.
+         */
+        if ((off >>> 0) + cb <= this.offMax) {
+            return (this.base + off)|0;
+        }
+        return this.checkReadProtDisallowed(off, cb);
+    }
+
+    /**
+     * checkReadProtDown(off, cb)
+     *
+     * @this {X86Seg}
+     * @param {number} off is a segment-relative offset
+     * @param {number} cb is number of bytes to check (1, 2 or 4)
+     * @return {number} corresponding linear address if valid, X86.ADDR_INVALID if not
+     */
+    checkReadProtDown(off, cb)
+    {
+        /*
+         * Since off could be a 32-bit value with the sign bit (bit 31) set, we must convert
+         * it to an unsigned value using ">>>"; offMax was already converted at segment load time.
+         */
+        if ((off >>> 0) + cb > this.offMax) {
+            return (this.base + off)|0;
+        }
+        return this.checkReadProtDisallowed(off, cb);
+    }
+
+    /**
+     * checkReadProtDisallowed(off, cb)
+     *
+     * @this {X86Seg}
+     * @param {number} off is a segment-relative offset
+     * @param {number} cb is number of bytes to check (1, 2 or 4)
+     * @return {number} corresponding linear address if valid, X86.ADDR_INVALID if not
+     */
+    checkReadProtDisallowed(off, cb)
+    {
+        X86.helpFault.call(this.cpu, X86.EXCEPTION.GP_FAULT, 0);
+        return X86.ADDR_INVALID;
+    }
+
+    /**
+     * checkWriteProt(off, cb)
+     *
+     * @this {X86Seg}
+     * @param {number} off is a segment-relative offset
+     * @param {number} cb is number of bytes to check (1, 2 or 4)
+     * @return {number} corresponding linear address if valid, X86.ADDR_INVALID if not
+     */
+    checkWriteProt(off, cb)
+    {
+        /*
+         * Since off could be a 32-bit value with the sign bit (bit 31) set, we must convert
+         * it to an unsigned value using ">>>"; offMax was already converted at segment load time.
+         */
+        if ((off >>> 0) + cb <= this.offMax) {
+            return (this.base + off)|0;
+        }
+        return this.checkWriteProtDisallowed(off, cb);
+    }
+
+    /**
+     * checkWriteProtDown(off, cb)
+     *
+     * @this {X86Seg}
+     * @param {number} off is a segment-relative offset
+     * @param {number} cb is number of bytes to check (1, 2 or 4)
+     * @return {number} corresponding linear address if valid, X86.ADDR_INVALID if not
+     */
+    checkWriteProtDown(off, cb)
+    {
+        /*
+         * Since off could be a 32-bit value with the sign bit (bit 31) set, we must convert
+         * it to an unsigned value using ">>>"; offMax was already converted at segment load time.
+         */
+        if ((off >>> 0) + cb > this.offMax) {
+            return (this.base + off)|0;
+        }
+        return this.checkWriteProtDisallowed(off, cb);
+    }
+
+    /**
+     * checkWriteProtDisallowed(off, cb)
+     *
+     * @this {X86Seg}
+     * @param {number} off is a segment-relative offset
+     * @param {number} cb is number of bytes to check (1, 2 or 4)
+     * @return {number} corresponding linear address if valid, X86.ADDR_INVALID if not
+     */
+    checkWriteProtDisallowed(off, cb)
+    {
+        X86.helpFault.call(this.cpu, X86.EXCEPTION.GP_FAULT, 0);
+        return X86.ADDR_INVALID;
+    }
+
+    /**
+     * checkReadDebugger(off, cb)
+     *
+     * @this {X86Seg}
+     * @param {number} off is a segment-relative offset
+     * @param {number} cb is number of bytes to check (1, 2 or 4)
+     * @return {number} corresponding linear address if valid, or X86.ADDR_INVALID if error
+     */
+    checkReadDebugger(off, cb)
+    {
+        /*
+         * The Debugger doesn't have separate "check" interfaces for real and protected mode,
+         * since it's not performance-critical.  If addrDesc is invalid, then we assume real mode.
+         *
+         * TODO: This doesn't actually check the segment for readability.
+         */
+        if (DEBUGGER) {
+            if (this.addrDesc === X86.ADDR_INVALID ||
+                this.fExpDown && (off >>> 0) + cb > this.offMax ||
+                !this.fExpDown && (off >>> 0) + cb <= this.offMax) {
+                return (this.base + off)|0;
+            }
+        }
+        return X86.ADDR_INVALID;
+    }
+
+    /**
+     * checkWriteDebugger(off, cb)
+     *
+     * @this {X86Seg}
+     * @param {number} off is a segment-relative offset
+     * @param {number} cb is number of bytes to check (1, 2 or 4)
+     * @return {number} corresponding linear address if valid, or X86.ADDR_INVALID if error
+     */
+    checkWriteDebugger(off, cb)
+    {
+        /*
+         * The Debugger doesn't have separate "check" interfaces for real and protected mode,
+         * since it's not performance-critical.  If addrDesc is invalid, then we assume real mode.
+         *
+         * TODO: This doesn't actually check the segment for writability.
+         */
+        if (DEBUGGER) {
+            if (this.addrDesc === X86.ADDR_INVALID ||
+                this.fExpDown && (off >>> 0) + cb > this.offMax ||
+                !this.fExpDown && (off >>> 0) + cb <= this.offMax) {
+                return (this.base + off)|0;
+            }
+        }
+        return X86.ADDR_INVALID;
+    }
+
+    /**
+     * loadDesc(sel, acc, base, limit)
+     *
+     * Used to manually load a segment register from the data provided (see LOADALL386).
+     *
+     * @this {X86Seg}
+     * @param {number} sel
+     * @param {number} acc
+     * @param {number} base
+     * @param {number} limit
+     */
+    loadDesc(sel, acc, base, limit)
+    {
+        this.sel = sel;
+        this.base = base;
+        this.limit = limit;
+        this.offMax = (limit >>> 0) + 1;
+        this.acc = acc;
+        this.type = (acc & X86.DESC.ACC.TYPE.MASK);
+        this.ext = (acc >> 16) & (X86.DESC.EXT.BIG | X86.DESC.EXT.LIMITPAGES);
+
+        var addrDT = (sel & X86.SEL.LDT)? this.cpu.segLDT.base : this.cpu.addrGDT;
+        this.addrDesc = (addrDT + (sel & X86.SEL.MASK))|0;
+
+        /*
+         * NOTE: This code must take care to leave the mode of the TSS, LDT, and VER segment registers alone;
+         * in particular, we must not allow a real-mode LOADALL to modify their mode, because the rest of PCx86
+         * assumes that their mode will never change (they were allocated with fProt set to true).
+         */
+        if (this.id < X86Seg.ID.TSS) this.updateMode(true);
+
+        if (DEBUG) this.messageSeg(sel, base, limit, this.type);
+    }
+
+    /**
+     * loadDesc6(addrDesc, sel)
+     *
+     * Used to load a protected-mode selector that refers to a 6-byte "descriptor cache" entry (see LOADALL286):
+     *
+     *      word 0: base address low
+     *      word 1: base address high (0-7), segment type (8-11), descriptor type (12), DPL (13-14), present bit (15)
+     *      word 2: segment limit (0-15)
+     *
+     * @this {X86Seg}
+     * @param {number} addrDesc is the descriptor address
+     * @param {number} sel is the associated selector
+     * @return {number} base address of selected segment
+     */
+    loadDesc6(addrDesc, sel)
+    {
+        var cpu = this.cpu;
+        var acc = cpu.getShort(addrDesc + 2);
+        var base = cpu.getShort(addrDesc) | ((acc & 0xff) << 16);
+        var limit = cpu.getShort(addrDesc + 4);
+
+        this.sel = sel;
+        this.base = base;
+        this.limit = limit;
+        this.offMax = (limit >>> 0) + 1;
+        this.acc = acc;
+        this.type = (acc & X86.DESC.ACC.TYPE.MASK);
+        this.ext = 0;
+        this.addrDesc = addrDesc;
+
+        /*
+         * NOTE: This code must take care to leave the mode of the TSS, LDT, and VER segment registers alone;
+         * in particular, we must not allow a real-mode LOADALL to modify their mode, because the rest of PCx86
+         * assumes that their mode will never change (they were allocated with fProt set to true).
+         */
+        if (this.id < X86Seg.ID.TSS) this.updateMode(true);
+
+        if (DEBUG) this.messageSeg(sel, base, limit, this.type);
+
+        return base;
+    }
+
+    /**
+     * loadDesc8(addrDesc, sel, fProbe)
+     *
+     * Used to load a protected-mode selector that refers to an 8-byte "descriptor table" (GDT, LDT, IDT) entry:
+     *
+     *      word 0: segment limit (0-15)
+     *      word 1: base address low
+     *      word 2: base address high (0-7), segment type (8-11), descriptor type (12), DPL (13-14), present bit (15)
+     *      word 3: used only on 80386 and up (should be set to zero for upward compatibility)
+     *
+     * See X86.DESC for offset and bit definitions.
+     *
+     * When fProbe is set, we do NOT modify the public properties of the X86Seg object (see class X86Seg above).
+     * We will generate a fault if any of the usual error conditions are detected (and return X86.ADDR_INVALID), but
+     * otherwise, we merely stash all the descriptor values it reads in the X86Seg's private "probe" object.
+     *
+     * Probed loads allow us to deal with complex segment load operations (ie, those involving an implied stack-switch
+     * or task-switch), by allowing us to probe all the new selectors and generate the necessary faults before modifying
+     * any segment registers; if all the probes succeed, then the original load can proceed.
+     *
+     * The next non-probed load of a probed selector will move those probed descriptor values into the X86Seg object,
+     * saving us from having to reload and reparse the descriptor.  However, if a different selector is loaded between
+     * the probed and non-probed loads, the probed data is tossed.
+     *
+     * @this {X86Seg}
+     * @param {number} addrDesc is the descriptor address
+     * @param {number} sel is the associated selector, or nIDT*8 if IDT descriptor
+     * @param {boolean} [fProbe] (true if this is a probe)
+     * @return {number} base address of selected segment, or X86.ADDR_INVALID if error
+     */
+    loadDesc8(addrDesc, sel, fProbe)
+    {
+        var cpu = this.cpu;
+
+        /*
+         * If the previous load was a successful "probed" load of the same segment, then we simply load
+         * up all the cached descriptor values from the probe and return.
+         */
+        if (!fProbe && sel === this.probe.sel) {
+            this.sel = sel;
+            this.base = this.probe.base;
+            this.limit = this.probe.limit;
+            this.offMax = (this.probe.limit >>> 0) + 1;
+            this.acc = this.probe.acc;
+            this.type = this.probe.type;
+            this.ext = this.probe.ext;
+            this.addrDesc = this.probe.addrDesc;
+            this.probe.sel = -1;
+            this.updateMode(true, true, false);
+            return this.base;
+        }
+
+        /*
+         * Any other load, probed or otherwise, should "flush" the probe cache, by setting probe.sel to -1.
+         */
+        this.probe.sel = -1;
+
+        /*
+         * Load the descriptor from memory.
+         */
+        var limit = cpu.getShort(addrDesc + X86.DESC.LIMIT.OFFSET);
+        var acc = cpu.getShort(addrDesc + X86.DESC.ACC.OFFSET);
+        var type = (acc & X86.DESC.ACC.TYPE.MASK);
+        var base = cpu.getShort(addrDesc + X86.DESC.BASE.OFFSET) | ((acc & X86.DESC.ACC.BASE1623) << 16);
+        var ext = cpu.getShort(addrDesc + X86.DESC.EXT.OFFSET);
+        var selMasked = sel & X86.SEL.MASK;
+
+        if (I386 && cpu.model >= X86.MODEL_80386) {
+            var limitOrig = limit;
+            base |= (ext & X86.DESC.EXT.BASE2431) << 16;
+            limit |= (ext & X86.DESC.EXT.LIMIT1619) << 16;
+            if (ext & X86.DESC.EXT.LIMITPAGES) limit = (limit << 12) | 0xfff;
+        }
+
+        switch (this.id) {
+
+        case X86Seg.ID.CODE:
+
+            /*
+             * NOTE: Since we are X86Seg.ID.CODE, we can use this.cpl instead of the more convoluted
+             * this.cpu.segCS.cpl.
+             */
+            var fCall = this.fCall;
+            this.fStackSwitch = false;
+
+            /*
+             * This special bit of code is currently used only by the Debugger, when it needs to inject
+             * a 16:32 callback address into the machine that it can intercept calls to.  We call these
+             * "call break" addresses, because they're essentially breakpoints that only operate when
+             * a particular address is called; specifically, an address with selector 0x0001 and an offset
+             * that forms a (1-based) index into the aCallBreaks function table.
+             *
+             * In protected-mode, any null selector, including 0x0001 (null with an RPL of 1), is
+             * an invalid CS selector, and while it's not inconceivable that an operating system might
+             * use such a selector for some strange purpose, I've not seen such an operating system.
+             * And in any case, those operating systems are not likely to trigger the Debugger's call to
+             * addCallBreak(), so no call breaks will be generated, and this code will never execute.
+             *
+             * TODO: If we ever need this to be mode-independent, it can be moved somewhere where it will
+             * trigger for both real and protected-mode code segment loads, because CALLBREAK_SEL (0x0001)
+             * is also a very unlikely real-mode CS value (but again, not inconceivable).  I think this is
+             * a reasonable solution, and it's likely the best we can do without injecting code into the
+             * machine that we could address -- and even then, it would not be a mode-independent address.
+             */
+            if (fCall && sel == X86Seg.CALLBREAK_SEL && this.aCallBreaks.length) {
+                var iBreak = this.offIP - 1;
+                var fnCallBreak = this.aCallBreaks[iBreak];
+
+                if (fnCallBreak && !fnCallBreak()) {
+                    return X86.ADDR_INVALID;
+                }
+            }
+
+            var rpl = sel & X86.SEL.RPL;
+            var dpl = (acc & X86.DESC.ACC.DPL.MASK) >> X86.DESC.ACC.DPL.SHIFT;
+
+            var sizeGate = -1, selCode, cplOld, cplNew, fIDT;
+            var addrTSS, offSP, lenSP, regSPPrev, regSSPrev, regPSClear, regSP;
+
+            if (!selMasked) {
+                /*
+                 * selMasked is really the descriptor table offset, and a zero offset is fine for the IDT,
+                 * and it's probably fine for the LDT, but it's definitely NOT fine for the GDT, because
+                 * that's a reference to the null selector.  A null selector is allowed in DS, ES, FS, or GS,
+                 * but never CS or SS.  Since there's no parameter that tells us which table we're using,
+                 * we have to check manually.
+                 *
+                 * If we ARE attempting to load a null selector from the GDT, then we zero type, ensuring that
+                 * sizeGate will remain invalid (-1), triggering a GP_FAULT below.
+                 */
+                if (addrDesc >= cpu.addrGDT && addrDesc < cpu.addrGDTLimit) type = 0;
+            }
+
+            if (type >= X86.DESC.ACC.TYPE.CODE_EXECONLY) {
+                /*
+                 * There are three basic ways to load a new code segment (ignoring special cases like LOADALL):
+                 *
+                 *      1) CALLF (fCall is true)
+                 *      2) RETF (fCall is false)
+                 *      3) JMPF (fCall is undefined)
+                 *
+                 * Also, note that if fProbe is set, we're being called on behalf of a gate, in which case the
+                 * gate logic will examine the relative privileges.
+                 */
+                if (fProbe != null) {
+                    sizeGate = 0;
+                }
+                else if (fCall !== false) {
+                    /*
+                     * We deal with CALLF/JMPF first.  We've already ascertained that the selector type is a
+                     * segment, not a gate, so the next important distinction is CONFORMING vs. non-CONFORMING.
+                     *
+                     * For a CONFORMING target, we must verify that its DPL <= CPL.  For a non-CONFORMING target,
+                     * we must verify that RPL <= CPL and DPL == CPL.  Assuming both those tests pass, we must also
+                     * ensure that the current CPL is recorded as the new RPL (that is, the RPL bits of sel must be
+                     * updated).
+                     */
+                    if (type & X86.DESC.ACC.TYPE.CONFORMING) {
+                        if (dpl <= this.cpl) {
+                            sizeGate = 0;
+                        }
+                    } else {
+                        if (rpl <= this.cpl && dpl == this.cpl) {
+                            sizeGate = 0;
+                        }
+                    }
+                    if (!sizeGate) {
+                        sel = (sel & ~X86.SEL.RPL) | (this.cpl & X86.SEL.RPL);
+                    }
+                }
+                else {
+                    /*
+                     * We deal with RETF next.  For starters, we must verify that RPL >= CPL.  Moreover, if
+                     * RPL > CPL, then we have a privilege level change that requires a stack switch, assuming
+                     * the stack selector is acceptable.
+                     */
+                    if (rpl >= this.cpl) {
+                        if (rpl > this.cpl) {
+                            /*
+                             * TODO: See if we can defer calling setSS() and setSP() until AFTER the final checks
+                             * below, because if, for example, the new CS is not PRESENT, we must generate a fault,
+                             * which in turn must restore the original stack, which means helpRETF() must snapshot
+                             * the stack registers.
+                             */
+                            regSP = cpu.popWord();
+                            cpu.setSS(cpu.popWord(), true);
+                            cpu.setSP(regSP);
+                            this.fStackSwitch = true;
+                        }
+                        sizeGate = 0;
+                    }
+                }
+            }
+            else if (type == X86.DESC.ACC.TYPE.TSS286 || type == X86.DESC.ACC.TYPE.TSS386) {
+                if (!this.switchTSS(sel, fCall)) {
+                    return X86.ADDR_INVALID;
+                }
+                return this.base;
+            }
+            else if (type == X86.DESC.ACC.TYPE.GATE_CALL) {
+                sizeGate = 2;
+                regPSClear = 0;
+                if (rpl < this.cpl) rpl = this.cpl;     // set RPL to max(RPL,CPL) for call gates
+            }
+            else if (type == X86.DESC.ACC.TYPE.GATE386_CALL) {
+                sizeGate = 4;
+                regPSClear = 0;
+                if (rpl < this.cpl) rpl = this.cpl;     // set RPL to max(RPL,CPL) for call gates
+            }
+            else if (type == X86.DESC.ACC.TYPE.GATE286_INT) {
+                sizeGate = 2;
+                regPSClear = (X86.PS.VM | X86.PS.NT | X86.PS.TF | X86.PS.IF);
+
+            }
+            else if (type == X86.DESC.ACC.TYPE.GATE386_INT) {
+                sizeGate = 4;
+                regPSClear = (X86.PS.VM | X86.PS.NT | X86.PS.TF | X86.PS.IF);
+
+            }
+            else if (type == X86.DESC.ACC.TYPE.GATE286_TRAP) {
+                sizeGate = 2;
+                regPSClear = (X86.PS.VM | X86.PS.NT | X86.PS.TF);
+
+            }
+            else if (type == X86.DESC.ACC.TYPE.GATE386_TRAP) {
+                sizeGate = 4;
+                regPSClear = (X86.PS.VM | X86.PS.NT | X86.PS.TF);
+
+            }
+            else if (type == X86.DESC.ACC.TYPE.GATE_TASK) {
+                if (!this.switchTSS(base & 0xffff, fCall)) {
+                    return X86.ADDR_INVALID;
+                }
+                return this.base;
+            }
+
+            if (sizeGate > 0 && !(acc & X86.DESC.ACC.PRESENT)) sizeGate = 0;
+
+            if (sizeGate > 0) {
+                /*
+                 * Note that since GATE_INT/GATE_TRAP descriptors should appear in the IDT only, that means sel
+                 * will actually be nIDT * 8, which means the rpl will always be zero; additionally, the nWords
+                 * portion of ACC should always be zero, but that's really dependent on the descriptor being properly
+                 * set (which we assert above).
+                 */
+                cplOld = this.cpl;
+                fIDT = (addrDesc == cpu.addrIDT + sel);
+
+                /*
+                 * Software interrupts (where fIDT is true and cpu.nFault < 0) require an additional test:
+                 * if DPL < CPL, then we must fall into the GP_FAULT code at the end of this case.
+                 */
+                if (rpl <= dpl && (!fIDT || cpu.nFault >= 0 || cplOld <= dpl))  {
+
+                    /*
+                     * For gates, there is no "base" and "limit", but rather "selector" and "offset"; the selector
+                     * is located where the first 16 bits of base are normally stored, and the offset comes from the
+                     * original limit and ext fields.
+                     *
+                     * TODO: Verify the PRESENT bit of the gate descriptor, and issue NP_FAULT as appropriate.
+                     */
+                    selCode = base & 0xffff;
+                    if (I386 && (type & X86.DESC.ACC.TYPE.NONSEG_386)) {
+                        limit = limitOrig | (ext << 16);
+                    }
+
+                    var selStack = 0, offStack = 0;
+                    cplNew = (selCode & X86.SEL.RPL);
+
+                    /*
+                     * If a stack switch is required, we must perform "probed" loads of both the new selCode
+                     * and selStack segments, so that if either probe fails, a fault will be generated while the
+                     * old code segment is still loaded.
+                     */
+                    if (cplNew < cplOld) {
+                        /*
+                         * Intel pseudo-code suggests that selStack should be "probed" before selCode, but it also
+                         * implies that we need to have the DPL of selCode in order to select the correct selStack,
+                         * so who knows...?
+                         */
+                        if (this.loadProt(selCode, true) === X86.ADDR_INVALID) {
+                            return X86.ADDR_INVALID;
+                        }
+                        /*
+                         * Intel pseudo-code suggests that the TSS stack pointer offset is based on the DPL of selCode
+                         * rather than the RPL of selCode.  TODO: Check for instances where DPL and RPL of selCode differ,
+                         * and then figure out which should really be used.
+                         */
+                        addrTSS = cpu.segTSS.base;
+                        if (!I386 || !(cpu.segTSS.type & X86.DESC.ACC.TYPE.NONSEG_386)) {
+                            offSP = (cplNew << 2) + X86.TSS286.CPL0_SP;
+                            lenSP = 2;
+                        } else {
+                            offSP = (cplNew << 3) + X86.TSS386.CPL0_ESP;
+                            lenSP = 4;
+                        }
+                        selStack = cpu.getShort(addrTSS + offSP + lenSP);
+
+                        /*
+                         * Intel pseudo-code indicates at least FIVE discrete selStack tests that could trigger
+                         * a TS_FAULT at this point:
+                         *
+                         *      1) Selector must not be null else #TS(O)
+                         *      2) Selector index must be within its descriptor table limits else #TS (SS selector)
+                         *      3) Selector's RPL must equal DPL of code segment else #TS (SS selector)
+                         *      4) Stack segment DPL must equal DPL of code segment else #TS (SS selector)
+                         *      5) Descriptor must indicate writable data segment else #TS (SS selector)
+                         */
+                        if (!selStack) {
+                            X86.helpFault.call(cpu, X86.EXCEPTION.TS_FAULT, selStack);
+                            return X86.ADDR_INVALID;
+                        }
+
+                        if (cpu.segSS.loadProt(selStack, true) === X86.ADDR_INVALID) {
+                            return X86.ADDR_INVALID;
+                        }
+                        /*
+                         * Both probes succeeded, so we can proceed with "normal" loads for both selCode and
+                         * selStack (which should automatically use the values cached by the "probed" loads above).
+                         */
+                        offStack = (lenSP == 2)? cpu.getShort(addrTSS + offSP) : cpu.getLong(addrTSS + offSP);
+                    }
+
+                    /*
+                     * Now that we're past all the probes, it should be safe to clear all flags that need clearing.
+                     */
+                    var regPS = cpu.regPS;
+                    cpu.regPS &= ~regPSClear;
+                    if (regPS & X86.PS.VM) {
+                        cpu.setProtMode(true, false);
+                    }
+
+                    /*
+                     * TODO: Consider whether we can skip this loadProt() call if this.sel already contains selCode
+                     * (and the previous mode matches, which might require we cache the mode in the X86Seg object, too).
+                     */
+                    if (this.loadProt(selCode, false) === X86.ADDR_INVALID) {
+                        return X86.ADDR_INVALID;
+                    }
+
+                    cpu.setDataSize(sizeGate);
+
+                    this.offIP = limit;
+
+                    //
+
+                    if (cplNew < cplOld) {
+
+                        if (fCall !== true) {
+
+                            return X86.ADDR_INVALID;
+                        }
+
+                        regSP = cpu.getSP();
+                        var i = 0, nWords = (acc & 0x1f);
+                        while (nWords--) {
+                            this.awParms[i++] = cpu.getSOWord(cpu.segSS, regSP);
+                            regSP += 2;
+                        }
+
+                        regSSPrev = cpu.getSS();
+                        regSPPrev = cpu.getSP();
+
+                        cpu.setSS(selStack, true);
+                        cpu.setSP(offStack);
+
+                        if (regPS & X86.PS.VM) {
+                            /*
+                             * Frames coming from V86-mode ALWAYS contain 32-bit values, and look like this:
+                             *
+                             *      low:    EIP
+                             *              CS (upper 16 bits undefined)
+                             *              EFLAGS
+                             *              ESP
+                             *              SS (upper 16 bits undefined)
+                             *              ES (upper 16 bits undefined)
+                             *              DS (upper 16 bits undefined)
+                             *              FS (upper 16 bits undefined)
+                             *      high:   GS (upper 16 bits undefined)
+                             *
+                             * Our caller (eg, helpINT()) will take care of pushing the final bits (EFLAGS, CS, and EIP).
+                             */
+                            cpu.setDataSize(4);
+
+                            cpu.pushData(cpu.segGS.sel, 4, 2);
+                            cpu.setGS(0);
+                            cpu.pushData(cpu.segFS.sel, 4, 2);
+                            cpu.setFS(0);
+                            cpu.pushData(cpu.segDS.sel, 4, 2);
+                            cpu.setDS(0);
+                            cpu.pushData(cpu.segES.sel, 4, 2);
+                            cpu.setES(0);
+                        }
+                        cpu.pushData(regSSPrev, cpu.sizeData, 2);
+                        cpu.pushWord(regSPPrev);
+                        while (i) cpu.pushWord(this.awParms[--i]);
+                        this.fStackSwitch = true;
+                    }
+                    return this.base;
+                }
+            }
+
+            if (sizeGate != 0) {
+                X86.helpFault.call(cpu, X86.EXCEPTION.GP_FAULT, (sel & X86.ERRCODE.SELMASK) | (fIDT? X86.ERRCODE.IDT : 0));
+                return X86.ADDR_INVALID;
+            }
+
+            if (!(acc & X86.DESC.ACC.PRESENT)) {
+                X86.helpFault.call(cpu, X86.EXCEPTION.NP_FAULT, (sel & X86.ERRCODE.SELMASK) | (fIDT? X86.ERRCODE.IDT : 0));
+                return X86.ADDR_INVALID;
+            }
+            break;
+
+        case X86Seg.ID.DATA:
+            if (selMasked) {
+                /*
+                 * OS/2 1.0 faults on segments with "empty descriptors" multiple times during boot; for example:
+                 *
+                 *      Fault 0x0B (0x002C) on opcode 0x8E at 3190:3A05 (%112625)
+                 *      AX=0000 BX=0970 CX=0300 DX=0300 SP=0ABE BP=0ABA SI=0000 DI=001A
+                 *      SS=0038[175CE0,0B5F] DS=19C0[177300,2C5F] ES=001F[1743A0,07FF] A20=ON
+                 *      CS=3190[10EC20,B89F] LD=0028[174BC0,003F] GD=[11A4E0,490F] ID=[11F61A,03FF]
+                 *      TR=0010 MS=0000FFF3 PS=3256 V0 D0 I1 T0 S0 Z1 A1 P1 C0
+                 *      3190:3A05 8E4604          MOV      ES,[BP+04]
+                 *      ## dw ss:bp+4 l1
+                 *      0038:0ABE  002F  19C0  0000  067C  07FC  0AD2  0010  C420   /.....|....... .
+                 *      ## ds 2f
+                 *      dumpDesc(0x002F): %174BE8
+                 *      base=000000 limit=0000 type=0x00 (undefined) ext=0x0000 dpl=0x00
+                 *
+                 * And Windows 95 Setup, during the "Analyzing Your Computer" phase, will fault on an attempt to load
+                 * a GDT selector of type LDT (why it does this is a mystery I've not yet investigated):
+                 *
+                 *      Fault 0x0D (0x26F0) on opcode 0x8E @039F:039B (%199E9B)
+                 *      EAX=0000149F EBX=00000100 ECX=000026F3 EDX=0020149F
+                 *      ESP=0000AA34 EBP=0000AA3C ESI=000026E7 EDI=00000080
+                 *      SS=155F[002AC9D0,C0BF] DS=149F[0031B470,9B1F] ES=0237[000C0000,FFFF]
+                 *      CS=039F[00199B00,2ABF] FS=0000[00000000,0000] GS=0000[00000000,0000]
+                 *      LD=0038[00FA4C50,FFEF] GD=[00FA0800,011F] ID=[00FA0000,07FF] TR=0088 A20=ON
+                 *      CR0=0000FFF1 CR2=00000000 CR3=00000000 PS=00003246 V0 D0 I1 T0 S0 Z1 A0 P1 C0
+                 *      039F:039B 8EC1            MOV      ES,CX
+                 *      ## ds cx
+                 *      dumpDesc(0x26F3): %00FA2EF0
+                 *      base=0006C726 limit=0000 type=0x02 (ldt,not present) ext=0x0000 dpl=0x00
+                 *
+                 * In both cases, the segment type is not valid for the target segment register *and* the PRESENT bit
+                 * is clear.  OS/2 doesn't seem to care whether I report an NP_FAULT or GP_FAULT, but Windows 95 definitely
+                 * cares: it will resolve the fault only if a GP_FAULT is reported.  And Intel's 80386 Programmers Reference
+                 * implies that, yes, GP_FAULT checks are supposed to be performed *before* NP_FAULT checks.
+                 */
+                if (type < X86.DESC.ACC.TYPE.SEG || (type & (X86.DESC.ACC.TYPE.CODE | X86.DESC.ACC.TYPE.READABLE)) == X86.DESC.ACC.TYPE.CODE) {
+                    X86.helpFault.call(cpu, X86.EXCEPTION.GP_FAULT, sel & X86.ERRCODE.SELMASK);
+                    return X86.ADDR_INVALID;
+                }
+                /*
+                 * TODO: This would be a good place to perform some additional access rights checks, too.
+                 */
+                if (!(acc & X86.DESC.ACC.PRESENT)) {
+                    X86.helpFault.call(cpu, X86.EXCEPTION.NP_FAULT, sel & X86.ERRCODE.SELMASK);
+                    return X86.ADDR_INVALID;
+                }
+            }
+            break;
+
+        case X86Seg.ID.STACK:
+            if (!selMasked || type < X86.DESC.ACC.TYPE.SEG || (type & (X86.DESC.ACC.TYPE.CODE | X86.DESC.ACC.TYPE.WRITABLE)) != X86.DESC.ACC.TYPE.WRITABLE) {
+                X86.helpFault.call(cpu, X86.EXCEPTION.GP_FAULT, sel & X86.ERRCODE.SELMASK);
+                return X86.ADDR_INVALID;
+            }
+            if (!(acc & X86.DESC.ACC.PRESENT)) {
+                X86.helpFault.call(cpu, X86.EXCEPTION.SS_FAULT, sel & X86.ERRCODE.SELMASK);
+                return X86.ADDR_INVALID;
+            }
+            break;
+
+        case X86Seg.ID.TSS:
+            var typeTSS = type & ~X86.DESC.ACC.TYPE.TSS_BUSY;
+            if (!selMasked || typeTSS != X86.DESC.ACC.TYPE.TSS286 && typeTSS != X86.DESC.ACC.TYPE.TSS386) {
+                X86.helpFault.call(cpu, X86.EXCEPTION.GP_FAULT, sel & X86.ERRCODE.SELMASK);
+                return X86.ADDR_INVALID;
+            }
+            /*
+             * For more efficient IOPM lookups, we cache the starting linear address in segTSS.addrIOPM, and the
+             * last valid address in segTSS.addrIOPMLimit.
+             */
+            if (typeTSS == X86.DESC.ACC.TYPE.TSS386) {
+                this.addrIOPM = (base + cpu.getShort(base + X86.TSS386.TASK_IOPM + 2))|0;
+                this.addrIOPMLimit = (base + this.limit)|0;
+            }
+            break;
+
+        case X86Seg.ID.VER:
+            /*
+             * For LSL, we must support any descriptor marked X86.DESC.ACC.TYPE.SEG, as well as TSS and LDT descriptors.
+             */
+            if (!(type & X86.DESC.ACC.TYPE.SEG) && type > X86.DESC.ACC.TYPE.TSS286_BUSY && type != X86.DESC.ACC.TYPE.TSS386 && type != X86.DESC.ACC.TYPE.TSS386_BUSY) {
+                return X86.ADDR_INVALID;
+            }
+            break;
+
+        default:
+            /*
+             * The only other cases are:
+              *
+              *     X86Seg.ID.NULL, X86Seg.ID.LDT, and X86Seg.ID.DBG
+              *
+              * which correspond to segNULL, segLDT and segDebugger; however, segLDT is the only one that might require further validation (TODO: Investigate).
+             */
+            break;
+        }
+
+        if (fProbe) {
+            this.probe.sel = sel;
+            this.probe.base = base;
+            this.probe.limit = limit;
+            this.probe.acc = acc;
+            this.probe.type = type;
+            this.probe.ext = ext;
+            this.probe.addrDesc = addrDesc;
+        } else {
+            this.sel = sel;
+            this.base = base;
+            this.limit = limit;
+            this.offMax = (limit >>> 0) + 1;
+            this.acc = acc;
+            this.type = type;
+            this.ext = ext;
+            this.addrDesc = addrDesc;
+            /*
+             * A quick recap of what updateMode(fLoad=true, fProt=true, fV86=false) actually updates:
+             *
+             *      cpl
+             *      dpl
+             *      dataSize
+             *      dataMask
+             *      addrSize
+             *      addrMask
+             *      fExpDown
+             *      load()
+             *      loadIDT()
+             *      checkRead()
+             *      checkWrite()
+             */
+            this.updateMode(true, true, false);
+        }
+
+        if (DEBUG) this.messageSeg(sel, base, limit, type, ext);
+
+        return base;
+    }
+
+    /**
+     * switchTSS(selNew, fNest)
+     *
+     * Implements TSS (Task State Segment) task switching.
+     *
+     * NOTES: This typically occurs during double-fault processing, because the IDT entry for DF_FAULT normally
+     * contains a task gate.  Interestingly, if we force a GP_FAULT to occur at a sufficiently early point in the
+     * OS/2 1.0 initialization code, OS/2 does a nice job of displaying the GP fault and then shutting down:
+     *
+     *      0090:067B FB            STI
+     *      0090:067C EBFD          JMP      067B
+     *
+     * but it may not have yet reprogrammed the master PIC to re-vector hardware interrupts to IDT entries 0x50-0x57,
+     * so when the next timer interrupt (IRQ 0) occurs, it vectors through IDT entry 0x08, which is the DF_FAULT
+     * vector. A spurious double-fault is generated, and a clean shutdown turns into a messy crash.
+     *
+     * Of course, that all could have been avoided if IBM had heeded Intel's advice and not used Intel-reserved IDT
+     * entries for PC interrupts.
+     *
+     * TODO: Add TSS validity checks and appropriate generation of TS_FAULT exceptions; the only rudimentary checks
+     * we currently perform are of the GP_FAULT variety.
+     *
+     * @this {X86Seg}
+     * @param {number} selNew
+     * @param {boolean|null} [fNest] is true if nesting, false if un-nesting, null if neither
+     * @return {boolean} true if successful, false if error
+     */
+    switchTSS(selNew, fNest)
+    {
+        var cpu = this.cpu;
+
+
+        var cplOld = this.cpl;
+        var selOld = cpu.segTSS.sel;
+        var addrOld = cpu.segTSS.base;
+
+        if (!fNest) {
+            /*
+             * TODO: Verify that it is (always) correct to require that the BUSY bit be currently set.
+             */
+            if (!(cpu.segTSS.type & X86.DESC.ACC.TYPE.TSS_BUSY)) {
+                X86.helpFault.call(cpu, X86.EXCEPTION.GP_FAULT, selNew & X86.ERRCODE.SELMASK);
+                return false;
+            }
+            /*
+             * TODO: Should I be more paranoid about writing our cached ACC value back into the descriptor?
+             */
+            cpu.setShort(cpu.segTSS.addrDesc + X86.DESC.ACC.OFFSET, cpu.segTSS.acc &= ~X86.DESC.ACC.TYPE.TSS_BUSY);
+        }
+
+        if (cpu.segTSS.load(selNew) === X86.ADDR_INVALID) {
+            return false;
+        }
+
+        var addrNew = cpu.segTSS.base;
+        if (DEBUG && DEBUGGER && this.dbg && this.dbg.messageEnabled(Messages.TSS)) {
+            this.dbg.message((fNest? "Task switch" : "Task return") + ": TR " + Str.toHexWord(selOld) + " (%" + Str.toHex(addrOld, 6) + "), new TR " + Str.toHexWord(selNew) + " (%" + Str.toHex(addrNew, 6) + ")");
+        }
+
+        if (fNest !== false) {
+            if (cpu.segTSS.type & X86.DESC.ACC.TYPE.TSS_BUSY) {
+                X86.helpFault.call(cpu, X86.EXCEPTION.GP_FAULT, selNew & X86.ERRCODE.SELMASK);
+                return false;
+            }
+            cpu.setShort(cpu.segTSS.addrDesc + X86.DESC.ACC.OFFSET, cpu.segTSS.acc |= X86.DESC.ACC.TYPE.TSS_BUSY);
+        }
+
+        /*
+         * Now that we're done checking the TSS_BUSY bit in the TYPE field (which is a subset of the ACC field),
+         * sync any changes made above in the ACC field to the TYPE field.
+         */
+        cpu.segTSS.type = (cpu.segTSS.type & ~X86.DESC.ACC.TYPE.TSS_BUSY) | (cpu.segTSS.acc & X86.DESC.ACC.TYPE.TSS_BUSY);
+
+        /*
+         * Update the old TSS
+         */
+        var offSS, offSP;
+        if (cpu.segTSS.type == X86.DESC.ACC.TYPE.TSS286 || cpu.segTSS.type == X86.DESC.ACC.TYPE.TSS286_BUSY) {
+            cpu.setShort(addrOld + X86.TSS286.TASK_IP, cpu.getIP());
+            cpu.setShort(addrOld + X86.TSS286.TASK_PS, cpu.getPS());
+            cpu.setShort(addrOld + X86.TSS286.TASK_AX, cpu.regEAX);
+            cpu.setShort(addrOld + X86.TSS286.TASK_CX, cpu.regECX);
+            cpu.setShort(addrOld + X86.TSS286.TASK_DX, cpu.regEDX);
+            cpu.setShort(addrOld + X86.TSS286.TASK_BX, cpu.regEBX);
+            cpu.setShort(addrOld + X86.TSS286.TASK_SP, cpu.getSP());
+            cpu.setShort(addrOld + X86.TSS286.TASK_BP, cpu.regEBP);
+            cpu.setShort(addrOld + X86.TSS286.TASK_SI, cpu.regESI);
+            cpu.setShort(addrOld + X86.TSS286.TASK_DI, cpu.regEDI);
+            cpu.setShort(addrOld + X86.TSS286.TASK_ES, cpu.segES.sel);
+            cpu.setShort(addrOld + X86.TSS286.TASK_CS, cpu.segCS.sel);
+            cpu.setShort(addrOld + X86.TSS286.TASK_SS, cpu.segSS.sel);
+            cpu.setShort(addrOld + X86.TSS286.TASK_DS, cpu.segDS.sel);
+            /*
+             * Reload all registers from the new TSS; it's important to reload the LDTR sooner
+             * rather than later, so that as segment registers are reloaded, any LDT selectors will
+             * will be located in the correct table.
+             */
+            cpu.segLDT.load(cpu.getShort(addrNew + X86.TSS286.TASK_LDT));
+            cpu.setPS(cpu.getShort(addrNew + X86.TSS286.TASK_PS) | (fNest? X86.PS.NT : 0));
+
+            cpu.regEAX = cpu.getShort(addrNew + X86.TSS286.TASK_AX);
+            cpu.regECX = cpu.getShort(addrNew + X86.TSS286.TASK_CX);
+            cpu.regEDX = cpu.getShort(addrNew + X86.TSS286.TASK_DX);
+            cpu.regEBX = cpu.getShort(addrNew + X86.TSS286.TASK_BX);
+            cpu.regEBP = cpu.getShort(addrNew + X86.TSS286.TASK_BP);
+            cpu.regESI = cpu.getShort(addrNew + X86.TSS286.TASK_SI);
+            cpu.regEDI = cpu.getShort(addrNew + X86.TSS286.TASK_DI);
+            cpu.segES.load(cpu.getShort(addrNew + X86.TSS286.TASK_ES));
+            cpu.segDS.load(cpu.getShort(addrNew + X86.TSS286.TASK_DS));
+            cpu.setCSIP(cpu.getShort(addrNew + X86.TSS286.TASK_IP), cpu.getShort(addrNew + X86.TSS286.TASK_CS));
+            offSS = X86.TSS286.TASK_SS;
+            offSP = X86.TSS286.TASK_SP;
+            if (this.cpl < cplOld) {
+                offSP = (this.cpl << 2) + X86.TSS286.CPL0_SP;
+                offSS = offSP + 2;
+            }
+            cpu.setSS(cpu.getShort(addrNew + offSS), true);
+            cpu.setSP(cpu.getShort(addrNew + offSP));
+        } else {
+
+            cpu.setLong(addrOld + X86.TSS386.TASK_CR3, cpu.regCR3);
+            cpu.setLong(addrOld + X86.TSS386.TASK_EIP, cpu.getIP());
+            cpu.setLong(addrOld + X86.TSS386.TASK_PS,  cpu.getPS());
+            cpu.setLong(addrOld + X86.TSS386.TASK_EAX, cpu.regEAX);
+            cpu.setLong(addrOld + X86.TSS386.TASK_ECX, cpu.regECX);
+            cpu.setLong(addrOld + X86.TSS386.TASK_EDX, cpu.regEDX);
+            cpu.setLong(addrOld + X86.TSS386.TASK_EBX, cpu.regEBX);
+            cpu.setLong(addrOld + X86.TSS386.TASK_ESP, cpu.getSP());
+            cpu.setLong(addrOld + X86.TSS386.TASK_EBP, cpu.regEBP);
+            cpu.setLong(addrOld + X86.TSS386.TASK_ESI, cpu.regESI);
+            cpu.setLong(addrOld + X86.TSS386.TASK_EDI, cpu.regEDI);
+            cpu.setLong(addrOld + X86.TSS386.TASK_ES,  cpu.segES.sel);
+            cpu.setLong(addrOld + X86.TSS386.TASK_CS,  cpu.segCS.sel);
+            cpu.setLong(addrOld + X86.TSS386.TASK_SS,  cpu.segSS.sel);
+            cpu.setLong(addrOld + X86.TSS386.TASK_DS,  cpu.segDS.sel);
+
+            /*
+             * segFS and segGS exist only on 80386 machines
+             */
+
+            cpu.setLong(addrOld + X86.TSS386.TASK_FS,  cpu.segFS.sel);
+            cpu.setLong(addrOld + X86.TSS386.TASK_GS,  cpu.segGS.sel);
+
+            /*
+             * Reload all registers from the new TSS; it's important to reload the LDTR sooner
+             * rather than later, so that as segment registers are reloaded, any LDT selectors will
+             * will be located in the correct table.
+             */
+            X86.helpLoadCR3.call(cpu, cpu.getLong(addrNew + X86.TSS386.TASK_CR3));
+            cpu.segLDT.load(cpu.getShort(addrNew + X86.TSS386.TASK_LDT));
+            cpu.setPS(cpu.getLong(addrNew + X86.TSS386.TASK_PS) | (fNest? X86.PS.NT : 0));
+
+            cpu.regEAX = cpu.getLong(addrNew + X86.TSS386.TASK_EAX);
+            cpu.regECX = cpu.getLong(addrNew + X86.TSS386.TASK_ECX);
+            cpu.regEDX = cpu.getLong(addrNew + X86.TSS386.TASK_EDX);
+            cpu.regEBX = cpu.getLong(addrNew + X86.TSS386.TASK_EBX);
+            cpu.regEBP = cpu.getLong(addrNew + X86.TSS386.TASK_EBP);
+            cpu.regESI = cpu.getLong(addrNew + X86.TSS386.TASK_ESI);
+            cpu.regEDI = cpu.getLong(addrNew + X86.TSS386.TASK_EDI);
+            cpu.segES.load(cpu.getShort(addrNew + X86.TSS386.TASK_ES));
+            cpu.segDS.load(cpu.getShort(addrNew + X86.TSS386.TASK_DS));
+
+            /*
+             * segFS and segGS exist only on 80386 machines
+             */
+
+            cpu.segFS.load(cpu.getShort(addrNew + X86.TSS386.TASK_FS));
+            cpu.segGS.load(cpu.getShort(addrNew + X86.TSS386.TASK_GS));
+
+            cpu.setCSIP(cpu.getLong(addrNew + X86.TSS386.TASK_EIP), cpu.getShort(addrNew + X86.TSS386.TASK_CS));
+            offSS = X86.TSS386.TASK_SS;
+            offSP = X86.TSS386.TASK_ESP;
+            if (this.cpl < cplOld) {
+                offSP = (this.cpl << 3) + X86.TSS386.CPL0_ESP;
+                offSS = offSP + 4;
+            }
+            cpu.setSS(cpu.getShort(addrNew + offSS), true);
+            cpu.setSP(cpu.getLong(addrNew + offSP));
+        }
+
+        /*
+         * Fortunately, X86.TSS286.PREV_TSS and X86.TSS386.PREV_TSS refer to the same TSS offset.
+         */
+        if (fNest) cpu.setShort(addrNew + X86.TSS286.PREV_TSS, selOld);
+
+        cpu.regCR0 |= X86.CR0.MSW.TS;
+        return true;
+    }
+
+    /**
+     * setBase(addr)
+     *
+     * This is used in unusual situations where the base must be set independently; normally, the base is
+     * set according to the selector provided to load(), but there are a few cases where setBase() is required.
+     *
+     * For example, in resetRegs(), the real-mode CS selector must be reset to 0xF000 for an 80286 or 80386,
+     * but the CS base must be set to 0x00FF0000 or 0xFFFF0000, respectively.  To simplify life for setBase()
+     * callers, we allow them to specify 32-bit bases, which we then truncate to 24 bits as needed.
+     *
+     * WARNING: Since the CPU must maintain regLIP as the sum of the CS base and the current IP, all calls
+     * to segCS.setBase() need to go through cpu.setCSBase().
+     *
+     * @this {X86Seg}
+     * @param {number} addr
+     * @return {number} addr, truncated as needed
+     */
+    setBase(addr)
+    {
+        if (this.cpu.model < X86.MODEL_80386) addr &= 0xffffff;
+        return this.base = addr;
+    }
+
+    /**
+     * save()
+     *
+     * Early versions of PCx86 saved only segment selectors, since that's all that mattered in real-mode;
+     * newer versions need to save/restore all the "core" properties of the X86Seg object (ie, properties other
+     * than those that updateMode() will take care of restoring later).
+     *
+     * @this {X86Seg}
+     * @return {Array}
+     */
+    save()
+    {
+        return [
+            this.sel,
+            this.base,
+            this.limit,
+            this.acc,
+            this.id,
+            this.sName,
+            this.cpl,
+            this.dpl,
+            this.addrDesc,
+            this.sizeAddr,
+            this.maskAddr,
+            this.sizeData,
+            this.maskData,
+            this.type,
+            this.offMax
+        ];
+    }
+
+    /**
+     * restore(a)
+     *
+     * Early versions of PCx86 saved only segment selectors, since that's all that mattered in real-mode;
+     * newer versions need to save/restore all the "core" properties of the X86Seg object (ie, properties other
+     * than those that updateMode() will take care of restoring later).
+     *
+     * @this {X86Seg}
+     * @param {Array|number} a
+     */
+    restore(a)
+    {
+        if (typeof a == "number") {
+            this.load(a);
+        } else {
+            this.sel      = a[0];
+            this.base     = a[1];
+            this.limit    = a[2];
+            this.acc      = a[3];
+            this.id       = a[4];
+            this.sName    = a[5];
+            this.cpl      = a[6];
+            this.dpl      = a[7];
+            this.addrDesc = a[8];
+            this.sizeAddr = a[9]  || 2;
+            this.maskAddr = a[10] || 0xffff;
+            this.sizeData = a[11] || 2;
+            this.maskData = a[12] || 0xffff;
+            this.type     = a[13] || (this.acc & X86.DESC.ACC.TYPE.MASK);
+            this.offMax   = a[14] || (this.limit >>> 0) + 1;
+        }
+    }
+
+    /**
+     * updateMode(fLoad, fProt, fV86)
+     *
+     * Ensures that the segment register's access (ie, load and check methods) matches the specified (or current)
+     * operating mode (real or protected).
+     *
+     * @this {X86Seg}
+     * @param {boolean} [fLoad] true if the segment was just (re)loaded, false if not
+     * @param {boolean} [fProt] true for protected-mode access, false for real-mode access, undefined for current mode
+     * @param {boolean} [fV86] true for V86-mode access, false for protected-mode access, undefined for current mode
+     */
+    updateMode(fLoad, fProt, fV86)
+    {
+        if (fProt === undefined) {
+            fProt = !!(this.cpu.regCR0 & X86.CR0.MSW.PE);
+        }
+
+        /*
+         * The fExpDown property is used for STACK segments only (ie, segSS); we want to make it easier for
+         * setSS() to set stack lower and upper limits, which requires knowing whether or not the segment is
+         * marked as EXPDOWN.
+         */
+        this.fExpDown = false;
+
+        if (fProt) {
+            this.load = this.loadProt;
+            this.loadIDT = this.loadIDTProt;
+            this.checkRead = this.checkReadProt;
+            this.checkWrite = this.checkWriteProt;
+
+            if (fV86 === undefined) {
+                fV86 = !!(this.cpu.regPS & X86.PS.VM);
+            }
+
+            if (fV86) {
+                this.load = this.loadV86;
+                this.checkRead = this.checkReadV86;
+                this.checkWrite = this.checkWriteV86;
+                /*
+                 * One important feature of V86-mode (as compared to real-mode) are that other segment attributes
+                 * (eg, limit, operand size, address size, etc) ARE updated, whereas in real-mode, segment attributes
+                 * remain set to whatever was in effect in protected-mode.
+                 */
+                this.cpl = this.dpl = 3;
+                this.sizeData = this.sizeAddr = 2;
+                this.maskData = this.maskAddr = 0xffff;
+                this.limit = 0xffff;
+                this.offMax = this.limit + 1;
+                this.sizeAddr = this.sizeData;
+                this.addrDesc = X86.ADDR_INVALID;
+                this.fStackSwitch = false;
+                return;
+            }
+
+            /*
+             * TODO: For null GDT selectors, should we rely on the descriptor being invalid, or should we assume that
+             * the null descriptor might contain uninitialized (or other) data?  I'm assuming the latter, hence the
+             * following null selector test.  However, if we're not going to consult the descriptor, is there anything
+             * else we should (or should not) be doing for null GDT selectors?
+             */
+            if (!(this.sel & ~X86.SEL.RPL)) {
+                this.checkRead = this.checkReadProtDisallowed;
+                this.checkWrite = this.checkWriteProtDisallowed;
+
+            }
+            else if (this.type & X86.DESC.ACC.TYPE.SEG) {
+                /*
+                 * If the READABLE bit of CODE_READABLE is not set, then disallow reads.
+                 */
+                if ((this.type & X86.DESC.ACC.TYPE.CODE_READABLE) == X86.DESC.ACC.TYPE.CODE_EXECONLY) {
+                    this.checkRead = this.checkReadProtDisallowed;
+                }
+                /*
+                 * If the CODE bit is set, or the the WRITABLE bit is not set, then disallow writes.
+                 */
+                if ((this.type & X86.DESC.ACC.TYPE.CODE) || !(this.type & X86.DESC.ACC.TYPE.WRITABLE)) {
+                    this.checkWrite = this.checkWriteProtDisallowed;
+                }
+                /*
+                 * If the CODE bit is not set *and* the EXPDOWN bit is set, then invert the limit check.
+                 */
+                if ((this.type & (X86.DESC.ACC.TYPE.CODE | X86.DESC.ACC.TYPE.EXPDOWN)) == X86.DESC.ACC.TYPE.EXPDOWN) {
+                    if (this.checkRead == this.checkReadProt) this.checkRead = this.checkReadProtDown;
+                    if (this.checkWrite == this.checkWriteProt) this.checkWrite = this.checkWriteProtDown;
+                    this.fExpDown = true;
+                }
+                if (fLoad && this.id < X86Seg.ID.VER) {
+                    /*
+                     * We must update the descriptor's ACCESSED bit whenever the segment is "accessed" (ie,
+                     * loaded); unlike the ACCESSED and DIRTY bits in PTEs, a descriptor ACCESSED bit is only
+                     * updated on loads, not on every memory access.
+                     *
+                     * We compute the address of the descriptor byte containing the ACCESSED bit (offset 0x5);
+                     * note that it's perfectly normal for addrDesc to occasionally be invalid (eg, when the CPU
+                     * is creating protected-mode-only segment registers like LDT and TSS, or when the CPU has
+                     * transitioned from real-mode to protected-mode and new selector(s) have not been loaded yet).
+                     *
+                     * NOTE: I do NOT update the ACCESSED bit for null GDT selectors, because I'm assuming the
+                     * hardware does not update it either.  In fact, I've seen code that uses the null GDT descriptor
+                     * for other purposes, on the assumption that that descriptor is completely unused.
+                     */
+                    if ((this.sel & ~X86.SEL.RPL) && this.addrDesc !== X86.ADDR_INVALID) {
+                        var addrType = this.addrDesc + X86.DESC.ACC.TYPE.OFFSET;
+                        var bType = this.cpu.getByte(addrType);
+                        /*
+                         * This code used to ALWAYS call setByte(), but that's a waste of time if ACCESSED is already
+                         * set.  TODO: It would also be nice if we could simply use the cached type value, and eliminate
+                         * the getByte() call; that seems a bit risky, but I think we should still try it someday.
+                         */
+                        if (!(bType & (X86.DESC.ACC.TYPE.ACCESSED >> 8))) {
+                            this.cpu.setByte(addrType, bType | (X86.DESC.ACC.TYPE.ACCESSED >> 8));
+                        }
+                    }
+                }
+            }
+
+            /*
+             * TODO: For non-SEG descriptors, are there other checks or functions we should establish?
+             */
+
+            /*
+             * Any update to the following properties must occur only on segment loads, not simply when
+             * we're updating segment registers as part of a mode change.
+             */
+            if (fLoad) {
+                this.cpl = this.sel & X86.SEL.RPL;
+                this.dpl = (this.acc & X86.DESC.ACC.DPL.MASK) >> X86.DESC.ACC.DPL.SHIFT;
+                if (this.cpu.model < X86.MODEL_80386 || !(this.ext & X86.DESC.EXT.BIG)) {
+                    this.sizeData = 2;
+                    this.maskData = 0xffff;
+                } else {
+                    this.sizeData = 4;
+                    this.maskData = (0xffffffff|0);
+                }
+                this.sizeAddr = this.sizeData;
+                this.maskAddr = this.maskData;
+            }
+            return;
+        }
+        /*
+         * One important feature of real-mode (as compared to V86-mode) are that other segment attributes
+         * (eg, limit, operand size, address size, etc) are NOT updated, enabling features like "big real-mode"
+         * (aka "unreal mode"), which is used by system software like HIMEM.SYS to access extended memory from
+         * real-mode.
+         */
+        this.load = this.loadReal;
+        this.loadIDT = this.loadIDTReal;
+        this.checkRead = this.checkReadReal;
+        this.checkWrite = this.checkWriteReal;
+        this.cpl = this.dpl = 0;
+        this.addrDesc = X86.ADDR_INVALID;
+        this.fStackSwitch = false;
+    }
+
+    /**
+     * messageSeg(sel, base, limit, type, ext)
+     *
+     * @this {X86Seg}
+     * @param {number} sel
+     * @param {number} base
+     * @param {number} limit
+     * @param {number} type
+     * @param {number} [ext]
+     */
+    messageSeg(sel, base, limit, type, ext)
+    {
+        if (DEBUG) {
+            if (DEBUGGER && this.dbg && this.dbg.messageEnabled(Messages.SEG)) {
+                var ch = (this.sName.length < 3? " " : "");
+                var sDPL = " dpl=" + this.dpl;
+                if (this.id == X86Seg.ID.CODE) sDPL += " cpl=" + this.cpl;
+                this.dbg.message("loadSeg(" + this.sName + "):" + ch + "sel=" + Str.toHexWord(sel) + " base=" + Str.toHex(base) + " limit=" + Str.toHexWord(limit) + " type=" + Str.toHexWord(type) + sDPL, true);
+            }
+            /*
+             * Unless I've got a bug that's causing descriptor corruption, it appears that Windows 3.0 may be setting the
+             * EXT field of descriptors, even when the processor is an 80286; eg, the EXT field below has been set to 0x000F:
+             *
+             *      ## ds 1bd
+             *      dumpSel(0x01BD): %1101B8
+             *      %001101B8  FFFF  C090  B317  000F
+             *
+             * So I've disabled this assert (I had already disabled the "base !== X86.ADDR_INVALID" check).
+             *
+             *
+             */
+        }
+    }
+
+    /**
+     * probeDesc(sel)
+     *
+     * This is a neutered version of loadProt() designed for the Debugger.
+     *
+     * @this {X86Seg}
+     * @param {number} sel
+     * @return {number} base address of selected segment, or X86.ADDR_INVALID if error
+     */
+    probeDesc(sel)
+    {
+        if (DEBUGGER) {
+            var addrDT;
+            var addrDTLimit;
+            var cpu = this.cpu;
+
+            sel &= 0xffff;
+
+            if (!(sel & X86.SEL.LDT)) {
+                addrDT = cpu.addrGDT;
+                addrDTLimit = cpu.addrGDTLimit;
+            } else {
+                addrDT = cpu.segLDT.base;
+                addrDTLimit = (addrDT + cpu.segLDT.limit)|0;
+            }
+
+            var addrDesc = (addrDT + (sel & X86.SEL.MASK))|0;
+
+            if ((addrDTLimit - addrDesc)|0 >= 7) {
+
+                /*
+                 * Load the descriptor from memory using probeAddr().
+                 */
+                var limit = cpu.probeAddr(addrDesc + X86.DESC.LIMIT.OFFSET, 2);
+                var acc = cpu.probeAddr(addrDesc + X86.DESC.ACC.OFFSET, 2);
+                var type = (acc & X86.DESC.ACC.TYPE.MASK);
+                var base = cpu.probeAddr(addrDesc + X86.DESC.BASE.OFFSET, 2) | ((acc & X86.DESC.ACC.BASE1623) << 16);
+                var ext = cpu.probeAddr(addrDesc + X86.DESC.EXT.OFFSET, 2);
+
+                if (I386 && cpu.model >= X86.MODEL_80386) {
+                    base |= (ext & X86.DESC.EXT.BASE2431) << 16;
+                    limit |= (ext & X86.DESC.EXT.LIMIT1619) << 16;
+                    if (ext & X86.DESC.EXT.LIMITPAGES) limit = (limit << 12) | 0xfff;
+                }
+
+                this.sel = sel;
+                this.base = base;
+                this.limit = limit;
+                this.offMax = (limit >>> 0) + 1;
+                this.acc = acc;
+                this.type = type;
+                this.ext = ext;
+                this.addrDesc = addrDesc;
+                this.updateMode(true, true, false);
+                return base;
+            }
+        }
+        return X86.ADDR_INVALID;
+    }
+
+    /**
+     * loadAcc(sel, fGDT)
+     *
+     * this {X86Seg}
+     * param {number} sel (protected-mode only)
+     * param {boolean} [fGDT] is true if sel must be in the GDT
+     * return {number} ACC field from descriptor, or X86.DESC.ACC.INVALID if error
+     *
+     loadAcc(sel, fGDT)
+     {
+         var addrDT;
+         var addrDTLimit;
+         var cpu = this.cpu;
+
+         if (!(sel & X86.SEL.LDT)) {
+             addrDT = cpu.addrGDT;
+             addrDTLimit = cpu.addrGDTLimit;
+         } else if (!fGDT) {
+             addrDT = cpu.segLDT.base;
+             addrDTLimit = (addrDT + cpu.segLDT.limit)|0;
+         }
+         if (addrDT !== undefined) {
+             var addrDesc = (addrDT + (sel & X86.SEL.MASK))|0;
+             if (((addrDTLimit - addrDesc)|0) >= 7) {
+                 return cpu.getShort(addrDesc + X86.DESC.ACC.OFFSET);
+             }
+         }
+         X86.helpFault.call(cpu, X86.EXCEPTION.GP_FAULT, sel & X86.ERRCODE.SELMASK);
+         return X86.DESC.ACC.INVALID;
+     }
+     */
+}
+
+X86Seg.ID = {
+    NULL:   0,          // "NULL"
+    CODE:   1,          // "CS"
+    DATA:   2,          // "DS", "ES", "FS", "GS"
+    STACK:  3,          // "SS"
+    TSS:    4,          // "TSS"
+    LDT:    5,          // "LDT"
+    VER:    6,          // "VER"
+    DBG:    7           // "DBG"
+};
+
+X86Seg.CALLBREAK_SEL = 0x0001;
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/x86cpu.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class X86CPU extends CPU {
+    /**
+     * X86CPU(parmsCPU)
+     *
+     * The X86CPU class uses the following (parmsCPU) properties:
+     *
+     *      model: a string (eg, "8088") that should match one of the X86.MODEL values (default is "8088")
+     *      stepping: a string (eg, "B1") that should match one of the X86.STEPPING values (default is "")
+     *
+     * This extends the CPU class and passes any remaining parmsCPU properties to the CPU class
+     * constructor, along with a default speed (cycles per second) based on the specified (or default)
+     * CPU model number.
+     *
+     * The X86CPU class was initially written to simulate a 8086/8088 microprocessor, although over time
+     * it has evolved to support later microprocessors (eg, the 80186/80188 and the 80286, including
+     * protected-mode support).
+     *
+     * This is a logical simulation, not a physical simulation, and performance is critical, second only
+     * to the accuracy of the simulation when running real-world x86 software.  Consequently, it takes a
+     * few liberties with the operation of the simulated hardware, especially with regard to timings,
+     * little-used features, etc.  We do make an effort to maintain approximate instruction cycle counts,
+     * but there are many other obstacles (eg, prefetch queue, wait states) to achieving accurate timings.
+     *
+     * For example, our 8237 DMA controller performs all DMA transfers immediately, since internally
+     * they are all memory-to-memory, and attempting to interleave DMA cycles with instruction execution
+     * cycles would hurt overall performance.  Similarly, 8254 timer counters are updated only on-demand.
+     *
+     * The 8237 and 8254, along with the 8259 interrupt controller and several other "chips", are combined
+     * into a single ChipSet component, to keep the number of components we juggle to a minimum.
+     *
+     * All that being said, this does not change the overall goal: to produce as accurate a simulation as
+     * possible, within the limits of what JavaScript allows and how precisely/predictably it behaves.
+     *
+     * @this {X86CPU}
+     * @param {Object} parmsCPU
+     */
+    constructor(parmsCPU)
+    {
+        var model = +parmsCPU['model'] || X86.MODEL_8088;
+
+        var nCyclesDefault = 0;
+        switch(model) {
+        case X86.MODEL_8088:
+        default:
+            nCyclesDefault = 4772727;
+            break;
+        case X86.MODEL_80286:
+            nCyclesDefault = 6000000;
+            break;
+        case X86.MODEL_80386:
+            nCyclesDefault = 16000000;
+            break;
+        }
+
+        super(parmsCPU, nCyclesDefault);
+
+        this.model = model;
+
+        /*
+         * We take the 'stepping' value, convert it to a hex value, and then add that to the model to provide
+         * a single value that's unique for any given CPU stepping.  If no stepping is provided, then stepping
+         * is equal to model.
+         */
+        var stepping = parmsCPU['stepping'];
+        this.stepping = model + (stepping? Str.parseInt(stepping, 16) : 0);
+
+        /*
+         * Initialize processor operation to match the requested model
+         */
+        this.initProcessor();
+
+        /*
+         * List of software interrupt notification functions: aIntNotify is an array, indexed by
+         * interrupt number, where each element contains:
+         *
+         *      registered function to call for every software interrupt
+         *
+         * The registered function is called with the linear address (LIP) following the software interrupt;
+         * if any function returns false, the software interrupt will be skipped (presumed to be emulated),
+         * and no further notification functions will be called.
+         *
+         * NOTE: Registered functions are called only for INT N instructions -- *not* INT 0x03 or INTO or the
+         * INT 0x00 generated by a divide-by-zero or any other kind of interrupt (nor any interrupt simulated
+         * with PUSHF/CALLF).
+         *
+         * aIntReturn is a hash of return address notifications set up by software interrupt notification
+         * functions that want to receive return notifications.  A software interrupt function must call
+         * cpu.addIntReturn(fn).
+         *
+         * WARNING: There's no mechanism in place to insure that software interrupt return notifications don't
+         * get "orphaned" if an interrupt handler bypasses the normal return path (INT 0x24 is one example of an
+         * "evil" software interrupt).
+         */
+        this.aIntNotify = [];
+        this.aIntReturn = [];
+
+        /*
+         * Since aReturnNotify is a "sparse array", this global count gives the CPU a quick way of knowing whether
+         * or not RETF or IRET instructions need to bother calling checkIntReturn().
+         */
+        this.cIntReturn = 0;
+
+        /*
+         * A variety of stepCPU() state variables that don't strictly need to be initialized before the first
+         * stepCPU() call, but it's good form to do so.
+         */
+        this.resetCycles();
+        this.flags.complete = this.flags.debugCheck = false;
+
+        /*
+         * If there are no live registers to display, then updateStatus() can skip a bit....
+         */
+        this.cLiveRegs = 0;
+
+        /*
+         * We're just declaring aMemBlocks and associated Bus parameters here; they'll be initialized by initMemory()
+         * when the Bus is initialized.
+         */
+        this.aBusBlocks = this.aMemBlocks = [];
+        this.nBusMask = this.nMemMask = 0;
+        this.nBlockShift = this.nBlockSize = this.nBlockLimit = this.nBlockTotal = this.nBlockMask = 0;
+
+        if (PREFETCH) {
+            this.cbPrefetch = 0;
+            this.adwPrefetch = null;
+        }
+
+        /*
+         * This initial resetRegs() call is important to create all the registers (eg, the X86Seg registers),
+         * so that if/when we call restore(), it will have something to fill in.
+         */
+        this.resetRegs();
+    }
+
+    /**
+     * initMemory(aMemBlocks, nBlockShift)
+     *
+     * Notification from Bus.initMemory(), giving us direct access to the entire memory space
+     * (aMemBlocks).  Since the CPU must perform additional layers of address decoding depending
+     * on the mode (real-mode, protected-mode, paging), it's best if the CPU can avoid going
+     * through the Bus component for every memory access.
+     *
+     * We also initialize a 32-bit prefetch queue, containing dword-aligned values; the queue is
+     * an array of dwords indexed by a masked regLIP; for example, a queue of 4 dwords is indexed
+     * by "regLIP & 0xC"; we use a sparse array to avoid right-shifting the index, like so:
+     *
+     *      0:  [dword]
+     *      4:  [dword]
+     *      8:  [dword]
+     *     12:  [dword]
+     *
+     * The actual regLIP mask is X86CPU.PFINFO.IP_MASK; ie, (X86CPU.PFINFO.LENGTH - 1) & ~0x3.
+     *
+     * On refilling, the queue is always filled to capacity, and cbPrefetch is set to its maximum
+     * value (eg, a value from 16 to 13, depending on whether "regLIP & 0x3" is 0, 1, 2 or 3).
+     *
+     * When a byte is requested from the queue, the dword is extracted from index "regLIP & 0xC"
+     * and then shifted by 0, 8, 16, or 24, depending on whether "regLIP & 0x3" is 0, 1, 2 or 3
+     * (ie, "(regLIP & 0x3) << 3").
+     *
+     * TODO: Consider how/whether to simulate an effective prefetch queue size of 4 bytes for an 8088,
+     * 6 bytes for an 8086, 12 for an 80386, etc.
+     *
+     * @this {X86CPU}
+     * @param {Array} aMemBlocks
+     * @param {number} nBlockShift
+     */
+    initMemory(aMemBlocks, nBlockShift)
+    {
+        /*
+         * aBusBlocks preserves the Bus block array for the life of the machine, whereas aMemBlocks
+         * will be altered if/when the CPU enables paging.  PAGEBLOCKS must be true when using Memory
+         * blocks to simulate paging, ensuring that physical blocks and pages have the same size (4Kb).
+         */
+        this.aBusBlocks = this.aMemBlocks = aMemBlocks;
+        this.nBlockShift = nBlockShift;
+        this.nBlockSize = 1 << this.nBlockShift;
+        this.nBlockLimit = this.nBlockSize - 1;
+        this.nBlockTotal = aMemBlocks.length;
+        this.nBlockMask = this.nBlockTotal - 1;
+        if (PREFETCH) {
+         // this.nBusCycles = 0;
+            this.adwPrefetch = new Array(X86CPU.PFINFO.LENGTH);
+        }
+    }
+
+    /**
+     * setAddressMask(nBusMask)
+     *
+     * Notification from Bus.initMemory() and Bus.setA20(); the latter calls us whenever the physical
+     * A20 line changes (note that on a 20-bit bus machine, address lines A20 and higher are always zero).
+     *
+     * For 32-bit bus machines (eg, 80386), nBusMask is never changed after the initial call, because A20
+     * wrap-around is simulated by changing the physical memory map rather than altering the A20 bit in nBusMask.
+     *
+     * We maintain nMemMask separate from nBusMask, because when paging is enabled on the 80386, the CPU memory
+     * functions are now dealing with linear addresses rather than physical addresses, so it would be incorrect
+     * to apply nBusMask to those addresses; nMemMask must remain 0xffffffff (-1) for the duration.  If we change
+     * how A20 is simulated on the 80386, then enablePageBlocks() and disablePageBlocks() will need to override
+     * nMemMask appropriately.
+     *
+     * TODO: Ideally, we would eliminate masking altogether of 32-bit addresses, but that would require different
+     * sets of memory access functions for different machines (ie, those with 20-bit or 24-bit buses).
+     *
+     * @this {X86CPU}
+     * @param {number} nBusMask
+     */
+    setAddressMask(nBusMask)
+    {
+        this.nBusMask = this.nMemMask = nBusMask;
+    }
+
+    /**
+     * addMemBreak(addr, fWrite, fPhysical)
+     *
+     * NOTE: addMemBreak() could be merged with addMemCheck(), but the new merged interface would
+     * have to provide one additional parameter indicating whether the Debugger or the CPU is the client.
+     *
+     * For now, this is simply a DEBUGGER-only interface.
+     *
+     * @this {X86CPU}
+     * @param {number} addr
+     * @param {boolean} fWrite is true for a memory write breakpoint, false for a memory read breakpoint
+     * @param {boolean} [fPhysical] (true for physical breakpoint, false for linear)
+     */
+    addMemBreak(addr, fWrite, fPhysical)
+    {
+        if (DEBUGGER) {
+            var iBlock = addr >>> this.nBlockShift;
+            var aBlocks = (fPhysical? this.aBusBlocks : this.aMemBlocks);
+            aBlocks[iBlock].addBreakpoint(addr & this.nBlockLimit, fWrite);
+            /*
+             * When a physical memory breakpoint is added, a fresh setPhysBlock() call is REQUIRED for any
+             * linear mappings to that address.  This is a bit of a sledgehammer solution, but at least it's a solution.
+             */
+            if (fPhysical) this.flushPageBlocks();
+        }
+    }
+
+    /**
+     * removeMemBreak(addr, fWrite, fPhysical)
+     *
+     * NOTE: removeMemBreak() could be merged with removeMemCheck(), but the new merged interface would
+     * have to provide one additional parameter indicating whether the Debugger or the CPU is the client.
+     *
+     * For now, this is simply a DEBUGGER-only interface.
+     *
+     * @this {X86CPU}
+     * @param {number} addr
+     * @param {boolean} fWrite is true for a memory write breakpoint, false for a memory read breakpoint
+     * @param {boolean} [fPhysical] (true for physical breakpoint, false for linear)
+     */
+    removeMemBreak(addr, fWrite, fPhysical)
+    {
+        if (DEBUGGER) {
+            var iBlock = addr >>> this.nBlockShift;
+            var aBlocks = (fPhysical? this.aBusBlocks : this.aMemBlocks);
+            aBlocks[iBlock].removeBreakpoint(addr & this.nBlockLimit, fWrite);
+            /*
+             * When a physical memory breakpoint is removed, a fresh setPhysBlock() call is RECOMMENDED for any
+             * linear mappings to that address.  This is a bit of a sledgehammer solution, but at least it's a solution.
+             */
+            if (fPhysical) this.flushPageBlocks();
+        }
+    }
+
+    /**
+     * addMemCheck(addr, fWrite)
+     *
+     * These functions provide Debug register functionality to the CPU by leveraging the same Memory block-based
+     * breakpoint support originally created for our built-in Debugger.  Only minimal changes were required to the
+     * Memory component, by adding additional checkMemoryException() call-outs from the "checked" Memory access
+     * functions.
+     *
+     * Note that those call-outs occur only AFTER our own Debugger (if present) has checked the address and has
+     * passed on it, because we want our own Debugger's breakpoints to take precedence over any breakpoints that
+     * the emulated machine may have enabled.
+     *
+     * @this {X86CPU}
+     * @param {number} addr
+     * @param {boolean} fWrite is true for a memory write check, false for a memory read check
+     */
+    addMemCheck(addr, fWrite)
+    {
+        var iBlock = addr >>> this.nBlockShift;
+        this.aMemBlocks[iBlock].addBreakpoint(addr & this.nBlockLimit, fWrite, this);
+    }
+
+    /**
+     * removeMemCheck(addr, fWrite)
+     *
+     * @this {X86CPU}
+     * @param {number} addr
+     * @param {boolean} fWrite is true for a memory write check, false for a memory read check
+     */
+    removeMemCheck(addr, fWrite)
+    {
+        var iBlock = addr >>> this.nBlockShift;
+        this.aMemBlocks[iBlock].removeBreakpoint(addr & this.nBlockLimit, fWrite);
+    }
+
+    /**
+     * enablePageBlocks()
+     *
+     * Whenever the CPU turns on paging and/or updates CR3, this function is called to update our copy
+     * of the Bus block array, to simulate paging.  Whenever the CPU turns paging off, disablePageBlocks()
+     * must be called to restore our copy of the Bus block array to its original (physical) mapping.
+     *
+     * This also requires PAGEBLOCKS be enabled, to ensure the Bus is configured with a 4Kb block size.
+     *
+     * The first time this function is called, aMemBlocks and aBusBlocks are identical, so aMemBlocks is
+     * reinitialized with special UNPAGED Memory blocks that know how to perform page directory/page table
+     * lookup and replace themselves with special PAGED Memory blocks that reference memory from the
+     * appropriate block in aBusBlocks.  A parallel array, aBlocksPaged, keeps track (by block number) of
+     * which blocks have been PAGED, so that whenever CR3 is updated, those blocks can be quickly UNPAGED.
+     *
+     * @this {X86CPU}
+     */
+    enablePageBlocks()
+    {
+        if (!PAGEBLOCKS) {
+            this.setError("PAGEBLOCKS support required");
+            return;
+        }
+        var iBlock;
+        if (this.aMemBlocks === this.aBusBlocks) {
+            this.aMemBlocks = new Array(this.nBlockTotal);
+            /*
+             * TODO: Currently we allocate only one UNPAGED block for the entire linear address space;
+             * only when a block is touched and becomes PAGED do we allocate a dedicated Memory block
+             * for that slot.  One potential downside to using a single UNPAGED block, however, is that
+             * it will accumulate all breakpoints for all UNPAGED blocks, requiring copyBreakpoints() to
+             * do extra work to figure out which breakpoints should be copied (ie, removed) from the
+             * outgoing block -- which it can't currently do, because blocks only keep track of the total
+             * number of breakpoints, not the actual breakpoint addresses.
+             *
+             * So, Memory blocks either need to start maintaining their own breakpoint address lists,
+             * or we need to allocate separate (empty) UNPAGED blocks for every slot.  I've not tackled
+             * this yet, because it's largely just a debugging issue.
+             *
+             * Notice that when we call copyBreakpoints() here, it's merely to initialize the new block;
+             * we make no attempt to copy any breakpoints from physical blocks to linear blocks, although
+             * perhaps we should.  The plan for our Debugger is to maintain separate physical and linear
+             * breakpoint address lists, but what about CPU Debug registers?  If the CPU sets the Debug
+             * registers, then enables paging, do all the previous Debug register addresses automatically
+             * become linear addresses?  I'm guessing they do.
+             */
+            this.blockUnpaged = new Memory(null, 0, 0, Memory.TYPE.UNPAGED, null, this);
+            this.blockUnpaged.copyBreakpoints(this.dbg);
+            for (iBlock = 0; iBlock < this.nBlockTotal; iBlock++) {
+                this.aMemBlocks[iBlock] = this.blockUnpaged;
+            }
+            /*
+             * We also use a special "empty" Memory block that mapPageBlock() can pass back to callers
+             * whenever a valid block cannot be found for an UNPAGED block.  Under normal conditions,
+             * an invalid block will trigger a fault, so memEmpty will never actually be returned, but
+             * if the Debugger is suppressing faults or calling probeAddr(), returning memEmpty is helpful.
+             */
+            this.memEmpty = new Memory();
+
+            /*
+             * Initialize our PAGEBLOCKS cache (see acquirePageBlock() and releasePageBlock()).
+             */
+            this.aCacheBlocks = new Array(X86CPU.PAGEBLOCKS_CACHE);
+            this.iCacheBlocks = 0;
+        } else {
+            /*
+             * Our equivalent of a TLB flush.  NOTE: We do not attempt to simulate an actual TLB; our
+             * aMemBlocks array will "cache" as many pages (ie, allow as many PAGED block) as there are
+             * entries in the array.  I'm assuming we won't run into any system software that relies on
+             * a constrained TLB -- at least not from the 80386 era, which is all we're emulating.
+             */
+            for (var i = 0; i < this.aBlocksPaged.length; i++) {
+                iBlock = this.aBlocksPaged[i];
+                this.releasePageBlock(this.aMemBlocks[iBlock]);
+                this.aMemBlocks[iBlock] = this.blockUnpaged;
+            }
+        }
+        this.aBlocksPaged = [];
+    }
+
+    /**
+     * flushPageBlocks()
+     *
+     * @this {X86CPU}
+     */
+    flushPageBlocks()
+    {
+        if (this.regCR0 & X86.CR0.PG) this.enablePageBlocks();
+    }
+
+    /**
+     * acquirePageBlock(addr)
+     *
+     * This implements a simple paged memory block cache.  Candidates for caching must be released via
+     * releasePageBlock().
+     *
+     * After acquiring a block from this cache, the caller MUST use setPhysBlock() to properly reinitialize
+     * it for the new given linear address.
+     *
+     * @this {X86CPU}
+     * @param {number} addr
+     * @return {Memory}
+     */
+    acquirePageBlock(addr)
+    {
+        var block;
+        if (this.iCacheBlocks > 0) {
+            block = this.aCacheBlocks[--this.iCacheBlocks];
+            /*
+             * Paged memory blocks are all very generic and contain no memory of their own, so the fact
+             * that we're not calling the Memory constructor to reinitialize it is OK.  setPhysBlock() is
+             * what's critical, and the caller will take care of that.  However, to avoid any confusion,
+             * especially when debugging, there are a few properties we should reinitialize, hence init().
+             */
+            block.init(addr);
+        } else {
+            block = new Memory(addr, 0, 0, Memory.TYPE.PAGED);
+        }
+        return block;
+    }
+
+    /**
+     * releasePageBlock(block)
+     *
+     * Instead of simply tossing Memory blocks onto the garbage collector's heap, we'll retain a maximum
+     * number (X86CPU.PAGEBLOCKS_CACHE) in aCacheBlocks, with iCacheBlocks pointing to the next free element.
+     *
+     * @this {X86CPU}
+     * @param {Memory} block
+     */
+    releasePageBlock(block)
+    {
+
+        if (this.iCacheBlocks < X86CPU.PAGEBLOCKS_CACHE) {
+            this.aCacheBlocks[this.iCacheBlocks++] = block;
+        }
+    }
+
+    /**
+     * mapPageBlock(addr, fWrite, fSuppress)
+     *
+     * Locate the corresponding physical PDE, PTE and memory blocks for the given linear address, and then
+     * upgrade the block from an UNPAGED Memory block to a new PAGED Memory block; all future accesses to
+     * the current page will go directly to that block, instead of coming here through the UNPAGED block
+     * handlers.
+     *
+     * Note that since the incoming address (addr) is a linear address, we never need to mask it with nBusMask,
+     * but all the intermediate (PDE, PTE) and final physical addresses we calculate should still be masked.
+     *
+     * Granted, nBusMask on a 32-bit bus is generally going to be 0xffffffff (-1), so masking might seem like
+     * a waste of time; however, if we decide to once again rely on nBusMask for emulating A20 wrap-around
+     * (instead of changing the physical memory map to alias the 2nd Mb to the 1st Mb), then performing
+     * consistent masking will be important.
+     *
+     * Also, addrPDE, addrPTE and addrPhys do not need any offsets added to them, because we immediately shift
+     * the offset portion of those addresses out.  But for now, at least for debugging and documentation purposes,
+     * my preference is to include the offset in the address calculations.
+     *
+     * Besides, this should not be a performance-critical function; it's normally called only once per UNPAGED
+     * page.  Obviously, if CR3 is constantly being updated, that will trigger repeated calls to enablePageBlocks(),
+     * which will perform our equivalent of a TLB flush (ie, resetting all PAGED blocks back to UNPAGED blocks).
+     * That would hurt our performance, but it would hurt performance on a real machine as well, so presumably
+     * CR3 updates will be minimal.
+     *
+     * @this {X86CPU}
+     * @param {number} addr is a linear address
+     * @param {boolean} fWrite (true if called for a write, false if for a read)
+     * @param {boolean} [fSuppress] (true if any faults, remapping, etc should be suppressed)
+     * @return {Memory}
+     */
+    mapPageBlock(addr, fWrite, fSuppress)
+    {
+        var offPDE = (addr & X86.LADDR.PDE.MASK) >>> X86.LADDR.PDE.SHIFT;
+        var addrPDE = this.regCR3 + offPDE;
+
+        /*
+         * bus.getLong(addrPDE) would be simpler, but setPhysBlock() needs to know blockPDE and offPDE, too.
+         * TODO: Since we're immediately shifting addrPDE by nBlockShift, then we could also skip adding offPDE.
+         */
+        var blockPDE = this.aBusBlocks[(addrPDE & this.nBusMask) >>> this.nBlockShift];
+        var pde = blockPDE.readLong(offPDE);
+
+        if (!(pde & X86.PTE.PRESENT)) {
+            if (!fSuppress) X86.helpPageFault.call(this, addr, false, fWrite);
+            return this.memEmpty;
+        }
+
+        if (!(pde & X86.PTE.USER) && this.nCPL == 3) {
+            if (!fSuppress) X86.helpPageFault.call(this, addr, true, fWrite);
+            return this.memEmpty;
+        }
+
+        var offPTE = (addr & X86.LADDR.PTE.MASK) >>> X86.LADDR.PTE.SHIFT;
+        var addrPTE = (pde & X86.PTE.FRAME) + offPTE;
+
+        /*
+         * bus.getLong(addrPTE) would be simpler, but setPhysBlock() needs to know blockPTE and offPTE, too.
+         * TODO: Since we're immediately shifting addrPDE by nBlockShift, then we could also skip adding offPTE.
+         */
+        var blockPTE = this.aBusBlocks[(addrPTE & this.nBusMask) >>> this.nBlockShift];
+        var pte = blockPTE.readLong(offPTE);
+
+        if (!(pte & X86.PTE.PRESENT)) {
+            if (!fSuppress) X86.helpPageFault.call(this, addr, false, fWrite);
+            return this.memEmpty;
+        }
+
+        if (!(pte & X86.PTE.USER) && this.nCPL == 3) {
+            if (!fSuppress) X86.helpPageFault.call(this, addr, true, fWrite);
+            return this.memEmpty;
+        }
+
+        var addrPhys = (pte & X86.PTE.FRAME) + (addr & X86.LADDR.OFFSET);
+        /*
+         * TODO: Since we're immediately shifting addrPhys by nBlockShift, we could also skip adding the addr's offset.
+         */
+        var blockPhys = this.aBusBlocks[(addrPhys & this.nBusMask) >>> this.nBlockShift];
+        if (fSuppress) return blockPhys;
+
+        var iBlock = addr >>> this.nBlockShift;
+        var block = this.aMemBlocks[iBlock];
+
+        /*
+         * So we have the block containing the physical memory corresponding to the given linear address.
+         *
+         * Now we can create a new PAGED Memory block and record the physical block info using setPhysBlock().
+         */
+        var blockPage = this.acquirePageBlock(addr & ~X86.LADDR.OFFSET);
+        blockPage.setPhysBlock(blockPhys, blockPDE, offPDE, blockPTE, offPTE);
+        blockPage.copyBreakpoints(this.dbg, block);
+
+        this.aMemBlocks[iBlock] = blockPage;
+        this.aBlocksPaged.push(iBlock);
+
+        return blockPage;
+    }
+
+    /**
+     * disablePageBlocks()
+     *
+     * Whenever the CPU turns off paging, this function restores the CPU's original aMemBlocks.
+     *
+     * @this {X86CPU}
+     */
+    disablePageBlocks()
+    {
+        if (this.aMemBlocks !== this.aBusBlocks) {
+            this.aMemBlocks = this.aBusBlocks;
+            this.blockUnpaged = null;
+            this.aBlocksPaged = null;
+            this.memEmpty = null;
+        }
+    }
+
+    /**
+     * isPagingEnabled()
+     *
+     * @this {X86CPU}
+     * @return {boolean}
+     */
+    isPagingEnabled()
+    {
+        var fPaging = !!(this.regCR0 & X86.CR0.PG);
+
+        return fPaging;
+    }
+
+    /**
+     * initProcessor()
+     *
+     * This isolates 80186/80188/80286/80386 support, so that it can be selectively enabled/tested.
+     *
+     * Here's a summary of 80186/80188 differences according to "AP-186: Introduction to the 80186
+     * Microprocessor, March 1983" (pp.55-56).  "The iAPX 86,88 and iAPX 186,188 User's Manual Programmer's
+     * Reference", p.3-38, apparently contains the same information, but I've not seen that document.
+     *
+     * Undefined [Invalid] Opcodes:
+     *
+     *      When the opcodes 63H, 64H, 65H, 66H, 67H, F1H, FEH/xx111xxxB and FFH/xx111xxxB are executed,
+     *      the 80186 will execute an illegal [invalid] instruction exception, interrupt 0x06.
+     *      The 8086 will ignore the opcode.
+     *
+     * 0FH opcode:
+     *
+     *      When the opcode 0FH is encountered, the 8086 will execute a POP CS, while the 80186 will
+     *      execute an illegal [invalid] instruction exception, interrupt 0x06.
+     *
+     * Word Write at Offset FFFFH:
+     *
+     *      When a word write is performed at offset FFFFH in a segment, the 8086 will write one byte
+     *      at offset FFFFH, and the other at offset 0, while the 80186 will write one byte at offset
+     *      FFFFH, and the other at offset 10000H (one byte beyond the end of the segment). One byte segment
+     *      underflow will also occur (on the 80186) if a stack PUSH is executed and the Stack Pointer
+     *      contains the value 1.
+     *
+     * Shift/Rotate by Value Greater Then [sic] 31:
+     *
+     *      Before the 80186 performs a shift or rotate by a value (either in the CL register, or by an
+     *      immediate value) it ANDs the value with 1FH, limiting the number of bits rotated to less than 32.
+     *      The 8086 does not do this.
+     *
+     * LOCK prefix:
+     *
+     *      The 8086 activates its LOCK signal immediately after executing the LOCK prefix. The 80186 does
+     *      not activate the LOCK signal until the processor is ready to begin the data cycles associated
+     *      with the LOCKed instruction.
+     *
+     * Interrupted String Move Instructions:
+     *
+     *      If an 8086 is interrupted during the execution of a repeated string move instruction, the return
+     *      value it will push on the stack will point to the last prefix instruction before the string move
+     *      instruction. If the instruction had more than one prefix (e.g., a segment override prefix in
+     *      addition to the repeat prefix), it will not be re-executed upon returning from the interrupt.
+     *      The 80186 will push the value of the first prefix to the repeated instruction, so long as prefixes
+     *      are not repeated, allowing the string instruction to properly resume.
+     *
+     * Conditions causing divide error with an integer divide:
+     *
+     *      The 8086 will cause a divide error whenever the absolute value of the quotient is greater then
+     *      [sic] 7FFFH (for word operations) or if the absolute value of the quotient is greater than 7FH
+     *      (for byte operations). The 80186 has expanded the range of negative numbers allowed as a quotient
+     *      by 1 to include 8000H and 80H. These numbers represent the most negative numbers representable
+     *      using 2's complement arithmetic (equaling -32768 and -128 in decimal, respectively).
+     *
+     * ESC Opcode:
+     *
+     *      The 80186 may be programmed to cause an interrupt type 7 whenever an ESCape instruction (used for
+     *      co-processors like the 8087) is executed. The 8086 has no such provision. Before the 80186 performs
+     *      this trap, it must be programmed to do so. [The details of this "programming" are not included.]
+     *
+     * Here's a summary of 80286 differences according to "80286 and 80287 Programmer's Reference Manual",
+     * Appendix C, p.C-1 (p.329):
+     *
+     *   1. Add Six Interrupt Vectors
+     *
+     *      The 80286 adds six interrupts which arise only if the 8086 program has a hidden bug. These interrupts
+     *      occur only for instructions which were undefined on the 8086/8088 or if a segment wraparound is attempted.
+     *      It is recommended that you add an interrupt handler to the 8086 software that is to be run on the 80286,
+     *      which will treat these interrupts as invalid operations.
+     *
+     *      This additional software does not significantly effect [sic] the existing 8086 software because the interrupts
+     *      do not normally occur and should not already have been used since they are in the interrupt group reserved
+     *      by Intel. [NOTE: IBM ignored Intel's admonishments.]
+     *
+     *   2. Do not Rely on 8086/8088 Instruction Clock Counts
+     *
+     *      The 80286 takes fewer clocks for most instructions than the 8086/8088. The areas to look into are delays
+     *      between I/0 operations, and assumed delays in 8086/8088 operating in parallel with an 8087.
+     *
+     *   3. Divide Exceptions Point at the DIV Instruction
+     *
+     *      Any interrupt on the 80286 will always leave the saved CS:IP value pointing at the beginning of the
+     *      instruction that failed (including prefixes). On the 8086, the CS:IP value saved for a divide exception
+     *      points at the next instruction.
+     *
+     *   4. Use Interrupt 16 (0x10) for Numeric Exceptions
+     *
+     *      Any 80287 system must use interrupt vector 16 for the numeric error interrupt. If an 8086/8087 or 8088/8087
+     *      system uses another vector for the 8087 interrupt, both vectors should point at the numeric error interrupt
+     *      handler.
+     *
+     *   5. Numeric Exception Handlers Should allow Prefixes
+     *
+     *      The saved CS:IP value in the NPX environment save area will point at any leading prefixes before an ESC
+     *      instruction. On 8086/8088 systems, this value points only at the ESC instruction.
+     *
+     *   6. Do Not Attempt Undefined 8086/8088 Operations
+     *
+     *      Instructions like POP CS or MOV CS,op will either cause exception 6 (undefined [invalid] opcode) or perform
+     *      a protection setup operation like LIDT on the 80286. Undefined bit encodings for bits 5-3 of the second byte
+     *      of POP MEM or PUSH MEM will cause exception 13 on the 80286.
+     *
+     *   7. Place a Far JMP Instruction at FFFF0H
+     *
+     *      After reset, CS:IP = F000:FFF0 on the 80286 (versus FFFF:0000 on the 8086/8088). This change was made to allow
+     *      sufficient code space to enter protected mode without reloading CS. Placing a far JMP instruction at FFFF0H
+     *      will avoid this difference. Note that the BOOTSTRAP option of LOC86 will automatically generate this jump
+     *      instruction.
+     *
+     *   8. Do not Rely on the Value Written by PUSH SP
+     *
+     *      The 80286 will push a different value on the stack for PUSH SP than the 8086/8088. If the value pushed is
+     *      important [and when would it NOT be?], replace PUSH SP instructions with the following three instructions:
+     *
+     *          PUSH    BP
+     *          MOV     BP,SP
+     *          XCHG    BP,[BP]
+     *
+     *      This code functions as the 8086/8088 PUSH SP instruction on the 80286.
+     *
+     *   9. Do not Shift or Rotate by More than 31 Bits
+     *
+     *      The 80286 masks all shift/rotate counts to the low 5 bits. This MOD 32 operation limits the count to a maximum
+     *      of 31 bits. With this change, the longest shift/rotate instruction is 39 clocks. Without this change, the longest
+     *      shift/rotate instruction would be 264 clocks, which delays interrupt response until the instruction completes
+     *      execution.
+     *
+     *  10. Do not Duplicate Prefixes
+     *
+     *      The 80286 sets an instruction length limit of 10 bytes. The only way to violate this limit is by duplicating
+     *      a prefix two or more times before an instruction. Exception 6 occurs if the instruction length limit is violated.
+     *      The 8086/8088 has no instruction length limit.
+     *
+     *  11. Do not Rely on Odd 8086/8088 LOCK Characteristics
+     *
+     *      The LOCK prefix and its corresponding output signal should only be used to prevent other bus masters from
+     *      interrupting a data movement operation. The 80286 will always assert LOCK during an XCHG instruction with memory
+     *      (even if the LOCK prefix was not used). LOCK should only be used with the XCHG, MOV, MOVS, INS, and OUTS instructions.
+     *
+     *      The 80286 LOCK signal will not go active during an instruction prefetch.
+     *
+     *  12. Do not Single Step External Interrupt Handlers
+     *
+     *      The priority of the 80286 single step interrupt is different from that of the 8086/8088. This change was made
+     *      to prevent an external interrupt from being single-stepped if it occurs while single stepping through a program.
+     *      The 80286 single step interrupt has higher priority than any external interrupt.
+     *
+     *      The 80286 will still single step through an interrupt handler invoked by INT instructions or an instruction
+     *      exception.
+     *
+     *  13. Do not Rely on IDIV Exceptions for Quotients of 80H or 8000H
+     *
+     *      The 80286 can generate the largest negative number as a quotient for IDIV instructions. The 8086 will instead
+     *      cause exception O.
+     *
+     *  14. Do not Rely on NMI Interrupting NMI Handlers
+     *
+     *      After an NMI is recognized, the NMI input and processor extension limit error interrupt is masked until the
+     *      first IRET instruction is executed.
+     *
+     *  15. The NPX error signal does not pass through an interrupt controller (an 8087 INT signal does). Any interrupt
+     *      controller-oriented instructions for the 8087 may have to be deleted.
+     *
+     *  16. If any real-mode program relies on address space wrap-around (e.g., FFF0:0400=0000:0300), then external hardware
+     *      should be used to force the upper 4 addresses to zero during real mode.
+     *
+     *  17. Do not use I/O ports 00F8-00FFH. These are reserved for controlling 80287 and future processor extensions.
+     *
+     * @this {X86CPU}
+     */
+    initProcessor()
+    {
+        this.PS_SET = X86.PS_SET_8086;
+        this.PS_DIRECT = X86.PS_DIRECT_8086;
+        this.PS_CLEAR_RM = X86.PS.IOPL.MASK | X86.PS.NT;
+
+        this.OPFLAG_NOINTR_8086 = X86.OPFLAG.NOINTR;
+        this.nShiftCountMask = 0xff;            // on an 8086/8088, all shift counts are used as-is
+
+        this.cycleCounts = (this.model >= X86.MODEL_80286? X86.CYCLES_80286 : X86.CYCLES_8088);
+
+        this.aOps     = X86.aOps;
+        this.aOpGrp4b = X86.aOpGrp4b;
+        this.aOpGrp4w = X86.aOpGrp4w;
+        this.aOpGrp6  = X86.aOpGrp6Real;        // setProtMode() will ensure that aOpGrp6 is switched
+
+        if (this.model >= X86.MODEL_80186) {
+            /*
+             * I don't go out of my way to make 80186/80188 cycle times accurate, since I'm not aware of any
+             * IBM PC models that used those processors; beyond the 8086, my next priorities are the 80286 and
+             * 80386, but I might revisit the 80186 someday.
+             *
+             * Instruction handlers that contain "hard-coded" 80286 cycle times include: opINSb, opINSw, opOUTSb,
+             * opOUTSw, opENTER, and opLEAVE.
+             */
+            this.aOps = X86.aOps.slice();       // make copies of opcode tables before modifying
+            this.aOpGrp4b = X86.aOpGrp4b.slice();
+            this.aOpGrp4w = X86.aOpGrp4w.slice();
+            this.nShiftCountMask = 0x1f;        // on newer processors, all shift counts are MOD 32
+            this.aOps[0x0F]                 = X86.opInvalid;
+            this.aOps[X86.OPCODE.PUSHA]     = X86.opPUSHA;      // 0x60
+            this.aOps[X86.OPCODE.POPA]      = X86.opPOPA;       // 0x61
+            this.aOps[X86.OPCODE.BOUND]     = X86.opBOUND;      // 0x62
+            this.aOps[X86.OPCODE.ARPL]      = X86.opInvalid;    // 0x63
+            this.aOps[X86.OPCODE.FS]        = X86.opInvalid;    // 0x64
+            this.aOps[X86.OPCODE.GS]        = X86.opInvalid;    // 0x65
+            this.aOps[X86.OPCODE.OS]        = X86.opInvalid;    // 0x66
+            this.aOps[X86.OPCODE.AS]        = X86.opInvalid;    // 0x67
+            this.aOps[X86.OPCODE.PUSHN]     = X86.opPUSHn;      // 0x68
+            this.aOps[X86.OPCODE.IMULN]     = X86.opIMULn;      // 0x69
+            this.aOps[X86.OPCODE.PUSH8]     = X86.opPUSH8;      // 0x6A
+            this.aOps[X86.OPCODE.IMUL8]     = X86.opIMUL8;      // 0x6B
+            this.aOps[X86.OPCODE.INSB]      = X86.opINSb;       // 0x6C
+            this.aOps[X86.OPCODE.INSW]      = X86.opINSw;       // 0x6D
+            this.aOps[X86.OPCODE.OUTSB]     = X86.opOUTSb;      // 0x6E
+            this.aOps[X86.OPCODE.OUTSW]     = X86.opOUTSw;      // 0x6F
+            this.aOps[0xC0]                 = X86.opGRP2bn;     // 0xC0
+            this.aOps[0xC1]                 = X86.opGRP2wn;     // 0xC1
+            this.aOps[X86.OPCODE.ENTER]     = X86.opENTER;      // 0xC8
+            this.aOps[X86.OPCODE.LEAVE]     = X86.opLEAVE;      // 0xC9
+            this.aOps[0xF1]                 = X86.opINT1;       // 0xF1
+            this.aOpGrp4b[0x07]             = X86.fnGRPInvalid;
+            this.aOpGrp4w[0x07]             = X86.fnGRPInvalid;
+
+            if (this.model >= X86.MODEL_80286) {
+
+                this.PS_SET = X86.PS.BIT1;      // on the 80286, only BIT1 of Processor Status (flags) is always set
+                this.PS_DIRECT |= X86.PS.IOPL.MASK | X86.PS.NT;
+
+                this.OPFLAG_NOINTR_8086 = 0;    // for instructions that do *not* set NOINTR on an 80286 (eg, non-SS segment loads)
+
+                this.aOps[0x0F] = X86.op0F;
+                this.aOps0F = X86.aOps0F.slice();
+                for (var i = 0; i < this.aOps0F.length; i++) {
+                    if (!this.aOps0F[i]) this.aOps0F[i] = X86.opUndefined;
+                }
+                this.aOps[X86.OPCODE.PUSHSP] = X86.opPUSHSP;    // 0x54
+                this.aOps[X86.OPCODE.ARPL]   = X86.opARPL;      // 0x63
+
+                if (I386 && this.model >= X86.MODEL_80386) {
+                    var bOpcode;
+                    this.PS_CLEAR_RM = 0;       // NOTE: This allows the 80386 to modify X86.PS.NT in real-mode (which is presumably OK)
+                    this.PS_DIRECT |= X86.PS.RF | X86.PS.VM;
+                    this.aOps[X86.OPCODE.FS] = X86.opFS;        // 0x64
+                    this.aOps[X86.OPCODE.GS] = X86.opGS;        // 0x65
+                    this.aOps[X86.OPCODE.OS] = X86.opOS;        // 0x66
+                    this.aOps[X86.OPCODE.AS] = X86.opAS;        // 0x67
+                    for (bOpcode in X86.aOps0F386) {
+                        this.aOps0F[+bOpcode] = X86.aOps0F386[+bOpcode];
+                    }
+                    if (this.stepping >= X86.STEPPING_80386_A0 && this.stepping <= X86.STEPPING_80386_B0) {
+                        this.aOps0F[0xA6] = X86.opXBTS;
+                        this.aOps0F[0xA7] = X86.opIBTS;
+                    }
+                }
+            }
+        }
+    }
+
+    /**
+     * reset()
+     *
+     * @this {X86CPU}
+     */
+    reset()
+    {
+        if (this.flags.running) this.stopCPU();
+        this.resetRegs();
+        this.resetCycles();
+        this.clearError();      // clear any fatal error/exception that setError() may have flagged
+    }
+
+    /**
+     * getReg(i)
+     *
+     * @this {X86CPU}
+     * @param {number} i (0-7)
+     * @return {number}
+     */
+    getReg(i)
+    {
+        var reg;
+        switch(i) {
+        case 0x0:
+            reg = this.regEAX;
+            break;
+        case 0x1:
+            reg = this.regECX;
+            break;
+        case 0x2:
+            reg = this.regEDX;
+            break;
+        case 0x3:
+            reg = this.regEBX;
+            break;
+        case 0x4:
+            reg = this.getSP();
+            break;
+        case 0x5:
+            reg = this.regEBP;
+            break;
+        case 0x6:
+            reg = this.regESI;
+            break;
+        case 0x7:
+            reg = this.regEDI;
+            break;
+        }
+        return reg;
+    }
+
+    /**
+     * setReg(i, reg)
+     *
+     * @this {X86CPU}
+     * @param {number} i (0-7)
+     * @param {number} reg
+     */
+    setReg(i, reg)
+    {
+        switch(i) {
+        case 0x0:
+            this.regEAX = reg;
+            break;
+        case 0x1:
+            this.regECX = reg;
+            break;
+        case 0x2:
+            this.regEDX = reg;
+            break;
+        case 0x3:
+            this.regEBX = reg;
+            break;
+        case 0x4:
+            this.setSP(reg);
+            break;
+        case 0x5:
+            this.regEBP = reg;
+            break;
+        case 0x6:
+            this.regESI = reg;
+            break;
+        case 0x7:
+            this.regEDI = reg;
+            break;
+        }
+    }
+
+    /**
+     * resetRegs()
+     *
+     * According to "The 8086 Book", p.7-5, a RESET signal initializes the following registers:
+     *
+     *      PS          =   0x0000 (which has the important side-effect of disabling interrupts and traps)
+     *      IP          =   0x0000
+     *      CS          =   0xFFFF
+     *      DS/ES/SS    =   0x0000
+     *
+     * It is silent as to whether the remaining registers are initialized to any particular values.
+     *
+     * According to the "80286 and 80287 Programmer's Reference Manual", these 80286 registers are reset:
+     *
+     *      PS          =   0x0002
+     *      MSW         =   0xFFF0
+     *      IP          =   0xFFF0
+     *      CS Selector =   0xF000      DS/ES/SS Selector =   0x0000
+     *      CS Base     = 0xFF0000      DS/ES/SS Base     = 0x000000        IDT Base  = 0x000000
+     *      CS Limit    =   0xFFFF      DS/ES/SS Limit    =   0xFFFF        IDT Limit =   0x03FF
+     *
+     * And from the "INTEL 80386 PROGRAMMER'S REFERENCE MANUAL 1986", section 10.1:
+     *
+     *      The contents of EAX depend upon the results of the power-up self test. The self-test may be requested
+     *      externally by assertion of BUSY# at the end of RESET. The EAX register holds zero if the 80386 passed
+     *      the test. A nonzero value in EAX after self-test indicates that the particular 80386 unit is faulty.
+     *      If the self-test is not requested, the contents of EAX after RESET is undefined.
+     *
+     *      DX holds a component identifier and revision number after RESET as Figure 10-1 illustrates. DH contains
+     *      3, which indicates an 80386 component. DL contains a unique identifier of the revision level.
+     *
+     *      EFLAGS      =   0x00000002
+     *      IP          =   0x0000FFF0
+     *      CS selector =   0xF000 (base of 0xFFFF0000 and limit of 0xFFFF)
+     *      DS selector =   0x0000
+     *      ES selector =   0x0000
+     *      SS selector =   0x0000
+     *      FS selector =   0x0000
+     *      GS selector =   0x0000
+     *      IDTR        =   base of 0 and limit of 0x3FF
+     *
+     * All other 80386 registers are undefined after a reset (ie, Intel did not document how or if they are set).
+     *
+     * We've elected to set DX to 0x0308 on a reset, the highest known 80386 revision, since we have no desire to
+     * try to emulate all the bugs in older (eg, B1) steppings -- at least not initially.  We leave stepping-accurate
+     * emulation for another day.  It's also known that the B1 (and possibly B0) reported 0x0303 in DX, and that
+     * the D0 stepping reported 0x0305; beyond that, it's not known exactly what revision numbers Intel used for all
+     * 80386 revisions.
+     *
+     * We define some additional "registers", such as regLIP, which mirrors the linear address corresponding to
+     * CS:IP (the address of the next opcode byte).  In fact, regLIP functions as our internal IP register, so any
+     * code that needs the real IP must call getIP().  This, in turn, means that whenever CS or IP must be modified,
+     * regLIP must be recalculated, so you must use either setCSIP(), which takes both an offset and a segment,
+     * or setIP(), whichever is appropriate; in unusual cases where only segCS is changing (eg, undocumented 8086
+     * opcodes), use setCS().
+     *
+     * Similarly, regLSP mirrors the linear address corresponding to SS:SP, and therefore you must rely on getSP()
+     * to read the current SP, and setSP() and setSS() to update SP and SS.
+     *
+     * The other segment registers, such as segDS and segES, have similar getters and setters, but we do not mirror
+     * any other segment:offset values in the same way that regLIP mirrors CS:IP, or that regLSP mirrors SS:SP.
+     *
+     * @this {X86CPU}
+     */
+    resetRegs()
+    {
+        this.regEAX = 0;
+        this.regEBX = 0;
+        this.regECX = 0;
+        this.regEDX = 0;
+        this.regESP = 0;            // this isn't needed in a 16-bit environment, but is required for I386
+        this.regEBP = 0;
+        this.regESI = 0;
+        this.regEDI = 0;
+
+        /*
+         * The following are internal "registers" used to capture intermediate values inside selected helper
+         * functions and use them if they've been modified (or are known to change); for example, the MUL and DIV
+         * instructions perform calculations that must be propagated to specific registers (eg, AX and/or DX), which
+         * the ModRM decoder functions don't know about.  We initialize them here mainly for documentation purposes.
+         */
+        this.fMDSet = false;        // regMDHi and/or regMDLo are invalid unless fMDSet is true
+        this.regMDLo = this.regMDHi = 0;
+        this.r64Div = [0, 0];
+        this.r64Rem = [0, 0];
+        this.regXX = 0;             // for internal use only (eg, assists with ModRM helper functions)
+
+        /*
+         * This internal "register" is set in selected opcode handlers to record the original opcode; ordinarily,
+         * we dispatch on the opcode but never save it, because it's rarely needed.
+         */
+        this.bOpcode = 0;
+
+        /*
+         * Another internal "register" we occasionally need is an interim copy of bModRM, set inside selected opcode
+         * handlers so that the helper function can have access to the instruction's bModRM without resorting to a
+         * closure (which, in the Chrome V8 engine, for example, may cause constant recompilation).
+         */
+        this.bModRM = 0;
+
+        /*
+         * NOTE: Even though the 8086 doesn't have CR0 (aka MSW) and IDTR, we initialize them for ALL CPUs, so
+         * that functions like X86.helpINT() can use the same code for both.  The 8086/8088 have no direct way
+         * of accessing or changing them, so this is an implementation detail those processors are unaware of.
+         */
+        this.regCR0 = X86.CR0.MSW.ON;
+        this.addrIDT = 0;
+        this.addrIDTLimit = 0x03FF;
+        this.regPS = this.nIOPL = 0;// these should be set before the first setPS() call
+
+        /*
+         * Define all the result registers that can be used to "cache" arithmetic and logical flags.
+         *
+         * In addition, setPS() will initialize resultType, which keeps track of which flags are cached,
+         * and resultSize, which maintains the size of the last result; initially, no flags are cached.
+         */
+        this.resultDst = this.resultSrc = this.resultArith = this.resultLogic = 0;
+
+        /*
+         * nFault is set by helpFault() and reset (to -1) by resetRegs() and opIRET().  Its initial purpose was to
+         * help helpFault() determine when a nested fault should be converted into either a double-fault (DF_FAULT)
+         * or a triple-fault (ie, a processor reset).
+         *
+         * It has since evolved into another important role: helping segCS.loadIDT() know when an exception
+         * is occurring, as opposed to a software interrupt (eg, INT3, INT n or INTO).  The former must set nFault
+         * to the corresponding fault #, whereas the latter must set it to -1, so that if the IDT contains a gate
+         * whose DPL < CPL, a GP fault will be generated instead.
+         *
+         * The former always call helpFault(), and the latter call helpTrap(), so nFault is updated automatically.
+         * However, there are also intermediate cases, like hardware interrupts, which call helpINT() after manually
+         * setting nFault to the IDT #.  TODO: Review all those "intermediate" cases.
+         */
+        this.nFault = -1;
+
+        /*
+         * These are used to snapshot regLIP and regLSP, to help make instructions restartable;
+         * currently opLIP is updated prior to every instruction, but opLSP is updated only for instructions
+         * that modify the stack pointer (eg, RETF) and should otherwise remain set to X86.ADDR_INVALID.
+         *
+         * More recently, opCS was added to selectively snapshot an instruction's original CS in case an
+         * exception occurs accessing the stack after a new CS has been loaded, allowing the exception handler
+         * to recover the old CS and make instructions like CALLF restartable; otherwise, opCS should remain -1.
+         *
+         * Ditto for opSS and the SS register.
+         */
+        this.opCS = this.opSS = -1;
+        this.opLIP = this.opLSP = X86.ADDR_INVALID;
+
+        /*
+         * Segment registers used to be defined as separate selector and base variables (eg, regCS and regCS0),
+         * but now they are defined as X86Seg objects.
+         */
+        this.segCS     = new X86Seg(this, X86Seg.ID.CODE,  "CS");
+        this.segDS     = new X86Seg(this, X86Seg.ID.DATA,  "DS");
+        this.segES     = new X86Seg(this, X86Seg.ID.DATA,  "ES");
+        this.segSS     = new X86Seg(this, X86Seg.ID.STACK, "SS");
+        this.setSP(0);
+        this.setSS(0);
+
+        if (I386 && this.model >= X86.MODEL_80386) {
+            /*
+             * Here lies everything I currently know about 80386 stepping revision numbers...
+             */
+            switch(this.stepping) {
+            case X86.STEPPING_80386_B0:
+            case X86.STEPPING_80386_B1:
+                this.regEDX = 0x0303;
+                break;
+            case X86.STEPPING_80386_C0:
+                this.regEDX = 0x0304;
+                break;
+            case X86.STEPPING_80386_D0:
+                this.regEDX = 0x0305;
+                break;
+            case X86.STEPPING_80386_D1:
+            case X86.STEPPING_80386_D2:
+                this.regEDX = 0x0308;
+                break;
+            default:
+                break;                      // in the absence of a specific stepping, we leave DX set to zero
+            }
+            this.regCR0 = X86.CR0.ET;       // formerly MSW
+            this.regCR1 = 0;                // reserved
+            this.regCR2 = 0;                // page fault linear address (PFLA)
+            this.regCR3 = 0;                // page directory base register (PDBR)
+            this.regDR  = [0,0,0,0,null,null,0,0];              // Debug Registers DR0-DR7 (DR4-DR5 are undefined)
+            this.regTR  = [null,null,null,null,null,null,0,0];  // Test Registers TR0-TR7 (TR0-TR5 are undefined)
+            this.segFS = new X86Seg(this, X86Seg.ID.DATA,  "FS");
+            this.segGS = new X86Seg(this, X86Seg.ID.DATA,  "GS");
+            /*
+             * Synchronize the fact that paging is initially disabled with our PAGEBLOCKS functions
+             */
+            this.disablePageBlocks();
+        }
+
+        this.segNULL = new X86Seg(this, X86Seg.ID.NULL,  "NULL");
+
+        /*
+         * The next few initializations mirror what we must do prior to each instruction (ie, inside the stepCPU() function);
+         * note that opPrefixes, along with segData and segStack, are reset only after we've executed a non-prefix instruction.
+         */
+        this.segData = this.segDS;
+        this.segStack = this.segSS;
+        this.opFlags = this.opPrefixes = 0;
+        this.regEA = this.regEAWrite = X86.ADDR_INVALID;
+
+        this.segEA = this.segNULL;
+
+        /*
+         * intFlags contains some internal states we use to indicate whether a hardware interrupt (INTFLAG.INTR) or
+         * Trap software interrupt (INTR.TRAP) has been requested, as well as when we're in a "HLT" state (INTFLAG.HALT)
+         * that requires us to wait for a hardware interrupt (INTFLAG.INTR) before continuing execution.
+         *
+         * intFlags must be cleared only by checkINTR(), whereas opFlags must be cleared prior to every CPU operation.
+         */
+        this.intFlags = X86.INTFLAG.NONE;
+
+        if (BACKTRACK) {
+            /*
+             * Initialize the backtrack indexes for all registers to zero.  And while, yes, it IS possible
+             * for raw data to flow through segment registers as well, it's not common enough in real-mode
+             * (and too difficult in protected-mode) to merit the overhead.  Ditto for SP, which can't really
+             * be considered a general-purpose register.
+             *
+             * Every time getByte() is called, btiMem0 is filled with the matching backtrack info; similarly,
+             * every time getWord() is called, btiMem0 and btiMem1 are filled with the matching backtrack info
+             * for the low and high bytes, respectively.
+             */
+            this.backTrack = {
+                btiAL:      0,
+                btiAH:      0,
+                btiBL:      0,
+                btiBH:      0,
+                btiCL:      0,
+                btiCH:      0,
+                btiDL:      0,
+                btiDH:      0,
+                btiBPLo:    0,
+                btiBPHi:    0,
+                btiSILo:    0,
+                btiSIHi:    0,
+                btiDILo:    0,
+                btiDIHi:    0,
+                btiMem0:    0,
+                btiMem1:    0,
+                btiMem2:    0,
+                btiMem3:    0,
+                btiEALo:    0,
+                btiEAHi:    0,
+                btiIO:      0
+            };
+        }
+
+        /*
+         * Set the initial CS:IP appropriate for the processor; this should be done before the first setPS() call,
+         * in part so that CPL will be set properly.
+         */
+        if (this.model < X86.MODEL_80286) {
+            this.setCSIP(0, 0xffff);
+        } else {
+            /*
+             * Assorted 80286-specific registers.  The GDTR and IDTR registers are stored as the following pieces:
+             *
+             *      GDTR:   addrGDT (24 bits) and addrGDTLimit (24 bits)
+             *      IDTR:   addrIDT (24 bits) and addrIDTLimit (24 bits)
+             *
+             * while the LDTR and TR are stored as special segment registers: segLDT and segTSS.
+             *
+             * So, yes, our GDTR and IDTR "registers" differ from other segment registers in that we do NOT record
+             * the 16-bit limit specified by the LGDT or LIDT instructions; instead, we immediately calculate the limiting
+             * address, and record that instead.
+             *
+             * In addition to different CS:IP reset values, the CS base address must be set to the top of the 16Mb
+             * address space rather than the top of the first 1Mb (which is why the MODEL_5170 ROM must be addressable
+             * at both 0x0F0000 and 0xFF0000; see the ROM component's "alias" parameter).
+             *
+             * TODO: Verify what the 80286 actually sets addrGDT and addrGDTLimit to on reset (or if it leaves them alone).
+             */
+            this.addrGDT = 0; this.addrGDTLimit = 0xffff;                   // GDTR
+            this.segLDT = new X86Seg(this, X86Seg.ID.LDT, "LDT", true);     // LDTR
+            this.segTSS = new X86Seg(this, X86Seg.ID.TSS, "TSS", true);     // TR
+            this.segVER = new X86Seg(this, X86Seg.ID.VER, "VER", true);     // a scratch segment register for VERR and VERW instructions
+            this.setCSIP(0xfff0, 0xf000);                   // on an 80286 or 80386, the default CS:IP is 0xF000:0xFFF0 instead of 0xFFFF:0x0000
+            this.setCSBase(0xffff0000|0);                   // on an 80286 or 80386, all CS base address bits above bit 15 must be set
+        }
+
+        /*
+         * This resets the Processor Status flags (regPS), along with all the internal "result registers";
+         * we've taken care to ensure that both CPL and IOPL are initialized before this first setPS() call.
+         */
+        this.setPS(0);
+
+        /*
+         * Now that all the segment registers have been created, it's safe to set the current addressing mode.
+         */
+        this.setProtMode();
+    }
+
+    /**
+     * updateAddrSize()
+     *
+     * Select the appropriate ModRM dispatch tables, based on the current ADDRESS size (addrSize), which
+     * is based foremost on segCS.sizeAddr, but can also be overridden by an ADDRESS size instruction prefix.
+     *
+     * There used to be six primary ModRM dispatch table pointers:
+     *
+     *      aOpModRegByte
+     *      aOpModMemByte
+     *      aOpModGrpByte
+     *      aOpModRegWord
+     *      aOpModMemWord
+     *      aOpModGrpWord
+     *
+     * However, when support for the 80386 was added, the number of dispatch tables doubled, and since each entry
+     * in the table was a discrete function, decoding was fast, but it also required a LOT of code.
+     *
+     * So we have now replaced the above table pointers with function pointers:
+     *
+     *      decodeModRegByte (set to one of: modRegByte16, modRegByte32)
+     *      decodeModMemByte (set to one of: modMemByte16, modMemByte32)
+     *      decodeModGrpByte (set to one of: modGrpByte16, modGrpByte32)
+     *      decodeModRegWord (set to one of: modRegShort16, modRegLong16, modRegShort32, modRegLong32)
+     *      decodeModMemWord (set to one of: modMemShort16, modMemLong16, modMemShort32, modMemLong32)
+     *      decodeModGrpWord (set to one of: modGrpShort16, modGrpLong16, modGrpShort32, modGrpLong32)
+     *
+     * So opcode handlers that used to do this:
+     *
+     *      this.aOpModMemByte[b].call(this, X86.fnADDb);
+     *
+     * now do this:
+     *
+     *      this.decodeModMemByte.call(this, X86.fnADDb);
+     *
+     * Decoding of ModRM bytes is now slightly slower, but the previous code is still in the repository
+     * (look for x86modb.js and x86modw.js for the pre-80386 dispatch tables, and x86modb16.js, x86modb32.js,
+     * x86modw16.js, x86modw32.js, and x86modsib.js for the post-80386 dispatch tables).
+     *
+     * @this {X86CPU}
+     */
+    updateAddrSize()
+    {
+        if (!I386) {
+            this.getAddr = (PREFETCH? this.getShortPrefetch : this.getShort);
+            this.decodeModRegByte = X86.modRegByte16;
+            this.decodeModMemByte = X86.modMemByte16;
+            this.decodeModGrpByte = X86.modGrpByte16;
+            this.decodeModRegWord = X86.modRegShort16;
+            this.decodeModMemWord = X86.modMemShort16;
+            this.decodeModGrpWord = X86.modGrpShort16;
+        } else {
+            if (this.sizeAddr == 2) {
+                this.getAddr = (PREFETCH? this.getShortPrefetch : this.getShort);
+                this.decodeModRegByte = X86.modRegByte16;
+                this.decodeModMemByte = X86.modMemByte16;
+                this.decodeModGrpByte = X86.modGrpByte16;
+                if (this.sizeData == 2) {
+                    this.decodeModRegWord = X86.modRegShort16;
+                    this.decodeModMemWord = X86.modMemShort16;
+                    this.decodeModGrpWord = X86.modGrpShort16;
+                } else {
+                    this.decodeModRegWord = X86.modRegLong16;
+                    this.decodeModMemWord = X86.modMemLong16;
+                    this.decodeModGrpWord = X86.modGrpLong16;
+                }
+            } else {
+                this.getAddr = (PREFETCH? this.getLongPrefetch : this.getLong);
+                this.decodeModRegByte = X86.modRegByte32;
+                this.decodeModMemByte = X86.modMemByte32;
+                this.decodeModGrpByte = X86.modGrpByte32;
+                if (this.sizeData == 2) {
+                    this.decodeModRegWord = X86.modRegShort32;
+                    this.decodeModMemWord = X86.modMemShort32;
+                    this.decodeModGrpWord = X86.modGrpShort32;
+                } else {
+                    this.decodeModRegWord = X86.modRegLong32;
+                    this.decodeModMemWord = X86.modMemLong32;
+                    this.decodeModGrpWord = X86.modGrpLong32;
+                }
+            }
+        }
+    }
+
+    /**
+     * setDataSize(size)
+     *
+     * This is used by opcodes that require a particular OPERAND size, which we enforce by internally
+     * simulating an OPERAND size override, if needed.
+     *
+     * @this {X86CPU}
+     * @param {number} size (2 for 2-byte/16-bit operands, or 4 for 4-byte/32-bit operands)
+     */
+    setDataSize(size)
+    {
+        if (this.sizeData != size) {
+            this.opPrefixes |= X86.OPFLAG.DATASIZE;
+            this.sizeData = size;
+            this.maskData = (size == 2? 0xffff : (0xffffffff|0));
+            this.updateDataSize();
+        }
+    }
+
+    /**
+     * updateDataSize()
+     *
+     * @this {X86CPU}
+     */
+    updateDataSize()
+    {
+        if (this.sizeData == 2) {
+            this.typeData = X86.RESULT.WORD;
+            this.getWord = this.getShort;
+            this.setWord = this.setShort;
+            if (this.sizeAddr == 2) {
+                this.decodeModRegWord = X86.modRegShort16;
+                this.decodeModMemWord = X86.modMemShort16;
+                this.decodeModGrpWord = X86.modGrpShort16;
+            } else {
+                this.decodeModRegWord = X86.modRegShort32;
+                this.decodeModMemWord = X86.modMemShort32;
+                this.decodeModGrpWord = X86.modGrpShort32;
+            }
+        } else {
+            this.typeData = X86.RESULT.DWORD;
+            this.getWord = this.getLong;
+            this.setWord = this.setLong;
+            if (this.sizeAddr == 2) {
+                this.decodeModRegWord = X86.modRegLong16;
+                this.decodeModMemWord = X86.modMemLong16;
+                this.decodeModGrpWord = X86.modGrpLong16;
+            } else {
+                this.decodeModRegWord = X86.modRegLong32;
+                this.decodeModMemWord = X86.modMemLong32;
+                this.decodeModGrpWord = X86.modGrpLong32;
+            }
+        }
+    }
+
+    /**
+     * resetSizes()
+     *
+     * @this {X86CPU}
+     */
+    resetSizes()
+    {
+        /*
+         * The following contain the (default) ADDRESS size (2 for 16 bits, 4 for 32 bits), and the corresponding
+         * masks for isolating the (src) bits of an address and clearing the (dst) bits of an address.  Like the
+         * OPERAND size properties, these are reset to their segCS counterparts at the start of every new instruction.
+         */
+        this.sizeAddr = this.segCS.sizeAddr;
+        this.maskAddr = this.segCS.maskAddr;
+
+        /*
+         * It's also worth noting that instructions that implicitly use the stack also rely on STACK size,
+         * which is based on the BIG bit of the last descriptor loaded into SS; use the following segSS properties:
+         *
+         *      segSS.sizeAddr      (2 or 4)
+         *      segSS.maskAddr      (0xffff or 0xffffffff)
+         *
+         * As there is no STACK size instruction prefix override, there's no need to propagate these segSS properties
+         * to separate X86CPU properties, as we do for the OPERAND size and ADDRESS size properties.
+         */
+
+        this.updateAddrSize();
+
+        /*
+         * The following contain the (default) OPERAND size (2 for 16 bits, 4 for 32 bits), and the corresponding masks
+         * for isolating the (src) bits of an OPERAND and clearing the (dst) bits of an OPERAND.  These are reset to
+         * their segCS counterparts at the start of every new instruction, but are also set here for documentation purposes.
+         */
+        this.sizeData = this.segCS.sizeData;
+        this.maskData = this.segCS.maskData;
+
+        this.updateDataSize();
+
+        this.opPrefixes &= ~(X86.OPFLAG.ADDRSIZE | X86.OPFLAG.DATASIZE);
+    }
+
+    /**
+     * getChecksum()
+     *
+     * @this {X86CPU}
+     * @return {number} a 32-bit summation of key elements of the current CPU state (used by the CPU checksum code)
+     */
+    getChecksum()
+    {
+        var sum = (this.regEAX + this.regEBX + this.regECX + this.regEDX + this.getSP() + this.regEBP + this.regESI + this.regEDI)|0;
+        sum = (sum + this.getIP() + this.getCS() + this.getDS() + this.getSS() + this.getES() + this.getPS())|0;
+        return sum;
+    }
+
+    /**
+     * addIntNotify(nInt, fn)
+     *
+     * Add a software interrupt notification handler to the CPU's list of such handlers.
+     *
+     * TODO: Consider adding removeIntNotify().  Example use case: if the Debugger's intWindowsDebugger() function
+     * detects that an INT 0x41 client is loaded, it would be quite happy to uninstall itself.
+     *
+     * @this {X86CPU}
+     * @param {number} nInt
+     * @param {function(number)} fn is called with the LIP value following the software interrupt
+     */
+    addIntNotify(nInt, fn)
+    {
+        if (this.aIntNotify[nInt] === undefined) {
+            this.aIntNotify[nInt] = [];
+        }
+        this.aIntNotify[nInt].push(fn);
+    }
+
+    /**
+     * checkIntNotify(nInt)
+     *
+     * NOTE: This is called ONLY for "INT N" instructions -- not "INTO" or breakpoint or single-step interrupts
+     * or divide exception interrupts, or hardware interrupts, or any simulation of an interrupt (eg, "PUSHF/CALLF").
+     *
+     * @this {X86CPU}
+     * @param {number} nInt
+     * @return {boolean} true if software interrupt may proceed, false if software interrupt should be skipped
+     */
+    checkIntNotify(nInt)
+    {
+        var aNotify = this.aIntNotify[nInt];
+        if (aNotify !== undefined) {
+            for (var i = 0; i < aNotify.length; i++) {
+                if (!aNotify[i](this.regLIP)) {
+                    return false;
+                }
+            }
+        }
+        /*
+         * The enabling of INT messages is one of the criteria that's also included in the Debugger's checksEnabled()
+         * function, and therefore included in fDebugCheck, so for maximum speed, we check fDebugCheck first.
+         *
+         * NOTE: We've added MAXDEBUG to the test below, because onIntReturn() generates a lot of noise, via
+         * dbg.messageIntReturn(), and because there's no way to be sure we'll catch the return (or for some interrupts,
+         * *whether* they will return), so it's safer to disable this feature unless you really want it.
+         *
+         * For most purposes, just having dbg.messageInt(), and the Debugger's ability to selectively turn categories
+         * of messages on and off, is good enough.
+         */
+        if (DEBUGGER && this.flags.debugCheck) {
+            if (this.messageEnabled(Messages.INT) && this.dbg.messageInt(nInt, this.regLIP) && MAXDEBUG) {
+                this.addIntReturn(this.regLIP, function(cpu, nCycles) {
+                    return function onIntReturn(nLevel) {
+                        cpu.dbg.messageIntReturn(nInt, nLevel, cpu.getCycles() - nCycles);
+                    };
+                }(this, this.getCycles()));
+            }
+        }
+        return true;
+    }
+
+    /**
+     * addIntReturn(addr, fn)
+     *
+     * Add a return notification handler to the CPU's list of such handlers.
+     *
+     * When fn(n) is called, it's passed a "software interrupt level", which will normally be 0,
+     * unless it's a return from a nested software interrupt (eg, return from INT 0x10 Video BIOS
+     * call issued inside another INT 0x10 Video BIOS call).
+     *
+     * Note that the nesting could be due to a completely different software interrupt that
+     * another interrupt notification function is intercepting, so use it as an advisory value only.
+     *
+     * @this {X86CPU}
+     * @param {number} addr is a linear address
+     * @param {function(number)} fn is an interrupt-return notification function
+     */
+    addIntReturn(addr, fn)
+    {
+        if (fn !== undefined) {
+            if (this.aIntReturn[addr] == null) {
+                this.cIntReturn++;
+            }
+            this.aIntReturn[addr] = fn;
+        }
+    }
+
+    /**
+     * checkIntReturn(addr)
+     *
+     * We check for possible "INT n" software interrupt returns in the cases of "IRET" (helpIRET), "RETF 2"
+     * (helpRETF) and "JMPF [DWORD]" (fnJMPFdw).
+     *
+     * "JMPF [DWORD]" is an unfortunate choice that newer versions of DOS (as of at least 3.20, and probably
+     * earlier) employed in their INT 0x13 hooks; I would have preferred not making this call for that opcode.
+     *
+     * It is expected (though not required) that callers will check cIntReturn and avoid calling this function
+     * if the count is zero, for maximum performance.
+     *
+     * @this {X86CPU}
+     * @param {number} addr is a linear address
+     */
+    checkIntReturn(addr)
+    {
+        var fn = this.aIntReturn[addr];
+        if (fn != null) {
+            fn(--this.cIntReturn);
+            delete this.aIntReturn[addr];
+        }
+    }
+
+    /**
+     * checkDebugRegisters(fEnable)
+     *
+     * opMOVdr() simplifies its life by doing work ONLY if the contents of a Debug register is actually changing.
+     *
+     * Whenever a single register is about to change, it calls this function with fEnable set to false to REMOVE any
+     * active checks, then updates the Debug register, then calls us again with fEnable set to true to (re)ADD active
+     * checks.
+     *
+     * @this {X86CPU}
+     * @param {boolean} fEnable
+     */
+    checkDebugRegisters(fEnable)
+    {
+        /*
+         * We use a constant mask for the enable bits (X86.DR7.L0 | X86.DR7.G0) and shift our copy of regDR7
+         * right 2 bits after each Debug register check.
+         *
+         * Similarly, we make a copy of regDR7 in bitsDR7 and shift the latter right 4 bits at a time, so that
+         * the RW and LEN bits for the next Debug register are always in positions 1-0 and 3-2, respectively.
+         */
+        var regDR7 = this.regDR[7];
+        var bitsDR7 = regDR7 >> 16;
+
+        for (var i = 0; i < 4; i++) {
+            if (regDR7 & (X86.DR7.L0 | X86.DR7.G0)) {
+                /*
+                 * We look only to the low bit of the RW field to determine if we should be watching for a write.
+                 * FYI, if the low bit is clear but the high bit is set, that's "undefined"; we treat it as a read.
+                 */
+                var fWrite = !!(bitsDR7 & 0x1);
+                /*
+                 * The address in regDR[i] should already be masked with ~0x1 for 2-byte accesses (LEN == 0x1) or
+                 * with ~0x3 for 4-byte accesses (LEN == 0x3), but if the client forgets, the hardware supposedly
+                 * enforces it, so that's what we do here, too.
+                 *
+                 * FYI, if LEN is set to the "undefined" value of (0x2), we still apply a mask to the address, albeit
+                 * a nonsensical mask of ~0x2 or 0xfffffffd.  That's how we define that particular "undefined" LEN.
+                 */
+                var addr = this.regDR[i];
+                var len = ((bitsDR7 >> 2) & 0x3);
+                addr &= ~len;       // NOTE: if LEN == 0x0, we don't need to mask, but ~0x0 is equivalent to no mask
+                if (fEnable) {
+                    this.addMemCheck(addr, fWrite);
+                } else {
+                    this.removeMemCheck(addr, fWrite);
+                }
+            }
+            regDR7 >>= 2; bitsDR7 >>= 4;
+        }
+    }
+
+    /**
+     * checkMemoryException(addr, nb, fWrite)
+     *
+     * This "check" function is called by a Memory block to inform us that a memory read or write is occurring,
+     * giving us the opportunity look for a matching "read" or "write" breakpoint enabled in one of the DRn registers.
+     *
+     * TODO: This currently does not discriminate between data reads and execution reads.  When we switch to a true
+     * "prefetch" model, that would also be a good time to include a signal to this function indicating which "read"
+     * accesses are are actually "exec" accesses.
+     *
+     * @this {X86CPU}
+     * @param {number} addr
+     * @param {number} nb (# of bytes)
+     * @param {boolean|null} [fWrite] (false if read, true if write, null if exec)
+     */
+    checkMemoryException(addr, nb, fWrite)
+    {
+        /*
+         * NOTE: We're preventing redundant X86.EXCEPTION.DB_EXC exceptions for a single instruction by checking
+         * X86.OPFLAG.DBEXC.  I decided not to rely on the generic X86.OPFLAG.FAULT, because if an instruction
+         * first triggers a DIFFERENT exception which then triggers a DEBUG exception (eg, because a Debug register
+         * was set on the IDT entry of the first exception), then presumably we'd like to see that DEBUG exception,
+         * as opposed to, say, a double fault.  TODO: Determine whether that SHOULD generate a double-fault.
+         */
+        if (!(this.opFlags & X86.OPFLAG.DBEXC) && (this.regDR[7] & X86.DR7.ENABLE)) {
+            nb--;
+            /*
+             * We use a constant mask for the enable bits (X86.DR7.L0 | X86.DR7.G0) and shift our copy of regDR7
+             * right 2 bits after each Debug register check.
+             *
+             * Similarly, we make a copy of regDR7 in bitsDR7 and shift the latter right 4 bits at a time, so that
+             * the RW and LEN bits for the next Debug register are always in positions 1-0 and 3-2, respectively.
+             */
+            var regDR7 = this.regDR[7];
+            var bitsDR7 = regDR7 >> 16;
+
+            var bitsRWMask = X86.DR7.RW0 >> 16;
+            var bitsRWRequired = (fWrite? 0x1 : (fWrite == false? 0x3 : 0x0));
+
+            for (var i = 0; i < 4; i++) {
+                if ((regDR7 & (X86.DR7.L0 | X86.DR7.G0)) && (bitsDR7 & bitsRWMask) == bitsRWRequired) {
+                    /*
+                     * NOTE: We reduced nb from 1-4 to 0-3 above, so we don't need to add 1 to len either.
+                     */
+                    var len = (bitsDR7 >> 2);
+                    /*
+                     * Time to determine if addr through addr + nb overlaps regDR[i] through regDR[i] + len.
+                     */
+                    if (addr + nb >= this.regDR[i] && addr <= this.regDR[i] + len) {
+                        this.regDR[6] |= (1 << i);
+                        /*
+                         * Data access breakpoints are not faults; they must generate a trap at the end of the
+                         * instruction, so we use the X86.INTFLAG.TRAP flag to generate the X86.EXCEPTION.DB_EXC trap.
+                         *
+                         *      X86.helpFault.call(this, X86.EXCEPTION.DB_EXC);
+                         */
+                        this.intFlags |= X86.INTFLAG.TRAP;
+                        return;
+                    }
+                }
+                regDR7 >>= 2; bitsDR7 >>= 4;
+            }
+        }
+    }
+
+    /**
+     * getProtMode()
+     *
+     * @this {X86CPU}
+     * @return {boolean} true if protected-mode, false if not
+     */
+    getProtMode()
+    {
+        return !!(this.regCR0 & X86.CR0.MSW.PE);
+    }
+
+    /**
+     * getV68Mode()
+     *
+     * @this {X86CPU}
+     * @return {boolean} true if V86-mode, false if not
+     */
+    getV86Mode()
+    {
+        return !!(this.regPS & X86.PS.VM);
+    }
+
+    /**
+     * setProtMode(fProt, fV86)
+     *
+     * Update any opcode handlers that operate significantly differently in real-mode vs. protected-mode, and
+     * notify all the segment registers about the mode change as well -- but only those that are "bi-modal"; internal
+     * segment registers like segLDT and segTSS do not need to be notified, because they cannot be accessed in real-mode
+     * (ie, LLDT, LTR, SLDT, STR are invalid instructions in real-mode, and are among the opcode handlers that we
+     * update here).
+     *
+     * NOTE: Ideally, this function would do its work ONLY on mode *transitions*, but we assume calls to setProtMode()
+     * are sufficiently infrequent that it doesn't really matter.
+     *
+     * @this {X86CPU}
+     * @param {boolean} [fProt] (use the current MSW PE bit if not specified)
+     * @param {boolean} [fV86] true if the X86.PS.VM (V86-mode) flag is set (or is about to be)
+     */
+    setProtMode(fProt, fV86)
+    {
+        if (fProt === undefined) {
+            fProt = this.getProtMode();
+        }
+        if (fV86 === undefined) {
+            fV86 = this.getV86Mode();
+        }
+        if (DEBUG && (fProt != this.getProtMode() || fV86 != this.getV86Mode()) && this.messageEnabled()) {
+            this.printMessage("CPU switching to " + (fProt? (fV86? "v86" : "protected") : "real") + "-mode", this.bitsMessage, true);
+        }
+        this.aOpGrp6 = (fProt && !fV86? X86.aOpGrp6Prot : X86.aOpGrp6Real);
+        this.segCS.updateMode(false, fProt, fV86);
+        this.segDS.updateMode(false, fProt, fV86);
+        this.segSS.updateMode(false, fProt, fV86);
+        this.segES.updateMode(false, fProt, fV86);
+        if (I386 && this.model >= X86.MODEL_80386) {
+            this.segFS.updateMode(false, fProt, fV86);
+            this.segGS.updateMode(false, fProt, fV86);
+        }
+        /*
+         * This function used to be called only when I386 is true, but it's probably best if we ALWAYS call it, even
+         * for 16-bit-only CPUs like the 8086 and 80286; this allows us to write opcode logic by either checking I386
+         * and using appropriate hard-coded sizes, or NOT checking I386 and simply using the "soft-coded" sizes in
+         * sizeData and sizeAddr.
+         */
+        this.resetSizes();
+    }
+
+    /**
+     * saveProtMode()
+     *
+     * Save CPU state related to protected-mode, for save()
+     *
+     * @this {X86CPU}
+     * @return {Array}
+     */
+    saveProtMode()
+    {
+        if (this.addrGDT != null) {
+            var a = [
+                this.regCR0,
+                this.addrGDT,
+                this.addrGDTLimit,
+                this.addrIDT,
+                this.addrIDTLimit,
+                this.segLDT.save(),
+                this.segTSS.save(),
+                this.nIOPL
+            ];
+            if (I386 && this.model >= X86.MODEL_80386) {
+                a.push(this.regCR1);
+                a.push(this.regCR2);
+                a.push(this.regCR3);
+                a.push(this.regDR);
+                a.push(this.regTR);
+            }
+            return a;
+        }
+        return null;
+    }
+
+    /**
+     * restoreProtMode()
+     *
+     * Restore CPU state related to protected-mode, for restore()
+     *
+     * @this {X86CPU}
+     * @param {Array} a
+     */
+    restoreProtMode(a)
+    {
+        if (a && a.length) {
+            this.regCR0 = a[0];
+            this.addrGDT = a[1];
+            this.addrGDTLimit = a[2];
+            this.addrIDT = a[3];
+            this.addrIDTLimit = a[4];
+            this.segLDT.restore(a[5]);
+            this.segTSS.restore(a[6]);
+            this.nIOPL = a[7];
+            if (I386 && this.model >= X86.MODEL_80386) {
+                this.regCR1 = a[8];
+                this.regCR2 = a[9];
+                this.regCR3 = a[10];
+                this.regDR  = a[11];
+                this.regTR  = a[12];
+            }
+            this.setProtMode();
+        }
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the X86 component.
+     *
+     * UPDATES: The current speed multiplier from getSpeed() is now saved in group #3, so that your speed is preserved.
+     *
+     * @this {X86CPU}
+     * @return {Object|null}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, [this.regEAX, this.regEBX, this.regECX, this.regEDX, this.getSP(), this.regEBP, this.regESI, this.regEDI]);
+        var a = [this.getIP(), this.segCS.save(), this.segDS.save(), this.segSS.save(), this.segES.save(), this.saveProtMode(), this.getPS()];
+        if (I386 && this.model >= X86.MODEL_80386) {
+            a.push(this.segFS.save());
+            a.push(this.segGS.save());
+        }
+        state.set(1, a);
+        state.set(2, [this.segData.sName, this.segStack.sName, this.opFlags, this.opPrefixes, this.intFlags, this.regEA, this.regEAWrite]);
+        state.set(3, [0, this.nTotalCycles, this.getSpeed()]);
+        state.set(4, this.bus.saveMemory(this.isPagingEnabled()));
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the X86 component.
+     *
+     * @this {X86CPU}
+     * @param {Object} data
+     * @return {boolean} true if restore successful, false if not
+     */
+    restore(data)
+    {
+        var a = data[0];
+        this.regEAX = a[0];
+        this.regEBX = a[1];
+        this.regECX = a[2];
+        this.regEDX = a[3];
+        var regESP = a[4];
+        this.regEBP = a[5];
+        this.regESI = a[6];
+        this.regEDI = a[7];
+
+        a = data[1];
+        this.segCS.restore(a[1]);
+        this.segDS.restore(a[2]);
+        this.segSS.restore(a[3]);
+        this.segES.restore(a[4]);
+        this.restoreProtMode(a[5]);
+        this.setPS(a[6]);
+
+        /*
+         * The introduction of protected-mode requires us to restore memory contents sooner than we used to
+         * (ie, before we load any segment registers).
+         */
+        var fRestored = false;
+
+        if (this.bus.restoreMemory(data[4])) {
+            /*
+             * It's important to call setCSIP(), both to ensure that the CPU's linear IP register (regLIP) is updated
+             * properly AND to ensure the CPU's default ADDRESS and OPERAND sizes are set properly.
+             */
+            this.setCSIP(a[0], this.segCS.sel);
+
+            /*
+             * It's also important to call setSP(), so that the linear SP register (regLSP) will be updated properly;
+             * we also need to call setSS(), to ensure that the lower and upper stack limits are properly initialized.
+             */
+            this.setSP(regESP);
+            this.setSS(this.segSS.sel);
+
+            if (I386 && this.model >= X86.MODEL_80386) {
+                this.segFS.restore(a[7]);
+                this.segGS.restore(a[8]);
+            }
+            fRestored = true;
+        }
+
+        a = data[2];
+        this.segData  = a[0] != null && this.getSeg(a[0]) || this.segDS;
+        this.segStack = a[1] != null && this.getSeg(a[1]) || this.segSS;
+        this.opFlags = a[2];
+        this.opPrefixes = a[3];
+        this.intFlags = a[4];
+        this.regEA = a[5];
+        this.regEAWrite = a[6];     // save/restore of last EA calculation(s) isn't strictly necessary, but they may be of some interest to, say, the Debugger
+
+        a = data[3];                // a[0] was previously nBurstDivisor (no longer used)
+        this.nTotalCycles = a[1];
+        this.setSpeed(a[2]);        // if we're restoring an old state that doesn't contain a value from getSpeed(), that's OK; setSpeed() checks for an undefined value
+
+        return fRestored;
+    }
+
+    /**
+     * getSeg(sName)
+     *
+     * @param {string} sName
+     * @return {X86Seg|Array}
+     */
+    getSeg(sName)
+    {
+        switch(sName) {
+        case "CS":
+            return this.segCS;
+        case "DS":
+            return this.segDS;
+        case "SS":
+            return this.segSS;
+        case "ES":
+            return this.segES;
+        case "NULL":
+            return this.segNULL;
+        default:
+            /*
+             * HACK: We return a fake segment register object in which only the base linear address is valid,
+             * because that's all the caller provided (ie, we must be restoring from an older state).
+             */
+
+            return [0, sName, 0, 0, ""];
+        }
+    }
+
+    /**
+     * getCS()
+     *
+     * @this {X86CPU}
+     * @return {number}
+     */
+    getCS()
+    {
+        return this.segCS.sel;
+    }
+
+    /**
+     * setCS(sel)
+     *
+     * NOTE: This is used ONLY by those few undocumented 8086/8088/80186/80188 instructions that "MOV" or "POP" a value
+     * into CS, which we assume have the same behavior as any other instruction that moves or pops a segment register
+     * (ie, suppresses h/w interrupts for one instruction).  Instructions that "JMP" or "CALL" or "INT" or "IRET" a new
+     * value into CS are always accompanied by a new IP value, so they use setCSIP() instead, which does NOT suppress
+     * h/w interrupts.
+     *
+     * @this {X86CPU}
+     * @param {number} sel
+     * @return {boolean}
+     */
+    setCS(sel)
+    {
+        if (this.setCSIP(this.getIP(), sel) != null) {
+            if (!BUGS_8086) this.opFlags |= this.OPFLAG_NOINTR_8086;
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * getDS()
+     *
+     * @this {X86CPU}
+     * @return {number}
+     */
+    getDS()
+    {
+        return this.segDS.sel;
+    }
+
+    /**
+     * setDS(sel)
+     *
+     * @this {X86CPU}
+     * @param {number} sel
+     */
+    setDS(sel)
+    {
+        if (this.segDS.load(sel) !== X86.ADDR_INVALID) {
+            if (!BUGS_8086) this.opFlags |= this.OPFLAG_NOINTR_8086;
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * getSS()
+     *
+     * @this {X86CPU}
+     * @return {number}
+     */
+    getSS()
+    {
+        return this.segSS.sel;
+    }
+
+    /**
+     * setSS(sel)
+     *
+     * @this {X86CPU}
+     * @param {number} sel
+     * @param {boolean} [fInterruptable]
+     * @return {boolean}
+     */
+    setSS(sel, fInterruptable)
+    {
+        var regESP = this.getSP();
+        var regLSP = this.segSS.load(sel);
+        if (regLSP !== X86.ADDR_INVALID) {
+            /*
+             * The safest way to update regLSP after a potential change to segSS.base is to call setSP()
+             * with the original stack pointer retrieved above via getSP().  When I tried to be clever and
+             * do this instead:
+             *
+             *      this.regLSP = (regLSP + regESP)|0;
+             *
+             * 16-bit stacks began inadvertently using ESP instead of SP.  The moral: don't be needlessly clever.
+             *
+             * Sprinkle the following assert throughout stack operations to catch that bug in the future:
+             *
+             *
+             */
+            this.setSP(regESP);
+            if (this.segSS.fExpDown) {
+                this.regLSPLimit = (this.segSS.base + this.segSS.maskAddr)|0;
+                this.regLSPLimitLow = (this.segSS.base + this.segSS.limit)|0;
+            } else {
+                this.regLSPLimit = (this.segSS.base + this.segSS.limit)|0;
+                this.regLSPLimitLow = this.segSS.base;
+            }
+            if (!BUGS_8086 && !fInterruptable) this.opFlags |= X86.OPFLAG.NOINTR;
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * getES()
+     *
+     * @this {X86CPU}
+     * @return {number}
+     */
+    getES()
+    {
+        return this.segES.sel;
+    }
+
+    /**
+     * setES(sel)
+     *
+     * @this {X86CPU}
+     * @param {number} sel
+     * @return {boolean}
+     */
+    setES(sel)
+    {
+        if (this.segES.load(sel) !== X86.ADDR_INVALID) {
+            if (!BUGS_8086) this.opFlags |= this.OPFLAG_NOINTR_8086;
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * getFS()
+     *
+     * NOTE: segFS is defined for I386 only.
+     *
+     * @this {X86CPU}
+     * @return {number}
+     */
+    getFS()
+    {
+        return this.segFS.sel;
+    }
+
+    /**
+     * setFS(sel)
+     *
+     * NOTE: segFS is defined for I386 only.
+     *
+     * @this {X86CPU}
+     * @param {number} sel
+     * @return {boolean}
+     */
+    setFS(sel)
+    {
+        return this.segFS.load(sel) !== X86.ADDR_INVALID;
+    }
+
+    /**
+     * getGS()
+     *
+     * NOTE: segGS is defined for I386 only.
+     *
+     * @this {X86CPU}
+     * @return {number}
+     */
+    getGS()
+    {
+        return this.segGS.sel;
+    }
+
+    /**
+     * setGS(sel)
+     *
+     * NOTE: segGS is defined for I386 only.
+     *
+     * @this {X86CPU}
+     * @param {number} sel
+     * @return {boolean}
+     */
+    setGS(sel)
+    {
+        return this.segGS.load(sel) !== X86.ADDR_INVALID;
+    }
+
+    /**
+     * getIP()
+     *
+     * @this {X86CPU}
+     * @return {number}
+     */
+    getIP()
+    {
+        return (this.regLIP - this.segCS.base)|0;
+    }
+
+    /**
+     * setIP(off)
+     *
+     * @this {X86CPU}
+     * @param {number} off
+     */
+    setIP(off)
+    {
+        this.regLIP = (this.segCS.base + (off & (I386? this.maskData : 0xffff)))|0;
+        if (PREFETCH) this.refillPrefetch();
+    }
+
+    /**
+     * setLIP(addr)
+     *
+     * @this {X86CPU}
+     * @param {number} addr
+     */
+    setLIP(addr)
+    {
+        this.regLIP = addr;
+        this.regLIPMax = (this.segCS.base >>> 0) + (this.segCS.limit >>> 0) + 1;
+
+        /*
+         * TODO: Verify the proper source for CPL.  Should it come from segCS.cpl or segCS.dpl?
+         * Also, note that LOADALL386 wants it to come from segSS.dpl.
+         */
+        this.nCPL = this.segCS.cpl;             // cache the current CPL where it's more convenient
+
+        if (I386) this.resetSizes();
+        /*
+         * Here, we need to additionally test whether the prefetch buffer (adwPrefetch) has been allocated yet,
+         * because when resetRegs() is first called, the Bus hasn't been initialized yet, so there's nothing to fetch.
+         *
+         * We'll allocate the prefetch buffer when the Bus calls initMemory().
+         */
+        if (PREFETCH && this.adwPrefetch) this.refillPrefetch();
+    }
+
+    /**
+     * setCSIP(off, sel, fCall)
+     *
+     * This function is a little different from the other segment setters, only because it turns out that CS is
+     * never set without an accompanying IP (well, except for a few undocumented instructions, like POP CS, which
+     * were available ONLY on the 8086/8088/80186/80188; see setCS() for details).
+     *
+     * And even though this function is called setCSIP(), please note the order of the parameters is [IP,CS],
+     * which matches the order that CS:IP values are normally stored in memory, allowing us to make calls like this:
+     *
+     *      this.setCSIP(this.popWord(), this.popWord());
+     *
+     * @this {X86CPU}
+     * @param {number} off
+     * @param {number} sel
+     * @param {boolean} [fCall] is true if CALLF in progress, false if RETF/IRET in progress, undefined otherwise
+     * @return {boolean|null} true if a stack switch occurred; the only operation that needs to pay attention is opRETFn()
+     */
+    setCSIP(off, sel, fCall)
+    {
+        /*
+         * Setting IP needs to occur AFTER loadCode(), because it may differ from the given IP if sel refers to a gate.
+         */
+        var base = this.segCS.loadCode(off, sel, fCall);
+        if (base !== X86.ADDR_INVALID) {
+            this.setLIP(base + (this.segCS.offIP & (I386? this.segCS.maskData : 0xffff)));
+            return this.segCS.fStackSwitch;
+        }
+        return null;
+    }
+
+    /**
+     * setCSBase(addr)
+     *
+     * Since the CPU must maintain regLIP as the sum of the CS base and the current IP, all calls to setBase()
+     * for segCS need to go through here.
+     *
+     * @param {number} addr
+     */
+    setCSBase(addr)
+    {
+        var regIP = this.getIP();
+        addr = this.segCS.setBase(addr);
+        this.regLIP = (addr + regIP)|0;
+        this.regLIPMax = (addr >>> 0) + (this.segCS.limit >>> 0) + 1;
+    }
+
+    /**
+     * checkIP(inc)
+     *
+     * TODO: If we didn't care about compatibility, we could just return:
+     *
+     *      (this.regLIP + inc)|0
+     *
+     * and be done with it, because there probably isn't any "good" code that triggers the
+     * "newLIP > this.regLIPMax" condition.  This check costs us about 2Mhz performance on an 80386.
+     *
+     * Turning PREFETCH on tends to offset this performance hit, but PREFETCH *without* this hit would
+     * probably perform even better.
+     *
+     * @this {X86CPU}
+     * @param {number} inc (positive)
+     * @return {number} new LIP
+     */
+    checkIP(inc)
+    {
+        var newLIP = (this.regLIP >>> 0) + inc;
+        if (newLIP > this.regLIPMax) {
+            /*
+             * There's no such thing as a GP fault on the 8086/8088, and I'm assuming that,
+             * on newer processors, when the segment limit is the maximum, it's OK for IP to wrap.
+             */
+            if (this.model <= X86.MODEL_8088 || this.segCS.limit == this.segCS.maskAddr) {
+                newLIP = this.segCS.base + ((newLIP - this.regLIPMax) & (I386? this.maskData : 0xffff));
+            } else {
+                X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0);
+            }
+        }
+        return newLIP|0;
+    }
+
+    /**
+     * resetIP(dec)
+     *
+     * This "rewinds" IP to the beginning of the current instruction (eg, an instruction with a REP prefix)
+     *
+     * @this {X86CPU}
+     * @param {number} dec (negative)
+     */
+    resetIP(dec)
+    {
+        if (BUGS_8086) {
+            this.regLIP = (this.regLIP + dec)|0;
+            /*
+             * This assertion is intended to fail if/when we encounter a "buggy" instruction (see BUGS_8086)
+             */
+
+        } else {
+            if (PREFETCH) {
+                this.cbPrefetch += this.regLIP - this.opLIP;
+                this.regLIP = this.opLIP;
+                /*
+                 * If "rewinding" produces a prefetch total greater than the allocated amount, then we must have
+                 * refilled the queue somewhere in the middle of the rewound instruction, so we need to refill the
+                 * queue all over again; otherwise, the next repetition may fetch future data instead of past data.
+                 *
+                 * That's the bad news; the good news is that this extra refill should only hurt performance of the
+                 * first repetition.
+                 */
+                if (this.cbPrefetch > X86CPU.PFINFO.LENGTH) this.refillPrefetch();
+            } else {
+                this.regLIP = this.opLIP;
+            }
+        }
+    }
+
+    /**
+     * getSP()
+     *
+     * @this {X86CPU}
+     * @return {number}
+     */
+    getSP()
+    {
+        if (I386) {
+            // assert(!((this.regLSP - this.segSS.base) & ~this.segSS.maskAddr));
+            return (this.regESP & ~this.segSS.maskAddr) | (this.regLSP - this.segSS.base);
+        }
+        return (this.regLSP - this.segSS.base)|0;
+    }
+
+    /**
+     * setSP(off)
+     *
+     * @this {X86CPU}
+     * @param {number} off
+     */
+    setSP(off)
+    {
+        if (I386) {
+            this.regESP = off;
+            this.regLSP = (this.segSS.base + (off & this.segSS.maskAddr))|0;
+        } else {
+            this.regLSP = (this.segSS.base + off)|0;
+        }
+    }
+
+    /**
+     * setArithResult(dst, src, value, type, fSubtract)
+     *
+     * Updates the flags for arithmetic instructions; use setLogicResult() for logical instructions.
+     *
+     * The type parameter indicates both the size of the result (BYTE, WORD or DWORD) and which of the
+     * flags should now be considered "cached" by the new result variables.  If the previous resultType
+     * specifies any flags not contained in the new type parameter, then those flags must be immediately
+     * calculated and written to the appropriate bit(s) in regPS.
+     *
+     * The default assumes an "addition" (eg, ADD, ADC, INC), where value = dst + src. The fSubtract
+     * parameter is used to indicate a "subtraction" (eg, CMP, DEC, SUB, SBB), where value = dst - src;
+     * We can transform a subtraction into an addition, since it's also true that dst = value + src,
+     * by swapping swap dst and value -- which is exactly what we do below.  This allows all downstream
+     * flag calculations (eg, getCF(), getOF()) to remain the same.
+     *
+     * @this {X86CPU}
+     * @param {number} dst
+     * @param {number} src
+     * @param {number} value
+     * @param {number} type
+     * @param {boolean} [fSubtract]
+     */
+    setArithResult(dst, src, value, type, fSubtract)
+    {
+        if ((type & X86.RESULT.ALL) != X86.RESULT.ALL && type != this.resultType) {
+            var diff = ((type ^ this.resultType) & this.resultType);
+            if (diff) {
+                if (diff & X86.RESULT.CF) this.getCF();
+                if (diff & X86.RESULT.PF) this.getPF();
+                if (diff & X86.RESULT.AF) this.getAF();
+                if (diff & X86.RESULT.ZF) this.getZF();
+                if (diff & X86.RESULT.SF) this.getSF();
+                if (diff & X86.RESULT.OF) this.getOF();
+            }
+        }
+        if (!fSubtract) {
+            this.resultDst = dst;
+            this.resultArith = value;
+        } else {
+            this.resultDst = value;
+            this.resultArith = dst;
+        }
+        this.resultSrc = src;
+        this.resultLogic = value;
+        this.resultType = type;
+    }
+
+    /**
+     * setLogicResult(value, type, carry, overflow)
+     *
+     * Updates the flags for logical instructions (eg, AND, OR, TEST, XOR); ie, instructions
+     * that update PF, ZF, and SF, while clearing CF and OF (although CF and OF can be explicitly
+     * set via the carry and overflow parameters as needed).  AF is always considered undefined.
+     *
+     * TODO: We should observe the behavior of AF on real CPUs, and determine if there is a
+     * well-defined behavior, even though none is documented.  Ditto for OF on shift instructions
+     * when the shift count > 1.
+     *
+     * @this {X86CPU}
+     * @param {number} value
+     * @param {number} type
+     * @param {number} [carry]
+     * @param {number} [overflow]
+     * @return {number} value
+     */
+    setLogicResult(value, type, carry, overflow)
+    {
+        this.resultType = type | X86.RESULT.LOGIC;
+        this.resultLogic = value;
+        if (carry) this.setCF(); else this.clearCF();
+        if (overflow) this.setOF(); else this.clearOF();
+        return value;
+    }
+
+    /**
+     * setRotateResult(result, carry, size)
+     *
+     * Used by all rotate instructions (ie, RCL, RCR, ROL, ROR) to update CF and OF.
+     *
+     * TODO: We should observe the behavior of OF on real CPUs whenever the rotate count > 1,
+     * and determine if there is a well-defined behavior, even though none is documented.
+     *
+     * @this {X86CPU}
+     * @param {number} result
+     * @param {number} carry
+     * @param {number} size
+     */
+    setRotateResult(result, carry, size)
+    {
+        if (carry & size) this.setCF(); else this.clearCF();
+        if ((result ^ carry) & size) this.setOF(); else this.clearOF();
+    }
+
+    /**
+     * getCarry()
+     *
+     * @this {X86CPU}
+     * @return {number} 0 or 1, depending on whether CF is clear or set
+     */
+    getCarry()
+    {
+        return this.getCF()? 1 : 0;
+    }
+
+    /**
+     * getCF()
+     *
+     * The following table summarizes bit 31 of the dst (D) and src (S) operands, bit 31 of the
+     * addition (A), along with the expected carry bit (C):
+     *
+     *      D   S   A   C
+     *      -   -   -   -
+     *      0   0   0   0       no
+     *      0   0   1   0       no (there must have been a carry out of bit 30, but it was "absorbed")
+     *      0   1   0   1       yes (there must have been a carry out of bit 30, but it was NOT "absorbed")
+     *      0   1   1   0       no
+     *      1   0   0   1       yes (same as the preceding "yes" case)
+     *      1   0   1   0       no
+     *      1   1   0   1       yes (since the addition of two ones must always produce a carry)
+     *      1   1   1   1       yes (since the addition of two ones must always produce a carry)
+     *
+     * So, we use the following calculation:
+     *
+     *      (resultDst ^ ((resultDst ^ resultSrc) & (resultSrc ^ resultArith))) & resultType
+     *
+     * NOTE: The above table assumes that the resultDst (D) and resultSrc (S) operands were ADDED to
+     * produce resultArith (A); if they were SUBTRACTED instead (D - S), then D and A must be swapped
+     * after the subtraction, so that the above truth table still applies; see setArithResult().
+     *
+     * @this {X86CPU}
+     * @return {number} 0 or X86.PS.CF
+     */
+    getCF()
+    {
+        if (this.resultType & X86.RESULT.CF) {
+            this.regPS &= ~X86.PS.CF;
+            if ((this.resultDst ^ ((this.resultDst ^ this.resultSrc) & (this.resultSrc ^ this.resultArith))) & (this.resultType & X86.RESULT.TYPE)) {
+                this.regPS |= X86.PS.CF;
+            }
+            this.resultType &= ~X86.RESULT.CF;
+        }
+        return this.regPS & X86.PS.CF;
+    }
+
+    /**
+     * getPF()
+     *
+     * From http://graphics.stanford.edu/~seander/bithacks.html#ParityParallel:
+     *
+     *      unsigned int v;  // word value to compute the parity of
+     *      v ^= v >> 16;
+     *      v ^= v >> 8;
+     *      v ^= v >> 4;
+     *      v &= 0xf;
+     *      return (0x6996 >> v) & 1;
+     *
+     *      The method above takes around 9 operations, and works for 32-bit words.  It may be optimized to work just on
+     *      bytes in 5 operations by removing the two lines immediately following "unsigned int v;".  The method first shifts
+     *      and XORs the eight nibbles of the 32-bit value together, leaving the result in the lowest nibble of v.  Next,
+     *      the binary number 0110 1001 1001 0110 (0x6996 in hex) is shifted to the right by the value represented in the
+     *      lowest nibble of v.  This number is like a miniature 16-bit parity-table indexed by the low four bits in v.
+     *      The result has the parity of v in bit 1, which is masked and returned.
+     *
+     * The x86 parity flag (PF) is based exclusively on the low 8 bits of resultParitySign, so our calculation is bit
+     * simpler.  Note that PF must be SET if that byte has EVEN parity, and CLEAR if it has ODD parity.
+     *
+     * @this {X86CPU}
+     * @return {number} 0 or X86.PS.PF
+     */
+    getPF()
+    {
+        if (this.resultType & X86.RESULT.PF) {
+            this.regPS &= ~X86.PS.PF;
+            if ((0x9669 >> ((this.resultLogic ^ (this.resultLogic >> 4)) & 0xf)) & 1) {
+                this.regPS |= X86.PS.PF;
+            }
+            this.resultType &= ~X86.RESULT.PF;
+        }
+        return this.regPS & X86.PS.PF;
+    }
+
+    /**
+     * getAF()
+     *
+     * To determine if there's been a carry out of the low 4 bits of an arithmetic operation,
+     * we look at all the possible inputs for bit 4, and calculate AF = A^(D^S).
+     *
+     *      D   S   A   D^S AF
+     *      -   -   -   --- --
+     *      0   0   0   0   0
+     *      0   0   1   0   1
+     *      0   1   0   1   1
+     *      0   1   1   1   0
+     *      1   0   0   1   1
+     *      1   0   1   1   0
+     *      1   1   0   0   0
+     *      1   1   1   0   1
+     *
+     * The final calculation looks like:
+     *
+     *      (resultArith ^ (resultDst ^ resultSrc)) & 0x0010
+     *
+     * @this {X86CPU}
+     * @return {number} 0 or X86.PS.AF
+     */
+    getAF()
+    {
+        if (this.resultType & X86.RESULT.AF) {
+            this.regPS &= ~X86.PS.AF;
+            if ((this.resultArith ^ (this.resultDst ^ this.resultSrc)) & 0x0010) {
+                this.regPS |= X86.PS.AF;
+            }
+            this.resultType &= ~X86.RESULT.AF;
+        }
+        return this.regPS & X86.PS.AF;
+    }
+
+    /**
+     * getZF()
+     *
+     * @this {X86CPU}
+     * @return {number} 0 or X86.PS.ZF
+     */
+    getZF()
+    {
+        if (this.resultType & X86.RESULT.ZF) {
+            this.regPS &= ~X86.PS.ZF;
+            if (!(this.resultLogic & (((this.resultType & X86.RESULT.TYPE) - 1) | (this.resultType & X86.RESULT.TYPE)))) {
+                this.regPS |= X86.PS.ZF;
+            }
+            this.resultType &= ~X86.RESULT.ZF;
+        }
+        return this.regPS & X86.PS.ZF;
+    }
+
+    /**
+     * getSF()
+     *
+     * @this {X86CPU}
+     * @return {number} 0 or X86.PS.SF
+     */
+    getSF()
+    {
+        if (this.resultType & X86.RESULT.SF) {
+            this.regPS &= ~X86.PS.SF;
+            if (this.resultLogic & (this.resultType & X86.RESULT.TYPE)) {
+                this.regPS |= X86.PS.SF;
+            }
+            this.resultType &= ~X86.RESULT.SF;
+        }
+        return this.regPS & X86.PS.SF;
+    }
+
+    /**
+     * getOF()
+     *
+     * Overflow was originally calculated as:
+     *
+     *      (resultParitySign ^ resultAuxOverflow ^ (resultParitySign >> 1)) & (resultSize >> 1)
+     *
+     * but as you can see, that calculation depends on the carry out of the 8/16/32-bit result in
+     * resultParitySign, which we don't have access to for 32-bit results.  So we fall-back to the
+     * following:
+     *
+     *      ((resultDst ^ resultArith) & (resultSrc ^ resultArith)) & resultType
+     *
+     * which you can verify from the following table of sign bits, where x1 is resultDst ^ resultArith,
+     * and x2 is resultSrc ^ resultArith:
+     *
+     *      D   S   A   x1  x2  OF
+     *      -   -   -   --  --  --
+     *      0   0   0   0   0   0
+     *      0   0   1   1   1   1 (adding two positive values yielded a negative value)
+     *      0   1   0   0   1   0
+     *      0   1   1   1   0   0
+     *      1   0   0   1   0   0
+     *      1   0   1   0   1   0
+     *      1   1   0   1   1   1 (adding two negative values yielded a positive value)
+     *      1   1   1   0   0   0
+     *
+     * NOTE: The above table assumes that the resultDst (D) and resultSrc (S) operands were ADDED to
+     * produce resultArith (A); if they were SUBTRACTED instead (D - S), then D and A must be swapped
+     * after the subtraction, so that the above truth table still applies; see setArithResult().
+     *
+     * @this {X86CPU}
+     * @return {number} 0 or X86.PS.OF
+     */
+    getOF()
+    {
+        if (this.resultType & X86.RESULT.OF) {
+            this.regPS &= ~X86.PS.OF;
+            if (((this.resultDst ^ this.resultArith) & (this.resultSrc ^ this.resultArith)) & (this.resultType & X86.RESULT.TYPE)) {
+                this.regPS |= X86.PS.OF;
+            }
+            this.resultType &= ~X86.RESULT.OF;
+        }
+        return this.regPS & X86.PS.OF;
+    }
+
+    /**
+     * getTF()
+     *
+     * @this {X86CPU}
+     * @return {number} 0 or X86.PS.TF
+     */
+    getTF()
+    {
+        return (this.regPS & X86.PS.TF);
+    }
+
+    /**
+     * getIF()
+     *
+     * @this {X86CPU}
+     * @return {number} 0 or X86.PS.IF
+     */
+    getIF()
+    {
+        return (this.regPS & X86.PS.IF);
+    }
+
+    /**
+     * getDF()
+     *
+     * @this {X86CPU}
+     * @return {number} 0 or X86.PS.DF
+     */
+    getDF()
+    {
+        return (this.regPS & X86.PS.DF);
+    }
+
+    /**
+     * clearCF()
+     *
+     * @this {X86CPU}
+     */
+    clearCF()
+    {
+        this.resultType &= ~X86.RESULT.CF;
+        this.regPS &= ~X86.PS.CF;
+    }
+
+    /**
+     * clearPF()
+     *
+     * @this {X86CPU}
+     */
+    clearPF()
+    {
+        this.resultType &= ~X86.RESULT.PF;
+        this.regPS &= ~X86.PS.PF;
+    }
+
+    /**
+     * clearAF()
+     *
+     * @this {X86CPU}
+     */
+    clearAF()
+    {
+        this.resultType &= ~X86.RESULT.AF;
+        this.regPS &= ~X86.PS.AF;
+    }
+
+    /**
+     * clearZF()
+     *
+     * @this {X86CPU}
+     */
+    clearZF()
+    {
+        this.resultType &= ~X86.RESULT.ZF;
+        this.regPS &= ~X86.PS.ZF;
+    }
+
+    /**
+     * clearSF()
+     *
+     * @this {X86CPU}
+     */
+    clearSF()
+    {
+        this.resultType &= ~X86.RESULT.SF;
+        this.regPS &= ~X86.PS.SF;
+    }
+
+    /**
+     * clearIF()
+     *
+     * @this {X86CPU}
+     */
+    clearIF()
+    {
+        this.regPS &= ~X86.PS.IF;
+    }
+
+    /**
+     * clearDF()
+     *
+     * @this {X86CPU}
+     */
+    clearDF()
+    {
+        this.regPS &= ~X86.PS.DF;
+    }
+
+    /**
+     * clearOF()
+     *
+     * @this {X86CPU}
+     */
+    clearOF()
+    {
+        this.resultType &= ~X86.RESULT.OF;
+        this.regPS &= ~X86.PS.OF;
+    }
+
+    /**
+     * setCF()
+     *
+     * @this {X86CPU}
+     */
+    setCF()
+    {
+        this.resultType &= ~X86.RESULT.CF;
+        this.regPS |= X86.PS.CF;
+    }
+
+    /**
+     * setPF()
+     *
+     * @this {X86CPU}
+     */
+    setPF()
+    {
+        this.resultType &= ~X86.RESULT.PF;
+        this.regPS |= X86.PS.PF;
+    }
+
+    /**
+     * setAF()
+     *
+     * @this {X86CPU}
+     */
+    setAF()
+    {
+        this.resultType &= ~X86.RESULT.AF;
+        this.regPS |= X86.PS.AF;
+    }
+
+    /**
+     * setZF()
+     *
+     * @this {X86CPU}
+     */
+    setZF()
+    {
+        this.resultType &= ~X86.RESULT.ZF;
+        this.regPS |= X86.PS.ZF;
+    }
+
+    /**
+     * setSF()
+     *
+     * @this {X86CPU}
+     */
+    setSF()
+    {
+        this.resultType &= ~X86.RESULT.SF;
+        this.regPS |= X86.PS.SF;
+    }
+
+    /**
+     * setIF()
+     *
+     * @this {X86CPU}
+     */
+    setIF()
+    {
+        this.regPS |= X86.PS.IF;
+    }
+
+    /**
+     * setDF()
+     *
+     * @this {X86CPU}
+     */
+    setDF()
+    {
+        this.regPS |= X86.PS.DF;
+    }
+
+    /**
+     * setOF()
+     *
+     * @this {X86CPU}
+     */
+    setOF()
+    {
+        this.resultType &= ~X86.RESULT.OF;
+        this.regPS |= X86.PS.OF;
+    }
+
+    /**
+     * getPS()
+     *
+     * @this {X86CPU}
+     * @return {number}
+     */
+    getPS()
+    {
+        return (this.regPS & ~X86.PS_CACHED) | (this.getCF() | this.getPF() | this.getAF() | this.getZF() | this.getSF() | this.getOF());
+    }
+
+    /**
+     * setMSW(w)
+     *
+     * Factored out of x86op0f.js, since both opLMSW and opLOADALL are capable of setting a new MSW.
+     * The caller is responsible for assessing the appropriate cycle cost.
+     *
+     * @this {X86CPU}
+     * @param {number} w
+     */
+    setMSW(w)
+    {
+        /*
+         * This instruction is always allowed to set MSW.PE, but it cannot clear MSW.PE once set;
+         * therefore, we always OR the previous value of MSW.PE into the new value before loading.
+         */
+        w |= (this.regCR0 & X86.CR0.MSW.PE) | X86.CR0.MSW.ON;
+        this.regCR0 = (this.regCR0 & ~X86.CR0.MSW.MASK) | (w & X86.CR0.MSW.MASK);
+        /*
+         * Since the 80286 cannot return to real-mode via this instruction, the only transition we
+         * must worry about is to protected-mode.  And there's no harm calling setProtMode() if the
+         * CPU is already in protected-mode; we could certainly optimize out the call in that case,
+         * but the instruction isn't used frequently enough to warrant it.
+         */
+        if (this.regCR0 & X86.CR0.MSW.PE) this.setProtMode(true);
+    }
+
+    /**
+     * setPS(regPS)
+     *
+     * @this {X86CPU}
+     * @param {number} regPS
+     * @param {number} [cpl]
+     */
+    setPS(regPS, cpl)
+    {
+        /*
+         * OS/2 1.0 discriminates between an 80286 and an 80386 based on whether an IRET in real-mode that
+         * pops 0xF000 into the flags is able to set *any* of flag bits 12-15: if it can, then OS/2 declares
+         * the CPU an 80386.
+         *
+         * So, if the CPU is an 80286, we clear incoming bits 12-14 in real-mode (bit 15 is never allowed to
+         * be modified, so there's no need to mask it).  And if the CPU is an 80386, no bits are automatically
+         * cleared in real-mode (PS_CLEAR_RM is zero); although that allows the IOPL bits to change, it doesn't
+         * affect real-mode operation, since CPL is always zero, making IOPL irrelevant.
+         */
+        if (!(this.regCR0 & X86.CR0.MSW.PE)) regPS &= ~this.PS_CLEAR_RM;
+
+        /*
+         * There are some cases (eg, an IRET returning to a less privileged code segment) where the CPL
+         * we compare against should come from the outgoing code segment, so if the caller provided it, use it.
+         */
+        if (cpl === undefined) cpl = this.nCPL;
+
+        /*
+         * Since PS.IOPL and PS.IF are part of PS_DIRECT, we need to take care of any 80286-specific behaviors
+         * before setting the PS_DIRECT bits from the incoming regPS bits.
+         *
+         * Specifically, PS.IOPL is unchanged if CPL > 0, and PS.IF is unchanged if CPL > IOPL.
+         */
+        if (!cpl) {
+            this.nIOPL = (regPS & X86.PS.IOPL.MASK) >> X86.PS.IOPL.SHIFT;           // IOPL allowed to change
+        } else {
+            regPS = (regPS & ~X86.PS.IOPL.MASK) | (this.regPS & X86.PS.IOPL.MASK);  // IOPL not allowed to change
+        }
+
+        if (cpl > this.nIOPL) {
+            regPS = (regPS & ~X86.PS.IF) | (this.regPS & X86.PS.IF);                // IF not allowed to change
+        }
+
+        this.resultType = X86.RESULT.BYTE;
+        this.regPS = (this.regPS & ~(this.PS_DIRECT|X86.PS_CACHED)) | (regPS & (this.PS_DIRECT|X86.PS_CACHED)) | this.PS_SET;
+
+        if (this.regPS & X86.PS.TF) {
+            this.intFlags |= X86.INTFLAG.TRAP;
+            this.opFlags |= X86.OPFLAG.NOINTR;
+        }
+    }
+
+    /**
+     * checkIOPM(port, nPorts, fInput)
+     *
+     * @this {X86CPU}
+     * @param {number} port (0x0000 to 0xffff)
+     * @param {number} nPorts (1 to 4)
+     * @param {boolean} [fInput] (true if input, false if output; output assumed if not specified)
+     * @return {boolean} true if allowed, false if not
+     */
+    checkIOPM(port, nPorts, fInput)
+    {
+        var bitsPorts = 0;
+        if (I386 && (this.regCR0 & X86.CR0.MSW.PE) && (this.nCPL > this.nIOPL || (this.regPS & X86.PS.VM)) && this.segTSS.addrIOPM) {
+            var offIOPM = port >>> 3;
+            var addrIOPM = this.segTSS.addrIOPM + offIOPM;
+            bitsPorts = ((1 << nPorts) - 1) << (port & 0x7);
+            while (bitsPorts && addrIOPM <= this.segTSS.addrIOPMLimit) {
+                var bits = this.getByte(addrIOPM);
+                if (bits & bitsPorts) break;
+                bitsPorts >>>= 8;
+                addrIOPM++;
+            }
+        }
+        if (bitsPorts) {
+            if (this.messageEnabled(Messages.PORT)) this.printMessage("checkIOPM(" + Str.toHexWord(port) + "," + nPorts + "," + (fInput? "input" : "output") + "): trapped", true, true);
+            X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0);
+            return false;
+        }
+        return true;
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * @this {X86CPU}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "AX")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        var fBound = false;
+        switch (sBinding) {
+        case "EAX":
+        case "EBX":
+        case "ECX":
+        case "EDX":
+        case "ESP":
+        case "EBP":
+        case "ESI":
+        case "EDI":
+        case "EIP":
+        case "AX":
+        case "BX":
+        case "CX":
+        case "DX":
+        case "SP":
+        case "BP":
+        case "SI":
+        case "DI":
+        case "IP":
+        case "PC":      // deprecated as an alias for "IP" (still used by older XML files, like the one at http://tpoindex.github.io/crobots/)
+        case "CS":
+        case "DS":
+        case "SS":
+        case "ES":
+        case "FS":
+        case "GS":
+        case "CR0":
+        case "CR2":
+        case "CR3":
+        case "PS":      // this refers to "Processor Status", aka the 16-bit flags register (although DEBUG.COM refers to this as "PC", surprisingly)
+        case "C":
+        case "P":
+        case "A":
+        case "Z":
+        case "S":
+        case "T":
+        case "I":
+        case "D":
+        case "V":
+            this.bindings[sBinding] = control;
+            this.cLiveRegs++;
+            fBound = true;
+            break;
+        default:
+            fBound = super.setBinding(sHTMLType, sBinding, control);
+            break;
+        }
+        return fBound;
+    }
+
+    /**
+     * probeAddr(addr, size, fPhysical)
+     *
+     * Used by the Debugger to probe addresses without risk of triggering a page fault, and by internal
+     * functions, like helpCheckFault(), that must also avoid triggering faults, since they're not part of
+     * standard CPU operation.
+     *
+     * Since originally written, I've also relaxed the requirement that the request be contained entirely
+     * within a single block; this was never a problem for any size-aligned request, but unfortunately, it
+     * was difficult for the Debugger to guarantee that every 2 or 4-byte request would be always be word or
+     * dword-aligned.  So now requests that straddle blocks will be broken into smaller probeAddr() requests.
+     *
+     * @this {X86CPU}
+     * @param {number} addr is a linear address
+     * @param {number} [size] is a length (default is 1; if specified, must be 1, 2 or 4)
+     * @param {boolean} [fPhysical] (true for physical probe, false for linear; linear is the default)
+     * @return {number|null} value at the specified address, or null if invalid
+     */
+    probeAddr(addr, size, fPhysical)
+    {
+        var aBlocks = (fPhysical? this.aBusBlocks : this.aMemBlocks);
+        var block = aBlocks[(addr & this.nMemMask) >>> this.nBlockShift];
+        if (block && block.type == Memory.TYPE.UNPAGED) block = this.mapPageBlock(addr, false, true);
+
+        if (block) {
+            var off = addr & this.nBlockLimit;
+            if (!size || size == 1) {
+                return block.readByteDirect(off, addr);
+            }
+            if (size == 2) {
+                if (off < this.nBlockLimit) {
+                    return block.readShortDirect(off, addr);
+                }
+                return block.readByteDirect(off, addr) | (this.probeAddr(addr + 1, 1, fPhysical) << 8);
+            }
+            if (size == 4) {
+                if (off < this.nBlockLimit - 2) {
+                    return block.readLongDirect(off, addr);
+                }
+                if (off == this.nBlockLimit - 1) {
+                    return block.readShortDirect(off, addr) | (this.probeAddr(addr + 2, 2, fPhysical) << 16);
+                }
+                return block.readByteDirect(off, addr) | (this.probeAddr(addr + 1, 1, fPhysical) << 8) | (this.probeAddr(addr + 2, 1, fPhysical) << 16) | (this.probeAddr(addr + 3, 1, fPhysical) << 24);
+            }
+        }
+
+        /*
+         * Since the Bus component initializes all unused portions of physical address space with an empty
+         * block, we have also written mapPageBlock() to return an empty block (memEmpty) whenever there is
+         * no valid mapping.  So if we ever end up here, this may represent a hole that needs plugging.
+         *
+         * It's also possible the caller passed a bogus parameter, such as an invalid size (must be 1, 2 or 4).
+         */
+
+        return null;
+    }
+
+    /**
+     * getByte(addr)
+     *
+     * Use bus.getByte() for physical addresses, and cpu.getByte() for linear addresses; the latter takes care
+     * of paging, cycle counts, and BACKTRACK states, if any.
+     *
+     * @this {X86CPU}
+     * @param {number} addr is a linear address
+     * @return {number} byte (8-bit) value at that address
+     */
+    getByte(addr)
+    {
+        if (BACKTRACK) this.backTrack.btiMem0 = this.bus.readBackTrack(addr);
+        return this.aMemBlocks[(addr & this.nMemMask) >>> this.nBlockShift].readByte(addr & this.nBlockLimit, addr);
+    }
+
+    /**
+     * getShort(addr)
+     *
+     * Use bus.getShort() for physical addresses, and cpu.getShort() for linear addresses; the latter takes care
+     * of paging, cycle counts, and BACKTRACK states, if any.
+     *
+     * @this {X86CPU}
+     * @param {number} addr is a linear address
+     * @return {number} word (16-bit) value at that address
+     */
+    getShort(addr)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = (addr & this.nMemMask) >>> this.nBlockShift;
+        /*
+         * On the 8088, it takes 4 cycles to read the additional byte REGARDLESS whether the address is odd or even.
+         * TODO: For the 8086, the penalty is actually "(addr & 0x1) << 2" (4 additional cycles only when the address is odd).
+         */
+        this.nStepCycles -= this.cycleCounts.nWordCyclePenalty;
+
+        if (BACKTRACK) {
+            this.backTrack.btiMem0 = this.bus.readBackTrack(addr);
+            this.backTrack.btiMem1 = this.bus.readBackTrack(addr + 1);
+        }
+        if (off < this.nBlockLimit) {
+            return this.aMemBlocks[iBlock].readShort(off, addr);
+        }
+        var w = this.aMemBlocks[iBlock].readByte(off, addr);
+        if (!(this.opFlags & X86.OPFLAG.FAULT)) {
+            w |= this.aMemBlocks[(iBlock + 1) & this.nBlockMask].readByte(0, addr + 1) << 8;
+        }
+        return w;
+    }
+
+    /**
+     * getLong(addr)
+     *
+     * Use bus.getLong() for physical addresses, and cpu.getLong() for linear addresses; the latter takes care
+     * of paging, cycle counts, and BACKTRACK states, if any.
+     *
+     * @this {X86CPU}
+     * @param {number} addr is a linear address
+     * @return {number} long (32-bit) value at that address
+     */
+    getLong(addr)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = (addr & this.nMemMask) >>> this.nBlockShift;
+        if (BACKTRACK) {
+            this.backTrack.btiMem0 = this.bus.readBackTrack(addr);
+            this.backTrack.btiMem1 = this.bus.readBackTrack(addr + 1);
+            this.backTrack.btiMem2 = this.bus.readBackTrack(addr + 2);
+            this.backTrack.btiMem3 = this.bus.readBackTrack(addr + 3);
+        }
+        if (off < this.nBlockLimit - 2) {
+            return this.aMemBlocks[iBlock].readLong(off, addr);
+        }
+        /*
+         * I think the previous version of this function tried to be too clever (ie, reading the last
+         * long in the current block and the first long in the next block and masking/combining the results),
+         * which may have also created some undesirable side-effects for custom memory controllers.
+         * This simpler (and probably more reliable) approach is to simply read the long as individual bytes.
+         */
+        var l = 0;
+        var cb = 4, nShift = 0;
+        var cbBlock = 4 - (off & 0x3);    // (off & 0x3) will be 1, 2 or 3, so cbBlock will be 3, 2, or 1
+        while (cb--) {
+            l |= (this.aMemBlocks[iBlock].readByte(off++, addr++) << nShift);
+            if (this.opFlags & X86.OPFLAG.FAULT) break;
+            if (!--cbBlock) {
+                iBlock = (iBlock + 1) & this.nBlockMask;
+                off = 0;
+            }
+            nShift += 8;
+        }
+        return l;
+    }
+
+    /**
+     * setByte(addr, b)
+     *
+     * Use bus.setByte() for physical addresses, and cpu.setByte() for linear addresses; the latter takes care
+     * of paging, cycle counts, and BACKTRACK states, if any.
+     *
+     * @this {X86CPU}
+     * @param {number} addr is a linear address
+     * @param {number} b is the byte (8-bit) value to write (which we truncate to 8 bits; required by opSTOSb)
+     */
+    setByte(addr, b)
+    {
+        if (BACKTRACK) this.bus.writeBackTrack(addr, this.backTrack.btiMem0);
+        this.aMemBlocks[(addr & this.nMemMask) >>> this.nBlockShift].writeByte(addr & this.nBlockLimit, b & 0xff, addr);
+    }
+
+    /**
+     * setShort(addr, w)
+     *
+     * Use bus.setShort() for physical addresses, and cpu.setShort() for linear addresses; the latter takes care
+     * of paging, cycle counts, and BACKTRACK states, if any.
+     *
+     * @this {X86CPU}
+     * @param {number} addr is a linear address
+     * @param {number} w is the word (16-bit) value to write (which we truncate to 16 bits to be safe)
+     */
+    setShort(addr, w)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = (addr & this.nMemMask) >>> this.nBlockShift;
+        /*
+         * On the 8088, it takes 4 cycles to write the additional byte REGARDLESS whether the address is odd or even.
+         * TODO: For the 8086, the penalty is actually "(addr & 0x1) << 2" (4 additional cycles only when the address is odd).
+         */
+        this.nStepCycles -= this.cycleCounts.nWordCyclePenalty;
+
+        if (BACKTRACK) {
+            this.bus.writeBackTrack(addr, this.backTrack.btiMem0);
+            this.bus.writeBackTrack(addr + 1, this.backTrack.btiMem1);
+        }
+        if (off < this.nBlockLimit) {
+            this.aMemBlocks[iBlock].writeShort(off, w & 0xffff, addr);
+            return;
+        }
+        this.aMemBlocks[iBlock++].writeByte(off, w & 0xff, addr);
+        if (this.opFlags & X86.OPFLAG.FAULT) return;
+        this.aMemBlocks[iBlock & this.nBlockMask].writeByte(0, (w >> 8) & 0xff, addr + 1);
+    }
+
+    /**
+     * setLong(addr, l)
+     *
+     * Use bus.setLong() for physical addresses, and cpu.setLong() for linear addresses; the latter takes care
+     * of paging, cycle counts, and BACKTRACK states, if any.
+     *
+     * @this {X86CPU}
+     * @param {number} addr is a linear address
+     * @param {number} l is the long (32-bit) value to write
+     */
+    setLong(addr, l)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = (addr & this.nMemMask) >>> this.nBlockShift;
+        this.nStepCycles -= this.cycleCounts.nWordCyclePenalty;
+
+        if (BACKTRACK) {
+            this.bus.writeBackTrack(addr, this.backTrack.btiMem0);
+            this.bus.writeBackTrack(addr + 1, this.backTrack.btiMem1);
+            this.bus.writeBackTrack(addr + 2, this.backTrack.btiMem2);
+            this.bus.writeBackTrack(addr + 3, this.backTrack.btiMem3);
+        }
+        if (off < this.nBlockLimit - 2) {
+            this.aMemBlocks[iBlock].writeLong(off, l, addr);
+            return;
+        }
+        /*
+         * I think the previous version of this function tried to be too clever (ie, reading and rewriting
+         * the last long in the current block, and then reading and rewriting the first long in the next
+         * block), which may have also created some undesirable side-effects for custom memory controllers.
+         * This simpler (and probably more reliable) approach is to simply write the long as individual bytes.
+         */
+        var cb = 4;
+        var cbBlock = 4 - (off & 0x3);    // (off & 0x3) will be 1, 2 or 3, so cbBlock will be 3, 2, or 1
+        while (cb--) {
+            this.aMemBlocks[iBlock].writeByte(off++, l & 0xff, addr++);
+            if (this.opFlags & X86.OPFLAG.FAULT) return;
+            if (!--cbBlock) {
+                iBlock = (iBlock + 1) & this.nBlockMask;
+                off = 0;
+            }
+            l >>>= 8;
+        }
+    }
+
+    /**
+     * getEAByte(seg, off)
+     *
+     * @this {X86CPU}
+     * @param {X86Seg} seg register (eg, segDS)
+     * @param {number} off is a segment-relative offset
+     * @return {number} byte (8-bit) value at that address
+     */
+    getEAByte(seg, off)
+    {
+        this.segEA = seg;
+        this.offEA = off & (I386? this.maskAddr : 0xffff);
+        this.regEA = seg.checkRead(this.offEA, 1);
+        if (this.opFlags & X86.OPFLAG.NOREAD) return 0;
+        var b = this.getByte(this.regEA);
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiMem0;
+        return b;
+    }
+
+    /**
+     * getEAByteData(off)
+     *
+     * @this {X86CPU}
+     * @param {number} off is a segment-relative offset
+     * @return {number} byte (8-bit) value at that address
+     */
+    getEAByteData(off)
+    {
+        return this.getEAByte(this.segData, off);
+    }
+
+    /**
+     * getEAByteStack(off)
+     *
+     * @this {X86CPU}
+     * @param {number} off is a segment-relative offset
+     * @return {number} byte (8-bit) value at that address
+     */
+    getEAByteStack(off)
+    {
+        return this.getEAByte(this.segStack, off);
+    }
+
+    /**
+     * getEAWord(seg, off)
+     *
+     * @this {X86CPU}
+     * @param {X86Seg} seg register (eg, segDS)
+     * @param {number} off is a segment-relative offset
+     * @return {number} word (16-bit) value at that address
+     */
+    getEAWord(seg, off)
+    {
+        this.segEA = seg;
+        this.offEA = off & (I386? this.maskAddr : 0xffff);
+        this.regEA = seg.checkRead(this.offEA, (I386? this.sizeData : 2));
+        if (this.opFlags & X86.OPFLAG.NOREAD) return 0;
+        var w = this.getWord(this.regEA);
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiMem0;
+            this.backTrack.btiEAHi = this.backTrack.btiMem1;
+        }
+        return w;
+    }
+
+    /**
+     * getEAShortData(off)
+     *
+     * @this {X86CPU}
+     * @param {number} off is a segment-relative offset
+     * @return {number} short (16-bit) value at that address
+     */
+    getEAShortData(off)
+    {
+        this.segEA = this.segData;
+        this.offEA = off & (I386? this.maskAddr : 0xffff);
+        this.regEA = this.segEA.checkRead(this.offEA, 2);
+        if (this.opFlags & X86.OPFLAG.NOREAD) return 0;
+        var w = this.getShort(this.regEA);
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiMem0;
+            this.backTrack.btiEAHi = this.backTrack.btiMem1;
+        }
+        return w;
+    }
+
+    /**
+     * getEAShortStack(off)
+     *
+     * @this {X86CPU}
+     * @param {number} off is a segment-relative offset
+     * @return {number} short (16-bit) value at that address
+     */
+    getEAShortStack(off)
+    {
+        this.segEA = this.segStack;
+        this.offEA = off & (I386? this.maskAddr : 0xffff);
+        this.regEA = this.segEA.checkRead(this.offEA, 2);
+        if (this.opFlags & X86.OPFLAG.NOREAD) return 0;
+        var w = this.getShort(this.regEA);
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiMem0;
+            this.backTrack.btiEAHi = this.backTrack.btiMem1;
+        }
+        return w;
+    }
+
+    /**
+     * getEALongData(off)
+     *
+     * @this {X86CPU}
+     * @param {number} off is a segment-relative offset
+     * @return {number} long (32-bit) value at that address
+     */
+    getEALongData(off)
+    {
+        this.segEA = this.segData;
+        this.offEA = off & (I386? this.maskAddr : 0xffff);
+        this.regEA = this.segEA.checkRead(this.offEA, 4);
+        if (this.opFlags & X86.OPFLAG.NOREAD) return 0;
+        var w = this.getLong(this.regEA);
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiMem0;
+            this.backTrack.btiEAHi = this.backTrack.btiMem1;
+        }
+        return w;
+    }
+
+    /**
+     * getEALongStack(off)
+     *
+     * @this {X86CPU}
+     * @param {number} off is a segment-relative offset
+     * @return {number} long (32-bit) value at that address
+     */
+    getEALongStack(off)
+    {
+        this.segEA = this.segStack;
+        this.offEA = off & (I386? this.maskAddr : 0xffff);
+        this.regEA = this.segEA.checkRead(this.offEA, 4);
+        if (this.opFlags & X86.OPFLAG.NOREAD) return 0;
+        var w = this.getLong(this.regEA);
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiMem0;
+            this.backTrack.btiEAHi = this.backTrack.btiMem1;
+        }
+        return w;
+    }
+
+    /**
+     * setEAByte(b)
+     *
+     * @this {X86CPU}
+     * @param {number} b is the byte (8-bit) value to write
+     */
+    setEAByte(b)
+    {
+        if (this.opFlags & X86.OPFLAG.NOWRITE) return;
+        if (BACKTRACK) this.backTrack.btiMem0 = this.backTrack.btiEALo;
+        this.setByte(this.segEA.checkWrite(this.offEA, 1), b);
+    }
+
+    /**
+     * setEAShort(w)
+     *
+     * @this {X86CPU}
+     * @param {number} w is the short (16-bit) value to write
+     */
+    setEAShort(w)
+    {
+        if (this.opFlags & X86.OPFLAG.NOWRITE) return;
+        if (BACKTRACK) {
+            this.backTrack.btiMem0 = this.backTrack.btiEALo;
+            this.backTrack.btiMem1 = this.backTrack.btiEAHi;
+        }
+        this.setShort(this.segEA.checkWrite(this.offEA, 2), w);
+    }
+
+    /**
+     * setEALong(l)
+     *
+     * @this {X86CPU}
+     * @param {number} l is the long (32-bit) value to write
+     */
+    setEALong(l)
+    {
+        if (this.opFlags & X86.OPFLAG.NOWRITE) return;
+        if (BACKTRACK) {
+            this.backTrack.btiMem0 = this.backTrack.btiEALo;
+            this.backTrack.btiMem1 = this.backTrack.btiEAHi;
+        }
+        this.setLong(this.segEA.checkWrite(this.offEA, 4), l);
+    }
+
+    /**
+     * setEAWord(w)
+     *
+     * @this {X86CPU}
+     * @param {number} w is the word (16-bit or 32-bit) value to write
+     */
+    setEAWord(w)
+    {
+        if (this.opFlags & X86.OPFLAG.NOWRITE) return;
+        if (BACKTRACK) {
+            this.backTrack.btiMem0 = this.backTrack.btiEALo;
+            this.backTrack.btiMem1 = this.backTrack.btiEAHi;
+        }
+        if (!I386) {
+            this.setShort(this.segEA.checkWrite(this.offEA, 2), w);
+        } else {
+            this.setWord(this.segEA.checkWrite(this.offEA, this.sizeData), w);
+        }
+    }
+
+    /**
+     * getSOByte(seg, off)
+     *
+     * This is like getEAByte(), but it does NOT update regEA.
+     *
+     * @this {X86CPU}
+     * @param {X86Seg} seg register (eg, segDS)
+     * @param {number} off is a segment-relative offset
+     * @return {number} byte (8-bit) value at that address
+     */
+    getSOByte(seg, off)
+    {
+       return this.getByte(seg.checkRead(off, 1));
+   }
+
+    /**
+     * getSOWord(seg, off)
+     *
+     * This is like getEAWord(), but it does NOT update regEA.
+     *
+     * @this {X86CPU}
+     * @param {X86Seg} seg register (eg, segDS)
+     * @param {number} off is a segment-relative offset
+     * @return {number} word (16-bit) value at that address
+     */
+    getSOWord(seg, off)
+    {
+        if (!I386) {
+            return this.getShort(seg.checkRead(off, 2));
+        } else {
+            return this.getWord(seg.checkRead(off, this.sizeData));
+        }
+    }
+
+    /**
+     * setSOByte(seg, off, b)
+     *
+     * This is like setEAByte(), but it does NOT update regEAWrite.
+     *
+     * @this {X86CPU}
+     * @param {X86Seg} seg register (eg, segDS)
+     * @param {number} off is a segment-relative offset
+     * @param {number} b is the byte (8-bit) value to write
+     */
+    setSOByte(seg, off, b)
+    {
+        this.setByte(seg.checkWrite(off, 1), b);
+    }
+
+    /**
+     * setSOWord(seg, off, w)
+     *
+     * This is like setEAWord(), but it does NOT update regEAWrite.
+     *
+     * @this {X86CPU}
+     * @param {X86Seg} seg register (eg, segDS)
+     * @param {number} off is a segment-relative offset
+     * @param {number} w is the word (16-bit) value to write
+     */
+    setSOWord(seg, off, w)
+    {
+        if (!I386) {
+            this.setShort(seg.checkWrite(off, 2), w);
+        } else {
+            this.setWord(seg.checkWrite(off, this.sizeData), w);
+        }
+    }
+
+    /**
+     * getBytePrefetch()
+     *
+     * @this {X86CPU}
+     * @return {number} byte (8-bit) value at regLIP
+     */
+    getBytePrefetch()
+    {
+        if (!this.cbPrefetch) {
+            this.refillPrefetch();
+            if (!this.cbPrefetch) return this.getByte(this.regLIP);
+        }
+        var b = (this.adwPrefetch[this.regLIP & X86CPU.PFINFO.IP_MASK] >> ((this.regLIP & 0x3) << 3)) & 0xff;
+
+        this.cbPrefetch--;
+        return b;
+    }
+
+    /**
+     * getShortPrefetch()
+     *
+     * @this {X86CPU}
+     * @return {number} short (16-bit) value at regLIP
+     */
+    getShortPrefetch()
+    {
+        if (this.cbPrefetch < 2) {
+            this.refillPrefetch();
+            if (this.cbPrefetch < 2) {
+                this.cbPrefetch = 0;
+                return this.getShort(this.regLIP);
+            }
+        }
+        var shift = (this.regLIP & 0x3) << 3;
+        var w = (this.adwPrefetch[this.regLIP & X86CPU.PFINFO.IP_MASK] >>> shift) & 0xffff;
+        if (shift > 16) w |= (this.adwPrefetch[(this.regLIP + 4) & X86CPU.PFINFO.IP_MASK] & 0xff) << 8;
+
+        this.cbPrefetch -= 2;
+        return w;
+    }
+
+    /**
+     * getLongPrefetch()
+     *
+     * @this {X86CPU}
+     * @return {number} long (32-bit) value at regLIP
+     */
+    getLongPrefetch()
+    {
+        if (this.cbPrefetch < 4) {
+            this.refillPrefetch();
+            if (this.cbPrefetch < 4) {
+                this.cbPrefetch = 0;
+                return this.getLong(this.regLIP);
+            }
+        }
+        var shift = (this.regLIP & 0x3) << 3;
+        var l = (this.adwPrefetch[this.regLIP & X86CPU.PFINFO.IP_MASK] >>> shift)|0;
+        if (shift) l |= this.adwPrefetch[(this.regLIP + 4) & X86CPU.PFINFO.IP_MASK] << (32 - shift);
+
+        this.cbPrefetch -= 4;
+        return l;
+    }
+
+    /**
+     * getWordPrefetch()
+     *
+     * @this {X86CPU}
+     * @return {number} short (16-bit) or long (32-bit) value as appropriate
+     */
+    getWordPrefetch()
+    {
+        return (I386 && this.sizeData == 4? this.getLongPrefetch() : this.getShortPrefetch());
+    }
+
+    /**
+     * refillPrefetch()
+     *
+     * This function is similar to probeAddr() in that must NOT trigger a fault, because prefetching
+     * inherently runs the risk of fetching more bytes that may actually be executed.  Also, to keep it
+     * simple, we limit prefetching to whatever bytes (if any) are available in the current page.  If the
+     * page is not present, or there are insufficient bytes in the current page to completely fill the
+     * queue, then the caller must request byte(s) "the old-fashioned way", to ensure proper fault handling.
+     *
+     * For example, if getShortPrefetch() finds there are only 0 or 1 bytes in the prefetch queue, and
+     * if it is unable to obtain any more bytes via refillPrefetch(), then getShortPrefetch() must call
+     * getShort(this.regLIP) (which is also what would be called if PREFETCH was disabled completely).
+     *
+     * @this {X86CPU}
+     */
+    refillPrefetch()
+    {
+        var aBlocks = this.aMemBlocks;
+        var regLIP = this.regLIP & ~0x3;
+        var block = aBlocks[(regLIP & this.nMemMask) >>> this.nBlockShift];
+        if (block && block.type == Memory.TYPE.UNPAGED) {
+            block = this.mapPageBlock(regLIP, false, true);
+            if (block === this.memEmpty) block = null;
+        }
+        if (block) {
+            var off = regLIP & this.nBlockLimit;
+            var cbMax = this.nBlockSize - off;
+            if (cbMax > X86CPU.PFINFO.LENGTH) cbMax = X86CPU.PFINFO.LENGTH;
+            for (var i = 0; i < cbMax; i += 4) {
+                this.adwPrefetch[regLIP & X86CPU.PFINFO.IP_MASK] = block.readLongDirect(off, regLIP);
+                off += 4; regLIP += 4;
+            }
+            this.cbPrefetch = i - (this.regLIP & 0x3);
+         // this.nBusCycles += 4;
+        } else {
+            this.cbPrefetch = 0;
+        }
+    }
+
+    /**
+     * getIPByte()
+     *
+     * @this {X86CPU}
+     * @return {number} byte at the current IP; IP advanced by 1
+     */
+    getIPByte()
+    {
+        var newLIP = this.checkIP(1);
+        var b = (PREFETCH? this.getBytePrefetch() : this.getByte(this.regLIP));
+        if (BACKTRACK) this.bus.updateBackTrackCode(this.regLIP, this.backTrack.btiMem0);
+        this.regLIP = newLIP;
+        return b;
+    }
+
+    /**
+     * getIPShort()
+     *
+     * @this {X86CPU}
+     * @return {number} short at the current IP; IP advanced by 2
+     */
+    getIPShort()
+    {
+        var newLIP = this.checkIP(2);
+        var w = (PREFETCH? this.getShortPrefetch() : this.getShort(this.regLIP));
+        if (BACKTRACK) {
+            this.bus.updateBackTrackCode(this.regLIP, this.backTrack.btiMem0);
+            this.bus.updateBackTrackCode(this.regLIP + 1, this.backTrack.btiMem1);
+        }
+        this.regLIP = newLIP;
+        return w;
+    }
+
+    /**
+     * getIPAddr()
+     *
+     * @this {X86CPU}
+     * @return {number} word at the current IP; IP advanced by 2 or 4, depending on address size
+     */
+    getIPAddr()
+    {
+        var newLIP = this.checkIP(this.sizeAddr);
+        var w = (PREFETCH? this.getAddr() : this.getAddr(this.regLIP));
+        if (BACKTRACK) {
+            this.bus.updateBackTrackCode(this.regLIP, this.backTrack.btiMem0);
+            this.bus.updateBackTrackCode(this.regLIP + 1, this.backTrack.btiMem1);
+        }
+        this.regLIP = newLIP;
+        return w;
+    }
+
+    /**
+     * getIPWord()
+     *
+     * @this {X86CPU}
+     * @return {number} word at the current IP; IP advanced by 2 or 4, depending on operand size
+     */
+    getIPWord()
+    {
+        var newLIP = this.checkIP(this.sizeData);
+        var w = (PREFETCH? this.getWordPrefetch() : this.getWord(this.regLIP));
+        if (BACKTRACK) {
+            this.bus.updateBackTrackCode(this.regLIP, this.backTrack.btiMem0);
+            this.bus.updateBackTrackCode(this.regLIP + 1, this.backTrack.btiMem1);
+        }
+        this.regLIP = newLIP;
+        return w;
+    }
+
+    /**
+     * getIPDisp()
+     *
+     * @this {X86CPU}
+     * @return {number} sign-extended (32-bit) value from the byte at the current IP; IP advanced by 1
+     */
+    getIPDisp()
+    {
+        var newLIP = this.checkIP(1);
+        var w = ((PREFETCH? this.getBytePrefetch() : this.getByte(this.regLIP)) << 24) >> 24;
+        if (BACKTRACK) this.bus.updateBackTrackCode(this.regLIP, this.backTrack.btiMem0);
+        this.regLIP = newLIP;
+        return w;
+    }
+
+    /**
+     * peekIPByte()
+     *
+     * @this {X86CPU}
+     * @return {number} byte at the current IP
+     */
+    peekIPByte()
+    {
+        return (PREFETCH? this.getBytePrefetch() : this.getByte(this.regLIP));
+    }
+
+    /**
+     * popWord()
+     *
+     * @this {X86CPU}
+     * @return {number} word popped from the current SP; SP increased by 2 or 4
+     */
+    popWord()
+    {
+        var w = this.getWord(this.regLSP);
+
+        this.regLSP = (this.regLSP + (I386? this.sizeData : 2))|0;
+
+        /*
+         * Properly comparing regLSP to regLSPLimit would normally require coercing both to unsigned
+         * (ie, floating-point) values.  But instead, we do a subtraction, (regLSPLimit - regLSP), and
+         * if the result is negative, we need only be concerned if the signs of both numbers are the same
+         * (ie, the sign of their XOR'ed union is positive).
+         *
+         * TODO: I'm combining the old 8088 address-wrap check with the new segment-limit check,
+         * even though the correct time to do the latter is immediately BEFORE the fetch, not AFTER;
+         * I'm working around this for now by applying a -1 fudge factor to the fault check below.
+         */
+        var off = ((this.regLSPLimit - this.regLSP)|0);
+        if (off < 0 && (this.regLSPLimit ^ this.regLSP) >= 0) {
+            /*
+             * There's no such thing as an SS fault on the 8086/8088, and I'm assuming that, on newer
+             * processors, when the stack segment limit is set to the maximum, it's OK for the stack to wrap.
+             */
+            if (this.model <= X86.MODEL_8088 || !this.segSS.fExpDown && this.segSS.limit == this.segSS.maskAddr || this.segSS.fExpDown && !this.segSS.limit) {
+                this.setSP((this.regLSP - this.segSS.base) & this.segSS.maskAddr);
+            } else if (off < -1) {          // fudge factor
+                X86.helpFault.call(this, X86.EXCEPTION.SS_FAULT, 0);
+            }
+        }
+        return w;
+    }
+
+    /**
+     * pushData(d, width, size)
+     *
+     * This function serves two very limited purposes: 1) the ability to push data according to a previous
+     * operand size (width), and 2) the ability to write fewer bytes than the width if necessary (size).
+     *
+     * The former occurs when a 32-bit code segment performs a 16:32 call to a 16-bit code segment; after the
+     * new 16-bit code segment is loaded (and possible stack switch occurs), the return address (both segment
+     * and offset) must still be pushed as 32-bit values.
+     *
+     * The latter occurs with segment register pushes.  When a 32-bit operand size is in effect (ie, width is 4),
+     * only the low 16 bits should be written (size must be 2).  For all other kinds of pushes, width and size are
+     * impliedly the same.
+     *
+     * @this {X86CPU}
+     * @param {number} d is the data to push at current SP; SP decreased by size
+     * @param {number} width is the width of the data to push, in bytes (must be either 2 or 4)
+     * @param {number} size is the size of the data to push, in bytes (must be 1, 2, or 4, and <= width)
+     */
+    pushData(d, width, size)
+    {
+
+
+        var regLSP = (this.regLSP - width)|0;
+
+        /*
+         * Properly comparing regLSP to regLSPLimitLow would normally require coercing both to unsigned
+         * (ie, floating-point) values.  But instead, we do a subtraction, (regLSP - regLSPLimitLow), and
+         * if the result is negative, we need only be concerned if the signs of both numbers are the same
+         * (ie, the sign of their XOR'ed union is positive).
+         */
+        if (((regLSP - this.regLSPLimitLow)|0) < 0 && (this.regLSPLimitLow ^ regLSP) >= 0) {
+            /*
+             * There's no such thing as an SS fault on the 8086/8088, and I'm assuming that, on newer
+             * processors, when the stack segment limit is set to the maximum, it's OK for the stack to wrap.
+             */
+            if (this.model <= X86.MODEL_8088 || !this.segSS.fExpDown && this.segSS.limit == this.segSS.maskAddr || this.segSS.fExpDown && !this.segSS.limit) {
+                this.setSP((regLSP - this.segSS.base) & this.segSS.maskAddr);
+                regLSP = this.regLSP;
+            } else {
+                X86.helpFault.call(this, X86.EXCEPTION.SS_FAULT, 0);
+            }
+        }
+
+        switch(size) {
+        case 1:
+            this.setByte(regLSP, d);
+            break;
+        case 2:
+            this.setShort(regLSP, d);
+            break;
+        case 4:
+            this.setLong(regLSP, d);
+            break;
+        default:
+
+            break;
+        }
+
+        /*
+         * We update this.regLSP at the end to make life simpler for opcode handlers that perform only one
+         * pushWord() operation, relieving them from having to snapshot this.regLSP into this.opLSP needlessly.
+         */
+        this.regLSP = regLSP;
+    }
+
+    /**
+     * pushWord(w)
+     *
+     * @this {X86CPU}
+     * @param {number} w is the word (16-bit) value to push at current SP; SP decreased by 2 or 4
+     */
+    pushWord(w)
+    {
+        /*
+         * This assertion is no longer valid, now that we've fixed opPUSH8() to use getIPDisp() instead of getIPByte(),
+         * thus sign-extending the byte as appropriate.  And since sign-extension necessarily affects the entire 32-bit
+         * value, this assertion could fail when dataMask is 16 bits.
+         *
+         *
+         *
+         * setWord() calls setShort() or setLong() as appropriate, and setShort() truncates incoming values, so the fact
+         * that any incoming signed values will not be truncated to 16 bits should not be a concern.
+         */
+        var regLSP = (this.regLSP - (I386? this.sizeData : 2))|0;
+
+        /*
+         * Properly comparing regLSP to regLSPLimitLow would normally require coercing both to unsigned
+         * (ie, floating-point) values.  But instead, we do a subtraction, (regLSP - regLSPLimitLow), and
+         * if the result is negative, we need only be concerned if the signs of both numbers are the same
+         * (ie, the sign of their XOR'ed union is positive).
+         */
+        if (((regLSP - this.regLSPLimitLow)|0) < 0 && (this.regLSPLimitLow ^ regLSP) >= 0) {
+            /*
+             * There's no such thing as an SS fault on the 8086/8088, and I'm assuming that, on newer
+             * processors, when the stack segment limit is set to the maximum, it's OK for the stack to wrap.
+             */
+            if (this.model <= X86.MODEL_8088 || !this.segSS.fExpDown && this.segSS.limit == this.segSS.maskAddr || this.segSS.fExpDown && !this.segSS.limit) {
+                this.setSP((regLSP - this.segSS.base) & this.segSS.maskAddr);
+                regLSP = this.regLSP;
+            } else {
+                X86.helpFault.call(this, X86.EXCEPTION.SS_FAULT, 0);
+            }
+        }
+
+        this.setWord(regLSP, w);
+
+        /*
+         * We update this.regLSP at the end to make life simpler for opcode handlers that perform only one
+         * pushWord() operation, relieving them from having to snapshot this.regLSP into this.opLSP needlessly.
+         */
+        this.regLSP = regLSP;
+    }
+
+    /**
+     * checkINTR()
+     *
+     * This must only be called when intFlags (containing the simulated INTFLAG.INTR signal) is known to be set.
+     * Note that it's perfectly possible that between the time updateINTR(true) was called and we request the
+     * interrupt vector number below, the interrupt could have been cleared or masked, in which case getIRRVector()
+     * will return -1 and we'll simply clear INTFLAG.INTR.
+     *
+     * intFlags has been overloaded with the INTFLAG.TRAP bit as well, since the acknowledgment of h/w interrupts
+     * and the Trap flag are similar; they must both honor the NOINTR suppression flag, and stepCPU() shouldn't
+     * have to check multiple variables when deciding whether to simulate an interrupt.
+     *
+     * This function also includes a check for the new async INTFLAG.DMA flag, which is triggered by a ChipSet call
+     * to setDMA().  This DMA flag actually has nothing to do with interrupts; it's simply an expedient way to
+     * piggy-back on the CPU's execution logic, to help drive async DMA requests.
+     *
+     * Originally, DMA requests (eg, FDC or HDC I/O operations) were all handled synchronously, since no actual
+     * I/O was required to satisfy the request; from the CPU's perspective, this meant DMA operations were virtually
+     * instantaneous.  However, with the introduction of remote disk connections, some actual I/O may now be required;
+     * in practice, this means that the FIRST byte requested as part of a DMA operation may require a callback to
+     * finish, while all remaining bytes will be retrieved during subsequent checkINTR() calls -- unless of course
+     * additional remote I/O operations are required to complete the DMA operation.
+     *
+     * As a result, the CPU will run slightly slower while an async DMA request is in progress, but the slowdown
+     * should be negligible.  One downside is that this slowdown will be in effect for the entire duration of the
+     * I/O (ie, even while we're waiting for the remote I/O to finish), so the ChipSet component should avoid
+     * calling setDMA() whenever possible.
+     *
+     * TODO: While comparing SYMDEB tracing in both PCx86 and VMware, I noticed that after single-stepping ANY
+     * segment-load instruction, SYMDEB would get control immediately after that instruction in VMware, whereas
+     * I delay acknowledgment of the Trap flag until the *following* instruction, so in PCx86, SYMDEB doesn't get
+     * control until the following instruction.  I think PCx86 behavior is correct, at least for SS.
+     *
+     * ERRATA: Early revisions of the 8086/8088 failed to suppress hardware interrupts (and possibly also Trap
+     * acknowledgements) after an SS load, but Intel corrected the problem at some point; however, I don't know when
+     * that change was made or which IBM PC models may have been affected, if any.  TODO: More research required.
+     *
+     * WARNING: There is also a priority consideration here.  On the 8086/8088, hardware interrupts have higher
+     * priority than Trap interrupts (which is why the code below is written the way it is).  A potentially
+     * undesirable side-effect is that a hardware interrupt handler could end up being single-stepped if an
+     * external interrupt occurs immediately after the Trap flag is set.  This is why some 8086 debuggers temporarily
+     * mask all hardware interrupts during a single-step operation (although that doesn't help with NMIs generated
+     * by a coprocessor).  As of the 80286, those priorities were inverted, giving the Trap interrupt higher priority
+     * than external interrupts.
+     *
+     * TODO: Determine the priorities for the 80186.
+     *
+     * @this {X86CPU}
+     * @return {boolean} true if h/w interrupt (or trap) has just been acknowledged, false if not
+     */
+    checkINTR()
+    {
+        // DEBUG:
+
+        if (!(this.opFlags & X86.OPFLAG.NOINTR)) {
+            /*
+             * As discussed above, the 8086/8088 give hardware interrupts higher priority than the TRAP interrupt,
+             * whereas the 80286 and up give TRAPs higher priority.
+             */
+            var iPriority = (this.model < X86.MODEL_80286? 0 : 1);
+            for (var cPriorities = 0; cPriorities < 2; cPriorities++) {
+                switch(iPriority) {
+                case 0:
+                    if ((this.intFlags & X86.INTFLAG.INTR) && (this.regPS & X86.PS.IF)) {
+                        var nIDT = this.chipset.getIRRVector();
+                        if (nIDT >= -1) {
+                            this.intFlags &= ~X86.INTFLAG.INTR;
+                            if (nIDT >= 0) {
+                                this.intFlags &= ~X86.INTFLAG.HALT;
+                                X86.helpInterrupt.call(this, nIDT);
+                                return true;
+                            }
+                        }
+                    }
+                    break;
+                case 1:
+                    if ((this.intFlags & X86.INTFLAG.TRAP)) {
+                        this.intFlags &= ~X86.INTFLAG.TRAP;
+                        if (I386 && this.model >= X86.MODEL_80386) this.regDR[6] |= X86.DR6.BS;
+                        X86.helpInterrupt.call(this, X86.EXCEPTION.DB_EXC);
+                        return true;
+                    }
+                    break;
+                }
+                iPriority = 1 - iPriority;
+            }
+        }
+        /*
+         * As long as the ChipSet component isn't calling setDMA(), we don't need to test INTFLAG.DMA...
+         *
+        if (this.intFlags & X86.INTFLAG.DMA) {
+            if (!this.chipset.checkDMA()) {
+                this.intFlags &= ~X86.INTFLAG.DMA;
+            }
+        }
+         */
+        return false;
+    }
+
+    /**
+     * updateINTR(fRaise)
+     *
+     * This is called by the ChipSet component whenever a h/w interrupt needs to be simulated.
+     * This is how the PIC component simulates raising the INTFLAG.INTR signal.  We will honor the request
+     * only if we have a reference back to the ChipSet component.  The CPU will then "respond" by calling
+     * checkINTR() and request the corresponding interrupt vector from the ChipSet.
+     *
+     * @this {X86CPU}
+     * @param {boolean} fRaise is true to raise INTFLAG.INTR, false to lower
+     */
+    updateINTR(fRaise)
+    {
+        if (this.chipset) {
+            if (fRaise) {
+                this.intFlags |= X86.INTFLAG.INTR;
+            } else {
+                this.intFlags &= ~X86.INTFLAG.INTR;
+            }
+        }
+    }
+
+    /**
+     * delayINTR()
+     *
+     * This is called by the ChipSet component whenever the IMR register is being unmasked, to avoid
+     * interrupts being simulated too quickly. This works around a problem in the ROM BIOS "KBD_RESET"
+     * (F000:E688) function, which is called with interrupts enabled by the "TST8" (F000:E30D) code.
+     *
+     * "KBD_RESET" appears to be written with the assumption that CLI is in effect, because it issues an
+     * STI immediately after unmasking the keyboard IRQ.  And normally, the STI would delay INTFLAG.INTR
+     * long enough to allow AH to be set to 0. But if interrupts are already enabled, an interrupt could
+     * theoretically occur before the STI.  And since AH isn't initialized until after the STI, such an
+     * interrupt would be missed.
+     *
+     * I'm assuming this never happens in practice because the PIC isn't that fast.  But for us to
+     * guarantee that, we need to provide this function to the ChipSet component.
+     *
+     * @this {X86CPU}
+     */
+    delayINTR()
+    {
+        this.opFlags |= X86.OPFLAG.NOINTR;
+    }
+
+    /**
+     * updateReg(sReg, nValue)
+     *
+     * This function helps updateStatus() by massaging the register names and values according to
+     * CPU type before passing the call to displayValue(); in the "old days", updateStatus() called
+     * displayValue() directly (although then it was called displayReg()).
+     *
+     * @this {X86CPU}
+     * @param {string} sReg
+     * @param {number} nValue
+     */
+    updateReg(sReg, nValue)
+    {
+        var cch = 4;
+        if (sReg.length == 1) {
+            cch = 1;
+            nValue = nValue? 1 : 0;
+        }
+        if (this.model < 80386) {
+            if (sReg.length > 2) {
+                sReg = sReg.substr(1, 2);
+            }
+        } else {
+            if (sReg == "PS" || sReg.length > 2) {
+                cch = 8;
+            }
+        }
+        this.displayValue(sReg, nValue, cch);
+    }
+
+    /**
+     * updateStatus(fForce)
+     *
+     * This provides periodic Control Panel updates (eg, a few times per second; see STATUS_UPDATES_PER_SECOND).
+     * this is where we take care of any DOM updates (eg, register values) while the CPU is running.
+     *
+     * Any high-frequency updates should be performed in updateVideo(), which should avoid DOM updates, since updateVideo()
+     * can be called up to 60 times per second (see VIDEO_UPDATES_PER_SECOND).
+     *
+     * @this {X86CPU}
+     * @param {boolean} [fForce] (true will display registers even if the CPU is running and "live" registers are not enabled)
+     */
+    updateStatus(fForce)
+    {
+        if (this.cLiveRegs) {
+            if (fForce || !this.flags.running || this.flags.displayLiveRegs) {
+                this.updateReg("EAX", this.regEAX);
+                this.updateReg("EBX", this.regEBX);
+                this.updateReg("ECX", this.regECX);
+                this.updateReg("EDX", this.regEDX);
+                this.updateReg("ESP", this.getSP());
+                this.updateReg("EBP", this.regEBP);
+                this.updateReg("ESI", this.regESI);
+                this.updateReg("EDI", this.regEDI);
+                this.updateReg("CS", this.getCS());
+                this.updateReg("DS", this.getDS());
+                this.updateReg("SS", this.getSS());
+                this.updateReg("ES", this.getES());
+                this.updateReg("EIP", this.getIP());
+                var regPS = this.getPS();
+                this.updateReg("PS", regPS);
+                this.updateReg("V", (regPS & X86.PS.OF));
+                this.updateReg("D", (regPS & X86.PS.DF));
+                this.updateReg("I", (regPS & X86.PS.IF));
+                this.updateReg("T", (regPS & X86.PS.TF));
+                this.updateReg("S", (regPS & X86.PS.SF));
+                this.updateReg("Z", (regPS & X86.PS.ZF));
+                this.updateReg("A", (regPS & X86.PS.AF));
+                this.updateReg("P", (regPS & X86.PS.PF));
+                this.updateReg("C", (regPS & X86.PS.CF));
+                if (this.model == X86.MODEL_80386) {
+                    this.updateReg("FS", this.getFS());
+                    this.updateReg("GS", this.getGS());
+                    this.updateReg("CR0", this.regCR0);
+                    this.updateReg("CR2", this.regCR2);
+                    this.updateReg("CR3", this.regCR3);
+                }
+            }
+        }
+
+        var controlSpeed = this.bindings["speed"];
+        if (controlSpeed) controlSpeed.textContent = this.getSpeedCurrent();
+    }
+
+    /**
+     * stepCPU(nMinCycles)
+     *
+     * NOTE: Single-stepping should not be confused with the Trap flag; single-stepping is a Debugger
+     * operation that's completely independent of Trap status.  The CPU can go in and out of Trap mode,
+     * in and out of h/w interrupt service routines (ISRs), etc, but from the Debugger's perspective,
+     * they're all one continuous stream of instructions that can be stepped or run at will.  Moreover,
+     * stepping vs. running should never change the behavior of the simulation.
+     *
+     * Similarly, the Debugger's execution breakpoints have no involvement with the x86 breakpoint instruction
+     * (0xCC); the Debugger monitors changes to the regLIP register to implement its own execution breakpoints.
+     *
+     * As a result, the Debugger's complete independence means you can run other 8086/8088 debuggers
+     * (eg, DEBUG) inside the simulation without interference; you can even "debug" them with the Debugger.
+     *
+     * @this {X86CPU}
+     * @param {number} nMinCycles (0 implies a single-step, and therefore breakpoints should be ignored)
+     * @return {number} of cycles executed; 0 indicates a pre-execution condition (ie, an execution breakpoint
+     * was hit), -1 indicates a post-execution condition (eg, a read or write breakpoint was hit), and a positive
+     * number indicates successful completion of that many cycles (which should always be >= nMinCycles).
+     */
+    stepCPU(nMinCycles)
+    {
+        /*
+         * The Debugger uses fComplete to determine if the instruction completed (true) or was interrupted
+         * by a breakpoint or some other exceptional condition (false).  NOTE: this does NOT include JavaScript
+         * exceptions, which stepCPU() expects the caller to catch using its own exception handler.
+         *
+         * The CPU relies on the use of stopCPU() rather than fComplete, because the CPU never single-steps
+         * (ie, nMinCycles is always some large number), whereas the Debugger does.  And conversely, when the
+         * Debugger is single-stepping (even when performing multiple single-steps), fRunning is never set,
+         * so stopCPU() would have no effect as far as the Debugger is concerned.
+         */
+        this.flags.complete = true;
+
+        /*
+         * fDebugCheck is true if we need to "check" every instruction with the Debugger.
+         */
+        var fDebugCheck = this.flags.debugCheck = (DEBUGGER && this.dbg && this.dbg.checksEnabled());
+
+        /*
+         * nDebugState is checked only when fDebugCheck is true, and its sole purpose is to tell the first call
+         * to checkInstruction() that it can skip breakpoint checks, and that will be true ONLY when fStarting is
+         * true OR nMinCycles is zero (the latter means the Debugger is single-stepping).
+         *
+         * Once we snap fStarting, we clear it, because technically, we've moved beyond "starting" and have
+         * officially "started" now.
+         */
+        var nDebugState = (!nMinCycles)? -1 : (this.flags.starting? 0 : 1);
+        this.flags.starting = false;
+
+        /*
+         * We move the minimum cycle count to nStepCycles (the number of cycles left to step), so that other
+         * functions have the ability to force that number to zero (eg, stopCPU()), and thus we don't have to check
+         * any other criteria to determine whether we should continue stepping or not.
+         */
+        this.nBurstCycles = this.nStepCycles = nMinCycles;
+
+        /*
+         * NOTE: Even though runCPU() calls updateAllTimers(), we need an additional call here if we're being
+         * called from the Debugger, so that any single-stepping will update the timers as well.
+         */
+        if (this.chipset && !nMinCycles) this.chipset.updateAllTimers();
+
+        /*
+         * Let's also suppress h/w interrupts whenever the Debugger is single-stepping an instruction; I'm loathe
+         * to allow Debugger interactions to affect the behavior of the virtual machine in ANY way, but I'm making
+         * this small concession to avoid the occasional and sometimes unexpected Debugger command that ends up
+         * stepping into a hardware interrupt service routine (ISR).
+         *
+         * Note that this is similar to the problem discussed in checkINTR() regarding the priority of external h/w
+         * interrupts vs. Trap interrupts, but they require different solutions, because our Debugger operates
+         * independently of the CPU.
+         *
+         * One exception I make here is when you've asked the Debugger to display PIC messages, the idea being that
+         * if you're watching the PIC that closely, then you want to hardware interrupts to occur regardless.
+         */
+        if (!nMinCycles && !this.messageEnabled(Messages.PIC)) this.opFlags |= X86.OPFLAG.NOINTR;
+
+        do {
+            var opPrefixes = this.opFlags & X86.OPFLAG_PREFIXES;
+            if (opPrefixes) {
+                this.opPrefixes |= opPrefixes;
+            } else {
+                /*
+                 * opLIP is used, among other things, to help string instructions rewind to the first prefix
+                 * byte whenever the instruction needs to be repeated.  Repeating string instructions in this
+                 * manner (essentially restarting them) is a bit heavy-handed, but ultimately it's more compatible,
+                 * because it allows hardware interrupts (as well as Trap processing and Debugger single-stepping)
+                 * to occur at any point during the string operation, without any additional effort.
+                 *
+                 * NOTE: The way we restart string instructions actually fixes an 8086/8088 flaw, because string
+                 * instructions with multiple prefixes (eg, a REP and a segment override) would not be restarted
+                 * properly following a hardware interrupt.  The recommended workarounds were to either turn off
+                 * interrupts or to follow the string instruction with a LOOPNZ back to the first prefix byte.
+                 * To emulate the flawed behavior, turn on BUGS_8086.
+                 */
+                this.opLIP = this.regLIP;
+                this.segData = this.segDS;
+                this.segStack = this.segSS;
+                this.regEA = this.regEAWrite = X86.ADDR_INVALID;
+
+                if (I386 && (this.opPrefixes & (X86.OPFLAG.ADDRSIZE | X86.OPFLAG.DATASIZE))) {
+                    this.resetSizes();
+                }
+
+                this.opPrefixes = this.opFlags & X86.OPFLAG.REPEAT;
+
+                if (this.intFlags) {
+                    if (this.checkINTR()) {
+                        if (!nMinCycles) {
+
+                            if (DEBUGGER) {
+                                this.println("interrupt dispatched");
+                                this.opFlags = 0;
+                                break;
+                            }
+                        }
+                    }
+                    if (this.intFlags & X86.INTFLAG.HALT) {
+                        /*
+                         * As discussed in opHLT(), the CPU is never REALLY halted by a HLT instruction; instead,
+                         * opHLT() sets X86.INTFLAG.HALT, signalling to us that we're free to end the current burst
+                         * AND that we should not execute any more instructions until checkINTR() indicates a hardware
+                         * interrupt has been requested.
+                         *
+                         * One downside to this approach is that it *might* appear to the careful observer that we
+                         * executed a full complement of instructions during bursts where X86.INTFLAG.HALT was set,
+                         * when in fact we did not.  However, the steady advance of the overall cycle count, and thus
+                         * the steady series calls to stepCPU(), is needed to ensure that timer updates, video updates,
+                         * etc, all continue to occur at the expected rates.
+                         *
+                         * If necessary, we can add another bookkeeping cycle counter (eg, one that keeps tracks of the
+                         * number of cycles during which we did not actually execute any instructions).
+                         */
+                        this.nStepCycles = 0;
+                        this.opFlags = 0;
+                        break;
+                    }
+                }
+            }
+
+            if (DEBUGGER && fDebugCheck) {
+                if (this.dbg.checkInstruction(this.regLIP, nDebugState)) {
+                    this.stopCPU();
+                    break;
+                }
+                nDebugState = 1;
+            }
+
+            this.opFlags = 0;
+
+            /*
+            if (DEBUG || PREFETCH) {
+                this.nBusCycles = 0;
+                this.nSnapCycles = this.nStepCycles;
+            }
+             */
+
+            this.aOps[this.getIPByte()].call(this);
+
+            /*
+            if (PREFETCH) {
+                var nSpareCycles = (this.nSnapCycles - this.nStepCycles) - this.nBusCycles;
+                if (nSpareCycles >= 4) {
+                    this.fillPrefetch(nSpareCycles >> 2);   // for every 4 spare cycles, fetch 1 instruction byte
+                }
+            }
+             */
+
+            /*
+            if (DEBUG) {
+                //
+                // Make sure that every instruction is assessing a cycle cost, and that the cost is a net positive.
+                //
+                if (this.flags.complete && this.nStepCycles >= this.nSnapCycles && !(this.opFlags & X86.OPFLAG_PREFIXES)) {
+                    this.println("cycle miscount: " + (this.nSnapCycles - this.nStepCycles));
+                    this.setIP(this.opLIP - this.segCS.base);
+                    this.stopCPU();
+                    break;
+                }
+            }
+             */
+
+        } while (this.nStepCycles > 0);
+
+        return (this.flags.complete? this.nBurstCycles - this.nStepCycles : (this.flags.complete === undefined? 0 : -1));
+    }
+
+    /**
+     * setAddrSize(size)
+     *
+     * This is used by opcodes that require a particular ADDRESS size, which we enforce by
+     * internally simulating an ADDRESS size override, if needed.
+     *
+     * @this {X86CPU}
+     * @param {number} size (2 for 2-byte/16-bit operands, or 4 for 4-byte/32-bit operands)
+     *
+     setAddrSize(size)
+     {
+         if (this.sizeAddr != size) {
+             this.opPrefixes |= X86.OPFLAG.ADDRSIZE;
+             this.sizeAddr = size;
+             this.maskAddr = (size == 2? 0xffff : (0xffffffff|0));
+             this.updateAddrSize();
+         }
+     }
+     */
+
+    /**
+     * getIPLong()
+     *
+     * @this {X86CPU}
+     * @return {number} long at the current IP; IP advanced by 4
+     *
+     getIPLong()
+     {
+         var newLIP = this.checkIP(4);
+         var l = (PREFETCH? this.getLongPrefetch() : this.getLong(this.regLIP));
+         if (BACKTRACK) {
+             this.bus.updateBackTrackCode(this.regLIP, this.backTrack.btiMem0);
+             this.bus.updateBackTrackCode(this.regLIP + 1, this.backTrack.btiMem1);
+             this.bus.updateBackTrackCode(this.regLIP + 2, this.backTrack.btiMem2);
+             this.bus.updateBackTrackCode(this.regLIP + 3, this.backTrack.btiMem3);
+         }
+         this.regLIP = newLIP;
+         return l;
+     }
+     */
+
+    /**
+     * setDMA(fActive)
+     *
+     * This is called by the ChipSet component to update DMA status.
+     *
+     * @this {X86CPU}
+     * @param {boolean} fActive is true to set INTFLAG.DMA, false to clear
+     *
+     setDMA(fActive)
+     {
+        if (this.chipset) {
+            if (fActive) {
+                this.intFlags |= X86.INTFLAG.DMA;
+            } else {
+                this.intFlags &= ~X86.INTFLAG.DMA;
+            }
+        }
+    }
+     */
+
+    /**
+     * X86CPU.init()
+     *
+     * This function operates on every HTML element of class "cpu", extracting the
+     * JSON-encoded parameters for the X86CPU constructor from the element's "data-value"
+     * attribute, invoking the constructor (which in turn invokes the CPU constructor)
+     * to create a X86CPU component, and then binding any associated HTML controls to the
+     * new component.
+     */
+    static init()
+    {
+        var aeCPUs = Component.getElementsByClass(document, PCX86.APPCLASS, "cpu");
+        for (var iCPU = 0; iCPU < aeCPUs.length; iCPU++) {
+            var eCPU = aeCPUs[iCPU];
+            var parmsCPU = Component.getComponentParms(eCPU);
+            var cpu = new X86CPU(parmsCPU);
+            Component.bindComponentControls(cpu, eCPU, PCX86.APPCLASS);
+        }
+    }
+}
+
+if (PREFETCH) {
+    /*
+     * NOTE: X86CPU.PFINFO.LENGTH must be set to a power of two, so that LENGTH - 1 will form a mask
+     * (IP_MASK) we can use to create a sliding prefetch window of LENGTH bytes.  We also zero the low
+     * 2 bits of IP_MASK so that the sliding window always starts on a 32-bit (long) boundary.  Finally,
+     * instead breaking breaking all the longs we prefetch into bytes, we simply store the longs as-is
+     * into every 4th element of the queue (the queue is sparse array).
+     */
+    X86CPU.PFINFO = {
+        LENGTH:     16              // 16 generates a 16-byte prefetch queue consisting of 4 32-bit entries
+    };
+    X86CPU.PFINFO.IP_MASK = ((X86CPU.PFINFO.LENGTH - 1) & ~0x3);
+}
+
+X86CPU.PAGEBLOCKS_CACHE = 512;      // TODO: This seems adequate for 4Mb of RAM, but it should be dynamically reconfigured
+
+/*
+ * Initialize every CPU module on the page
+ */
+Web.onInit(X86CPU.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/x86fpu.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * Operand Type Reference
+ *
+ *      ST(0), ST           stack top; the register currently at the top of the stack
+ *      ST(i)               register in the stack i (0<=i<=7) stack elements from the top
+ *      SR (short-real)     short real (32 bits) number in memory; exponent bias is 127 (0x7f)
+ *      LR (long-real)      long real (64 bits) number in memory; exponent bias is 1023 (0x3ff)
+ *      TR (temp-real)      temporary real (80 bits) number in memory; exponent bias is 16383 (0x3fff)
+ *      PD (packed-decimal) packed decimal integer (18 digits, 10 bytes) in memory
+ *      WI (word-integer)   word binary integer (16 bits) in memory
+ *      SI (short-integer)  short binary integer (32 bits) in memory
+ *      LI (long-integer)   long binary integer (64 bits) in memory
+ *      NN (nn-bytes)       memory area nn bytes long
+ *
+ * FPU Coprocessor Trivia
+ *
+ *      Microsoft C 4.00 libraries executed software interrupts in the range 0x34-0x3B immediately after
+ *      FPU operations, to assist with floating-point emulation when no coprocessor was present, since
+ *      processors prior to the 80286 had no mechanism for generating a fault when an unsupported FPU
+ *      instruction was executed.
+ *
+ *      In short, INT 0x34 through INT 0x3B was used after ESC opcodes 0xD8 through 0xDF, INT 0x3C was
+ *      used for FPU instructions containing a segment override, and INT 0x3D was used for FWAIT.
+ *
+ *      A sample piece of code is available in x86ops.js, because it also highlights the Microsoft C 4.00
+ *      library's dependency on the 8086/8088 behavior of "PUSH SP" (see the opPUSHSP_8086() function).
+ */
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class X86FPU extends Component {
+    /**
+     * X86FPU(parmsFPU)
+     *
+     * The X86FPU class uses the following (parmsFPU) properties:
+     *
+     *      model: a number (eg, 8087) that should match one of the X86.FPU.MODEL values (default is 8087)
+     *      stepping: a string (eg, "B1") that should match one of the X86.FPU.STEPPING values (default is "")
+     *
+     * @this {X86FPU}
+     * @param {Object} parmsFPU
+     */
+    constructor(parmsFPU)
+    {
+        super("FPU", parmsFPU);
+
+        this.model = parmsFPU['model'] || X86.FPU.MODEL_8087;
+
+        /*
+         * We take the 'stepping' value, convert it to a hex value, and then add that to the model to provide
+         * a single value that's unique for any given CPU stepping.  If no stepping is provided, then stepping
+         * is equal to model.
+         */
+        var stepping = parmsFPU['stepping'];
+        this.stepping = this.model + (stepping? Str.parseInt(stepping, 16) : 0);
+
+        /*
+         * Perform a one-time allocation of all floating-point registers.
+         * NOTE: The FPU's internal registers are supposed to be 80-bit, but JavaScript gives us only 64-bit floats.
+         */
+        this.regStack = new Float64Array(8);
+        this.intStack = new Int32Array(this.regStack.buffer);
+
+        /*
+         * Used for "short-real" (SR) 32-bit floating-point operations.
+         */
+        this.regTmpSR = new Float32Array(1);
+        this.intTmpSR = new Int32Array(this.regTmpSR.buffer);
+
+        /*
+         * Used for "long-real" (LR) 64-bit floating-point operations.  We also use intTmpLR as temporary storage
+         * for all "word-integer" (WI or INT16), "short-integer" (SI or INT32) and "long-integer" (LI or INT64) values,
+         * since it's just large enough to accommodate all three integer sizes.
+         */
+        this.regTmpLR = new Float64Array(1);
+        this.intTmpLR = new Int32Array(this.regTmpLR.buffer);
+
+        /*
+         * Used for conversion to/from the 80-bit "temp-real" (TR) format; used as three 32-bit integers,
+         * where [0] contains TR bits 0-31, [1] contains TR bits 32-63, and [2] contains TR bits 64-79; the
+         * upper 16 bits of [2] are not used and should remain zero.
+         */
+        this.intTmpTR = new Array(3);
+
+        /*
+         * Initialize other (non-floating-point) coprocessor registers that resetFPU() doesn't touch,
+         * such as the "exception" registers: regCodeSel, regCodeOff, regDataSel, regDataOff, and regOpcode.
+         *
+         * Note that regCodeSel and regDataSel are NEVER set in real-mode and are ALWAYS set in protected-mode,
+         * so we set them to -1 in their "unset" state; if those values ever show up in an exception block,
+         * something may have gone amiss (it's not impossible though, because if an exception occurs before any
+         * memory operands have been used, regDataSel may still be "unset").
+         *
+         * NOTE: iStack is the low 3 bits of the bModRM byte, for instructions that have an explicit stack operand.
+         */
+        this.regCodeSel = this.regDataSel = -1;
+        this.regCodeOff = this.regDataOff = this.regOpcode = this.iStack = 0;
+
+        /*
+         * Initialize special floating-point constants, as if they were internal read-only registers;
+         * all other simple (non-special) constants are "statically" initialized below, as class constants.
+         */
+        this.regIndefinite = new Float64Array(1);
+        this.intIndefinite = new Int32Array(this.regIndefinite.buffer);
+        this.intIndefinite[0] = 0x00000000; this.intIndefinite[1] = 0xFFF8000;
+
+        /*
+         * Initialize all other coprocessor registers (control word, tag word, status word, etc) by resetting them.
+         */
+        this.resetFPU();
+        /**
+         * setEAFromSR()
+         *
+         * Stores the (32-bit) "short-real" value in the internal regTmpSR register to the address in regEA.
+         *
+         * @this {X86FPU}
+         */
+        this.setEAFromSR = X86FPU.prototype.setEAFromSI;
+        /**
+         * setEAFromLR()
+         *
+         * Stores the (64-bit) "long-real" value in the internal regTmpLR register to the address in regEA.
+         *
+         * @this {X86FPU}
+         */
+        this.setEAFromLR = X86FPU.prototype.setEAFromLI;
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {X86FPU}
+     * @param {Computer} cmp
+     * @param {Bus} bus
+     * @param {X86CPU} cpu
+     * @param {DebuggerX86} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cpu = cpu;
+        this.chipset = cmp.getMachineComponent("ChipSet");
+        this.setReady();
+    }
+
+    /**
+     * clearBusy()
+     *
+     * The ChipSet calls us whenever an I/O operation that clears the coprocessor's "busy" state is performed.
+     *
+     * @this {X86FPU}
+     */
+    clearBusy()
+    {
+        /*
+         * We're never "busy" as far as other components are concerned, because we perform all FPU operations
+         * synchronously, so there's nothing to do here.
+         */
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {X86FPU}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            if (!data || !this.restore) {
+                this.resetFPU();
+            } else {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {X86FPU}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the X86FPU component.
+     *
+     * @this {X86FPU}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        var a = [], i = 0;
+        a[i++] = this.regControl;
+        a[i++] = this.getStatus();
+        a[i++] = this.getTags();
+        /*
+         * Note that, unlike the FSAVE() and FRSTOR() operations, we save the registers in regStack in their physical
+         * order (0-7) rather than their logical order (ST0-ST7).  Moreover, FSAVE() and FRSTOR() use the "temp-real" (TR)
+         * format, whereas we use the current native format -- which, sadly, is only a 64-bit "long-real" (LR) format.
+         */
+        for (var iReg = 0; iReg < this.regStack.length; iReg++) {
+            a[i++] = this.regStack[iReg];
+        }
+        state.set(0, a);
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the X86FPU component.
+     *
+     * @this {X86FPU}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        var a = data[0], i = 0;
+        this.setControl(a[i++]);
+        this.setStatus(a[i++]);
+        this.setTags(a[i++]);
+        for (var iReg = 0; iReg < this.regStack.length; iReg++) {
+            this.regStack[iReg] = a[i++];
+        }
+        return true;
+    }
+
+    /**
+     * resetFPU()
+     *
+     * Aside from calling this internally (eg, during initialization and FINIT operations), the ChipSet may also call
+     * us whenever an I/O operation that resets the coprocessor is performed.  Only 80487 coprocessors and higher will
+     * also clear the "exception" registers, but the 80487 is currently beyond my planned level of support.
+     *
+     * TODO: Add support for X86.FPU.CONTROL.PC (Precision Control) and X86.FPU.CONTROL.IC (Infinity Control)
+     *
+     * @this {X86FPU}
+     */
+    resetFPU()
+    {
+        this.regUsed = 0;           // bits 0-7 are set as regs 0-7 are used
+        this.regControl = X86.FPU.CONTROL.INIT;
+        this.regStatus = 0;         // contains all status register bits EXCEPT for ST
+        this.iST = 0;               // the ST bits for regStatus are actually stored here
+        if (DEBUG) {
+            /*
+             * All the registers were tagged "unused" above, which is all that would normally happen, but debugging is
+             * a little easier if we zero all the registers as well.
+             */
+            for (var iReg = 0; iReg < this.regStack.length; iReg++) {
+                this.regStack[iReg] = 0.0;
+            }
+        }
+        if (this.chipset) this.chipset.clearFPUInterrupt();
+    }
+
+    /**
+     * isModel(model)
+     *
+     * If the current model is equal to the specified model, then it's assumed the current operation
+     * is supported, and we return true.
+     *
+     * @this {X86FPU}
+     * @param {number} model
+     * @return {boolean}
+     */
+    isModel(model)
+    {
+        return this.model == model;
+    }
+
+    /**
+     * isAtLeastModel(model)
+     *
+     * If the current model is greater than or equal to the specified model, then it's assumed that the
+     * current operation is supported, and we return true.
+     *
+     * @this {X86FPU}
+     * @param {number} model
+     * @return {boolean}
+     */
+    isAtLeastModel(model)
+    {
+        return this.model >= model;
+    }
+
+    /**
+     * opStop(fError)
+     *
+     * Place this inside any opcode handler to stop the CPU from running the current instruction; eg:
+     *
+     *      if (this.opStop()) return;
+     *
+     * You can still use the Debugger to single-step over the instruction; opStop() will return false in that case.
+     *
+     * @this {X86FPU}
+     * @param {boolean} [fError]
+     * @return {boolean} (true if there was an error or the CPU was running, false if not)
+     */
+    opStop(fError)
+    {
+        if (DEBUG) {
+            var cpu = this.cpu;
+            if (fError || cpu.isRunning()) {
+                cpu.setIP(cpu.opLIP - cpu.segCS.base);
+                cpu.stopCPU();
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * opNone()
+     *
+     * Used for any coprocessor opcode that has no known operation for the given model.
+     *
+     * @this {X86FPU}
+     */
+    opNone()
+    {
+        if (DEBUG) this.println(this.idComponent + ".opNone(" + Str.toHexByte(this.cpu.bOpcode) + "," + Str.toHexByte(this.cpu.bModRM) + ")");
+        this.opStop(true);
+    }
+
+    /**
+     * opObsolete()
+     *
+     * Used for any coprocessor opcodes that are redundant and potentially obsolete.
+     *
+     * @this {X86FPU}
+     */
+    opObsolete()
+    {
+        if (DEBUG) this.println(this.idComponent + ".opObsolete(" + Str.toHexByte(this.cpu.bOpcode) + "," + Str.toHexByte(this.cpu.bModRM) + ")");
+        this.opStop(true);
+    }
+
+    /**
+     * opUnimplemented()
+     *
+     * Used for any coprocessor opcode that DOES have a known operation, we just haven't implemented it yet.
+     *
+     * @this {X86FPU}
+     */
+    opUnimplemented()
+    {
+        if (DEBUG) this.println(this.idComponent + ".opUnimplemented(" + Str.toHexByte(this.cpu.bOpcode) + "," + Str.toHexByte(this.cpu.bModRM) + ")");
+        this.opStop(true);
+    }
+
+    /**
+     * checkException()
+     *
+     * @this {X86FPU}
+     * @return {boolean} (true if unmasked exception exists, false if not)
+     */
+    checkException()
+    {
+        this.regStatus &= ~X86.FPU.STATUS.ES;
+        /*
+         * NOTE: The "Stack Fault" (SF) status bit wasn't introduced until the 80387, so it triggers the pre-existing
+         * "Invalid Operation" (IE) exception; there is no corresponding "Stack Fault" (SE) exception, and the matching
+         * control bit is still reserved.  Consequently, X86.FPU.CONTROL.EXC is a *subset* of X86.FPU.STATUS.EXC (0x3F
+         * instead of 0x7F).
+         *
+         * However, we shouldn't have to do anything special when SF is set, because any setException() call that sets
+         * SF should ALSO set IE.
+         */
+        if (this.regStatus & (~this.regControl & X86.FPU.CONTROL.EXC)) {
+            this.regStatus |= X86.FPU.STATUS.ES;    // set ES whenever one or more unmasked EXC bits are set
+        }
+        if ((this.regStatus & X86.FPU.STATUS.ES) && !(this.regControl & X86.FPU.CONTROL.IEM)) {
+            this.chipset.setFPUInterrupt();
+            return true;
+        }
+        this.chipset.clearFPUInterrupt();
+        return false;
+    }
+
+    /**
+     * setException(n)
+     *
+     * Sets one or more of the FPU.STATUS.ECX bits; ie:
+     *
+     *      IE (0x0001 bit 0: Invalid Operation)
+     *      DE (0x0002 bit 1: Denormalized Operand)
+     *      ZE (0x0004 bit 2: Zero Divide)
+     *      OE (0x0008 bit 3: Overflow)
+     *      UE (0x0010 bit 4: Underflow)
+     *      PE (0x0020 bit 5: Precision)
+     *      SF (0x0040 bit 6: Stack Fault; 80387 and later)
+     *
+     * Also, as noted in checkException(), any time you set the SF bit, you should also set the IE bit, because
+     * Stack Fault is a subset of Invalid Operation.  TODO: We should include a test for that in the assertion below.
+     *
+     * @this {X86FPU}
+     * @param {number} n (one or more of the above error status bits)
+     * @return {boolean} (true if unmasked exception exists, false if not)
+     */
+    setException(n)
+    {
+        if (DEBUG) this.println(this.idComponent + ".setException(" + Str.toHexWord(n) + ")");
+
+        if (!this.isAtLeastModel(X86.FPU.MODEL_80387)) {
+            n &= ~X86.FPU.STATUS.SF;                // the SF bit didn't exist on pre-80387 coprocessors
+        }
+
+        this.regStatus |= n;
+        return this.checkException();
+    }
+
+    /**
+     * getControl()
+     *
+     * @this {X86FPU}
+     * @return {number}
+     */
+    getControl()
+    {
+        return this.regControl;
+    }
+
+    /**
+     * setControl(n)
+     *
+     * NOTE: Be sure to use this function for all "wholesale" regControl updates, because it ensures that
+     * unused bits cannot be set -- including bit 6, which could otherwise inadvertently mask the SF error
+     * condition on 80387 and newer coprocessors.
+     *
+     * @this {X86FPU}
+     * @param {number} n
+     */
+    setControl(n)
+    {
+        this.regControl = n & ~X86.FPU.CONTROL.UNUSED;
+    }
+
+    /**
+     * clearStatus(n)
+     *
+     * @this {X86FPU}
+     * @param {number} n
+     */
+    clearStatus(n)
+    {
+        this.regStatus &= ~n;
+        this.checkException();
+    }
+
+    /**
+     * getStatus()
+     *
+     * @this {X86FPU}
+     * @return {number} regStatus merged with iST
+     */
+    getStatus()
+    {
+        /*
+         * As long as we never store any ST bits in regStatus, they should always be zero, so in
+         * order to return the complete regStatus, all we need to do is shift and "or" the bits from iST.
+         */
+        return this.regStatus | (this.iST << X86.FPU.STATUS.ST_SHIFT);
+    }
+
+    /**
+     * setStatus(n)
+     *
+     * NOTE: Be sure to use this function for all "wholesale" regStatus updates, because it ensures that
+     * the ST bits get propagated to the internal iST register.  Setting individual EXC bits should be done
+     * through the fault() interface, and clearing individual EXC or BUSY bits should be done through
+     * clearStatus().  Both functions, including this function, call checkException() after updating regStatus.
+     *
+     * @this {X86FPU}
+     * @param {number} n
+     */
+    setStatus(n)
+    {
+        this.regStatus = n & ~X86.FPU.STATUS.ST;
+        this.iST = (n & X86.FPU.STATUS.ST) >> X86.FPU.STATUS.ST_SHIFT;
+        this.checkException();
+    }
+
+    /**
+     * checkOperand(v)
+     *
+     * @this {X86FPU}
+     * @param {number|null} v
+     * @return {boolean} (true if no exception, false otherwise)
+     */
+    checkOperand(v)
+    {
+        return isNaN(v)? !this.setException(X86.FPU.STATUS.IE) : true;
+    }
+
+    /**
+     * checkResult(v)
+     *
+     * @this {X86FPU}
+     * @param {number} v
+     * @return {boolean} (true if no exception, false otherwise)
+     */
+    checkResult(v)
+    {
+        return !isFinite(v)? !this.setException(v === Infinity? X86.FPU.STATUS.OE : X86.FPU.STATUS.UE) : true;
+    }
+
+    /**
+     * doAdd(operand1, operand2)
+     *
+     * @this {X86FPU}
+     * @param {number|null} operand1
+     * @param {number|null} operand2
+     * @return {number|null}
+     */
+    doAdd(operand1, operand2)
+    {
+        var result = null;
+        if (operand1 != null && operand2 != null) {
+            result = operand1 + operand2;
+            if (!this.checkResult(result)) result = null;
+        }
+        return result;
+    }
+
+    /**
+     * doSubtract(operand1, operand2)
+     *
+     * @this {X86FPU}
+     * @param {number|null} operand1
+     * @param {number|null} operand2
+     * @return {number|null}
+     */
+    doSubtract(operand1, operand2)
+    {
+        var result = null;
+        if (operand1 != null && operand2 != null) {
+            result = operand1 - operand2;
+            if (!this.checkResult(result)) result = null;
+        }
+        return result;
+    }
+
+    /**
+     * doMultiply(operand1, operand2)
+     *
+     * @this {X86FPU}
+     * @param {number|null} operand1
+     * @param {number|null} operand2
+     * @return {number|null}
+     */
+    doMultiply(operand1, operand2)
+    {
+        var result = null;
+        if (operand1 != null && operand2 != null) {
+            result = operand1 * operand2;
+            if (!this.checkResult(result)) result = null;
+        }
+        return result;
+    }
+
+    /**
+     * doDivide(dividend, divisor)
+     *
+     * TODO: IE exceptions: infinity / infinity, 0 / 0, 0 / pseudo-zero, or divisor is denormal or unnormal.
+     *
+     * @this {X86FPU}
+     * @param {number|null} dividend
+     * @param {number|null} divisor
+     * @return {number|null}
+     */
+    doDivide(dividend, divisor)
+    {
+        var quotient = null;
+        if (dividend != null && divisor != null) {
+            if (divisor || !this.setException(X86.FPU.STATUS.DE)) {
+                quotient = dividend / divisor;
+                if (!this.checkResult(quotient)) quotient = null;
+            }
+        }
+        return quotient;
+    }
+
+    /**
+     * doCompare(operand1, operand2)
+     *
+     * @this {X86FPU}
+     * @param {number|null} operand1
+     * @param {number|null} operand2
+     * @return {boolean}
+     */
+    doCompare(operand1, operand2)
+    {
+        if (operand1 != null && operand2 != null) {
+            var cc = 0;             // default value used when result > 0
+            if (!isNaN(operand1) && !isNaN(operand2)) {
+                var result = operand1 - operand2;
+                if (result < 0) {
+                    cc = X86.FPU.STATUS.C0;
+                } else if (result === 0) {
+                    cc = X86.FPU.STATUS.C3;
+                }
+            } else {
+                cc = X86.FPU.STATUS.C0 | X86.FPU.STATUS.C2 | X86.FPU.STATUS.C3;
+            }
+            this.regStatus = (this.regStatus & ~X86.FPU.STATUS.CC) | cc;
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * doSquareRoot(operand)
+     *
+     * @this {X86FPU}
+     * @param {number|null} operand
+     * @return {number|null}
+     */
+    doSquareRoot(operand)
+    {
+        var result = null;
+        /*
+         * Happily, -0 is ALSO >= 0.  Also happily, Math.sqrt(-0) returns -0.
+         */
+        if (operand >= 0 || !this.setException(X86.FPU.STATUS.IE)) {
+            result = Math.sqrt(operand);
+            if (!this.checkResult(result)) result = null;
+        }
+        return result;
+    }
+
+    /**
+     * roundValue(operand, max)
+     *
+     * NOTE: The max parameter is EXCLUSIVE, not inclusive (ie, the maximum positive value is < max).
+     *
+     * Also, callers that expect intTmpLR[] to be loaded with the result *must* also specify a max parameter;
+     * callers performing internal rounding and using just the return value may omit max to skip loading intTmpLR[].
+     *
+     * @this {X86FPU}
+     * @param {number|null} operand
+     * @param {number} [max] (ie, 0x8000, 0x80000000, or 0x8000000000000000)
+     * @return {number|null} (rounded result, or null if there was an unmasked exception)
+     */
+    roundValue(operand, max)
+    {
+        if (operand == null) return null;
+
+        var rc = (this.regControl & X86.FPU.CONTROL.RC.MASK), result;
+
+        if (rc == X86.FPU.CONTROL.RC.NEAR) {
+            result = Math.round(operand);
+            if (result - operand === 0.5 && (result % 2)) result--;
+        }
+        else if (rc == X86.FPU.CONTROL.RC.DOWN || rc == X86.FPU.CONTROL.RC.CHOP && operand > 0) {
+            result = Math.floor(operand);
+        }
+        else {  // X86.FPU.CONTROL.RC.UP or X86.FPU.CONTROL.RC.CHOP && operand <= 0
+            result = Math.ceil(operand);
+        }
+
+        if (max) {
+            if (result >= max) {
+                if (this.setException(X86.FPU.STATUS.IE)) return null;
+                result = -max;      // apparently, the masked response is to return the most negative integer (not max - 1)
+            }
+            else if (result < -max) {
+                if (this.setException(X86.FPU.STATUS.IE)) return null;
+                result = -max;
+            }
+            this.intTmpLR[0] = result|0;
+            if (max > X86FPU.MAX_INT32) {
+                this.intTmpLR[1] = (result / 0x100000000)|0;
+                if (!this.intTmpLR[1] && result < 0) this.intTmpLR[1] = -1;
+            }
+        }
+        return result;
+    }
+
+    /**
+     * truncateValue(v)
+     *
+     * @this {X86FPU}
+     * @param {number} v
+     * @return {number}
+     */
+    truncateValue(v)
+    {
+        return v > 0? Math.floor(v) : Math.ceil(v);
+    }
+
+    /**
+     * getTag(iReg)
+     *
+     * @this {X86FPU}
+     * @param {number} iReg (register index)
+     * @return {number} tag value for register
+     */
+    getTag(iReg)
+    {
+        var bitUsed = (1 << iReg);
+        var tag = X86.FPU.TAGS.EMPTY;
+        if (this.regUsed & bitUsed) {
+            var f = this.regStack[iReg];
+            tag = X86.FPU.TAGS.VALID;
+            if (f === 0.0) {
+                tag = X86.FPU.TAGS.ZERO;
+            }
+            else if (!isFinite(f)) {
+                tag = X86.FPU.TAGS.SPECIAL;
+            }
+        }
+        return tag;
+    }
+
+    /**
+     * getTags()
+     *
+     * @this {X86FPU}
+     * @return {number} tag values for all registers
+     */
+    getTags()
+    {
+        var tags = 0;
+        for (var iReg = this.regStack.length - 1; iReg >= 0; iReg--) {
+            tags <<= 2;
+            tags |= this.getTag(iReg);
+        }
+        return tags;
+    }
+
+    /**
+     * setTag(iReg, tag)
+     *
+     * @this {X86FPU}
+     * @param {number} iReg (register index)
+     * @param {number} tag value for register (EMPTY is the only supported value)
+     */
+    setTag(iReg, tag)
+    {
+
+        this.regUsed &= ~(1 << iReg);
+    }
+
+    /**
+     * setTags(n)
+     *
+     * All we need to update here are which physical registers are marked "empty"; the rest of the tags
+     * are generated on the fly based on actual values in the registers.
+     *
+     * @this {X86FPU}
+     * @param {number} n (16-bit tag word, containing 8 2-bit tags)
+     */
+    setTags(n)
+    {
+        this.regUsed = 0;
+        for (var bitUsed = 0x1; bitUsed <= 0x80; bitUsed <<= 1) {
+            var tag = n & X86.FPU.TAGS.MASK;
+            if (tag != X86.FPU.TAGS.EMPTY) {
+                this.regUsed |= bitUsed;
+            }
+            n >>= 2;
+        }
+    }
+
+    /**
+     * getWI(i)
+     *
+     * Gets a "word-integer" (WI aka INT16) from ST(i)
+     *
+     * @this {X86FPU}
+     * @param {number} i (eg, 0 for top-of-stack)
+     * @return {boolean} true if intTmpLR was loaded, false if not
+     */
+    getWI(i)
+    {
+        return this.roundValue(this.getST(i), X86FPU.MAX_INT16) != null;
+    }
+
+    /**
+     * getSI(i)
+     *
+     * Gets a "short-integer" (SI aka INT32) from ST(i)
+     *
+     * @this {X86FPU}
+     * @param {number} i (eg, 0 for top-of-stack)
+     * @return {boolean} true if intTmpLR was loaded, false if not
+     */
+    getSI(i)
+    {
+        return this.roundValue(this.getST(i), X86FPU.MAX_INT32) != null;
+    }
+
+    /**
+     * getLI(i)
+     *
+     * Gets a "long-integer" (LI aka INT64) from ST(i)
+     *
+     * @this {X86FPU}
+     * @param {number} i (eg, 0 for top-of-stack)
+     * @return {boolean} true if intTmpLR was loaded, false if not
+     */
+    getLI(i)
+    {
+        return this.roundValue(this.getST(i), X86FPU.MAX_INT64) != null;
+    }
+
+    /**
+     * getSR(i)
+     *
+     * @this {X86FPU}
+     * @param {number} i (eg, 0 for top-of-stack)
+     * @return {boolean} true if regTmpSR was loaded, false if not
+     */
+    getSR(i)
+    {
+        var iReg = (this.iST + i) & 7;
+        if (this.regUsed & (1 << iReg)) {
+            this.regTmpSR[0] = this.regStack[iReg];
+            return true;
+        } else if (!this.setException(X86.FPU.STATUS.IE)) {
+            this.regTmpSR[0] = this.regIndefinite[0];
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * getLR(i)
+     *
+     * @this {X86FPU}
+     * @param {number} i (eg, 0 for top-of-stack)
+     * @return {boolean} true if regTmpLR was loaded, false if not
+     */
+    getLR(i)
+    {
+        var iReg = (this.iST + i) & 7;
+        if (this.regUsed & (1 << iReg)) {
+            this.regTmpLR[0] = this.regStack[iReg];
+            return true;
+        } else if (!this.setException(X86.FPU.STATUS.IE)) {
+            this.regTmpLR[0] = this.regIndefinite[0];
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * getST(i)
+     *
+     * @this {X86FPU}
+     * @param {number} i (eg, 0 for top-of-stack)
+     * @return {number|null} v
+     */
+    getST(i)
+    {
+        var v = null;
+        var iReg = (this.iST + i) & 7;
+        if (this.regUsed & (1 << iReg)) {
+            v = this.regStack[iReg];
+        } else if (!this.setException(X86.FPU.STATUS.IE)) {
+            v = this.regIndefinite[0];
+        }
+        return v;
+    }
+
+    /**
+     * getSTSign(i)
+     *
+     * Returns zero if sign bit clear, and non-zero (negative) if sign bit set.  This is safer
+     * than comparing getST() to zero, because JavaScript comparisons involving NaNs are meaningless.
+     *
+     * For internal use only; ignores whether the register is empty, and performs no exception checks.
+     *
+     * @this {X86FPU}
+     * @param {number} i (eg, 0 for top-of-stack)
+     * @return {number}
+     */
+    getSTSign(i)
+    {
+        var iInt = ((this.iST + i) & 7) << 1;
+        return this.intStack[iInt + 1] & (0x80000000|0);
+    }
+
+    /**
+     * setST(i, v)
+     *
+     * @this {X86FPU}
+     * @param {number} i (eg, 0 for top-of-stack)
+     * @param {number|null} v
+     * @return {boolean}
+     */
+    setST(i, v)
+    {
+        if (v != null && this.checkOperand(v)) {
+            var iReg = (this.iST + i) & 7;
+            this.regStack[iReg] = v;
+            this.regUsed |= (1 << iReg);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * getTR(i, fSafe)
+     *
+     * @this {X86FPU}
+     * @param {number} i (stack index, 0-7)
+     * @param {boolean} [fSafe] (true to ignore all exception criteria; used by FSAVE)
+     * @return {Array.<number>|null} ("temp-real" aka TR, as an array of three 32-bit integers)
+     */
+    getTR(i, fSafe)
+    {
+        var a = null;
+        var iReg = (this.iST + i) & 7;
+        if (fSafe || this.regUsed & (1 << iReg) || !this.setException(X86.FPU.STATUS.IE)) {
+            var iInt = iReg << 1;
+            a = this.getTRFromLR(this.intStack[iInt], this.intStack[iInt + 1]);
+        }
+        return a;
+    }
+
+    /**
+     * setTR(i, a)
+     *
+     * Sets ST(i) to the TR ("long-real") in a[].
+     *
+     * @this {X86FPU}
+     * @param {number} i (stack index, 0-7)
+     * @param {Array.<number>|null} a
+     */
+    setTR(i, a)
+    {
+        if (a) this.setST(i, this.getLRFromTR(a));
+    }
+
+    /**
+     * getWIFromEA()
+     *
+     * Returns the (16-bit) "word-integer" value located at regEA.
+     *
+     * @this {X86FPU}
+     * @return {number} v
+     */
+    getWIFromEA()
+    {
+
+        return (this.cpu.getShort(this.cpu.regEA) << 16) >> 16;
+    }
+
+    /**
+     * getSIFromEA()
+     *
+     * Returns the (32-bit) "short-integer" value located at regEA.
+     *
+     * @this {X86FPU}
+     * @return {number} v
+     */
+    getSIFromEA()
+    {
+
+        return this.cpu.getLong(this.cpu.regEA);
+    }
+
+    /**
+     * getLIFromEA()
+     *
+     * Returns the (64-bit) "long-integer" value located at regEA.
+     *
+     * @this {X86FPU}
+     * @return {number} v
+     */
+    getLIFromEA()
+    {
+
+        var lo = this.cpu.getLong(this.cpu.regEA);
+        var hi = this.cpu.getLong(this.cpu.regEA + 4);
+        return (hi * 0x100000000) + (lo >>> 0);
+    }
+
+    /**
+     * getSRFromEA()
+     *
+     * Sets the internal regTmpSR register to the (32-bit) "short-real" value located at regEA.
+     *
+     * @this {X86FPU}
+     * @return {number} v
+     */
+    getSRFromEA()
+    {
+
+        this.intTmpSR[0] = this.cpu.getLong(this.cpu.regEA);
+        return this.regTmpSR[0];
+    }
+
+    /**
+     * getLRFromEA()
+     *
+     * Sets the internal regTmpLR register to the (64-bit) "long-real" value located at regEA.
+     *
+     * @this {X86FPU}
+     * @return {number} v
+     */
+    getLRFromEA()
+    {
+
+        this.intTmpLR[0] = this.cpu.getLong(this.cpu.regEA);
+        this.intTmpLR[1] = this.cpu.getLong(this.cpu.regEA + 4);
+        return this.regTmpLR[0];
+    }
+
+    /**
+     * getTRFromEA()
+     *
+     * Sets the internal intTmpTR register to the (80-bit) "temp-real" value located at regEA.
+     *
+     * @this {X86FPU}
+     * @return {Array.<number>} intTmpTR
+     */
+    getTRFromEA()
+    {
+
+        this.intTmpTR[0] = this.cpu.getLong(this.cpu.regEA);
+        this.intTmpTR[1] = this.cpu.getLong(this.cpu.regEA + 4);
+        this.intTmpTR[2] = this.cpu.getShort(this.cpu.regEA + 8);
+        return this.intTmpTR;
+    }
+
+    /**
+     * setEAFromWI()
+     *
+     * Stores the (16-bit) "word-integer" value in the internal intTmpLR register to the address in regEA.
+     *
+     * @this {X86FPU}
+     */
+    setEAFromWI()
+    {
+
+        this.cpu.setShort(this.cpu.regEA, this.intTmpLR[0]);
+    }
+
+    /**
+     * setEAFromSI()
+     *
+     * Stores the (32-bit) "short-integer" value in the internal intTmpLR register to the address in regEA.
+     *
+     * @this {X86FPU}
+     */
+    setEAFromSI()
+    {
+
+        this.cpu.setLong(this.cpu.regEA, this.intTmpLR[0]);
+    }
+
+    /**
+     * setEAFromLI()
+     *
+     * Stores the (64-bit) "long-integer" value in the internal intTmpLR register to the address in regEA.
+     *
+     * @this {X86FPU}
+     */
+    setEAFromLI()
+    {
+
+        this.cpu.setLong(this.cpu.regEA, this.intTmpLR[0]);
+        this.cpu.setLong(this.cpu.regEA + 4, this.intTmpLR[1]);
+    }
+
+    /**
+     * setEAFromTR()
+     *
+     * Stores the (80-bit) "temp-real" value in the internal intTmpTR register to the address in regEA.
+     *
+     * @this {X86FPU}
+     */
+    setEAFromTR()
+    {
+
+        this.cpu.setLong(this.cpu.regEA, this.intTmpTR[0]);
+        this.cpu.setLong(this.cpu.regEA + 4, this.intTmpTR[1]);
+        this.cpu.setShort(this.cpu.regEA + 8, this.intTmpTR[2]);
+    }
+
+    /**
+     * getLRFromTR(a)
+     *
+     * Since we must use the "long-real" (64-bit) format internally, rather than the "temp-real" (80-bit) format,
+     * this function converts a 64-bit value to an 80-bit value.  The major differences: 1) the former uses a 52-bit
+     * fraction and 11-bit exponent, while the latter uses a 64-bit fraction and 15-bit exponent; 2) the former
+     * does NOT store a leading 1 with the fraction, whereas the latter does.
+     *
+     * @this {X86FPU}
+     * @param {Array.<number>} a (eg, intTmpTR)
+     * @return {number} v
+     */
+    getLRFromTR(a)
+    {
+        var loTR = a[0], hiTR = a[1];
+        var signLR = (a[2] & 0x8000) >> 4, expLR = a[2] & 0x7fff;
+        /*
+         * We have no choice but to chop off the bottom 11 TR bits in order to fit in an LR....
+         */
+        var loLR = (loTR >>> 11) | (hiTR << 21), hiLR = (hiTR >> 11) & 0xfffff;
+
+        if (expLR == 0x7fff) {
+            /*
+             * Convert an TR NaN to a LR NaN.
+             */
+            expLR = 0x7ff;
+        }
+        else if (expLR) {
+            /*
+             * We have a normal (biased) TR exponent which we must now convert to a (biased) LR exponent;
+             * subtract the TR bias (0x3fff) and add the LR bias (0x3ff); additionally, we have a problem
+             * that getTRFromLR() did not: if the TR exponent is too large to fit in an LR exponent, then we
+             * have convert the result to +/- infinity.
+             */
+            expLR += 0x3ff - 0x3fff;
+            if (expLR <= 0) {
+                expLR = 0x7ff;
+                loLR = hiLR = 0;
+            }
+        }
+
+        this.intTmpLR[0] = loLR;
+        this.intTmpLR[1] = hiLR | ((signLR | expLR) << 20);
+        return this.regTmpLR[0];
+    }
+
+    /**
+     * getTRFromLR(loLR, hiLR)
+     *
+     * Since we must use the "long-real" (64-bit) format internally, rather than the "temp-real" (80-bit) format,
+     * this function converts a 64-bit value to an 80-bit value.  The major differences: 1) the former uses a 52-bit
+     * fraction and 11-bit exponent, while the latter uses a 64-bit fraction and 15-bit exponent; 2) the former
+     * does NOT store a leading 1 with the fraction, whereas the latter does.
+     *
+     * @this {X86FPU}
+     * @param {number} loLR
+     * @param {number} hiLR
+     * @return {Array.<number>} (intTmpTR)
+     */
+    getTRFromLR(loLR, hiLR)
+    {
+        var expTR = (hiLR >> 20) & 0x07ff;
+        var signTR = (hiLR >> 16) & 0x8000;
+        var loTR = loLR << 11, hiTR = 0x80000000 | ((hiLR & 0x000fffff) << 11) | (loLR >>> 21);
+
+        if (expTR == 0x07ff) {
+            /*
+             * Convert an LR NaN to a TR NaN.  NaNs encompass +/- infinity, which in the LR
+             * world are fractions of all zeros.  NaNs also encompass indefinite, which in the LR
+             * world are negative numbers with only the high fraction bit set.  So, in both cases,
+             * our default TR value (ie, with zeros shifted into the bottom 11 bits) should be fine;
+             * we simply need to change the exponent to the maximum TR value.
+             */
+            expTR = 0x7fff;
+        }
+        else if (!expTR) {
+            /*
+             * An LR with an exponent of zero could be an actual +/- zero, if the fraction is zero,
+             * or it could be a denormal, if the fraction is non-zero.  In both cases, the only
+             * change we need to make the TR form is clearing the leading 1 bit.
+             */
+            hiTR &= 0x7fffffff;
+        }
+        else {
+            /*
+             * We have a normal (biased) LR exponent which we must now convert to a (biased) TR exponent;
+             * subtract the LR bias (0x3ff) and add the TR bias (0x3fff).
+             */
+            expTR += 0x3fff - 0x3ff;
+        }
+
+        this.intTmpTR[0] = loTR;
+        this.intTmpTR[1] = hiTR;
+        this.intTmpTR[2] = signTR | expTR;
+        return this.intTmpTR;
+    }
+
+    /**
+     * decodeBCD()
+     *
+     * @this {X86FPU}
+     * @param {number} i (32-bit integer containing n BCD digits)
+     * @param {number} n (number of BCD digits to decode)
+     * @return {number} (binary value representing the specified number of BCD digits)
+     */
+    decodeBCD(i, n)
+    {
+        var v = 0, m = 1;
+
+        while (n--) {
+            var d = i & 0xf;
+
+            v += d * m;
+            m *= 10;
+            i >>= 4;
+        }
+        return v;
+    }
+
+    /**
+     * encodeBCD()
+     *
+     * @this {X86FPU}
+     * @param {number} v (binary value from which to extract n BCD digits)
+     * @param {number} n (number of BCD digits to extract)
+     * @return {number} (integer containing the requested number of BCD digits)
+     */
+    encodeBCD(v, n)
+    {
+        var i = 0, s = 0;
+
+        while (n--) {
+            i |= (v % 10) << s;
+            v /= 10;
+            s += 4;
+        }
+        return i;
+    }
+
+    /**
+     * popValue()
+     *
+     * @this {X86FPU}
+     * @return {number|null} v
+     */
+    popValue()
+    {
+        var v = null;
+        var bitUsed = (1 << this.iST);
+        if (!(this.regUsed & bitUsed)) {
+            this.regStatus &= ~X86.FPU.STATUS.C1;       // clear C1 to indicate stack underflow (80287XL and up)
+            if (this.setException(X86.FPU.STATUS.SF | X86.FPU.STATUS.IE)) return v;
+        }
+        this.regUsed &= ~bitUsed;
+        v = this.regStack[this.iST];
+        this.iST = (this.iST + 1) & 7;
+        return v;
+    }
+
+    /**
+     * pushValue(v)
+     *
+     * @this {X86FPU}
+     * @param {number|null} v
+     */
+    pushValue(v)
+    {
+        if (v == null) return;
+        var iReg = (this.iST - 1) & 7;
+        var bitUsed = (1 << iReg);
+        if (this.regUsed & bitUsed) {
+            this.regStatus |= X86.FPU.STATUS.C1;        // set C1 to indicate stack overflow (80287XL and up)
+            if (this.setException(X86.FPU.STATUS.SF | X86.FPU.STATUS.IE)) return;
+        }
+        if (!this.checkOperand(v)) {
+            if (this.setException(X86.FPU.STATUS.IE)) return;
+            v = NaN;
+        }
+        this.regStack[this.iST = iReg] = v;
+        this.regUsed |= bitUsed;
+    }
+
+    /**
+     * loadEnv(addr)
+     *
+     * @this {X86FPU}
+     * @param {number} addr
+     * @return {number} updated addr
+     */
+    loadEnv(addr)
+    {
+        var w;
+        var cpu = this.cpu;
+
+        this.setControl(cpu.getWord(addr));
+        this.setStatus(cpu.getWord(addr += cpu.sizeData));
+        this.setTags(cpu.getWord(addr += cpu.sizeData));
+
+        if (!(cpu.regCR0 & X86.CR0.MSW.PE) || (cpu.regPS & X86.PS.VM)) {
+            this.regCodeOff = cpu.getWord(addr += cpu.sizeData);
+            w = cpu.getWord(addr += cpu.sizeData);
+            this.regOpcode = w & 0x7ff;
+            this.regCodeOff |= (w & ~0xfff) << 4;
+            this.regCodeSel = -1;
+            this.regDataOff = cpu.getWord(addr += cpu.sizeData);
+            this.regDataOff |= (cpu.getWord(addr += cpu.sizeData) & ~0xfff) << 4;
+            this.regDataSel = -1;
+        } else {
+            this.regCodeOff = cpu.getWord(addr += cpu.sizeData);
+            w = cpu.getWord(addr += cpu.sizeData);
+            this.regCodeSel = w & 0xffff;
+            this.regOpcode = (w >> 16) & 0x7ff;
+            this.regDataOff = cpu.getWord(addr += cpu.sizeData);
+            this.regDataSel = cpu.getWord(addr += cpu.sizeData) & 0xffff;
+        }
+        return addr + cpu.sizeData;
+    }
+
+    /**
+     * saveEnv(addr)
+     *
+     * @this {X86FPU}
+     * @param {number} addr
+     * @return {number} updated addr
+     */
+    saveEnv(addr)
+    {
+        var cpu = this.cpu;
+
+        cpu.setWord(addr, this.regControl);
+        cpu.setWord(addr += cpu.sizeData, this.getStatus());
+        cpu.setWord(addr += cpu.sizeData, this.getTags());
+
+        if (!(cpu.regCR0 & X86.CR0.MSW.PE) || (cpu.regPS & X86.PS.VM)) {
+            var off = (this.regCodeSel << 4) + this.regCodeOff;
+            cpu.setWord(addr += cpu.sizeData, off);
+            cpu.setWord(addr += cpu.sizeData, ((off >> 4) & ~0xfff) | this.regOpcode);
+            off = (this.regDataSel << 4) + this.regDataOff;
+            cpu.setWord(addr += cpu.sizeData, off);
+            cpu.setWord(addr += cpu.sizeData, ((off >> 4) & ~0xfff));
+        } else {
+            cpu.setWord(addr += cpu.sizeData, this.regCodeOff);
+            cpu.setWord(addr += cpu.sizeData, this.regCodeSel | (this.regOpcode << 16));
+            cpu.setWord(addr += cpu.sizeData, this.regDataOff);
+            cpu.setWord(addr += cpu.sizeData, this.regDataSel);
+        }
+        return addr + cpu.sizeData;
+    }
+
+    /**
+     * opFPU(bOpcode, bModRM, dst, src)
+     *
+     * This is called by the CPU's ESC opcode handlers, after each instruction has been fully decoded.
+     *
+     * @this {X86FPU}
+     * @param {number} bOpcode (0xD8-0xDF)
+     * @param {number} bModRM
+     * @param {number} dst
+     * @param {number} src
+     */
+    opFPU(bOpcode, bModRM, dst, src)
+    {
+        var mod = (bModRM >> 6) & 3;
+        var reg = (bModRM >> 3) & 7;
+        this.iStack = (bModRM & 7);
+
+        /*
+         * Combine mod and reg into one decodable value: put mod in the high nibble
+         * and reg in the low nibble, after first collapsing all mod values < 3 to zero.
+         */
+        var modReg = (mod < 3? 0 : 0x30) + reg;
+
+        /*
+         * All values >= 0x34 imply mod == 3 and reg >= 4, so now we shift reg into the high
+         * nibble and iStack into the low, yielding values >= 0x40.
+         */
+        if ((bOpcode == X86.OPCODE.ESC1 || bOpcode == X86.OPCODE.ESC3) && modReg >= 0x34) {
+            modReg = (reg << 4) | this.iStack;
+        }
+
+        var fnOp = X86FPU.aaOps[bOpcode][modReg];
+        if (fnOp) {
+            /*
+             * A handful of FPU instructions must preserve (at least some of) the "exception" registers,
+             * so if the current function is NOT one of those, then update all the "exception" registers.
+             */
+            if (X86FPU.afnPreserveExceptions.indexOf(fnOp) < 0) {
+                var cpu = this.cpu;
+                var off = cpu.opLIP;
+                /*
+                 * WARNING: opLIP points to any prefixes preceding the ESC instruction, but the 8087 always
+                 * points to the ESC instruction.  Technically, that's a bug, but it's also a reality, so we
+                 * check for preceding prefixes and bump the instruction pointer accordingly.  This isn't a
+                 * perfect solution, because it doesn't account for multiple (redundant) prefixes, but it
+                 * should be adequate.
+                 */
+                if (this.isModel(X86.FPU.MODEL_8087)) {
+                    if (cpu.opPrefixes & X86.OPFLAG.SEG) off++;
+                    if (cpu.opPrefixes & X86.OPFLAG.LOCK) off++;
+                }
+                this.regCodeSel = cpu.segCS.sel;
+                this.regCodeOff = off - cpu.segCS.base;
+                if (cpu.regEA !== X86.ADDR_INVALID) {
+                    this.regDataSel = cpu.segEA.sel;
+                    this.regDataOff = cpu.regEA - cpu.segEA.base;
+                }
+                this.regOpcode = ((bOpcode & 7) << 8) | bModRM;
+            }
+            /*
+             * Finally, perform the FPU operation.
+             */
+            fnOp.call(this);
+        }
+        else {
+            /*
+             * This is a gray area, at least until aaOps has been filled in for all supported coprocessors;
+             * but for now, we'll treat all unrecognized operations as "no operation", as opposed to unimplemented.
+             */
+            this.opNone();
+        }
+    }
+
+    /**
+     * opWAIT()
+     *
+     * This is called by the CPU's WAIT opcode handler, giving us the opportunity to synchronize the FPU with the CPU,
+     * charge an appropriate number of cycles, and return true.  In this context, it's considered an FWAIT instruction,
+     * but technically, it's the same opcode.
+     *
+     * If we choose to do nothing, then we must return false, so that the CPU can charge a default number of cycles.
+     *
+     * @this {X86FPU}
+     * @return {boolean} true if implemented, false if not
+     */
+    opWAIT()
+    {
+        return false;
+    }
+
+    /**
+     * readFPUStack(i)
+     *
+     * Returns the following information for the requested FPU stack element, relative to ST:
+     *
+     *      a[0]: physical stack position (0-7)
+     *      a[1]: corresponding tag value
+     *      a[2]: 64-bit "long-real" (LR) value
+     *      a[3]: bits 0-31 of 64-bit "long-real" (LR)
+     *      a[4]: bits 32-63 of 64-bit "long-real" (LR)
+     *      a[5]: bits 0-31 of 80-bit "temp-real" (TR)
+     *      a[6]: bits 32-63 of 80-bit "temp-real" (TR)
+     *      a[7]: bits 64-79 of 80-bit "temp-real" (TR) (in bits 0-15)
+     *
+     * Used by the Debugger for its floating-point register ("rfp") command.  For other FPU registers,
+     * the Debugger calls getStatus() and getControl() directly.
+     *
+     * NOTE: The "temp-real" values are fake; we manufacture them on demand from 64-bit "long-real" values
+     * actually stored in the stack; see getTRFromLR().
+     *
+     * @this {X86FPU}
+     * @param {number} i (stack index, relative to ST)
+     * @return {Array.<number>|null} (an array of information as described above, or null if invalid element)
+     */
+    readFPUStack(i)
+    {
+        var a = null;
+        if (i < this.regStack.length) {
+            a = [];
+            var iReg = (this.iST + i) & 7;
+            a[0] = iReg;
+            a[1] = this.getTag(iReg);
+            a[2] = this.regStack[iReg];
+            var iInt = iReg << 1;
+            a[3] = this.intStack[iInt];
+            a[4] = this.intStack[iInt + 1];
+            var aTR = this.getTRFromLR(a[3], a[4]);
+            a[5] = aTR[0]; a[6] = aTR[1]; a[7] = aTR[2];
+        }
+        return a;
+    }
+
+    /**
+     * getRandomInt(min, max)
+     *
+     * Used with old test code to verify that any randomly-constructed "long-real" (REAL64) could be converted
+     * to a "temp-real" (REAL80) and back again losslessly, otherwise a bug in either getTRFromLR() or getLRFromTR()
+     * might exist.  That test code can be resurrected from the repo; this code is being retained for future tests.
+     *
+     * NOTE: If either min or max is a value containing 32 or more significant bits AND bit 31 is set AND it has passed
+     * through some bitwise operation(s), then that value may end up being negative, so you may end up with an inverted
+     * range, or a range that's smaller or larger than intended.
+     *
+     * @this {X86FPU}
+     * @param {number} min (inclusive)
+     * @param {number} max (inclusive)
+     * @return {number}
+     *
+     getRandomInt(min, max)
+     {
+         max -= min;
+         if (max < 0) {      // compensate for inverted ranges (ie, where min > max)
+             min += max;
+             max = -max;
+         }
+         return Math.floor(Math.random() * (max + 1)) + min;
+     }
+     */
+
+    /**
+     * F2XM1()
+     *
+     * F2XM1 (2 to the x minus 1) calculates the function 2^x - 1 and returns the result to ST(0).
+     *
+     * On the 8087 and 80287, the value in ST(0) must satisfy the inequality 0 <= ST(0) <= 0.5.  On the 80287XL and
+     * later coprocessors, the permissible range is greater, and ST(0) must satisfy the inequality -1 <= ST(0) <= 1.
+     * If ST(0) is out of range, the result is undefined, even though no exception is raised.
+     *
+     * The F2XM1 instruction is designed to provide an accurate result even when x is close to zero. To obtain 2^x,
+     * simply add 1.0 to the result returned by F2XM1.
+     *
+     * This instruction is useful in performing exponentiation of values other than 2 as shown in the following formulas:
+     *
+     *      10^x = 2^(x * log2(10))
+     *      e^x = 2^(x * log2(e))
+     *      y^x = 2^(x * log2(y))
+     *
+     * Note that the NPX has dedicated instructions for loading the constants log2(10) and log2(e).  The FYL2X instruction
+     * may be used to calculate x * log2(y).
+     *
+     * See also: FYL2X, FLDL2T, FLDL2E.
+     *
+     * @this {X86FPU}
+     */
+    static F2XM1()
+    {
+        this.setST(0, Math.pow(2, this.getST(0)) - 1);
+    }
+
+    /**
+     * FABS()
+     *
+     * @this {X86FPU}
+     */
+    static FABS()
+    {
+        /*
+         * TODO: This could be implemented more efficiently by simply clearing the sign bit of ST(0).
+         */
+        this.setST(0, Math.abs(this.getST(0)));
+    }
+
+    /**
+     * FADDlr()
+     *
+     * @this {X86FPU}
+     */
+    static FADDlr()
+    {
+        this.setST(0, this.doAdd(this.getST(0), this.getLRFromEA()));
+    }
+
+    /**
+     * FADDsr()
+     *
+     * Encoding 0xD8,reg=0x00 ("FADD short-real"): ST(0) <- ST(0) + REAL32
+     *
+     * @this {X86FPU}
+     */
+    static FADDsr()
+    {
+        this.setST(0, this.doAdd(this.getST(0), this.getSRFromEA()));
+    }
+
+    /**
+     * FADDst()
+     *
+     * @this {X86FPU}
+     */
+    static FADDst()
+    {
+        this.setST(0, this.doAdd(this.getST(0), this.getST(this.iStack)));
+    }
+
+    /**
+     * FADDsti()
+     *
+     * @this {X86FPU}
+     */
+    static FADDsti()
+    {
+        this.setST(this.iStack, this.doAdd(this.getST(this.iStack), this.getST(0)));
+    }
+
+    /**
+     * FADDPsti()
+     *
+     * @this {X86FPU}
+     */
+    static FADDPsti()
+    {
+        if (this.setST(this.iStack, this.doAdd(this.getST(this.iStack), this.getST(0)))) this.popValue();
+    }
+
+    /**
+     * FBLDpd()
+     *
+     * @this {X86FPU}
+     */
+    static FBLDpd()
+    {
+        var a = this.getTRFromEA();
+        /*
+         * a[0] contains the 8 least-significant BCD digits, a[1] contains the next 8, and a[2] contains
+         * the next 2 (bit 15 of a[2] is the sign bit, and bits 8-14 of a[2] are unused).
+         */
+        var v = this.decodeBCD(a[0], 8) + this.decodeBCD(a[1], 8) * 100000000 + this.decodeBCD(a[2], 2) * 10000000000000000;
+        if (a[2] & 0x8000) v = -v;
+        this.pushValue(v);
+    }
+
+    /**
+     * FBSTPpd()
+     *
+     * @this {X86FPU}
+     */
+    static FBSTPpd()
+    {
+        /*
+         * TODO: Verify the operation of FBSTP (eg, does it signal an exception if abs(value) >= 1000000000000000000?)
+         */
+        var v = this.roundValue(this.popValue());
+        if (v != null) {
+            /*
+             * intTmpTR[0] will contain the 8 least-significant BCD digits, intTmpTR[1] will contain the next 8,
+             * and intTmpTR[2] will contain the next 2 (bit 15 of intTmpTR[2] will be the sign bit, and bits 8-14 of
+             * intTmpTR[2] will be unused).
+             */
+            this.intTmpTR[0] = this.encodeBCD(v, 8);
+            this.intTmpTR[1] = this.encodeBCD(v / 100000000, 8);
+            this.intTmpTR[2] = this.encodeBCD(v / 10000000000000000, 2);
+            if (v < 0) this.intTmpTR[2] |= 0x8000;
+            this.setEAFromTR();
+        }
+    }
+
+    /**
+     * FCHS()
+     *
+     * @this {X86FPU}
+     */
+    static FCHS()
+    {
+        /*
+         * TODO: This could be implemented more efficiently by simply inverting the sign bit of ST(0).
+         */
+        this.setST(0, -this.getST(0));
+    }
+
+    /**
+     * FCLEX()
+     *
+     * NOTE: Although we explicitly clear the BUSY bit, there shouldn't be any code setting it, because
+     * we're never "busy" (all floating-point operations are performed synchronously).  Conversely, there's
+     * no need to explicitly clear the ES bit, because clearStatus() will call checkException(), which
+     * updates ES and clears/sets FPU interrupt status as appropriate.
+     *
+     * @this {X86FPU}
+     */
+    static FCLEX()
+    {
+        this.clearStatus(X86.FPU.STATUS.EXC | X86.FPU.STATUS.BUSY);
+    }
+
+    /**
+     * FCOMlr()
+     *
+     * Encoding 0xDC,mod<3,reg=2 ("FCOM long-real"): Evaluate ST(0) - REAL64
+     *
+     * @this {X86FPU}
+     */
+    static FCOMlr()
+    {
+        this.doCompare(this.getST(0), this.getLRFromEA());
+    }
+
+    /**
+     * FCOMsr()
+     *
+     * Encoding 0xD8,mod<3,reg=2 ("FCOM short-real"): Evaluate ST(0) - REAL32
+     *
+     * @this {X86FPU}
+     */
+    static FCOMsr()
+    {
+        this.doCompare(this.getST(0), this.getSRFromEA());
+    }
+
+    /**
+     * FCOMst()
+     *
+     * Encoding 0xD8,mod=3,reg=2 ("FCOM ST(i)"): Evaluate ST(0) - ST(i)
+     *
+     * @this {X86FPU}
+     */
+    static FCOMst()
+    {
+        this.doCompare(this.getST(0), this.getST(this.iStack));
+    }
+
+    /**
+     * FCOM8087()
+     *
+     * NOTE: This is used with encoding(s) (0xDC,0xD0-0xD7) that were valid for the 8087 and 80287
+     * but may no longer be valid as of the 80387.
+     *
+     * TODO: Determine if this form subtracted the operands in the same order, or if it requires an FCOMsti(),
+     * which, like the other *sti() functions, uses ST(0) as the second operand rather than the first.
+     *
+     * @this {X86FPU}
+     */
+    static FCOM8087()
+    {
+        this.opObsolete();
+        X86FPU.FCOMst.call(this);
+    }
+
+    /**
+     * FCOMPlr()
+     *
+     * Encoding 0xDC,mod<3,reg=3 ("FCOM long-real"): Evaluate ST(0) - REAL64, POP
+     *
+     * @this {X86FPU}
+     */
+    static FCOMPlr()
+    {
+        if (this.doCompare(this.getST(0), this.getLRFromEA())) this.popValue();
+    }
+
+    /**
+     * FCOMPsr()
+     *
+     * Encoding 0xD8,mod<3,reg=3 ("FCOM short-real"): Evaluate ST(0) - REAL32, POP
+     *
+     * @this {X86FPU}
+     */
+    static FCOMPsr()
+    {
+        if (this.doCompare(this.getST(0), this.getSRFromEA())) this.popValue();
+    }
+
+    /**
+     * FCOMPst()
+     *
+     * Encoding 0xD8,mod=3,reg=3 ("FCOMP ST(i)"): Evaluate ST(0) - ST(i), POP
+     *
+     * @this {X86FPU}
+     */
+    static FCOMPst()
+    {
+        if (this.doCompare(this.getST(0), this.getST(this.iStack))) this.popValue();
+    }
+
+    /**
+     * FCOMP8087()
+     *
+     * NOTE: This is used with encodings (0xDC,0xD8-0xDF and 0xDE,0xD0-0xD7) that were valid for the 8087
+     * and 80287 but may no longer be valid as of the 80387.
+     *
+     * TODO: Determine if this form subtracted the operands in the same order, or if it requires an FCOMPsti(),
+     * which, like the other *sti() functions, uses ST(0) as the second operand rather than the first.
+     *
+     * @this {X86FPU}
+     */
+    static FCOMP8087()
+    {
+        this.opObsolete();
+        X86FPU.FCOMPst.call(this);
+    }
+
+    /**
+     * FCOMPP()
+     *
+     * @this {X86FPU}
+     */
+    static FCOMPP()
+    {
+        if (this.doCompare(this.getST(0), this.getST(1)) && this.popValue() != null) this.popValue();
+    }
+
+    /**
+     * FDECSTP()
+     *
+     * @this {X86FPU}
+     */
+    static FDECSTP()
+    {
+        this.iST = (this.iST - 1) & 0x7;
+        this.regStatus &= ~X86.FPU.STATUS.C1;
+    }
+
+    /**
+     * FDISI8087()
+     *
+     * @this {X86FPU}
+     */
+    static FDISI8087()
+    {
+        if (this.isModel(X86.FPU.MODEL_8087)) {
+            this.regControl |= X86.FPU.CONTROL.IEM;
+        }
+    }
+
+    /**
+     * FDIVlr()
+     *
+     * @this {X86FPU}
+     */
+    static FDIVlr()
+    {
+        this.setST(0, this.doDivide(this.getST(0), this.getLRFromEA()));
+    }
+
+    /**
+     * FDIVsr()
+     *
+     * @this {X86FPU}
+     */
+    static FDIVsr()
+    {
+        this.setST(0, this.doDivide(this.getST(0), this.getSRFromEA()));
+    }
+
+    /**
+     * FDIVst()
+     *
+     * Encoding 0xD8,0xF0-0xF7 ("FDIV ST,ST(i)"): ST(0) <- ST(0) / ST(i)
+     *
+     * @this {X86FPU}
+     */
+    static FDIVst()
+    {
+        this.setST(0, this.doDivide(this.getST(0), this.getST(this.iStack)));
+    }
+
+    /**
+     * FDIVsti()
+     *
+     * Encoding 0xDC,0xF8-0xFF ("FDIV ST(i),ST"): ST(i) <- ST(i) / ST(0)
+     *
+     * @this {X86FPU}
+     */
+    static FDIVsti()
+    {
+        this.setST(this.iStack, this.doDivide(this.getST(this.iStack), this.getST(0)));
+    }
+
+    /**
+     * FDIVPsti()
+     *
+     * Encoding 0xDE,0xF8-0xFF ("FDIVP ST(i),ST"): ST(i) <- ST(i) / ST(0), POP
+     *
+     * @this {X86FPU}
+     */
+    static FDIVPsti()
+    {
+        if (this.setST(this.iStack, this.doDivide(this.getST(this.iStack), this.getST(0)))) this.popValue();
+    }
+
+    /**
+     * FDIVRlr()
+     *
+     * @this {X86FPU}
+     */
+    static FDIVRlr()
+    {
+        this.setST(0, this.doDivide(this.getLRFromEA(), this.getST(0)));
+    }
+
+    /**
+     * FDIVRsr()
+     *
+     * @this {X86FPU}
+     */
+    static FDIVRsr()
+    {
+        this.setST(0, this.doDivide(this.getSRFromEA(), this.getST(0)));
+    }
+
+    /**
+     * FDIVRst()
+     *
+     * Encoding 0xD8,0xF8-0xFF ("FDIVR ST,ST(i)"): ST(0) <- ST(i) / ST(0)
+     *
+     * @this {X86FPU}
+     */
+    static FDIVRst()
+    {
+        this.setST(0, this.doDivide(this.getST(this.iStack), this.getST(0)));
+    }
+
+    /**
+     * FDIVRsti()
+     *
+     * Encoding 0xDC,0xF0-0xF7 ("FDIVR ST(i),ST"): ST(i) <- ST(0) / ST(i)
+     *
+     * @this {X86FPU}
+     */
+    static FDIVRsti()
+    {
+        this.setST(this.iStack, this.doDivide(this.getST(0), this.getST(this.iStack)));
+    }
+
+    /**
+     * FDIVRPsti()
+     *
+     * Encoding 0xDE,0xF0-0xE7 ("FDIVRP ST(i),ST"): ST(i) <- ST(0) / ST(i), POP
+     *
+     * @this {X86FPU}
+     */
+    static FDIVRPsti()
+    {
+        if (this.setST(this.iStack, this.doDivide(this.getST(0), this.getST(this.iStack)))) this.popValue();
+    }
+
+    /**
+     * FENI8087()
+     *
+     * @this {X86FPU}
+     */
+    static FENI8087()
+    {
+        if (this.isModel(X86.FPU.MODEL_8087)) {
+            this.regControl &= ~X86.FPU.CONTROL.IEM;
+        }
+    }
+
+    /**
+     * FFREEsti()
+     *
+     * @this {X86FPU}
+     */
+    static FFREEsti()
+    {
+        this.setTag(this.iST, X86.FPU.TAGS.EMPTY);
+    }
+
+    /**
+     * FFREEP8087()
+     *
+     * NOTE: This is used with an encoding (0xDF,0xC0-0xC7) that was valid for the 8087 and 80287
+     * but may no longer be valid as of the 80387.  Also, if the older documentation is to be believed,
+     * this instruction has no modern counterpart, as FFREE doesn't pop the stack.
+     *
+     * @this {X86FPU}
+     */
+    static FFREEP8087()
+    {
+        this.opObsolete();
+        X86FPU.FFREEsti.call(this);
+        this.popValue();
+    }
+
+    /**
+     * FIADD16()
+     *
+     * @this {X86FPU}
+     */
+    static FIADD16()
+    {
+        this.setST(0, this.doAdd(this.getST(0), this.getWIFromEA()));
+    }
+
+    /**
+     * FIADD32()
+     *
+     * @this {X86FPU}
+     */
+    static FIADD32()
+    {
+        this.setST(0, this.doAdd(this.getST(0), this.getSIFromEA()));
+    }
+
+    /**
+     * FICOM16()
+     *
+     * @this {X86FPU}
+     */
+    static FICOM16()
+    {
+        this.doCompare(this.getST(0), this.getWIFromEA());
+    }
+
+    /**
+     * FICOM32()
+     *
+     * @this {X86FPU}
+     */
+    static FICOM32()
+    {
+        this.doCompare(this.getST(0), this.getSIFromEA());
+    }
+
+    /**
+     * FICOMP16()
+     *
+     * @this {X86FPU}
+     */
+    static FICOMP16()
+    {
+        if (this.doCompare(this.getST(0), this.getWIFromEA())) this.popValue();
+    }
+
+    /**
+     * FICOMP32()
+     *
+     * @this {X86FPU}
+     */
+    static FICOMP32()
+    {
+        if (this.doCompare(this.getST(0), this.getSIFromEA())) this.popValue();
+    }
+
+    /**
+     * FIDIV16()
+     *
+     * @this {X86FPU}
+     */
+    static FIDIV16()
+    {
+        this.setST(0, this.doDivide(this.getST(0), this.getWIFromEA()));
+    }
+
+    /**
+     * FIDIV32()
+     *
+     * @this {X86FPU}
+     */
+    static FIDIV32()
+    {
+        this.setST(0, this.doDivide(this.getST(0), this.getSIFromEA()));
+    }
+
+    /**
+     * FIDIVR16()
+     *
+     * @this {X86FPU}
+     */
+    static FIDIVR16()
+    {
+        this.setST(0, this.doDivide(this.getWIFromEA(), this.getST(0)));
+    }
+
+    /**
+     * FIDIVR32()
+     *
+     * @this {X86FPU}
+     */
+    static FIDIVR32()
+    {
+        this.setST(0, this.doDivide(this.getSIFromEA(), this.getST(0)));
+    }
+
+    /**
+     * FILD16()
+     *
+     * @this {X86FPU}
+     */
+    static FILD16()
+    {
+        this.pushValue(this.getWIFromEA());
+    }
+
+    /**
+     * FILD32()
+     *
+     * @this {X86FPU}
+     */
+    static FILD32()
+    {
+        this.pushValue(this.getSIFromEA());
+    }
+
+    /**
+     * FILD64()
+     *
+     * @this {X86FPU}
+     */
+    static FILD64()
+    {
+        this.pushValue(this.getLIFromEA());
+    }
+
+    /**
+     * FIMUL16()
+     *
+     * @this {X86FPU}
+     */
+    static FIMUL16()
+    {
+        this.setST(0, this.doMultiply(this.getST(0), this.getWIFromEA()));
+    }
+
+    /**
+     * FIMUL32()
+     *
+     * @this {X86FPU}
+     */
+    static FIMUL32()
+    {
+        this.setST(0, this.doMultiply(this.getST(0), this.getSIFromEA()));
+    }
+
+    /**
+     * FINCSTP()
+     *
+     * @this {X86FPU}
+     */
+    static FINCSTP()
+    {
+        this.iST = (this.iST + 1) & 0x7;
+        this.regStatus &= ~X86.FPU.STATUS.C1;
+    }
+
+    /**
+     * FINIT()
+     *
+     * @this {X86FPU}
+     */
+    static FINIT()
+    {
+        this.resetFPU();
+    }
+
+    /**
+     * FIST16()
+     *
+     * @this {X86FPU}
+     */
+    static FIST16()
+    {
+        if (this.getWI(0)) this.setEAFromWI();
+    }
+
+    /**
+     * FIST32()
+     *
+     * @this {X86FPU}
+     */
+    static FIST32()
+    {
+        if (this.getSI(0)) this.setEAFromSI();
+    }
+
+    /**
+     * FISTP16()
+     *
+     * @this {X86FPU}
+     */
+    static FISTP16()
+    {
+        if (this.getWI(0)) {
+            this.setEAFromWI();
+            this.popValue();
+        }
+    }
+
+    /**
+     * FISTP32()
+     *
+     * @this {X86FPU}
+     */
+    static FISTP32()
+    {
+        if (this.getSI(0)) {
+            this.setEAFromSI();
+            this.popValue();
+        }
+    }
+
+    /**
+     * FISTP64()
+     *
+     * @this {X86FPU}
+     */
+    static FISTP64()
+    {
+        if (this.getLI(0)) {
+            this.setEAFromLI();
+            this.popValue();
+        }
+    }
+
+    /**
+     * FISUB16()
+     *
+     * @this {X86FPU}
+     */
+    static FISUB16()
+    {
+        this.setST(0, this.doSubtract(this.getST(0), this.getWIFromEA()));
+    }
+
+    /**
+     * FISUB32()
+     *
+     * @this {X86FPU}
+     */
+    static FISUB32()
+    {
+        this.setST(0, this.doSubtract(this.getST(0), this.getSIFromEA()));
+    }
+
+    /**
+     * FISUBR16()
+     *
+     * @this {X86FPU}
+     */
+    static FISUBR16()
+    {
+        this.setST(0, this.doSubtract(this.getWIFromEA(), this.getST(0)));
+    }
+
+    /**
+     * FISUBR32()
+     *
+     * @this {X86FPU}
+     */
+    static FISUBR32()
+    {
+        this.setST(0, this.doSubtract(this.getSIFromEA(), this.getST(0)));
+    }
+
+    /**
+     * FLDlr()
+     *
+     * The FLD instruction loads the source operand, converts it to temporary real format (if required),
+     * and pushes the resulting value onto the floating-point stack.
+     *
+     * The load operation is accomplished by decrementing the top-of-stack pointer (TOP) and copying the
+     * source operand to the new stack top. If the source operand is a float ing-point register, the index of
+     * the register is taken before TOP is changed. The source operand may also be a short real, long real,
+     * or temporary real memory operand. Short real and long real operands are converted automatically.
+     *
+     * Note that coding the instruction FLD ST(0) duplicates the value at the stack top.
+     *
+     * On the 8087 and 80287, the FLD real80 instruction will raise the denormal exception if the memory
+     * operand is a denormal. The 80287XL and later coprocessors will not, since the operation is not arithmetic.
+     *
+     * On the 8087 and 80287, a denormal will be converted to an unnormal by FLD; on the 80287XL and later
+     * coprocessors, the number will be converted to temporary real. If the next instruction is an FXTRACT or FXAM,
+     * the 8087/80827 and 80287XL/80387/ 80486 results will be different.
+     *
+     * On the 8087 and 80287, the FLD real32 and FLD real64 instructions will not raise an exception when loading
+     * a signaling NaN; on the 80287XL and later coprocessors, loading a signaling NaN raises the invalid operation
+     * exception.
+     *
+     * @this {X86FPU}
+     */
+    static FLDlr()
+    {
+        this.pushValue(this.getLRFromEA());
+    }
+
+    /**
+     * FLDsr()
+     *
+     * @this {X86FPU}
+     */
+    static FLDsr()
+    {
+        this.pushValue(this.getSRFromEA());
+    }
+
+    /**
+     * FLDsti()
+     *
+     * @this {X86FPU}
+     */
+    static FLDsti()
+    {
+        this.pushValue(this.getST(this.iStack));
+    }
+
+    /**
+     * FLDtr()
+     *
+     * @this {X86FPU}
+     */
+    static FLDtr()
+    {
+        this.pushValue(this.getLRFromTR(this.getTRFromEA()));
+    }
+
+    /**
+     * FLDCW()
+     *
+     * @this {X86FPU}
+     */
+    static FLDCW()
+    {
+
+        this.setControl(this.cpu.getShort(this.cpu.regEA));
+    }
+
+    /**
+     * FLDENV()
+     *
+     * @this {X86FPU}
+     */
+    static FLDENV()
+    {
+
+        this.loadEnv(this.cpu.regEA);
+    }
+
+    /**
+     * FLD1()
+     *
+     * The FLD1 instruction loads the constant +1.0 from the NPX's constant ROM and pushes the value onto the
+     * floating-point stack.
+     *
+     * The constant is stored internally in temporary real format and is simply moved to the stack.
+     *
+     * See also: FLDLG2, FLDLN2, FLDL2E, FLDL2T, FLDPI, and FLD1.
+     *
+     * @this {X86FPU}
+     */
+    static FLD1()
+    {
+        this.pushValue(1.0);
+    }
+
+    /**
+     * FLDL2T()
+     *
+     * The FLDL2T instruction loads the constant log2(10) from the NPX's constant ROM and pushes the value onto the
+     * floating-point stack.
+     *
+     * The constant is stored internally in temporary real format and is simply moved to the stack.
+     *
+     * On the 8087 and 80287, rounding control is not in effect for the loading of this constant.  On the 80287XL and
+     * later coprocessors, rounding control is in effect.  If RC is set for chop (round toward 0), round down (toward
+     * -infinity), or round to nearest or even, the result will be the same as on the 8087 and 80287.  If RC is set for
+     * round up (toward +infinity), the result will differ by one in the least significant bit of the mantissa.
+     *
+     * See also: FLDLG2, FLDLN2, FLDL2E, FLDPI, FLD1, and FLDZ.
+     *
+     * @this {X86FPU}
+     */
+    static FLDL2T()
+    {
+        this.pushValue(X86FPU.regL2T);
+    }
+
+    /**
+     * FLDL2E()
+     *
+     * The FLDL2E instruction loads the constant log2(e) from the NPX's constant ROM and pushes the value onto the
+     * floating-point stack.
+     *
+     * The constant is stored internally in temporary real format and is simply moved to the stack.
+     *
+     * On the 8087 and 80287, rounding control is not in effect for the loading of this constant.  On the 80287XL and
+     * later coprocessors, rounding control is in effect.  If RC is set for chop (round toward 0) or round down (toward
+     * -infinity), the result is the same as on the 8087 and 80827.  If RC is set for round to nearest or even, or round
+     * up (toward +infinity), the result will differ by one in the least significant bit of the mantissa.
+     *
+     * See also: FLDLG2, FLDLN2, FLDL2T, FLDPI, FLD1, and FLDZ.
+     *
+     * @this {X86FPU}
+     */
+    static FLDL2E()
+    {
+        this.pushValue(X86FPU.regL2E);
+    }
+
+    /**
+     * FLDPI()
+     *
+     * The FLDPI instruction loads the constant Pi from the NPX's constant ROM and pushes the value onto the
+     * floating-point stack.
+     *
+     * The constant is stored internally in temporary real format and is simply moved to the stack.
+     *
+     * On the 8087 and 80287, rounding control is not in effect for the loading of these constants.  On the 80287XL and
+     * later coprocessors, rounding control is in effect.  If RC is set for chop (round toward 0) or round down (toward
+     * -infinity), the result is the same as on the 8087 and 80827.  If RC is set for round to nearest or even, or round
+     * up (toward +infinity), the result will differ by one in the least significant bit of the mantissa.
+     *
+     * See also: FLDLG2, FLDLN2, FLDL2E, FLDL2T, FLD1, and FLDZ.
+     *
+     * @this {X86FPU}
+     */
+    static FLDPI()
+    {
+        this.pushValue(X86FPU.regPI);
+    }
+
+    /**
+     * FLDLG2()
+     *
+     * The FLDLG2 instruction loads the constant log10(2) from the NPX's constant ROM and pushes the value onto the
+     * floating-point stack.
+     *
+     * The constant is stored internally in temporary real format and is simply moved to the stack.
+     *
+     * On the 8087 and 80287, rounding control is not in effect for the loading of this constant.  On the 80287XL and
+     * later coprocessors, rounding control is in effect.  If RC is set for chop (round toward 0) or round down (toward
+     * -infinity), the result is the same as on the 8087 and 80827.  If RC is set for round to nearest or even, or round
+     * up (toward +infinity), the result will differ by one in the least significant bit of the mantissa.
+     *
+     * See also: FLDLN2, FLDL2E, FLDL2T, FLDPI, FLD1, and FLDZ.
+     *
+     * @this {X86FPU}
+     */
+    static FLDLG2()
+    {
+        this.pushValue(X86FPU.regLG2);
+    }
+
+    /**
+     * FLDLN2()
+     *
+     * The FLDLN2 instruction loads the constant loge(2) from the NPX's constant ROM and pushes the value onto the
+     * floating-point stack.
+     *
+     * The constant is stored internally in temporary real format and is simply moved to the stack.
+     *
+     * On the 8087 and 80287, rounding control is not in effect for the loading of this constant.  On the 80287XL and
+     * later coprocessors, rounding control is in effect.  If RC is set for chop (round toward 0) or round down (toward
+     * -infinity), the result will be the same as on the 8087 and 80827.  If RC is set for round to nearest or even, or
+     * round up (toward +infinity), the result will differ by one in the least significant bit of the mantissa.
+     *
+     * See also: FLDLG2, FLDL2E, FLDL2T, FLDPI, FLD1, and FLDZ.
+     *
+     * @this {X86FPU}
+     */
+    static FLDLN2()
+    {
+        this.pushValue(X86FPU.regLN2);
+    }
+
+    /**
+     * FLDZ()
+     *
+     * The FLDZ instruction loads the constant +0.0 from the NPX's constant ROM and pushes the value onto the
+     * floating-point stack.
+     *
+     * The constant is stored internally in temporary real format and is simply moved to the stack.
+     *
+     * See also: FLDLG2, FLDLN2, FLDL2E, FLDL2T, FLDPI, and FLD1.
+     *
+     * @this {X86FPU}
+     */
+    static FLDZ()
+    {
+        this.pushValue(0.0);
+    }
+
+    /**
+     * FMULlr()
+     *
+     * @this {X86FPU}
+     */
+    static FMULlr()
+    {
+        this.setST(0, this.doMultiply(this.getST(0), this.getLRFromEA()));
+    }
+
+    /**
+     * FMULsr()
+     *
+     * Encoding 0xD8,reg=0x01 ("FMUL short-real"): ST(0) <- ST(0) * REAL32
+     *
+     * @this {X86FPU}
+     */
+    static FMULsr()
+    {
+        this.setST(0, this.doMultiply(this.getST(0), this.getSRFromEA()));
+    }
+
+    /**
+     * FMULst()
+     *
+     * @this {X86FPU}
+     */
+    static FMULst()
+    {
+        this.setST(0, this.doMultiply(this.getST(0), this.getST(this.iStack)));
+    }
+
+    /**
+     * FMULsti()
+     *
+     * @this {X86FPU}
+     */
+    static FMULsti()
+    {
+        this.setST(this.iStack, this.doMultiply(this.getST(this.iStack), this.getST(0)));
+    }
+
+    /**
+     * FMULPsti()
+     *
+     * @this {X86FPU}
+     */
+    static FMULPsti()
+    {
+        if (this.setST(this.iStack, this.doMultiply(this.getST(this.iStack), this.getST(0)))) this.popValue();
+    }
+
+    /**
+     * FNOP()
+     *
+     * @this {X86FPU}
+     */
+    static FNOP()
+    {
+    }
+
+    /**
+     * FPATAN()
+     *
+     * FPATAN calculates the partial arctangent of ST(0) divided by ST(1):
+     *
+     *      ST(1) = tan^-1( ST(1) / ST(0) )
+     *
+     * On the 8087 and 80287, the arguments must satisfy the inequality 0 <= ST(1) < ST(0) < +infinity.
+     * On the 80287XL and later coprocessors, the range of the operands is unrestricted.  The result is
+     * returned to ST(1), and the stack is popped, destroying both operands and leaving the result in ST(0).
+     *
+     * @this {X86FPU}
+     */
+    static FPATAN()
+    {
+        if (this.setST(1, Math.atan2(this.getST(1), this.getST(0)))) this.popValue();
+    }
+
+    /**
+     * FPTAN()
+     *
+     * FPTAN calculates the partial tangent of ST(0):
+     *
+     *      y / x = tan( ST(0) )
+     *
+     * The result of the operation is a ratio.  y replaces the argument on the stack, and x is pushed onto the stack,
+     * where it becomes the new ST(0).
+     *
+     * On the 8087 and 80287, the FPTAN function assumes that its argument is valid and in-range.  No argument checking
+     * is performed.  The value of ST(0) must satisfy the inequality -pi/4 <= ST(0) <= pi/4.  In the case of an invalid
+     * argument, the result is undefined and no error is signaled.
+     *
+     * On the 80287XL and later coprocessors, if value of ST(0) satisfies the condition -2^63 < ST(0) < 2^63, it will
+     * automatically be reduced to within range.  If the operand is outside this range, however, C2 is set to 1 to indicate
+     * that the function is incomplete, and ST(0) is left unchanged.
+     *
+     * The 80287XL, 80387, and 80486 always push a value of +1.0 for x. The value of x pushed by the 8087 and 80287 may be
+     * any real number.  In either case, the ratio is the same. The cotangent can be calculated by executing FDIVR immediately
+     * after FPTAN.  The following code will leave the 8087 and 80287 in the same state as the later coprocessors:
+     *
+     *      FDIV
+     *      FLD1
+     *
+     * ST(7) must be empty before this instruction is executed to avoid an invalid operation exception.  If the invalid
+     * operation exception is masked, the 8087 and 80287 leave the original operand unchanged, but push it to ST(1).  On the
+     * 80287XL and later coprocessors, both ST(0) and ST(1) will contain quiet NaNs.  On the 80287XL and later coprocessors,
+     * if condition code bit C2 is 0 and the precision exception is raised, then C1=1 if the last bit was rounded up. C1 is
+     * undefined for the 8087 and 80287.
+     *
+     * @this {X86FPU}
+     */
+    static FPTAN()
+    {
+        if (this.setST(0, Math.tan(this.getST(0)))) this.pushValue(1.0);
+    }
+
+    /**
+     * FPREM()
+     *
+     * FPREM performs modulo division of ST(0) by ST(1) and returns the result to ST(0).
+     *
+     * The FPREM instruction is used to reduce the real operand in ST(0) to a value whose magnitude is less than the
+     * magnitude of ST(1).  FPREM produces an exact result, so the precision exception is never raised and the rounding
+     * control has no effect.  The sign of the remainder is the same as the sign of the original operand.
+     *
+     * The remaindering operation is performed by iterative scaled subtractions and can reduce the exponent of ST(0) by
+     * no more than 63 in one execution.  If the remainder is less than ST(1) (the modulus), the function is complete and
+     * C2 in the status word is cleared.
+     *
+     * If the modulo function is incomplete, C2 is set to 1, and the result in ST(0) is termed the partial remainder.
+     * C2 can be inspected by storing the status word and re-executing the instruction until C2 is clear. Alternately,
+     * ST(0) can be compared to ST(1).  If ST(0) > ST(1), then FPREM must be executed again.  If ST(0) = ST(1), then the
+     * remainder is 0.
+     *
+     * FPREM is important for reducing arguments to the periodic transcendental functions such as FPTAN.  Because FPREM
+     * produces an exact result, no round-off error is introduced into the calculation.
+     *
+     * When reduction is complete, the three least-significant bits of the quotient are stored in the condition code bits
+     * C3, C1, and C0, respectively.  When arguments to the tangent function are reduced by pi/4, this result can be used
+     * to identify the octant that contained the original angle.
+     *
+     * The FPREM function operates differently than specified by the IEEE 754 standard when rounding the quotient to form
+     * a partial remainder (see the algorithm).  The FPREM1 function (80287XL and up) is provided for compatibility with
+     * that standard.
+     *
+     * The FPREM instruction can also be used to normalize ST(0).  If ST(0) is unnormal and ST(1) is greater than ST(0),
+     * FPREM will normalize ST(0).  On the 8087 and 80287, operation on a denormal operand raises the invalid operation
+     * exception.  Underflow is not possible.  On the 80287XL and later coprocessors, operation on a denormal is supported
+     * and an underflow exception can occur.
+     *
+     * ALGORITHM:
+     *
+     *      t = EXPONENT(ST) - EXPONENT(ST(1))
+     *      IF (t < 64) THEN
+     *          q = R0UND(ST(0) / ST(1), CHOP)
+     *          ST(0) = ST(0) - (ST(1) * q)
+     *          C2 = 0
+     *          C0 = BIT 2 of q
+     *          C1 = BIT 1 of q
+     *          C3 = BIT 0 of q
+     *      ELSE
+     *          n = a number between 32 and 63
+     *          q = ROUND((ST(0) / ST(1)) / 2^(t-n), CHOP)
+     *          ST(0) = ST(0) - (ST(1) * q * 2^(t-n))
+     *          C2 = 1
+     *      ENDIF
+     *
+     * TODO: Determine the extent to which the JavaScript MOD operator differs from the above algorithm.
+     *
+     * ERRATA: On the 8087 and 80287, the condition code bits C3, C1, and C0 are incorrect when performing a reduction of
+     * 64^n + m, where n >= 1, and m=1 or m=2.  A bug fix should be implemented in software.
+     *
+     * @this {X86FPU}
+     */
+    static FPREM()
+    {
+        this.setST(0, this.getST(0) % this.getST(1));
+    }
+
+    /**
+     * FRSTOR()
+     *
+     * @this {X86FPU}
+     */
+    static FRSTOR()
+    {
+        var cpu = this.cpu;
+        var addr = this.loadEnv(cpu.regEA);
+        var a = this.intTmpTR;
+        for (var i = 0; i < this.regStack.length; i++) {
+            a[0] = cpu.getLong(addr);
+            a[1] = cpu.getLong(addr += 4);
+            a[2] = cpu.getShort(addr += 4);
+            this.setTR(i, a);
+            addr += 2;
+        }
+    }
+
+    /**
+     * FRNDINT()
+     *
+     * @this {X86FPU}
+     */
+    static FRNDINT()
+    {
+        this.setST(0, this.roundValue(this.getST(0), X86FPU.MAX_INT64));
+    }
+
+    /**
+     * FSAVE()
+     *
+     * @this {X86FPU}
+     */
+    static FSAVE()
+    {
+        var cpu = this.cpu;
+        var addr = this.saveEnv(cpu.regEA);
+        for (var i = 0; i < this.regStack.length; i++) {
+            var a = this.getTR(i, true);
+            cpu.setLong(addr, a[0]);
+            cpu.setLong(addr += 4, a[1]);
+            cpu.setShort(addr += 4, a[2]);
+            addr += 2;
+        }
+        this.resetFPU();
+    }
+
+    /**
+     * FSCALE()
+     *
+     * FSCALE interprets the value in ST(1) as an integer and adds this number to the exponent of the number in ST(0).
+     *
+     * The FSCALE instruction provides a means of quickly performing multiplication or division by powers of two.
+     * This operation is often required when scaling array indexes.
+     *
+     * On the 8087 and 80287, FSCALE assumes that the scale factor in ST(1) is an integer that satisfies the inequality
+     * -2^15 <= ST(1) < +2^15.  If ST(1) is not an integer value, the value is chopped to the next smallest integer in
+     * magnitude (chopped toward zero).  If the value is out of range or 0 < ST(1) < 1, FSCALE produces an undefined
+     * result and doesn't signal an exception.  Typically, the value in ST(0) is unchanged but should not be depended on.
+     *
+     * On the 80287XL and later coprocessors, there is no limit on the range of the scale factor in ST(1). The value in
+     * ST(1) is still chopped toward zero.  If ST(1) is 0, ST(0) is unchanged.
+     *
+     * @this {X86FPU}
+     */
+    static FSCALE()
+    {
+        var x = this.getST(0);
+        var y = this.getST(1);
+        if (x != null && y != null) this.setST(0, x * Math.pow(2, this.truncateValue(y)));
+    }
+
+    /**
+     * FSETPM287()
+     *
+     * @this {X86FPU}
+     */
+    static FSETPM287()
+    {
+        if (this.isModel(X86.FPU.MODEL_80287)) {
+            this.opUnimplemented();
+        }
+    }
+
+    /**
+     * FSINCOS387()
+     *
+     * @this {X86FPU}
+     */
+    static FSINCOS387()
+    {
+        if (this.isAtLeastModel(X86.FPU.MODEL_80287XL)) {
+            this.opUnimplemented();
+        }
+    }
+
+    /**
+     * FSQRT()
+     *
+     * @this {X86FPU}
+     */
+    static FSQRT()
+    {
+        this.setST(0, this.doSquareRoot(this.getST(0)));
+    }
+
+    /**
+     * FSTlr()
+     *
+     * @this {X86FPU}
+     */
+    static FSTlr()
+    {
+        if (this.getLR(0)) this.setEAFromLR();
+    }
+
+    /**
+     * FSTsr()
+     *
+     * @this {X86FPU}
+     */
+    static FSTsr()
+    {
+        if (this.getSR(0)) this.setEAFromSR();
+    }
+
+    /**
+     * FSTsti()
+     *
+     * @this {X86FPU}
+     */
+    static FSTsti()
+    {
+        this.setST(this.iStack, this.getST(0));
+    }
+
+    /**
+     * FSTENV()
+     *
+     * @this {X86FPU}
+     */
+    static FSTENV()
+    {
+
+        this.saveEnv(this.cpu.regEA);
+        this.regControl |= X86.FPU.CONTROL.EXC;     // mask all exceptions (but do not set IEM)
+    }
+
+    /**
+     * FSTPlr()
+     *
+     * @this {X86FPU}
+     */
+    static FSTPlr()
+    {
+        if (this.getLR(0)) {
+            this.setEAFromLR();
+            this.popValue();
+        }
+    }
+
+    /**
+     * FSTPsr()
+     *
+     * @this {X86FPU}
+     */
+    static FSTPsr()
+    {
+        if (this.getSR(0)) {
+            this.setEAFromSR();
+            this.popValue();
+        }
+    }
+
+    /**
+     * FSTPsti()
+     *
+     * @this {X86FPU}
+     */
+    static FSTPsti()
+    {
+        if (this.setST(this.iStack, this.getST(0))) this.popValue();
+    }
+
+    /**
+     * FSTP8087()
+     *
+     * NOTE: This is used with encodings (0xD9,0xD8-0xDF and 0xDF,0xD0-0xDF) that were valid for the 8087 and 80287
+     * but may no longer be valid as of the 80387.
+     *
+     * @this {X86FPU}
+     */
+    static FSTP8087()
+    {
+        this.opObsolete();
+        X86FPU.FSTPsti.call(this);
+    }
+
+    /**
+     * FSTPtr()
+     *
+     * @this {X86FPU}
+     */
+    static FSTPtr()
+    {
+        if (this.getTR(0)) {
+            this.setEAFromTR();
+            this.popValue();
+        }
+    }
+
+    /**
+     * FSTCW()
+     *
+     * @this {X86FPU}
+     */
+    static FSTCW()
+    {
+
+        this.cpu.setShort(this.cpu.regEA, this.regControl);
+    }
+
+    /**
+     * FSTSW()
+     *
+     * @this {X86FPU}
+     */
+    static FSTSW()
+    {
+
+        this.cpu.setShort(this.cpu.regEA, this.getStatus());
+    }
+
+    /**
+     * FSTSWAX287()
+     *
+     * @this {X86FPU}
+     */
+    static FSTSWAX287()
+    {
+        if (this.isAtLeastModel(X86.FPU.MODEL_80287)) {
+            this.cpu.regEAX = (this.cpu.regEAX & ~0xffff) | this.getStatus();
+        }
+    }
+
+    /**
+     * FSUBlr()
+     *
+     * @this {X86FPU}
+     */
+    static FSUBlr()
+    {
+        this.setST(0, this.doSubtract(this.getST(0), this.getLRFromEA()));
+    }
+
+    /**
+     * FSUBsr()
+     *
+     * @this {X86FPU}
+     */
+    static FSUBsr()
+    {
+        this.setST(0, this.doSubtract(this.getST(0), this.getSRFromEA()));
+    }
+
+    /**
+     * FSUBst()
+     *
+     * Encoding 0xD8,0xE0-0xE7 ("FSUB ST,ST(i)"): ST(0) <- ST(0) - ST(i)
+     *
+     * @this {X86FPU}
+     */
+    static FSUBst()
+    {
+        this.setST(0, this.doSubtract(this.getST(0), this.getST(this.iStack)));
+    }
+
+    /**
+     * FSUBsti()
+     *
+     * Encoding 0xDC,0xE8-0xEF ("FSUB ST(i),ST"): ST(i) <- ST(i) - ST(0)
+     *
+     * @this {X86FPU}
+     */
+    static FSUBsti()
+    {
+        this.setST(this.iStack, this.doSubtract(this.getST(this.iStack), this.getST(0)));
+    }
+
+    /**
+     * FSUBPsti()
+     *
+     * Encoding 0xDE,0xE8-0xEF ("FSUBP ST(i),ST"): ST(i) <- ST(i) - ST(0), POP
+     *
+     * @this {X86FPU}
+     */
+    static FSUBPsti()
+    {
+        if (this.setST(this.iStack, this.doSubtract(this.getST(this.iStack), this.getST(0)))) this.popValue();
+    }
+
+    /**
+     * FSUBRlr()
+     *
+     * @this {X86FPU}
+     */
+    static FSUBRlr()
+    {
+        this.setST(0, this.doSubtract(this.getLRFromEA(), this.getST(0)));
+    }
+
+    /**
+     * FSUBRsr()
+     *
+     * @this {X86FPU}
+     */
+    static FSUBRsr()
+    {
+        this.setST(0, this.doSubtract(this.getSRFromEA(), this.getST(0)));
+    }
+
+    /**
+     * FSUBRst()
+     *
+     * Encoding 0xD8,0xE8-0xEF ("FSUBR ST,ST(i)"): ST(0) <- ST(i) - ST(0)
+     *
+     * @this {X86FPU}
+     */
+    static FSUBRst()
+    {
+        this.setST(0, this.doSubtract(this.getST(this.iStack), this.getST(0)));
+    }
+
+    /**
+     * FSUBRsti()
+     *
+     * Encoding 0xDC,0xE0-0xE7 ("FSUBR ST(i),ST"): ST(i) <- ST(0) - ST(i)
+     *
+     * @this {X86FPU}
+     */
+    static FSUBRsti()
+    {
+        this.setST(this.iStack, this.doSubtract(this.getST(0), this.getST(this.iStack)));
+    }
+
+    /**
+     * FSUBRPsti()
+     *
+     * Encoding 0xDE,0xE0-0xE7 ("FSUBRP ST(i),ST"): ST(i) <- ST(0) - ST(i), POP
+     *
+     * @this {X86FPU}
+     */
+    static FSUBRPsti()
+    {
+        if (this.setST(this.iStack, this.doSubtract(this.getST(0), this.getST(this.iStack)))) this.popValue();
+    }
+
+    /**
+     * FTST()
+     *
+     * @this {X86FPU}
+     */
+    static FTST()
+    {
+        this.doCompare(this.getST(0), 0);
+    }
+
+    /**
+     * FXAM()
+     *
+     * @this {X86FPU}
+     */
+    static FXAM()
+    {
+        this.regStatus &= ~X86.FPU.STATUS.CC;
+
+        if (this.getSTSign(0)) {
+            this.regStatus |= X86.FPU.STATUS.C1;
+        }
+        if (this.getTag(this.iST) == X86.FPU.TAGS.EMPTY) {
+            this.regStatus |= X86.FPU.STATUS.C0 | X86.FPU.STATUS.C3;
+        }
+        else {
+            var v = this.getST(0);
+            if (isNaN(v)) {
+                this.regStatus |= X86.FPU.STATUS.C0;
+            }
+            else if (v === 0) {                                 // this equals -0, too (WTF, strict equality?)
+                this.regStatus |= X86.FPU.STATUS.C3;
+            }
+            else if (v === Infinity || v === -Infinity) {       // these are so divergent that even non-strict equality doesn't consider them equal
+                this.regStatus |= X86.FPU.STATUS.C0 | X86.FPU.STATUS.C2;
+            }
+            else {
+                this.regStatus |= X86.FPU.STATUS.C2;
+            }
+        }
+    }
+
+    /**
+     * FXCHsti()
+     *
+     * @this {X86FPU}
+     */
+    static FXCHsti()
+    {
+        var tmp = this.getST(0);
+        this.setST(0, this.getST(this.iStack));
+        this.setST(this.iStack, tmp);
+    }
+
+    /**
+     * FXCH8087()
+     *
+     * NOTE: This is used with encodings (0xDD,0xC8-0xCF and 0xDF,0xC8-0xCF) that were valid for the 8087 and 80287
+     * but may no longer be valid as of the 80387.
+     *
+     * @this {X86FPU}
+     */
+    static FXCH8087()
+    {
+        this.opObsolete();
+        X86FPU.FXCHsti.call(this);
+    }
+
+    /**
+     * FXTRACT()
+     *
+     * FXTRACT splits the value encoded in ST(0) into two separate numbers representing the actual value of the
+     * fraction (mantissa) and exponent fields.
+     *
+     * The FXTRACT instruction is used to decompose the two fields of the temporary real number in ST(0).  The exponent
+     * replaces the value in ST(0), then the fraction is pushed onto the stack.  When execution is complete, ST(0)
+     * contains the original fraction, expressed as a real number with a true exponent of 0 (0x3FFF in biased form),
+     * and ST(1) contains the value of the original operand's true (unbiased) exponent expressed as a real number.
+     *
+     * If ST(0) is 0, the 8087 and 80287 will leave zeros in both ST(0) and ST(1); both zeros will have the same sign as
+     * the original operand.  If ST(0) is +infinity, the invalid operation exception is raised.
+     *
+     * On the 80287XL and later coprocessors, if ST(0) is 0, the zero-divide exception is reported and ST(1) is set to
+     * -infinity.  If ST(0) is +infinity, no exception is reported.
+     *
+     * The FXTRACT instruction may be thought of as the complement to the FSCALE instruction, which combines a separate
+     * fraction and exponent into a single value.
+     *
+     * ALGORITHM:
+     *
+     *      IF (ST(0) = 0) THEN
+     *          DEC TOP
+     *          ST(0) = ST(1)
+     *      ELSE
+     *          temp = ST(0)
+     *          ST(0) = EXPONENT(ST(0))     ; stored as true exponent
+     *          DEC TOP
+     *          ST(0) = FRACTION(ST(0))
+     *      ENDIF
+     *
+     * @this {X86FPU}
+     */
+    static FXTRACT()
+    {
+        var v = this.getST(0);
+        if (v != null) {
+            this.regTmpLR[0] = v;
+            this.setST(0, ((this.intTmpLR[1] >> 20) & 0x7ff) - 0x3ff);
+            this.intTmpLR[1] = (this.intTmpLR[1] | 0x3ff00000) & ~0x40000000;
+            this.pushValue(this.regTmpLR[0]);
+        }
+    }
+
+    /**
+     * FYL2X()
+     *
+     * FYL2X (y log base 2 of x) calculates:
+     *
+     *      ST(1) = ST(1) * log2(ST(0))
+     *
+     * The operands must satisfy the inequalities 0 < ST(0) < +infinity and -infinity < ST(1) < +infinity.  FYL2X pops
+     * the stack and returns the result to the new ST(0).  Both original operands are destroyed.
+     *
+     * The FYL2X function is designed to optimize the calculation of a log to a base, n, other than two.  In such a case,
+     * the following multiplication is required; ie:
+     *
+     *      logn(x) = logn(2) * log2(x)
+     *
+     * @this {X86FPU}
+     */
+    static FYL2X()
+    {
+        if (this.setST(1, this.getST(1) * Math.log(this.getST(0)) / Math.LN2)) this.popValue();
+    }
+
+    /**
+     * FYL2XP1()
+     *
+     * FYL2XP1 (y log base 2 of x plus 1) calculates:
+     *
+     *      ST(1) = ST(1) * log2(ST(0) + 1)
+     *
+     * The operands must satisfy the inequalities -(1-sqrt(2)/2) < ST(0) < (1-sqrt(2)/2) and -infinity < ST(1) < +infinity.
+     * FYL2XP1 pops the stack and returns the result to the new ST(0).  Both original operands are destroyed.
+     *
+     * The FYL2XP1 function provides greater accuracy than FYL2X in computing the log of a number that is very close to 1.
+     *
+     * FYL2XP1 is typically used when computing compound interest, for example, which requires the calculation of a logarithm
+     * of 1.0 + n where 0 < n < 0.29.  If 1.0 was added to n, significant digits might be lost.  By using FYL2XP1, the result
+     * will be as accurate as n to within three units of temporary real precision.
+     *
+     * @this {X86FPU}
+     */
+    static FYL2XP1()
+    {
+        if (this.setST(1, this.getST(1) * Math.log(this.getST(0) + 1.0) / Math.LN2)) this.popValue();
+    }
+
+    /**
+     * X86FPU.init()
+     *
+     * This function operates on every HTML element of class "fpu", extracting the
+     * JSON-encoded parameters for the X86FPU constructor from the element's "data-value"
+     * attribute, invoking the constructor to create an X86FPU component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeFPUs = Component.getElementsByClass(document, PCX86.APPCLASS, "fpu");
+        for (var iFPU = 0; iFPU < aeFPUs.length; iFPU++) {
+            var eFPU = aeFPUs[iFPU];
+            var parmsFPU = Component.getComponentParms(eFPU);
+            var fpu = new X86FPU(parmsFPU);
+            Component.bindComponentControls(fpu, eFPU, PCX86.APPCLASS);
+        }
+    }
+}
+
+/*
+ * Class constants
+ *
+ * TODO: When loading any of the following 5 constants, the 80287XL and newer coprocessors apply rounding control.
+ */
+
+/** @const */
+X86FPU.regL2T = Math.log(10) / Math.LN2;        // log2(10) (use Math.log2() if we ever switch to ES6)
+
+/** @const */
+X86FPU.regL2E = Math.LOG2E;                     // log2(e)
+
+/** @const */
+X86FPU.regPI  = Math.PI;                        // pi
+
+/** @const */
+X86FPU.regLG2 = Math.log(2) / Math.LN10;        // log10(2) (use Math.log10() if we ever switch to ES6)
+
+/** @const */
+X86FPU.regLN2 = Math.LN2;                       // log(2)
+
+/** @const */
+X86FPU.MAX_INT16 = 0x8000;
+
+/** @const */
+X86FPU.MAX_INT32 = 0x80000000;
+
+/** @const */
+X86FPU.MAX_INT64 = Math.pow(2, 63);
+
+
+/*
+ * FPU operation lookup table (be sure to keep the following table in sync with Debugger.aaaOpFPUDescs).
+ *
+ * The second lookup value corresponds to bits in the ModRegRM byte that follows the ESC byte (0xD8-0xDF).
+ *
+ * Here's a little cheat-sheet for how the 2nd lookup values relate to ModRegRM values; see opFPU() for details.
+ *
+ *      Lookup  ModRegRM value(s)
+ *      ------  -------------------------------
+ *      0x00:   0x00-0x07, 0x40-0x47, 0x80-0x87
+ *      0x01:   0x08-0x0F, 0x48-0x4F, 0x88-0x8F
+ *      0x02:   0x10-0x17, 0x50-0x57, 0x90-0x97
+ *      0x03:   0x18-0x1F, 0x58-0x5F, 0x98-0x9F
+ *      0x04:   0x20-0x27, 0x60-0x67, 0xA0-0xA7
+ *      0x05:   0x28-0x2F, 0x68-0x6F, 0xA8-0xAF
+ *      0x06:   0x30-0x37, 0x70-0x77, 0xB0-0xB7
+ *      0x07:   0x38-0x3F, 0x78-0x7F, 0xB8-0xBF
+ *      0x30:   0xC0-0xC7
+ *      0x31:   0xC8-0xCF
+ *      0x32:   0xD0-0xD7
+ *      0x33:   0xD8-0xDF
+ *      0x34:   0xE0-0xE7
+ *      0x35:   0xE8-0xEF
+ *      0x36:   0xF0-0xF7
+ *      0x37:   0xF8-0xFF
+ *
+ * ESC bytes 0xD9 and 0xDB use the RM field to further describe the operation when the ModRegRM value >= 0xE0.
+ * In those cases, we shift the Reg value into the high nibble and the RM value into the low nibble, resulting in
+ * the following lookup values (which look a lot like hex-encoded octal):
+ *
+ *      0x40:   0xE0
+ *      0x41:   0xE1
+ *      ...     ...
+ *      0x46:   0xE6
+ *      0x47:   0xE7
+ *
+ *      0x50:   0xE8
+ *      0x51:   0xE9
+ *      ...     ...
+ *      0x56:   0xEE
+ *      0x57:   0xEF
+ *
+ *      0x60:   0xF0
+ *      0x61:   0xF1
+ *      ...     ...
+ *      0x66:   0xF6
+ *      0x67:   0xF7
+ *
+ *      0x70:   0xF8
+ *      0x71:   0xF9
+ *      ...     ...
+ *      0x76:   0xFE
+ *      0x77:   0xFF
+ */
+X86FPU.aaOps = {
+    0xD8: {
+        0x00: X86FPU.FADDsr,    0x01: X86FPU.FMULsr,    0x02: X86FPU.FCOMsr,    0x03: X86FPU.FCOMPsr,
+        0x04: X86FPU.FSUBsr,    0x05: X86FPU.FSUBRsr,   0x06: X86FPU.FDIVsr,    0x07: X86FPU.FDIVsr,
+        0x30: X86FPU.FADDst,    0x31: X86FPU.FMULst,    0x32: X86FPU.FCOMst,    0x33: X86FPU.FCOMPst,
+        0x34: X86FPU.FSUBst,    0x35: X86FPU.FSUBRst,   0x36: X86FPU.FDIVst,    0x37: X86FPU.FDIVRst
+    },
+    0xD9: {
+        0x00: X86FPU.FLDsr,                             0x02: X86FPU.FSTsr,     0x03: X86FPU.FSTPsr,
+        0x04: X86FPU.FLDENV,    0x05: X86FPU.FLDCW,     0x06: X86FPU.FSTENV,    0x07: X86FPU.FSTCW,
+        0x30: X86FPU.FLDsti,    0x31: X86FPU.FXCHsti,   0x32: X86FPU.FNOP,      0x33: X86FPU.FSTP8087,
+        0x40: X86FPU.FCHS,      0x41: X86FPU.FABS,
+        0x44: X86FPU.FTST,      0x45: X86FPU.FXAM,
+        0x50: X86FPU.FLD1,      0x51: X86FPU.FLDL2T,    0x52: X86FPU.FLDL2E,    0x53: X86FPU.FLDPI,
+        0x54: X86FPU.FLDLG2,    0x55: X86FPU.FLDLN2,    0x56: X86FPU.FLDZ,
+        0x60: X86FPU.F2XM1,     0x61: X86FPU.FYL2X,     0x62: X86FPU.FPTAN,     0x63: X86FPU.FPATAN,
+        0x64: X86FPU.FXTRACT,                           0x66: X86FPU.FDECSTP,   0x67: X86FPU.FINCSTP,
+        0x70: X86FPU.FPREM,     0x71: X86FPU.FYL2XP1,   0x72: X86FPU.FSQRT,
+        0x74: X86FPU.FRNDINT,   0x75: X86FPU.FSCALE
+    },
+    0xDA: {
+        0x00: X86FPU.FIADD32,   0x01: X86FPU.FIMUL32,   0x02: X86FPU.FICOM32,   0x03: X86FPU.FICOMP32,
+        0x04: X86FPU.FISUB32,   0x05: X86FPU.FISUBR32,  0x06: X86FPU.FIDIV32,   0x07: X86FPU.FIDIVR32
+    },
+    0xDB: {
+        0x00: X86FPU.FILD32,    0x02: X86FPU.FIST32,    0x03: X86FPU.FISTP32,
+                                0x05: X86FPU.FLDtr,                             0x07: X86FPU.FSTPtr,
+        0x40: X86FPU.FENI8087,  0x41: X86FPU.FDISI8087, 0x42: X86FPU.FCLEX,     0x43: X86FPU.FINIT,
+        0x44: X86FPU.FSETPM287,
+        0x73: X86FPU.FSINCOS387
+    },
+    0xDC: {
+        0x00: X86FPU.FADDlr,    0x01: X86FPU.FMULlr,    0x02: X86FPU.FCOMlr,    0x03: X86FPU.FCOMPlr,
+        0x04: X86FPU.FSUBlr,    0x05: X86FPU.FSUBRlr,   0x06: X86FPU.FDIVlr,    0x07: X86FPU.FDIVRlr,
+        0x30: X86FPU.FADDsti,   0x31: X86FPU.FMULsti,   0x32: X86FPU.FCOM8087,  0x33: X86FPU.FCOMP8087,
+        /*
+         * Intel's original 8087 datasheet had these forms of SUB and SUBR (and DIV and DIVR) swapped.
+         */
+        0x34: X86FPU.FSUBRsti,  0x35: X86FPU.FSUBsti,   0x36: X86FPU.FDIVRsti,  0x37: X86FPU.FDIVsti
+    },
+    0xDD: {
+        0x00: X86FPU.FLDlr,                             0x02: X86FPU.FSTlr,     0x03: X86FPU.FSTPlr,
+        0x04: X86FPU.FRSTOR,                            0x06: X86FPU.FSAVE,     0x07: X86FPU.FSTSW,
+        0x30: X86FPU.FFREEsti,  0x31: X86FPU.FXCH8087,  0x32: X86FPU.FSTsti,    0x33: X86FPU.FSTPsti
+    },
+    0xDE: {
+        0x00: X86FPU.FIADD16,   0x01: X86FPU.FIMUL16,   0x02: X86FPU.FICOM16,   0x03: X86FPU.FICOMP16,
+        0x04: X86FPU.FISUB16,   0x05: X86FPU.FISUBR16,  0x06: X86FPU.FIDIV16,   0x07: X86FPU.FIDIVR16,
+        0x30: X86FPU.FADDPsti,  0x31: X86FPU.FMULPsti,  0x32: X86FPU.FCOMP8087, 0x33: X86FPU.FCOMPP,
+        /*
+         * Intel's original 8087 datasheet had these forms of SUBP and SUBRP (and DIVP and DIVRP) swapped.
+         */
+        0x34: X86FPU.FSUBRPsti, 0x35: X86FPU.FSUBPsti,  0x36: X86FPU.FDIVRPsti, 0x37: X86FPU.FDIVPsti
+    },
+    0xDF: {
+        0x00: X86FPU.FILD16,                            0x02: X86FPU.FIST16,    0x03: X86FPU.FISTP16,
+        0x04: X86FPU.FBLDpd,    0x05: X86FPU.FILD64,    0x06: X86FPU.FBSTPpd,   0x07: X86FPU.FISTP64,
+        0x30: X86FPU.FFREEP8087,0x31: X86FPU.FXCH8087,  0x32: X86FPU.FSTP8087,  0x33: X86FPU.FSTP8087,
+        0x34: X86FPU.FSTSWAX287
+    }
+};
+
+/*
+ * An array of X86FPU functions documented as preserving the "exception" registers.
+ */
+X86FPU.afnPreserveExceptions = [
+    X86FPU.FCLEX,   X86FPU.FINIT,   X86FPU.FLDCW,   X86FPU.FLDENV,  X86FPU.FRSTOR,
+    X86FPU.FSAVE,   X86FPU.FSTCW,   X86FPU.FSTENV,  X86FPU.FSTSW,   X86FPU.FSTSWAX287
+];
+
+/*
+ * Initialize every FPU module on the page
+ */
+Web.onInit(X86FPU.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/x86func.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * fnADCb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnADCb = function(dst, src)
+{
+    var b = (dst + src + this.getCarry())|0;
+    this.setArithResult(dst, src, b, X86.RESULT.BYTE | X86.RESULT.ALL);
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesArithRR : this.cycleCounts.nOpCyclesArithRM) : this.cycleCounts.nOpCyclesArithMR);
+    return b & 0xff;
+};
+
+/**
+ * fnADCw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnADCw = function(dst, src)
+{
+    var w = (dst + src + this.getCarry())|0;
+    this.setArithResult(dst, src, w, this.typeData | X86.RESULT.ALL);
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesArithRR : this.cycleCounts.nOpCyclesArithRM) : this.cycleCounts.nOpCyclesArithMR);
+    return w & this.maskData;
+};
+
+/**
+ * fnADDb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnADDb = function(dst, src)
+{
+    var b = (dst + src)|0;
+    this.setArithResult(dst, src, b, X86.RESULT.BYTE | X86.RESULT.ALL);
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesArithRR : this.cycleCounts.nOpCyclesArithRM) : this.cycleCounts.nOpCyclesArithMR);
+    return b & 0xff;
+};
+
+/**
+ * fnADDw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnADDw = function(dst, src)
+{
+    var w = (dst + src)|0;
+    this.setArithResult(dst, src, w, this.typeData | X86.RESULT.ALL);
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesArithRR : this.cycleCounts.nOpCyclesArithRM) : this.cycleCounts.nOpCyclesArithMR);
+    return w & this.maskData;
+};
+
+/**
+ * fnANDb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnANDb = function(dst, src)
+{
+    var b = dst & src;
+    this.setLogicResult(b, X86.RESULT.BYTE);
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesArithRR : this.cycleCounts.nOpCyclesArithRM) : this.cycleCounts.nOpCyclesArithMR);
+    return b;
+};
+
+/**
+ * fnANDw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnANDw = function(dst, src)
+{
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesArithRR : this.cycleCounts.nOpCyclesArithRM) : this.cycleCounts.nOpCyclesArithMR);
+    return this.setLogicResult(dst & src, this.typeData) & this.maskData;
+};
+
+/**
+ * fnARPL(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnARPL = function(dst, src)
+{
+    this.nStepCycles -= (10 + (this.regEA === X86.ADDR_INVALID? 0 : 1));
+    if ((dst & X86.SEL.RPL) < (src & X86.SEL.RPL)) {
+        dst = (dst & ~X86.SEL.RPL) | (src & X86.SEL.RPL);
+        this.setZF();
+        return dst;
+    }
+    this.clearZF();
+    return dst;
+};
+
+/**
+ * fnBOUND(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnBOUND = function(dst, src)
+{
+    if (this.regEA === X86.ADDR_INVALID) {
+        /*
+         * Generate UD_FAULT (INT 0x06: Invalid Opcode) if src is not a memory operand.
+         */
+        X86.opInvalid.call(this);
+        return dst;
+    }
+    /*
+     * Note that BOUND performs signed comparisons, so we must transform all arguments into signed values.
+     */
+    var wIndex = dst;
+    var wLower = this.getWord(this.regEA);
+    var wUpper = this.getWord(this.regEA + this.sizeData);
+    if (this.sizeData == 2) {
+        wIndex = (dst << 16) >> 16;
+        wLower = (wLower << 16) >> 16;
+        wUpper = (wUpper << 16) >> 16;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesBound;
+    if (wIndex < wLower || wIndex > wUpper) {
+        /*
+         * The INT 0x05 handler must be called with CS:IP pointing to the BOUND instruction.
+         *
+         * TODO: Determine the cycle cost when a BOUND exception is triggered, over and above nCyclesBound,
+         * and then call X86.helpFault(X86.EXCEPTION.BR_FAULT, null, nCycles).
+         */
+        X86.helpFault.call(this, X86.EXCEPTION.BR_FAULT);
+    }
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnBSF(dst, src)
+ *
+ * Scan src starting at bit 0.  If a set bit is found, the bit index is stored in dst and ZF is cleared;
+ * otherwise, ZF is set and dst is unchanged.
+ *
+ * NOTES: Early versions of the 80386 manuals misstated how ZF was set/cleared.  Also, Intel insists that
+ * dst is undefined whenever ZF is set, but in fact, the 80386 leaves dst unchanged when that happens;
+ * unfortunately, some early 80486s would always modify dst, so it is unsafe to rely on dst when ZF is set.
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnBSF = function(dst, src)
+{
+    var n = 0;
+    if (!src) {
+        this.setZF();
+    } else {
+        this.clearZF();
+        var bit = 0x1;
+        while (bit & this.maskData) {
+            if (src & bit) {
+                dst = n;
+                break;
+            }
+            bit <<= 1;
+            n++;                // TODO: Determine if n should be incremented before the bailout for an accurate cycle count
+        }
+    }
+    this.nStepCycles -= 11 + n * 3;
+    return dst;
+};
+
+/**
+ * fnBSR(dst, src)
+ *
+ * Scan src starting from the highest bit.  If a set bit is found, the bit index is stored in dst and ZF is
+ * cleared; otherwise, ZF is set and dst is unchanged.
+ *
+ * NOTES: Early versions of the 80386 manuals misstated how ZF was set/cleared.  Also, Intel insists that
+ * dst is undefined whenever ZF is set, but in fact, the 80386 leaves dst unchanged when that happens;
+ * unfortunately, some early 80486s would always modify dst, so it is unsafe to rely on dst when ZF is set.
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnBSR = function(dst, src)
+{
+    var n = 0;
+    if (!src) {
+        this.setZF();
+    } else {
+        this.clearZF();
+        var i = (this.sizeData == 2? 15 : 31), bit = 1 << i;
+        while (bit) {
+            if (src & bit) {
+                dst = i;
+                break;
+            }
+            bit >>>= 1;
+            n++; i--;           // TODO: Determine if n should be incremented before the bailout for an accurate cycle count
+        }
+
+    }
+    this.nStepCycles -= 11 + n * 3;
+    return dst;
+};
+
+/**
+ * fnBT(dst, src)
+ *
+ * In this form of BT, src is an immediate operand (OR dst is register operand); immediate operands
+ * are supposed to be masked with either 0xf or 0x1f for 16-bit or 32-bit operands, respectively.
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnBT = function(dst, src)
+{
+    var bit = 1 << (src & (this.sizeData == 2? 0xf : 0x1f));
+    if (dst & bit) this.setCF(); else this.clearCF();
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 3 : 6);
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnBTC(dst, src)
+ *
+ * In this form of BTC, src is an immediate operand (OR dst is register operand); immediate operands
+ * are supposed to be masked with either 0xf or 0x1f for 16-bit or 32-bit operands, respectively.
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnBTC = function(dst, src)
+{
+    var bit = 1 << (src & (this.sizeData == 2? 0xf : 0x1f));
+    if (dst & bit) this.setCF(); else this.clearCF();
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 6 : 8);
+    return dst ^ bit;
+};
+
+/**
+ * fnBTR(dst, src)
+ *
+ * In this form of BTR, src is an immediate operand (OR dst is register operand); immediate operands
+ * are supposed to be masked with either 0xf or 0x1f for 16-bit or 32-bit operands, respectively.
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnBTR = function(dst, src)
+{
+    var bit = 1 << (src & (this.sizeData == 2? 0xf : 0x1f));
+    if (dst & bit) this.setCF(); else this.clearCF();
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 6 : 8);
+    return dst & ~bit;
+};
+
+/**
+ * fnBTS(dst, src)
+ *
+ * In this form of BTS, src is an immediate operand (OR dst is register operand); immediate operands
+ * are supposed to be masked with either 0xf or 0x1f for 16-bit or 32-bit operands, respectively.
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnBTS = function(dst, src)
+{
+    var bit = 1 << (src & (this.sizeData == 2? 0xf : 0x1f));
+    if (dst & bit) this.setCF(); else this.clearCF();
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 6 : 8);
+    return dst | bit;
+};
+
+/**
+ * fnBTMem(dst, src)
+ *
+ * In this form of BT, src is a register operand, which is NOT truncated if dst is a memory operand;
+ * however, if dst is also a register operand, then we defer to the simpler function, fnBT().
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnBTMem = function(dst, src)
+{
+    if (this.regEA === X86.ADDR_INVALID) {
+        return X86.fnBT.call(this, dst, src);
+    }
+    /*
+     * TODO: Consider a worker function that performs the following block of code for: BT, BTC, BTR, and BTS.
+     * It's somewhat inconvenient, because it needs to provide two results: an updated src AND an updated dst.
+     *
+     * src is usually positive BUT can also be negative (as the IA32 spec says: "The offset operand then selects
+     * a bit position within the range −231 to 231 − 1 for a register offset and 0 to 31 for an immediate offset.")
+     */
+    var max = this.sizeData << 3;
+    if (src >= max || src < -max) {
+        /*
+         * We just divided src by 8, but now we need to divide src by 16 or 32, according to the OPERAND size,
+         * which means shifting it right by either 4 or 5 bits.  That gives us a short or long INDEX, which we then
+         * multiply by the OPERAND size to obtain to the corresponding short or long OFFSET that we must add to
+         * the original EA offset.
+         */
+        var i = src >> (this.sizeData == 2? 4 : 5);
+        dst = this.getEAWord(this.segEA, this.offEA + i * this.sizeData);
+    }
+    /*
+     * Now we convert src from a bit index to a bit mask.
+     */
+    src = 1 << (src & (this.sizeData == 2? 0xf : 0x1f));
+    if (dst & src) this.setCF(); else this.clearCF();
+    /*
+     * End of common code block
+     */
+
+    this.nStepCycles -= 6;
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnBTCMem(dst, src)
+ *
+ * In this form of BTC, src is a register operand, which is NOT truncated if dst is a memory operand;
+ * however, if dst is also a register operand, then we defer to the simpler function, fnBTC().
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnBTCMem = function(dst, src)
+{
+    if (this.regEA === X86.ADDR_INVALID) {
+        return X86.fnBTC.call(this, dst, src);
+    }
+    /*
+     * src is usually positive BUT can also be negative (as the IA32 spec says: "The offset operand then selects
+     * a bit position within the range −231 to 231 − 1 for a register offset and 0 to 31 for an immediate offset.")
+     */
+    var max = this.sizeData << 3;
+    if (src >= max || src < -max) {
+        /*
+         * We just divided src by 8, but now we need to divide src by 16 or 32, according to the OPERAND size,
+         * which means shifting it right by either 4 or 5 bits.  That gives us a short or long INDEX, which we then
+         * multiply by the OPERAND size to obtain to the corresponding short or long OFFSET that we must add to
+         * the original EA offset.
+         */
+        var i = src >> (this.sizeData == 2? 4 : 5);
+        dst = this.getEAWord(this.segEA, this.offEA + i * this.sizeData);
+    }
+    /*
+     * Now we convert src from a bit index to a bit mask.
+     */
+    src = 1 << (src & (this.sizeData == 2? 0xf : 0x1f));
+    if (dst & src) this.setCF(); else this.clearCF();
+
+    this.nStepCycles -= 8;
+    return dst ^ src;
+};
+
+/**
+ * fnBTRMem(dst, src)
+ *
+ * In this form of BTR, src is a register operand, which is NOT truncated if dst is a memory operand;
+ * however, if dst is also a register operand, then we defer to the simpler function, fnBTR().
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnBTRMem = function(dst, src)
+{
+    if (this.regEA === X86.ADDR_INVALID) {
+        return X86.fnBTR.call(this, dst, src);
+    }
+    /*
+     * src is usually positive BUT can also be negative (as the IA32 spec says: "The offset operand then selects
+     * a bit position within the range −231 to 231 − 1 for a register offset and 0 to 31 for an immediate offset.")
+     */
+    var max = this.sizeData << 3;
+    if (src >= max || src < -max) {
+        /*
+         * We just divided src by 8, but now we need to divide src by 16 or 32, according to the OPERAND size,
+         * which means shifting it right by either 4 or 5 bits.  That gives us a short or long INDEX, which we then
+         * multiply by the OPERAND size to obtain to the corresponding short or long OFFSET that we must add to
+         * the original EA offset.
+         */
+        var i = src >> (this.sizeData == 2? 4 : 5);
+        dst = this.getEAWord(this.segEA, this.offEA + i * this.sizeData);
+    }
+    /*
+     * Now we convert src from a bit index to a bit mask.
+     */
+    src = 1 << (src & (this.sizeData == 2? 0xf : 0x1f));
+    if (dst & src) this.setCF(); else this.clearCF();
+
+    this.nStepCycles -= 8;
+    return dst & ~src;
+};
+
+/**
+ * fnBTSMem(dst, src)
+ *
+ * In this form of BTS, src is a register operand, which is NOT truncated if dst is a memory operand;
+ * however, if dst is also a register operand, then we defer to the simpler function, fnBTS().
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnBTSMem = function(dst, src)
+{
+    if (this.regEA === X86.ADDR_INVALID) {
+        return X86.fnBTS.call(this, dst, src);
+    }
+    /*
+     * src is usually positive BUT can also be negative (as the IA32 spec says: "The offset operand then selects
+     * a bit position within the range −231 to 231 − 1 for a register offset and 0 to 31 for an immediate offset.")
+     */
+    var max = this.sizeData << 3;
+    if (src >= max || src < -max) {
+        /*
+         * We just divided src by 8, but now we need to divide src by 16 or 32, according to the OPERAND size,
+         * which means shifting it right by either 4 or 5 bits.  That gives us a short or long INDEX, which we then
+         * multiply by the OPERAND size to obtain to the corresponding short or long OFFSET that we must add to
+         * the original EA offset.
+         */
+        var i = src >> (this.sizeData == 2? 4 : 5);
+        dst = this.getEAWord(this.segEA, this.offEA + i * this.sizeData);
+    }
+    /*
+     * Now we convert src from a bit index to a bit mask.
+     */
+    src = 1 << (src & (this.sizeData == 2? 0xf : 0x1f));
+    if (dst & src) this.setCF(); else this.clearCF();
+
+    this.nStepCycles -= 8;
+    return dst | src;
+};
+
+/**
+ * fnCALLw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnCALLw = function(dst, src)
+{
+    this.pushWord(this.getIP());
+    this.setIP(dst);
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesCallWR : this.cycleCounts.nOpCyclesCallWM);
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnCALLFdw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnCALLFdw = function(dst, src)
+{
+    if (this.regEA === X86.ADDR_INVALID) {
+        return X86.fnGRPUndefined.call(this, dst, src);
+    }
+    /*
+     * Originally, we would snapshot regLSP into opLSP because helpCALLF() could trigger a segment fault,
+     * but additionally, the stack segment could trigger either a segment fault or a page fault; indeed,
+     * any operation that performs multiple stack modifications must take this precaution and snapshot regLSP.
+     */
+    this.opLSP = this.regLSP;
+
+    X86.helpCALLF.call(this, dst, this.getShort(this.regEA + this.sizeData));
+    this.nStepCycles -= this.cycleCounts.nOpCyclesCallDM;
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+
+    this.opLSP = X86.ADDR_INVALID;
+    return dst;
+};
+
+/**
+ * fnCMPb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number} dst unchanged
+ */
+X86.fnCMPb = function(dst, src)
+{
+    var b = (dst - src)|0;
+    this.setArithResult(dst, src, b, X86.RESULT.BYTE | X86.RESULT.ALL, true);
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesArithRR : this.cycleCounts.nOpCyclesCompareRM) : this.cycleCounts.nOpCyclesArithRM);
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnCMPw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number} dst unchanged
+ */
+X86.fnCMPw = function(dst, src)
+{
+    var w = (dst - src)|0;
+    this.setArithResult(dst, src, w, this.typeData | X86.RESULT.ALL, true);
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesArithRR : this.cycleCounts.nOpCyclesCompareRM) : this.cycleCounts.nOpCyclesArithRM);
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnDECb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnDECb = function(dst, src)
+{
+    var b = (dst - 1)|0;
+    this.setArithResult(dst, 1, b, X86.RESULT.BYTE | X86.RESULT.NOTCF, true);
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesIncR : this.cycleCounts.nOpCyclesIncM);
+    return b & 0xff;
+};
+
+/**
+ * fnDECw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnDECw = function(dst, src)
+{
+    var w = (dst - 1)|0;
+    this.setArithResult(dst, 1, w, this.typeData | X86.RESULT.NOTCF, true);
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesIncR : this.cycleCounts.nOpCyclesIncM);
+    return w & this.maskData;
+};
+
+/**
+ * fnDIVb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (the divisor)
+ * @param {number} src (null; AX is the implied src)
+ * @return {number} (we return dst unchanged, since it's actually AX that's modified)
+ */
+X86.fnDIVb = function(dst, src)
+{
+    /*
+     * Detect zero divisor
+     */
+    if (!dst) {
+        X86.helpDIVOverflow.call(this);
+        return dst;
+    }
+
+    /*
+     * Detect too-small divisor (quotient overflow)
+     */
+    var result = ((src = this.regEAX & 0xffff) / dst);
+    if (result > 0xff) {
+        X86.helpDIVOverflow.call(this);
+        return dst;
+    }
+
+    this.regMDLo = (result & 0xff) | (((src % dst) & 0xff) << 8);
+    this.fMDSet = true;
+
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesDivBR : this.cycleCounts.nOpCyclesDivBM);
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnDIVw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (the divisor)
+ * @param {number} src (null; DX:AX or EDX:EAX is the implied src)
+ * @return {number} (we return dst unchanged, since it's actually DX:AX that's modified)
+ */
+X86.fnDIVw = function(dst, src)
+{
+    if (this.sizeData == 2) {
+        /*
+         * Detect zero divisor
+         */
+        if (!dst) {
+            X86.helpDIVOverflow.call(this);
+            return dst;
+        }
+        /*
+         * Detect too-small divisor (quotient overflow)
+         *
+         * WARNING: We CANNOT simply do "src = (this.regEDX << 16) | this.regEAX", because if bit 15 of DX
+         * is set, JavaScript will create a negative 32-bit number.  So we instead use non-bitwise operators
+         * to force JavaScript to create a floating-point value that won't suffer from 32-bit-math side-effects.
+         */
+        src = (this.regEDX & 0xffff) * 0x10000 + (this.regEAX & 0xffff);
+        var result = (src / dst);
+        if (result >= 0x10000) {
+            X86.helpDIVOverflow.call(this);
+            return dst;
+        }
+        this.regMDLo = (result & 0xffff);
+        this.regMDHi = (src % dst) & 0xffff;
+    }
+    else {
+        if (!X86.helpDIV32.call(this, this.regEAX, this.regEDX, dst)) {
+            X86.helpDIVOverflow.call(this);
+            return dst;
+        }
+        this.regMDLo |= 0;
+        this.regMDHi |= 0;
+    }
+
+    this.fMDSet = true;
+
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesDivWR : this.cycleCounts.nOpCyclesDivWM);
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnESC(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number} dst unchanged
+ */
+X86.fnESC = function(dst, src)
+{
+    if (this.fpu) {
+        this.fpu.opFPU(this.bOpcode, this.bModRM, dst, src);
+    }
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 2 : 8);
+    return dst;
+};
+
+/**
+ * fnGRPFault(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnGRPFault = function(dst, src)
+{
+    /*
+     * This should NEVER be called on 8086/8088 CPUs, and yet we preset some of the handlers in aOpGrpPOPw,
+     * aOpGrp4b, and aOpGrp4w to call it.  initProcessor() DOES patch aOpGrp4b[0x07] and aOpGrp4w[0x07] to
+     * fnGRPInvalid, but that's it.
+     *
+     * However, given the infrequency of this call, it's simpler to continue presetting all the handlers in
+     * aOpGrpPOPw to their post-8086 default, and deal with the appropriate 8086 behavior here (which for now,
+     * is to call fnGRPUndefined instead).
+     */
+    if (this.model < X86.MODEL_80186) {
+        return X86.fnGRPUndefined.call(this, dst, src);
+    }
+    X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0);
+    return dst;
+};
+
+/**
+ * fnGRPInvalid(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnGRPInvalid = function(dst, src)
+{
+    X86.opInvalid.call(this);
+    return dst;
+};
+
+/**
+ * fnGRPUndefined(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnGRPUndefined = function(dst, src)
+{
+    X86.opUndefined.call(this);
+    return dst;
+};
+
+/**
+ * fnIDIVb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (the divisor)
+ * @param {number} src (null; AX is the implied src)
+ * @return {number} (we return dst unchanged, since it's actually AX that's modified)
+ */
+X86.fnIDIVb = function(dst, src)
+{
+    /*
+     * Detect zero divisor
+     */
+    if (!dst) {
+        X86.helpDIVOverflow.call(this);
+        return dst;
+    }
+
+    /*
+     * Detect too-small divisor (quotient overflow)
+     */
+    var div = ((dst << 24) >> 24);
+    var result = ((src = (this.regEAX << 16) >> 16) / div)|0;
+
+    /*
+     * Note the following difference, from "AP-186: Introduction to the 80186 Microprocessor, March 1983":
+     *
+     *      "The 8086 will cause a divide error whenever the absolute value of the quotient is greater then 7FFFH
+     *      (for word operations) or if the absolute value of the quotient is greater than 7FH (for byte operations).
+     *      The 80186 has expanded the range of negative numbers allowed as a quotient by 1 to include 8000H and 80H.
+     *      These numbers represent the most negative numbers representable using 2's complement arithmetic (equaling
+     *      -32768 and -128 in decimal, respectively)."
+     */
+    if (result != ((result << 24) >> 24) || this.model == X86.MODEL_8086 && result == -128) {
+        X86.helpDIVOverflow.call(this);
+        return dst;
+    }
+
+    this.regMDLo = (result & 0xff) | (((src % div) & 0xff) << 8);
+    this.fMDSet = true;
+
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesIDivBR : this.cycleCounts.nOpCyclesIDivBM);
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnIDIVw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (the divisor)
+ * @param {number} src (null; DX:AX or EDX:EAX is the implied src)
+ * @return {number} (we return dst unchanged, since it's actually DX:AX that's modified)
+ */
+X86.fnIDIVw = function(dst, src)
+{
+    if (this.sizeData == 2) {
+        /*
+         * Detect zero divisor
+         */
+        if (!dst) {
+            X86.helpDIVOverflow.call(this);
+            return dst;
+        }
+
+        /*
+         * Detect too-small divisor (quotient overflow)
+         */
+        var div = ((dst << 16) >> 16);
+        var result = ((src = (this.regEDX << 16) | (this.regEAX & 0xffff)) / div)|0;
+
+        /*
+         * Note the following difference, from "AP-186: Introduction to the 80186 Microprocessor, March 1983":
+         *
+         *      "The 8086 will cause a divide error whenever the absolute value of the quotient is greater then 7FFFH
+         *      (for word operations) or if the absolute value of the quotient is greater than 7FH (for byte operations).
+         *      The 80186 has expanded the range of negative numbers allowed as a quotient by 1 to include 8000H and 80H.
+         *      These numbers represent the most negative numbers representable using 2's complement arithmetic (equaling
+         *      -32768 and -128 in decimal, respectively)."
+         */
+        if (result != ((result << 16) >> 16) || this.model == X86.MODEL_8086 && result == -32768) {
+            X86.helpDIVOverflow.call(this);
+            return dst;
+        }
+
+        this.regMDLo = (result & 0xffff);
+        this.regMDHi = (src % div) & 0xffff;
+    }
+    else {
+        if (!X86.helpIDIV32.call(this, this.regEAX, this.regEDX, dst)) {
+            X86.helpDIVOverflow.call(this);
+            return dst;
+        }
+        this.regMDLo |= 0;
+        this.regMDHi |= 0;
+    }
+
+    this.fMDSet = true;
+
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesIDivWR : this.cycleCounts.nOpCyclesIDivWM);
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnIMUL8(dst, src)
+ *
+ * 80286_and_80287_Programmers_Reference_Manual_1987.pdf, p.B-44 (p.254) notes that:
+ *
+ *      "The low 16 bits of the product of a 16-bit signed multiply are the same as those of an
+ *      unsigned multiply. The three operand IMUL instruction can be used for unsigned operands as well."
+ *
+ * However, we still sign-extend the operands before multiplying, making it easier to range-check the result.
+ *
+ * (80186/80188 and up)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnIMUL8 = function(dst, src)
+{
+    /*
+     * NOTE: getIPDisp() already sign-extends the dst parameter, so fnIMULrw() needlessly sign-extends it again;
+     * a small price to pay for a common function.
+     */
+    var result = X86.fnIMULrw.call(this, this.getIPDisp(), src);
+
+    /*
+     * NOTE: The above function already accounted for the 80386 cycle count, so we are simply accounting for the
+     * increased time on an 80286; the 80186/80188 have even larger values, but we'll worry about that another day.
+     */
+    if (this.model < X86.MODEL_80386) this.nStepCycles -= 12;
+    return result;
+};
+
+/**
+ * fnIMULn(dst, src)
+ *
+ * 80286_and_80287_Programmers_Reference_Manual_1987.pdf, p.B-44 (p.254) notes that:
+ *
+ *      "The low 16 bits of the product of a 16-bit signed multiply are the same as those of an
+ *      unsigned multiply. The three operand IMUL instruction can be used for unsigned operands as well."
+ *
+ * However, we still sign-extend the operands before multiplying, making it easier to range-check the result.
+ *
+ * (80186/80188 and up)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (not used)
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnIMULn = function(dst, src)
+{
+    var result;
+    dst = this.getIPWord();
+
+    if (this.sizeData == 2) {
+        result = X86.fnIMULrw.call(this, dst, src);
+    } else {
+        result = X86.fnIMULrd.call(this, dst, src);
+    }
+
+    /*
+     * NOTE: The above functions already accounted for 80386 cycle counts, so we are simply accounting for the
+     * increased time on an 80286; the 80186/80188 have even larger values, but we'll worry about that another day.
+     */
+    if (this.model < X86.MODEL_80386) this.nStepCycles -= 12;
+    return result;
+};
+
+/**
+ * fnIMUL32(dst, src)
+ *
+ * This sets regMDHi:regMDLo to the 64-bit result of dst * src, both of which are treated as signed.
+ *
+ * @this {X86CPU}
+ * @param {number} dst (any 32-bit number, treated as signed)
+ * @param {number} src (any 32-bit number, treated as signed)
+ */
+X86.fnIMUL32 = function(dst, src)
+{
+    var fNeg = false;
+    if (src < 0) {
+        src = -src|0;
+        fNeg = !fNeg;
+    }
+    if (dst < 0) {
+        dst = -dst|0;
+        fNeg = !fNeg;
+    }
+    X86.fnMUL32.call(this, dst, src);
+    if (fNeg) {
+        this.regMDLo = (~this.regMDLo + 1)|0;
+        this.regMDHi = (~this.regMDHi + (this.regMDLo? 0 : 1))|0;
+    }
+};
+
+/**
+ * fnIMULb(dst, src)
+ *
+ * This 16-bit multiplication must indicate when the upper 8 bits are simply a sign-extension of the
+ * lower 8 bits (carry clear) and when the upper 8 bits contain significant bits (carry set).  The latter
+ * will occur whenever a positive result is > 127 (0x007f) and whenever a negative result is < -128
+ * (0xff80).
+ *
+ * Example 1: 16 * 4 = 64 (0x0040): carry is clear
+ * Example 2: 16 * 8 = 128 (0x0080): carry is set (the sign bit no longer fits in the lower 8 bits)
+ * Example 3: 16 * -8 (0xf8) = -128 (0xff80): carry is clear (the sign bit *still* fits in the lower 8 bits)
+ * Example 4: 16 * -16 (0xf0) = -256 (0xff00): carry is set (the sign bit no longer fits in the lower 8 bits)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null; AL is the implied src)
+ * @return {number} (we return dst unchanged, since it's actually AX that's modified)
+ */
+X86.fnIMULb = function(dst, src)
+{
+    var result = (((this.regEAX << 24) >> 24) * ((dst << 24) >> 24))|0;
+
+    this.regMDLo = result & 0xffff;
+
+    if (result > 127 || result < -128) {
+        this.setCF(); this.setOF();
+    } else {
+        this.clearCF(); this.clearOF();
+    }
+
+    this.fMDSet = true;
+
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesIMulBR : this.cycleCounts.nOpCyclesIMulBM);
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnIMULw(dst, src)
+ *
+ * regMDHi:regMDLo = dst * regEAX
+ *
+ * This 32-bit multiplication must indicate when the upper 16 bits are simply a sign-extension of the
+ * lower 16 bits (carry clear) and when the upper 16 bits contain significant bits (carry set).  The latter
+ * will occur whenever a positive result is > 32767 (0x00007fff) and whenever a negative result is < -32768
+ * (0xffff8000).
+ *
+ * Example 1: 256 * 64 = 16384 (0x00004000): carry is clear
+ * Example 2: 256 * 128 = 32768 (0x00008000): carry is set (the sign bit no longer fits in the lower 16 bits)
+ * Example 3: 256 * -128 (0xff80) = -32768 (0xffff8000): carry is clear (the sign bit *still* fits in the lower 16 bits)
+ * Example 4: 256 * -256 (0xff00) = -65536 (0xffff0000): carry is set (the sign bit no longer fits in the lower 16 bits)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null; AX or EAX is the implied src)
+ * @return {number} (we return dst unchanged, since it's actually DX:AX or EDX:EAX that's modified)
+ */
+X86.fnIMULw = function(dst, src)
+{
+    var fOverflow;
+    if (this.sizeData == 2) {
+        src = this.regEAX & 0xffff;
+        var result = (((src << 16) >> 16) * ((dst << 16) >> 16))|0;
+        this.regMDLo = result & 0xffff;
+        this.regMDHi = (result >> 16) & 0xffff;
+        fOverflow = (result > 32767 || result < -32768);
+    } else {
+        X86.fnIMUL32.call(this, dst, this.regEAX);
+        fOverflow = (this.regMDHi != (this.regMDLo >> 31));
+    }
+
+    if (fOverflow) {
+        this.setCF(); this.setOF();
+    } else {
+        this.clearCF(); this.clearOF();
+    }
+
+    this.fMDSet = true;
+
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesIMulWR : this.cycleCounts.nOpCyclesIMulWM);
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnIMULrw(dst, src)
+ *
+ * This function exists for 16-bit IMUL instructions that produce a 16-bit result instead of a 32-bit result
+ * (and don't implicitly use the accumulator).
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnIMULrw = function(dst, src)
+{
+    /*
+     * Unlike fnIMULrd() below, we can use normal JavaScript multiplication, because there's no danger of
+     * overflowing the floating-point result and losing accuracy in the bottom 16 bits.
+     */
+    var result = (((dst << 16) >> 16) * ((src << 16) >> 16))|0;
+    if (result > 32767 || result < -32768) {
+        this.setCF(); this.setOF();
+    } else {
+        this.clearCF(); this.clearOF();
+    }
+    result &= 0xffff;
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 9 : 12);
+    return result;
+};
+
+/**
+ * fnIMULrd(dst, src)
+ *
+ * This function exists for 32-bit IMUL instructions that produce a 32-bit result instead of a 64-bit result
+ * (and don't implicitly use the accumulator).
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnIMULrd = function(dst, src)
+{
+    /*
+     * The following code works, but I've stopped using it because it produces different results from an actual CPU
+     * when overflow occurs; the bottom 32 bits of the result are still supposed to be accurate.
+     *
+     * And unfortunately, we cannot achieve that level of compatibility using normal JavaScript multiplication,
+     * because the result may be too large to fit in a JavaScript floating-point variable, which means we could lose
+     * accuracy in the bottom 32 bits, which would defeat what we're trying to achieve here.  So we must use the
+     * slower fnIMUL32() function.
+     *
+     *      var result = dst * src;
+     *      if (result > 2147483647 || result < -2147483648) {
+     *          this.setCF(); this.setOF();
+     *      } else {
+     *          this.clearCF(); this.clearOF();
+     *      }
+     *      result |= 0;
+     */
+    X86.fnIMUL32.call(this, dst, src);
+    var fOverflow = (this.regMDHi != (this.regMDLo >> 31));
+    if (fOverflow) {
+        this.setCF(); this.setOF();
+    } else {
+        this.clearCF(); this.clearOF();
+    }
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 9 : 12);
+    return this.regMDLo;
+};
+
+/**
+ * fnINCb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnINCb = function(dst, src)
+{
+    var b = (dst + 1)|0;
+    this.setArithResult(dst, 1, b, X86.RESULT.BYTE | X86.RESULT.NOTCF);
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesIncR : this.cycleCounts.nOpCyclesIncM);
+    return b & 0xff;
+};
+
+/**
+ * fnINCw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnINCw = function(dst, src)
+{
+    var w = (dst + 1)|0;
+    this.setArithResult(dst, 1, w, this.typeData | X86.RESULT.NOTCF);
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesIncR : this.cycleCounts.nOpCyclesIncM);
+    return w & this.maskData;
+};
+
+/**
+ * fnJMPw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnJMPw = function(dst, src)
+{
+    this.setIP(dst);
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesJmpWR : this.cycleCounts.nOpCyclesJmpWM);
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnJMPFdw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnJMPFdw = function(dst, src)
+{
+    if (this.regEA === X86.ADDR_INVALID) {
+        return X86.fnGRPUndefined.call(this, dst, src);
+    }
+    this.setCSIP(dst, this.getShort(this.regEA + this.sizeData));
+    if (MAXDEBUG && this.cIntReturn) this.checkIntReturn(this.regLIP);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpDM;
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnLAR(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnLAR = function(dst, src)
+{
+    this.nStepCycles -= (14 + (this.regEA === X86.ADDR_INVALID? 0 : 2));
+    /*
+     * Currently, segVER.load() will return an error only if the selector is beyond the bounds of the
+     * descriptor table or the descriptor is not for a segment.
+     *
+     * TODO: This instruction's 80286 documentation does not discuss conforming code segments; determine
+     * if we need a special check for them.
+     */
+    this.clearZF();
+    if (this.segVER.load(src) !== X86.ADDR_INVALID) {
+        if (this.segVER.dpl >= this.nCPL && this.segVER.dpl >= (src & X86.SEL.RPL)) {
+            this.setZF();
+            dst = this.segVER.acc & ~X86.DESC.ACC.BASE1623;
+            if (this.sizeData > 2) {
+                dst |= ((this.segVER.ext & ~X86.DESC.EXT.BASE2431) << 16);
+            }
+        }
+    }
+    return dst;
+};
+
+/**
+ * fnLDS(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnLDS = function(dst, src)
+{
+    if (this.regEA === X86.ADDR_INVALID) {
+        X86.opUndefined.call(this);
+        return dst;
+    }
+    this.setDS(this.getShort(this.regEA + this.sizeData));
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLS;
+    return src;
+};
+
+/**
+ * fnLEA(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnLEA = function(dst, src)
+{
+    /*
+     * TODO: Until I bite the bullet and choose a truly invalid value for X86.ADDR_INVALID (eg, null),
+     * this code must be disabled, because otherwise an instruction like "LEA ECX,[EAX-1]" will fail when
+     * EAX is zero.  And we can't have that.
+     *
+    if (this.regEA === X86.ADDR_INVALID) {
+        //
+        // TODO: After reading http://www.os2museum.com/wp/undocumented-8086-opcodes/, it seems that this
+        // form of LEA (eg, "LEA AX,DX") simply returns the last calculated EA.  Since we always reset regEA
+        // at the start of a new instruction, we would need to preserve the previous EA if we want to mimic
+        // that (undocumented) behavior.
+        //
+        // And for completeness, we would have to extend EA tracking beyond the usual ModRM instructions
+        // (eg, XLAT, instructions that modify the stack pointer, and string instructions).  Anything else?
+        //
+        X86.opUndefined.call(this);
+        return dst;
+    }
+    */
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLEA;
+    return this.regEA;
+};
+
+/**
+ * fnLES(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnLES = function(dst, src)
+{
+    if (this.regEA === X86.ADDR_INVALID) {
+        X86.opUndefined.call(this);
+        return dst;
+    }
+    this.setES(this.getShort(this.regEA + this.sizeData));
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLS;
+    return src;
+};
+
+/**
+ * fnLFS(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnLFS = function(dst, src)
+{
+    if (this.regEA === X86.ADDR_INVALID) {
+        X86.opUndefined.call(this);
+        return dst;
+    }
+    this.setFS(this.getShort(this.regEA + this.sizeData));
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLS;
+    return src;
+};
+
+/**
+ * fnLGDT(dst, src)
+ *
+ * op=0x0F,0x01,reg=0x2 (GRP7:LGDT)
+ *
+ * The 80286 LGDT instruction assumes a 40-bit operand: a 16-bit limit followed by a 24-bit base address;
+ * the ModRM decoder has already supplied the first word of the operand (in dst), which corresponds to
+ * the limit, so we must fetch the remaining bits ourselves.
+ *
+ * The 80386 LGDT instruction assumes a 48-bit operand: a 16-bit limit followed by a 32-bit base address,
+ * but it ignores the last 8 bits of the base address if the OPERAND size is 16 bits; we interpret that to
+ * mean that the 24-bit base address should be zero-extended to 32 bits.
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnLGDT = function(dst, src)
+{
+    /*
+     * TODO: Consider swapping out this function whenever setProtMode() changes the mode to V86-mode.
+     */
+    if (this.regEA === X86.ADDR_INVALID || I386 && (this.regPS & X86.PS.VM)) {
+        X86.opInvalid.call(this);
+    } else {
+        /*
+         * Hopefully it won't hurt to always fetch a 32-bit base address (even on an 80286), which we then
+         * mask appropriately.
+         */
+        this.addrGDT = this.getLong(this.regEA + 2) & (this.maskData | (this.maskData << 8));
+        /*
+         * An idiosyncrasy of our ModRM decoders is that, if the OPERAND size is 32 bits, then it will have
+         * fetched a 32-bit dst operand; we mask off those extra bits now.
+         */
+        dst &= 0xffff;
+        this.addrGDTLimit = this.addrGDT + dst;
+        this.opFlags |= X86.OPFLAG.NOWRITE;
+        this.nStepCycles -= 11;
+    }
+    return dst;
+};
+
+/**
+ * fnLGS(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnLGS = function(dst, src)
+{
+    if (this.regEA === X86.ADDR_INVALID) {
+        X86.opUndefined.call(this);
+        return dst;
+    }
+    this.setGS(this.getShort(this.regEA + this.sizeData));
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLS;
+    return src;
+};
+
+/**
+ * fnLIDT(dst, src)
+ *
+ * op=0x0F,0x01,reg=0x3 (GRP7:LIDT)
+ *
+ * The 80286 LIDT instruction assumes a 40-bit operand: a 16-bit limit followed by a 24-bit base address;
+ * the ModRM decoder has already supplied the first word of the operand (in dst), which corresponds to
+ * the limit, so we must fetch the remaining bits ourselves.
+ *
+ * The 80386 LIDT instruction assumes a 48-bit operand: a 16-bit limit followed by a 32-bit base address,
+ * but it ignores the last 8 bits of the base address if the OPERAND size is 16 bits; we interpret that to
+ * mean that the 24-bit base address should be zero-extended to 32 bits.
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnLIDT = function(dst, src)
+{
+    /*
+     * TODO: Consider swapping out this function whenever setProtMode() changes the mode to V86-mode.
+     */
+    if (this.regEA === X86.ADDR_INVALID || I386 && (this.regPS & X86.PS.VM)) {
+        X86.opInvalid.call(this);
+    } else {
+        /*
+         * Hopefully it won't hurt to always fetch a 32-bit base address (even on an 80286), which we then
+         * mask appropriately.
+         */
+        this.addrIDT = this.getLong(this.regEA + 2) & (this.maskData | (this.maskData << 8));
+        /*
+         * An idiosyncrasy of our ModRM decoders is that, if the OPERAND size is 32 bits, then it will have
+         * fetched a 32-bit dst operand; we mask off those extra bits now.
+         */
+        dst &= 0xffff;
+        this.addrIDTLimit = this.addrIDT + dst;
+        this.opFlags |= X86.OPFLAG.NOWRITE;
+        this.nStepCycles -= 12;
+    }
+    return dst;
+};
+
+/**
+ * fnLLDT(dst, src)
+ *
+ * op=0x0F,0x00,reg=0x2 (GRP6:LLDT)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnLLDT = function(dst, src)
+{
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    this.segLDT.load(dst);
+    this.nStepCycles -= (17 + (this.regEA === X86.ADDR_INVALID? 0 : 2));
+    return dst;
+};
+
+/**
+ * fnLMSW(dst, src)
+ *
+ * op=0x0F,0x01,reg=0x6 (GRP7:LMSW)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnLMSW = function(dst, src)
+{
+    /*
+     * TODO: Consider swapping out this function whenever setProtMode() changes the mode to V86-mode.
+     */
+    if (I386 && (this.regPS & X86.PS.VM)) {
+        X86.opInvalid.call(this);
+    } else {
+        this.setMSW(dst);
+        this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 3 : 6);
+        this.opFlags |= X86.OPFLAG.NOWRITE;
+    }
+    return dst;
+};
+
+/**
+ * fnLSL(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (the selector)
+ * @return {number}
+ */
+X86.fnLSL = function(dst, src)
+{
+    /*
+     * TODO: Is this an invalid operation if regEAWrite is set?  dst is required to be a register.
+     */
+    this.nStepCycles -= (14 + (this.regEA === X86.ADDR_INVALID? 0 : 2));
+    /*
+     * Currently, segVER.load() will return an error only if the selector is beyond the bounds of the
+     * descriptor table or the descriptor is not for a segment.
+     *
+     * TODO: LSL is explicitly documented as ALSO requiring a non-null selector, so we check X86.SEL.MASK;
+     * are there any other instructions that were, um, less explicit but also require a non-null selector?
+     */
+    if ((src & X86.SEL.MASK) && this.segVER.load(src) !== X86.ADDR_INVALID) {
+        var fConforming = ((this.segVER.acc & X86.DESC.ACC.TYPE.CODE_CONFORMING) == X86.DESC.ACC.TYPE.CODE_CONFORMING);
+        if ((fConforming || this.segVER.dpl >= this.nCPL) && this.segVER.dpl >= (src & X86.SEL.RPL)) {
+            this.setZF();
+            return this.segVER.limit;
+        }
+    }
+    this.clearZF();
+    return dst;
+};
+
+/**
+ * fnLSS(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnLSS = function(dst, src)
+{
+    if (this.regEA === X86.ADDR_INVALID) {
+        X86.opUndefined.call(this);
+        return dst;
+    }
+    this.setSS(this.getShort(this.regEA + this.sizeData));
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLS;
+    return src;
+};
+
+/**
+ * fnLTR(dst, src)
+ *
+ * op=0x0F,0x00,reg=0x3 (GRP6:LTR)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnLTR = function(dst, src)
+{
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    if (this.segTSS.load(dst) !== X86.ADDR_INVALID) {
+        this.setShort(this.segTSS.addrDesc + X86.DESC.ACC.OFFSET, this.segTSS.acc |= X86.DESC.ACC.TYPE.TSS_BUSY);
+        this.segTSS.type |= X86.DESC.ACC.TYPE.TSS_BUSY;
+    }
+    this.nStepCycles -= (17 + (this.regEA === X86.ADDR_INVALID? 0 : 2));
+    return dst;
+};
+
+/**
+ * fnMOV(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (current value, ignored)
+ * @param {number} src (new value)
+ * @return {number} dst (updated value, from src)
+ */
+X86.fnMOV = function(dst, src)
+{
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesMovRR : this.cycleCounts.nOpCyclesMovRM) : this.cycleCounts.nOpCyclesMovMR);
+    return src;
+};
+
+/**
+ * fnMOVXb(dst, src)
+ *
+ * Helper for opMOVSXb() and opMOVZXb() (which also take care of updating nStepCycles, so we don't have to)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (current value, ignored)
+ * @param {number} src (new value)
+ * @return {number} dst (updated value, from src)
+ */
+X86.fnMOVXb = function(dst, src)
+{
+    /*
+     * The ModRegByte handlers update the registers in the 1st column, but we need to update those in the 2nd column.
+     *
+     *      000:    AL      ->      000:    AX
+     *      001:    CL      ->      001:    CX
+     *      010:    DL      ->      010:    DX
+     *      011:    BL      ->      011:    BX
+     *      100:    AH      ->      100:    SP
+     *      101:    CH      ->      101:    BP
+     *      110:    DH      ->      110:    SI
+     *      111:    BH      ->      111:    DI
+     */
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    switch(reg) {
+    case 0x4:
+        this.regXX = this.regEAX;
+        break;
+    case 0x5:
+        this.regXX = this.regECX;
+        break;
+    case 0x6:
+        this.regXX = this.regEDX;
+        break;
+    case 0x7:
+        this.regXX = this.regEBX;
+        break;
+    }
+    return src;
+};
+
+/**
+ * fnMOVXw(dst, src)
+ *
+ * Helper for opMOVSXw() and opMOVZXw() (which also take care of updating nStepCycles, so we don't have to)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (current value, ignored)
+ * @param {number} src (new value)
+ * @return {number} dst (updated value, from src)
+ */
+X86.fnMOVXw = function(dst, src)
+{
+    return src;
+};
+
+/**
+ * fnMOVn(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (current value, ignored)
+ * @param {number} src (new value)
+ * @return {number} dst (updated value, from src)
+ */
+X86.fnMOVn = function(dst, src)
+{
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesMovRI : this.cycleCounts.nOpCyclesMovMI);
+    return src;
+};
+
+/**
+ * fnMOVsrw(dst, src)
+ *
+ * This helper saves the contents of the general-purpose register that will be overwritten, so that the caller
+ * can restore it after moving the updated value to the correct segment register.
+ *
+ * @this {X86CPU}
+ * @param {number} dst (current value, ignored)
+ * @param {number} src (new value)
+ * @return {number} dst (updated value, from src)
+ */
+X86.fnMOVsrw = function(dst, src)
+{
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    switch(reg) {
+    case 0x0:
+        this.regXX = this.regEAX;
+        break;
+    case 0x2:
+        this.regXX = this.regEDX;
+        break;
+    case 0x3:
+        this.regXX = this.regEBX;
+        break;
+    default:
+        if (this.model == X86.MODEL_80286 || this.model == X86.MODEL_80386 && reg != 0x4 && reg != 0x5) {
+            X86.opInvalid.call(this);
+            break;
+        }
+        switch(reg) {
+        case 0x1:           // MOV to CS is undocumented on 8086/8088/80186/80188, and invalid on 80286 and up
+            this.regXX = this.regECX;
+            break;
+        case 0x4:           // this form of MOV to ES is undocumented on 8086/8088/80186/80188, invalid on 80286, and uses FS starting with 80386
+            this.regXX = this.getSP();
+            break;
+        case 0x5:           // this form of MOV to CS is undocumented on 8086/8088/80186/80188, invalid on 80286, and uses GS starting with 80386
+            this.regXX = this.regEBP;
+            break;
+        case 0x6:           // this form of MOV to SS is undocumented on 8086/8088/80186/80188, invalid on 80286 and up
+            this.regXX = this.regESI;
+            break;
+        case 0x7:           // this form of MOV to DS is undocumented on 8086/8088/80186/80188, invalid on 80286 and up
+            this.regXX = this.regEDI;
+            break;
+        default:
+            break;
+        }
+        break;
+    }
+    /*
+     * We could just return src, but nStepCycles needs to be updated, too.
+     */
+    return X86.fnMOV.call(this, dst, src);
+};
+
+/**
+ * fnMOVwsr(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (current value, ignored)
+ * @param {number} src (new value)
+ * @return {number} dst
+ */
+X86.fnMOVwsr = function(dst, src)
+{
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    switch (reg) {
+    case 0x0:
+        src = this.segES.sel;
+        break;
+    case 0x1:
+        src = this.segCS.sel;
+        break;
+    case 0x2:
+        src = this.segSS.sel;
+        break;
+    case 0x3:
+        src = this.segDS.sel;
+        break;
+    case 0x4:
+        if (I386 && this.model >= X86.MODEL_80386) {
+            src = this.segFS.sel;
+            break;
+        }
+        X86.opInvalid.call(this);
+        src = dst;
+        break;
+    case 0x5:
+        if (I386 && this.model >= X86.MODEL_80386) {
+            src = this.segGS.sel;
+            break;
+        }
+        /* falls through */
+    default:
+        X86.opInvalid.call(this);
+        src = dst;
+        break;
+    }
+
+    /*
+     * When a 32-bit OPERAND size is in effect, segment register writes via opMOVwsr() must write 32 bits
+     * (zero-extended) if the destination is a register, but only 16 bits if the destination is memory,
+     * hence the setDataSize(2) below.
+     *
+     * The only other caller, opMOVrc(), is not affected, because it writes only to register destinations.
+     */
+    if (this.regEAWrite !== X86.ADDR_INVALID) {
+        this.setDataSize(2);
+    }
+    /*
+     * We could just return src, but nStepCycles needs to be updated, too.
+     */
+    return X86.fnMOV.call(this, dst, src);
+};
+
+/**
+ * fnMULb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number} (we return dst unchanged, since it's actually AX that's modified)
+ */
+X86.fnMULb = function(dst, src)
+{
+    this.regMDLo = ((this.regEAX & 0xff) * dst) & 0xffff;
+
+    if (this.regMDLo & 0xff00) {
+        this.setCF(); this.setOF();
+    } else {
+        this.clearCF(); this.clearOF();
+    }
+
+    this.fMDSet = true;
+
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesMulBR : this.cycleCounts.nOpCyclesMulBM);
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnMUL32(dst, src)
+ *
+ * This sets regMDHi:regMDLo to the 64-bit result of dst * src, both of which are treated as unsigned.
+ *
+ * The algorithm is based on the traditional "by hand" multiplication method, by treating the two inputs
+ * (dst and src) as two 2-digit numbers, where each digit is a base-65536 digit.
+ *
+ * @this {X86CPU}
+ * @param {number} dst (any 32-bit number, treated as unsigned)
+ * @param {number} src (any 32-bit number, treated as unsigned)
+ */
+X86.fnMUL32 = function(dst, src)
+{
+    if (!(dst & ~0xffff) && !(src & ~0xffff)) {
+        this.regMDLo = (dst * src)|0;
+        this.regMDHi = 0;
+    }
+    else {
+        var srcLo = src & 0xffff;
+        var srcHi = src >>> 16;
+        var dstLo = dst & 0xffff;
+        var dstHi = dst >>> 16;
+
+        var mul00 = srcLo * dstLo;
+        var mul16 = ((mul00 >>> 16) + (srcHi * dstLo));
+        var mul32 = mul16 >>> 16;
+        mul16 = ((mul16 & 0xffff) + (srcLo * dstHi));
+        mul32 += ((mul16 >>> 16) + (srcHi * dstHi));
+
+        this.regMDLo = (mul16 << 16) | (mul00 & 0xffff);
+        this.regMDHi = mul32|0;
+    }
+};
+
+/**
+ * fnMULw(dst, src)
+ *
+ * regMDHi:regMDLo = dst * regEAX
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null; AX or EAX is the implied src)
+ * @return {number} (we return dst unchanged, since it's actually DX:AX that's modified)
+ */
+X86.fnMULw = function(dst, src)
+{
+    if (this.sizeData == 2) {
+        src = this.regEAX & 0xffff;
+        var result = (src * dst)|0;
+        this.regMDLo = result & 0xffff;
+        this.regMDHi = (result >> 16) & 0xffff;
+    } else {
+        X86.fnMUL32.call(this, dst, this.regEAX);
+        if (this.stepping == X86.STEPPING_80386_B1) {
+            if (this.regEAX == 0x0417A000 && dst == 0x00000081) {
+                /*
+                 * Normally, the result should be 0x20FE7A000 (ie, regMDHi should be 0x2).
+                 * I'm not sure what a typical B1 stepping failure looked like, so I'll set regMDHi to 0.
+                 *
+                 * If you want a B1 stepping without this 32-bit multiplication flaw, select the B2 stepping.
+                 */
+
+                this.regMDHi = 0;
+            }
+        }
+    }
+
+    if (this.regMDHi) {
+        this.setCF(); this.setOF();
+    } else {
+        this.clearCF(); this.clearOF();
+    }
+
+    this.fMDSet = true;
+
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesMulWR : this.cycleCounts.nOpCyclesMulWM);
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnNEGb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnNEGb = function(dst, src)
+{
+    var b = (-dst)|0;
+    this.setArithResult(0, dst, b, X86.RESULT.BYTE | X86.RESULT.ALL, true);
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesNegR : this.cycleCounts.nOpCyclesNegM);
+    return b & 0xff;
+};
+
+/**
+ * fnNEGw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnNEGw = function(dst, src)
+{
+    var w = (-dst)|0;
+    this.setArithResult(0, dst, w, this.typeData | X86.RESULT.ALL, true);
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesNegR : this.cycleCounts.nOpCyclesNegM);
+    return w & this.maskData;
+};
+
+/**
+ * fnNOTb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnNOTb = function(dst, src)
+{
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesNegR : this.cycleCounts.nOpCyclesNegM);
+    return dst ^ 0xff;
+};
+
+/**
+ * fnNOTw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnNOTw = function(dst, src)
+{
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesNegR : this.cycleCounts.nOpCyclesNegM);
+    return dst ^ this.maskData;
+};
+
+/**
+ * fnORb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnORb = function(dst, src)
+{
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesArithRR : this.cycleCounts.nOpCyclesArithRM) : this.cycleCounts.nOpCyclesArithMR);
+    return this.setLogicResult(dst | src, X86.RESULT.BYTE);
+};
+
+/**
+ * fnORw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnORw = function(dst, src)
+{
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesArithRR : this.cycleCounts.nOpCyclesArithRM) : this.cycleCounts.nOpCyclesArithMR);
+    return this.setLogicResult(dst | src, this.typeData) & this.maskData;
+};
+
+/**
+ * fnPOPw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (current value, ignored)
+ * @param {number} src (new value)
+ * @return {number} dst (updated value, from src)
+ */
+X86.fnPOPw = function(dst, src)
+{
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesPopReg : this.cycleCounts.nOpCyclesPopMem);
+    return src;
+};
+
+/**
+ * fnPUSHw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnPUSHw = function(dst, src)
+{
+    var w = dst;
+    if (this.opFlags & X86.OPFLAG.PUSHSP) {
+        /*
+         * This is the one case where must actually modify dst, so that the ModRM function will
+         * not put a stale value back into the SP register.
+         */
+        dst = (dst - 2) & 0xffff;
+        /*
+         * And on the 8086/8088, the value we just calculated also happens to be the value that must
+         * be pushed.
+         */
+        if (this.model < X86.MODEL_80286) w = dst;
+    }
+    this.pushWord(w);
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesPushReg : this.cycleCounts.nOpCyclesPushMem);
+    /*
+     * The PUSH is the only write that needs to occur; dst was the source operand and does not need to be rewritten.
+     */
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnRCLb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL)
+ * @return {number}
+ */
+X86.fnRCLb = function(dst, src)
+{
+    var result = dst;
+    var count = src & this.nShiftCountMask;
+    if (count) {
+        var carry = this.getCarry();
+        count %= 9;
+        if (!count) {
+            carry <<= 7;
+        } else {
+            result = ((dst << count) | (carry << (count - 1)) | (dst >> (9 - count))) & 0xff;
+            carry = dst << (count - 1);
+        }
+        this.setRotateResult(result, carry, X86.RESULT.BYTE);
+    }
+    return result;
+};
+
+/**
+ * fnRCLw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL)
+ * @return {number}
+ */
+X86.fnRCLw = function(dst, src)
+{
+    var result = dst;
+    var count = src & this.nShiftCountMask;
+    if (count) {
+        var carry = this.getCarry();
+        count %= 17;
+        if (!count) {
+            carry <<= 15;
+        } else {
+            result = ((dst << count) | (carry << (count - 1)) | (dst >> (17 - count))) & 0xffff;
+            carry = dst << (count - 1);
+        }
+        this.setRotateResult(result, carry, X86.RESULT.WORD);
+    }
+    return result;
+};
+
+/**
+ * fnRCLd(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL)
+ * @return {number}
+ */
+X86.fnRCLd = function(dst, src)
+{
+    var result = dst;
+    var count = src & this.nShiftCountMask;     // this 32-bit-only function could mask with 0x1f directly
+    if (count) {
+        var carry = this.getCarry();
+        /*
+         * JavaScript Alert: much like a post-8086 Intel CPU, JavaScript shift counts are mod 32,
+         * so "dst >>> 32" is equivalent to "dst >>> 0", which doesn't shift any bits at all.  To
+         * compensate, we shift one bit less than the maximum, and then shift one bit farther.
+         */
+        result = (dst << count) | (carry << (count - 1)) | ((dst >>> (32 - count)) >>> 1);
+        carry = dst << (count - 1);
+        this.setRotateResult(result, carry, X86.RESULT.DWORD);
+    }
+    return result;
+};
+
+/**
+ * fnRCRb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL)
+ * @return {number}
+ */
+X86.fnRCRb = function(dst, src)
+{
+    var result = dst;
+    var count = src & this.nShiftCountMask;
+    if (count) {
+        var carry = this.getCarry();
+        count %= 9;
+        if (!count) {
+            carry <<= 7;
+        } else {
+            result = ((dst >> count) | (carry << (8 - count)) | (dst << (9 - count))) & 0xff;
+            carry = dst << (8 - count);
+        }
+        this.setRotateResult(result, carry, X86.RESULT.BYTE);
+    }
+    return result;
+};
+
+/**
+ * fnRCRw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL)
+ * @return {number}
+ */
+X86.fnRCRw = function(dst, src)
+{
+    var result = dst;
+    var count = src & this.nShiftCountMask;
+    if (count) {
+        var carry = this.getCarry();
+        count %= 17;
+        if (!count) {
+            carry <<= 15;
+        } else {
+            result = ((dst >> count) | (carry << (16 - count)) | (dst << (17 - count))) & 0xffff;
+            carry = dst << (16 - count);
+        }
+        this.setRotateResult(result, carry, X86.RESULT.WORD);
+    }
+    return result;
+};
+
+/**
+ * fnRCRd(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL)
+ * @return {number}
+ */
+X86.fnRCRd = function(dst, src)
+{
+    var result = dst;
+    var count = src & this.nShiftCountMask;     // this 32-bit-only function could mask with 0x1f directly
+    if (count) {
+        var carry = this.getCarry();
+        /*
+         * JavaScript Alert: much like a post-8086 Intel CPU, JavaScript shift counts are mod 32,
+         * so "dst << 32" is equivalent to "dst << 0", which doesn't shift any bits at all.  To
+         * compensate, we shift one bit less than the maximum, and then shift one bit farther.
+         */
+        result = (dst >>> count) | (carry << (32 - count)) | ((dst << (32 - count)) << 1);
+        carry = dst << (32 - count);
+        this.setRotateResult(result, carry, X86.RESULT.DWORD);
+    }
+    return result;
+};
+
+/**
+ * fnROLb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL)
+ * @return {number}
+ */
+X86.fnROLb = function(dst, src)
+{
+    var result = dst;
+    var count = src & this.nShiftCountMask;
+    if (count) {
+        var carry;
+        count &= 0x7;
+        if (!count) {
+            carry = dst << 7;
+        } else {
+            carry = dst << (count - 1);
+            result = ((dst << count) | (dst >> (8 - count))) & 0xff;
+        }
+        this.setRotateResult(result, carry, X86.RESULT.BYTE);
+    }
+    return result;
+};
+
+/**
+ * fnROLw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL)
+ * @return {number}
+ */
+X86.fnROLw = function(dst, src)
+{
+    var result = dst;
+    var count = src & this.nShiftCountMask;
+    if (count) {
+        var carry;
+        count &= 0xf;
+        if (!count) {
+            carry = dst << 15;
+        } else {
+            carry = dst << (count - 1);
+            result = ((dst << count) | (dst >> (16 - count))) & 0xffff;
+        }
+        this.setRotateResult(result, carry, X86.RESULT.WORD);
+    }
+    return result;
+};
+
+/**
+ * fnROLd(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL)
+ * @return {number}
+ */
+X86.fnROLd = function(dst, src)
+{
+    var result = dst;
+    var count = src & this.nShiftCountMask;
+    if (count) {
+        var carry = dst << (count - 1);
+        result = (dst << count) | (dst >>> (32 - count));
+        this.setRotateResult(result, carry, X86.RESULT.DWORD);
+    }
+    return result;
+};
+
+/**
+ * fnRORb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL)
+ * @return {number}
+ */
+X86.fnRORb = function(dst, src)
+{
+    var result = dst;
+    var count = src & this.nShiftCountMask;
+    if (count) {
+        var carry;
+        count &= 0x7;
+        if (!count) {
+            carry = dst;
+        } else {
+            carry = dst << (8 - count);
+            result = ((dst >>> count) | carry) & 0xff;
+        }
+        this.setRotateResult(result, carry, X86.RESULT.BYTE);
+    }
+    return result;
+};
+
+/**
+ * fnRORw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL)
+ * @return {number}
+ */
+X86.fnRORw = function(dst, src)
+{
+    var result = dst;
+    var count = src & this.nShiftCountMask;
+    if (count) {
+        var carry;
+        count &= 0xf;
+        if (!count) {
+            carry = dst;
+        } else {
+            carry = dst << (16 - count);
+            result = ((dst >>> count) | carry) & 0xffff;
+        }
+        this.setRotateResult(result, carry, X86.RESULT.WORD);
+    }
+    return result;
+};
+
+/**
+ * fnRORd(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL)
+ * @return {number}
+ */
+X86.fnRORd = function(dst, src)
+{
+    var result = dst;
+    var count = src & this.nShiftCountMask;
+    if (count) {
+        var carry = dst << (32 - count);
+        result = (dst >>> count) | carry;
+        this.setRotateResult(result, carry, X86.RESULT.DWORD);
+    }
+    return result;
+};
+
+/**
+ * fnSARb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL, or an immediate byte for 80186/80188 and up)
+ * @return {number}
+ */
+X86.fnSARb = function(dst, src)
+{
+    var count = src & this.nShiftCountMask;
+    if (count) {
+        if (count > 9) count = 9;
+        var carry = ((dst << 24) >> 24) >> (count - 1);
+        dst = (carry >> 1) & 0xff;
+        this.setLogicResult(dst, X86.RESULT.BYTE, carry & 0x1);
+    }
+    return dst;
+};
+
+/**
+ * fnSARw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL, or an immediate byte for 80186/80188 and up)
+ * @return {number}
+ */
+X86.fnSARw = function(dst, src)
+{
+    var count = src & this.nShiftCountMask;
+    if (count) {
+        if (count > 17) count = 17;
+        var carry = ((dst << 16) >> 16) >> (count - 1);
+        dst = (carry >> 1) & 0xffff;
+        this.setLogicResult(dst, X86.RESULT.WORD, carry & 0x1);
+    }
+    return dst;
+};
+
+/**
+ * fnSARd(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL, or an immediate byte for 80186/80188 and up)
+ * @return {number}
+ */
+X86.fnSARd = function(dst, src)
+{
+    var count = src & this.nShiftCountMask;
+    if (count) {
+        var carry = dst >> (count - 1);
+        dst = (carry >> 1);
+        this.setLogicResult(dst, X86.RESULT.DWORD, carry & 0x1);
+    }
+    return dst;
+};
+
+/**
+ * fnSBBb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnSBBb = function(dst, src)
+{
+    var b = (dst - src - this.getCarry())|0;
+    this.setArithResult(dst, src, b, X86.RESULT.BYTE | X86.RESULT.ALL, true);
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesArithRR : this.cycleCounts.nOpCyclesArithRM) : this.cycleCounts.nOpCyclesArithMR);
+    return b & 0xff;
+};
+
+/**
+ * fnSBBw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnSBBw = function(dst, src)
+{
+    var w = (dst - src - this.getCarry())|0;
+    this.setArithResult(dst, src, w, this.typeData | X86.RESULT.ALL, true);
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesArithRR : this.cycleCounts.nOpCyclesArithRM) : this.cycleCounts.nOpCyclesArithMR);
+    return w & this.maskData;
+};
+
+/**
+ * fnSETO(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (ignored)
+ * @param {number} src (ignored)
+ * @return {number}
+ */
+X86.fnSETO = function(dst, src)
+{
+    return (this.getOF()? 1 : 0);
+};
+
+/**
+ * fnSETNO(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (ignored)
+ * @param {number} src (ignored)
+ * @return {number}
+ */
+X86.fnSETNO = function(dst, src)
+{
+    return (this.getOF()? 0 : 1);
+};
+
+/**
+ * fnSETC(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (ignored)
+ * @param {number} src (ignored)
+ * @return {number}
+ */
+X86.fnSETC = function(dst, src)
+{
+    return (this.getCF()? 1 : 0);
+};
+
+/**
+ * fnSETNC(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (ignored)
+ * @param {number} src (ignored)
+ * @return {number}
+ */
+X86.fnSETNC = function(dst, src)
+{
+    return (this.getCF()? 0 : 1);
+};
+
+/**
+ * fnSETZ(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (ignored)
+ * @param {number} src (ignored)
+ * @return {number}
+ */
+X86.fnSETZ = function(dst, src)
+{
+    return (this.getZF()? 1 : 0);
+};
+
+/**
+ * fnSETNZ(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (ignored)
+ * @param {number} src (ignored)
+ * @return {number}
+ */
+X86.fnSETNZ = function(dst, src)
+{
+    return (this.getZF()? 0 : 1);
+};
+
+/**
+ * fnSETBE(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (ignored)
+ * @param {number} src (ignored)
+ * @return {number}
+ */
+X86.fnSETBE = function(dst, src)
+{
+    return (this.getCF() || this.getZF()? 1 : 0);
+};
+
+/**
+ * fnSETNBE(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (ignored)
+ * @param {number} src (ignored)
+ * @return {number}
+ */
+X86.fnSETNBE = function(dst, src)
+{
+    return (this.getCF() || this.getZF()? 0 : 1);
+};
+
+/**
+ * fnSETS(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (ignored)
+ * @param {number} src (ignored)
+ * @return {number}
+ */
+X86.fnSETS = function(dst, src)
+{
+    return (this.getSF()? 1 : 0);
+};
+
+/**
+ * fnSETNS(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (ignored)
+ * @param {number} src (ignored)
+ * @return {number}
+ */
+X86.fnSETNS = function(dst, src)
+{
+    return (this.getSF()? 0 : 1);
+};
+
+/**
+ * fnSETP(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (ignored)
+ * @param {number} src (ignored)
+ * @return {number}
+ */
+X86.fnSETP = function(dst, src)
+{
+    return (this.getPF()? 1 : 0);
+};
+
+/**
+ * fnSETNP(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (ignored)
+ * @param {number} src (ignored)
+ * @return {number}
+ */
+X86.fnSETNP = function(dst, src)
+{
+    return (this.getPF()? 0 : 1);
+};
+
+/**
+ * fnSETL(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (ignored)
+ * @param {number} src (ignored)
+ * @return {number}
+ */
+X86.fnSETL = function(dst, src)
+{
+    return (!this.getSF() != !this.getOF()? 1 : 0);
+};
+
+/**
+ * fnSETNL(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (ignored)
+ * @param {number} src (ignored)
+ * @return {number}
+ */
+X86.fnSETNL = function(dst, src)
+{
+    return (!this.getSF() != !this.getOF()? 0 : 1);
+};
+
+/**
+ * fnSETLE(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (ignored)
+ * @param {number} src (ignored)
+ * @return {number}
+ */
+X86.fnSETLE = function(dst, src)
+{
+    return (this.getZF() || !this.getSF() != !this.getOF()? 1 : 0);
+};
+
+/**
+ * fnSETNLE(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst (ignored)
+ * @param {number} src (ignored)
+ * @return {number}
+ */
+X86.fnSETNLE = function(dst, src)
+{
+    return (this.getZF() || !this.getSF() != !this.getOF()? 0 : 1);
+};
+
+/**
+ * fnSGDT(dst, src)
+ *
+ * op=0x0F,0x01,reg=0x0 (GRP7:SGDT)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnSGDT = function(dst, src)
+{
+    if (this.regEA === X86.ADDR_INVALID) {
+        X86.opInvalid.call(this);
+    } else {
+        /*
+         * We don't need to set the first word of the operand, because the ModRM group decoder that calls us
+         * does that automatically with the value we return (dst).
+         */
+        dst = this.addrGDTLimit - this.addrGDT;
+
+
+        var addr = this.addrGDT;
+        if (this.model == X86.MODEL_80286) {
+            /*
+             * We previously left the 6th byte of the target operand "undefined".  But it turns out we have to set
+             * it to *something*, because there's processor detection in PC-DOS 7.0 (at least in the SETUP portion)
+             * that looks like this:
+             *
+             *      145E:4B84 9C            PUSHF
+             *      145E:4B85 55            PUSH     BP
+             *      145E:4B86 8BEC          MOV      BP,SP
+             *      145E:4B88 B80000        MOV      AX,0000
+             *      145E:4B8B 50            PUSH     AX
+             *      145E:4B8C 9D            POPF
+             *      145E:4B8D 9C            PUSHF
+             *      145E:4B8E 58            POP      AX
+             *      145E:4B8F 2500F0        AND      AX,F000
+             *      145E:4B92 3D00F0        CMP      AX,F000
+             *      145E:4B95 7511          JNZ      4BA8
+             *      145E:4BA8 C8060000      ENTER    0006,00
+             *      145E:4BAC 0F0146FA      SGDT     [BP-06]
+             *      145E:4BB0 807EFFFF      CMP      [BP-01],FF
+             *      145E:4BB4 C9            LEAVE
+             *      145E:4BB5 BA8603        MOV      DX,0386
+             *      145E:4BB8 7503          JNZ      4BBD
+             *      145E:4BBA BA8602        MOV      DX,0286
+             *      145E:4BBD 89163004      MOV      [0430],DX
+             *      145E:4BC1 5D            POP      BP
+             *      145E:4BC2 9D            POPF
+             *      145E:4BC3 CB            RETF
+             *
+             * This code is expecting SGDT on an 80286 to set the 6th "undefined" byte to 0xFF, so that's what we do.
+             */
+            addr |= (0xff000000|0);
+        }
+        else if (this.model >= X86.MODEL_80386) {
+            /*
+             * The 80386 added another wrinkle: Intel's documentation claimed that the 6th byte is either set to zero
+             * or the high byte of the BASE field, depending on the OPERAND size; from the "INTEL 80386 PROGRAMMER'S
+             * REFERENCE MANUAL 1986":
+             *
+             *      The LIMIT field of the [GDTR or IDTR] register is assigned to the first word at the effective address.
+             *      If the operand-size attribute is 32 bits, the next three bytes are assigned the BASE field of the
+             *      register, and the fourth byte is written with zero. The last byte is undefined. Otherwise, if the
+             *      operand-size attribute is 16 bits, the next 4 bytes are assigned the 32-bit BASE field of the register.
+             *
+             * However, Intel obviously meant the reverse (ie, that the BASE field is truncated when using a 16-bit
+             * OPERAND size, not when using a 32-bit OPERAND size).
+             */
+            if (this.sizeData == 2) {
+                /*
+                 * Thanks to Michal Necasek, we now know that the: "386 in reality does not pay attention to the operand
+                 * size (despite Intel's claims to the contrary). In fact Windows 3.11/Win32s relies on it -- at least in
+                 * some configurations, it will execute SGDT in 16-bit code and will crash if all 6 bytes aren't stored."
+                 *
+                 * Based on the above information, we no longer mask the 6th byte on the 80386 when the OPERAND size is 2.
+                 *
+                 *      addr &= 0x00ffffff;
+                 */
+            } else {
+                /*
+                 * When the OPERAND size is 4, our ModRM group decoder will call setLong(dst) rather than setShort(dst);
+                 * we could fix that by calling setDataSize(2), but it seems safer/simpler to set the high bits (16-31)
+                 * of dst to match the low bits (0-15) of addr, so that the caller will harmlessly rewrite what we are
+                 * already writing with the setLong() below.
+                 */
+                dst |= (addr << 16);
+            }
+        }
+        this.setLong(this.regEA + 2, addr);
+        this.nStepCycles -= 11;
+    }
+    return dst;
+};
+
+/**
+ * fnSHLb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL, or an immediate byte for 80186/80188 and up)
+ * @return {number}
+ */
+X86.fnSHLb = function(dst, src)
+{
+    var result = dst;
+    var count = src & this.nShiftCountMask;
+    if (count) {
+        var carry = 0;
+        if (count > 8) {
+            result = 0;
+        } else {
+            carry = dst << (count - 1);
+            result = (carry << 1) & 0xff;
+        }
+        this.setLogicResult(result, X86.RESULT.BYTE, carry & X86.RESULT.BYTE, (result ^ carry) & X86.RESULT.BYTE);
+    }
+    return result;
+};
+
+/**
+ * fnSHLw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL, or an immediate byte for 80186/80188 and up)
+ * @return {number}
+ */
+X86.fnSHLw = function(dst, src)
+{
+    var result = dst;
+    var count = src & this.nShiftCountMask;
+    if (count) {
+        var carry = 0;
+        if (count > 16) {
+            result = 0;
+        } else {
+            carry = dst << (count - 1);
+            result = (carry << 1) & 0xffff;
+        }
+        this.setLogicResult(result, X86.RESULT.WORD, carry & X86.RESULT.WORD, (result ^ carry) & X86.RESULT.WORD);
+    }
+    return result;
+};
+
+/**
+ * fnSHLd(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL, or an immediate byte for 80186/80188 and up)
+ * @return {number}
+ */
+X86.fnSHLd = function(dst, src)
+{
+    var result = dst;
+    var count = src & this.nShiftCountMask;     // this 32-bit-only function could mask with 0x1f directly
+    if (count) {
+        var carry = dst << (count - 1);
+        result = (carry << 1);
+        this.setLogicResult(result, X86.RESULT.DWORD, carry & X86.RESULT.DWORD, (result ^ carry) & X86.RESULT.DWORD);
+    }
+    return result;
+};
+
+/**
+ * fnSHLDwi(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnSHLDwi = function(dst, src)
+{
+    return X86.helpSHLDw.call(this, dst, src, this.getIPByte());
+};
+
+/**
+ * fnSHLDdi(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnSHLDdi = function(dst, src)
+{
+    return X86.helpSHLDd.call(this, dst, src, this.getIPByte());
+};
+
+/**
+ * fnSHLDwCL(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnSHLDwCL = function(dst, src)
+{
+    return X86.helpSHLDw.call(this, dst, src, this.regECX & 0x1f);
+};
+
+/**
+ * fnSHLDdCL(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnSHLDdCL = function(dst, src)
+{
+    return X86.helpSHLDd.call(this, dst, src, this.regECX & 0x1f);
+};
+
+/**
+ * fnSHRb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL, or an immediate byte for 80186/80188 and up)
+ * @return {number}
+ */
+X86.fnSHRb = function(dst, src)
+{
+    var count = src & this.nShiftCountMask;
+    if (count) {
+        var carry = (count > 8? 0 : (dst >>> (count - 1)));
+        dst = (carry >>> 1) & 0xff;
+        this.setLogicResult(dst, X86.RESULT.BYTE, carry & 0x1, dst & X86.RESULT.BYTE);
+    }
+    return dst;
+};
+
+/**
+ * fnSHRw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL, or an immediate byte for 80186/80188 and up)
+ * @return {number}
+ */
+X86.fnSHRw = function(dst, src)
+{
+    var count = src & this.nShiftCountMask;
+    if (count) {
+        var carry = (count > 16? 0 : (dst >>> (count - 1)));
+        dst = (carry >>> 1) & 0xffff;
+        this.setLogicResult(dst, X86.RESULT.WORD, carry & 0x1, dst & X86.RESULT.WORD);
+    }
+    return dst;
+};
+
+/**
+ * fnSHRd(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (1 or CL, or an immediate byte for 80186/80188 and up)
+ * @return {number}
+ */
+X86.fnSHRd = function(dst, src)
+{
+    var count = src & this.nShiftCountMask;
+    if (count) {
+        var carry = (dst >>> (count - 1));
+        dst = (carry >>> 1);
+        this.setLogicResult(dst, X86.RESULT.DWORD, carry & 0x1, dst & X86.RESULT.DWORD);
+    }
+    return dst;
+};
+
+/**
+ * fnSHRDwi(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnSHRDwi = function(dst, src)
+{
+    return X86.helpSHRDw.call(this, dst, src, this.getIPByte());
+};
+
+/**
+ * fnSHRDdi(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnSHRDdi = function(dst, src)
+{
+    return X86.helpSHRDd.call(this, dst, src, this.getIPByte());
+};
+
+/**
+ * fnSHRDwCL(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnSHRDwCL = function(dst, src)
+{
+    return X86.helpSHRDw.call(this, dst, src, this.regECX & 0x1f);
+};
+
+/**
+ * fnSHRDdCL(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnSHRDdCL = function(dst, src)
+{
+    return X86.helpSHRDd.call(this, dst, src, this.regECX & 0x1f);
+};
+
+/**
+ * fnSIDT(dst, src)
+ *
+ * op=0x0F,0x01,reg=0x1 (GRP7:SIDT)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnSIDT = function(dst, src)
+{
+    if (this.regEA === X86.ADDR_INVALID) {
+        X86.opInvalid.call(this);
+    } else {
+        /*
+         * We don't need to set the first word of the operand, because the ModRM group decoder that calls us
+         * does that automatically with the value we return (dst).
+         */
+        dst = this.addrIDTLimit - this.addrIDT;
+
+        /*
+         * As with SGDT, the 6th byte is technically "undefined" on an 80286, but we now set it to 0xFF, for the
+         * same reasons discussed in SGDT (above).
+         */
+        var addr = this.addrIDT;
+        if (this.model == X86.MODEL_80286) {
+            addr |= (0xff000000|0);
+        }
+        else if (this.model >= X86.MODEL_80386) {
+            if (this.sizeData == 2) {
+                /*
+                 * Based on the SGDT information above, we no longer mask the 6th byte when the OPERAND size is 2.
+                 *
+                 *      addr &= 0x00ffffff;
+                 */
+            } else {
+                dst |= (addr << 16);
+            }
+        }
+        this.setLong(this.regEA + 2, addr);
+        this.nStepCycles -= 12;
+    }
+    return dst;
+};
+
+/**
+ * fnSLDT(dst, src)
+ *
+ * op=0x0F,0x00,reg=0x0 (GRP6:SLDT)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnSLDT = function(dst, src)
+{
+    this.nStepCycles -= (2 + (this.regEA === X86.ADDR_INVALID? 0 : 1));
+    return this.segLDT.sel;
+};
+
+/**
+ * fnSMSW(dst, src)
+ *
+ * TODO: I've seen a claim that SMSW can be used with an operand size override to obtain the entire CR0.
+ * I don't dispute that, and since I don't mask the return value, that should be possible here; however, it
+ * should still be confirmed on real hardware at some point.  Note that this differs from LMSW, which is
+ * REQUIRED to mask the source operand.
+ *
+ * op=0x0F,0x01,reg=0x4 (GRP7:SMSW)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnSMSW = function(dst, src)
+{
+    this.nStepCycles -= (2 + (this.regEA === X86.ADDR_INVALID? 0 : 1));
+    return this.regCR0;
+};
+
+/**
+ * fnSTR(dst, src)
+ *
+ * op=0x0F,0x00,reg=0x1 (GRP6:STR)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnSTR = function(dst, src)
+{
+    this.nStepCycles -= (2 + (this.regEA === X86.ADDR_INVALID? 0 : 1));
+    return this.segTSS.sel;
+};
+
+/**
+ * fnSUBb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnSUBb = function(dst, src)
+{
+    var b = (dst - src)|0;
+    this.setArithResult(dst, src, b, X86.RESULT.BYTE | X86.RESULT.ALL, true);
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesArithRR : this.cycleCounts.nOpCyclesArithRM) : this.cycleCounts.nOpCyclesArithMR);
+    return b & 0xff;
+};
+
+/**
+ * fnSUBw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnSUBw = function(dst, src)
+{
+    var w = (dst - src)|0;
+    this.setArithResult(dst, src, w, this.typeData | X86.RESULT.ALL, true);
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesArithRR : this.cycleCounts.nOpCyclesArithRM) : this.cycleCounts.nOpCyclesArithMR);
+    return w & this.maskData;
+};
+
+/**
+ * fnTESTib(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null; we have to supply the source ourselves)
+ * @return {number}
+ */
+X86.fnTESTib = function(dst, src)
+{
+    src = this.getIPByte();
+    this.setLogicResult(dst & src, X86.RESULT.BYTE);
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesTestRI : this.cycleCounts.nOpCyclesTestMI);
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnTESTiw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null; we have to supply the source ourselves)
+ * @return {number}
+ */
+X86.fnTESTiw = function(dst, src)
+{
+    src = this.getIPWord();
+    this.setLogicResult(dst & src, this.typeData);
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesTestRI : this.cycleCounts.nOpCyclesTestMI);
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnTESTb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnTESTb = function(dst, src)
+{
+    this.setLogicResult(dst & src, X86.RESULT.BYTE);
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesTestRR : this.cycleCounts.nOpCyclesTestRM) : this.cycleCounts.nOpCyclesTestRM);
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnTESTw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnTESTw = function(dst, src)
+{
+    this.setLogicResult(dst & src, this.typeData);
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesTestRR : this.cycleCounts.nOpCyclesTestRM) : this.cycleCounts.nOpCyclesTestRM);
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    return dst;
+};
+
+/**
+ * fnVERR(dst, src)
+ *
+ * op=0x0F,0x00,reg=0x4 (GRP6:VERR)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnVERR = function(dst, src)
+{
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    /*
+     * Currently, segVER.load() will return an error only if the selector is beyond the bounds of the
+     * descriptor table or the descriptor is not for a segment.
+     */
+    this.nStepCycles -= (14 + (this.regEA === X86.ADDR_INVALID? 0 : 2));
+    if (this.segVER.load(dst) !== X86.ADDR_INVALID) {
+        /*
+         * Verify that this is a readable segment; that is, of these four combinations (code+readable,
+         * code+nonreadable, data+writable, date+nonwritable), make sure we're not the second combination.
+         */
+        if ((this.segVER.acc & (X86.DESC.ACC.TYPE.READABLE | X86.DESC.ACC.TYPE.CODE)) != X86.DESC.ACC.TYPE.CODE) {
+            /*
+             * For VERR, if the code segment is readable and conforming, the descriptor privilege level
+             * (DPL) can be any value.
+             *
+             * Otherwise, DPL must be greater than or equal to (have less or the same privilege as) both the
+             * current privilege level and the selector's RPL.
+             */
+            if (this.segVER.dpl >= this.nCPL && this.segVER.dpl >= (dst & X86.SEL.RPL) ||
+                (this.segVER.acc & X86.DESC.ACC.TYPE.CODE_CONFORMING) == X86.DESC.ACC.TYPE.CODE_CONFORMING) {
+                this.setZF();
+                return dst;
+            }
+        }
+    }
+    this.clearZF();
+    if (DEBUG && (this.sizeData > 2 || this.sizeAddr > 2)) this.stopCPU();
+    return dst;
+};
+
+/**
+ * fnVERW(dst, src)
+ *
+ * op=0x0F,0x00,reg=0x5 (GRP6:VERW)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src (null)
+ * @return {number}
+ */
+X86.fnVERW = function(dst, src)
+{
+    this.opFlags |= X86.OPFLAG.NOWRITE;
+    /*
+     * Currently, segVER.load() will return an error only if the selector is beyond the bounds of the
+     * descriptor table or the descriptor is not for a segment.
+     */
+    this.nStepCycles -= (14 + (this.regEA === X86.ADDR_INVALID? 0 : 2));
+    if (this.segVER.load(dst) !== X86.ADDR_INVALID) {
+        /*
+         * Verify that this is a writable data segment
+         */
+        if ((this.segVER.acc & (X86.DESC.ACC.TYPE.WRITABLE | X86.DESC.ACC.TYPE.CODE)) == X86.DESC.ACC.TYPE.WRITABLE) {
+            /*
+             * DPL must be greater than or equal to (have less or the same privilege as) both the current
+             * privilege level and the selector's RPL.
+             */
+            if (this.segVER.dpl >= this.nCPL && this.segVER.dpl >= (dst & X86.SEL.RPL)) {
+                this.setZF();
+                return dst;
+            }
+        }
+    }
+    this.clearZF();
+    if (DEBUG && (this.sizeData > 2 || this.sizeAddr > 2)) this.stopCPU();
+    return dst;
+};
+
+/**
+ * fnIBTS(dst, src)
+ *
+ * As best I can determine, this function copies the specified bits from src (starting at bit 0 for CL
+ * bits) to dst (starting at bit offset in AX).  For register operands, that's simple enough.
+ *
+ * TODO: If dst refers to a memory location, then the bit index may refer to higher memory locations, just
+ * like the BT/BTC/BTR/BTS instructions.  For an instruction that no one was really able to use, except
+ * as a CPU stepping discriminator, that doesn't seem worth the effort.
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnIBTS = function(dst, src)
+{
+    var shift = (this.regEAX & this.maskData);
+    var mask = ((1 << (this.regECX & 0x1f)) - 1);
+    return (dst & ~(mask << shift)) | ((src & mask) << shift);
+};
+
+/**
+ * fnXBTS(dst, src)
+ *
+ * As best I can determine, this function copies the specified bits from src (starting at the bit offset
+ * in AX, for the bit length in CL) to dst (starting at bit 0).  For register operands, that's simple enough.
+ *
+ * TODO: If src refers to a memory location, then the bit index may refer to higher memory locations, just
+ * like the BT/BTC/BTR/BTS instructions.  For an instruction that no one was really able to use, except
+ * as a CPU stepping discriminator, that doesn't seem worth the effort.
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnXBTS = function(dst, src)
+{
+    /*
+     * Shift src right by the bit offset in [E]AX, then apply a mask equal to the number of bits in CL,
+     * then mask the resulting bit string with the current OPERAND size.
+     */
+    return ((src >> (this.regEAX & this.maskData)) & ((1 << (this.regECX & 0x1f)) - 1)) & this.maskData;
+};
+
+/**
+ * fnXCHGrb(dst, src)
+ *
+ * If an instruction like "XCHG AL,AH" was a traditional "op dst,src" instruction, dst would contain AL,
+ * src would contain AH, and we would return src, which the caller would then store in AL, and we'd be done.
+ *
+ * However, that's only half of what XCHG does, so THIS function must perform the other half; in the previous
+ * example, that means storing the original AL (dst) into AH (src).
+ *
+ * BACKTRACK support is incomplete without also passing bti values as parameters, because the caller will
+ * store btiAH in btiAL, but the original btiAL will be lost.  Similarly, if src is a memory operand, the
+ * caller will store btiEALo in btiAL, but again, the original btiAL will be lost.
+ *
+ * BACKTRACK support for memory operands could be fixed by decoding the dst register in order to determine the
+ * corresponding bti and then temporarily storing it in btiEALo around the setEAByte() call below.  Register-only
+ * XCHGs would require a more extensive hack.  For now, I'm going to live with one-way BACKTRACK support here.
+ *
+ * TODO: Implement full BACKTRACK support for XCHG instructions.
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnXCHGrb = function(dst, src)
+{
+    if (this.regEA === X86.ADDR_INVALID) {
+        /*
+         * Decode which register was src
+         */
+
+        switch (this.bModRM & 0x7) {
+        case 0x0:       // AL
+            this.regEAX = (this.regEAX & ~0xff) | dst;
+            break;
+        case 0x1:       // CL
+            this.regECX = (this.regECX & ~0xff) | dst;
+            break;
+        case 0x2:       // DL
+            this.regEDX = (this.regEDX & ~0xff) | dst;
+            break;
+        case 0x3:       // BL
+            this.regEBX = (this.regEBX & ~0xff) | dst;
+            break;
+        case 0x4:       // AH
+            this.regEAX = (this.regEAX & ~0xff00) | (dst << 8);
+            break;
+        case 0x5:       // CH
+            this.regECX = (this.regECX & ~0xff00) | (dst << 8);
+            break;
+        case 0x6:       // DH
+            this.regEDX = (this.regEDX & ~0xff00) | (dst << 8);
+            break;
+        case 0x7:       // BH
+            this.regEBX = (this.regEBX & ~0xff00) | (dst << 8);
+            break;
+        default:
+            break;      // there IS no other case, but JavaScript inspections don't know that
+        }
+        this.nStepCycles -= this.cycleCounts.nOpCyclesXchgRR;
+    } else {
+        /*
+         * This is a case where the ModRM decoder that's calling us didn't know it should have set regEAWrite,
+         * so we compensate by updating regEAWrite.  However, setEAWord() has since been changed to revalidate
+         * the write using segEA:offEA, so updating regEAWrite here isn't strictly necessary.
+         */
+        this.regEAWrite = this.regEA;
+        this.setEAByte(dst);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesXchgRM;
+    }
+    return src;
+};
+
+/**
+ * fnXCHGrw(dst, src)
+ *
+ * If an instruction like "XCHG AX,DX" was a traditional "op dst,src" instruction, dst would contain AX,
+ * src would contain DX, and we would return src, which the caller would then store in AX, and we'd be done.
+ *
+ * However, that's only half of what XCHG does, so THIS function must perform the other half; in the previous
+ * example, that means storing the original AX (dst) into DX (src).
+ *
+ * TODO: Implement full BACKTRACK support for XCHG instructions (see fnXCHGrb comments).
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnXCHGrw = function(dst, src)
+{
+    if (this.regEA === X86.ADDR_INVALID) {
+        /*
+         * Decode which register was src
+         */
+
+        switch (this.bModRM & 0x7) {
+        case 0x0:       // [E]AX
+            this.regEAX = (this.regEAX & ~this.maskData) | dst;
+            break;
+        case 0x1:       // [E]CX
+            this.regECX = (this.regECX & ~this.maskData) | dst;
+            break;
+        case 0x2:       // [E]DX
+            this.regEDX = (this.regEDX & ~this.maskData) | dst;
+            break;
+        case 0x3:       // [E]BX
+            this.regEBX = (this.regEBX & ~this.maskData) | dst;
+            break;
+        case 0x4:       // [E]SP
+            this.setSP((this.getSP() & ~this.maskData) | dst);
+            break;
+        case 0x5:       // [E]BP
+            this.regEBP = (this.regEBX & ~this.maskData) | dst;
+            break;
+        case 0x6:       // [E]SI
+            this.regESI = (this.regESI & ~this.maskData) | dst;
+            break;
+        case 0x7:       // [E]DI
+            this.regEDI = (this.regEDI & ~this.maskData) | dst;
+            break;
+        default:
+            break;      // there IS no other case, but JavaScript inspections don't know that
+        }
+        this.nStepCycles -= this.cycleCounts.nOpCyclesXchgRR;
+    } else {
+        /*
+         * This is a case where the ModRM decoder that's calling us didn't know it should have set regEAWrite,
+         * so we compensate by updating regEAWrite.  However, setEAWord() has since been changed to revalidate
+         * the write using segEA:offEA, so updating regEAWrite here isn't strictly necessary.
+         */
+        this.regEAWrite = this.regEA;
+        this.setEAWord(dst);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesXchgRM;
+    }
+    return src;
+};
+
+/**
+ * fnXORb(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnXORb = function(dst, src)
+{
+    var b = dst ^ src;
+    this.setLogicResult(b, X86.RESULT.BYTE);
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesArithRR : this.cycleCounts.nOpCyclesArithRM) : this.cycleCounts.nOpCyclesArithMR);
+    return b;
+};
+
+/**
+ * fnXORw(dst, src)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @return {number}
+ */
+X86.fnXORw = function(dst, src)
+{
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesArithRR : this.cycleCounts.nOpCyclesArithRM) : this.cycleCounts.nOpCyclesArithMR);
+    return this.setLogicResult(dst ^ src, this.typeData) & this.maskData;
+};
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/x86help.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * helpAdd64(r64Dst, r64Src)
+ *
+ * Adds r64Src to r64Dst.
+ *
+ * @param {Array.<number>} r64Dst is a 64-bit value
+ * @param {Array.<number>} r64Src is a 64-bit value
+ */
+X86.helpAdd64 = function(r64Dst, r64Src)
+{
+    r64Dst[0] += r64Src[0];
+    r64Dst[1] += r64Src[1];
+    if (r64Dst[0] > 0xffffffff) {
+        r64Dst[0] >>>= 0;       // truncate r64Dst[0] to 32 bits AND keep it unsigned
+        r64Dst[1]++;
+    }
+};
+
+/**
+ * helpCmp64(r64Dst, r64Src)
+ *
+ * Compares r64Dst to r64Src, by computing r64Dst - r64Src.
+ *
+ * @param {Array.<number>} r64Dst is a 64-bit value
+ * @param {Array.<number>} r64Src is a 64-bit value
+ * @return {number} > 0 if r64Dst > r64Src, == 0 if r64Dst == r64Src, < 0 if r64Dst < r64Src
+ */
+X86.helpCmp64 = function(r64Dst, r64Src)
+{
+    var result = r64Dst[1] - r64Src[1];
+    if (!result) result = r64Dst[0] - r64Src[0];
+    return result;
+};
+
+/**
+ * helpSet64(r64Dst, lo, hi)
+ *
+ * @param {Array.<number>} r64Dst
+ * @param {number} lo
+ * @param {number} hi
+ * @return {Array.<number>}
+ */
+X86.helpSet64 = function(r64Dst, lo, hi)
+{
+    r64Dst[0] = lo >>> 0;
+    r64Dst[1] = hi >>> 0;
+    return r64Dst;
+};
+
+/**
+ * helpShr64(r64Dst)
+ *
+ * Shifts r64Dst right one bit.
+ *
+ * @param {Array.<number>} r64Dst is a 64-bit value
+ */
+X86.helpShr64 = function(r64Dst)
+{
+    r64Dst[0] >>>= 1;
+    if (r64Dst[1] & 0x1) {
+        r64Dst[0] = (r64Dst[0] | 0x80000000) >>> 0;
+    }
+    r64Dst[1] >>>= 1;
+};
+
+/**
+ * helpSub64(r64Dst, r64Src)
+ *
+ * Subtracts r64Src from r64Dst.
+ *
+ * @param {Array.<number>} r64Dst is a 64-bit value
+ * @param {Array.<number>} r64Src is a 64-bit value
+ */
+X86.helpSub64 = function(r64Dst, r64Src)
+{
+    r64Dst[0] -= r64Src[0];
+    r64Dst[1] -= r64Src[1];
+    if (r64Dst[0] < 0) {
+        r64Dst[0] >>>= 0;       // truncate r64Dst[0] to 32 bits AND keep it unsigned
+        r64Dst[1]--;
+    }
+};
+
+/**
+ * helpDECreg(w)
+ *
+ * @this {X86CPU}
+ * @param {number} w
+ * @return {number}
+ */
+X86.helpDECreg = function(w)
+{
+    var result = (w - 1)|0;
+    this.setArithResult(w, 1, result, this.typeData | X86.RESULT.NOTCF, true);
+    this.nStepCycles -= 2;                          // the register form of DEC takes 2 cycles on all CPUs
+    return (w & ~this.maskData) | (result & this.maskData);
+};
+
+/**
+ * helpDIV32(dstLo, dstHi, src)
+ *
+ * This sets regMDLo to dstHi:dstLo / src, and regMDHi to dstHi:dstLo % src; all inputs are treated as unsigned.
+ *
+ * Refer to: http://lxr.linux.no/linux+v2.6.22/lib/div64.c
+ *
+ * @this {X86CPU}
+ * @param {number} dstLo (low 32-bit portion of dividend)
+ * @param {number} dstHi (high 32-bit portion of dividend)
+ * @param {number} src (32-bit divisor)
+ * @return {boolean} true if successful, false if overflow (ie, the divisor was either zero or too small)
+ */
+X86.helpDIV32 = function(dstLo, dstHi, src)
+{
+    src >>>= 0;
+
+    if (!src || src <= (dstHi >>> 0)) {
+        return false;
+    }
+
+    var result = 0, bit = 1;
+
+    var r64Div = X86.helpSet64(this.r64Div, src, 0);
+    var r64Rem = X86.helpSet64(this.r64Rem, dstLo, dstHi);
+
+    while (X86.helpCmp64(r64Rem, r64Div) > 0) {
+        X86.helpAdd64(r64Div, r64Div);
+        bit += bit;
+    }
+    do {
+        if (X86.helpCmp64(r64Rem, r64Div) >= 0) {
+            X86.helpSub64(r64Rem, r64Div);
+            result += bit;
+        }
+        X86.helpShr64(r64Div);
+        bit /= 2;
+    } while (bit >= 1);
+
+
+
+    this.regMDLo = result;      // result is the quotient, which callers expect in the low MD register
+    this.regMDHi = r64Rem[0];   // r64Rem[0] is the remainder, which callers expect in the high MD register
+    return true;
+};
+
+/**
+ * helpIDIV32(dstLo, dstHi, src)
+ *
+ * This sets regMDLo to dstHi:dstLo / src, and regMDHi to dstHi:dstLo % src; all inputs are treated as signed.
+ *
+ * Refer to: http://lxr.linux.no/linux+v2.6.22/lib/div64.c
+ *
+ * @this {X86CPU}
+ * @param {number} dstLo (low 32-bit portion of dividend)
+ * @param {number} dstHi (high 32-bit portion of dividend)
+ * @param {number} src (32-bit divisor)
+ * @return {boolean} true if successful, false if overflow (ie, the divisor was either zero or too small)
+ */
+X86.helpIDIV32 = function(dstLo, dstHi, src)
+{
+    var bNegLo = 0, bNegHi = 0;
+    /*
+     *      dividend    divisor       quotient    remainder
+     *        (dst)      (src)          (lo)         (hi)
+     *      --------    -------       --------    ---------
+     *         +           +     ->       +           +
+     *         +           -     ->       -           +
+     *         -           +     ->       -           -
+     *         -           -     ->       +           -
+     */
+    if (src < 0) {
+        src = -src|0;
+        bNegLo = 1 - bNegLo;
+    }
+    if (dstHi < 0) {
+        dstLo = -dstLo|0;
+        dstHi = (~dstHi + (dstLo? 0 : 1))|0;
+        bNegHi = 1;
+        bNegLo = 1 - bNegLo;
+    }
+    if (!X86.helpDIV32.call(this, dstLo, dstHi, src) || this.regMDLo > 0x7fffffff+bNegLo || this.regMDHi > 0x7fffffff+bNegHi) {
+        return false;
+    }
+    if (bNegLo) this.regMDLo = -this.regMDLo;
+    if (bNegHi) this.regMDHi = -this.regMDHi;
+    return true;
+};
+
+/**
+ * helpINCreg(w)
+ *
+ * @this {X86CPU}
+ * @param {number} w
+ * @return {number}
+ */
+X86.helpINCreg = function(w)
+{
+    var result = (w + 1)|0;
+    this.setArithResult(w, 1, result, this.typeData | X86.RESULT.NOTCF);
+    this.nStepCycles -= 2;                          // the register form of INC takes 2 cycles on all CPUs
+    return (w & ~this.maskData) | (result & this.maskData);
+};
+
+/**
+ * helpLoadCR0(l)
+ *
+ * This is called by an 80386 control instruction (ie, MOV CR0,reg).
+ *
+ * TODO: Determine which CR0 bits, if any, cannot be modified by MOV CR0,reg.
+ *
+ * @this {X86CPU}
+ * @param {number} l
+ */
+X86.helpLoadCR0 = function(l)
+{
+    this.regCR0 = l;
+    this.setProtMode();
+    if (this.regCR0 & X86.CR0.PG) {
+        /*
+         * TODO: Determine if setting X86.CR0.PG when already set should really act as a flush;
+         * I'm not currently worried about it, because I'm assuming CR0 is not rewritten that often.
+         */
+        this.enablePageBlocks();
+    } else {
+        this.disablePageBlocks();
+    }
+};
+
+/**
+ * helpLoadCR3(l)
+ *
+ * This is called by an 80386 control instruction (ie, MOV CR3,reg) or an 80386 task switch.
+ *
+ * @this {X86CPU}
+ * @param {number} l
+ */
+X86.helpLoadCR3 = function(l)
+{
+    this.regCR3 = l;
+    /*
+     * Normal use of regCR3 involves adding a 0-4K (12-bit) offset to obtain a page directory entry,
+     * so let's ensure that the low 12 bits of regCR3 are always zero.
+     */
+
+    this.flushPageBlocks();
+};
+
+/**
+ * helpSETcc()
+ *
+ * @this {X86CPU}
+ * @param {function(number,number)} fnSet
+ */
+X86.helpSETcc = function(fnSet)
+{
+    this.opFlags |= X86.OPFLAG.NOREAD;
+    this.decodeModMemByte.call(this, fnSet);
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 4 : 5);
+};
+
+/**
+ * helpSHLDw(dst, src, count)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @param {number} count (0-31)
+ * @return {number}
+ */
+X86.helpSHLDw = function(dst, src, count)
+{
+    if (count) {
+        if (count > 16) {
+            dst = src;
+            count -= 16;
+        }
+        var carry = dst << (count - 1);
+        dst = ((carry << 1) | (src >>> (16 - count))) & 0xffff;
+        this.setLogicResult(dst, X86.RESULT.WORD, carry & X86.RESULT.WORD);
+    }
+    return dst;
+};
+
+/**
+ * helpSHLDd(dst, src, count)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @param {number} count
+ * @return {number}
+ */
+X86.helpSHLDd = function(dst, src, count)
+{
+    if (count) {
+        var carry = dst << (count - 1);
+        dst = (carry << 1) | (src >>> (32 - count));
+        this.setLogicResult(dst, X86.RESULT.DWORD, carry & X86.RESULT.DWORD);
+    }
+    return dst;
+};
+
+/**
+ * helpSHRDw(dst, src, count)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @param {number} count (0-31)
+ * @return {number}
+ */
+X86.helpSHRDw = function(dst, src, count)
+{
+    if (count) {
+        if (count > 16) {
+            dst = src;
+            count -= 16;
+        }
+        var carry = dst >>> (count - 1);
+        dst = ((carry >>> 1) | (src << (16 - count))) & 0xffff;
+        this.setLogicResult(dst, X86.RESULT.WORD, carry & 0x1);
+    }
+    return dst;
+};
+
+/**
+ * helpSHRDd(dst, src, count)
+ *
+ * @this {X86CPU}
+ * @param {number} dst
+ * @param {number} src
+ * @param {number} count
+ * @return {number}
+ */
+X86.helpSHRDd = function(dst, src, count)
+{
+    if (count) {
+        var carry = dst >>> (count - 1);
+        dst = (carry >>> 1) | (src << (32 - count));
+        this.setLogicResult(dst, X86.RESULT.DWORD, carry & 0x1);
+    }
+    return dst;
+};
+
+/**
+ * helpSRC1()
+ *
+ * @this {X86CPU}
+ * @return {number}
+ */
+X86.helpSRC1 = function()
+{
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 2 : this.cycleCounts.nOpCyclesShift1M);
+    return 1;
+};
+
+/**
+ * helpSRCCL()
+ *
+ * @this {X86CPU}
+ * @return {number}
+ */
+X86.helpSRCCL = function()
+{
+    var count = this.regECX & 0xff;
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesShiftCR : this.cycleCounts.nOpCyclesShiftCM) + (count << this.cycleCounts.nOpCyclesShiftCS);
+    return count;
+};
+
+/**
+ * helpSRCByte()
+ *
+ * @this {X86CPU}
+ * @return {number}
+ */
+X86.helpSRCByte = function()
+{
+    var count = this.getIPByte();
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? this.cycleCounts.nOpCyclesShiftCR : this.cycleCounts.nOpCyclesShiftCM) + (count << this.cycleCounts.nOpCyclesShiftCS);
+    return count;
+};
+
+/**
+ * helpSRCNone()
+ *
+ * @this {X86CPU}
+ * @return {number|null}
+ */
+X86.helpSRCNone = function()
+{
+    return null;
+};
+
+/**
+ * helpSRCxx()
+ *
+ * This is used by opPOPmw(), because the actual pop must occur BEFORE the effective address (EA)
+ * calculation.  So opPOPmw() does the pop, saves the popped value in regXX, and this passes src function
+ * to the EA worker.
+ *
+ * @this {X86CPU}
+ * @return {number} regXX
+ */
+X86.helpSRCxx = function()
+{
+    return this.regXX;
+};
+
+/**
+ * helpCALLF(off, sel)
+ *
+ * For protected-mode, this function must attempt to load the new code segment first, because if the new segment
+ * requires a change in privilege level, the return address must be pushed on the NEW stack, not the current stack.
+ *
+ * Also, we rely on a new function, pushData(), instead of pushWord(), to accommodate the outgoing segment size,
+ * which may differ from the incoming segment.  For example, when a 32-bit code segment performs a 16:32 call to a
+ * 16-bit code segment, we must push 32-bit segment and offset values.
+ *
+ * TODO: Since setCSIP() already informs the segCS load() function when it's making a call, the load() function
+ * could automatically push the old CS and IP values *before* segCS is updated -- which would be a better time to do
+ * those pushes AND eliminate the need for pushData().  Unfortunately, load() is also used by loadIDT(), and loadIDT()
+ * has different requirements (eg, pushing flags first), so it's not a trivial change.
+ *
+ * @this {X86CPU}
+ * @param {number} off
+ * @param {number} sel
+ */
+X86.helpCALLF = function(off, sel)
+{
+    /*
+     * Since we always push the return address AFTER calling setCSIP(), and since either push could trigger
+     * a fault (eg, segment fault, page fault, etc), we must not only snapshot regSS and regLSP, but also regCS,
+     * so that helpFault() can always make CALLF restartable.
+     */
+    this.opCS = this.getCS();
+    this.opSS = this.getSS();
+    this.opLSP = this.regLSP;
+    var oldIP = this.getIP();
+    var oldSize = (I386? this.sizeData : 2);
+    if (this.setCSIP(off, sel, true) != null) {
+        /*
+         * When the OPERAND size is 32 bits, the 80386 will decrement the stack pointer by 4, write the selector
+         * into the 2 lower bytes, and leave the 2 upper bytes untouched; at least, that's the case for all other
+         * segment register writes, so we assume this case is no different.  Hence, the hard-coded size of 2.
+         */
+        this.pushData(this.opCS, oldSize, 2);
+        this.pushData(oldIP, oldSize, oldSize);
+    }
+    this.opLSP = X86.ADDR_INVALID;
+    this.opCS = this.opSS = -1;
+};
+
+/**
+ * helpINT(nIDT, nError, nCycles)
+ *
+ * NOTE: We no longer use setCSIP(), because it always loads the new CS using segCS.load(), which only knows
+ * how to load GDT and LDT descriptors, whereas interrupts must use setCS.loadIDT(), which deals exclusively
+ * with IDT descriptors.
+ *
+ * @this {X86CPU}
+ * @param {number} nIDT
+ * @param {number|null} [nError]
+ * @param {number} [nCycles] (in addition to the default of nOpCyclesInt)
+ */
+X86.helpINT = function(nIDT, nError, nCycles)
+{
+    /*
+     * TODO: We assess the cycle cost up front, because otherwise, if loadIDT() fails, no cost may be assessed.
+     */
+    this.nStepCycles -= this.cycleCounts.nOpCyclesInt + (nCycles || 0);
+    var oldPS = this.getPS();
+    var oldCS = this.getCS();
+    var oldIP = this.getIP();
+    var addr = this.segCS.loadIDT(nIDT);
+    if (addr !== X86.ADDR_INVALID) {
+        /*
+         * TODO: Determine if we should use pushData() instead of pushWord() for oldCS and nError, to deal with
+         * the same 32-bit 80386 compatibility issue that helpCALLF(), opPUSHCS(), et al must deal with; namely, that
+         * 32-bit segment register writes (and, reportedly, 32-bit error codes) don't modify the upper 16 bits.
+         *
+         * Also, note that helpCALLF() is using the OPERAND size in effect *before* CS is loaded, whereas here we're
+         * using the OPERAND size in effect *after* CS is loaded.  Is that correct?  And does an explicit OPERAND
+         * size override on an "INT" instruction have any effect on that behavior?  Is that even allowed?
+         */
+        this.pushWord(oldPS);
+        this.pushWord(oldCS);
+        this.pushWord(oldIP);
+        if (nError != null) this.pushWord(nError);
+        this.nFault = -1;
+        this.setLIP(addr);
+    }
+};
+
+/**
+ * helpIRET()
+ *
+ * @this {X86CPU}
+ */
+X86.helpIRET = function()
+{
+    this.opSS = this.getSS();
+    this.opLSP = this.regLSP;
+
+    this.nStepCycles -= this.cycleCounts.nOpCyclesIRet;
+
+    if ((this.regCR0 & X86.CR0.MSW.PE) && (this.regPS & X86.PS.NT)) {
+        var addrNew = this.segTSS.base;
+        /*
+         * Fortunately, X86.TSS286.PREV_TSS and X86.TSS386.PREV_TSS refer to the same TSS offset.
+         * TODO: Update switchTS() to assess a cycle cost; currently, all we assess is what's shown above.
+         */
+        var sel = this.getShort(addrNew + X86.TSS286.PREV_TSS);
+        this.segCS.switchTSS(sel, false);
+    }
+    else {
+        var cpl = this.nCPL;
+        var newIP = this.popWord();
+        var newCS = this.popWord();
+        var newPS = this.popWord();
+
+        if (I386) {
+            if (this.regPS & X86.PS.VM) {
+                /*
+                 * On the 80386, in V86-mode, RF is the only defined EFLAGS bit above bit 15 that may be changed by IRETD.
+                 * This is less restrictive than POPFD, which cannot change ANY bits above bit 15; see opPOPF() for details.
+                 */
+                newPS = (newPS & (0xffff | X86.PS.RF)) | (this.regPS & ~(0xffff | X86.PS.RF));
+            }
+            else {
+                if (newPS & X86.PS.VM) {
+                    /*
+                     * As noted in loadDesc8(), where the V86-mode frame we're about to pop was originally pushed,
+                     * these frames ALWAYS contain 32-bit values, so make sure that sizeData reflects that.
+                     */
+
+                    /*
+                     * We have to assume that a full V86-mode interrupt frame was on the protected-mode stack; namely:
+                     *
+                     *      low:    EIP
+                     *              CS (padded to 32 bits)
+                     *              EFLAGS
+                     *              ESP
+                     *              SS (padded to 32 bits)
+                     *              ES (padded to 32 bits)
+                     *              DS (padded to 32 bits)
+                     *              FS (padded to 32 bits)
+                     *      high:   GS (padded to 32 bits)
+                     *
+                     * We've already popped EIP, CS, and EFLAGS into newIP, newCS and newPS, respectively, so we must now
+                     * pop the rest, while we're still in protected-mode, before the switch to V86-mode alters the current
+                     * operand size (among other things).
+                     */
+                    var newSP = this.popWord();
+                    var newSS = this.popWord();
+                    var newES = this.popWord();
+                    var newDS = this.popWord();
+                    var newFS = this.popWord();
+                    var newGS = this.popWord();
+                    this.setProtMode(true, true);       // flip the switch to V86-mode now
+                    this.setSS(newSS);
+                    this.setSP(newSP);
+                    this.setES(newES);
+                    this.setDS(newDS);
+                    this.setFS(newFS);
+                    this.setGS(newGS);
+                }
+            }
+        }
+
+        if (this.setCSIP(newIP, newCS, false) != null) {
+            this.setPS(newPS, cpl);
+            if (this.cIntReturn) this.checkIntReturn(this.regLIP);
+        }
+    }
+
+    this.opLSP = X86.ADDR_INVALID;
+    this.opSS = -1;
+};
+
+/**
+ * helpRETF(n)
+ *
+ * For protected-mode, this function must pop any arguments off the current stack AND whatever stack
+ * we may have switched to; setCSIP() returns true if a stack switch occurred, false if not, and null
+ * if an error occurred.
+ *
+ * @this {X86CPU}
+ * @param {number} n
+ */
+X86.helpRETF = function(n)
+{
+    this.opSS = this.getSS();
+    this.opLSP = this.regLSP;
+
+    var newIP = this.popWord();
+    var newCS = this.popWord();
+
+    if (n) this.setSP(this.getSP() + n);            // TODO: optimize
+
+    if (this.setCSIP(newIP, newCS, false)) {        // returns true if a stack switch occurred
+        /*
+         * Fool me once, shame on... whatever.  If setCSIP() indicates a stack switch occurred,
+         * make sure we're in protected mode, because automatic stack switches can't occur in real mode.
+         */
+
+
+        if (n) this.setSP(this.getSP() + n);        // TODO: optimize
+
+        /*
+         * As per Intel documentation: "If any of [the DS or ES] registers refer to segments whose DPL is
+         * less than the new CPL (excluding conforming code segments), the segment register is loaded with
+         * the null selector."
+         *
+         * TODO: I'm not clear on whether a conforming code segment must also be marked readable, so I'm playing
+         * it safe and using CODE_CONFORMING instead of CODE_CONFORMING_READABLE.  Also, for the record, I've not
+         * seen this situation occur yet (eg, in OS/2 1.0).
+         */
+        X86.zeroSeg.call(this, this.segDS);
+        X86.zeroSeg.call(this, this.segES);
+        if (I386 && this.model >= X86.MODEL_80386) {
+            X86.zeroSeg.call(this, this.segFS);
+            X86.zeroSeg.call(this, this.segGS);
+        }
+    }
+    if (n == 2 && this.cIntReturn) this.checkIntReturn(this.regLIP);
+
+    this.opLSP = X86.ADDR_INVALID;
+    this.opSS = -1;
+};
+
+/**
+ * helpDIVOverflow()
+ *
+ * @this {X86CPU}
+ */
+X86.helpDIVOverflow = function()
+{
+    /*
+     * Divide error exceptions are traps on the 8086 and faults on later processors.  I question the value of that
+     * change, because it implies that someone might actually want to restart a failing divide.  The only reasonable
+     * explanation I can see for the change is to enable the exception handler to accurately record the address of
+     * the failing divide, which seems like a very minor benefit.  It doesn't change the fact that, on any processor,
+     * the exception handler's only reasonable recourse is to unwind execution to a safe point (or terminate the app).
+     *
+     * TODO: Determine the proper cycle cost.
+     */
+    if (this.model == X86.MODEL_8086) {
+        X86.helpTrap.call(this, X86.EXCEPTION.DE_EXC, 2);
+    } else {
+        X86.helpFault.call(this, X86.EXCEPTION.DE_EXC, null, 2);
+    }
+};
+
+/**
+ * helpInterrupt(nIDT, nCycles)
+ *
+ * Helper to dispatch external interrupts.  nCycles defaults to 11 for the 8086/8088
+ * if no alternate value is specified.
+ *
+ * @this {X86CPU}
+ * @param {number} nIDT
+ * @param {number} [nCycles] (number of cycles in addition to the default of nOpCyclesInt)
+ */
+X86.helpInterrupt = function(nIDT, nCycles)
+{
+    this.nFault = nIDT;
+    if (nCycles === undefined) nCycles = 11;
+    X86.helpINT.call(this, nIDT, null, nCycles);
+};
+
+/**
+ * helpTrap(nIDT, nCycles)
+ *
+ * Helper to dispatch traps (ie, exceptions that occur AFTER the instruction, with NO error code)
+ *
+ * @this {X86CPU}
+ * @param {number} nIDT
+ * @param {number} [nCycles] (number of cycles in addition to the default of nOpCyclesInt)
+ */
+X86.helpTrap = function(nIDT, nCycles)
+{
+    this.nFault = -1;
+    X86.helpINT.call(this, nIDT, null, nCycles);
+};
+
+/**
+ * helpFault(nFault, nError, nCycles, fHalt)
+ *
+ * Helper to dispatch faults (ie, exceptions that occur DURING an instruction and MAY generate an error code)
+ *
+ * @this {X86CPU}
+ * @param {number} nFault
+ * @param {number|null} [nError] (if omitted, no error code will be pushed)
+ * @param {number} [nCycles] cycle count to pass through to helpINT(), if any
+ * @param {boolean} [fHalt] (true to halt the CPU, false to not, undefined if "it depends")
+ */
+X86.helpFault = function(nFault, nError, nCycles, fHalt)
+{
+    var fDispatch = false;
+
+    if (!this.flags.complete) {
+        /*
+         * Prior to each new burst of instructions, stepCPU() sets fComplete to true, and the only (normal) way
+         * for fComplete to become false is through stopCPU(), which isn't ordinarily called, except by the Debugger.
+         */
+        this.setLIP(this.opLIP);
+    }
+    else if (this.model >= X86.MODEL_80186) {
+
+        fDispatch = true;
+
+        if (this.nFault < 0) {
+            /*
+             * Single-fault (error code is passed through, and the responsible instruction is restartable.
+             *
+             * TODO: The following opCS/opLIP/opSS/opLSP checks are primarily required for 80386-based machines
+             * with paging enabled, because page faults introduce a new set of complex faults that our current
+             * segment load "probes" are insufficient to catch.  So as a stop-gap measure, we rely on these four
+             * "snapshot" registers to resolve the general instruction restartability problem (for now).
+             *
+             * If you want to closely examine the underlying causes of these more complex faults, set breakpoints
+             * where indicated below, and examine the stack trace.
+             */
+            if (this.opCS != -1) {
+                if (this.opCS !== this.segCS.sel) {
+                    /*
+                     * HACK: We slam the RPL into this.segCS.cpl to ensure that loading the original CS segment doesn't
+                     * fail.  For example, if we faulted in the middle of a ring transition that loaded CS with a higher
+                     * privilege (lower CPL) code segment, then our attempt here to reload the lower privilege (higher CPL)
+                     * code segment could be viewed as a privilege violation (which it would be outside this context).
+                     */
+                    this.segCS.cpl = this.opCS & 0x3;           // set breakpoint here to inspect complex faults
+                    this.setCS(this.opCS);
+                }
+                this.opCS = -1;
+            }
+            if (this.opLIP !== this.regLIP) {
+                this.setLIP(this.opLIP);                        // set breakpoint here to inspect complex faults
+
+            }
+            if (this.opSS != -1) {
+                if (this.opSS !== this.segSS.sel) {
+                    this.setSS(this.opSS);                      // set breakpoint here to inspect complex faults
+                }
+                this.opSS = -1;
+            }
+            if (this.opLSP !== X86.ADDR_INVALID) {
+                if (this.opLSP !== this.regLSP) {               // set breakpoint below to inspect complex faults
+                    this.setSP((this.regESP & ~this.segSS.maskAddr) | (this.opLSP - this.segSS.base));
+
+                }
+                this.opLSP = X86.ADDR_INVALID;
+            }
+        }
+        else if (this.nFault != X86.EXCEPTION.DF_FAULT) {
+            /*
+             * Double-fault (error code is always zero, and the responsible instruction is not restartable)
+             */
+            nError = 0;
+            nFault = X86.EXCEPTION.DF_FAULT;
+        }
+        else {
+            /*
+             * Triple-fault (usually referred to in Intel literature as a "shutdown", but at least on the 80286,
+             * it's actually a "reset")
+             */
+            nError = 0;
+            nFault = -1;
+            this.resetRegs();
+            fDispatch = fHalt = false;
+        }
+    }
+
+    if (X86.helpCheckFault.call(this, nFault, nError, fHalt)) {
+        /*
+         * If this is a fault that would normally be dispatched BUT helpCheckFault() wants us to halt,
+         * then we throw a bogus fault number (-1), simply to interrupt the current instruction in exactly
+         * the same way that a dispatched fault would interrupt it.
+         */
+        if (fDispatch) throw -1;
+    }
+
+    if (fDispatch) {
+
+        this.nFault = nFault;
+        X86.helpINT.call(this, nFault, nError, nCycles);
+
+        /*
+         * REP'eated instructions that rewind regLIP to opLIP used to screw up this dispatch,
+         * so now we slip the new regLIP into opLIP, effectively turning their action into a no-op.
+         */
+        this.opLIP = this.regLIP;
+
+        /*
+         * X86.OPFLAG.FAULT flag is used by selected opcodes to provide an early exit, restore register(s),
+         * or whatever is needed to help ensure instruction restartability; there is currently no general
+         * mechanism for snapping and restoring all registers for any instruction that might fault.
+         *
+         * X86.EXCEPTION.DB_EXC exceptions set their own special flag, X86.OPFLAG.DBEXC, to prevent redundant
+         * DEBUG exceptions, so we don't need to set OPFLAG.FAULT in that case, because a DEBUG exception
+         * doesn't actually prevent an instruction from executing (and therefore doesn't need to be restarted).
+         */
+        if (nFault == X86.EXCEPTION.DB_EXC) {
+            this.opFlags |= X86.OPFLAG.DBEXC;
+        } else {
+
+            this.opFlags |= X86.OPFLAG.FAULT;
+        }
+
+        /*
+         * Since this fault is likely being issued in the context of an instruction that hasn't finished
+         * executing, if we don't do anything to interrupt that execution (eg, throw a JavaScript exception),
+         * then we would need to shut off all further reads/writes for the current instruction.
+         *
+         * That's easy for any EA-based memory accesses: simply set both the NOREAD and NOWRITE flags.
+         * However, there are also direct, non-EA-based memory accesses to consider.  A perfect example is
+         * opPUSHA(): if a GP fault occurs on any PUSH other than the last, a subsequent PUSH is likely to
+         * cause another fault, which we will misinterpret as a double-fault -- unless the handler for
+         * such an opcode checks this.opFlags for X86.OPFLAG.FAULT after each step of the operation.
+         *
+         *      this.opFlags |= (X86.OPFLAG.NOREAD | X86.OPFLAG.NOWRITE);
+         *
+         * Fortunately, we now throw an exception that terminates the current instruction, so the above hack
+         * should no longer be necessary.
+         */
+        throw nFault;
+    }
+};
+
+/**
+ * helpPageFault(addr, fPresent, fWrite)
+ *
+ * Helper to dispatch page faults.
+ *
+ * @this {X86CPU}
+ * @param {number} addr
+ * @param {boolean} fPresent
+ * @param {boolean} fWrite
+ */
+X86.helpPageFault = function(addr, fPresent, fWrite)
+{
+    this.regCR2 = addr;
+    var nError = 0;
+    if (fPresent) nError |= X86.PTE.PRESENT;
+    if (fWrite) nError |= X86.PTE.READWRITE;
+    if (this.nCPL == 3) nError |= X86.PTE.USER;
+    X86.helpFault.call(this, X86.EXCEPTION.PF_FAULT, nError);
+};
+
+/**
+ * helpCheckFault(nFault, nError, fHalt)
+ *
+ * Aside from giving the Debugger an opportunity to report every fault, this also gives us the ability to
+ * halt exception processing in tracks: return true to prevent the fault handler from being dispatched.
+ *
+ * At the moment, the only Debugger control you have over fault interception is setting MESSAGE.FAULT, which
+ * will display faults as they occur, and MESSAGE.HALT, which will halt after any Debugger message, including
+ * MESSAGE.FAULT.  If you want execution to continue after halting, clear MESSAGE.FAULT and/or MESSAGE.HALT,
+ * or single-step over the offending instruction, which will allow the fault to be dispatched.
+ *
+ * @this {X86CPU}
+ * @param {number} nFault
+ * @param {number|null} [nError] (if omitted, no error code will be reported)
+ * @param {boolean} [fHalt] (true to halt the CPU, false to not, undefined if "it depends")
+ * @return {boolean|undefined} true to block the fault (often desirable when fHalt is true), otherwise dispatch it
+ */
+X86.helpCheckFault = function(nFault, nError, fHalt)
+{
+    var bitsMessage = Messages.FAULT;
+
+    var bOpcode = this.probeAddr(this.regLIP);
+
+    /*
+     * OS/2 1.0 uses an INT3 (0xCC) opcode in conjunction with an invalid IDT to trigger a triple-fault
+     * reset and return to real-mode, and these resets happen quite frequently during boot; for example,
+     * OS/2 startup messages are displayed using a series of INT 0x10 BIOS calls for each character, and
+     * each series of BIOS calls requires a round-trip mode switch.
+     *
+     * Since we really only want to halt on "bad" faults, not "good" (ie, intentional) faults, we take
+     * advantage of the fact that all 3 faults comprising the triple-fault point to an INT3 (0xCC) opcode,
+     * and so whenever we see that opcode, we ignore the caller's fHalt flag, and suppress FAULT messages
+     * unless CPU messages are also enabled.
+     *
+     * When a triple fault shows up, nFault is -1; it displays as 0xff only because we use toHexByte().
+     */
+    if (bOpcode == X86.OPCODE.INT3 && !this.addrIDTLimit) {
+        fHalt = false;
+    }
+
+    /*
+     * There are a number of V86-mode exceptions we don't need to know about.  For starters, Windows 3.00
+     * (and other versions of enhanced-mode Windows) use an ARPL to switch out of V86-mode, so we can ignore
+     * those UD_FAULTs.
+     *
+     * Ditto for software interrupts, which will generate a GP_FAULT when the interrupt number (eg, 0x6D)
+     * exceeds the protected-mode IDT's limit (eg, a limit of 0x2FF corresponds to a maximum interrupt number
+     * of 0x5F).  Windows doesn't really care if its IDT is too small, because it has to simulate all software
+     * interrupts in V86-mode regardless (they generate a GP_FAULT if IOPL < 3, and even when IOPL == 3, only
+     * the protected-mode IDT handler gets to run).
+     */
+    if (this.regPS & X86.PS.VM) {
+        if (nFault == X86.EXCEPTION.UD_FAULT && bOpcode == X86.OPCODE.ARPL ||
+            nFault == X86.EXCEPTION.GP_FAULT && bOpcode == X86.OPCODE.INTN) {
+            fHalt = false;
+        }
+    }
+    // else if (DEBUG && nFault == X86.EXCEPTION.GP_FAULT && fHalt === undefined) fHalt = true;
+
+    /*
+     * If fHalt has been explicitly set to false, we also take that as a cue to disable fault messages
+     * (which you can override by turning on CPU messages).
+     */
+    if (fHalt === false) {
+        bitsMessage |= Messages.CPU;
+    }
+
+    /*
+     * Similarly, the PC AT ROM BIOS deliberately generates a couple of GP faults as part of the POST
+     * (Power-On Self Test); we don't want to ignore those, but we don't want to halt on them either.  We
+     * detect those faults by virtue of the LIP being in the range 0x0F0000 to 0x0FFFFF.
+     *
+     * TODO: Be aware that this test can trigger false positives, such as when a V86-mode ARPL is hit; eg:
+     *
+     *      &FD82:22F7 6338            ARPL     [BX+SI],DI
+     */
+    if (this.regLIP >= 0x0F0000 && this.regLIP <= 0x0FFFFF) {
+        fHalt = false;
+    }
+
+    /*
+     * However, the foregoing notwithstanding, if MESSAGE.HALT is enabled along with all the other required
+     * MESSAGE bits, then we want to halt regardless.
+     */
+    if (this.messageEnabled(bitsMessage | Messages.HALT)) {
+        fHalt = true;
+    }
+
+    if (this.messageEnabled(bitsMessage) || fHalt) {
+
+        var fRunning = this.flags.running;
+        var sMessage = "Fault " + Str.toHexByte(nFault) + (nError != null? " (" + Str.toHexWord(nError) + ")" : "") + " on opcode " + Str.toHexByte(bOpcode);
+        if (fHalt && fRunning) sMessage += " (blocked)";
+
+        if (DEBUGGER && this.dbg) {
+            this.printMessage(sMessage, fHalt || bitsMessage, true);
+            if (fHalt) {
+                /*
+                 * By setting fHalt to fRunning (which is true while running but false while single-stepping),
+                 * this allows a fault to be dispatched when you single-step over a faulting instruction; you can
+                 * then continue single-stepping into the fault handler, or start running again.
+                 *
+                 * Note that we had to capture fRunning before calling printMessage(), because if MESSAGE.HALT
+                 * is set, printMessage() will have already halted the CPU.
+                 */
+                fHalt = fRunning;
+                this.dbg.stopCPU();
+            }
+        } else {
+            /*
+             * If there's no Debugger, then messageEnabled() must have returned false, which means that fHalt must
+             * be true.  Which means we should shut the machine down.
+             */
+
+            this.notice(sMessage);
+            this.stopCPU();
+        }
+    }
+    return fHalt;
+};
+
+/**
+ * zeroSeg(seg)
+ *
+ * Helper to zero a segment register whenever transitioning to a less privileged (numerically higher) level.
+ *
+ * @this {X86CPU}
+ * @param {X86Seg} seg
+ */
+X86.zeroSeg = function(seg)
+{
+    var acc = seg.acc & X86.DESC.ACC.TYPE.CODE_OR_DATA;
+    if (seg.sel & X86.SEL.MASK) {
+        if (acc == X86.DESC.ACC.TYPE.CODE_EXECONLY ||           // non-readable code segment (not allowed)
+            acc == X86.DESC.ACC.TYPE.CODE_CONFORMING ||         // non-readable code segment (not allowed)
+            acc < X86.DESC.ACC.TYPE.CODE_CONFORMING && seg.dpl < this.nCPL && seg.dpl < (seg.sel & X86.SEL.RPL)) {
+            seg.load(0);
+        }
+    }
+};
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/x86mods.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * Before 80386 support was added to PCx86, the approach to decoding ModRegRM bytes (which I usually
+ * just call ModRM bytes) used one generated function per ModRM value.  This was optimal for 16-bit processors,
+ * because the functions were small, and it was maximally efficient, turning the entire ModRM decoding operation
+ * into one table lookup and function call.
+ *
+ * However, that approach didn't scale well for 32-bit processors, which had extended ModRM capabilities in both
+ * the addressing mode dimension and the operand size dimension.  So I've rewritten ModRM decoding as 18 functions.
+ * The first 9 are for 16-bit addressing modes, and the second 9 are for 32-bit addressing modes.  Within each
+ * group of 9, there are 3 for 8-bit operands, 3 for 16-bit operands, and 3 for 32-bit operands.  And each group of 3
+ * contains functions for register-source, memory-source, and group-source.
+ *
+ * Each of the 18 functions must do additional work to examine the ModRM bits, which makes decoding slightly slower,
+ * but it's not really noticeable, and the speed difference didn't justify the additional generated code.  So one much
+ * smaller file (x86mods.js) replaces a host of older files (x86modb.js, x86modw.js, x86modb16.js, x86modw16.js,
+ * x86modb32.js, x86modw32.js, and x86modsib.js).
+ *
+ * You can dig up the older files from the repository if you're curious, or you can run /modules/pcx86/bin/x86gen.js to
+ * get a sense of what they contained (x86gen.js created most of the code, but it still had to be massaged afterward).
+ */
+
+/**
+ * modRegByte16(fn)
+ *
+ * @this {X86CPU}
+ * @param {function(number,number)} fn (dst,src)
+ */
+X86.modRegByte16 = function(fn)
+{
+    var dst, src;
+    var bModRM = (this.bModRM = this.getIPByte()) & 0xC7;
+
+    switch(bModRM) {
+    case 0x00:
+        src = this.getEAByteData(this.regEBX + this.regESI);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndex;
+        break;
+    case 0x01:
+        src = this.getEAByteData(this.regEBX + this.regEDI);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexExtra;
+        break;
+    case 0x02:
+        src = this.getEAByteStack(this.regEBP + this.regESI);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexExtra;
+        break;
+    case 0x03:
+        src = this.getEAByteStack(this.regEBP + this.regEDI);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndex;
+        break;
+    case 0x04:
+        src = this.getEAByteData(this.regESI);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBase;
+        break;
+    case 0x05:
+        src = this.getEAByteData(this.regEDI);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBase;
+        break;
+    case 0x06:
+        src = this.getEAByteData(this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesDisp;
+        break;
+    case 0x07:
+        src = this.getEAByteData(this.regEBX);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBase;
+        break;
+    case 0x40:
+        src = this.getEAByteData(this.regEBX + this.regESI + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDisp;
+        break;
+    case 0x41:
+        src = this.getEAByteData(this.regEBX + this.regEDI + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDispExtra;
+        break;
+    case 0x42:
+        src = this.getEAByteStack(this.regEBP + this.regESI + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDispExtra;
+        break;
+    case 0x43:
+        src = this.getEAByteStack(this.regEBP + this.regEDI + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDisp;
+        break;
+    case 0x44:
+        src = this.getEAByteData(this.regESI + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x45:
+        src = this.getEAByteData(this.regEDI + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x46:
+        src = this.getEAByteStack(this.regEBP + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x47:
+        src = this.getEAByteData(this.regEBX + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x80:
+        src = this.getEAByteData(this.regEBX + this.regESI + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDisp;
+        break;
+    case 0x81:
+        src = this.getEAByteData(this.regEBX + this.regEDI + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDispExtra;
+        break;
+    case 0x82:
+        src = this.getEAByteStack(this.regEBP + this.regESI + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDispExtra;
+        break;
+    case 0x83:
+        src = this.getEAByteStack(this.regEBP + this.regEDI + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDisp;
+        break;
+    case 0x84:
+        src = this.getEAByteData(this.regESI + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x85:
+        src = this.getEAByteData(this.regEDI + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x86:
+        src = this.getEAByteStack(this.regEBP + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x87:
+        src = this.getEAByteData(this.regEBX + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0xC0:
+        src = this.regEAX & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiAL;
+        break;
+    case 0xC1:
+        src = this.regECX & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiCL;
+        break;
+    case 0xC2:
+        src = this.regEDX & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiDL;
+        break;
+    case 0xC3:
+        src = this.regEBX & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiBL;
+        break;
+    case 0xC4:
+        src = (this.regEAX >> 8) & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiAH;
+        break;
+    case 0xC5:
+        src = (this.regECX >> 8) & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiCH;
+        break;
+    case 0xC6:
+        src = (this.regEDX >> 8) & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiDH;
+        break;
+    case 0xC7:
+        src = (this.regEBX >> 8) & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiBH;
+        break;
+    default:
+        src = 0;
+
+        break;
+    }
+
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    switch(reg) {
+    case 0x0:
+        dst = this.regEAX & 0xff;
+        break;
+    case 0x1:
+        dst = this.regECX & 0xff;
+        break;
+    case 0x2:
+        dst = this.regEDX & 0xff;
+        break;
+    case 0x3:
+        dst = this.regEBX & 0xff;
+        break;
+    case 0x4:
+        dst = (this.regEAX >> 8) & 0xff;
+        break;
+    case 0x5:
+        dst = (this.regECX >> 8) & 0xff;
+        break;
+    case 0x6:
+        dst = (this.regEDX >> 8) & 0xff;
+        break;
+    case 0x7:
+        dst = (this.regEBX >> 8) & 0xff;
+        break;
+    default:
+        dst = 0;
+        break;
+    }
+
+    var b = fn.call(this, dst, src);
+
+    switch(reg) {
+    case 0x0:
+        this.regEAX = (this.regEAX & ~0xff) | b;
+        if (BACKTRACK) this.backTrack.btiAL = this.backTrack.btiEALo;
+        break;
+    case 0x1:
+        this.regECX = (this.regECX & ~0xff) | b;
+        if (BACKTRACK) this.backTrack.btiCL = this.backTrack.btiEALo;
+        break;
+    case 0x2:
+        this.regEDX = (this.regEDX & ~0xff) | b;
+        if (BACKTRACK) this.backTrack.btiDL = this.backTrack.btiEALo;
+        break;
+    case 0x3:
+        this.regEBX = (this.regEBX & ~0xff) | b;
+        if (BACKTRACK) this.backTrack.btiBL = this.backTrack.btiEALo;
+        break;
+    case 0x4:
+        this.regEAX = (this.regEAX & ~0xff00) | (b << 8);
+        if (BACKTRACK) this.backTrack.btiAH = this.backTrack.btiEALo;
+        break;
+    case 0x5:
+        this.regECX = (this.regECX & ~0xff00) | (b << 8);
+        if (BACKTRACK) this.backTrack.btiCH = this.backTrack.btiEALo;
+        break;
+    case 0x6:
+        this.regEDX = (this.regEDX & ~0xff00) | (b << 8);
+        if (BACKTRACK) this.backTrack.btiDH = this.backTrack.btiEALo;
+        break;
+    case 0x7:
+        this.regEBX = (this.regEBX & ~0xff00) | (b << 8);
+        if (BACKTRACK) this.backTrack.btiBH = this.backTrack.btiEALo;
+        break;
+    }
+};
+
+/**
+ * modMemByte16(fn)
+ *
+ * @this {X86CPU}
+ * @param {function(number,number)} fn (dst,src)
+ */
+X86.modMemByte16 = function(fn)
+{
+    var dst, src;
+    var bModRM = (this.bModRM = this.getIPByte()) & 0xC7;
+
+    switch(bModRM) {
+    case 0x00:
+        dst = this.getEAByteData(this.regEBX + this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x01:
+        dst = this.getEAByteData(this.regEBX + this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x02:
+        dst = this.getEAByteStack(this.regEBP + this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x03:
+        dst = this.getEAByteStack(this.regEBP + this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x04:
+        dst = this.getEAByteData(this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x05:
+        dst = this.getEAByteData(this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x06:
+        dst = this.getEAByteData(this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x07:
+        dst = this.getEAByteData(this.regEBX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x40:
+        dst = this.getEAByteData(this.regEBX + this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x41:
+        dst = this.getEAByteData(this.regEBX + this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x42:
+        dst = this.getEAByteStack(this.regEBP + this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x43:
+        dst = this.getEAByteStack(this.regEBP + this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x44:
+        dst = this.getEAByteData(this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x45:
+        dst = this.getEAByteData(this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x46:
+        dst = this.getEAByteStack(this.regEBP + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x47:
+        dst = this.getEAByteData(this.regEBX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x80:
+        dst = this.getEAByteData(this.regEBX + this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x81:
+        dst = this.getEAByteData(this.regEBX + this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x82:
+        dst = this.getEAByteStack(this.regEBP + this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x83:
+        dst = this.getEAByteStack(this.regEBP + this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x84:
+        dst = this.getEAByteData(this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x85:
+        dst = this.getEAByteData(this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x86:
+        dst = this.getEAByteStack(this.regEBP + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x87:
+        dst = this.getEAByteData(this.regEBX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0xC0:
+        dst = this.regEAX & 0xff;
+        break;
+    case 0xC1:
+        dst = this.regECX & 0xff;
+        break;
+    case 0xC2:
+        dst = this.regEDX & 0xff;
+        break;
+    case 0xC3:
+        dst = this.regEBX & 0xff;
+        break;
+    case 0xC4:
+        dst = (this.regEAX >> 8) & 0xff;
+        break;
+    case 0xC5:
+        dst = (this.regECX >> 8) & 0xff;
+        break;
+    case 0xC6:
+        dst = (this.regEDX >> 8) & 0xff;
+        break;
+    case 0xC7:
+        dst = (this.regEBX >> 8) & 0xff;
+        break;
+    default:
+        dst = 0;
+
+        break;
+    }
+
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    switch(reg) {
+    case 0x0:
+        src = this.regEAX & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiAL;
+        break;
+    case 0x1:
+        src = this.regECX & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiCL;
+        break;
+    case 0x2:
+        src = this.regEDX & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiDL;
+        break;
+    case 0x3:
+        src = this.regEBX & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiBL;
+        break;
+    case 0x4:
+        src = (this.regEAX >> 8) & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiAH;
+        break;
+    case 0x5:
+        src = (this.regECX >> 8) & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiCH;
+        break;
+    case 0x6:
+        src = (this.regEDX >> 8) & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiDH;
+        break;
+    case 0x7:
+        src = (this.regEBX >> 8) & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiBH;
+        break;
+    default:
+        src = 0;
+        break;
+    }
+
+    var b = fn.call(this, dst, src);
+
+    switch(bModRM) {
+    case 0x00:
+    case 0x03:
+        this.setEAByte(b);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndex;
+        break;
+    case 0x01:
+    case 0x02:
+        this.setEAByte(b);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexExtra;
+        break;
+    case 0x04:
+    case 0x05:
+    case 0x07:
+        this.setEAByte(b);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBase;
+        break;
+    case 0x06:
+        this.setEAByte(b);
+        this.nStepCycles -= this.cycleCounts.nEACyclesDisp;
+        break;
+    case 0x40:
+    case 0x43:
+    case 0x80:
+    case 0x83:
+        this.setEAByte(b);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDisp;
+        break;
+    case 0x41:
+    case 0x42:
+    case 0x81:
+    case 0x82:
+        this.setEAByte(b);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDispExtra;
+        break;
+    case 0x44:
+    case 0x45:
+    case 0x46:
+    case 0x47:
+    case 0x84:
+    case 0x85:
+    case 0x86:
+    case 0x87:
+        this.setEAByte(b);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0xC0:
+        this.regEAX = (this.regEAX & ~0xff) | b;
+        if (BACKTRACK) this.backTrack.btiAL = this.backTrack.btiEALo;
+        break;
+    case 0xC1:
+        this.regECX = (this.regECX & ~0xff) | b;
+        if (BACKTRACK) this.backTrack.btiCL = this.backTrack.btiEALo;
+        break;
+    case 0xC2:
+        this.regEDX = (this.regEDX & ~0xff) | b;
+        if (BACKTRACK) this.backTrack.btiDL = this.backTrack.btiEALo;
+        break;
+    case 0xC3:
+        this.regEBX = (this.regEBX & ~0xff) | b;
+        if (BACKTRACK) this.backTrack.btiBL = this.backTrack.btiEALo;
+        break;
+    case 0xC4:
+        this.regEAX = (this.regEAX & ~0xff00) | (b << 8);
+        if (BACKTRACK) this.backTrack.btiAH = this.backTrack.btiEALo;
+        break;
+    case 0xC5:
+        this.regECX = (this.regECX & ~0xff00) | (b << 8);
+        if (BACKTRACK) this.backTrack.btiCH = this.backTrack.btiEALo;
+        break;
+    case 0xC6:
+        this.regEDX = (this.regEDX & ~0xff00) | (b << 8);
+        if (BACKTRACK) this.backTrack.btiDH = this.backTrack.btiEALo;
+        break;
+    case 0xC7:
+        this.regEBX = (this.regEBX & ~0xff00) | (b << 8);
+        if (BACKTRACK) this.backTrack.btiBH = this.backTrack.btiEALo;
+        break;
+    default:
+
+        break;
+    }
+};
+
+/**
+ * modGrpByte16(afnGrp, fnSrc)
+ *
+ * @this {X86CPU}
+ * @param {Array.<function(number,number)>} afnGrp
+ * @param {function()} fnSrc
+ */
+X86.modGrpByte16 = function(afnGrp, fnSrc) {
+    var dst;
+    var bModRM = (this.bModRM = this.getIPByte()) & 0xC7;
+
+    switch(bModRM) {
+    case 0x00:
+        dst = this.getEAByteData(this.regEBX + this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x01:
+        dst = this.getEAByteData(this.regEBX + this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x02:
+        dst = this.getEAByteStack(this.regEBP + this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x03:
+        dst = this.getEAByteStack(this.regEBP + this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x04:
+        dst = this.getEAByteData(this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x05:
+        dst = this.getEAByteData(this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x06:
+        dst = this.getEAByteData(this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x07:
+        dst = this.getEAByteData(this.regEBX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x40:
+        dst = this.getEAByteData(this.regEBX + this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x41:
+        dst = this.getEAByteData(this.regEBX + this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x42:
+        dst = this.getEAByteStack(this.regEBP + this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x43:
+        dst = this.getEAByteStack(this.regEBP + this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x44:
+        dst = this.getEAByteData(this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x45:
+        dst = this.getEAByteData(this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x46:
+        dst = this.getEAByteStack(this.regEBP + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x47:
+        dst = this.getEAByteData(this.regEBX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x80:
+        dst = this.getEAByteData(this.regEBX + this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x81:
+        dst = this.getEAByteData(this.regEBX + this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x82:
+        dst = this.getEAByteStack(this.regEBP + this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x83:
+        dst = this.getEAByteStack(this.regEBP + this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x84:
+        dst = this.getEAByteData(this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x85:
+        dst = this.getEAByteData(this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x86:
+        dst = this.getEAByteStack(this.regEBP + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x87:
+        dst = this.getEAByteData(this.regEBX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0xC0:
+        dst = this.regEAX & 0xff;
+        break;
+    case 0xC1:
+        dst = this.regECX & 0xff;
+        break;
+    case 0xC2:
+        dst = this.regEDX & 0xff;
+        break;
+    case 0xC3:
+        dst = this.regEBX & 0xff;
+        break;
+    case 0xC4:
+        dst = (this.regEAX >> 8) & 0xff;
+        break;
+    case 0xC5:
+        dst = (this.regECX >> 8) & 0xff;
+        break;
+    case 0xC6:
+        dst = (this.regEDX >> 8) & 0xff;
+        break;
+    case 0xC7:
+        dst = (this.regEBX >> 8) & 0xff;
+        break;
+    default:
+        dst = 0;
+
+        break;
+    }
+
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    var b = afnGrp[reg].call(this, dst, fnSrc.call(this));
+
+    switch(bModRM) {
+    case 0x00:
+    case 0x03:
+        this.setEAByte(b);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndex;
+        break;
+    case 0x01:
+    case 0x02:
+        this.setEAByte(b);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexExtra;
+        break;
+    case 0x04:
+    case 0x05:
+    case 0x07:
+        this.setEAByte(b);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBase;
+        break;
+    case 0x06:
+        this.setEAByte(b);
+        this.nStepCycles -= this.cycleCounts.nEACyclesDisp;
+        break;
+    case 0x40:
+    case 0x43:
+    case 0x80:
+    case 0x83:
+        this.setEAByte(b);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDisp;
+        break;
+    case 0x41:
+    case 0x42:
+    case 0x81:
+    case 0x82:
+        this.setEAByte(b);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDispExtra;
+        break;
+    case 0x44:
+    case 0x45:
+    case 0x46:
+    case 0x47:
+    case 0x84:
+    case 0x85:
+    case 0x86:
+    case 0x87:
+        this.setEAByte(b);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0xC0:
+        this.regEAX = (this.regEAX & ~0xff) | b;
+        break;
+    case 0xC1:
+        this.regECX = (this.regECX & ~0xff) | b;
+        break;
+    case 0xC2:
+        this.regEDX = (this.regEDX & ~0xff) | b;
+        break;
+    case 0xC3:
+        this.regEBX = (this.regEBX & ~0xff) | b;
+        break;
+    case 0xC4:
+        this.regEAX = (this.regEAX & ~0xff00) | (b << 8);
+        break;
+    case 0xC5:
+        this.regECX = (this.regECX & ~0xff00) | (b << 8);
+        break;
+    case 0xC6:
+        this.regEDX = (this.regEDX & ~0xff00) | (b << 8);
+        break;
+    case 0xC7:
+        this.regEBX = (this.regEBX & ~0xff00) | (b << 8);
+        break;
+    }
+};
+
+/**
+ * modRegShort16(fn)
+ *
+ * @this {X86CPU}
+ * @param {function(number,number)} fn (dst,src)
+ */
+X86.modRegShort16 = function(fn)
+{
+    var dst, src;
+    var bModRM = (this.bModRM = this.getIPByte()) & 0xC7;
+
+    switch(bModRM) {
+    case 0x00:
+        src = this.getEAShortData(this.regEBX + this.regESI);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndex;
+        break;
+    case 0x01:
+        src = this.getEAShortData(this.regEBX + this.regEDI);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexExtra;
+        break;
+    case 0x02:
+        src = this.getEAShortStack(this.regEBP + this.regESI);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexExtra;
+        break;
+    case 0x03:
+        src = this.getEAShortStack(this.regEBP + this.regEDI);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndex;
+        break;
+    case 0x04:
+        src = this.getEAShortData(this.regESI);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBase;
+        break;
+    case 0x05:
+        src = this.getEAShortData(this.regEDI);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBase;
+        break;
+    case 0x06:
+        src = this.getEAShortData(this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesDisp;
+        break;
+    case 0x07:
+        src = this.getEAShortData(this.regEBX);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBase;
+        break;
+    case 0x40:
+        src = this.getEAShortData(this.regEBX + this.regESI + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDisp;
+        break;
+    case 0x41:
+        src = this.getEAShortData(this.regEBX + this.regEDI + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDispExtra;
+        break;
+    case 0x42:
+        src = this.getEAShortStack(this.regEBP + this.regESI + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDispExtra;
+        break;
+    case 0x43:
+        src = this.getEAShortStack(this.regEBP + this.regEDI + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDisp;
+        break;
+    case 0x44:
+        src = this.getEAShortData(this.regESI + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x45:
+        src = this.getEAShortData(this.regEDI + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x46:
+        src = this.getEAShortStack(this.regEBP + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x47:
+        src = this.getEAShortData(this.regEBX + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x80:
+        src = this.getEAShortData(this.regEBX + this.regESI + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDisp;
+        break;
+    case 0x81:
+        src = this.getEAShortData(this.regEBX + this.regEDI + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDispExtra;
+        break;
+    case 0x82:
+        src = this.getEAShortStack(this.regEBP + this.regESI + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDispExtra;
+        break;
+    case 0x83:
+        src = this.getEAShortStack(this.regEBP + this.regEDI + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDisp;
+        break;
+    case 0x84:
+        src = this.getEAShortData(this.regESI + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x85:
+        src = this.getEAShortData(this.regEDI + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x86:
+        src = this.getEAShortStack(this.regEBP + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x87:
+        src = this.getEAShortData(this.regEBX + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0xC0:
+        src = this.regEAX & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiAL; this.backTrack.btiEAHi = this.backTrack.btiAH;
+        }
+        break;
+    case 0xC1:
+        src = this.regECX & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiCL; this.backTrack.btiEAHi = this.backTrack.btiCH;
+        }
+        break;
+    case 0xC2:
+        src = this.regEDX & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiDL; this.backTrack.btiEAHi = this.backTrack.btiDH;
+        }
+        break;
+    case 0xC3:
+        src = this.regEBX & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiBL; this.backTrack.btiEAHi = this.backTrack.btiBH;
+        }
+        break;
+    case 0xC4:
+        src = this.getSP() & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = X86.BTINFO.SP_LO; this.backTrack.btiEAHi = X86.BTINFO.SP_HI;
+        }
+        break;
+    case 0xC5:
+        src = this.regEBP & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiBPLo; this.backTrack.btiEAHi = this.backTrack.btiBPHi;
+        }
+        break;
+    case 0xC6:
+        src = this.regESI & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiSILo; this.backTrack.btiEAHi = this.backTrack.btiSIHi;
+        }
+        break;
+    case 0xC7:
+        src = this.regEDI & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiDILo; this.backTrack.btiEAHi = this.backTrack.btiDIHi;
+        }
+        break;
+    default:
+        src = 0;
+
+        break;
+    }
+
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    switch(reg) {
+    case 0x0:
+        dst = this.regEAX & 0xffff;
+        break;
+    case 0x1:
+        dst = this.regECX & 0xffff;
+        break;
+    case 0x2:
+        dst = this.regEDX & 0xffff;
+        break;
+    case 0x3:
+        dst = this.regEBX & 0xffff;
+        break;
+    case 0x4:
+        dst = this.getSP() & 0xffff;
+        break;
+    case 0x5:
+        dst = this.regEBP & 0xffff;
+        break;
+    case 0x6:
+        dst = this.regESI & 0xffff;
+        break;
+    case 0x7:
+        dst = this.regEDI & 0xffff;
+        break;
+    default:
+        dst = 0;
+        break;
+    }
+
+    var w = fn.call(this, dst, src);
+
+    switch(reg) {
+    case 0x0:
+        this.regEAX = (this.regEAX & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiAL = this.backTrack.btiEALo; this.backTrack.btiAH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x1:
+        this.regECX = (this.regECX & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiCL = this.backTrack.btiEALo; this.backTrack.btiCH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x2:
+        this.regEDX = (this.regEDX & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiDL = this.backTrack.btiEALo; this.backTrack.btiDH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x3:
+        this.regEBX = (this.regEBX & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiBL = this.backTrack.btiEALo; this.backTrack.btiBH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x4:
+        this.setSP((this.getSP() & ~0xffff) | w);
+        break;
+    case 0x5:
+        this.regEBP = (this.regEBP & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiBPLo = this.backTrack.btiEALo; this.backTrack.btiBPHi = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x6:
+        this.regESI = (this.regESI & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiSILo = this.backTrack.btiEALo; this.backTrack.btiSIHi = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x7:
+        this.regEDI = (this.regEDI & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiDILo = this.backTrack.btiEALo; this.backTrack.btiDIHi = this.backTrack.btiEAHi;
+        }
+        break;
+    }
+};
+
+/**
+ * modMemShort16(fn)
+ *
+ * @this {X86CPU}
+ * @param {function(number,number)} fn (dst,src)
+ */
+X86.modMemShort16 = function(fn)
+{
+    var dst, src;
+    var bModRM = (this.bModRM = this.getIPByte()) & 0xC7;
+
+    switch(bModRM) {
+    case 0x00:
+        dst = this.getEAShortData(this.regEBX + this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x01:
+        dst = this.getEAShortData(this.regEBX + this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x02:
+        dst = this.getEAShortStack(this.regEBP + this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x03:
+        dst = this.getEAShortStack(this.regEBP + this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x04:
+        dst = this.getEAShortData(this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x05:
+        dst = this.getEAShortData(this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x06:
+        dst = this.getEAShortData(this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x07:
+        dst = this.getEAShortData(this.regEBX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x40:
+        dst = this.getEAShortData(this.regEBX + this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x41:
+        dst = this.getEAShortData(this.regEBX + this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x42:
+        dst = this.getEAShortStack(this.regEBP + this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x43:
+        dst = this.getEAShortStack(this.regEBP + this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x44:
+        dst = this.getEAShortData(this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x45:
+        dst = this.getEAShortData(this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x46:
+        dst = this.getEAShortStack(this.regEBP + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x47:
+        dst = this.getEAShortData(this.regEBX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x80:
+        dst = this.getEAShortData(this.regEBX + this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x81:
+        dst = this.getEAShortData(this.regEBX + this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x82:
+        dst = this.getEAShortStack(this.regEBP + this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x83:
+        dst = this.getEAShortStack(this.regEBP + this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x84:
+        dst = this.getEAShortData(this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x85:
+        dst = this.getEAShortData(this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x86:
+        dst = this.getEAShortStack(this.regEBP + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x87:
+        dst = this.getEAShortData(this.regEBX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0xC0:
+        dst = this.regEAX & 0xffff;
+        break;
+    case 0xC1:
+        dst = this.regECX & 0xffff;
+        break;
+    case 0xC2:
+        dst = this.regEDX & 0xffff;
+        break;
+    case 0xC3:
+        dst = this.regEBX & 0xffff;
+        break;
+    case 0xC4:
+        dst = this.getSP() & 0xffff;
+        break;
+    case 0xC5:
+        dst = this.regEBP & 0xffff;
+        break;
+    case 0xC6:
+        dst = this.regESI & 0xffff;
+        break;
+    case 0xC7:
+        dst = this.regEDI & 0xffff;
+        break;
+    default:
+        dst = 0;
+
+        break;
+    }
+
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    switch(reg) {
+    case 0x0:
+        src = this.regEAX & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiAL; this.backTrack.btiEAHi = this.backTrack.btiAH;
+        }
+        break;
+    case 0x1:
+        src = this.regECX & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiCL; this.backTrack.btiEAHi = this.backTrack.btiCH;
+        }
+        break;
+    case 0x2:
+        src = this.regEDX & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiDL; this.backTrack.btiEAHi = this.backTrack.btiDH;
+        }
+        break;
+    case 0x3:
+        src = this.regEBX & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiBL; this.backTrack.btiEAHi = this.backTrack.btiBH;
+        }
+        break;
+    case 0x4:
+        src = this.getSP() & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = X86.BTINFO.SP_LO; this.backTrack.btiEAHi = X86.BTINFO.SP_HI;
+        }
+        break;
+    case 0x5:
+        src = this.regEBP & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiBPLo; this.backTrack.btiEAHi = this.backTrack.btiBPHi;
+        }
+        break;
+    case 0x6:
+        src = this.regESI & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiSILo; this.backTrack.btiEAHi = this.backTrack.btiSIHi;
+        }
+        break;
+    case 0x7:
+        src = this.regEDI & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiDILo; this.backTrack.btiEAHi = this.backTrack.btiDIHi;
+        }
+        break;
+    default:
+        src = 0;
+        break;
+    }
+
+    var w = fn.call(this, dst, src);
+
+    switch(bModRM) {
+    case 0x00:
+    case 0x03:
+        this.setEAShort(w);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndex;
+        break;
+    case 0x01:
+    case 0x02:
+        this.setEAShort(w);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexExtra;
+        break;
+    case 0x04:
+    case 0x05:
+    case 0x07:
+        this.setEAShort(w);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBase;
+        break;
+    case 0x06:
+        this.setEAShort(w);
+        this.nStepCycles -= this.cycleCounts.nEACyclesDisp;
+        break;
+    case 0x40:
+    case 0x43:
+    case 0x80:
+    case 0x83:
+        this.setEAShort(w);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDisp;
+        break;
+    case 0x41:
+    case 0x42:
+    case 0x81:
+    case 0x82:
+        this.setEAShort(w);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDispExtra;
+        break;
+    case 0x44:
+    case 0x45:
+    case 0x46:
+    case 0x47:
+    case 0x84:
+    case 0x85:
+    case 0x86:
+    case 0x87:
+        this.setEAShort(w);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0xC0:
+        this.regEAX = (this.regEAX & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiAL = this.backTrack.btiEALo; this.backTrack.btiAH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC1:
+        this.regECX = (this.regECX & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiCL = this.backTrack.btiEALo; this.backTrack.btiCH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC2:
+        this.regEDX = (this.regEDX & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiDL = this.backTrack.btiEALo; this.backTrack.btiDH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC3:
+        this.regEBX = (this.regEBX & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiBL = this.backTrack.btiEALo; this.backTrack.btiBH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC4:
+        this.setSP((this.getSP() & ~0xffff) | w);
+        break;
+    case 0xC5:
+        this.regEBP = (this.regEBP & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiBPLo = this.backTrack.btiEALo; this.backTrack.btiBPHi = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC6:
+        this.regESI = (this.regESI & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiSILo = this.backTrack.btiEALo; this.backTrack.btiSIHi = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC7:
+        this.regEDI = (this.regEDI & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiDILo = this.backTrack.btiEALo; this.backTrack.btiDIHi = this.backTrack.btiEAHi;
+        }
+        break;
+    default:
+
+        break;
+    }
+};
+
+/**
+ * modGrpShort16(afnGrp, fnSrc)
+ *
+ * @this {X86CPU}
+ * @param {Array.<function(number,number)>} afnGrp
+ * @param {function()} fnSrc
+ */
+X86.modGrpShort16 = function(afnGrp, fnSrc) {
+    var dst;
+    var bModRM = (this.bModRM = this.getIPByte()) & 0xC7;
+
+    switch(bModRM) {
+    case 0x00:
+        dst = this.getEAShortData(this.regEBX + this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x01:
+        dst = this.getEAShortData(this.regEBX + this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x02:
+        dst = this.getEAShortStack(this.regEBP + this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x03:
+        dst = this.getEAShortStack(this.regEBP + this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x04:
+        dst = this.getEAShortData(this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x05:
+        dst = this.getEAShortData(this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x06:
+        dst = this.getEAShortData(this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x07:
+        dst = this.getEAShortData(this.regEBX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x40:
+        dst = this.getEAShortData(this.regEBX + this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x41:
+        dst = this.getEAShortData(this.regEBX + this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x42:
+        dst = this.getEAShortStack(this.regEBP + this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x43:
+        dst = this.getEAShortStack(this.regEBP + this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x44:
+        dst = this.getEAShortData(this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x45:
+        dst = this.getEAShortData(this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x46:
+        dst = this.getEAShortStack(this.regEBP + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x47:
+        dst = this.getEAShortData(this.regEBX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x80:
+        dst = this.getEAShortData(this.regEBX + this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x81:
+        dst = this.getEAShortData(this.regEBX + this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x82:
+        dst = this.getEAShortStack(this.regEBP + this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x83:
+        dst = this.getEAShortStack(this.regEBP + this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x84:
+        dst = this.getEAShortData(this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x85:
+        dst = this.getEAShortData(this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x86:
+        dst = this.getEAShortStack(this.regEBP + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x87:
+        dst = this.getEAShortData(this.regEBX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0xC0:
+        dst = this.regEAX & 0xffff;
+        break;
+    case 0xC1:
+        dst = this.regECX & 0xffff;
+        break;
+    case 0xC2:
+        dst = this.regEDX & 0xffff;
+        break;
+    case 0xC3:
+        dst = this.regEBX & 0xffff;
+        break;
+    case 0xC4:
+        dst = this.getSP() & 0xffff;
+        break;
+    case 0xC5:
+        dst = this.regEBP & 0xffff;
+        break;
+    case 0xC6:
+        dst = this.regESI & 0xffff;
+        break;
+    case 0xC7:
+        dst = this.regEDI & 0xffff;
+        break;
+    default:
+        dst = 0;
+
+        break;
+    }
+
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    var w = afnGrp[reg].call(this, dst, fnSrc.call(this));
+
+    switch(bModRM) {
+    case 0x00:
+    case 0x03:
+        this.setEAShort(w);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndex;
+        break;
+    case 0x01:
+    case 0x02:
+        this.setEAShort(w);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexExtra;
+        break;
+    case 0x04:
+    case 0x05:
+    case 0x07:
+        this.setEAShort(w);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBase;
+        break;
+    case 0x06:
+        this.setEAShort(w);
+        this.nStepCycles -= this.cycleCounts.nEACyclesDisp;
+        break;
+    case 0x40:
+    case 0x43:
+    case 0x80:
+    case 0x83:
+        this.setEAShort(w);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDisp;
+        break;
+    case 0x41:
+    case 0x42:
+    case 0x81:
+    case 0x82:
+        this.setEAShort(w);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDispExtra;
+        break;
+    case 0x44:
+    case 0x45:
+    case 0x46:
+    case 0x47:
+    case 0x84:
+    case 0x85:
+    case 0x86:
+    case 0x87:
+        this.setEAShort(w);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0xC0:
+        this.regEAX = (this.regEAX & ~0xffff) | w;
+        break;
+    case 0xC1:
+        this.regECX = (this.regECX & ~0xffff) | w;
+        break;
+    case 0xC2:
+        this.regEDX = (this.regEDX & ~0xffff) | w;
+        break;
+    case 0xC3:
+        this.regEBX = (this.regEBX & ~0xffff) | w;
+        break;
+    case 0xC4:
+        this.setSP((this.getSP() & ~0xffff) | w);
+        break;
+    case 0xC5:
+        this.regEBP = (this.regEBP & ~0xffff) | w;
+        break;
+    case 0xC6:
+        this.regESI = (this.regESI & ~0xffff) | w;
+        break;
+    case 0xC7:
+        this.regEDI = (this.regEDI & ~0xffff) | w;
+        break;
+    }
+};
+
+/**
+ * modRegLong16(fn)
+ *
+ * @this {X86CPU}
+ * @param {function(number,number)} fn (dst,src)
+ */
+X86.modRegLong16 = function(fn)
+{
+    var dst, src;
+    var bModRM = (this.bModRM = this.getIPByte()) & 0xC7;
+
+    switch(bModRM) {
+    case 0x00:
+        src = this.getEALongData(this.regEBX + this.regESI);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndex;
+        break;
+    case 0x01:
+        src = this.getEALongData(this.regEBX + this.regEDI);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexExtra;
+        break;
+    case 0x02:
+        src = this.getEALongStack(this.regEBP + this.regESI);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexExtra;
+        break;
+    case 0x03:
+        src = this.getEALongStack(this.regEBP + this.regEDI);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndex;
+        break;
+    case 0x04:
+        src = this.getEALongData(this.regESI);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBase;
+        break;
+    case 0x05:
+        src = this.getEALongData(this.regEDI);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBase;
+        break;
+    case 0x06:
+        src = this.getEALongData(this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesDisp;
+        break;
+    case 0x07:
+        src = this.getEALongData(this.regEBX);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBase;
+        break;
+    case 0x40:
+        src = this.getEALongData(this.regEBX + this.regESI + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDisp;
+        break;
+    case 0x41:
+        src = this.getEALongData(this.regEBX + this.regEDI + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDispExtra;
+        break;
+    case 0x42:
+        src = this.getEALongStack(this.regEBP + this.regESI + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDispExtra;
+        break;
+    case 0x43:
+        src = this.getEALongStack(this.regEBP + this.regEDI + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDisp;
+        break;
+    case 0x44:
+        src = this.getEALongData(this.regESI + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x45:
+        src = this.getEALongData(this.regEDI + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x46:
+        src = this.getEALongStack(this.regEBP + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x47:
+        src = this.getEALongData(this.regEBX + this.getIPDisp());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x80:
+        src = this.getEALongData(this.regEBX + this.regESI + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDisp;
+        break;
+    case 0x81:
+        src = this.getEALongData(this.regEBX + this.regEDI + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDispExtra;
+        break;
+    case 0x82:
+        src = this.getEALongStack(this.regEBP + this.regESI + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDispExtra;
+        break;
+    case 0x83:
+        src = this.getEALongStack(this.regEBP + this.regEDI + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDisp;
+        break;
+    case 0x84:
+        src = this.getEALongData(this.regESI + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x85:
+        src = this.getEALongData(this.regEDI + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x86:
+        src = this.getEALongStack(this.regEBP + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0x87:
+        src = this.getEALongData(this.regEBX + this.getIPAddr());
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0xC0:
+        src = this.regEAX;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiAL; this.backTrack.btiEAHi = this.backTrack.btiAH;
+        }
+        break;
+    case 0xC1:
+        src = this.regECX;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiCL; this.backTrack.btiEAHi = this.backTrack.btiCH;
+        }
+        break;
+    case 0xC2:
+        src = this.regEDX;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiDL; this.backTrack.btiEAHi = this.backTrack.btiDH;
+        }
+        break;
+    case 0xC3:
+        src = this.regEBX;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiBL; this.backTrack.btiEAHi = this.backTrack.btiBH;
+        }
+        break;
+    case 0xC4:
+        src = this.getSP();
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = X86.BTINFO.SP_LO; this.backTrack.btiEAHi = X86.BTINFO.SP_HI;
+        }
+        break;
+    case 0xC5:
+        src = this.regEBP;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiBPLo; this.backTrack.btiEAHi = this.backTrack.btiBPHi;
+        }
+        break;
+    case 0xC6:
+        src = this.regESI;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiSILo; this.backTrack.btiEAHi = this.backTrack.btiSIHi;
+        }
+        break;
+    case 0xC7:
+        src = this.regEDI;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiDILo; this.backTrack.btiEAHi = this.backTrack.btiDIHi;
+        }
+        break;
+    default:
+        src = 0;
+
+        break;
+    }
+
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    switch(reg) {
+    case 0x0:
+        dst = this.regEAX;
+        break;
+    case 0x1:
+        dst = this.regECX;
+        break;
+    case 0x2:
+        dst = this.regEDX;
+        break;
+    case 0x3:
+        dst = this.regEBX;
+        break;
+    case 0x4:
+        dst = this.getSP();
+        break;
+    case 0x5:
+        dst = this.regEBP;
+        break;
+    case 0x6:
+        dst = this.regESI;
+        break;
+    case 0x7:
+        dst = this.regEDI;
+        break;
+    default:
+        dst = 0;
+        break;
+    }
+
+    var l = fn.call(this, dst, src);
+
+    switch(reg) {
+    case 0x0:
+        this.regEAX = l;
+        if (BACKTRACK) {
+            this.backTrack.btiAL = this.backTrack.btiEALo; this.backTrack.btiAH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x1:
+        this.regECX = l;
+        if (BACKTRACK) {
+            this.backTrack.btiCL = this.backTrack.btiEALo; this.backTrack.btiCH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x2:
+        this.regEDX = l;
+        if (BACKTRACK) {
+            this.backTrack.btiDL = this.backTrack.btiEALo; this.backTrack.btiDH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x3:
+        this.regEBX = l;
+        if (BACKTRACK) {
+            this.backTrack.btiBL = this.backTrack.btiEALo; this.backTrack.btiBH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x4:
+        this.setSP(l);
+        break;
+    case 0x5:
+        this.regEBP = l;
+        if (BACKTRACK) {
+            this.backTrack.btiBPLo = this.backTrack.btiEALo; this.backTrack.btiBPHi = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x6:
+        this.regESI = l;
+        if (BACKTRACK) {
+            this.backTrack.btiSILo = this.backTrack.btiEALo; this.backTrack.btiSIHi = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x7:
+        this.regEDI = l;
+        if (BACKTRACK) {
+            this.backTrack.btiDILo = this.backTrack.btiEALo; this.backTrack.btiDIHi = this.backTrack.btiEAHi;
+        }
+        break;
+    }
+};
+
+/**
+ * modMemLong16(fn)
+ *
+ * @this {X86CPU}
+ * @param {function(number,number)} fn (dst,src)
+ */
+X86.modMemLong16 = function(fn)
+{
+    var dst, src;
+    var bModRM = (this.bModRM = this.getIPByte()) & 0xC7;
+
+    switch(bModRM) {
+    case 0x00:
+        dst = this.getEALongData(this.regEBX + this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x01:
+        dst = this.getEALongData(this.regEBX + this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x02:
+        dst = this.getEALongStack(this.regEBP + this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x03:
+        dst = this.getEALongStack(this.regEBP + this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x04:
+        dst = this.getEALongData(this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x05:
+        dst = this.getEALongData(this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x06:
+        dst = this.getEALongData(this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x07:
+        dst = this.getEALongData(this.regEBX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x40:
+        dst = this.getEALongData(this.regEBX + this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x41:
+        dst = this.getEALongData(this.regEBX + this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x42:
+        dst = this.getEALongStack(this.regEBP + this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x43:
+        dst = this.getEALongStack(this.regEBP + this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x44:
+        dst = this.getEALongData(this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x45:
+        dst = this.getEALongData(this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x46:
+        dst = this.getEALongStack(this.regEBP + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x47:
+        dst = this.getEALongData(this.regEBX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x80:
+        dst = this.getEALongData(this.regEBX + this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x81:
+        dst = this.getEALongData(this.regEBX + this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x82:
+        dst = this.getEALongStack(this.regEBP + this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x83:
+        dst = this.getEALongStack(this.regEBP + this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x84:
+        dst = this.getEALongData(this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x85:
+        dst = this.getEALongData(this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x86:
+        dst = this.getEALongStack(this.regEBP + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x87:
+        dst = this.getEALongData(this.regEBX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0xC0:
+        dst = this.regEAX;
+        break;
+    case 0xC1:
+        dst = this.regECX;
+        break;
+    case 0xC2:
+        dst = this.regEDX;
+        break;
+    case 0xC3:
+        dst = this.regEBX;
+        break;
+    case 0xC4:
+        dst = this.getSP();
+        break;
+    case 0xC5:
+        dst = this.regEBP;
+        break;
+    case 0xC6:
+        dst = this.regESI;
+        break;
+    case 0xC7:
+        dst = this.regEDI;
+        break;
+    default:
+        dst = 0;
+
+        break;
+    }
+
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    switch(reg) {
+    case 0x0:
+        src = this.regEAX;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiAL; this.backTrack.btiEAHi = this.backTrack.btiAH;
+        }
+        break;
+    case 0x1:
+        src = this.regECX;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiCL; this.backTrack.btiEAHi = this.backTrack.btiCH;
+        }
+        break;
+    case 0x2:
+        src = this.regEDX;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiDL; this.backTrack.btiEAHi = this.backTrack.btiDH;
+        }
+        break;
+    case 0x3:
+        src = this.regEBX;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiBL; this.backTrack.btiEAHi = this.backTrack.btiBH;
+        }
+        break;
+    case 0x4:
+        src = this.getSP();
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = X86.BTINFO.SP_LO; this.backTrack.btiEAHi = X86.BTINFO.SP_HI;
+        }
+        break;
+    case 0x5:
+        src = this.regEBP;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiBPLo; this.backTrack.btiEAHi = this.backTrack.btiBPHi;
+        }
+        break;
+    case 0x6:
+        src = this.regESI;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiSILo; this.backTrack.btiEAHi = this.backTrack.btiSIHi;
+        }
+        break;
+    case 0x7:
+        src = this.regEDI;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiDILo; this.backTrack.btiEAHi = this.backTrack.btiDIHi;
+        }
+        break;
+    default:
+        src = 0;
+        break;
+    }
+
+    var l = fn.call(this, dst, src);
+
+    switch(bModRM) {
+    case 0x00:
+    case 0x03:
+        this.setEALong(l);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndex;
+        break;
+    case 0x01:
+    case 0x02:
+        this.setEALong(l);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexExtra;
+        break;
+    case 0x04:
+    case 0x05:
+    case 0x07:
+        this.setEALong(l);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBase;
+        break;
+    case 0x06:
+        this.setEALong(l);
+        this.nStepCycles -= this.cycleCounts.nEACyclesDisp;
+        break;
+    case 0x40:
+    case 0x43:
+    case 0x80:
+    case 0x83:
+        this.setEALong(l);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDisp;
+        break;
+    case 0x41:
+    case 0x42:
+    case 0x81:
+    case 0x82:
+        this.setEALong(l);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDispExtra;
+        break;
+    case 0x44:
+    case 0x45:
+    case 0x46:
+    case 0x47:
+    case 0x84:
+    case 0x85:
+    case 0x86:
+    case 0x87:
+        this.setEALong(l);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0xC0:
+        this.regEAX = l;
+        if (BACKTRACK) {
+            this.backTrack.btiAL = this.backTrack.btiEALo; this.backTrack.btiAH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC1:
+        this.regECX = l;
+        if (BACKTRACK) {
+            this.backTrack.btiCL = this.backTrack.btiEALo; this.backTrack.btiCH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC2:
+        this.regEDX = l;
+        if (BACKTRACK) {
+            this.backTrack.btiDL = this.backTrack.btiEALo; this.backTrack.btiDH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC3:
+        this.regEBX = l;
+        if (BACKTRACK) {
+            this.backTrack.btiBL = this.backTrack.btiEALo; this.backTrack.btiBH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC4:
+        this.setSP(l);
+        break;
+    case 0xC5:
+        this.regEBP = l;
+        if (BACKTRACK) {
+            this.backTrack.btiBPLo = this.backTrack.btiEALo; this.backTrack.btiBPHi = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC6:
+        this.regESI = l;
+        if (BACKTRACK) {
+            this.backTrack.btiSILo = this.backTrack.btiEALo; this.backTrack.btiSIHi = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC7:
+        this.regEDI = l;
+        if (BACKTRACK) {
+            this.backTrack.btiDILo = this.backTrack.btiEALo; this.backTrack.btiDIHi = this.backTrack.btiEAHi;
+        }
+        break;
+    default:
+
+        break;
+    }
+};
+
+/**
+ * modGrpLong16(afnGrp, fnSrc)
+ *
+ * @this {X86CPU}
+ * @param {Array.<function(number,number)>} afnGrp
+ * @param {function()} fnSrc
+ */
+X86.modGrpLong16 = function(afnGrp, fnSrc) {
+    var dst;
+    var bModRM = (this.bModRM = this.getIPByte()) & 0xC7;
+
+    switch(bModRM) {
+    case 0x00:
+        dst = this.getEALongData(this.regEBX + this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x01:
+        dst = this.getEALongData(this.regEBX + this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x02:
+        dst = this.getEALongStack(this.regEBP + this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x03:
+        dst = this.getEALongStack(this.regEBP + this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x04:
+        dst = this.getEALongData(this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x05:
+        dst = this.getEALongData(this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x06:
+        dst = this.getEALongData(this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x07:
+        dst = this.getEALongData(this.regEBX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x40:
+        dst = this.getEALongData(this.regEBX + this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x41:
+        dst = this.getEALongData(this.regEBX + this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x42:
+        dst = this.getEALongStack(this.regEBP + this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x43:
+        dst = this.getEALongStack(this.regEBP + this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x44:
+        dst = this.getEALongData(this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x45:
+        dst = this.getEALongData(this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x46:
+        dst = this.getEALongStack(this.regEBP + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x47:
+        dst = this.getEALongData(this.regEBX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x80:
+        dst = this.getEALongData(this.regEBX + this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x81:
+        dst = this.getEALongData(this.regEBX + this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x82:
+        dst = this.getEALongStack(this.regEBP + this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x83:
+        dst = this.getEALongStack(this.regEBP + this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x84:
+        dst = this.getEALongData(this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x85:
+        dst = this.getEALongData(this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x86:
+        dst = this.getEALongStack(this.regEBP + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x87:
+        dst = this.getEALongData(this.regEBX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0xC0:
+        dst = this.regEAX;
+        break;
+    case 0xC1:
+        dst = this.regECX;
+        break;
+    case 0xC2:
+        dst = this.regEDX;
+        break;
+    case 0xC3:
+        dst = this.regEBX;
+        break;
+    case 0xC4:
+        dst = this.getSP();
+        break;
+    case 0xC5:
+        dst = this.regEBP;
+        break;
+    case 0xC6:
+        dst = this.regESI;
+        break;
+    case 0xC7:
+        dst = this.regEDI;
+        break;
+    default:
+
+        break;
+    }
+
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    var l = afnGrp[reg].call(this, dst, fnSrc.call(this));
+
+    switch(bModRM) {
+    case 0x00:
+    case 0x03:
+        this.setEALong(l);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndex;
+        break;
+    case 0x01:
+    case 0x02:
+        this.setEALong(l);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexExtra;
+        break;
+    case 0x04:
+    case 0x05:
+    case 0x07:
+        this.setEALong(l);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBase;
+        break;
+    case 0x06:
+        this.setEALong(l);
+        this.nStepCycles -= this.cycleCounts.nEACyclesDisp;
+        break;
+    case 0x40:
+    case 0x43:
+    case 0x80:
+    case 0x83:
+        this.setEALong(l);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDisp;
+        break;
+    case 0x41:
+    case 0x42:
+    case 0x81:
+    case 0x82:
+        this.setEALong(l);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseIndexDispExtra;
+        break;
+    case 0x44:
+    case 0x45:
+    case 0x46:
+    case 0x47:
+    case 0x84:
+    case 0x85:
+    case 0x86:
+    case 0x87:
+        this.setEALong(l);
+        this.nStepCycles -= this.cycleCounts.nEACyclesBaseDisp;
+        break;
+    case 0xC0:
+        this.regEAX = l;
+        break;
+    case 0xC1:
+        this.regECX = l;
+        break;
+    case 0xC2:
+        this.regEDX = l;
+        break;
+    case 0xC3:
+        this.regEBX = l;
+        break;
+    case 0xC4:
+        this.setSP(l);
+        break;
+    case 0xC5:
+        this.regEBP = l;
+        break;
+    case 0xC6:
+        this.regESI = l;
+        break;
+    case 0xC7:
+        this.regEDI = l;
+        break;
+    }
+};
+
+/**
+ * modRegByte32(fn)
+ *
+ * @this {X86CPU}
+ * @param {function(number,number)} fn (dst,src)
+ */
+X86.modRegByte32 = function(fn)
+{
+    var dst, src;
+    var bModRM = (this.bModRM = this.getIPByte()) & 0xC7;
+
+    switch(bModRM) {
+    case 0x00:
+        src = this.getEAByteData(this.regEAX);
+        break;
+    case 0x01:
+        src = this.getEAByteData(this.regECX);
+        break;
+    case 0x02:
+        src = this.getEAByteData(this.regEDX);
+        break;
+    case 0x03:
+        src = this.getEAByteData(this.regEBX);
+        break;
+    case 0x04:
+        src = this.getEAByteData(X86.modSIB.call(this, 0));
+        break;
+    case 0x05:
+        src = this.getEAByteData(this.getIPAddr());
+        break;
+    case 0x06:
+        src = this.getEAByteData(this.regESI);
+        break;
+    case 0x07:
+        src = this.getEAByteData(this.regEDI);
+        break;
+    case 0x40:
+        src = this.getEAByteData(this.regEAX + this.getIPDisp());
+        break;
+    case 0x41:
+        src = this.getEAByteData(this.regECX + this.getIPDisp());
+        break;
+    case 0x42:
+        src = this.getEAByteData(this.regEDX + this.getIPDisp());
+        break;
+    case 0x43:
+        src = this.getEAByteData(this.regEBX + this.getIPDisp());
+        break;
+    case 0x44:
+        src = this.getEAByteData(X86.modSIB.call(this, 1) + this.getIPDisp());
+        break;
+    case 0x45:
+        src = this.getEAByteStack(this.regEBP + this.getIPDisp());
+        break;
+    case 0x46:
+        src = this.getEAByteData(this.regESI + this.getIPDisp());
+        break;
+    case 0x47:
+        src = this.getEAByteData(this.regEDI + this.getIPDisp());
+        break;
+    case 0x80:
+        src = this.getEAByteData(this.regEAX + this.getIPAddr());
+        break;
+    case 0x81:
+        src = this.getEAByteData(this.regECX + this.getIPAddr());
+        break;
+    case 0x82:
+        src = this.getEAByteData(this.regEDX + this.getIPAddr());
+        break;
+    case 0x83:
+        src = this.getEAByteData(this.regEBX + this.getIPAddr());
+        break;
+    case 0x84:
+        src = this.getEAByteData(X86.modSIB.call(this, 2) + this.getIPAddr());
+        break;
+    case 0x85:
+        src = this.getEAByteStack(this.regEBP + this.getIPAddr());
+        break;
+    case 0x86:
+        src = this.getEAByteData(this.regESI + this.getIPAddr());
+        break;
+    case 0x87:
+        src = this.getEAByteData(this.regEDI + this.getIPAddr());
+        break;
+    case 0xC0:
+        src = this.regEAX & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiAL;
+        break;
+    case 0xC1:
+        src = this.regECX & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiCL;
+        break;
+    case 0xC2:
+        src = this.regEDX & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiDL;
+        break;
+    case 0xC3:
+        src = this.regEBX & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiBL;
+        break;
+    case 0xC4:
+        src = (this.regEAX >> 8) & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiAH;
+        break;
+    case 0xC5:
+        src = (this.regECX >> 8) & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiCH;
+        break;
+    case 0xC6:
+        src = (this.regEDX >> 8) & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiDH;
+        break;
+    case 0xC7:
+        src = (this.regEBX >> 8) & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiBH;
+        break;
+    default:
+        src = 0;
+
+        break;
+    }
+
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    switch(reg) {
+    case 0x0:
+        dst = this.regEAX & 0xff;
+        break;
+    case 0x1:
+        dst = this.regECX & 0xff;
+        break;
+    case 0x2:
+        dst = this.regEDX & 0xff;
+        break;
+    case 0x3:
+        dst = this.regEBX & 0xff;
+        break;
+    case 0x4:
+        dst = (this.regEAX >> 8) & 0xff;
+        break;
+    case 0x5:
+        dst = (this.regECX >> 8) & 0xff;
+        break;
+    case 0x6:
+        dst = (this.regEDX >> 8) & 0xff;
+        break;
+    case 0x7:
+        dst = (this.regEBX >> 8) & 0xff;
+        break;
+    default:
+        dst = 0;
+        break;
+    }
+
+    var b = fn.call(this, dst, src);
+
+    switch(reg) {
+    case 0x0:
+        this.regEAX = (this.regEAX & ~0xff) | b;
+        if (BACKTRACK) this.backTrack.btiAL = this.backTrack.btiEALo;
+        break;
+    case 0x1:
+        this.regECX = (this.regECX & ~0xff) | b;
+        if (BACKTRACK) this.backTrack.btiCL = this.backTrack.btiEALo;
+        break;
+    case 0x2:
+        this.regEDX = (this.regEDX & ~0xff) | b;
+        if (BACKTRACK) this.backTrack.btiDL = this.backTrack.btiEALo;
+        break;
+    case 0x3:
+        this.regEBX = (this.regEBX & ~0xff) | b;
+        if (BACKTRACK) this.backTrack.btiBL = this.backTrack.btiEALo;
+        break;
+    case 0x4:
+        this.regEAX = (this.regEAX & ~0xff00) | (b << 8);
+        if (BACKTRACK) this.backTrack.btiAH = this.backTrack.btiEALo;
+        break;
+    case 0x5:
+        this.regECX = (this.regECX & ~0xff00) | (b << 8);
+        if (BACKTRACK) this.backTrack.btiCH = this.backTrack.btiEALo;
+        break;
+    case 0x6:
+        this.regEDX = (this.regEDX & ~0xff00) | (b << 8);
+        if (BACKTRACK) this.backTrack.btiDH = this.backTrack.btiEALo;
+        break;
+    case 0x7:
+        this.regEBX = (this.regEBX & ~0xff00) | (b << 8);
+        if (BACKTRACK) this.backTrack.btiBH = this.backTrack.btiEALo;
+        break;
+    }
+};
+
+/**
+ * modMemByte32(fn)
+ *
+ * @this {X86CPU}
+ * @param {function(number,number)} fn (dst,src)
+ */
+X86.modMemByte32 = function(fn)
+{
+    var dst, src;
+    var bModRM = (this.bModRM = this.getIPByte()) & 0xC7;
+
+    switch(bModRM) {
+    case 0x00:
+        dst = this.getEAByteData(this.regEAX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x01:
+        dst = this.getEAByteData(this.regECX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x02:
+        dst = this.getEAByteData(this.regEDX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x03:
+        dst = this.getEAByteData(this.regEBX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x04:
+        dst = this.getEAByteData(X86.modSIB.call(this, 0));
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x05:
+        dst = this.getEAByteData(this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x06:
+        dst = this.getEAByteData(this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x07:
+        dst = this.getEAByteData(this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x40:
+        dst = this.getEAByteData(this.regEAX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x41:
+        dst = this.getEAByteData(this.regECX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x42:
+        dst = this.getEAByteData(this.regEDX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x43:
+        dst = this.getEAByteData(this.regEBX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x44:
+        dst = this.getEAByteData(X86.modSIB.call(this, 1) + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x45:
+        dst = this.getEAByteStack(this.regEBP + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x46:
+        dst = this.getEAByteData(this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x47:
+        dst = this.getEAByteData(this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x80:
+        dst = this.getEAByteData(this.regEAX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x81:
+        dst = this.getEAByteData(this.regECX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x82:
+        dst = this.getEAByteData(this.regEDX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x83:
+        dst = this.getEAByteData(this.regEBX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x84:
+        dst = this.getEAByteData(X86.modSIB.call(this, 2) + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x85:
+        dst = this.getEAByteStack(this.regEBP + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x86:
+        dst = this.getEAByteData(this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x87:
+        dst = this.getEAByteData(this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0xC0:
+        dst = this.regEAX & 0xff;
+        break;
+    case 0xC1:
+        dst = this.regECX & 0xff;
+        break;
+    case 0xC2:
+        dst = this.regEDX & 0xff;
+        break;
+    case 0xC3:
+        dst = this.regEBX & 0xff;
+        break;
+    case 0xC4:
+        dst = (this.regEAX >> 8) & 0xff;
+        break;
+    case 0xC5:
+        dst = (this.regECX >> 8) & 0xff;
+        break;
+    case 0xC6:
+        dst = (this.regEDX >> 8) & 0xff;
+        break;
+    case 0xC7:
+        dst = (this.regEBX >> 8) & 0xff;
+        break;
+    default:
+        dst = 0;
+
+        break;
+    }
+
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    switch(reg) {
+    case 0x0:
+        src = this.regEAX & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiAL;
+        break;
+    case 0x1:
+        src = this.regECX & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiCL;
+        break;
+    case 0x2:
+        src = this.regEDX & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiDL;
+        break;
+    case 0x3:
+        src = this.regEBX & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiBL;
+        break;
+    case 0x4:
+        src = (this.regEAX >> 8) & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiAH;
+        break;
+    case 0x5:
+        src = (this.regECX >> 8) & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiCH;
+        break;
+    case 0x6:
+        src = (this.regEDX >> 8) & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiDH;
+        break;
+    case 0x7:
+        src = (this.regEBX >> 8) & 0xff;
+        if (BACKTRACK) this.backTrack.btiEALo = this.backTrack.btiBH;
+        break;
+    default:
+        src = 0;
+        break;
+    }
+
+    var b = fn.call(this, dst, src);
+
+    switch(bModRM) {
+    case 0xC0:
+        this.regEAX = (this.regEAX & ~0xff) | b;
+        if (BACKTRACK) this.backTrack.btiAL = this.backTrack.btiEALo;
+        break;
+    case 0xC1:
+        this.regECX = (this.regECX & ~0xff) | b;
+        if (BACKTRACK) this.backTrack.btiCL = this.backTrack.btiEALo;
+        break;
+    case 0xC2:
+        this.regEDX = (this.regEDX & ~0xff) | b;
+        if (BACKTRACK) this.backTrack.btiDL = this.backTrack.btiEALo;
+        break;
+    case 0xC3:
+        this.regEBX = (this.regEBX & ~0xff) | b;
+        if (BACKTRACK) this.backTrack.btiBL = this.backTrack.btiEALo;
+        break;
+    case 0xC4:
+        this.regEAX = (this.regEAX & ~0xff00) | (b << 8);
+        if (BACKTRACK) this.backTrack.btiAH = this.backTrack.btiEALo;
+        break;
+    case 0xC5:
+        this.regECX = (this.regECX & ~0xff00) | (b << 8);
+        if (BACKTRACK) this.backTrack.btiCH = this.backTrack.btiEALo;
+        break;
+    case 0xC6:
+        this.regEDX = (this.regEDX & ~0xff00) | (b << 8);
+        if (BACKTRACK) this.backTrack.btiDH = this.backTrack.btiEALo;
+        break;
+    case 0xC7:
+        this.regEBX = (this.regEBX & ~0xff00) | (b << 8);
+        if (BACKTRACK) this.backTrack.btiBH = this.backTrack.btiEALo;
+        break;
+    default:
+        this.setEAByte(b);
+        break;
+    }
+};
+
+/**
+ * modGrpByte32(afnGrp, fnSrc)
+ *
+ * @this {X86CPU}
+ * @param {Array.<function(number,number)>} afnGrp
+ * @param {function()} fnSrc
+ */
+X86.modGrpByte32 = function(afnGrp, fnSrc) {
+    var dst;
+    var bModRM = (this.bModRM = this.getIPByte()) & 0xC7;
+
+    switch(bModRM) {
+    case 0x00:
+        dst = this.getEAByteData(this.regEAX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x01:
+        dst = this.getEAByteData(this.regECX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x02:
+        dst = this.getEAByteData(this.regEDX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x03:
+        dst = this.getEAByteData(this.regEBX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x04:
+        dst = this.getEAByteData(X86.modSIB.call(this, 0));
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x05:
+        dst = this.getEAByteData(this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x06:
+        dst = this.getEAByteData(this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x07:
+        dst = this.getEAByteData(this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x40:
+        dst = this.getEAByteData(this.regEAX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x41:
+        dst = this.getEAByteData(this.regECX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x42:
+        dst = this.getEAByteData(this.regEDX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x43:
+        dst = this.getEAByteData(this.regEBX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x44:
+        dst = this.getEAByteData(X86.modSIB.call(this, 1) + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x45:
+        dst = this.getEAByteStack(this.regEBP + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x46:
+        dst = this.getEAByteData(this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x47:
+        dst = this.getEAByteData(this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x80:
+        dst = this.getEAByteData(this.regEAX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x81:
+        dst = this.getEAByteData(this.regECX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x82:
+        dst = this.getEAByteData(this.regEDX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x83:
+        dst = this.getEAByteData(this.regEBX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x84:
+        dst = this.getEAByteData(X86.modSIB.call(this, 2) + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x85:
+        dst = this.getEAByteStack(this.regEBP + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x86:
+        dst = this.getEAByteData(this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x87:
+        dst = this.getEAByteData(this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0xC0:
+        dst = this.regEAX & 0xff;
+        break;
+    case 0xC1:
+        dst = this.regECX & 0xff;
+        break;
+    case 0xC2:
+        dst = this.regEDX & 0xff;
+        break;
+    case 0xC3:
+        dst = this.regEBX & 0xff;
+        break;
+    case 0xC4:
+        dst = (this.regEAX >> 8) & 0xff;
+        break;
+    case 0xC5:
+        dst = (this.regECX >> 8) & 0xff;
+        break;
+    case 0xC6:
+        dst = (this.regEDX >> 8) & 0xff;
+        break;
+    case 0xC7:
+        dst = (this.regEBX >> 8) & 0xff;
+        break;
+    default:
+        dst = 0;
+
+        break;
+    }
+
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    var b = afnGrp[reg].call(this, dst, fnSrc.call(this));
+
+    switch(bModRM) {
+    case 0xC0:
+        this.regEAX = (this.regEAX & ~0xff) | b;
+        break;
+    case 0xC1:
+        this.regECX = (this.regECX & ~0xff) | b;
+        break;
+    case 0xC2:
+        this.regEDX = (this.regEDX & ~0xff) | b;
+        break;
+    case 0xC3:
+        this.regEBX = (this.regEBX & ~0xff) | b;
+        break;
+    case 0xC4:
+        this.regEAX = (this.regEAX & ~0xff00) | (b << 8);
+        break;
+    case 0xC5:
+        this.regECX = (this.regECX & ~0xff00) | (b << 8);
+        break;
+    case 0xC6:
+        this.regEDX = (this.regEDX & ~0xff00) | (b << 8);
+        break;
+    case 0xC7:
+        this.regEBX = (this.regEBX & ~0xff00) | (b << 8);
+        break;
+    default:
+        this.setEAByte(b);
+        break;
+    }
+};
+
+/**
+ * modRegShort32(fn)
+ *
+ * @this {X86CPU}
+ * @param {function(number,number)} fn (dst,src)
+ */
+X86.modRegShort32 = function(fn)
+{
+    var dst, src;
+    var bModRM = (this.bModRM = this.getIPByte()) & 0xC7;
+
+    switch(bModRM) {
+    case 0x00:
+        src = this.getEAShortData(this.regEAX);
+        break;
+    case 0x01:
+        src = this.getEAShortData(this.regECX);
+        break;
+    case 0x02:
+        src = this.getEAShortData(this.regEDX);
+        break;
+    case 0x03:
+        src = this.getEAShortData(this.regEBX);
+        break;
+    case 0x04:
+        src = this.getEAShortData(X86.modSIB.call(this, 0));
+        break;
+    case 0x05:
+        src = this.getEAShortData(this.getIPAddr());
+        break;
+    case 0x06:
+        src = this.getEAShortData(this.regESI);
+        break;
+    case 0x07:
+        src = this.getEAShortData(this.regEDI);
+        break;
+    case 0x40:
+        src = this.getEAShortData(this.regEAX + this.getIPDisp());
+        break;
+    case 0x41:
+        src = this.getEAShortData(this.regECX + this.getIPDisp());
+        break;
+    case 0x42:
+        src = this.getEAShortData(this.regEDX + this.getIPDisp());
+        break;
+    case 0x43:
+        src = this.getEAShortData(this.regEBX + this.getIPDisp());
+        break;
+    case 0x44:
+        src = this.getEAShortData(X86.modSIB.call(this, 1) + this.getIPDisp());
+        break;
+    case 0x45:
+        src = this.getEAShortStack(this.regEBP + this.getIPDisp());
+        break;
+    case 0x46:
+        src = this.getEAShortData(this.regESI + this.getIPDisp());
+        break;
+    case 0x47:
+        src = this.getEAShortData(this.regEDI + this.getIPDisp());
+        break;
+    case 0x80:
+        src = this.getEAShortData(this.regEAX + this.getIPAddr());
+        break;
+    case 0x81:
+        src = this.getEAShortData(this.regECX + this.getIPAddr());
+        break;
+    case 0x82:
+        src = this.getEAShortData(this.regEDX + this.getIPAddr());
+        break;
+    case 0x83:
+        src = this.getEAShortData(this.regEBX + this.getIPAddr());
+        break;
+    case 0x84:
+        src = this.getEAShortData(X86.modSIB.call(this, 2) + this.getIPAddr());
+        break;
+    case 0x85:
+        src = this.getEAShortStack(this.regEBP + this.getIPAddr());
+        break;
+    case 0x86:
+        src = this.getEAShortData(this.regESI + this.getIPAddr());
+        break;
+    case 0x87:
+        src = this.getEAShortData(this.regEDI + this.getIPAddr());
+        break;
+    case 0xC0:
+        src = this.regEAX & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiAL; this.backTrack.btiEAHi = this.backTrack.btiAH;
+        }
+        break;
+    case 0xC1:
+        src = this.regECX & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiCL; this.backTrack.btiEAHi = this.backTrack.btiCH;
+        }
+        break;
+    case 0xC2:
+        src = this.regEDX & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiDL; this.backTrack.btiEAHi = this.backTrack.btiDH;
+        }
+        break;
+    case 0xC3:
+        src = this.regEBX & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiBL; this.backTrack.btiEAHi = this.backTrack.btiBH;
+        }
+        break;
+    case 0xC4:
+        src = this.getSP() & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = X86.BTINFO.SP_LO; this.backTrack.btiEAHi = X86.BTINFO.SP_HI;
+        }
+        break;
+    case 0xC5:
+        src = this.regEBP & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiBPLo; this.backTrack.btiEAHi = this.backTrack.btiBPHi;
+        }
+        break;
+    case 0xC6:
+        src = this.regESI & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiSILo; this.backTrack.btiEAHi = this.backTrack.btiSIHi;
+        }
+        break;
+    case 0xC7:
+        src = this.regEDI & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiDILo; this.backTrack.btiEAHi = this.backTrack.btiDIHi;
+        }
+        break;
+    default:
+        src = 0;
+
+        break;
+    }
+
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    switch(reg) {
+    case 0x0:
+        dst = this.regEAX & 0xffff;
+        break;
+    case 0x1:
+        dst = this.regECX & 0xffff;
+        break;
+    case 0x2:
+        dst = this.regEDX & 0xffff;
+        break;
+    case 0x3:
+        dst = this.regEBX & 0xffff;
+        break;
+    case 0x4:
+        dst = this.getSP() & 0xffff;
+        break;
+    case 0x5:
+        dst = this.regEBP & 0xffff;
+        break;
+    case 0x6:
+        dst = this.regESI & 0xffff;
+        break;
+    case 0x7:
+        dst = this.regEDI & 0xffff;
+        break;
+    default:
+        dst = 0;
+        break;
+    }
+
+    var w = fn.call(this, dst, src);
+
+    switch(reg) {
+    case 0x0:
+        this.regEAX = (this.regEAX & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiAL = this.backTrack.btiEALo; this.backTrack.btiAH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x1:
+        this.regECX = (this.regECX & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiCL = this.backTrack.btiEALo; this.backTrack.btiCH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x2:
+        this.regEDX = (this.regEDX & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiDL = this.backTrack.btiEALo; this.backTrack.btiDH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x3:
+        this.regEBX = (this.regEBX & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiBL = this.backTrack.btiEALo; this.backTrack.btiBH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x4:
+        this.setSP((this.getSP() & ~0xffff) | w);
+        break;
+    case 0x5:
+        this.regEBP = (this.regEBP & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiBPLo = this.backTrack.btiEALo; this.backTrack.btiBPHi = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x6:
+        this.regESI = (this.regESI & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiSILo = this.backTrack.btiEALo; this.backTrack.btiSIHi = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x7:
+        this.regEDI = (this.regEDI & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiDILo = this.backTrack.btiEALo; this.backTrack.btiDIHi = this.backTrack.btiEAHi;
+        }
+        break;
+    }
+};
+
+/**
+ * modMemShort32(fn)
+ *
+ * @this {X86CPU}
+ * @param {function(number,number)} fn (dst,src)
+ */
+X86.modMemShort32 = function(fn)
+{
+    var dst, src;
+    var bModRM = (this.bModRM = this.getIPByte()) & 0xC7;
+
+    switch(bModRM) {
+    case 0x00:
+        dst = this.getEAShortData(this.regEAX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x01:
+        dst = this.getEAShortData(this.regECX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x02:
+        dst = this.getEAShortData(this.regEDX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x03:
+        dst = this.getEAShortData(this.regEBX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x04:
+        dst = this.getEAShortData(X86.modSIB.call(this, 0));
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x05:
+        dst = this.getEAShortData(this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x06:
+        dst = this.getEAShortData(this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x07:
+        dst = this.getEAShortData(this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x40:
+        dst = this.getEAShortData(this.regEAX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x41:
+        dst = this.getEAShortData(this.regECX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x42:
+        dst = this.getEAShortData(this.regEDX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x43:
+        dst = this.getEAShortData(this.regEBX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x44:
+        dst = this.getEAShortData(X86.modSIB.call(this, 1) + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x45:
+        dst = this.getEAShortStack(this.regEBP + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x46:
+        dst = this.getEAShortData(this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x47:
+        dst = this.getEAShortData(this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x80:
+        dst = this.getEAShortData(this.regEAX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x81:
+        dst = this.getEAShortData(this.regECX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x82:
+        dst = this.getEAShortData(this.regEDX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x83:
+        dst = this.getEAShortData(this.regEBX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x84:
+        dst = this.getEAShortData(X86.modSIB.call(this, 2) + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x85:
+        dst = this.getEAShortStack(this.regEBP + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x86:
+        dst = this.getEAShortData(this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x87:
+        dst = this.getEAShortData(this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0xC0:
+        dst = this.regEAX & 0xffff;
+        break;
+    case 0xC1:
+        dst = this.regECX & 0xffff;
+        break;
+    case 0xC2:
+        dst = this.regEDX & 0xffff;
+        break;
+    case 0xC3:
+        dst = this.regEBX & 0xffff;
+        break;
+    case 0xC4:
+        dst = this.getSP() & 0xffff;
+        break;
+    case 0xC5:
+        dst = this.regEBP & 0xffff;
+        break;
+    case 0xC6:
+        dst = this.regESI & 0xffff;
+        break;
+    case 0xC7:
+        dst = this.regEDI & 0xffff;
+        break;
+    default:
+        dst = 0;
+
+        break;
+    }
+
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    switch(reg) {
+    case 0x0:
+        src = this.regEAX & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiAL; this.backTrack.btiEAHi = this.backTrack.btiAH;
+        }
+        break;
+    case 0x1:
+        src = this.regECX & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiCL; this.backTrack.btiEAHi = this.backTrack.btiCH;
+        }
+        break;
+    case 0x2:
+        src = this.regEDX & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiDL; this.backTrack.btiEAHi = this.backTrack.btiDH;
+        }
+        break;
+    case 0x3:
+        src = this.regEBX & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiBL; this.backTrack.btiEAHi = this.backTrack.btiBH;
+        }
+        break;
+    case 0x4:
+        src = this.getSP() & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = X86.BTINFO.SP_LO; this.backTrack.btiEAHi = X86.BTINFO.SP_HI;
+        }
+        break;
+    case 0x5:
+        src = this.regEBP & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiBPLo; this.backTrack.btiEAHi = this.backTrack.btiBPHi;
+        }
+        break;
+    case 0x6:
+        src = this.regESI & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiSILo; this.backTrack.btiEAHi = this.backTrack.btiSIHi;
+        }
+        break;
+    case 0x7:
+        src = this.regEDI & 0xffff;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiDILo; this.backTrack.btiEAHi = this.backTrack.btiDIHi;
+        }
+        break;
+    default:
+        src = 0;
+        break;
+    }
+
+    var w = fn.call(this, dst, src);
+
+    switch(bModRM) {
+    case 0xC0:
+        this.regEAX = (this.regEAX & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiAL = this.backTrack.btiEALo; this.backTrack.btiAH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC1:
+        this.regECX = (this.regECX & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiCL = this.backTrack.btiEALo; this.backTrack.btiCH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC2:
+        this.regEDX = (this.regEDX & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiDL = this.backTrack.btiEALo; this.backTrack.btiDH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC3:
+        this.regEBX = (this.regEBX & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiBL = this.backTrack.btiEALo; this.backTrack.btiBH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC4:
+        this.setSP((this.getSP() & ~0xffff) | w);
+        break;
+    case 0xC5:
+        this.regEBP = (this.regEBP & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiBPLo = this.backTrack.btiEALo; this.backTrack.btiBPHi = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC6:
+        this.regESI = (this.regESI & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiSILo = this.backTrack.btiEALo; this.backTrack.btiSIHi = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC7:
+        this.regEDI = (this.regEDI & ~0xffff) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiDILo = this.backTrack.btiEALo; this.backTrack.btiDIHi = this.backTrack.btiEAHi;
+        }
+        break;
+    default:
+        this.setEAShort(w);
+        break;
+    }
+};
+
+/**
+ * modGrpShort32(afnGrp, fnSrc)
+ *
+ * @this {X86CPU}
+ * @param {Array.<function(number,number)>} afnGrp
+ * @param {function()} fnSrc
+ */
+X86.modGrpShort32 = function(afnGrp, fnSrc) {
+    var dst;
+    var bModRM = (this.bModRM = this.getIPByte()) & 0xC7;
+
+    switch(bModRM) {
+    case 0x00:
+        dst = this.getEAShortData(this.regEAX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x01:
+        dst = this.getEAShortData(this.regECX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x02:
+        dst = this.getEAShortData(this.regEDX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x03:
+        dst = this.getEAShortData(this.regEBX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x04:
+        dst = this.getEAShortData(X86.modSIB.call(this, 0));
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x05:
+        dst = this.getEAShortData(this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x06:
+        dst = this.getEAShortData(this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x07:
+        dst = this.getEAShortData(this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x40:
+        dst = this.getEAShortData(this.regEAX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x41:
+        dst = this.getEAShortData(this.regECX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x42:
+        dst = this.getEAShortData(this.regEDX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x43:
+        dst = this.getEAShortData(this.regEBX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x44:
+        dst = this.getEAShortData(X86.modSIB.call(this, 1) + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x45:
+        dst = this.getEAShortStack(this.regEBP + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x46:
+        dst = this.getEAShortData(this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x47:
+        dst = this.getEAShortData(this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x80:
+        dst = this.getEAShortData(this.regEAX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x81:
+        dst = this.getEAShortData(this.regECX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x82:
+        dst = this.getEAShortData(this.regEDX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x83:
+        dst = this.getEAShortData(this.regEBX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x84:
+        dst = this.getEAShortData(X86.modSIB.call(this, 2) + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x85:
+        dst = this.getEAShortStack(this.regEBP + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x86:
+        dst = this.getEAShortData(this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x87:
+        dst = this.getEAShortData(this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0xC0:
+        dst = this.regEAX & 0xffff;
+        break;
+    case 0xC1:
+        dst = this.regECX & 0xffff;
+        break;
+    case 0xC2:
+        dst = this.regEDX & 0xffff;
+        break;
+    case 0xC3:
+        dst = this.regEBX & 0xffff;
+        break;
+    case 0xC4:
+        dst = this.getSP() & 0xffff;
+        break;
+    case 0xC5:
+        dst = this.regEBP & 0xffff;
+        break;
+    case 0xC6:
+        dst = this.regESI & 0xffff;
+        break;
+    case 0xC7:
+        dst = this.regEDI & 0xffff;
+        break;
+    default:
+        dst = 0;
+
+        break;
+    }
+
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    var w = afnGrp[reg].call(this, dst, fnSrc.call(this));
+
+    switch(bModRM) {
+    case 0xC0:
+        this.regEAX = (this.regEAX & ~0xffff) | w;
+        break;
+    case 0xC1:
+        this.regECX = (this.regECX & ~0xffff) | w;
+        break;
+    case 0xC2:
+        this.regEDX = (this.regEDX & ~0xffff) | w;
+        break;
+    case 0xC3:
+        this.regEBX = (this.regEBX & ~0xffff) | w;
+        break;
+    case 0xC4:
+        this.setSP((this.getSP() & ~0xffff) | w);
+        break;
+    case 0xC5:
+        this.regEBP = (this.regEBP & ~0xffff) | w;
+        break;
+    case 0xC6:
+        this.regESI = (this.regESI & ~0xffff) | w;
+        break;
+    case 0xC7:
+        this.regEDI = (this.regEDI & ~0xffff) | w;
+        break;
+    default:
+        this.setEAShort(w);
+        break;
+    }
+};
+
+/**
+ * modRegLong32(fn)
+ *
+ * @this {X86CPU}
+ * @param {function(number,number)} fn (dst,src)
+ */
+X86.modRegLong32 = function(fn)
+{
+    var dst, src;
+    var bModRM = (this.bModRM = this.getIPByte()) & 0xC7;
+
+    switch(bModRM) {
+    case 0x00:
+        src = this.getEALongData(this.regEAX);
+        break;
+    case 0x01:
+        src = this.getEALongData(this.regECX);
+        break;
+    case 0x02:
+        src = this.getEALongData(this.regEDX);
+        break;
+    case 0x03:
+        src = this.getEALongData(this.regEBX);
+        break;
+    case 0x04:
+        src = this.getEALongData(X86.modSIB.call(this, 0));
+        break;
+    case 0x05:
+        src = this.getEALongData(this.getIPAddr());
+        break;
+    case 0x06:
+        src = this.getEALongData(this.regESI);
+        break;
+    case 0x07:
+        src = this.getEALongData(this.regEDI);
+        break;
+    case 0x40:
+        src = this.getEALongData(this.regEAX + this.getIPDisp());
+        break;
+    case 0x41:
+        src = this.getEALongData(this.regECX + this.getIPDisp());
+        break;
+    case 0x42:
+        src = this.getEALongData(this.regEDX + this.getIPDisp());
+        break;
+    case 0x43:
+        src = this.getEALongData(this.regEBX + this.getIPDisp());
+        break;
+    case 0x44:
+        src = this.getEALongData(X86.modSIB.call(this, 1) + this.getIPDisp());
+        break;
+    case 0x45:
+        src = this.getEALongStack(this.regEBP + this.getIPDisp());
+        break;
+    case 0x46:
+        src = this.getEALongData(this.regESI + this.getIPDisp());
+        break;
+    case 0x47:
+        src = this.getEALongData(this.regEDI + this.getIPDisp());
+        break;
+    case 0x80:
+        src = this.getEALongData(this.regEAX + this.getIPAddr());
+        break;
+    case 0x81:
+        src = this.getEALongData(this.regECX + this.getIPAddr());
+        break;
+    case 0x82:
+        src = this.getEALongData(this.regEDX + this.getIPAddr());
+        break;
+    case 0x83:
+        src = this.getEALongData(this.regEBX + this.getIPAddr());
+        break;
+    case 0x84:
+        src = this.getEALongData(X86.modSIB.call(this, 2) + this.getIPAddr());
+        break;
+    case 0x85:
+        src = this.getEALongStack(this.regEBP + this.getIPAddr());
+        break;
+    case 0x86:
+        src = this.getEALongData(this.regESI + this.getIPAddr());
+        break;
+    case 0x87:
+        src = this.getEALongData(this.regEDI + this.getIPAddr());
+        break;
+    case 0xC0:
+        src = this.regEAX;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiAL; this.backTrack.btiEAHi = this.backTrack.btiAH;
+        }
+        break;
+    case 0xC1:
+        src = this.regECX;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiCL; this.backTrack.btiEAHi = this.backTrack.btiCH;
+        }
+        break;
+    case 0xC2:
+        src = this.regEDX;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiDL; this.backTrack.btiEAHi = this.backTrack.btiDH;
+        }
+        break;
+    case 0xC3:
+        src = this.regEBX;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiBL; this.backTrack.btiEAHi = this.backTrack.btiBH;
+        }
+        break;
+    case 0xC4:
+        src = this.getSP();
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = X86.BTINFO.SP_LO; this.backTrack.btiEAHi = X86.BTINFO.SP_HI;
+        }
+        break;
+    case 0xC5:
+        src = this.regEBP;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiBPLo; this.backTrack.btiEAHi = this.backTrack.btiBPHi;
+        }
+        break;
+    case 0xC6:
+        src = this.regESI;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiSILo; this.backTrack.btiEAHi = this.backTrack.btiSIHi;
+        }
+        break;
+    case 0xC7:
+        src = this.regEDI;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiDILo; this.backTrack.btiEAHi = this.backTrack.btiDIHi;
+        }
+        break;
+    default:
+        src = 0;
+
+        break;
+    }
+
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    switch(reg) {
+    case 0x0:
+        dst = this.regEAX;
+        break;
+    case 0x1:
+        dst = this.regECX;
+        break;
+    case 0x2:
+        dst = this.regEDX;
+        break;
+    case 0x3:
+        dst = this.regEBX;
+        break;
+    case 0x4:
+        dst = this.getSP();
+        break;
+    case 0x5:
+        dst = this.regEBP;
+        break;
+    case 0x6:
+        dst = this.regESI;
+        break;
+    case 0x7:
+        dst = this.regEDI;
+        break;
+    default:
+        dst = 0;
+        break;
+    }
+
+    var l = fn.call(this, dst, src);
+
+    switch(reg) {
+    case 0x0:
+        this.regEAX = l;
+        if (BACKTRACK) {
+            this.backTrack.btiAL = this.backTrack.btiEALo; this.backTrack.btiAH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x1:
+        this.regECX = l;
+        if (BACKTRACK) {
+            this.backTrack.btiCL = this.backTrack.btiEALo; this.backTrack.btiCH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x2:
+        this.regEDX = l;
+        if (BACKTRACK) {
+            this.backTrack.btiDL = this.backTrack.btiEALo; this.backTrack.btiDH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x3:
+        this.regEBX = l;
+        if (BACKTRACK) {
+            this.backTrack.btiBL = this.backTrack.btiEALo; this.backTrack.btiBH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x4:
+        this.setSP(l);
+        break;
+    case 0x5:
+        this.regEBP = l;
+        if (BACKTRACK) {
+            this.backTrack.btiBPLo = this.backTrack.btiEALo; this.backTrack.btiBPHi = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x6:
+        this.regESI = l;
+        if (BACKTRACK) {
+            this.backTrack.btiSILo = this.backTrack.btiEALo; this.backTrack.btiSIHi = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0x7:
+        this.regEDI = l;
+        if (BACKTRACK) {
+            this.backTrack.btiDILo = this.backTrack.btiEALo; this.backTrack.btiDIHi = this.backTrack.btiEAHi;
+        }
+        break;
+    }
+};
+
+/**
+ * modMemLong32(fn)
+ *
+ * @this {X86CPU}
+ * @param {function(number,number)} fn (dst,src)
+ */
+X86.modMemLong32 = function(fn)
+{
+    var dst, src;
+    var bModRM = (this.bModRM = this.getIPByte()) & 0xC7;
+
+    switch(bModRM) {
+    case 0x00:
+        dst = this.getEALongData(this.regEAX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x01:
+        dst = this.getEALongData(this.regECX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x02:
+        dst = this.getEALongData(this.regEDX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x03:
+        dst = this.getEALongData(this.regEBX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x04:
+        dst = this.getEALongData(X86.modSIB.call(this, 0));
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x05:
+        dst = this.getEALongData(this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x06:
+        dst = this.getEALongData(this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x07:
+        dst = this.getEALongData(this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x40:
+        dst = this.getEALongData(this.regEAX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x41:
+        dst = this.getEALongData(this.regECX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x42:
+        dst = this.getEALongData(this.regEDX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x43:
+        dst = this.getEALongData(this.regEBX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x44:
+        dst = this.getEALongData(X86.modSIB.call(this, 1) + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x45:
+        dst = this.getEALongStack(this.regEBP + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x46:
+        dst = this.getEALongData(this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x47:
+        dst = this.getEALongData(this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x80:
+        dst = this.getEALongData(this.regEAX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x81:
+        dst = this.getEALongData(this.regECX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x82:
+        dst = this.getEALongData(this.regEDX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x83:
+        dst = this.getEALongData(this.regEBX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x84:
+        dst = this.getEALongData(X86.modSIB.call(this, 2) + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x85:
+        dst = this.getEALongStack(this.regEBP + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x86:
+        dst = this.getEALongData(this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x87:
+        dst = this.getEALongData(this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0xC0:
+        dst = this.regEAX;
+        break;
+    case 0xC1:
+        dst = this.regECX;
+        break;
+    case 0xC2:
+        dst = this.regEDX;
+        break;
+    case 0xC3:
+        dst = this.regEBX;
+        break;
+    case 0xC4:
+        dst = this.getSP();
+        break;
+    case 0xC5:
+        dst = this.regEBP;
+        break;
+    case 0xC6:
+        dst = this.regESI;
+        break;
+    case 0xC7:
+        dst = this.regEDI;
+        break;
+    default:
+        dst = 0;
+
+        break;
+    }
+
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    switch(reg) {
+    case 0x0:
+        src = this.regEAX;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiAL; this.backTrack.btiEAHi = this.backTrack.btiAH;
+        }
+        break;
+    case 0x1:
+        src = this.regECX;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiCL; this.backTrack.btiEAHi = this.backTrack.btiCH;
+        }
+        break;
+    case 0x2:
+        src = this.regEDX;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiDL; this.backTrack.btiEAHi = this.backTrack.btiDH;
+        }
+        break;
+    case 0x3:
+        src = this.regEBX;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiBL; this.backTrack.btiEAHi = this.backTrack.btiBH;
+        }
+        break;
+    case 0x4:
+        src = this.getSP();
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = X86.BTINFO.SP_LO; this.backTrack.btiEAHi = X86.BTINFO.SP_HI;
+        }
+        break;
+    case 0x5:
+        src = this.regEBP;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiBPLo; this.backTrack.btiEAHi = this.backTrack.btiBPHi;
+        }
+        break;
+    case 0x6:
+        src = this.regESI;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiSILo; this.backTrack.btiEAHi = this.backTrack.btiSIHi;
+        }
+        break;
+    case 0x7:
+        src = this.regEDI;
+        if (BACKTRACK) {
+            this.backTrack.btiEALo = this.backTrack.btiDILo; this.backTrack.btiEAHi = this.backTrack.btiDIHi;
+        }
+        break;
+    default:
+        src = 0;
+        break;
+    }
+
+    var l = fn.call(this, dst, src);
+
+    switch(bModRM) {
+    case 0xC0:
+        this.regEAX = l;
+        if (BACKTRACK) {
+            this.backTrack.btiAL = this.backTrack.btiEALo; this.backTrack.btiAH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC1:
+        this.regECX = l;
+        if (BACKTRACK) {
+            this.backTrack.btiCL = this.backTrack.btiEALo; this.backTrack.btiCH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC2:
+        this.regEDX = l;
+        if (BACKTRACK) {
+            this.backTrack.btiDL = this.backTrack.btiEALo; this.backTrack.btiDH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC3:
+        this.regEBX = l;
+        if (BACKTRACK) {
+            this.backTrack.btiBL = this.backTrack.btiEALo; this.backTrack.btiBH = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC4:
+        this.setSP(l);
+        break;
+    case 0xC5:
+        this.regEBP = l;
+        if (BACKTRACK) {
+            this.backTrack.btiBPLo = this.backTrack.btiEALo; this.backTrack.btiBPHi = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC6:
+        this.regESI = l;
+        if (BACKTRACK) {
+            this.backTrack.btiSILo = this.backTrack.btiEALo; this.backTrack.btiSIHi = this.backTrack.btiEAHi;
+        }
+        break;
+    case 0xC7:
+        this.regEDI = l;
+        if (BACKTRACK) {
+            this.backTrack.btiDILo = this.backTrack.btiEALo; this.backTrack.btiDIHi = this.backTrack.btiEAHi;
+        }
+        break;
+    default:
+        this.setEALong(l);
+        break;
+    }
+};
+
+/**
+ * modGrpLong32(afnGrp, fnSrc)
+ *
+ * @this {X86CPU}
+ * @param {Array.<function(number,number)>} afnGrp
+ * @param {function()} fnSrc
+ */
+X86.modGrpLong32 = function(afnGrp, fnSrc) {
+    var dst;
+    var bModRM = (this.bModRM = this.getIPByte()) & 0xC7;
+
+    switch(bModRM) {
+    case 0x00:
+        dst = this.getEALongData(this.regEAX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x01:
+        dst = this.getEALongData(this.regECX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x02:
+        dst = this.getEALongData(this.regEDX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x03:
+        dst = this.getEALongData(this.regEBX);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x04:
+        dst = this.getEALongData(X86.modSIB.call(this, 0));
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x05:
+        dst = this.getEALongData(this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x06:
+        dst = this.getEALongData(this.regESI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x07:
+        dst = this.getEALongData(this.regEDI);
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x40:
+        dst = this.getEALongData(this.regEAX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x41:
+        dst = this.getEALongData(this.regECX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x42:
+        dst = this.getEALongData(this.regEDX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x43:
+        dst = this.getEALongData(this.regEBX + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x44:
+        dst = this.getEALongData(X86.modSIB.call(this, 1) + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x45:
+        dst = this.getEALongStack(this.regEBP + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x46:
+        dst = this.getEALongData(this.regESI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x47:
+        dst = this.getEALongData(this.regEDI + this.getIPDisp());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x80:
+        dst = this.getEALongData(this.regEAX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x81:
+        dst = this.getEALongData(this.regECX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x82:
+        dst = this.getEALongData(this.regEDX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x83:
+        dst = this.getEALongData(this.regEBX + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x84:
+        dst = this.getEALongData(X86.modSIB.call(this, 2) + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x85:
+        dst = this.getEALongStack(this.regEBP + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x86:
+        dst = this.getEALongData(this.regESI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0x87:
+        dst = this.getEALongData(this.regEDI + this.getIPAddr());
+        this.regEAWrite = this.regEA;
+        break;
+    case 0xC0:
+        dst = this.regEAX;
+        break;
+    case 0xC1:
+        dst = this.regECX;
+        break;
+    case 0xC2:
+        dst = this.regEDX;
+        break;
+    case 0xC3:
+        dst = this.regEBX;
+        break;
+    case 0xC4:
+        dst = this.getSP();
+        break;
+    case 0xC5:
+        dst = this.regEBP;
+        break;
+    case 0xC6:
+        dst = this.regESI;
+        break;
+    case 0xC7:
+        dst = this.regEDI;
+        break;
+    default:
+        dst = 0;
+
+        break;
+    }
+
+    var reg = (this.bModRM >> 3) & 0x7;
+
+    var l = afnGrp[reg].call(this, dst, fnSrc.call(this));
+
+    switch(bModRM) {
+    case 0xC0:
+        this.regEAX = l;
+        break;
+    case 0xC1:
+        this.regECX = l;
+        break;
+    case 0xC2:
+        this.regEDX = l;
+        break;
+    case 0xC3:
+        this.regEBX = l;
+        break;
+    case 0xC4:
+        this.setSP(l);
+        break;
+    case 0xC5:
+        this.regEBP = l;
+        break;
+    case 0xC6:
+        this.regESI = l;
+        break;
+    case 0xC7:
+        this.regEDI = l;
+        break;
+    default:
+        this.setEALong(l);
+        break;
+    }
+};
+
+/**
+ * modSIB(mod)
+ *
+ * @this {X86CPU}
+ * @param {number} mod
+ * @return {number}
+ */
+X86.modSIB = function(mod)
+{
+    var bSIB = this.getIPByte();
+    var scale = bSIB >> 6, index, base;
+
+    switch((bSIB >> 3) & 0x7) {
+    case 0:
+        index = this.regEAX;
+        break;
+    case 1:
+        index = this.regECX;
+        break;
+    case 2:
+        index = this.regEDX;
+        break;
+    case 3:
+        index = this.regEBX;
+        break;
+    case 4:
+        index = 0;
+        break;
+    case 5:
+        index = this.regEBP;
+        break;
+    case 6:
+        index = this.regESI;
+        break;
+    case 7:
+        index = this.regEDI;
+        break;
+    }
+
+    switch(bSIB & 0x07) {
+    case 0:
+        base = this.regEAX;
+        break;
+    case 1:
+        base = this.regECX;
+        break;
+    case 2:
+        base = this.regEDX;
+        break;
+    case 3:
+        base = this.regEBX;
+        break;
+    case 4:
+        base = this.getSP();
+        this.segData = this.segStack;
+        break;
+    case 5:
+        if (mod) {
+            base = this.regEBP;
+            this.segData = this.segStack;
+        } else {
+            base = this.getIPAddr();
+        }
+        break;
+    case 6:
+        base = this.regESI;
+        break;
+    case 7:
+        base = this.regEDI;
+        break;
+    }
+
+    return ((index << scale) + base)|0;
+};
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/x86ops.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * op=0x00 (ADD byte,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opADDmb = function()
+{
+    this.decodeModMemByte.call(this, X86.fnADDb);
+    /*
+     * Opcode bytes 0x00 0x00 are sufficiently uncommon that it's more likely we've started
+     * executing in the weeds, so if you're in DEBUG mode, we'll print a warning and stop the
+     * CPU if a Debugger is available.
+     *
+     * Notice that we also test fRunning: this allows the Debugger to step over the instruction,
+     * because its trace ("t") command doesn't "run" the CPU; it merely "steps" the CPU.
+     */
+    if (DEBUG && !this.bModRM && this.flags.running) {
+        this.printMessage("suspicious opcode: 0x00 0x00", DEBUGGER || this.bitsMessage);
+        if (DEBUGGER && this.dbg) this.dbg.stopCPU();
+    }
+};
+
+/**
+ * op=0x01 (ADD word,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opADDmw = function()
+{
+    this.decodeModMemWord.call(this, X86.fnADDw);
+};
+
+/**
+ * op=0x02 (ADD reg,byte)
+ *
+ * @this {X86CPU}
+ */
+X86.opADDrb = function()
+{
+    this.decodeModRegByte.call(this, X86.fnADDb);
+};
+
+/**
+ * op=0x03 (ADD reg,word)
+ *
+ * @this {X86CPU}
+ */
+X86.opADDrw = function()
+{
+    this.decodeModRegWord.call(this, X86.fnADDw);
+};
+
+/**
+ * op=0x04 (ADD AL,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opADDALb = function()
+{
+    this.regEAX = (this.regEAX & ~0xff) | X86.fnADDb.call(this, this.regEAX & 0xff, this.getIPByte());
+    /*
+     * NOTE: Whenever the result is "blended" value (eg, of btiAL and btiMem0), a new bti should be
+     * allocated to reflect that fact; however, I'm leaving "perfect" BACKTRACK support for another day.
+     */
+    if (BACKTRACK) this.backTrack.btiAL = this.backTrack.btiMem0;
+    this.nStepCycles--;         // in the absence of any EA calculations, we need deduct only one more cycle
+};
+
+/**
+ * op=0x05 (ADD AX,imm16 or ADD EAX,imm32)
+ *
+ * @this {X86CPU}
+ */
+X86.opADDAX = function()
+{
+    this.regEAX = (this.regEAX & ~this.maskData) | X86.fnADDw.call(this, this.regEAX & this.maskData, this.getIPWord());
+    if (BACKTRACK) {
+        this.backTrack.btiAL = this.backTrack.btiMem0; this.backTrack.btiAH = this.backTrack.btiMem1;
+    }
+    this.nStepCycles--;         // in the absence of any EA calculations, we need deduct only one more cycle
+};
+
+/**
+ * op=0x06 (PUSH ES)
+ *
+ * @this {X86CPU}
+ */
+X86.opPUSHES = function()
+{
+    /*
+     * When the OPERAND size is 32 bits, the 80386 will decrement the stack pointer by 4, write the selector
+     * into the 2 lower bytes, and leave the 2 upper bytes untouched; to properly emulate that, we must use the
+     * more generic pushData() instead of pushWord().
+     */
+    if (!I386) {
+        this.pushWord(this.segES.sel);
+    } else {
+        this.pushData(this.segES.sel, this.sizeData, 2);
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPushSeg;
+};
+
+/**
+ * op=0x07 (POP ES)
+ *
+ * @this {X86CPU}
+ */
+X86.opPOPES = function()
+{
+    /*
+     * Any operation that modifies the stack before loading a new segment must snapshot regLSP first.
+     */
+    this.opLSP = this.regLSP;
+    this.setES(this.popWord());
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPopReg;
+    this.opLSP = X86.ADDR_INVALID;
+};
+
+/**
+ * op=0x08 (OR byte,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opORmb = function()
+{
+    this.decodeModMemByte.call(this, X86.fnORb);
+};
+
+/**
+ * op=0x09 (OR word,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opORmw = function()
+{
+    this.decodeModMemWord.call(this, X86.fnORw);
+};
+
+/**
+ * op=0x0A (OR reg,byte)
+ *
+ * @this {X86CPU}
+ */
+X86.opORrb = function()
+{
+    this.decodeModRegByte.call(this, X86.fnORb);
+};
+
+/**
+ * op=0x0B (OR reg,word)
+ *
+ * @this {X86CPU}
+ */
+X86.opORrw = function()
+{
+    this.decodeModRegWord.call(this, X86.fnORw);
+};
+
+/**
+ * op=0x0C (OR AL,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opORALb = function()
+{
+    this.regEAX = (this.regEAX & ~0xff) | X86.fnORb.call(this, this.regEAX & 0xff, this.getIPByte());
+    if (BACKTRACK) this.backTrack.btiAL = this.backTrack.btiMem0;
+    this.nStepCycles--;         // in the absence of any EA calculations, we need deduct only one more cycle
+};
+
+/**
+ * op=0x0D (OR AX,imm16 or OR EAX,imm32)
+ *
+ * @this {X86CPU}
+ */
+X86.opORAX = function()
+{
+    this.regEAX = (this.regEAX & ~this.maskData) | X86.fnORw.call(this, this.regEAX & this.maskData, this.getIPWord());
+    if (BACKTRACK) {
+        this.backTrack.btiAL = this.backTrack.btiMem0; this.backTrack.btiAH = this.backTrack.btiMem1;
+    }
+    this.nStepCycles--;         // in the absence of any EA calculations, we need deduct only one more cycle
+};
+
+/**
+ * op=0x0E (PUSH CS)
+ *
+ * @this {X86CPU}
+ */
+X86.opPUSHCS = function()
+{
+    /*
+     * When the OPERAND size is 32 bits, the 80386 will decrement the stack pointer by 4, write the selector
+     * into the 2 lower bytes, and leave the 2 upper bytes untouched; to properly emulate that, we must use the
+     * more generic pushData() instead of pushWord().
+     */
+    if (!I386) {
+        this.pushWord(this.segCS.sel);
+    } else {
+        this.pushData(this.segCS.sel, this.sizeData, 2);
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPushSeg;
+};
+
+/**
+ * op=0x0F (POP CS) (undocumented on 8086/8088; replaced with opInvalid() on 80186/80188, and op0F() on 80286 and up)
+ *
+ * @this {X86CPU}
+ */
+X86.opPOPCS = function()
+{
+    /*
+     * Because this is an 8088-only operation, we don't have to worry about taking a snapshot of regLSP first.
+     */
+    this.setCS(this.popWord());
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPopReg;
+};
+
+/**
+ * op=0x0F (handler for two-byte opcodes; 80286 and up)
+ *
+ * @this {X86CPU}
+ */
+X86.op0F = function()
+{
+    this.aOps0F[this.getIPByte()].call(this);
+};
+
+/**
+ * op=0x10 (ADC byte,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opADCmb = function()
+{
+    this.decodeModMemByte.call(this, X86.fnADCb);
+};
+
+/**
+ * op=0x11 (ADC word,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opADCmw = function()
+{
+    this.decodeModMemWord.call(this, X86.fnADCw);
+};
+
+/**
+ * op=0x12 (ADC reg,byte)
+ *
+ * @this {X86CPU}
+ */
+X86.opADCrb = function()
+{
+    this.decodeModRegByte.call(this, X86.fnADCb);
+};
+
+/**
+ * op=0x13 (ADC reg,word)
+ *
+ * @this {X86CPU}
+ */
+X86.opADCrw = function()
+{
+    this.decodeModRegWord.call(this, X86.fnADCw);
+};
+
+/**
+ * op=0x14 (ADC AL,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opADCALb = function()
+{
+    this.regEAX = (this.regEAX & ~0xff) | X86.fnADCb.call(this, this.regEAX & 0xff, this.getIPByte());
+    if (BACKTRACK) this.backTrack.btiAL = this.backTrack.btiMem0;
+    this.nStepCycles--;         // in the absence of any EA calculations, we need deduct only one more cycle
+};
+
+/**
+ * op=0x15 (ADC AX,imm16 or ADC EAX,imm32)
+ *
+ * @this {X86CPU}
+ */
+X86.opADCAX = function()
+{
+    this.regEAX = (this.regEAX & ~this.maskData) | X86.fnADCw.call(this, this.regEAX & this.maskData, this.getIPWord());
+    if (BACKTRACK) {
+        this.backTrack.btiAL = this.backTrack.btiMem0; this.backTrack.btiAH = this.backTrack.btiMem1;
+    }
+    this.nStepCycles--;         // in the absence of any EA calculations, we need deduct only one more cycle
+};
+
+/**
+ * op=0x16 (PUSH SS)
+ *
+ * @this {X86CPU}
+ */
+X86.opPUSHSS = function()
+{
+    /*
+     * When the OPERAND size is 32 bits, the 80386 will decrement the stack pointer by 4, write the selector
+     * into the 2 lower bytes, and leave the 2 upper bytes untouched; to properly emulate that, we must use the
+     * more generic pushData() instead of pushWord().
+     */
+    if (!I386) {
+        this.pushWord(this.segSS.sel);
+    } else {
+        this.pushData(this.segSS.sel, this.sizeData, 2);
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPushSeg;
+};
+
+/**
+ * op=0x17 (POP SS)
+ *
+ * @this {X86CPU}
+ */
+X86.opPOPSS = function()
+{
+    /*
+     * Any operation that modifies the stack before loading a new segment must snapshot regLSP first.
+     */
+    this.opLSP = this.regLSP;
+    this.setSS(this.popWord());
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPopReg;
+    this.opLSP = X86.ADDR_INVALID;
+};
+
+/**
+ * op=0x18 (SBB byte,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opSBBmb = function()
+{
+    this.decodeModMemByte.call(this, X86.fnSBBb);
+};
+
+/**
+ * op=0x19 (SBB word,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opSBBmw = function()
+{
+    this.decodeModMemWord.call(this, X86.fnSBBw);
+};
+
+/**
+ * op=0x1A (SBB reg,byte)
+ *
+ * @this {X86CPU}
+ */
+X86.opSBBrb = function()
+{
+    this.decodeModRegByte.call(this, X86.fnSBBb);
+};
+
+/**
+ * op=0x1B (SBB reg,word)
+ *
+ * @this {X86CPU}
+ */
+X86.opSBBrw = function()
+{
+    this.decodeModRegWord.call(this, X86.fnSBBw);
+};
+
+/**
+ * op=0x1C (SBB AL,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opSBBALb = function()
+{
+    this.regEAX = (this.regEAX & ~0xff) | X86.fnSBBb.call(this, this.regEAX & 0xff, this.getIPByte());
+    if (BACKTRACK) this.backTrack.btiAL = this.backTrack.btiMem0;
+    this.nStepCycles--;         // in the absence of any EA calculations, we need deduct only one more cycle
+};
+
+/**
+ * op=0x1D (SBB AX,imm16 or SBB EAX,imm32)
+ *
+ * @this {X86CPU}
+ */
+X86.opSBBAX = function()
+{
+    this.regEAX = (this.regEAX & ~this.maskData) | X86.fnSBBw.call(this, this.regEAX & this.maskData, this.getIPWord());
+    if (BACKTRACK) {
+        this.backTrack.btiAL = this.backTrack.btiMem0; this.backTrack.btiAH = this.backTrack.btiMem1;
+    }
+    this.nStepCycles--;         // in the absence of any EA calculations, we need deduct only one more cycle
+};
+
+/**
+ * op=0x1E (PUSH DS)
+ *
+ * @this {X86CPU}
+ */
+X86.opPUSHDS = function()
+{
+    /*
+     * When the OPERAND size is 32 bits, the 80386 will decrement the stack pointer by 4, write the selector
+     * into the 2 lower bytes, and leave the 2 upper bytes untouched; to properly emulate that, we must use the
+     * more generic pushData() instead of pushWord().
+     */
+    if (!I386) {
+        this.pushWord(this.segDS.sel);
+    } else {
+        this.pushData(this.segDS.sel, this.sizeData, 2);
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPushSeg;
+};
+
+/**
+ * op=0x1F (POP DS)
+ *
+ * @this {X86CPU}
+ */
+X86.opPOPDS = function()
+{
+    /*
+     * Any operation that modifies the stack before loading a new segment must snapshot regLSP first.
+     */
+    this.opLSP = this.regLSP;
+    this.setDS(this.popWord());
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPopReg;
+    this.opLSP = X86.ADDR_INVALID;
+};
+
+/**
+ * op=0x20 (AND byte,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opANDmb = function()
+{
+    this.decodeModMemByte.call(this, X86.fnANDb);
+};
+
+/**
+ * op=0x21 (AND word,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opANDmw = function()
+{
+    this.decodeModMemWord.call(this, X86.fnANDw);
+};
+
+/**
+ * op=0x22 (AND reg,byte)
+ *
+ * @this {X86CPU}
+ */
+X86.opANDrb = function()
+{
+    this.decodeModRegByte.call(this, X86.fnANDb);
+};
+
+/**
+ * op=0x23 (AND reg,word)
+ *
+ * @this {X86CPU}
+ */
+X86.opANDrw = function()
+{
+    this.decodeModRegWord.call(this, X86.fnANDw);
+};
+
+/**
+ * op=0x24 (AND AL,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opANDAL = function()
+{
+    this.regEAX = (this.regEAX & ~0xff) | X86.fnANDb.call(this, this.regEAX & 0xff, this.getIPByte());
+    if (BACKTRACK) this.backTrack.btiAL = this.backTrack.btiMem0;
+    this.nStepCycles--;         // in the absence of any EA calculations, we need deduct only one more cycle
+};
+
+/**
+ * op=0x25 (AND AX,imm16 or AND EAX,imm32)
+ *
+ * @this {X86CPU}
+ */
+X86.opANDAX = function()
+{
+    this.regEAX = (this.regEAX & ~this.maskData) | X86.fnANDw.call(this, this.regEAX & this.maskData, this.getIPWord());
+    if (BACKTRACK) {
+        this.backTrack.btiAL = this.backTrack.btiMem0; this.backTrack.btiAH = this.backTrack.btiMem1;
+    }
+    this.nStepCycles--;         // in the absence of any EA calculations, we need deduct only one more cycle
+};
+
+/**
+ * op=0x26 (ES:)
+ *
+ * @this {X86CPU}
+ */
+X86.opES = function()
+{
+    this.opFlags |= X86.OPFLAG.SEG | X86.OPFLAG.NOINTR;
+    this.segData = this.segStack = this.segES;
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPrefix;
+};
+
+/**
+ * op=0x27 (DAA)
+ *
+ * @this {X86CPU}
+ */
+X86.opDAA = function()
+{
+    var AL = this.regEAX & 0xff;
+    var AF = this.getAF();
+    var CF = this.getCF();
+    if ((AL & 0xf) > 9 || AF) {
+        AL += 0x6;
+        AF = X86.PS.AF;
+    } else {
+        AF = 0;
+    }
+    if (AL > 0x9f || CF) {
+        AL += 0x60;
+        CF = X86.PS.CF;
+    } else {
+        CF = 0;
+    }
+    var b = (AL & 0xff);
+    this.regEAX = (this.regEAX & ~0xff) | b;
+    this.setLogicResult(b, X86.RESULT.BYTE);
+    if (CF) this.setCF(); else this.clearCF();
+    if (AF) this.setAF(); else this.clearAF();
+    this.nStepCycles -= this.cycleCounts.nOpCyclesAAA;          // AAA and DAA have the same cycle times
+};
+
+/**
+ * op=0x28 (SUB byte,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opSUBmb = function()
+{
+    this.decodeModMemByte.call(this, X86.fnSUBb);
+};
+
+/**
+ * op=0x29 (SUB word,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opSUBmw = function()
+{
+    this.decodeModMemWord.call(this, X86.fnSUBw);
+};
+
+/**
+ * op=0x2A (SUB reg,byte)
+ *
+ * @this {X86CPU}
+ */
+X86.opSUBrb = function()
+{
+    this.decodeModRegByte.call(this, X86.fnSUBb);
+};
+
+/**
+ * op=0x2B (SUB reg,word)
+ *
+ * @this {X86CPU}
+ */
+X86.opSUBrw = function()
+{
+    this.decodeModRegWord.call(this, X86.fnSUBw);
+};
+
+/**
+ * op=0x2C (SUB AL,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opSUBALb = function()
+{
+    this.regEAX = (this.regEAX & ~0xff) | X86.fnSUBb.call(this, this.regEAX & 0xff, this.getIPByte());
+    if (BACKTRACK) this.backTrack.btiAL = this.backTrack.btiMem0;
+    this.nStepCycles--;         // in the absence of any EA calculations, we need deduct only one more cycle
+};
+
+/**
+ * op=0x2D (SUB AX,imm16 or SUB EAX,imm32)
+ *
+ * @this {X86CPU}
+ */
+X86.opSUBAX = function()
+{
+    this.regEAX = (this.regEAX & ~this.maskData) | X86.fnSUBw.call(this, this.regEAX & this.maskData, this.getIPWord());
+    if (BACKTRACK) {
+        this.backTrack.btiAL = this.backTrack.btiMem0; this.backTrack.btiAH = this.backTrack.btiMem1;
+    }
+    this.nStepCycles--;         // in the absence of any EA calculations, we need deduct only one more cycle
+};
+
+/**
+ * op=0x2E (CS:)
+ *
+ * @this {X86CPU}
+ */
+X86.opCS = function()
+{
+    this.opFlags |= X86.OPFLAG.SEG | X86.OPFLAG.NOINTR;
+    this.segData = this.segStack = this.segCS;
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPrefix;
+};
+
+/**
+ * op=0x2F (DAS)
+ *
+ * @this {X86CPU}
+ */
+X86.opDAS = function()
+{
+    var AL = this.regEAX & 0xff;
+    var AF = this.getAF();
+    var CF = this.getCF();
+    if ((AL & 0xf) > 9 || AF) {
+        AL -= 0x6;
+        AF = X86.PS.AF;
+    } else {
+        AF = 0;
+    }
+    if (AL > 0x9f || CF) {
+        AL -= 0x60;
+        CF = X86.PS.CF;
+    } else {
+        CF = 0;
+    }
+    var b = (AL & 0xff);
+    this.regEAX = (this.regEAX & ~0xff) | b;
+    this.setLogicResult(b, X86.RESULT.BYTE);
+    if (CF) this.setCF(); else this.clearCF();
+    if (AF) this.setAF(); else this.clearAF();
+    this.nStepCycles -= this.cycleCounts.nOpCyclesAAA;          // AAA and DAS have the same cycle times
+};
+
+/**
+ * op=0x30 (XOR byte,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opXORmb = function()
+{
+    this.decodeModMemByte.call(this, X86.fnXORb);
+};
+
+/**
+ * op=0x31 (XOR word,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opXORmw = function()
+{
+    this.decodeModMemWord.call(this, X86.fnXORw);
+};
+
+/**
+ * op=0x32 (XOR reg,byte)
+ *
+ * @this {X86CPU}
+ */
+X86.opXORrb = function()
+{
+    this.decodeModRegByte.call(this, X86.fnXORb);
+};
+
+/**
+ * op=0x33 (XOR reg,word)
+ *
+ * @this {X86CPU}
+ */
+X86.opXORrw = function()
+{
+    this.decodeModRegWord.call(this, X86.fnXORw);
+};
+
+/**
+ * op=0x34 (XOR AL,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opXORALb = function()
+{
+    this.regEAX = (this.regEAX & ~0xff) | X86.fnXORb.call(this, this.regEAX & 0xff, this.getIPByte());
+    if (BACKTRACK) this.backTrack.btiAL = this.backTrack.btiMem0;
+    this.nStepCycles--;         // in the absence of any EA calculations, we need deduct only one more cycle
+};
+
+/**
+ * op=0x35 (XOR AX,imm16 or XOR EAX,imm32)
+ *
+ * @this {X86CPU}
+ */
+X86.opXORAX = function()
+{
+    this.regEAX = (this.regEAX & ~this.maskData) | X86.fnXORw.call(this, this.regEAX & this.maskData, this.getIPWord());
+    if (BACKTRACK) {
+        this.backTrack.btiAL = this.backTrack.btiMem0; this.backTrack.btiAH = this.backTrack.btiMem1;
+    }
+    this.nStepCycles--;         // in the absence of any EA calculations, we need deduct only one more cycle
+};
+
+/**
+ * op=0x36 (SS:)
+ *
+ * @this {X86CPU}
+ */
+X86.opSS = function()
+{
+    this.opFlags |= X86.OPFLAG.SEG | X86.OPFLAG.NOINTR;
+    this.segData = this.segStack = this.segSS;      // QUESTION: Is there a case where segStack would not already be segSS? (eg, multiple segment overrides?)
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPrefix;
+};
+
+/**
+ * op=0x37 (AAA)
+ *
+ * @this {X86CPU}
+ */
+X86.opAAA = function()
+{
+    var CF, AF;
+    var AL = this.regEAX & 0xff;
+    var AH = (this.regEAX >> 8) & 0xff;
+    if ((AL & 0xf) > 9 || this.getAF()) {
+        AL += 6;
+        /*
+         * Simulate the fact that the 80286 and higher add 6 to AX rather than AL.
+         */
+        if (this.model >= X86.MODEL_80286 && AL > 0xff) AH++;
+        AH++;
+        CF = AF = 1;
+    } else {
+        CF = AF = 0;
+    }
+    this.regEAX = (this.regEAX & ~0xffff) | (((AH << 8) | AL) & 0xff0f);
+    if (CF) this.setCF(); else this.clearCF();
+    if (AF) this.setAF(); else this.clearAF();
+    this.nStepCycles -= this.cycleCounts.nOpCyclesAAA;
+};
+
+/**
+ * op=0x38 (CMP byte,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opCMPmb = function()
+{
+    this.decodeModMemByte.call(this, X86.fnCMPb);
+};
+
+/**
+ * op=0x39 (CMP word,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opCMPmw = function()
+{
+    this.decodeModMemWord.call(this, X86.fnCMPw);
+};
+
+/**
+ * op=0x3A (CMP reg,byte)
+ *
+ * @this {X86CPU}
+ */
+X86.opCMPrb = function()
+{
+    this.decodeModRegByte.call(this, X86.fnCMPb);
+};
+
+/**
+ * op=0x3B (CMP reg,word)
+ *
+ * @this {X86CPU}
+ */
+X86.opCMPrw = function()
+{
+    this.decodeModRegWord.call(this, X86.fnCMPw);
+};
+
+/**
+ * op=0x3C (CMP AL,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opCMPALb = function()
+{
+    X86.fnCMPb.call(this, this.regEAX & 0xff, this.getIPByte());
+    this.nStepCycles--;         // in the absence of any EA calculations, we need deduct only one more cycle
+};
+
+/**
+ * op=0x3D (CMP AX,imm16 or CMP EAX,imm32)
+ *
+ * @this {X86CPU}
+ */
+X86.opCMPAX = function()
+{
+    X86.fnCMPw.call(this, this.regEAX & this.maskData, this.getIPWord());
+    this.nStepCycles--;         // in the absence of any EA calculations, we need deduct only one more cycle
+};
+
+/**
+ * op=0x3E (DS:)
+ *
+ * @this {X86CPU}
+ */
+X86.opDS = function()
+{
+    this.opFlags |= X86.OPFLAG.SEG | X86.OPFLAG.NOINTR;
+    this.segData = this.segStack = this.segDS;      // QUESTION: Is there a case where segData would not already be segDS? (eg, multiple segment overrides?)
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPrefix;
+};
+
+/**
+ * op=0x3D (AAS)
+ *
+ * @this {X86CPU}
+ */
+X86.opAAS = function()
+{
+    var CF, AF;
+    var AL = this.regEAX & 0xff;
+    var AH = (this.regEAX >> 8) & 0xff;
+    if ((AL & 0xf) > 9 || this.getAF()) {
+        AL = (AL - 0x6) & 0xf;
+        AH = (AH - 1) & 0xff;
+        CF = AF = 1;
+    } else {
+        CF = AF = 0;
+    }
+    this.regEAX = (this.regEAX & ~0xffff) | ((AH << 8) | AL);
+    if (CF) this.setCF(); else this.clearCF();
+    if (AF) this.setAF(); else this.clearAF();
+    this.nStepCycles -= this.cycleCounts.nOpCyclesAAA;   // AAA and AAS have the same cycle times
+};
+
+/**
+ * op=0x40 (INC [E]AX)
+ *
+ * @this {X86CPU}
+ */
+X86.opINCAX = function()
+{
+    this.regEAX = X86.helpINCreg.call(this, this.regEAX);
+};
+
+/**
+ * op=0x41 (INC [E]CX)
+ *
+ * @this {X86CPU}
+ */
+X86.opINCCX = function()
+{
+    this.regECX = X86.helpINCreg.call(this, this.regECX);
+};
+
+/**
+ * op=0x42 (INC [E]DX)
+ *
+ * @this {X86CPU}
+ */
+X86.opINCDX = function()
+{
+    this.regEDX = X86.helpINCreg.call(this, this.regEDX);
+};
+
+/**
+ * op=0x43 (INC [E]BX)
+ *
+ * @this {X86CPU}
+ */
+X86.opINCBX = function()
+{
+    this.regEBX = X86.helpINCreg.call(this, this.regEBX);
+};
+
+/**
+ * op=0x44 (INC [E]SP)
+ *
+ * @this {X86CPU}
+ */
+X86.opINCSP = function()
+{
+    this.setSP(X86.helpINCreg.call(this, this.getSP()));
+};
+
+/**
+ * op=0x45 (INC [E]BP)
+ *
+ * @this {X86CPU}
+ */
+X86.opINCBP = function()
+{
+    this.regEBP = X86.helpINCreg.call(this, this.regEBP);
+};
+
+/**
+ * op=0x46 (INC [E]SI)
+ *
+ * @this {X86CPU}
+ */
+X86.opINCSI = function()
+{
+    this.regESI = X86.helpINCreg.call(this, this.regESI);
+};
+
+/**
+ * op=0x47 (INC [E]DI)
+ *
+ * @this {X86CPU}
+ */
+X86.opINCDI = function()
+{
+    this.regEDI = X86.helpINCreg.call(this, this.regEDI);
+};
+
+/**
+ * op=0x48 (DEC [E]AX)
+ *
+ * @this {X86CPU}
+ */
+X86.opDECAX = function()
+{
+    this.regEAX = X86.helpDECreg.call(this, this.regEAX);
+};
+
+/**
+ * op=0x49 (DEC [E]CX)
+ *
+ * @this {X86CPU}
+ */
+X86.opDECCX = function()
+{
+    this.regECX = X86.helpDECreg.call(this, this.regECX);
+};
+
+/**
+ * op=0x4A (DEC [E]DX)
+ *
+ * @this {X86CPU}
+ */
+X86.opDECDX = function()
+{
+    this.regEDX = X86.helpDECreg.call(this, this.regEDX);
+};
+
+/**
+ * op=0x4B (DEC [E]BX)
+ *
+ * @this {X86CPU}
+ */
+X86.opDECBX = function()
+{
+    this.regEBX = X86.helpDECreg.call(this, this.regEBX);
+};
+
+/**
+ * op=0x4C (DEC [E]SP)
+ *
+ * @this {X86CPU}
+ */
+X86.opDECSP = function()
+{
+    this.setSP(X86.helpDECreg.call(this, this.getSP()));
+};
+
+/**
+ * op=0x4D (DEC [E]BP)
+ *
+ * @this {X86CPU}
+ */
+X86.opDECBP = function()
+{
+    this.regEBP = X86.helpDECreg.call(this, this.regEBP);
+};
+
+/**
+ * op=0x4E (DEC [E]SI)
+ *
+ * @this {X86CPU}
+ */
+X86.opDECSI = function()
+{
+    this.regESI = X86.helpDECreg.call(this, this.regESI);
+};
+
+/**`
+ * op=0x4F (DEC [E]DI)
+ *
+ * @this {X86CPU}
+ */
+X86.opDECDI = function()
+{
+    this.regEDI = X86.helpDECreg.call(this, this.regEDI);
+};
+
+/**
+ * op=0x50 (PUSH [E]AX)
+ *
+ * @this {X86CPU}
+ */
+X86.opPUSHAX = function()
+{
+    if (BACKTRACK) {
+        this.backTrack.btiMem0 = this.backTrack.btiAL; this.backTrack.btiMem1 = this.backTrack.btiAH;
+    }
+    this.pushWord(this.regEAX & this.maskData);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPushReg;
+};
+
+/**
+ * op=0x51 (PUSH [E]CX)
+ *
+ * @this {X86CPU}
+ */
+X86.opPUSHCX = function()
+{
+    if (BACKTRACK) {
+        this.backTrack.btiMem0 = this.backTrack.btiCL; this.backTrack.btiMem1 = this.backTrack.btiCH;
+    }
+    this.pushWord(this.regECX & this.maskData);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPushReg;
+};
+
+/**
+ * op=0x52 (PUSH [E]DX)
+ *
+ * @this {X86CPU}
+ */
+X86.opPUSHDX = function()
+{
+    if (BACKTRACK) {
+        this.backTrack.btiMem0 = this.backTrack.btiDL; this.backTrack.btiMem1 = this.backTrack.btiDH;
+    }
+    this.pushWord(this.regEDX & this.maskData);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPushReg;
+};
+
+/**
+ * op=0x53 (PUSH [E]BX)
+ *
+ * @this {X86CPU}
+ */
+X86.opPUSHBX = function()
+{
+    if (BACKTRACK) {
+        this.backTrack.btiMem0 = this.backTrack.btiBL; this.backTrack.btiMem1 = this.backTrack.btiBH;
+    }
+    this.pushWord(this.regEBX & this.maskData);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPushReg;
+};
+
+/**
+ * op=0x54 (PUSH SP)
+ *
+ * NOTE: Having an accurate implementation of "PUSH SP" for the 8086/8088 isn't just a nice idea, it affects real
+ * code.  Case in point: early Microsoft C floating-point libraries relied on "PUSH SP" behavior to quickly determine
+ * whether an 8088 (and therefore presumably an 8087) or an 80286 (and presumably an 80287) was being used; eg:
+ *
+ *      &0910:1E82 D93E1709        FSTCW    WORD [0917]
+ *      &0910:1E86 CD3D            INT      3D
+ *      &0E4E:06D3 50              PUSH     AX
+ *      &0E4E:06D4 B83DA2          MOV      AX,A23D
+ *      &0E4E:06D7 EB04            JMP      06DD
+ *      &0E4E:06DD 55              PUSH     BP
+ *      &0E4E:06DE 1E              PUSH     DS
+ *      &0E4E:06DF 56              PUSH     SI
+ *      &0E4E:06E0 8BEC            MOV      BP,SP
+ *      &0E4E:06E2 C57608          LDS      SI,[BP+08]
+ *      &0E4E:06E5 4E              DEC      SI
+ *      &0E4E:06E6 4E              DEC      SI
+ *      &0E4E:06E7 897608          MOV      [BP+08],SI
+ *      &0E4E:06EA 2904            SUB      [SI],AX
+ *      &0E4E:06EC 53              PUSH     BX
+ *      &0E4E:06ED 33DB            XOR      BX,BX
+ *      &0E4E:06EF 54              PUSH     SP          ; beginning of processor check
+ *      &0E4E:06F0 58              POP      AX
+ *      &0E4E:06F1 3BC4            CMP      AX,SP
+ *      &0E4E:06F3 7528            JNZ      071D        ; jump if 8086/8088/80186/80188, no jump if 80286 or later
+ *      &0E4E:06F5 8B4001          MOV      AX,[BX+SI+01]
+ *      &0E4E:06F8 25FB30          AND      AX,30FB
+ *      &0E4E:06FB 3DD930          CMP      AX,30D9
+ *      &0E4E:06FE 7507            JNZ      0707
+ *      &0E4E:0700 8A4002          MOV      AL,[BX+SI+02]
+ *      &0E4E:0703 3CF0            CMP      AL,F0
+ *      &0E4E:0705 7216            JC       071D
+ *      &0E4E:0707 8B4001          MOV      AX,[BX+SI+01]
+ *      &0E4E:070A 25FFFE          AND      AX,FEFF
+ *      &0E4E:070D 3DDBE2          CMP      AX,E2DB
+ *      &0E4E:0710 740B            JZ       071D
+ *      &0E4E:0712 8B4001          MOV      AX,[BX+SI+01]
+ *      &0E4E:0715 3DDFE0          CMP      AX,E0DF
+ *      &0E4E:0718 7403            JZ       071D
+ *      &0E4E:071A C60490          MOV      [SI],90
+ *      &0E4E:071D 5B              POP      BX
+ *      &0E4E:071E 5E              POP      SI
+ *      &0E4E:071F 1F              POP      DS
+ *      &0E4E:0720 5D              POP      BP
+ *      &0E4E:0721 58              POP      AX
+ *      &0E4E:0722 CF              IRET
+ *
+ * @this {X86CPU}
+ */
+X86.opPUSHSP_8086 = function()
+{
+    var w = (this.getSP() - 2) & 0xffff;
+    this.pushWord(w);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPushReg;
+};
+
+/**
+ * op=0x54 (PUSH [E]SP)
+ *
+ * @this {X86CPU}
+ */
+X86.opPUSHSP = function()
+{
+    this.pushWord(this.getSP() & this.maskData);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPushReg;
+};
+
+/**
+ * op=0x55 (PUSH [E]BP)
+ *
+ * @this {X86CPU}
+ */
+X86.opPUSHBP = function()
+{
+    if (BACKTRACK) {
+        this.backTrack.btiMem0 = this.backTrack.btiBPLo; this.backTrack.btiMem1 = this.backTrack.btiBPHi;
+    }
+    this.pushWord(this.regEBP & this.maskData);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPushReg;
+};
+
+/**
+ * op=0x56 (PUSH [E]SI)
+ *
+ * @this {X86CPU}
+ */
+X86.opPUSHSI = function()
+{
+    if (BACKTRACK) {
+        this.backTrack.btiMem0 = this.backTrack.btiSILo; this.backTrack.btiMem1 = this.backTrack.btiSIHi;
+    }
+    this.pushWord(this.regESI & this.maskData);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPushReg;
+};
+
+/**
+ * op=0x57 (PUSH [E]DI)
+ *
+ * @this {X86CPU}
+ */
+X86.opPUSHDI = function()
+{
+    if (BACKTRACK) {
+        this.backTrack.btiMem0 = this.backTrack.btiDILo; this.backTrack.btiMem1 = this.backTrack.btiDIHi;
+    }
+    this.pushWord(this.regEDI & this.maskData);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPushReg;
+};
+
+/**
+ * op=0x58 (POP [E]AX)
+ *
+ * @this {X86CPU}
+ */
+X86.opPOPAX = function()
+{
+    this.regEAX = (this.regEAX & ~this.maskData) | this.popWord();
+    if (BACKTRACK) {
+        this.backTrack.btiAL = this.backTrack.btiMem0; this.backTrack.btiAH = this.backTrack.btiMem1;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPopReg;
+};
+
+/**
+ * op=0x59 (POP [E]CX)
+ *
+ * @this {X86CPU}
+ */
+X86.opPOPCX = function()
+{
+    this.regECX = (this.regECX & ~this.maskData) | this.popWord();
+    if (BACKTRACK) {
+        this.backTrack.btiCL = this.backTrack.btiMem0; this.backTrack.btiCH = this.backTrack.btiMem1;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPopReg;
+};
+
+/**
+ * op=0x5A (POP [E]DX)
+ *
+ * @this {X86CPU}
+ */
+X86.opPOPDX = function()
+{
+    this.regEDX = (this.regEDX & ~this.maskData) | this.popWord();
+    if (BACKTRACK) {
+        this.backTrack.btiDL = this.backTrack.btiMem0; this.backTrack.btiDH = this.backTrack.btiMem1;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPopReg;
+};
+
+/**
+ * op=0x5B (POP [E]BX)
+ *
+ * @this {X86CPU}
+ */
+X86.opPOPBX = function()
+{
+    this.regEBX = (this.regEBX & ~this.maskData) | this.popWord();
+    if (BACKTRACK) {
+        this.backTrack.btiBL = this.backTrack.btiMem0; this.backTrack.btiBH = this.backTrack.btiMem1;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPopReg;
+};
+
+/**
+ * op=0x5C (POP [E]SP)
+ *
+ * @this {X86CPU}
+ */
+X86.opPOPSP = function()
+{
+    this.setSP((this.getSP() & ~this.maskData) | this.popWord());
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPopReg;
+};
+
+/**
+ * op=0x5D (POP [E]BP)
+ *
+ * @this {X86CPU}
+ */
+X86.opPOPBP = function()
+{
+    this.regEBP = (this.regEBP & ~this.maskData) | this.popWord();
+    if (BACKTRACK) {
+        this.backTrack.btiBPLo = this.backTrack.btiMem0; this.backTrack.btiBPHi = this.backTrack.btiMem1;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPopReg;
+};
+
+/**
+ * op=0x5E (POP [E]SI)
+ *
+ * @this {X86CPU}
+ */
+X86.opPOPSI = function()
+{
+    this.regESI = (this.regESI & ~this.maskData) | this.popWord();
+    if (BACKTRACK) {
+        this.backTrack.btiSILo = this.backTrack.btiMem0; this.backTrack.btiSIHi = this.backTrack.btiMem1;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPopReg;
+};
+
+/**
+ * op=0x5F (POP [E]DI)
+ *
+ * @this {X86CPU}
+ */
+X86.opPOPDI = function()
+{
+    this.regEDI = (this.regEDI & ~this.maskData) | this.popWord();
+    if (BACKTRACK) {
+        this.backTrack.btiDILo = this.backTrack.btiMem0; this.backTrack.btiDIHi = this.backTrack.btiMem1;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPopReg;
+};
+
+/**
+ * op=0x60 (PUSHA) (80186/80188 and up)
+ *
+ * @this {X86CPU}
+ */
+X86.opPUSHA = function()
+{
+    /*
+     * Any operation that performs multiple stack modifications must snapshot regLSP first.
+     */
+    this.opLSP = this.regLSP;
+
+    /*
+     * TODO: regLSP needs to be pre-bounds-checked against regLSPLimitLow
+     */
+    var temp = this.getSP() & this.maskData;
+    if (BACKTRACK) {
+        this.backTrack.btiMem0 = this.backTrack.btiAL; this.backTrack.btiMem1 = this.backTrack.btiAH;
+    }
+    this.pushWord(this.regEAX & this.maskData);
+    if (BACKTRACK) {
+        this.backTrack.btiMem0 = this.backTrack.btiCL; this.backTrack.btiMem1 = this.backTrack.btiCH;
+    }
+    this.pushWord(this.regECX & this.maskData);
+    if (BACKTRACK) {
+        this.backTrack.btiMem0 = this.backTrack.btiDL; this.backTrack.btiMem1 = this.backTrack.btiDH;
+    }
+    this.pushWord(this.regEDX & this.maskData);
+    if (BACKTRACK) {
+        this.backTrack.btiMem0 = this.backTrack.btiBL; this.backTrack.btiMem1 = this.backTrack.btiBH;
+    }
+    this.pushWord(this.regEBX & this.maskData);
+    this.pushWord(temp);
+    if (BACKTRACK) {
+        this.backTrack.btiMem0 = this.backTrack.btiBPLo; this.backTrack.btiMem1 = this.backTrack.btiBPHi;
+    }
+    this.pushWord(this.regEBP & this.maskData);
+    if (BACKTRACK) {
+        this.backTrack.btiMem0 = this.backTrack.btiSILo; this.backTrack.btiMem1 = this.backTrack.btiSIHi;
+    }
+    this.pushWord(this.regESI & this.maskData);
+    if (BACKTRACK) {
+        this.backTrack.btiMem0 = this.backTrack.btiDILo; this.backTrack.btiMem1 = this.backTrack.btiDIHi;
+    }
+    this.pushWord(this.regEDI & this.maskData);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPushAll;
+
+    this.opLSP = X86.ADDR_INVALID;
+};
+
+/**
+ * op=0x61 (POPA) (80186/80188 and up)
+ *
+ * @this {X86CPU}
+ */
+X86.opPOPA = function()
+{
+    /*
+     * Any operation that performs multiple stack modifications must snapshot regLSP first.
+     */
+    this.opLSP = this.regLSP;
+
+    this.regEDI = (this.regEDI & ~this.maskData) | this.popWord();
+    if (BACKTRACK) {
+        this.backTrack.btiDILo = this.backTrack.btiMem0; this.backTrack.btiDIHi = this.backTrack.btiMem1;
+    }
+    this.regESI = (this.regESI & ~this.maskData) | this.popWord();
+    if (BACKTRACK) {
+        this.backTrack.btiSILo = this.backTrack.btiMem0; this.backTrack.btiSIHi = this.backTrack.btiMem1;
+    }
+    this.regEBP = (this.regEBP & ~this.maskData) | this.popWord();
+    if (BACKTRACK) {
+        this.backTrack.btiBPLo = this.backTrack.btiMem0; this.backTrack.btiBPHi = this.backTrack.btiMem1;
+    }
+    /*
+     * TODO: regLSP needs to be pre-bounds-checked against regLSPLimit at the start
+     */
+    this.setSP(this.getSP() + this.sizeData);
+    // this.regLSP += (I386? this.sizeData : 2);
+    this.regEBX = (this.regEBX & ~this.maskData) | this.popWord();
+    if (BACKTRACK) {
+        this.backTrack.btiBL = this.backTrack.btiMem0; this.backTrack.btiBH = this.backTrack.btiMem1;
+    }
+    this.regEDX = (this.regEDX & ~this.maskData) | this.popWord();
+    if (BACKTRACK) {
+        this.backTrack.btiDL = this.backTrack.btiMem0; this.backTrack.btiDH = this.backTrack.btiMem1;
+    }
+    this.regECX = (this.regECX & ~this.maskData) | this.popWord();
+    if (BACKTRACK) {
+        this.backTrack.btiCL = this.backTrack.btiMem0; this.backTrack.btiCH = this.backTrack.btiMem1;
+    }
+    this.regEAX = (this.regEAX & ~this.maskData) | this.popWord();
+    if (BACKTRACK) {
+        this.backTrack.btiAL = this.backTrack.btiMem0; this.backTrack.btiAH = this.backTrack.btiMem1;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPopAll;
+
+    this.opLSP = X86.ADDR_INVALID;
+};
+
+/**
+ * op=0x62 (BOUND reg,word) (80186/80188 and up)
+ *
+ * @this {X86CPU}
+ */
+X86.opBOUND = function()
+{
+    this.decodeModRegWord.call(this, X86.fnBOUND);
+};
+
+/**
+ * op=0x63 (ARPL word,reg) (80286 and up)
+ *
+ * @this {X86CPU}
+ */
+X86.opARPL = function()
+{
+    /*
+     * ARPL is one of several protected-mode instructions that are meaningless and not allowed in either real-mode
+     * or V86-mode; others include LAR, LSL, VERR and VERW.  More meaningful but potentially harmful protected-mode
+     * instructions that ARE allowed in real-mode but NOT in V86-mode include LIDT, LGDT, LMSW, CLTS, HLT, and
+     * control register MOV instructions.
+     *
+     * ARPL is somewhat more noteworthy because enhanced-mode Windows (going back to at least Windows 3.00, and
+     * possibly even the earliest versions of Windows/386) selected the ARPL opcode as a controlled means of exiting
+     * V86-mode via the UD_FAULT exception.  Windows would use the same ARPL for all controlled exits, using different
+     * segment:offset pointers to the ARPL to differentiate them.  ARPL was probably chosen because it could trigger
+     * a UD_FAULT with a single byte (0x63); any subsequent address bytes would be irrelevant.
+     *
+     * Which is WHY we must perform the CPU mode tests below rather than in the fnARPL() worker; otherwise we could
+     * generate additional (bogus) faults, based on the address of the first operand.
+     *
+     * TODO: You may have noticed that setProtMode() already swaps out a 0x0F opcode dispatch table for another based
+     * on the mode, because none of the "GRP6" 0x0F opcodes (eg, SLDT, STR, LLDT, LTR, VERR and VERW) are allowed in
+     * real-mode, and it was easy to swap all those handlers in/out with a single update.  We've extended that particular
+     * swap to include V86-mode as well, but we might want to consider swapping out more opcode handlers in a similar
+     * fashion, instead of using these in-line mode tests.
+     */
+    if (!(this.regCR0 & X86.CR0.MSW.PE) || I386 && (this.regPS & X86.PS.VM)) {
+        X86.opInvalid.call(this);
+        return;
+    }
+    this.decodeModMemWord.call(this, X86.fnARPL);
+};
+
+/**
+ * op=0x64 (FS:)
+ *
+ * @this {X86CPU}
+ */
+X86.opFS = function()
+{
+    this.opFlags |= X86.OPFLAG.SEG | X86.OPFLAG.NOINTR;
+    this.segData = this.segStack = this.segFS;
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPrefix;
+};
+
+/**
+ * op=0x65 (GS:)
+ *
+ * @this {X86CPU}
+ */
+X86.opGS = function()
+{
+    this.opFlags |= X86.OPFLAG.SEG | X86.OPFLAG.NOINTR;
+    this.segData = this.segStack = this.segGS;
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPrefix;
+};
+
+/**
+ * op=0x66 (OS:) (80386 and up)
+ *
+ * TODO: Review other effective operand-size criteria, cycle count, etc.
+ *
+ * @this {X86CPU}
+ */
+X86.opOS = function()
+{
+    if (I386) {
+        /*
+         * See opAS() for a discussion of multiple prefixes, which applies equally to both
+         * operand-size and address-size prefixes.
+         *
+         * The simple fix here is to skip the bulk of the operation if the prefix is redundant.
+         */
+        this.opFlags |= X86.OPFLAG.DATASIZE;
+        if (!(this.opPrefixes & X86.OPFLAG.DATASIZE)) {
+            this.sizeData ^= 0x6;               // that which is 2 shall become 4, and vice versa
+            this.maskData ^= (0xffff0000|0);    // that which is 0x0000ffff shall become 0xffffffff, and vice versa
+            this.updateDataSize();
+        }
+        this.nStepCycles -= this.cycleCounts.nOpCyclesPrefix;
+    }
+};
+
+/**
+ * op=0x67 (AS:) (80386 and up)
+ *
+ * TODO: Review other effective address-size criteria, cycle count, etc.
+ *
+ * @this {X86CPU}
+ */
+X86.opAS = function()
+{
+    if (I386) {
+        /*
+         * Live and learn: multiple address-size prefixes can and do occur on a single instruction,
+         * and contrary to my original assumption that the prefixes act independently, they do not.
+         * During Windows 95 SETUP, the following instruction is executed:
+         *
+         *      06AF:1B4D 67672E          CS:
+         *      06AF:1B50 FFA25A1B        JMP      [BP+SI+1B5A]
+         *
+         * which is in fact:
+         *
+         *      06AF:1B4D 67672E          CS:
+         *      06AF:1B50 FFA25A1B0000    JMP      [EDX+00001B5A]
+         *
+         * The other interesting question is: why/how did this instruction get encoded that way?
+         * All I can say is, there were no explicit prefixes in the source (BSG.ASM), so we'll chalk
+         * it up to a glitch in MASM.
+         *
+         * The simple fix here is to skip the bulk of the operation if the prefix is redundant.
+         */
+        this.opFlags |= X86.OPFLAG.ADDRSIZE;
+        if (!(this.opPrefixes & X86.OPFLAG.ADDRSIZE)) {
+            this.sizeAddr ^= 0x06;              // that which is 2 shall become 4, and vice versa
+            this.maskAddr ^= (0xffff0000|0);    // that which is 0x0000ffff shall become 0xffffffff, and vice versa
+            this.updateAddrSize();
+        }
+        this.nStepCycles -= this.cycleCounts.nOpCyclesPrefix;
+    }
+};
+
+/**
+ * op=0x68 (PUSH imm) (80186/80188 and up)
+ *
+ * @this {X86CPU}
+ */
+X86.opPUSHn = function()
+{
+    this.pushWord(this.getIPWord());
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPushReg;
+};
+
+/**
+ * op=0x69 (IMUL reg,word,imm) (80186/80188 and up)
+ *
+ * @this {X86CPU}
+ */
+X86.opIMULn = function()
+{
+    this.decodeModRegWord.call(this, X86.fnIMULn);
+};
+
+/**
+ * op=0x6A (PUSH imm8) (80186/80188 and up)
+ *
+ * @this {X86CPU}
+ */
+X86.opPUSH8 = function()
+{
+    if (BACKTRACK) this.backTrack.btiMem1 = 0;
+    this.pushWord(this.getIPDisp());
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPushReg;
+};
+
+/**
+ * op=0x6B (IMUL reg,word,imm8) (80186/80188 and up)
+ *
+ * @this {X86CPU}
+ */
+X86.opIMUL8 = function()
+{
+    this.decodeModRegWord.call(this, X86.fnIMUL8);
+};
+
+/**
+ * op=0x6C (INSB) (80186/80188 and up)
+ *
+ * NOTE: Segment overrides are ignored for this instruction, so we must use segES instead of segData.
+ *
+ * @this {X86CPU}
+ */
+X86.opINSb = function()
+{
+    var nReps = 1;
+    var nDelta = 0;
+    var maskAddr = this.maskAddr;
+
+    /*
+     * NOTE: 5 + 4n is the cycle time for the 80286; the 80186/80188 has different values: 14 cycles for
+     * an unrepeated INS, and 8 + 8n for a repeated INS.  However, accurate cycle times for the 80186/80188 is
+     * low priority.
+     */
+    var nCycles = 5;
+
+    /*
+     * The (normal) REP prefix, if used, is REPNZ (0xf2), but either one works....
+     */
+    if (this.opPrefixes & (X86.OPFLAG.REPZ | X86.OPFLAG.REPNZ)) {
+        nReps = this.regECX & maskAddr;
+        nDelta = 1;
+        if (this.opPrefixes & X86.OPFLAG.REPEAT) nCycles = 4;
+    }
+
+    if (nReps--) {
+        var port = this.regEDX & 0xffff;
+        if (!this.checkIOPM(port, 1, true)) return;
+        var b = this.bus.checkPortInputNotify(port, 1, this.regLIP - nDelta - 1);
+        this.setSOByte(this.segES, this.regEDI & maskAddr, b);
+        /*
+         * helpFault() throws exceptions now, so inline checks of X86.OPFLAG.FAULT should no longer be necessary.
+         *
+         *      if (this.opFlags & X86.OPFLAG.FAULT) return;
+         */
+        if (BACKTRACK) this.backTrack.btiMem0 = this.backTrack.btiIO;
+        this.regEDI = (this.regEDI & ~maskAddr) | ((this.regEDI + ((this.regPS & X86.PS.DF)? -1 : 1)) & maskAddr);
+        this.regECX = (this.regECX & ~maskAddr) | ((this.regECX - nDelta) & maskAddr);
+        this.nStepCycles -= nCycles;
+        if (nReps) {
+            this.resetIP(-2);
+            this.opFlags |= X86.OPFLAG.REPEAT;
+        }
+    }
+};
+
+/**
+ * op=0x6D (INSW) (80186/80188 and up)
+ *
+ * NOTE: Segment overrides are ignored for this instruction, so we must use segDS instead of segData.
+ *
+ * @this {X86CPU}
+ */
+X86.opINSw = function()
+{
+    var nReps = 1;
+    var nDelta = 0;
+    var maskAddr = this.maskAddr;
+
+    /*
+     * NOTE: 5 + 4n is the cycle time for the 80286; the 80186/80188 has different values: 14 cycles for
+     * an unrepeated INS, and 8 + 8n for a repeated INS.  However, accurate cycle times for the 80186/80188 is
+     * low priority.
+     */
+    var nCycles = 5;
+
+    /*
+     * The (normal) REP prefix, if used, is REPNZ (0xf2), but either one works....
+     */
+    if (this.opPrefixes & (X86.OPFLAG.REPZ | X86.OPFLAG.REPNZ)) {
+        nReps = this.regECX & maskAddr;
+        nDelta = 1;
+        if (this.opPrefixes & X86.OPFLAG.REPEAT) nCycles = 4;
+    }
+    if (nReps--) {
+        var port = this.regEDX & 0xffff;
+        if (!this.checkIOPM(port, this.sizeData, true)) return;
+        var w = this.bus.checkPortInputNotify(port, this.sizeData, this.regLIP - nDelta - 1);
+        if (BACKTRACK) {
+            this.backTrack.btiMem0 = this.backTrack.btiIO;
+            this.backTrack.btiMem1 = this.backTrack.btiIO;
+        }
+        this.setSOWord(this.segES, this.regEDI & maskAddr, w);
+        /*
+         * helpFault() throws exceptions now, so inline checks of X86.OPFLAG.FAULT should no longer be necessary.
+         *
+         *      if (this.opFlags & X86.OPFLAG.FAULT) return;
+         */
+        this.regEDI = (this.regEDI & ~maskAddr) | ((this.regEDI + ((this.regPS & X86.PS.DF)? -this.sizeData : this.sizeData)) & maskAddr);
+        this.regECX = (this.regECX & ~maskAddr) | ((this.regECX - nDelta) & maskAddr);
+        this.nStepCycles -= nCycles;
+        if (nReps) {
+            this.resetIP(-2);
+            this.opFlags |= X86.OPFLAG.REPEAT;
+        }
+    }
+};
+
+/**
+ * op=0x6E (OUTSB) (80186/80188 and up)
+ *
+ * NOTE: Segment overrides are ignored for this instruction, so we must use segDS instead of segData.
+ *
+ * @this {X86CPU}
+ */
+X86.opOUTSb = function()
+{
+    var nReps = 1;
+    var nDelta = 0;
+    var maskAddr = this.maskAddr;
+
+    /*
+     * NOTE: 5 + 4n is the cycle time for the 80286; the 80186/80188 has different values: 14 cycles for
+     * an unrepeated INS, and 8 + 8n for a repeated INS.  TODO: Fix this someday.
+     */
+    var nCycles = 5;
+
+    /*
+     * The (normal) REP prefix, if used, is REPNZ (0xf2), but either one works....
+     */
+    if (this.opPrefixes & (X86.OPFLAG.REPZ | X86.OPFLAG.REPNZ)) {
+        nReps = this.regECX & maskAddr;
+        nDelta = 1;
+        if (this.opPrefixes & X86.OPFLAG.REPEAT) nCycles = 4;
+    }
+    if (nReps--) {
+        var port = this.regEDX & 0xffff;
+        if (!this.checkIOPM(port, 1, false)) return;
+        var b = this.getSOByte(this.segDS, this.regESI & maskAddr);
+        /*
+         * helpFault() throws exceptions now, so inline checks of X86.OPFLAG.FAULT should no longer be necessary.
+         *
+         *      if (this.opFlags & X86.OPFLAG.FAULT) return;
+         */
+        if (BACKTRACK) this.backTrack.btiIO = this.backTrack.btiMem0;
+        this.bus.checkPortOutputNotify(port, 1, b, this.regLIP - nDelta - 1);
+        this.regESI = (this.regESI & ~maskAddr) | ((this.regESI + ((this.regPS & X86.PS.DF)? -1 : 1)) & maskAddr);
+        this.regECX = (this.regECX & ~maskAddr) | ((this.regECX - nDelta) & maskAddr);
+        this.nStepCycles -= nCycles;
+        if (nReps) {
+            this.resetIP(-2);
+            this.opFlags |= X86.OPFLAG.REPEAT;
+        }
+    }
+};
+
+/**
+ * op=0x6F (OUTSW) (80186/80188 and up)
+ *
+ * NOTE: Segment overrides are ignored for this instruction, so we must use segDS instead of segData.
+ *
+ * @this {X86CPU}
+ */
+X86.opOUTSw = function()
+{
+    var nReps = 1;
+    var nDelta = 0;
+    var maskAddr = this.maskAddr;
+
+    /*
+     * NOTE: 5 + 4n is the cycle time for the 80286; the 80186/80188 has different values: 14 cycles for
+     * an unrepeated INS, and 8 + 8n for a repeated INS.  TODO: Fix this someday.
+     */
+    var nCycles = 5;
+
+    /*
+     * The (normal) REP prefix, if used, is REPNZ (0xf2), but either one works....
+     */
+    if (this.opPrefixes & (X86.OPFLAG.REPZ | X86.OPFLAG.REPNZ)) {
+        nReps = this.regECX & maskAddr;
+        nDelta = 1;
+        if (this.opPrefixes & X86.OPFLAG.REPEAT) nCycles = 4;
+    }
+    if (nReps--) {
+        var w = this.getSOWord(this.segDS, this.regESI & maskAddr);
+        /*
+         * helpFault() throws exceptions now, so inline checks of X86.OPFLAG.FAULT should no longer be necessary.
+         *
+         *      if (this.opFlags & X86.OPFLAG.FAULT) return;
+         */
+        var port = this.regEDX & 0xffff;
+        if (!this.checkIOPM(port, this.sizeData, false)) return;
+        if (BACKTRACK) {
+            this.backTrack.btiIO = this.backTrack.btiMem0;
+            this.backTrack.btiIO = this.backTrack.btiMem1;
+        }
+        this.bus.checkPortOutputNotify(port, this.sizeData, w, this.regLIP - nDelta - 1);
+        this.regESI = (this.regESI & ~maskAddr) | ((this.regESI + ((this.regPS & X86.PS.DF)? -this.sizeData : this.sizeData)) & maskAddr);
+        this.regECX = (this.regECX & ~maskAddr) | ((this.regECX - nDelta) & maskAddr);
+        this.nStepCycles -= nCycles;
+        if (nReps) {
+            this.resetIP(-2);
+            this.opFlags |= X86.OPFLAG.REPEAT;
+        }
+    }
+};
+
+/**
+ * op=0x70 (JO disp)
+ *
+ * @this {X86CPU}
+ */
+X86.opJO = function()
+{
+    var disp = this.getIPDisp();
+    if (this.getOF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * op=0x71 (JNO disp)
+ *
+ * @this {X86CPU}
+ */
+X86.opJNO = function()
+{
+    var disp = this.getIPDisp();
+    if (!this.getOF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * op=0x72 (JC disp, aka JB disp)
+ *
+ * @this {X86CPU}
+ */
+X86.opJC = function()
+{
+    var disp = this.getIPDisp();
+    if (this.getCF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * op=0x73 (JNC disp, aka JAE disp)
+ *
+ * @this {X86CPU}
+ */
+X86.opJNC = function()
+{
+    var disp = this.getIPDisp();
+    if (!this.getCF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * op=0x74 (JZ disp)
+ *
+ * @this {X86CPU}
+ */
+X86.opJZ = function()
+{
+    var disp = this.getIPDisp();
+    if (this.getZF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * op=0x75 (JNZ disp)
+ *
+ * @this {X86CPU}
+ */
+X86.opJNZ = function()
+{
+    var disp = this.getIPDisp();
+    if (!this.getZF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * op=0x76 (JBE disp)
+ *
+ * @this {X86CPU}
+ */
+X86.opJBE = function()
+{
+    var disp = this.getIPDisp();
+    if (this.getCF() || this.getZF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * op=0x77 (JNBE disp, JA disp)
+ *
+ * @this {X86CPU}
+ */
+X86.opJNBE = function()
+{
+    var disp = this.getIPDisp();
+    if (!this.getCF() && !this.getZF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * op=0x78 (JS disp)
+ *
+ * @this {X86CPU}
+ */
+X86.opJS = function()
+{
+    var disp = this.getIPDisp();
+    if (this.getSF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * op=0x79 (JNS disp)
+ *
+ * @this {X86CPU}
+ */
+X86.opJNS = function()
+{
+    var disp = this.getIPDisp();
+    if (!this.getSF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * op=0x7A (JP disp)
+ *
+ * @this {X86CPU}
+ */
+X86.opJP = function()
+{
+    var disp = this.getIPDisp();
+    if (this.getPF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * op=0x7B (JNP disp)
+ *
+ * @this {X86CPU}
+ */
+X86.opJNP = function()
+{
+    var disp = this.getIPDisp();
+    if (!this.getPF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * op=0x7C (JL disp)
+ *
+ * @this {X86CPU}
+ */
+X86.opJL = function()
+{
+    var disp = this.getIPDisp();
+    if (!this.getSF() != !this.getOF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * op=0x7D (JNL disp, aka JGE disp)
+ *
+ * @this {X86CPU}
+ */
+X86.opJNL = function()
+{
+    var disp = this.getIPDisp();
+    if (!this.getSF() == !this.getOF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * op=0x7E (JLE disp)
+ *
+ * @this {X86CPU}
+ */
+X86.opJLE = function()
+{
+    var disp = this.getIPDisp();
+    if (this.getZF() || !this.getSF() != !this.getOF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * op=0x7F (JNLE disp, aka JG disp)
+ *
+ * @this {X86CPU}
+ */
+X86.opJNLE = function()
+{
+    var disp = this.getIPDisp();
+    if (!this.getZF() && !this.getSF() == !this.getOF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * op=0x80/0x82 (GRP1 byte,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opGRP1b = function()
+{
+    this.decodeModGrpByte.call(this, X86.aOpGrp1b, this.getIPByte);
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? 1 : this.cycleCounts.nOpCyclesArithMID);
+};
+
+/**
+ * op=0x81 (GRP1 word,imm)
+ *
+ * @this {X86CPU}
+ */
+X86.opGRP1w = function()
+{
+    this.decodeModGrpWord.call(this, X86.aOpGrp1w, this.getIPWord);
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? 1 : this.cycleCounts.nOpCyclesArithMID);
+};
+
+/**
+ * op=0x83 (GRP1 word,disp)
+ *
+ * WARNING: This passes getIPDisp() as the fnSrc parameter, which returns a 32-bit signed value,
+ * so the worker functions (ie, the functions listed in aOpGrp1w[]) MUST mask their result with maskData,
+ * to avoid setting bits beyond the current operand size.
+ *
+ * @this {X86CPU}
+ */
+X86.opGRP1sw = function()
+{
+    this.decodeModGrpWord.call(this, X86.aOpGrp1w, this.getIPDisp);
+    this.nStepCycles -= (this.regEAWrite === X86.ADDR_INVALID? 1 : this.cycleCounts.nOpCyclesArithMID);
+};
+
+/**
+ * op=0x84 (TEST reg,byte)
+ *
+ * @this {X86CPU}
+ */
+X86.opTESTrb = function()
+{
+    this.decodeModMemByte.call(this, X86.fnTESTb);
+};
+
+/**
+ * op=0x85 (TEST reg,word)
+ *
+ * @this {X86CPU}
+ */
+X86.opTESTrw = function()
+{
+    this.decodeModMemWord.call(this, X86.fnTESTw);
+};
+
+/**
+ * op=0x86 (XCHG reg,byte)
+ *
+ * NOTE: The XCHG instruction is unique in that both src and dst are both read and written;
+ * see fnXCHGrb() for how we deal with this special case.
+ *
+ * @this {X86CPU}
+ */
+X86.opXCHGrb = function()
+{
+    /*
+     * If the second operand is a register, then the ModRegByte decoder must use separate "get" and
+     * "set" assignments, otherwise instructions like "XCHG DH,DL" will end up using a stale DL instead of
+     * the updated DL.
+     *
+     * To be clear, a single assignment like this will fail:
+     *
+     *      opModRegByteF2: function(fn)
+     *      {
+     *          this.regEDX = (this.regEDX & 0xff) | (fn.call(this, this.regEDX >> 8, this.regEDX & 0xff) << 8);
+     *      }
+     *
+     * which is why all affected decoders now use separate assignments; eg:
+     *
+     *      opModRegByteF2: function(fn)
+     *      {
+     *          var b = fn.call(this, this.regEDX >> 8, this.regEDX & 0xff);
+     *          this.regEDX = (this.regEDX & 0xff) | (b << 8);
+     *      }
+     */
+    this.decodeModRegByte.call(this, X86.fnXCHGrb);
+};
+
+/**
+ * op=0x87 (XCHG reg,word)
+ *
+ * NOTE: The XCHG instruction is unique in that both src and dst are both read and written;
+ * see fnXCHGrw() for how we deal with this special case.
+ *
+ * @this {X86CPU}
+ */
+X86.opXCHGrw = function()
+{
+    this.decodeModRegWord.call(this, X86.fnXCHGrw);
+};
+
+/**
+ * op=0x88 (MOV byte,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVmb = function()
+{
+    /*
+     * Like other MOV operations, the destination does not need to be read, just written.
+     */
+    this.opFlags |= X86.OPFLAG.NOREAD;
+    this.decodeModMemByte.call(this, X86.fnMOV);
+};
+
+/**
+ * op=0x89 (MOV word,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVmw = function()
+{
+    /*
+     * Like other MOV operations, the destination does not need to be read, just written.
+     */
+    this.opFlags |= X86.OPFLAG.NOREAD;
+    this.decodeModMemWord.call(this, X86.fnMOV);
+};
+
+/**
+ * op=0x8A (MOV reg,byte)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVrb = function()
+{
+    this.decodeModRegByte.call(this, X86.fnMOV);
+};
+
+/**
+ * op=0x8B (MOV reg,word)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVrw = function()
+{
+    this.decodeModRegWord.call(this, X86.fnMOV);
+};
+
+/**
+ * op=0x8C (MOV word,sreg)
+ *
+ * NOTE: Since the ModRM decoders deal only with general-purpose registers, we rely on our helper
+ * function (fnMOVwsr) to select the appropriate segment register and replace the decoder's src operand.
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVwsr = function()
+{
+    /*
+     * Like other MOV operations, the destination does not need to be read, just written.
+     */
+    this.opFlags |= X86.OPFLAG.NOREAD;
+    this.decodeModMemWord.call(this, X86.fnMOVwsr);
+};
+
+/**
+ * op=0x8D (LEA reg,word)
+ *
+ * @this {X86CPU}
+ */
+X86.opLEA = function()
+{
+    this.opFlags |= X86.OPFLAG.NOREAD;
+    this.segData = this.segStack = this.segNULL;    // we can't have the EA calculation, if any, "polluted" by segment arithmetic
+    this.decodeModRegWord.call(this, X86.fnLEA);
+};
+
+/**
+ * op=0x8E (MOV sreg,word)
+ *
+ * NOTE: Since the ModRM decoders deal only with general-purpose registers, we rely on our
+ * helper function (fnMOVsrw) to make a note of which general-purpose register will be overwritten,
+ * so that we can restore it after moving the updated value to the correct segment register.
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVsrw = function()
+{
+    var sel;
+    this.decodeModRegWord.call(this, X86.fnMOVsrw);
+    switch ((this.bModRM >> 3) & 0x7) {
+    case 0x0:
+        sel = this.regEAX;
+        this.regEAX = this.regXX;
+        this.setES(sel);
+        break;
+    case 0x1:
+        sel = this.regECX;
+        this.regECX = this.regXX;
+        this.setCS(sel);
+        break;
+    case 0x2:
+        sel = this.regEDX;
+        this.regEDX = this.regXX;
+        this.setSS(sel);
+        break;
+    case 0x3:
+        sel = this.regEBX;
+        this.regEBX = this.regXX;
+        this.setDS(sel);
+        break;
+    case 0x4:
+        sel = this.getSP();
+        this.setSP(this.regXX);
+        if (I386 && this.model >= X86.MODEL_80386) {
+            this.setFS(sel);
+        } else {
+            this.setES(sel);
+        }
+        break;
+    case 0x5:
+        sel = this.regEBP;
+        this.regEBP = this.regXX;
+        if (I386 && this.model >= X86.MODEL_80386) {
+            this.setGS(sel);
+        } else {
+            this.setCS(sel);
+        }
+        break;
+    case 0x6:
+        sel = this.regESI;
+        this.regESI = this.regXX;
+        this.setSS(sel);
+        break;
+    case 0x7:
+        sel = this.regEDI;
+        this.regEDI = this.regXX;
+        this.setDS(sel);
+        break;
+    }
+};
+
+/**
+ * op=0x8F (POP word)
+ *
+ * @this {X86CPU}
+ */
+X86.opPOPmw = function()
+{
+    /*
+     * Like other MOV operations, the destination does not need to be read, just written.
+     */
+    this.opFlags |= X86.OPFLAG.NOREAD;
+
+    /*
+     * If the word we're about to pop FROM the stack gets popped INTO a not-present page, this
+     * instruction will not be restartable unless we snapshot regLSP first.
+     */
+    this.opLSP = this.regLSP;
+
+    /*
+     * A "clever" instruction like this:
+     *
+     *      #0117:651C 67668F442408    POP      DWORD [ESP+08]
+     *
+     * pops the DWORD from the top of the stack and places it at ESP+08, where ESP is the value
+     * AFTER the pop, not before.  We used to (incorrectly) pass "popWord" as the fnSrc parameter
+     * below; we now pop the word first, saving it in regXX, and then pass "helpSRCxx" as fnSrc,
+     * which simply returns the contents of regXX.
+     *
+     * Also, in case you're wondering, fnPUSHw() (in aOpGrp4w) is the complement to this instruction,
+     * but it doesn't require a similar work-around, because a push from memory accesses that memory
+     * BEFORE the push, which occurs through our normal ModRM processing.
+     */
+    this.regXX = this.popWord();
+
+    this.decodeModGrpWord.call(this, X86.aOpGrpPOPw, X86.helpSRCxx);
+
+    this.opLSP = X86.ADDR_INVALID;
+};
+
+/**
+ * op=0x90 (NOP, aka XCHG AX,AX)
+ *
+ * @this {X86CPU}
+ */
+X86.opNOP = function()
+{
+    this.nStepCycles -= 3;                          // this form of XCHG takes 3 cycles on all CPUs
+};
+
+/**
+ * op=0x91 (XCHG AX,CX)
+ *
+ * @this {X86CPU}
+ */
+X86.opXCHGCX = function()
+{
+    var temp = this.regEAX;
+    this.regEAX = (I386? (this.regEAX & ~this.maskData) | (this.regECX & this.maskData) : this.regECX);
+    this.regECX = (I386? (this.regECX & ~this.maskData) | (temp & this.maskData) : temp);
+    if (BACKTRACK) {
+        temp = this.backTrack.btiAL; this.backTrack.btiAL = this.backTrack.btiCL; this.backTrack.btiCL = temp;
+        temp = this.backTrack.btiAH; this.backTrack.btiAH = this.backTrack.btiCH; this.backTrack.btiCH = temp;
+    }
+    this.nStepCycles -= 3;                          // this form of XCHG takes 3 cycles on all CPUs
+};
+
+/**
+ * op=0x92 (XCHG AX,DX)
+ *
+ * @this {X86CPU}
+ */
+X86.opXCHGDX = function()
+{
+    var temp = this.regEAX;
+    this.regEAX = (I386? (this.regEAX & ~this.maskData) | (this.regEDX & this.maskData) : this.regEDX);
+    this.regEDX = (I386? (this.regEDX & ~this.maskData) | (temp & this.maskData) : temp);
+    if (BACKTRACK) {
+        temp = this.backTrack.btiAL; this.backTrack.btiAL = this.backTrack.btiDL; this.backTrack.btiDL = temp;
+        temp = this.backTrack.btiAH; this.backTrack.btiAH = this.backTrack.btiDH; this.backTrack.btiDH = temp;
+    }
+    this.nStepCycles -= 3;                          // this form of XCHG takes 3 cycles on all CPUs
+};
+
+/**
+ * op=0x93 (XCHG AX,BX)
+ *
+ * @this {X86CPU}
+ */
+X86.opXCHGBX = function()
+{
+    var temp = this.regEAX;
+    this.regEAX = (I386? (this.regEAX & ~this.maskData) | (this.regEBX & this.maskData) : this.regEBX);
+    this.regEBX = (I386? (this.regEBX & ~this.maskData) | (temp & this.maskData) : temp);
+    if (BACKTRACK) {
+        temp = this.backTrack.btiAL; this.backTrack.btiAL = this.backTrack.btiBL; this.backTrack.btiBL = temp;
+        temp = this.backTrack.btiAH; this.backTrack.btiAH = this.backTrack.btiBH; this.backTrack.btiBH = temp;
+    }
+    this.nStepCycles -= 3;                          // this form of XCHG takes 3 cycles on all CPUs
+};
+
+/**
+ * op=0x94 (XCHG AX,SP)
+ *
+ * @this {X86CPU}
+ */
+X86.opXCHGSP = function()
+{
+    var temp = this.regEAX;
+    var regESP = this.getSP();
+    this.regEAX = (I386? (this.regEAX & ~this.maskData) | (regESP & this.maskData) : regESP);
+    this.setSP((I386? (regESP & ~this.maskData) | (temp & this.maskData) : temp));
+    if (BACKTRACK) this.backTrack.btiAL = this.backTrack.btiAH = 0;
+    this.nStepCycles -= 3;                          // this form of XCHG takes 3 cycles on all CPUs
+};
+
+/**
+ * op=0x95 (XCHG AX,BP)
+ *
+ * @this {X86CPU}
+ */
+X86.opXCHGBP = function()
+{
+    var temp = this.regEAX;
+    this.regEAX = (I386? (this.regEAX & ~this.maskData) | (this.regEBP & this.maskData) : this.regEBP);
+    this.regEBP = (I386? (this.regEBP & ~this.maskData) | (temp & this.maskData) : temp);
+    if (BACKTRACK) {
+        temp = this.backTrack.btiAL; this.backTrack.btiAL = this.backTrack.btiBPLo; this.backTrack.btiBPLo = temp;
+        temp = this.backTrack.btiAH; this.backTrack.btiAH = this.backTrack.btiBPHi; this.backTrack.btiBPHi = temp;
+    }
+    this.nStepCycles -= 3;                          // this form of XCHG takes 3 cycles on all CPUs
+};
+
+/**
+ * op=0x96 (XCHG AX,SI)
+ *
+ * @this {X86CPU}
+ */
+X86.opXCHGSI = function()
+{
+    var temp = this.regEAX;
+    this.regEAX = (I386? (this.regEAX & ~this.maskData) | (this.regESI & this.maskData) : this.regESI);
+    this.regESI = (I386? (this.regESI & ~this.maskData) | (temp & this.maskData) : temp);
+    if (BACKTRACK) {
+        temp = this.backTrack.btiAL; this.backTrack.btiAL = this.backTrack.btiSILo; this.backTrack.btiSILo = temp;
+        temp = this.backTrack.btiAH; this.backTrack.btiAH = this.backTrack.btiSIHi; this.backTrack.btiSIHi = temp;
+    }
+    this.nStepCycles -= 3;                          // this form of XCHG takes 3 cycles on all CPUs
+};
+
+/**
+ * op=0x97 (XCHG AX,DI)
+ *
+ * @this {X86CPU}
+ */
+X86.opXCHGDI = function()
+{
+    var temp = this.regEAX;
+    this.regEAX = (I386? (this.regEAX & ~this.maskData) | (this.regEDI & this.maskData) : this.regEDI);
+    this.regEDI = (I386? (this.regEDI & ~this.maskData) | (temp & this.maskData) : temp);
+    if (BACKTRACK) {
+        temp = this.backTrack.btiAL; this.backTrack.btiAL = this.backTrack.btiDILo; this.backTrack.btiDILo = temp;
+        temp = this.backTrack.btiAH; this.backTrack.btiAH = this.backTrack.btiDIHi; this.backTrack.btiDIHi = temp;
+    }
+    this.nStepCycles -= 3;                          // this form of XCHG takes 3 cycles on all CPUs
+};
+
+/**
+ * op=0x98 (CBW/CWDE)
+ *
+ * NOTE: The 16-bit form (CBW) sign-extends AL into AX, whereas the 32-bit form (CWDE) sign-extends AX into EAX;
+ * CWDE is similar to CWD, except that the destination is EAX rather than DX:AX.
+ *
+ * @this {X86CPU}
+ */
+X86.opCBW = function()
+{
+    if (this.sizeData == 2) {   // CBW
+        this.regEAX = (this.regEAX & ~0xffff) | (((this.regEAX << 24) >> 24) & 0xffff);
+        if (BACKTRACK) this.backTrack.btiAH = this.backTrack.btiAL;
+    }
+    else {                      // CWDE
+        this.regEAX = ((this.regEAX << 16) >> 16);
+    }
+    this.nStepCycles -= 2;                          // CBW takes 2 cycles on all CPUs through 80286
+};
+
+/**
+ * op=0x99 (CWD/CDQ)
+ *
+ * NOTE: The 16-bit form (CWD) sign-extends AX, producing a 32-bit result in DX:AX, while the 32-bit form (CDQ)
+ * sign-extends EAX, producing a 64-bit result in EDX:EAX.
+ *
+ * @this {X86CPU}
+ */
+X86.opCWD = function()
+{
+    if (this.sizeData == 2) {   // CWD
+        this.regEDX = (this.regEDX & ~0xffff) | ((this.regEAX & 0x8000)? 0xffff : 0);
+        if (BACKTRACK) this.backTrack.btiDL = this.backTrack.btiDH = this.backTrack.btiAH;
+    }
+    else {                      // CDQ
+        this.regEDX = (this.regEAX & (0x80000000|0))? -1 : 0;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesCWD;
+};
+
+/**
+ * op=0x9A (CALL seg:off)
+ *
+ * @this {X86CPU}
+ */
+X86.opCALLF = function()
+{
+    X86.helpCALLF.call(this, this.getIPWord(), this.getIPShort());
+    this.nStepCycles -= this.cycleCounts.nOpCyclesCallF;
+};
+
+/**
+ * op=0x9B (WAIT)
+ *
+ * @this {X86CPU}
+ */
+X86.opWAIT = function()
+{
+    if (!this.fpu || !this.fpu.opWAIT()) {
+        this.nStepCycles -= 3;     // X86FPU.opWAIT() is required to charge some number of cycles if it returns true
+    }
+};
+
+/**
+ * op=0x9C (PUSHF/PUSHFD)
+ *
+ * @this {X86CPU}
+ */
+X86.opPUSHF = function()
+{
+    /*
+     * TODO: Consider swapping out this function whenever setProtMode() changes the mode to V86-mode.
+     */
+    var regPS = this.getPS();
+    if (I386) {
+        if ((regPS & X86.PS.VM) && this.nIOPL < 3) {
+            if (DEBUG) this.printMessage("PUSHF in v86-mode (IOPL < 3)", this.bitsMessage, true);
+            X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0);
+            return;
+        }
+        /*
+         * It doesn't matter whether this is PUSHF or PUSHFD: the VM and RF flags are never pushed, so
+         * we should always clear them.  NOTE: This contradicts what the "INTEL 80386 PROGRAMMER'S REFERENCE
+         * MANUAL 1986" says on page 81 (which we assume is wrong):
+         *
+         *      SYSTEMS FLAGS (INCLUDING THE IOPL FIELD, AND THE VM, RF, AND IF FLAGS) ARE PUSHED AND ARE
+         *      VISIBLE TO APPLICATIONS PROGRAMS. HOWEVER, WHEN AN APPLICATIONS PROGRAM POPS THE FLAGS,
+         *      THESE ITEMS ARE NOT CHANGED, REGARDLESS OF THE VALUES POPPED INTO THEM.
+         *
+         * This does, however, beg the question: how does code running in V86-mode detect that's in V86-mode
+         * and not real-mode?  By using the SMSW instruction and checking the PE (protected-mode enabled) bit.
+         * The SMSW instruction returns a subset of the CR0 bits, and unlike the MOV reg,CR0 instruction, is
+         * allowed in V86-mode.  See fnSMSW() for more information.
+         */
+        regPS &= ~(X86.PS.VM | X86.PS.RF);
+    }
+    this.pushWord(regPS);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPushReg;
+};
+
+/**
+ * op=0x9D (POPF/POPFD)
+ *
+ * @this {X86CPU}
+ */
+X86.opPOPF = function()
+{
+    /*
+     * TODO: Consider swapping out this function whenever setProtMode() changes the mode to V86-mode.
+     */
+    if (I386 && (this.regPS & X86.PS.VM) && this.nIOPL < 3) {
+        if (DEBUG) this.printMessage("POPF in v86-mode (IOPL < 3)", this.bitsMessage, true);
+        X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0);
+        return;
+    }
+    /*
+     * Regardless of mode, VM and RF (the only defined EFLAGS bit above bit 15) are never changed by POPFD.
+     */
+    var newPS = this.popWord();
+    if (I386) newPS = (newPS & 0xffff) | (this.regPS & ~0xffff);
+    this.setPS(newPS);
+    /*
+     * NOTE: I'm assuming that neither POPF nor IRET are required to set NOINTR like STI does.
+     */
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPopReg;
+};
+
+/**
+ * op=0x9E (SAHF)
+ *
+ * @this {X86CPU}
+ */
+X86.opSAHF = function()
+{
+    /*
+     * NOTE: While it make seem more efficient to do this:
+     *
+     *      this.setPS((this.getPS() & ~X86.PS_SAHF) | ((this.regEAX >> 8) & X86.PS_SAHF));
+     *
+     * getPS() forces any "cached" flags to be resolved first, and setPS() must do extra work above
+     * and beyond setting the arithmetic and logical flags, so on balance, the code below may be more
+     * efficient, and may also avoid unexpected side-effects of updating the entire PS register.
+     */
+    var ah = (this.regEAX >> 8) & 0xff;
+    if (ah & X86.PS.CF) this.setCF(); else this.clearCF();
+    if (ah & X86.PS.PF) this.setPF(); else this.clearPF();
+    if (ah & X86.PS.AF) this.setAF(); else this.clearAF();
+    if (ah & X86.PS.ZF) this.setZF(); else this.clearZF();
+    if (ah & X86.PS.SF) this.setSF(); else this.clearSF();
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLAHF;
+
+};
+
+/**
+ * op=0x9F (LAHF)
+ *
+ * @this {X86CPU}
+ */
+X86.opLAHF = function()
+{
+    this.regEAX = (this.regEAX & ~0xff00) | (this.getPS() & X86.PS_SAHF) << 8;
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLAHF;
+};
+
+/**
+ * op=0xA0 (MOV AL,mem)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVALm = function()
+{
+    this.regEAX = (this.regEAX & ~0xff) | this.getSOByte(this.segData, this.getIPAddr());
+    if (BACKTRACK) this.backTrack.btiAL = this.backTrack.btiMem0;
+    this.nStepCycles -= this.cycleCounts.nOpCyclesMovAM;
+};
+
+/**
+ * op=0xA1 (MOV [E]AX,mem)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVAXm = function()
+{
+    this.regEAX = (this.regEAX & ~this.maskData) | this.getSOWord(this.segData, this.getIPAddr());
+    if (BACKTRACK) {
+        this.backTrack.btiAL = this.backTrack.btiMem0; this.backTrack.btiAH = this.backTrack.btiMem1;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesMovAM;
+};
+
+/**
+ * op=0xA2 (MOV mem,AL)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVmAL = function()
+{
+    if (BACKTRACK) this.backTrack.btiMem0 = this.backTrack.btiAL;
+    /*
+     * setSOByte() truncates the value as appropriate
+     */
+    this.setSOByte(this.segData, this.getIPAddr(), this.regEAX);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesMovMA;
+};
+
+/**
+ * op=0xA3 (MOV mem,AX)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVmAX = function()
+{
+    if (BACKTRACK) {
+        this.backTrack.btiMem0 = this.backTrack.btiAL; this.backTrack.btiMem1 = this.backTrack.btiAH;
+    }
+    /*
+     * setSOWord() truncates the value as appropriate
+     */
+    this.setSOWord(this.segData, this.getIPAddr(), this.regEAX);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesMovMA;
+};
+
+/**
+ * op=0xA4 (MOVSB)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVSb = function()
+{
+    var nReps = 1;
+    var nDelta = 0;
+    var maskAddr = this.maskAddr;
+
+    var nCycles = this.cycleCounts.nOpCyclesMovS;
+    if (this.opPrefixes & (X86.OPFLAG.REPZ | X86.OPFLAG.REPNZ)) {
+        nReps = this.regECX & maskAddr;
+        nDelta = 1;
+        nCycles = this.cycleCounts.nOpCyclesMovSrn;
+        if (!(this.opPrefixes & X86.OPFLAG.REPEAT)) this.nStepCycles -= this.cycleCounts.nOpCyclesMovSr0;
+    }
+    if (nReps--) {
+        this.setSOByte(this.segES, this.regEDI & maskAddr, this.getSOByte(this.segData, this.regESI & maskAddr));
+        /*
+         * helpFault() throws exceptions now, so inline checks of X86.OPFLAG.FAULT should no longer be necessary.
+         *
+         *      if (this.opFlags & X86.OPFLAG.FAULT) return;
+         */
+        var nInc = ((this.regPS & X86.PS.DF)? -1 : 1);
+        this.regESI = (this.regESI & ~maskAddr) | ((this.regESI + nInc) & maskAddr);
+        this.regEDI = (this.regEDI & ~maskAddr) | ((this.regEDI + nInc) & maskAddr);
+        this.nStepCycles -= nCycles;
+        this.regECX = (this.regECX & ~maskAddr) | ((this.regECX - nDelta) & maskAddr);
+        if (nReps) {
+            this.resetIP(((this.opPrefixes & X86.OPFLAG.SEG)? -3 : -2));
+            this.opFlags |= X86.OPFLAG.REPEAT;
+        }
+    }
+};
+
+/**
+ * op=0xA5 (MOVSW)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVSw = function()
+{
+    var nReps = 1;
+    var nDelta = 0;
+    var maskAddr = this.maskAddr;
+
+    var nCycles = this.cycleCounts.nOpCyclesMovS;
+    if (this.opPrefixes & (X86.OPFLAG.REPZ | X86.OPFLAG.REPNZ)) {
+        nReps = this.regECX & maskAddr;
+        nDelta = 1;
+        nCycles = this.cycleCounts.nOpCyclesMovSrn;
+        if (!(this.opPrefixes & X86.OPFLAG.REPEAT)) this.nStepCycles -= this.cycleCounts.nOpCyclesMovSr0;
+    }
+    if (nReps--) {
+        this.setSOWord(this.segES, this.regEDI & maskAddr, this.getSOWord(this.segData, this.regESI & maskAddr));
+        /*
+         * helpFault() throws exceptions now, so inline checks of X86.OPFLAG.FAULT should no longer be necessary.
+         *
+         *      if (this.opFlags & X86.OPFLAG.FAULT) return;
+         */
+        var nInc = ((this.regPS & X86.PS.DF)? -this.sizeData : this.sizeData);
+        this.regESI = (this.regESI & ~maskAddr) | ((this.regESI + nInc) & maskAddr);
+        this.regEDI = (this.regEDI & ~maskAddr) | ((this.regEDI + nInc) & maskAddr);
+        this.nStepCycles -= nCycles;
+        this.regECX = (this.regECX & ~maskAddr) | ((this.regECX - nDelta) & maskAddr);
+        if (nReps) {
+            this.resetIP(((this.opPrefixes & X86.OPFLAG.SEG)? -3 : -2));
+            this.opFlags |= X86.OPFLAG.REPEAT;
+        }
+    }
+};
+
+/**
+ * op=0xA6 (CMPSB)
+ *
+ * @this {X86CPU}
+ */
+X86.opCMPSb = function()
+{
+    var nReps = 1;
+    var nDelta = 0;
+    var maskAddr = this.maskAddr;
+
+    var nCycles = this.cycleCounts.nOpCyclesCmpS;
+    if (this.opPrefixes & (X86.OPFLAG.REPZ | X86.OPFLAG.REPNZ)) {
+        nReps = this.regECX & maskAddr;
+        nDelta = 1;
+        nCycles = this.cycleCounts.nOpCyclesCmpSrn;
+        if (!(this.opPrefixes & X86.OPFLAG.REPEAT)) this.nStepCycles -= this.cycleCounts.nOpCyclesCmpSr0;
+    }
+    if (nReps--) {
+        var bDst = this.getEAByte(this.segData, this.regESI);
+        var bSrc = this.getEAByte(this.segES, this.regEDI);
+        this.regEAWrite = this.regEA;           // TODO: Is this necessary?
+        /*
+         * helpFault() throws exceptions now, so inline checks of X86.OPFLAG.FAULT should no longer be necessary.
+         *
+         *      if (this.opFlags & X86.OPFLAG.FAULT) return;
+         */
+        X86.fnCMPb.call(this, bDst, bSrc);
+        var nInc = ((this.regPS & X86.PS.DF)? -1 : 1);
+        this.regESI = (this.regESI & ~maskAddr) | ((this.regESI + nInc) & maskAddr);
+        this.regEDI = (this.regEDI & ~maskAddr) | ((this.regEDI + nInc) & maskAddr);
+        this.regECX = (this.regECX & ~maskAddr) | ((this.regECX - nDelta) & maskAddr);
+        /*
+         * NOTE: As long as we're calling fnCMPb(), all our cycle times must be reduced by nOpCyclesArithRM
+         */
+        this.nStepCycles -= nCycles - this.cycleCounts.nOpCyclesArithRM;
+        /*
+         * Repetition continues while ZF matches bit 0 of the REP prefix.  getZF() returns 0x40 if ZF is
+         * set, and OP_REPZ (which represents the REP prefix whose bit 0 is set) is 0x40 as well, so when those
+         * two values are equal, we must continue.
+         */
+        if (nReps && this.getZF() == (this.opPrefixes & X86.OPFLAG.REPZ)) {
+            this.resetIP(((this.opPrefixes & X86.OPFLAG.SEG)? -3 : -2));
+            this.opFlags |= X86.OPFLAG.REPEAT;
+        }
+    }
+};
+
+/**
+ * op=0xA7 (CMPSW)
+ *
+ * @this {X86CPU}
+ */
+X86.opCMPSw = function()
+{
+    var nReps = 1;
+    var nDelta = 0;
+    var maskAddr = this.maskAddr;
+
+    var nCycles = this.cycleCounts.nOpCyclesCmpS;
+    if (this.opPrefixes & (X86.OPFLAG.REPZ | X86.OPFLAG.REPNZ)) {
+        nReps = this.regECX & maskAddr;
+        nDelta = 1;
+        nCycles = this.cycleCounts.nOpCyclesCmpSrn;
+        if (!(this.opPrefixes & X86.OPFLAG.REPEAT)) this.nStepCycles -= this.cycleCounts.nOpCyclesCmpSr0;
+    }
+    if (nReps--) {
+        var wDst = this.getEAWord(this.segData, this.regESI & maskAddr);
+        var wSrc = this.getEAWord(this.segES, this.regEDI & maskAddr);
+        this.regEAWrite = this.regEA;           // TODO: Is this necessary?
+        /*
+         * helpFault() throws exceptions now, so inline checks of X86.OPFLAG.FAULT should no longer be necessary.
+         *
+         *      if (this.opFlags & X86.OPFLAG.FAULT) return;
+         */
+        X86.fnCMPw.call(this, wDst, wSrc);
+        var nInc = ((this.regPS & X86.PS.DF)? -this.sizeData : this.sizeData);
+        this.regESI = (this.regESI & ~maskAddr) | ((this.regESI + nInc) & maskAddr);
+        this.regEDI = (this.regEDI & ~maskAddr) | ((this.regEDI + nInc) & maskAddr);
+        this.regECX = (this.regECX & ~maskAddr) | ((this.regECX - nDelta) & maskAddr);
+        /*
+         * NOTE: As long as we're calling fnCMPw(), all our cycle times must be reduced by nOpCyclesArithRM
+         */
+        this.nStepCycles -= nCycles - this.cycleCounts.nOpCyclesArithRM;
+        /*
+         * Repetition continues while ZF matches bit 0 of the REP prefix.  getZF() returns 0x40 if ZF is
+         * set, and OP_REPZ (which represents the REP prefix whose bit 0 is set) is 0x40 as well, so when those
+         * two values are equal, we must continue.
+         */
+        if (nReps && this.getZF() == (this.opPrefixes & X86.OPFLAG.REPZ)) {
+            this.resetIP(((this.opPrefixes & X86.OPFLAG.SEG)? -3 : -2));
+            this.opFlags |= X86.OPFLAG.REPEAT;
+        }
+    }
+};
+
+/**
+ * op=0xA8 (TEST AL,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opTESTALb = function()
+{
+    this.setLogicResult(this.regEAX & this.getIPByte(), X86.RESULT.BYTE);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesAAA;
+};
+
+/**
+ * op=0xA9 (TEST [E]AX,imm)
+ *
+ * @this {X86CPU}
+ */
+X86.opTESTAX = function()
+{
+    this.setLogicResult(this.regEAX & this.getIPWord(), this.typeData);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesAAA;
+};
+
+/**
+ * op=0xAA (STOSB)
+ *
+ * NOTES: Segment overrides are ignored for this instruction, so we must use segES instead of segData.
+ *
+ * @this {X86CPU}
+ */
+X86.opSTOSb = function()
+{
+    var nReps = 1;
+    var nDelta = 0;
+    var maskAddr = this.maskAddr;
+
+    var nCycles = this.cycleCounts.nOpCyclesStoS;
+    if (this.opPrefixes & (X86.OPFLAG.REPZ | X86.OPFLAG.REPNZ)) {
+        nReps = this.regECX & maskAddr;
+        nDelta = 1;
+        nCycles = this.cycleCounts.nOpCyclesStoSrn;
+        if (!(this.opPrefixes & X86.OPFLAG.REPEAT)) this.nStepCycles -= this.cycleCounts.nOpCyclesStoSr0;
+    }
+    if (nReps--) {
+        this.setSOByte(this.segES, this.regEDI & maskAddr, this.regEAX);
+        /*
+         * helpFault() throws exceptions now, so inline checks of X86.OPFLAG.FAULT should no longer be necessary.
+         *
+         *      if (this.opFlags & X86.OPFLAG.FAULT) return;
+         */
+        if (BACKTRACK) this.backTrack.btiMem0 = this.backTrack.btiAL;
+
+        this.regECX = (this.regECX & ~maskAddr) | ((this.regECX - nDelta) & maskAddr);
+
+        /*
+         * Implement 80386 B1 Errata #7 (to the extent that Windows 95 checks for the errata).  This
+         * isn't a rock-solid implementation of the errata (for example, the ADDRESS override on the next
+         * instruction, if it exists, may or may not be the first prefix byte), but it's close enough.
+         *
+         * Note that we carefully alter with maskAddr only AFTER updating ECX, because this errata affects
+         * only EDI in the case of STOS.  The other instructions mentioned below trash different registers,
+         * so read the errata carefully.
+         *
+         * TODO: Extend this errata to STOSW, as well as MOVSB, MOVSW, INSB, and INSW.  Also, verify the
+         * extent to which this errata existed on earlier 80386 steppings (I'm currently assuming A0-B1).
+         */
+        if (this.stepping >= X86.STEPPING_80386_A0 && this.stepping <= X86.STEPPING_80386_B2) {
+            if (!(this.opPrefixes & X86.OPFLAG.ADDRSIZE) != (this.getByte(this.regLIP) != X86.OPCODE.AS)) {
+                maskAddr ^= (0xffff0000|0);
+            }
+        }
+        this.regEDI = (this.regEDI & ~maskAddr) | ((this.regEDI + ((this.regPS & X86.PS.DF)? -1 : 1)) & maskAddr);
+
+        this.nStepCycles -= nCycles;
+        if (nReps) {
+            this.resetIP(-2);
+            this.opFlags |= X86.OPFLAG.REPEAT;
+        }
+    }
+};
+
+/**
+ * op=0xAB (STOSW)
+ *
+ * NOTES: Segment overrides are ignored for this instruction, so we must use segES instead of segData.
+ *
+ * @this {X86CPU}
+ */
+X86.opSTOSw = function()
+{
+    var nReps = 1;
+    var nDelta = 0;
+    var maskAddr = this.maskAddr;
+
+    var nCycles = this.cycleCounts.nOpCyclesStoS;
+    if (this.opPrefixes & (X86.OPFLAG.REPZ | X86.OPFLAG.REPNZ)) {
+        nReps = this.regECX & maskAddr;
+        nDelta = 1;
+        nCycles = this.cycleCounts.nOpCyclesStoSrn;
+        if (!(this.opPrefixes & X86.OPFLAG.REPEAT)) this.nStepCycles -= this.cycleCounts.nOpCyclesStoSr0;
+    }
+    if (nReps--) {
+        this.setSOWord(this.segES, this.regEDI & maskAddr, this.regEAX);
+        /*
+         * helpFault() throws exceptions now, so inline checks of X86.OPFLAG.FAULT should no longer be necessary.
+         *
+         *      if (this.opFlags & X86.OPFLAG.FAULT) return;
+         */
+        if (BACKTRACK) {
+            this.backTrack.btiMem0 = this.backTrack.btiAL; this.backTrack.btiMem1 = this.backTrack.btiAH;
+        }
+        this.regEDI = (this.regEDI & ~maskAddr) | ((this.regEDI + ((this.regPS & X86.PS.DF)? -this.sizeData : this.sizeData)) & maskAddr);
+        this.regECX = (this.regECX & ~maskAddr) | ((this.regECX - nDelta) & maskAddr);
+        this.nStepCycles -= nCycles;
+        if (nReps) {
+            this.resetIP(-2);
+            this.opFlags |= X86.OPFLAG.REPEAT;
+        }
+    }
+};
+
+/**
+ * op=0xAC (LODSB)
+ *
+ * @this {X86CPU}
+ */
+X86.opLODSb = function()
+{
+    var nReps = 1;
+    var nDelta = 0;
+    var maskAddr = this.maskAddr;
+
+    var nCycles = this.cycleCounts.nOpCyclesLodS;
+    if (this.opPrefixes & (X86.OPFLAG.REPZ | X86.OPFLAG.REPNZ)) {
+        nReps = this.regECX & maskAddr;
+        nDelta = 1;
+        nCycles = this.cycleCounts.nOpCyclesLodSrn;
+        if (!(this.opPrefixes & X86.OPFLAG.REPEAT)) this.nStepCycles -= this.cycleCounts.nOpCyclesLodSr0;
+    }
+    if (nReps--) {
+        var b = this.getSOByte(this.segData, this.regESI & maskAddr);
+        /*
+         * helpFault() throws exceptions now, so inline checks of X86.OPFLAG.FAULT should no longer be necessary.
+         *
+         *      if (this.opFlags & X86.OPFLAG.FAULT) return;
+         */
+        this.regEAX = (this.regEAX & ~0xff) | b;
+        if (BACKTRACK) this.backTrack.btiAL = this.backTrack.btiMem0;
+        this.regESI = (this.regESI & ~maskAddr) | ((this.regESI + ((this.regPS & X86.PS.DF)? -1 : 1)) & maskAddr);
+        this.regECX = (this.regECX & ~maskAddr) | ((this.regECX - nDelta) & maskAddr);
+        this.nStepCycles -= nCycles;
+        if (nReps) {
+            this.resetIP(((this.opPrefixes & X86.OPFLAG.SEG)? -3 : -2));
+            this.opFlags |= X86.OPFLAG.REPEAT;
+        }
+    }
+};
+
+/**
+ * op=0xAD (LODSW)
+ *
+ * @this {X86CPU}
+ */
+X86.opLODSw = function()
+{
+    var nReps = 1;
+    var nDelta = 0;
+    var maskAddr = this.maskAddr;
+
+    var nCycles = this.cycleCounts.nOpCyclesLodS;
+    if (this.opPrefixes & (X86.OPFLAG.REPZ | X86.OPFLAG.REPNZ)) {
+        nReps = this.regECX & maskAddr;
+        nDelta = 1;
+        nCycles = this.cycleCounts.nOpCyclesLodSrn;
+        if (!(this.opPrefixes & X86.OPFLAG.REPEAT)) this.nStepCycles -= this.cycleCounts.nOpCyclesLodSr0;
+    }
+    if (nReps--) {
+        var w = this.getSOWord(this.segData, this.regESI & maskAddr);
+        /*
+         * helpFault() throws exceptions now, so inline checks of X86.OPFLAG.FAULT should no longer be necessary.
+         *
+         *      if (this.opFlags & X86.OPFLAG.FAULT) return;
+         */
+        this.regEAX = (this.regEAX & ~this.maskData) | w;
+        if (BACKTRACK) {
+            this.backTrack.btiAL = this.backTrack.btiMem0; this.backTrack.btiAH = this.backTrack.btiMem1;
+        }
+        this.regESI = (this.regESI & ~maskAddr) | ((this.regESI + ((this.regPS & X86.PS.DF)? -this.sizeData : this.sizeData)) & maskAddr);
+        this.regECX = (this.regECX & ~maskAddr) | ((this.regECX - nDelta) & maskAddr);
+        this.nStepCycles -= nCycles;
+        if (nReps) {
+            this.resetIP(((this.opPrefixes & X86.OPFLAG.SEG)? -3 : -2));
+            this.opFlags |= X86.OPFLAG.REPEAT;
+        }
+    }
+};
+
+/**
+ * op=0xAE (SCASB)
+ *
+ * @this {X86CPU}
+ */
+X86.opSCASb = function()
+{
+    var nReps = 1;
+    var nDelta = 0;
+    var maskAddr = this.maskAddr;
+
+    var nCycles = this.cycleCounts.nOpCyclesScaS;
+    if (this.opPrefixes & (X86.OPFLAG.REPZ | X86.OPFLAG.REPNZ)) {
+        nReps = this.regECX & maskAddr;
+        nDelta = 1;
+        nCycles = this.cycleCounts.nOpCyclesScaSrn;
+        if (!(this.opPrefixes & X86.OPFLAG.REPEAT)) this.nStepCycles -= this.cycleCounts.nOpCyclesScaSr0;
+    }
+    if (nReps--) {
+        var bDst = this.regEAX & 0xff;
+        var bSrc = this.getEAByte(this.segES, this.regEDI);
+        this.regEAWrite = this.regEA;           // TODO: Is this necessary?
+        X86.fnCMPb.call(this, bDst, bSrc);
+        /*
+         * helpFault() throws exceptions now, so inline checks of X86.OPFLAG.FAULT should no longer be necessary.
+         *
+         *      if (this.opFlags & X86.OPFLAG.FAULT) return;
+         */
+        this.regEDI = (this.regEDI & ~maskAddr) | ((this.regEDI + ((this.regPS & X86.PS.DF)? -1 : 1)) & maskAddr);
+        this.regECX = (this.regECX & ~maskAddr) | ((this.regECX - nDelta) & maskAddr);
+        /*
+         * NOTE: As long as we're calling fnCMPb(), all our cycle times must be reduced by nOpCyclesArithRM
+         */
+        this.nStepCycles -= nCycles - this.cycleCounts.nOpCyclesArithRM;
+        /*
+         * Repetition continues while ZF matches bit 0 of the REP prefix.  getZF() returns 0x40 if ZF is
+         * set, and OP_REPZ (which represents the REP prefix whose bit 0 is set) is 0x40 as well, so when those
+         * two values are equal, we must continue.
+         */
+        if (nReps && this.getZF() == (this.opPrefixes & X86.OPFLAG.REPZ)) {
+            this.resetIP(-2);
+            this.opFlags |= X86.OPFLAG.REPEAT;
+        }
+    }
+};
+
+/**
+ * op=0xAF (SCASW)
+ *
+ * @this {X86CPU}
+ */
+X86.opSCASw = function()
+{
+    var nReps = 1;
+    var nDelta = 0;
+    var maskAddr = this.maskAddr;
+
+    var nCycles = this.cycleCounts.nOpCyclesScaS;
+    if (this.opPrefixes & (X86.OPFLAG.REPZ | X86.OPFLAG.REPNZ)) {
+        nReps = this.regECX & maskAddr;
+        nDelta = 1;
+        nCycles = this.cycleCounts.nOpCyclesScaSrn;
+        if (!(this.opPrefixes & X86.OPFLAG.REPEAT)) this.nStepCycles -= this.cycleCounts.nOpCyclesScaSr0;
+    }
+    if (nReps--) {
+        var wDst = this.regEAX & this.maskData;
+        var wSrc = this.getEAWord(this.segES, this.regEDI & maskAddr);
+        this.regEAWrite = this.regEA;           // TODO: Is this necessary?
+        X86.fnCMPw.call(this, wDst, wSrc);
+        /*
+         * helpFault() throws exceptions now, so inline checks of X86.OPFLAG.FAULT should no longer be necessary.
+         *
+         *      if (this.opFlags & X86.OPFLAG.FAULT) return;
+         */
+        this.regEDI = (this.regEDI & ~maskAddr) | ((this.regEDI + ((this.regPS & X86.PS.DF)? -this.sizeData : this.sizeData)) & maskAddr);
+        this.regECX = (this.regECX & ~maskAddr) | ((this.regECX - nDelta) & maskAddr);
+        /*
+         * NOTE: As long as we're calling fnCMPw(), all our cycle times must be reduced by nOpCyclesArithRM
+         */
+        this.nStepCycles -= nCycles - this.cycleCounts.nOpCyclesArithRM;
+        /*
+         * Repetition continues while ZF matches bit 0 of the REP prefix.  getZF() returns 0x40 if ZF is
+         * set, and OP_REPZ (which represents the REP prefix whose bit 0 is set) is 0x40 as well, so when those
+         * two values are equal, we must continue.
+         */
+        if (nReps && this.getZF() == (this.opPrefixes & X86.OPFLAG.REPZ)) {
+            this.resetIP(-2);
+            this.opFlags |= X86.OPFLAG.REPEAT;
+        }
+    }
+};
+
+/**
+ * op=0xB0 (MOV AL,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVALb = function()
+{
+    this.regEAX = (this.regEAX & ~0xff) | this.getIPByte();
+    if (BACKTRACK) this.backTrack.btiAL = this.backTrack.btiMem0;
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLAHF;
+};
+
+/**
+ * op=0xB1 (MOV CL,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVCLb = function()
+{
+    this.regECX = (this.regECX & ~0xff) | this.getIPByte();
+    if (BACKTRACK) this.backTrack.btiCL = this.backTrack.btiMem0;
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLAHF;
+};
+
+/**
+ * op=0xB2 (MOV DL,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVDLb = function()
+{
+    this.regEDX = (this.regEDX & ~0xff) | this.getIPByte();
+    if (BACKTRACK) this.backTrack.btiDL = this.backTrack.btiMem0;
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLAHF;
+};
+
+/**
+ * op=0xB3 (MOV BL,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVBLb = function()
+{
+    this.regEBX = (this.regEBX & ~0xff) | this.getIPByte();
+    if (BACKTRACK) this.backTrack.btiBL = this.backTrack.btiMem0;
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLAHF;
+};
+
+/**
+ * op=0xB4 (MOV AH,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVAHb = function()
+{
+    this.regEAX = (this.regEAX & ~0xff00) | (this.getIPByte() << 8);
+    if (BACKTRACK) this.backTrack.btiAH = this.backTrack.btiMem0;
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLAHF;
+};
+
+/**
+ * op=0xB5 (MOV CH,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVCHb = function()
+{
+    this.regECX = (this.regECX & ~0xff00) | (this.getIPByte() << 8);
+    if (BACKTRACK) this.backTrack.btiCH = this.backTrack.btiMem0;
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLAHF;
+};
+
+/**
+ * op=0xB6 (MOV DH,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVDHb = function()
+{
+    this.regEDX = (this.regEDX & ~0xff00) | (this.getIPByte() << 8);
+    if (BACKTRACK) this.backTrack.btiDH = this.backTrack.btiMem0;
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLAHF;
+};
+
+/**
+ * op=0xB7 (MOV BH,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVBHb = function()
+{
+    this.regEBX = (this.regEBX & ~0xff00) | (this.getIPByte() << 8);
+    if (BACKTRACK) this.backTrack.btiBH = this.backTrack.btiMem0;
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLAHF;
+};
+
+/**
+ * op=0xB8 (MOV [E]AX,imm)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVAX = function()
+{
+    this.regEAX = (this.regEAX & ~this.maskData) | this.getIPWord();
+    if (BACKTRACK) {
+        this.backTrack.btiAL = this.backTrack.btiMem0; this.backTrack.btiAH = this.backTrack.btiMem1;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLAHF;
+};
+
+/**
+ * op=0xB9 (MOV [E]CX,imm)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVCX = function()
+{
+    this.regECX = (this.regECX & ~this.maskData) | this.getIPWord();
+    if (BACKTRACK) {
+        this.backTrack.btiCL = this.backTrack.btiMem0; this.backTrack.btiCH = this.backTrack.btiMem1;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLAHF;
+};
+
+/**
+ * op=0xBA (MOV [E]DX,imm)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVDX = function()
+{
+    this.regEDX = (this.regEDX & ~this.maskData) | this.getIPWord();
+    if (BACKTRACK) {
+        this.backTrack.btiDL = this.backTrack.btiMem0; this.backTrack.btiDH = this.backTrack.btiMem1;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLAHF;
+};
+
+/**
+ * op=0xBB (MOV [E]BX,imm)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVBX = function()
+{
+    this.regEBX = (this.regEBX & ~this.maskData) | this.getIPWord();
+    if (BACKTRACK) {
+        this.backTrack.btiBL = this.backTrack.btiMem0; this.backTrack.btiBH = this.backTrack.btiMem1;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLAHF;
+};
+
+/**
+ * op=0xBC (MOV [E]SP,imm)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVSP = function()
+{
+    this.setSP((this.getSP() & ~this.maskData) | this.getIPWord());
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLAHF;
+};
+
+/**
+ * op=0xBD (MOV [E]BP,imm)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVBP = function()
+{
+    this.regEBP = (this.regEBP & ~this.maskData) | this.getIPWord();
+    if (BACKTRACK) {
+        this.backTrack.btiBPLo = this.backTrack.btiMem0; this.backTrack.btiBPHi = this.backTrack.btiMem1;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLAHF;
+};
+
+/**
+ * op=0xBE (MOV [E]SI,imm)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVSI = function()
+{
+    this.regESI = (this.regESI & ~this.maskData) | this.getIPWord();
+    if (BACKTRACK) {
+        this.backTrack.btiSILo = this.backTrack.btiMem0; this.backTrack.btiSIHi = this.backTrack.btiMem1;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLAHF;
+};
+
+/**
+ * op=0xBF (MOV [E]DI,imm)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVDI = function()
+{
+    this.regEDI = (this.regEDI & ~this.maskData) | this.getIPWord();
+    if (BACKTRACK) {
+        this.backTrack.btiDILo = this.backTrack.btiMem0; this.backTrack.btiDIHi = this.backTrack.btiMem1;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLAHF;
+};
+
+/**
+ * op=0xC0 (GRP2 byte,imm8) (80186/80188 and up)
+ *
+ * @this {X86CPU}
+ */
+X86.opGRP2bn = function()
+{
+    this.decodeModGrpByte.call(this, X86.aOpGrp2b, X86.helpSRCByte);
+};
+
+/**
+ * op=0xC1 (GRP2 word,imm) (80186/80188 and up)
+ *
+ * @this {X86CPU}
+ */
+X86.opGRP2wn = function()
+{
+    this.decodeModGrpWord.call(this, this.sizeData == 2? X86.aOpGrp2w : X86.aOpGrp2d, X86.helpSRCByte);
+};
+
+/**
+ * op=0xC2 (RET n)
+ *
+ * @this {X86CPU}
+ */
+X86.opRETn = function()
+{
+    var n = this.getIPShort();
+    var newIP = this.popWord();
+    this.setIP(newIP);
+    if (n) this.setSP(this.getSP() + n);            // TODO: optimize
+    this.nStepCycles -= this.cycleCounts.nOpCyclesRetn;
+};
+
+/**
+ * op=0xC3 (RET)
+ *
+ * @this {X86CPU}
+ */
+X86.opRET = function()
+{
+    var newIP = this.popWord();
+    this.setIP(newIP);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesRet;
+};
+
+/**
+ * op=0xC4 (LES reg,word)
+ *
+ * This is like a "MOV reg,rm" operation, but it also loads ES from the next word.
+ *
+ * @this {X86CPU}
+ */
+X86.opLES = function()
+{
+    this.decodeModRegWord.call(this, X86.fnLES);
+};
+
+/**
+ * op=0xC5 (LDS reg,word)
+ *
+ * This is like a "MOV reg,rm" operation, but it also loads DS from the next word.
+ *
+ * @this {X86CPU}
+ */
+X86.opLDS = function()
+{
+    this.decodeModRegWord.call(this, X86.fnLDS);
+};
+
+/**
+ * op=0xC6 (MOV byte,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVb = function()
+{
+    /*
+     * Like other MOV operations, the destination does not need to be read, just written.
+     */
+    this.opFlags |= X86.OPFLAG.NOREAD;
+    this.decodeModGrpByte.call(this, X86.aOpGrpMOVn, this.getIPByte);
+};
+
+/**
+ * op=0xC7 (MOV word,imm)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVw = function()
+{
+    /*
+     * Like other MOV operations, the destination does not need to be read, just written.
+     */
+    this.opFlags |= X86.OPFLAG.NOREAD;
+    this.decodeModGrpWord.call(this, X86.aOpGrpMOVn, this.getIPWord);
+};
+
+/**
+ * op=0xC8 (ENTER imm16,imm8) (80186/80188 and up)
+ *
+ * @this {X86CPU}
+ */
+X86.opENTER = function()
+{
+    /*
+     * Any operation that performs multiple stack modifications must snapshot regLSP first.
+     */
+    this.opLSP = this.regLSP;
+
+    var wLocal = this.getIPShort();
+    var bLevel = this.getIPByte() & 0x1f;
+    /*
+     * NOTE: 11 is the minimum cycle time for the 80286; the 80186/80188 has different cycle times: 15, 25 and
+     * 22 + 16 * (bLevel - 1) for bLevel 0, 1 and > 1, respectively.  TODO: Fix this someday.
+     */
+    this.nStepCycles -= 11;
+    this.pushWord(this.regEBP);
+    var wFrame = this.getSP() & this.maskData;
+    if (bLevel > 0) {
+        this.nStepCycles -= (bLevel << 2) + (bLevel > 1? 1 : 0);
+        while (--bLevel) {
+            this.regEBP = (this.regEBP & ~this.maskData) | ((this.regEBP - this.sizeData) & this.maskData);
+            this.pushWord(this.getSOWord(this.segSS, this.regEBP & this.maskData));
+        }
+        this.pushWord(wFrame);
+    }
+    this.regEBP = (this.regEBP & ~this.maskData) | wFrame;
+    this.setSP((this.getSP() & ~this.segSS.maskAddr) | ((this.getSP() - wLocal) & this.segSS.maskAddr));
+
+    this.opLSP = X86.ADDR_INVALID;
+};
+
+/**
+ * op=0xC9 (LEAVE) (80186/80188 and up)
+ *
+ * @this {X86CPU}
+ */
+X86.opLEAVE = function()
+{
+    /*
+     * Any operation that performs multiple stack modifications must snapshot regLSP first.
+     */
+    this.opLSP = this.regLSP;
+
+    this.setSP((this.getSP() & ~this.segSS.maskAddr) | (this.regEBP & this.segSS.maskAddr));
+
+    this.regEBP = (this.regEBP & ~this.maskData) | (this.popWord() & this.maskData);
+    /*
+     * NOTE: 5 is the cycle time for the 80286; the 80186/80188 has a cycle time of 8.  TODO: Fix this someday.
+     */
+    this.nStepCycles -= 5;
+
+    this.opLSP = X86.ADDR_INVALID;
+};
+
+/**
+ * op=0xCA (RETF n)
+ *
+ * @this {X86CPU}
+ */
+X86.opRETFn = function()
+{
+    X86.helpRETF.call(this, this.getIPShort());
+    this.nStepCycles -= this.cycleCounts.nOpCyclesRetFn;
+};
+
+/**
+ * op=0xCB (RETF)
+ *
+ * @this {X86CPU}
+ */
+X86.opRETF = function()
+{
+    X86.helpRETF.call(this, 0);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesRetF;
+};
+
+/**
+ * op=0xCC (INT 3)
+ *
+ * @this {X86CPU}
+ */
+X86.opINT3 = function()
+{
+    /*
+     * TODO: Consider swapping out this function whenever setProtMode() changes the mode to V86-mode.
+     */
+    if (I386 && (this.regPS & X86.PS.VM) && this.nIOPL < 3) {
+        if (DEBUG) this.printMessage("INT 0x03 in v86-mode (IOPL < 3)", this.bitsMessage, true);
+        X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0);
+        return;
+    }
+    /*
+     * Because INT3 is a trap, not a fault, we must use helpTrap() rather than helpFault().  Unfortunately, that
+     * means you can't rely on the Debugger logic instead helpFault() to conditionally stop execution on an INT3,
+     * so I've changed the Debugger's checkBreakpoint() function to stop execution on INT3 whenever both the
+     * INT and HALT message bits are set; a simple "g" command allows you to continue.
+     */
+    X86.helpTrap.call(this, X86.EXCEPTION.BP_TRAP, this.cycleCounts.nOpCyclesInt3D);
+};
+
+/**
+ * op=0xCD (INT n)
+ *
+ * @this {X86CPU}
+ */
+X86.opINTn = function()
+{
+    var nInt = this.getIPByte();
+    /*
+     * TODO: Consider swapping out this function whenever setProtMode() changes the mode to V86-mode.
+     */
+    if (I386 && (this.regPS & X86.PS.VM) && this.nIOPL < 3) {
+        if (DEBUG && this.messageEnabled()) this.printMessage("INT " + Str.toHexByte(nInt) + " in v86-mode (IOPL < 3)", true, true);
+        X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0);
+        return;
+    }
+    /*
+     * checkIntNotify() checks for any notification handlers registered via addIntNotify(), calls them,
+     * and returns false ONLY if a notification handler returned false (ie, requesting the interrupt be skipped).
+     */
+    if (this.checkIntNotify(nInt)) {
+        X86.helpTrap.call(this, nInt, 0);
+        return;
+    }
+    this.nStepCycles--;     // we don't need to assess the full cost of nOpCyclesInt, but we need to assess something...
+};
+
+/**
+ * op=0xCE (INTO: INT 4 if OF set)
+ *
+ * @this {X86CPU}
+ */
+X86.opINTO = function()
+{
+    if (this.getOF()) {
+        /*
+         * TODO: Consider swapping out this function whenever setProtMode() changes the mode to V86-mode.
+         */
+        if (I386 && (this.regPS & X86.PS.VM) && this.nIOPL < 3) {
+            if (DEBUG) this.printMessage("INTO in v86-mode (IOPL < 3)", this.bitsMessage, true);
+            X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0);
+            return;
+        }
+        X86.helpTrap.call(this, X86.EXCEPTION.OF_TRAP, this.cycleCounts.nOpCyclesIntOD);
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesIntOFall;
+};
+
+/**
+ * op=0xCF (IRET)
+ *
+ * @this {X86CPU}
+ */
+X86.opIRET = function()
+{
+    /*
+     * TODO: Consider swapping out this function whenever setProtMode() changes the mode to V86-mode.
+     */
+    if (I386 && (this.regPS & X86.PS.VM) && this.nIOPL < 3) {
+        if (DEBUG) this.printMessage("IRET in v86-mode (IOPL < 3)", this.bitsMessage, true);
+        X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0);
+        return;
+    }
+    X86.helpIRET.call(this);
+};
+
+/**
+ * op=0xD0 (GRP2 byte,1)
+ *
+ * @this {X86CPU}
+ */
+X86.opGRP2b1 = function()
+{
+    this.decodeModGrpByte.call(this, X86.aOpGrp2b, X86.helpSRC1);
+};
+
+/**
+ * op=0xD1 (GRP2 word,1)
+ *
+ * @this {X86CPU}
+ */
+X86.opGRP2w1 = function()
+{
+    this.decodeModGrpWord.call(this, this.sizeData == 2? X86.aOpGrp2w : X86.aOpGrp2d, X86.helpSRC1);
+};
+
+/**
+ * op=0xD2 (GRP2 byte,CL)
+ *
+ * @this {X86CPU}
+ */
+X86.opGRP2bCL = function()
+{
+    this.decodeModGrpByte.call(this, X86.aOpGrp2b, X86.helpSRCCL);
+};
+
+/**
+ * op=0xD3 (GRP2 word,CL)
+ *
+ * @this {X86CPU}
+ */
+X86.opGRP2wCL = function()
+{
+    this.decodeModGrpWord.call(this, this.sizeData == 2? X86.aOpGrp2w : X86.aOpGrp2d, X86.helpSRCCL);
+};
+
+/**
+ * op=0xD4 0x0A (AAM)
+ *
+ * From "The 8086 Book":
+ *
+ *      1. Divide AL by 0x0A; store the quotient in AH and the remainder in AL
+ *      2. Set PF, SF, and ZF based on the AL register (CF, OF, and AF are undefined)
+ *
+ * From "Undocumented Opcodes" (http://www.rcollins.org/secrets/opcodes/AAM.html):
+ *
+ *      AAM is shown as a two byte encoding used to divide AL by 10, putting the quotient in AH, and the remainder in AL.
+ *      However, AAM is listed in the op code map as a single byte instruction. This leads one to wonder why a two-byte
+ *      opcode is listed in the single-byte opcode map. In reality, the second byte is an undocumented operand to AAM.
+ *      The operand is the divisor. In its documented incarnation, AAM is encoded as D4 0A. The operand 0A is the divisor.
+ *      This divisor can be changed to any value between 0 and FF.
+ *
+ *      Using AAM in this manner is useful -- as it extends the CPU instruction set to include a DIV IMM8 instruction
+ *      that is not available from any other form of the DIV instruction. The extended form of the AAM instruction is also
+ *      useful because it sets the flags register according to the results, unlike the DIV or IDIV instruction.
+ *
+ *      According to Intel documentation, SF, ZF, and PF flags are set according to the result, while OF, AF, and CF
+ *      are undefined. However, if AAM were used strictly as documented, then the Sign Flag (SF) could not be set under
+ *      any circumstances, since anything divided by 10 will leave a remainder between 0 and 9. Obviously the remainder
+ *      could never be between 128 and 255 (or -1 and -128 if you prefer) if used only as documented. Since AAM divides
+ *      an 8 bit number by another 8-bit number, a carry or overflow could never occur. Therefore CF and OF always=0.
+ *      Intel claims they are undefined, but my observations are consistent with my theory.
+ *
+ *      Contrary to documentation, AAM will generate exceptions in real mode, protected mode, and V86 mode. AAM can only
+ *      generate Exception 0 -- divide by 0.
+ *
+ *      Finally, in the Pentium User's Manual, this heretofore undocumented form of AMM is described. Intel says:
+ *
+ *          Note: imm8 has the value of the instruction's second byte. The second byte under normally assembly [sic] of
+ *          this instruction will be 0A, however, explicit modification of this byte will result in the operation described
+ *          above and may alter results.
+ *
+ *      This instruction exists in this form on all Intel x86 processors. See the file [AAM.ASM](/docs/x86/ops/AAM/AAM.ASM)
+ *      for diagnostics source code for this instruction.
+ *
+ * @this {X86CPU}
+ */
+X86.opAAM = function()
+{
+    var b = this.getIPByte();
+    if (!b) {
+        X86.helpDIVOverflow.call(this);
+        return;
+    }
+    var AL = this.regEAX & 0xff;
+    this.regEAX = (this.regEAX & ~0xffff) | ((AL / b) << 8) | (AL % b);
+    /*
+     * setLogicResult() is perfect, because it ensures that CF and OF are cleared as well (see above for why).
+     */
+    this.setLogicResult(this.regEAX, X86.RESULT.BYTE);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesAAM;
+};
+
+/**
+ * op=0xD5 (AAD)
+ *
+ * From "The 8086 Book":
+ *
+ *      1. Multiply AH by 0x0A, add AH to AL, and store 0x00 in AH
+ *      2. Set PF, SF, and ZF based on the AL register (CF, OF, and AF are undefined)
+ *
+ * From "Undocumented Opcodes" (http://www.rcollins.org/secrets/opcodes/AAD.html):
+ *
+ *      This instruction is the multiplication counterpart to AAM. As is the case with AAM, AAD uses the second
+ *      byte as an operand. This operand is the multiplicand for AAD. Like AAM, AAD provides a way to execute a MUL
+ *      IMM8 that is unavailable through any other means in the CPU.
+ *
+ *      Unlike MUL, or IMUL, AAD sets all of the CPU status flags according to the result. Intel states that the
+ *      Overflow Flag (OF), Auxiliary carry Flag (AF), and Carry Flag (CF) are undefined. This assertion is incorrect.
+ *      These flags are fully defined, and are set consistently with respect to any other integer operations.
+ *
+ *      And again, like AMM, beginning with the Pentium, Intel has finally acknowledged the existence of the second
+ *      byte of this instruction as its operand. Intel says:
+ *
+ *          Note: imm8 has the value of the instruction's second byte. The second byte under normally assembly [sic]
+ *          of this instruction will be 0A, however, explicit modification of this byte will result in the operation
+ *          described above and may alter results.
+ *
+ *      This instruction exists in this form on all Intel x86 processors. See the file [AAD.ASM](/docs/x86/ops/AAD/AAD.ASM)
+ *      for diagnostics source code for this instruction.
+ *
+ * TODO: Confirm on real hardware that flags reflect the result of the final addition (ie, that the result of the
+ * intermediate multiplication is irrelevant); it also might be nice to confirm that an operand override has no effect.
+ *
+ * @this {X86CPU}
+ */
+X86.opAAD = function()
+{
+    var dst = (this.regEAX & 0xff);
+    var src = (((this.regEAX >> 8) & 0xff) * this.getIPByte())|0;
+    var result = (dst + src)|0;
+    this.regEAX = (this.regEAX & ~0xffff) | (result & 0xff);
+    this.setArithResult(dst, src, result, X86.RESULT.BYTE | X86.RESULT.ALL);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesAAD;
+};
+
+/**
+ * op=0xD6 (SALC aka SETALC) (undocumented until Pentium Pro)
+ *
+ * Sets AL to 0xFF if CF=1, 0x00 otherwise; no flags are affected (similar to SBB AL,AL, but without side-effects)
+ *
+ * WARNING: I have no idea how many clocks this instruction originally required, so for now, I'm going with a minimum of 2.
+ *
+ * @this {X86CPU}
+ */
+X86.opSALC = function()
+{
+    this.regEAX = (this.regEAX & ~0xff) | (this.getCF()? 0xFF : 0);
+    this.nStepCycles -= 2;
+};
+
+/**
+ * op=0xD7 (XLAT)
+ *
+ * @this {X86CPU}
+ */
+X86.opXLAT = function()
+{
+    /*
+     * TODO: Verify whether XLAT wraps its address calculation....
+     */
+    this.regEAX = (this.regEAX & ~0xff) | this.getEAByte(this.segData, (this.regEBX + (this.regEAX & 0xff)));
+    this.nStepCycles -= this.cycleCounts.nOpCyclesXLAT;
+};
+
+/**
+ * opESC()
+ *
+ * @this {X86CPU}
+ * @param {number} bOpcode
+ */
+X86.opESC = function(bOpcode)
+{
+    this.bOpcode = bOpcode;
+    this.decodeModRegWord.call(this, X86.fnESC);
+};
+
+/**
+ * op=0xD8 (ESC0)
+ *
+ * @this {X86CPU}
+ */
+X86.opESC0 = function()
+{
+    X86.opESC.call(this, X86.OPCODE.ESC0);
+};
+
+/**
+ * op=0xD9 (ESC1)
+ *
+ * @this {X86CPU}
+ */
+X86.opESC1 = function()
+{
+    X86.opESC.call(this, X86.OPCODE.ESC1);
+};
+
+/**
+ * op=0xDA (ESC2)
+ *
+ * @this {X86CPU}
+ */
+X86.opESC2 = function()
+{
+    X86.opESC.call(this, X86.OPCODE.ESC2);
+};
+
+/**
+ * op=0xDB (ESC3)
+ *
+ * @this {X86CPU}
+ */
+X86.opESC3 = function()
+{
+    X86.opESC.call(this, X86.OPCODE.ESC3);
+};
+
+/**
+ * op=0xDC (ESC4)
+ *
+ * @this {X86CPU}
+ */
+X86.opESC4 = function()
+{
+    X86.opESC.call(this, X86.OPCODE.ESC4);
+};
+
+/**
+ * op=0xDD (ESC5)
+ *
+ * @this {X86CPU}
+ */
+X86.opESC5 = function()
+{
+    X86.opESC.call(this, X86.OPCODE.ESC5);
+};
+
+/**
+ * op=0xDE (ESC6)
+ *
+ * @this {X86CPU}
+ */
+X86.opESC6 = function()
+{
+    X86.opESC.call(this, X86.OPCODE.ESC6);
+};
+
+/**
+ * op=0xDF (ESC7)
+ *
+ * @this {X86CPU}
+ */
+X86.opESC7 = function()
+{
+    X86.opESC.call(this, X86.OPCODE.ESC7);
+};
+
+/**
+ * op=0xE0 (LOOPNZ disp)
+ *
+ * NOTE: All the instructions in this group (LOOPNZ, LOOPZ, LOOP, and JCXZ) actually
+ * rely on the ADDRESS override setting for determining whether CX or ECX will be used,
+ * even though it seems counter-intuitive; ditto for the REP prefix.
+ *
+ * @this {X86CPU}
+ */
+X86.opLOOPNZ = function()
+{
+    var disp = this.getIPDisp();
+    var n = (this.regECX - 1) & this.maskAddr;
+    this.regECX = (this.regECX & ~this.maskAddr) | n;
+    if (n && !this.getZF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesLoopNZ;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLoopFall;
+};
+
+/**
+ * op=0xE1 (LOOPZ disp)
+ *
+ * NOTE: All the instructions in this group (LOOPNZ, LOOPZ, LOOP, and JCXZ) actually
+ * rely on the ADDRESS override setting for determining whether CX or ECX will be used,
+ * even though it seems counter-intuitive; ditto for the REP prefix.
+ *
+ * @this {X86CPU}
+ */
+X86.opLOOPZ = function()
+{
+    var disp = this.getIPDisp();
+    var n = (this.regECX - 1) & this.maskAddr;
+    this.regECX = (this.regECX & ~this.maskAddr) | n;
+    if (n && this.getZF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesLoopZ;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLoopZFall;
+};
+
+/**
+ * op=0xE2 (LOOP disp)
+ *
+ * NOTE: All the instructions in this group (LOOPNZ, LOOPZ, LOOP, and JCXZ) actually
+ * rely on the ADDRESS override setting for determining whether CX or ECX will be used,
+ * even though it seems counter-intuitive; ditto for the REP prefix.
+ *
+ * @this {X86CPU}
+ */
+X86.opLOOP = function()
+{
+    var disp = this.getIPDisp();
+    var n = (this.regECX - 1) & this.maskAddr;
+    this.regECX = (this.regECX & ~this.maskAddr) | n;
+    if (n) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesLoop;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLoopFall;
+};
+
+/**
+ * op=0xE3 (JCXZ/JECXZ disp)
+ *
+ * NOTE: All the instructions in this group (LOOPNZ, LOOPZ, LOOP, and JCXZ) actually
+ * rely on the ADDRESS override setting for determining whether CX or ECX will be used,
+ * even though it seems counter-intuitive; ditto for the REP prefix.
+ *
+ * @this {X86CPU}
+ */
+X86.opJCXZ = function()
+{
+    var disp = this.getIPDisp();
+    if (!(this.regECX & this.maskAddr)) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesLoopZ;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesLoopZFall;
+};
+
+/**
+ * op=0xE4 (IN AL,port)
+ *
+ * @this {X86CPU}
+ */
+X86.opINb = function()
+{
+    var port = this.getIPByte();
+    if (!this.checkIOPM(port, 1, true)) return;
+    this.regEAX = (this.regEAX & ~0xff) | (this.bus.checkPortInputNotify(port, 1, this.regLIP - 2) & 0xff);
+    if (BACKTRACK) this.backTrack.btiAL = this.backTrack.btiIO;
+    this.nStepCycles -= this.cycleCounts.nOpCyclesInP;
+};
+
+/**
+ * op=0xE5 (IN AX,port)
+ *
+ * @this {X86CPU}
+ */
+X86.opINw = function()
+{
+    var port = this.getIPByte();
+    if (!this.checkIOPM(port, this.sizeData, true)) return;
+    this.regEAX = (this.regEAX & ~this.maskData) | (this.bus.checkPortInputNotify(port, this.sizeData, this.regLIP - 2) & this.maskData);
+    if (BACKTRACK) {
+        this.backTrack.btiAL = this.backTrack.btiIO;
+        this.backTrack.btiAH = this.backTrack.btiIO;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesInP;
+};
+
+/**
+ * op=0xE6 (OUT port,AL)
+ *
+ * @this {X86CPU}
+ */
+X86.opOUTb = function()
+{
+    var port = this.getIPByte();
+    if (!this.checkIOPM(port, 1, false)) return;
+    this.bus.checkPortOutputNotify(port, 1, this.regEAX & 0xff, this.regLIP - 2);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesOutP;
+};
+
+/**
+ * op=0xE7 (OUT port,AX)
+ *
+ * @this {X86CPU}
+ */
+X86.opOUTw = function()
+{
+    var port = this.getIPByte();
+    if (!this.checkIOPM(port, this.sizeData, false)) return;
+    this.bus.checkPortOutputNotify(port, this.sizeData, this.regEAX & this.maskData, this.regLIP - 2);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesOutP;
+};
+
+/**
+ * op=0xE8 (CALL disp16)
+ *
+ * @this {X86CPU}
+ */
+X86.opCALL = function()
+{
+    var disp = this.getIPWord();
+    var oldIP = this.getIP();
+    var newIP = oldIP + disp;
+    this.pushWord(oldIP);
+    this.setIP(newIP);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesCall;
+};
+
+/**
+ * op=0xE9 (JMP disp16)
+ *
+ * @this {X86CPU}
+ */
+X86.opJMP = function()
+{
+    var disp = this.getIPWord();
+    this.setIP(this.getIP() + disp);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmp;
+};
+
+/**
+ * op=0xEA (JMP seg:off)
+ *
+ * @this {X86CPU}
+ */
+X86.opJMPF = function()
+{
+    this.setCSIP(this.getIPWord(), this.getIPShort());
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpF;
+};
+
+/**
+ * op=0xEB (JMP short disp8)
+ *
+ * @this {X86CPU}
+ */
+X86.opJMPs = function()
+{
+    var disp = this.getIPDisp();
+    this.setIP(this.getIP() + disp);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmp;
+};
+
+/**
+ * op=0xEC (IN AL,dx)
+ *
+ * @this {X86CPU}
+ */
+X86.opINDXb = function()
+{
+    var port = this.regEDX & 0xffff;
+    if (!this.checkIOPM(port, 1, true)) return;
+    this.regEAX = (this.regEAX & ~0xff) | (this.bus.checkPortInputNotify(port, 1, this.regLIP - 1) & 0xff);
+    if (BACKTRACK) this.backTrack.btiAL = this.backTrack.btiIO;
+    this.nStepCycles -= this.cycleCounts.nOpCyclesInDX;
+};
+
+/**
+ * op=0xED (IN AX,dx)
+ *
+ * @this {X86CPU}
+ */
+X86.opINDXw = function()
+{
+    var port = this.regEDX & 0xffff;
+    if (!this.checkIOPM(port, this.sizeData, true)) return;
+    this.regEAX = (this.regEAX & ~this.maskData) | (this.bus.checkPortInputNotify(port, this.sizeData, this.regLIP - 1) & this.maskData);
+    if (BACKTRACK) {
+        this.backTrack.btiAL = this.backTrack.btiIO;
+        this.backTrack.btiAH = this.backTrack.btiIO;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesInDX;
+};
+
+/**
+ * op=0xEE (OUT dx,AL)
+ *
+ * @this {X86CPU}
+ */
+X86.opOUTDXb = function()
+{
+    var port = this.regEDX & 0xffff;
+    if (!this.checkIOPM(port, 1, false)) return;
+    if (BACKTRACK) this.backTrack.btiIO = this.backTrack.btiAL;
+    this.bus.checkPortOutputNotify(port, 1, this.regEAX & 0xff, this.regLIP - 1);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesOutDX;
+};
+
+/**
+ * op=0xEF (OUT dx,AX)
+ *
+ * @this {X86CPU}
+ */
+X86.opOUTDXw = function()
+{
+    var port = this.regEDX & 0xffff;
+    if (!this.checkIOPM(port, 2, false)) return;
+    if (BACKTRACK) {
+        this.backTrack.btiIO = this.backTrack.btiAL;
+        this.backTrack.btiIO = this.backTrack.btiAH;
+    }
+    this.bus.checkPortOutputNotify(port, this.sizeData, this.regEAX & this.maskData, this.regLIP - 1);
+    this.nStepCycles -= this.cycleCounts.nOpCyclesOutDX;
+};
+
+/**
+ * op=0xF0 (LOCK:)
+ *
+ * @this {X86CPU}
+ */
+X86.opLOCK = function()
+{
+    this.opFlags |= X86.OPFLAG.LOCK | X86.OPFLAG.NOINTR;
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPrefix;
+};
+
+/**
+ * op=0xF1 (INT1; undocumented; 80186/80188 and up; TODO: Verify)
+ *
+ * Note that this handler is assigned to opcode 0xF1 only on 80186 processors and up, because on 8086/8086
+ * processors, we treat that opcode as an alias for LOCK (0xF0).
+ *
+ * For the 80186 and up, and we treat it as undefined.  Starting with the 80386, this opcode is known as INT1
+ * or ICEBP, since it effectively performs an INT 0x01 but is normally only performed with an ICE.
+ *
+ * @this {X86CPU}
+ */
+X86.opINT1 = function()
+{
+    X86.opUndefined.call(this);
+};
+
+/**
+ * op=0xF2 (REPNZ:) (repeat CMPS or SCAS until NZ; repeat MOVS, LODS, or STOS unconditionally)
+ *
+ * @this {X86CPU}
+ */
+X86.opREPNZ = function()
+{
+    this.opFlags |= X86.OPFLAG.REPNZ | X86.OPFLAG.NOINTR;
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPrefix;
+};
+
+/**
+ * op=0xF3 (REPZ:) (repeat CMPS or SCAS until Z; repeat MOVS, LODS, or STOS unconditionally)
+ *
+ * @this {X86CPU}
+ */
+X86.opREPZ = function()
+{
+    this.opFlags |= X86.OPFLAG.REPZ | X86.OPFLAG.NOINTR;
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPrefix;
+};
+
+/**
+ * op=0xF4 (HLT)
+ *
+ * @this {X86CPU}
+ */
+X86.opHLT = function()
+{
+    /*
+     * TODO: Consider swapping out this function whenever setProtMode() changes the mode to V86-mode.
+     */
+    if (I386 && (this.regPS & X86.PS.VM)) {
+        X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0);
+        return;
+    }
+    /*
+     * The CPU is never REALLY halted by a HLT instruction; instead, by setting X86.INTFLAG.HALT,
+     * we are signalling to stepCPU() that it's free to end the current burst AND that it should not
+     * execute any more instructions until checkINTR() indicates a hardware interrupt is requested.
+     */
+    this.intFlags |= X86.INTFLAG.HALT;
+    this.nStepCycles -= 2;
+    /*
+     * If a Debugger is present and the HALT message category is enabled, then we REALLY halt the CPU,
+     * on the theory that whoever's using the Debugger would like to see HLTs.
+     */
+    if (DEBUGGER && this.dbg && this.messageEnabled(Messages.HALT)) {
+        this.resetIP(-1);       // this is purely for the Debugger's benefit, to show the HLT
+        this.dbg.stopCPU();
+        return;
+    }
+    /*
+     * We also REALLY halt the machine if interrupts have been disabled, since that means it's dead
+     * in the water (we have no NMI generation mechanism at the moment).
+     */
+    if (!this.getIF()) {
+        if (DEBUGGER && this.dbg) this.resetIP(-1);
+        this.stopCPU();
+    }
+};
+
+/**
+ * op=0xF5 (CMC)
+ *
+ * @this {X86CPU}
+ */
+X86.opCMC = function()
+{
+    if (this.getCF()) this.clearCF(); else this.setCF();
+    this.nStepCycles -= 2;                          // CMC takes 2 cycles on all CPUs
+};
+
+/**
+ * op=0xF6 (GRP3 byte)
+ *
+ * The MUL byte instruction is problematic in two cases:
+ *
+ *      0xF6 0xE0:  MUL AL
+ *      0xF6 0xE4:  MUL AH
+ *
+ * because the OpModGrpByte decoder function will attempt to put the fnMULb() function's
+ * return value back into AL or AH, undoing fnMULb's update of AX.  And since fnMULb doesn't
+ * know what the target is (only the target's value), it cannot easily work around the problem.
+ *
+ * A simple, albeit kludgy, solution is for fnMULb to always save its result in a special
+ * "register" (eg, regMDLo), which we will then put back into regEAX if it's been updated.
+ * This also relieves us from having to decode any part of the ModRM byte, so maybe it's not
+ * such a bad work-around after all.
+ *
+ * Similar issues with IMUL (and DIV and IDIV) are resolved using the same special variable(s).
+ *
+ * @this {X86CPU}
+ */
+X86.opGRP3b = function()
+{
+    this.fMDSet = false;
+    this.decodeModGrpByte.call(this, X86.aOpGrp3b, X86.helpSRCNone);
+    if (this.fMDSet) this.regEAX = (this.regEAX & ~this.maskData) | (this.regMDLo & this.maskData);
+};
+
+/**
+ * op=0xF7 (GRP3 word)
+ *
+ * The MUL word instruction is problematic in two cases:
+ *
+ *      0xF7 0xE0:  MUL AX
+ *      0xF7 0xE2:  MUL DX
+ *
+ * because the OpModGrpWord decoder function will attempt to put the fnMULw() function's
+ * return value back into AX or DX, undoing fnMULw's update of DX:AX.  And since fnMULw doesn't
+ * know what the target is (only the target's value), it cannot easily work around the problem.
+ *
+ * A simple, albeit kludgy, solution is for fnMULw to always save its result in a special
+ * "register" (eg, regMDLo/regMDHi), which we will then put back into regEAX/regEDX if it's been
+ * updated.  This also relieves us from having to decode any part of the ModRM byte, so maybe
+ * it's not such a bad work-around after all.
+ *
+ * @this {X86CPU}
+ */
+X86.opGRP3w = function()
+{
+    this.fMDSet = false;
+    this.decodeModGrpWord.call(this, X86.aOpGrp3w, X86.helpSRCNone);
+    if (this.fMDSet) {
+        this.regEAX = (this.regEAX & ~this.maskData) | (this.regMDLo & this.maskData);
+        this.regEDX = (this.regEDX & ~this.maskData) | (this.regMDHi & this.maskData);
+    }
+};
+
+/**
+ * op=0xF8 (CLC)
+ *
+ * @this {X86CPU}
+ */
+X86.opCLC = function()
+{
+    this.clearCF();
+    this.nStepCycles -= 2;                              // CLC takes 2 cycles on all CPUs
+};
+
+/**
+ * op=0xF9 (STC)
+ *
+ * @this {X86CPU}
+ */
+X86.opSTC = function()
+{
+    this.setCF();
+    this.nStepCycles -= 2;                              // STC takes 2 cycles on all CPUs
+};
+
+/**
+ * op=0xFA (CLI)
+ *
+ * @this {X86CPU}
+ */
+X86.opCLI = function()
+{
+    /*
+     * The following code should be sufficient for all modes, because in real-mode, CPL is always zero,
+     * and in V86-mode, CPL is always 3.
+     */
+    if (this.nCPL > this.nIOPL) {
+        if (DEBUG && (this.regPS & X86.PS.VM)) this.printMessage("CLI in v86-mode (IOPL < 3)", this.bitsMessage, true);
+        X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0);
+        return;
+    }
+    this.clearIF();
+    this.nStepCycles -= this.cycleCounts.nOpCyclesCLI;  // CLI takes LONGER on an 80286
+};
+
+/**
+ * op=0xFB (STI)
+ *
+ * @this {X86CPU}
+ */
+X86.opSTI = function()
+{
+    /*
+     * The following code should be sufficient for all modes, because in real-mode, CPL is always zero,
+     * and in V86-mode, CPL is always 3.
+     */
+    if (this.nCPL > this.nIOPL) {
+        if (DEBUG && (this.regPS & X86.PS.VM)) this.printMessage("STI in v86-mode (IOPL < 3)", this.bitsMessage, true);
+        X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0);
+        return;
+    }
+    this.setIF();
+    this.opFlags |= X86.OPFLAG.NOINTR;
+    this.nStepCycles -= 2;                              // STI takes 2 cycles on all CPUs
+};
+
+/**
+ * op=0xFC (CLD)
+ *
+ * @this {X86CPU}
+ */
+X86.opCLD = function()
+{
+    this.clearDF();
+    this.nStepCycles -= 2;                              // CLD takes 2 cycles on all CPUs
+};
+
+/**
+ * op=0xFD (STD)
+ *
+ * @this {X86CPU}
+ */
+X86.opSTD = function()
+{
+    this.setDF();
+    this.nStepCycles -= 2;                              // STD takes 2 cycles on all CPUs
+};
+
+/**
+ * op=0xFE (GRP4 byte)
+ *
+ * @this {X86CPU}
+ */
+X86.opGRP4b = function()
+{
+    this.decodeModGrpByte.call(this, X86.aOpGrp4b, X86.helpSRCNone);
+};
+
+/**
+ * op=0xFF (GRP4 word)
+ *
+ * @this {X86CPU}
+ */
+X86.opGRP4w = function()
+{
+    this.decodeModGrpWord.call(this, X86.aOpGrp4w, X86.helpSRCNone);
+};
+
+/**
+ * opInvalid()
+ *
+ * @this {X86CPU}
+ */
+X86.opInvalid = function()
+{
+    X86.helpFault.call(this, X86.EXCEPTION.UD_FAULT);
+};
+
+/**
+ * opUndefined()
+ *
+ * @this {X86CPU}
+ */
+X86.opUndefined = function()
+{
+    this.setIP(this.opLIP - this.segCS.base);
+    this.setError("Undefined opcode " + Str.toHexByte(this.getByte(this.regLIP)) + " at " + Str.toHexLong(this.regLIP));
+    this.stopCPU();
+};
+
+/**
+ * opTBD()
+ *
+ * @this {X86CPU}
+ */
+X86.opTBD = function()
+{
+    this.setIP(this.opLIP - this.segCS.base);
+    this.printMessage("unimplemented 80386 opcode", true);
+    this.stopCPU();
+};
+
+/*
+ * This 256-entry array of opcode functions is at the heart of the CPU engine: stepCPU(n).
+ *
+ * It might be worth trying a switch() statement instead, to see how the performance compares,
+ * but I suspect that would vary quite a bit across JavaScript engines; for now, I'm putting my
+ * money on array lookup.
+ */
+X86.aOps = [
+    X86.opADDmb,            X86.opADDmw,            X86.opADDrb,            X86.opADDrw,        // 0x00-0x03
+    X86.opADDALb,           X86.opADDAX,            X86.opPUSHES,           X86.opPOPES,        // 0x04-0x07
+    X86.opORmb,             X86.opORmw,             X86.opORrb,             X86.opORrw,         // 0x08-0x0B
+    X86.opORALb,            X86.opORAX,             X86.opPUSHCS,           X86.opPOPCS,        // 0x0C-0x0F
+    X86.opADCmb,            X86.opADCmw,            X86.opADCrb,            X86.opADCrw,        // 0x10-0x13
+    X86.opADCALb,           X86.opADCAX,            X86.opPUSHSS,           X86.opPOPSS,        // 0x14-0x17
+    X86.opSBBmb,            X86.opSBBmw,            X86.opSBBrb,            X86.opSBBrw,        // 0x18-0x1B
+    X86.opSBBALb,           X86.opSBBAX,            X86.opPUSHDS,           X86.opPOPDS,        // 0x1C-0x1F
+    X86.opANDmb,            X86.opANDmw,            X86.opANDrb,            X86.opANDrw,        // 0x20-0x23
+    X86.opANDAL,            X86.opANDAX,            X86.opES,               X86.opDAA,          // 0x24-0x27
+    X86.opSUBmb,            X86.opSUBmw,            X86.opSUBrb,            X86.opSUBrw,        // 0x28-0x2B
+    X86.opSUBALb,           X86.opSUBAX,            X86.opCS,               X86.opDAS,          // 0x2C-0x2F
+    X86.opXORmb,            X86.opXORmw,            X86.opXORrb,            X86.opXORrw,        // 0x30-0x33
+    X86.opXORALb,           X86.opXORAX,            X86.opSS,               X86.opAAA,          // 0x34-0x37
+    X86.opCMPmb,            X86.opCMPmw,            X86.opCMPrb,            X86.opCMPrw,        // 0x38-0x3B
+    X86.opCMPALb,           X86.opCMPAX,            X86.opDS,               X86.opAAS,          // 0x3C-0x3F
+    X86.opINCAX,            X86.opINCCX,            X86.opINCDX,            X86.opINCBX,        // 0x40-0x43
+    X86.opINCSP,            X86.opINCBP,            X86.opINCSI,            X86.opINCDI,        // 0x44-0x47
+    X86.opDECAX,            X86.opDECCX,            X86.opDECDX,            X86.opDECBX,        // 0x48-0x4B
+    X86.opDECSP,            X86.opDECBP,            X86.opDECSI,            X86.opDECDI,        // 0x4C-0x4F
+    X86.opPUSHAX,           X86.opPUSHCX,           X86.opPUSHDX,           X86.opPUSHBX,       // 0x50-0x53
+    X86.opPUSHSP_8086,      X86.opPUSHBP,           X86.opPUSHSI,           X86.opPUSHDI,       // 0x54-0x57
+    X86.opPOPAX,            X86.opPOPCX,            X86.opPOPDX,            X86.opPOPBX,        // 0x58-0x5B
+    X86.opPOPSP,            X86.opPOPBP,            X86.opPOPSI,            X86.opPOPDI,        // 0x5C-0x5F
+    /*
+     * On an 8086/8088, opcodes 0x60-0x6F are aliases for the conditional jumps 0x70-0x7F.  Sometimes you'll see
+     * references to these opcodes (like 0x60) being a "two-byte NOP" and using them differentiate an 8088 from newer
+     * CPUs, but they're only a "two-byte NOP" if the second byte is zero, resulting in zero displacement.
+     */
+    X86.opJO,               X86.opJNO,              X86.opJC,               X86.opJNC,          // 0x60-0x63
+    X86.opJZ,               X86.opJNZ,              X86.opJBE,              X86.opJNBE,         // 0x64-0x67
+    X86.opJS,               X86.opJNS,              X86.opJP,               X86.opJNP,          // 0x68-0x6B
+    X86.opJL,               X86.opJNL,              X86.opJLE,              X86.opJNLE,         // 0x6C-0x6F
+    X86.opJO,               X86.opJNO,              X86.opJC,               X86.opJNC,          // 0x70-0x73
+    X86.opJZ,               X86.opJNZ,              X86.opJBE,              X86.opJNBE,         // 0x74-0x77
+    X86.opJS,               X86.opJNS,              X86.opJP,               X86.opJNP,          // 0x78-0x7B
+    X86.opJL,               X86.opJNL,              X86.opJLE,              X86.opJNLE,         // 0x7C-0x7F
+    /*
+     * On all processors, opcode groups 0x80 and 0x82 perform identically (0x82 opcodes sign-extend their
+     * immediate data, but since both 0x80 and 0x82 are byte operations, the sign extension has no effect).
+     *
+     * WARNING: Intel's "Pentium Processor User's Manual (Volume 3: Architecture and Programming Manual)" refers
+     * to opcode 0x82 as a "reserved" instruction, but also cryptically refers to it as "MOVB AL,imm".  This is
+     * assumed to be an error in the manual, because as far as I know, 0x82 has always mirrored 0x80.
+     */
+    X86.opGRP1b,            X86.opGRP1w,            X86.opGRP1b,            X86.opGRP1sw,       // 0x80-0x83
+    X86.opTESTrb,           X86.opTESTrw,           X86.opXCHGrb,           X86.opXCHGrw,       // 0x84-0x87
+    X86.opMOVmb,            X86.opMOVmw,            X86.opMOVrb,            X86.opMOVrw,        // 0x88-0x8B
+    X86.opMOVwsr,           X86.opLEA,              X86.opMOVsrw,           X86.opPOPmw,        // 0x8C-0x8F
+    X86.opNOP,              X86.opXCHGCX,           X86.opXCHGDX,           X86.opXCHGBX,       // 0x90-0x93
+    X86.opXCHGSP,           X86.opXCHGBP,           X86.opXCHGSI,           X86.opXCHGDI,       // 0x94-0x97
+    X86.opCBW,              X86.opCWD,              X86.opCALLF,            X86.opWAIT,         // 0x98-0x9B
+    X86.opPUSHF,            X86.opPOPF,             X86.opSAHF,             X86.opLAHF,         // 0x9C-0x9F
+    X86.opMOVALm,           X86.opMOVAXm,           X86.opMOVmAL,           X86.opMOVmAX,       // 0xA0-0xA3
+    X86.opMOVSb,            X86.opMOVSw,            X86.opCMPSb,            X86.opCMPSw,        // 0xA4-0xA7
+    X86.opTESTALb,          X86.opTESTAX,           X86.opSTOSb,            X86.opSTOSw,        // 0xA8-0xAB
+    X86.opLODSb,            X86.opLODSw,            X86.opSCASb,            X86.opSCASw,        // 0xAC-0xAF
+    X86.opMOVALb,           X86.opMOVCLb,           X86.opMOVDLb,           X86.opMOVBLb,       // 0xB0-0xB3
+    X86.opMOVAHb,           X86.opMOVCHb,           X86.opMOVDHb,           X86.opMOVBHb,       // 0xB4-0xB7
+    X86.opMOVAX,            X86.opMOVCX,            X86.opMOVDX,            X86.opMOVBX,        // 0xB8-0xBB
+    X86.opMOVSP,            X86.opMOVBP,            X86.opMOVSI,            X86.opMOVDI,        // 0xBC-0xBF
+    /*
+     * On an 8086/8088, opcodes 0xC0 -> 0xC2, 0xC1 -> 0xC3, 0xC8 -> 0xCA and 0xC9 -> 0xCB.
+     */
+    X86.opRETn,             X86.opRET,              X86.opRETn,             X86.opRET,          // 0xC0-0xC3
+    X86.opLES,              X86.opLDS,              X86.opMOVb,             X86.opMOVw,         // 0xC4-0xC7
+    X86.opRETFn,            X86.opRETF,             X86.opRETFn,            X86.opRETF,         // 0xC8-0xCB
+    X86.opINT3,             X86.opINTn,             X86.opINTO,             X86.opIRET,         // 0xCC-0xCF
+    X86.opGRP2b1,           X86.opGRP2w1,           X86.opGRP2bCL,          X86.opGRP2wCL,      // 0xD0-0xD3
+    /*
+     * Even as of the Pentium, opcode 0xD6 is still marked as "reserved", but it's always been SALC (aka SETALC).
+     */
+    X86.opAAM,              X86.opAAD,              X86.opSALC,             X86.opXLAT,         // 0xD4-0xD7
+    X86.opESC0,             X86.opESC1,             X86.opESC2,             X86.opESC3,         // 0xD8-0xDB
+    X86.opESC4,             X86.opESC5,             X86.opESC6,             X86.opESC7,         // 0xDC-0xDF
+    X86.opLOOPNZ,           X86.opLOOPZ,            X86.opLOOP,             X86.opJCXZ,         // 0xE0-0xE3
+    X86.opINb,              X86.opINw,              X86.opOUTb,             X86.opOUTw,         // 0xE4-0xE7
+    X86.opCALL,             X86.opJMP,              X86.opJMPF,             X86.opJMPs,         // 0xE8-0xEB
+    X86.opINDXb,            X86.opINDXw,            X86.opOUTDXb,           X86.opOUTDXw,       // 0xEC-0xEF
+    /*
+     * On an 8086/8088, opcode 0xF1 is believed to be an alias for 0xF0; in any case, it definitely behaves like
+     * a prefix on those processors, so we treat it as such.  On the 80186 and up, we treat as opINT1().
+     *
+     * As of the Pentium, opcode 0xF1 is still marked "reserved".
+     */
+    X86.opLOCK,             X86.opLOCK,             X86.opREPNZ,            X86.opREPZ,         // 0xF0-0xF3
+    X86.opHLT,              X86.opCMC,              X86.opGRP3b,            X86.opGRP3w,        // 0xF4-0xF7
+    X86.opCLC,              X86.opSTC,              X86.opCLI,              X86.opSTI,          // 0xF8-0xFB
+    X86.opCLD,              X86.opSTD,              X86.opGRP4b,            X86.opGRP4w         // 0xFC-0xFF
+];
+
+/*
+ * A word (or two) on instruction groups (eg, Grp1, Grp2), which are groups of instructions that
+ * use a mod/reg/rm byte, where the reg field of that byte selects a function rather than a register.
+ *
+ * I start with the groupings used by Intel's "Pentium Processor User's Manual (Volume 3: Architecture
+ * and Programming Manual)", but I deviate slightly, mostly by subdividing their groups with letter suffixes:
+ *
+ *      Opcodes     Intel       PCx86                                               PC Mag TechRef
+ *      -------     -----       ----                                                --------------
+ *      0x80-0x83   Grp1        Grp1b and Grp1w                                     Group A
+ *      0xC0-0xC1   Grp2        Grp2b and Grp2w (opGRP2bn/wn)                       Group B
+ *      0xD0-0xD3   Grp2        Grp2b and Grp2w (opGRP2b1/w1 and opGRP2bCL/wCL)     Group B
+ *      0xF6-0xF7   Grp3        Grp3b and Grp3w                                     Group C
+ *      0xFE        Grp4        Grp4b                                               Group D
+ *      0xFF        Grp5        Grp4w                                               Group E
+ *      0x0F,0x00   Grp6        Grp6 (SLDT, STR, LLDT, LTR, VERR, VERW)             Group F
+ *      0x0F,0x01   Grp7        Grp7 (SGDT, SIDT, LGDT, LIDT, SMSW, LMSW, INVLPG)   Group G
+ *      0x0F,0xBA   Grp8        Grp8 (BT, BTS, BTR, BTC)                            Group H
+ *      0x0F,0xC7   Grp9        Grp9 (CMPXCH)                                       (N/A, 80486 and up)
+ *
+ * My only serious deviation is Grp5, which I refer to as Grp4w, because it contains word forms of
+ * the INC and DEC instructions found in Grp4b.  Granted, Grp4w also contains versions of the CALL,
+ * JMP and PUSH instructions, which are not in Grp4b, but there's nothing in Grp4b that conflicts with
+ * Grp4w, so I think my nomenclature makes more sense.  To compensate, I don't use Grp5, so that the
+ * remaining group numbers remain in sync with Intel's.
+ *
+ * To the above list, I've added a few "single-serving" groups: opcode 0x8F uses GrpPOPw, and opcodes 0xC6/0xC7
+ * use GrpMOVn.  In both of these groups, the only valid (documented) instruction is where reg=0x0.
+ *
+ * TODO: Test what happens on real hardware when the reg field is non-zero for opcodes 0x8F and 0xC6/0xC7.
+ */
+X86.aOpGrp1b = [
+    X86.fnADDb,             X86.fnORb,              X86.fnADCb,             X86.fnSBBb,             // 0x80/0x82(reg=0x0-0x3)
+    X86.fnANDb,             X86.fnSUBb,             X86.fnXORb,             X86.fnCMPb              // 0x80/0x82(reg=0x4-0x7)
+];
+
+X86.aOpGrp1w = [
+    X86.fnADDw,             X86.fnORw,              X86.fnADCw,             X86.fnSBBw,             // 0x81/0x83(reg=0x0-0x3)
+    X86.fnANDw,             X86.fnSUBw,             X86.fnXORw,             X86.fnCMPw              // 0x81/0x83(reg=0x4-0x7)
+];
+
+X86.aOpGrpPOPw = [
+    X86.fnPOPw,             X86.fnGRPFault,         X86.fnGRPFault,         X86.fnGRPFault,         // 0x8F(reg=0x0-0x3)
+    X86.fnGRPFault,         X86.fnGRPFault,         X86.fnGRPFault,         X86.fnGRPFault          // 0x8F(reg=0x4-0x7)
+];
+
+X86.aOpGrpMOVn = [
+    X86.fnMOVn,             X86.fnGRPUndefined,     X86.fnGRPUndefined,     X86.fnGRPUndefined,     // 0xC6/0xC7(reg=0x0-0x3)
+    X86.fnGRPUndefined,     X86.fnGRPUndefined,     X86.fnGRPUndefined,     X86.fnGRPUndefined      // 0xC6/0xC7(reg=0x4-0x7)
+];
+
+X86.aOpGrp2b = [
+    X86.fnROLb,             X86.fnRORb,             X86.fnRCLb,             X86.fnRCRb,             // 0xC0/0xD0/0xD2(reg=0x0-0x3)
+    X86.fnSHLb,             X86.fnSHRb,             X86.fnGRPUndefined,     X86.fnSARb              // 0xC0/0xD0/0xD2(reg=0x4-0x7)
+];
+
+X86.aOpGrp2w = [
+    X86.fnROLw,             X86.fnRORw,             X86.fnRCLw,             X86.fnRCRw,             // 0xC1/0xD1/0xD3(reg=0x0-0x3)
+    X86.fnSHLw,             X86.fnSHRw,             X86.fnGRPUndefined,     X86.fnSARw              // 0xC1/0xD1/0xD3(reg=0x4-0x7)
+];
+
+X86.aOpGrp2d = [
+    X86.fnROLd,             X86.fnRORd,             X86.fnRCLd,             X86.fnRCRd,             // 0xC1/0xD1/0xD3(reg=0x0-0x3)
+    X86.fnSHLd,             X86.fnSHRd,             X86.fnGRPUndefined,     X86.fnSARd              // 0xC1/0xD1/0xD3(reg=0x4-0x7)
+];
+
+X86.aOpGrp3b = [
+    X86.fnTESTib,           X86.fnGRPUndefined,     X86.fnNOTb,             X86.fnNEGb,             // 0xF6(reg=0x0-0x3)
+    X86.fnMULb,             X86.fnIMULb,            X86.fnDIVb,             X86.fnIDIVb             // 0xF6(reg=0x4-0x7)
+];
+
+X86.aOpGrp3w = [
+    X86.fnTESTiw,           X86.fnGRPUndefined,     X86.fnNOTw,             X86.fnNEGw,             // 0xF7(reg=0x0-0x3)
+    X86.fnMULw,             X86.fnIMULw,            X86.fnDIVw,             X86.fnIDIVw             // 0xF7(reg=0x4-0x7)
+];
+
+X86.aOpGrp4b = [
+    X86.fnINCb,             X86.fnDECb,             X86.fnGRPUndefined,     X86.fnGRPUndefined,     // 0xFE(reg=0x0-0x3)
+    X86.fnGRPUndefined,     X86.fnGRPUndefined,     X86.fnGRPUndefined,     X86.fnGRPUndefined      // 0xFE(reg=0x4-0x7)
+];
+
+X86.aOpGrp4w = [
+    X86.fnINCw,             X86.fnDECw,             X86.fnCALLw,            X86.fnCALLFdw,          // 0xFF(reg=0x0-0x3)
+    X86.fnJMPw,             X86.fnJMPFdw,           X86.fnPUSHw,            X86.fnGRPUndefined      // 0xFF(reg=0x4-0x7)
+];
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/x86op0f.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * op=0x0F,0x00 (GRP6 mem/reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opGRP6 = function()
+{
+    var bModRM = this.peekIPByte();
+    if ((bModRM & 0x38) < 0x10) {   // possible reg values: 0x00, 0x08, 0x10, 0x18, 0x20, 0x28, 0x30, 0x38
+        this.opFlags |= X86.OPFLAG.NOREAD;
+    }
+    this.decodeModGrpWord.call(this, this.aOpGrp6, X86.helpSRCNone);
+};
+
+/**
+ * op=0x0F,0x01 (GRP7 mem/reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opGRP7 = function()
+{
+    var bModRM = this.peekIPByte();
+    if (!(bModRM & 0x10)) {
+        this.opFlags |= X86.OPFLAG.NOREAD;
+    }
+    this.decodeModGrpWord.call(this, X86.aOpGrp7, X86.helpSRCNone);
+};
+
+/**
+ * opLAR()
+ *
+ * op=0x0F,0x02 (LAR reg,mem/reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opLAR = function()
+{
+    /*
+     * TODO: Consider swapping out this function whenever setProtMode() changes the mode to real-mode or V86-mode.
+     */
+    if (!(this.regCR0 & X86.CR0.MSW.PE) || I386 && (this.regPS & X86.PS.VM)) {
+        X86.opInvalid.call(this);
+        return;
+    }
+    this.decodeModRegWord.call(this, X86.fnLAR);
+};
+
+/**
+ * opLSL()
+ *
+ * op=0x0F,0x03 (LSL reg,mem/reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opLSL = function()
+{
+    /*
+     * TODO: Consider swapping out this function whenever setProtMode() changes the mode to real-mode or V86-mode.
+     */
+    if (!(this.regCR0 & X86.CR0.MSW.PE) || I386 && (this.regPS & X86.PS.VM)) {
+        X86.opInvalid.call(this);
+        return;
+    }
+    this.decodeModRegWord.call(this, X86.fnLSL);
+};
+
+/**
+ * opLOADALL286()
+ *
+ * op=0x0F,0x05 (LOADALL)
+ *
+ * From the "Undocumented iAPX 286 Test Instruction" document at http://www.pcjs.org/pubs/pc/reference/intel/80286/loadall/:
+ *
+ *  Physical Address (Hex)        Associated CPU Register
+ *          800-805                        None
+ *          806-807                        MSW
+ *          808-815                        None
+ *          816-817                        TR
+ *          818-819                        Flag word
+ *          81A-81B                        IP
+ *          81C-81D                        LDT
+ *          81E-81F                        DS
+ *          820-821                        SS
+ *          822-823                        CS
+ *          824-825                        ES
+ *          826-827                        DI
+ *          828-829                        SI
+ *          82A-82B                        BP
+ *          82C-82D                        SP
+ *          82E-82F                        BX
+ *          830-831                        DX
+ *          832-833                        CX
+ *          834-835                        AX
+ *          836-83B                        ES descriptor cache
+ *          83C-841                        CS descriptor cache
+ *          842-847                        SS descriptor cache
+ *          848-84D                        DS descriptor cache
+ *          84E-853                        GDTR
+ *          854-859                        LDT descriptor cache
+ *          85A-85F                        IDTR
+ *          860-865                        TSS descriptor cache
+ *
+ * @this {X86CPU}
+ */
+X86.opLOADALL286 = function()
+{
+    if (this.nCPL) {
+        /*
+         * To use LOADALL, CPL must be zero.
+         */
+        X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0, 0, true);
+        return;
+    }
+    this.setMSW(this.getShort(0x806));
+    this.regEDI = this.getShort(0x826);
+    this.regESI = this.getShort(0x828);
+    this.regEBP = this.getShort(0x82A);
+    this.regEBX = this.getShort(0x82E);
+    this.regEDX = this.getShort(0x830);
+    this.regECX = this.getShort(0x832);
+    this.regEAX = this.getShort(0x834);
+    this.segES.loadDesc6(0x836, this.getShort(0x824));
+    this.segCS.loadDesc6(0x83C, this.getShort(0x822));
+    this.segSS.loadDesc6(0x842, this.getShort(0x820));
+    this.segDS.loadDesc6(0x848, this.getShort(0x81E));
+    /*
+     * Unlike LOADALL386, there's no requirement for calling setPS() before loading segment registers;
+     * in fact, since we're not passing a CPL to setPS(), it may be preferable to have CS (and perhaps SS)
+     * already loaded, so that setPS() can query the CPL.  TODO: Verify that CPL is set correctly.
+     */
+    this.setPS(this.getShort(0x818));
+    /*
+     * It's important to call setIP() and setSP() *after* the segCS and segSS loads, so that the CPU's
+     * linear IP and SP registers (regLIP and regLSP) will be updated properly.  Ordinarily that would be
+     * taken care of by simply using the CPU's setCS() and setSS() functions, but those functions call the
+     * default descriptor load() functions, and obviously here we must use loadDesc6() instead.
+     */
+    this.setIP(this.getShort(0x81A));
+    this.setSP(this.getShort(0x82C));
+    /*
+     * The bytes at 0x851 and 0x85D "should be zeroes", as per the "Undocumented iAPX 286 Test Instruction"
+     * document, but the LOADALL issued by RAMDRIVE in PC-DOS 7.0 contains 0xFF in both of those bytes, resulting
+     * in very large addrGDT and addrIDT values.  Obviously, we can't have that, so we load only the low byte
+     * of the second word for both of those registers.
+     */
+    this.addrGDT = this.getShort(0x84E) | (this.getByte(0x850) << 16);
+    this.addrGDTLimit = this.addrGDT + this.getShort(0x852);
+    this.addrIDT = this.getShort(0x85A) | (this.getByte(0x85C) << 16);
+    this.addrIDTLimit = this.addrIDT + this.getShort(0x85E);
+    this.segLDT.loadDesc6(0x854, this.getShort(0x81C));
+    this.segTSS.loadDesc6(0x860, this.getShort(0x816));
+
+    /*
+     * Oddly, the above Intel document gives two contradictory cycle counts for LOADALL: 190 and 195.
+     * I'm going with 195, since both the PC Magazine Programmer's Technical Reference and Robert Collins
+     * (http://www.rcollins.org/articles/loadall/tspec_a3_doc.html) agree.
+     */
+    this.nStepCycles -= 195;
+
+    /*
+     * TODO: LOADALL operation still needs to be verified in protected mode....
+     */
+    if (DEBUG && DEBUGGER && (this.regCR0 & X86.CR0.MSW.PE)) this.stopCPU();
+};
+
+/**
+ * opCLTS()
+ *
+ * op=0x0F,0x06 (CLTS)
+ *
+ * @this {X86CPU}
+ */
+X86.opCLTS = function()
+{
+    /*
+     * NOTE: The following code shouldn't need to also test X86.PS.VM, because V86-mode is CPL 3.
+     */
+    if (this.nCPL) {
+        X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0);
+        return;
+    }
+    this.regCR0 &= ~X86.CR0.MSW.TS;
+    this.nStepCycles -= 2;
+};
+
+/**
+ * opLOADALL386()
+ *
+ * op=0x0F,0x07 (LOADALL ES:[EDI])
+ *
+ * Excerpt from Intel Internal Correspondence on "386 LOADALL Instruction" (undated), available as part of the
+ * PCjs Project at http://www.pcjs.org/pubs/pc/reference/intel/80386/loadall/
+ *
+ *      1.5. 386 LOADALL Memory Format
+ *
+ *      The following tables define the LOADALL memory format. The LOADALL instruction uses a 512-byte block of
+ *      memory, where the lowest addressed byte is given in ES:[(E)DI]. The area above offset CC hex is used for
+ *      processor dependent registers (temporaries, invisible registers). These are loaded into the processor,
+ *      but will not affect normal program execution. All values in the memory area are read from a four byte field,
+ *      to keep the memory format DWORD aligned, but it is possible to locate memory area at a non-aligned address.
+ *      In this case, the execution time of LOADALL will DOUBLE For this reason, the memory dump area should always
+ *      be DWORD aligned.
+ *
+ *         Offset         Register
+ *         ------         --------
+ *          0x00            CR0
+ *          0x04            EFLAGS
+ *          0x08            EIP
+ *          0x0C            EDI
+ *          0x10            ESI
+ *          0x14            EBP
+ *          0x18            ESP
+ *          0x1C            EBX
+ *          0x20            EDX
+ *          0x24            ECX
+ *          0x28            EAX
+ *          0x2C            DR6
+ *          0x30            DR7
+ *          0x34            TSSR(TSSSelector-Word)
+ *          0x38            LDTR(LDTSelector-Word)
+ *          0x3C            GS
+ *          0x40            FS
+ *          0x44            DS
+ *          0x48            SS
+ *          0x4C            CS
+ *          0x50            ES
+ *          0x54            TSS(AR)
+ *          0x58            TSS(BASE)
+ *          0x5C            TSS(LIMIT)
+ *          0x60            IDT(AR)
+ *          0x64            IDT(BASE)
+ *          0x68            IDT(LIMIT)
+ *          0x6C            GDT(AR)
+ *          0x70            GDT(BASE)
+ *          0x74            GDT(LIMIT)
+ *          0x78            LDT(AR)
+ *          0x7C            LDT(BASE)
+ *          0x80            LDT(LIMIT)
+ *          0x84            GS(AR)
+ *          0x88            GS(BASE)
+ *          0x8C            GS(LIMIT)
+ *          0x90            FS(AR)
+ *          0x94            FS(BASE)
+ *          0x98            FS(LIMIT)
+ *          0x9C            DS(AR)
+ *          0xA0            DS(BASE)
+ *          0xA4            DS(LIMIT)
+ *          0xA8            SS(AR)
+ *          0xAC            SS(BASE)
+ *          0xB0            SS(LIMIT)
+ *          0xB4            CS(AR)
+ *          0xB8            CS(BASE)
+ *          0xBC            CS(LIMIT)
+ *          0xC0            ES(AR)
+ *          0xC4            ES(BASE)
+ *          0xC8            ES(LIMIT)
+ *
+ *      Each descriptor entry consists of 3 pieces:
+ *
+ *          AR
+ *          BASE
+ *          LIMIT
+ *
+ *      The AR part has the same format as the second dword of a segment descriptor except that only the AR byte
+ *      (bits 8-15) and the G and B/D bits (bits 23 and 22) are used. All other bits in the AR field are ignored.
+ *      The BASE and LIMIT parts contain full 32-bit values, fully expanded and unscrambled from the 386 descriptor.
+ *      In particular, the LIMIT field loaded for a page granular segment gives a byte granular limit, so should
+ *      contain the page limit*4096 plus 4095.
+ *
+ * @this {X86CPU}
+ */
+X86.opLOADALL386 = function()
+{
+    if (this.nCPL) {
+        /*
+         * To use LOADALL, CPL must be zero.
+         */
+        X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0, 0, true);
+        return;
+    }
+    var addr = this.segES.checkRead(this.regEDI & this.maskAddr, 0xCC);
+    if (addr !== X86.ADDR_INVALID) {
+        X86.helpLoadCR0.call(this, this.getLong(addr));
+        /*
+         * We need to call setPS() before loading any segment registers, because if the Virtual 8086 Mode (VM)
+         * bit is set in EFLAGS, the segment registers need to know that.
+         */
+        var accSS = this.getLong(addr + 0xA8);
+        var cpl = (accSS & X86.DESC.ACC.DPL.MASK) >> X86.DESC.ACC.DPL.SHIFT;
+        this.setPS(this.getLong(addr + 0x04), cpl);
+        /*
+         * TODO: We have no use for the GDT(AR) at offset 0x6C or the IDT(AR) at offset 0x60, because
+         * we don't manage them as segment registers.  Should we?
+         */
+        this.addrGDT = this.getLong(addr + 0x70);
+        this.addrGDTLimit = this.addrGDT + this.getLong(addr + 0x74);
+        this.addrIDT = this.getLong(addr + 0x64);
+        this.addrIDTLimit = this.addrIDT + this.getLong(addr + 0x68);
+        this.segLDT.loadDesc(this.getLong(addr + 0x38), this.getLong(addr + 0x78), this.getLong(addr + 0x7C), this.getLong(addr + 0x80));
+        this.segTSS.loadDesc(this.getLong(addr + 0x34), this.getLong(addr + 0x54), this.getLong(addr + 0x58), this.getLong(addr + 0x5C));
+        this.regEDI = this.getLong(addr + 0x0C);
+        this.regESI = this.getLong(addr + 0x10);
+        this.regEBP = this.getLong(addr + 0x14);
+        this.regEBX = this.getLong(addr + 0x1C);
+        this.regEDX = this.getLong(addr + 0x20);
+        this.regECX = this.getLong(addr + 0x24);
+        this.regEAX = this.getLong(addr + 0x28);
+        this.segGS.loadDesc(this.getLong(addr + 0x3C), this.getLong(addr + 0x84), this.getLong(addr + 0x88), this.getLong(addr + 0x8C));
+        this.segFS.loadDesc(this.getLong(addr + 0x40), this.getLong(addr + 0x90), this.getLong(addr + 0x94), this.getLong(addr + 0x98));
+        this.segDS.loadDesc(this.getLong(addr + 0x44), this.getLong(addr + 0x9C), this.getLong(addr + 0xA0), this.getLong(addr + 0xA4));
+        this.segSS.loadDesc(this.getLong(addr + 0x48), accSS,                     this.getLong(addr + 0xAC), this.getLong(addr + 0xB0));
+        this.segCS.loadDesc(this.getLong(addr + 0x4C), this.getLong(addr + 0xB4), this.getLong(addr + 0xB8), this.getLong(addr + 0xBC));
+        this.segES.loadDesc(this.getLong(addr + 0x50), this.getLong(addr + 0xC0), this.getLong(addr + 0xC4), this.getLong(addr + 0xC8));
+        /*
+         * It's important to call setIP() and setSP() *after* the segCS and segSS loads, so that the CPU's
+         * linear IP and SP registers (regLIP and regLSP) will be updated properly.  Ordinarily that would be
+         * taken care of by simply using the CPU's setCS() and setSS() functions, but those functions call the
+         * default descriptor load() functions, and obviously here we must use loadDesc() instead.
+         */
+        this.setIP(this.getLong(addr + 0x08));
+        this.setSP(this.getLong(addr + 0x18));
+        /*
+         * TODO: We need to factor out the code that updates DR6 and DR7 from X86.opMOVdr(), so that we can
+         * more easily update DR6 and DR7 (which we're simply ignoring for now).
+         */
+    }
+
+    /*
+     * According to Robert Collins (http://www.rcollins.org/articles/loadall/tspec_a3_doc.html), the 80386 LOADALL
+     * takes 122 cycles.  Also, according the above-mentioned Intel document, if the memory buffer is not DWORD aligned,
+     * execution time will DOUBLE.
+     */
+    this.nStepCycles -= (122 << ((addr & 0x3)? 1 : 0));
+};
+
+/**
+ * opMOVrc()
+ *
+ * op=0x0F,0x20 (MOV reg,ctlreg)
+ *
+ * NOTE: Since this instruction uses only 32-bit general-purpose registers, our ModRM decoders
+ * are going to be more hindrance than help, so we fully decode and execute the instruction ourselves.
+ *
+ * From PCMag_Prog_TechRef, p.476: "The 80386 executes the MOV to/from control registers (CRn) regardless
+ * of the setting of the MOD field.  The MOD field should be set to 11, but an early 80386 documentation
+ * error indicated that the MOD field value was a don't care.  Early versions of the 80486 detect
+ * a MOD != 11 as an illegal opcode.  This was changed in later versions to ignore the value of MOD.
+ * Assemblers that generate MOD != 11 for these instructions will fail on some 80486s."
+ *
+ * And in fact, the COMPAQ DeskPro 386 ROM BIOS executes this instruction with MOD set to 00, so we have
+ * to ignore it.
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVrc = function()
+{
+    /*
+     * NOTE: The following code shouldn't need to also test X86.PS.VM, because V86-mode is CPL 3.
+     */
+    if (this.nCPL) {
+        /*
+         * You're not allowed to read control registers if the current privilege level is not zero.
+         */
+        X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0);
+        return;
+    }
+
+    var reg;
+    var bModRM = this.getIPByte();
+    switch((bModRM & 0x38) >> 3) {
+    case 0x0:
+        reg = this.regCR0;
+        break;
+    case 0x2:
+        reg = this.regCR2;
+        break;
+    case 0x3:
+        reg = this.regCR3;
+        break;
+    default:
+        X86.opUndefined.call(this);
+        return;
+    }
+
+    this.setReg(bModRM & 0x7, reg);
+
+    this.nStepCycles -= 6;
+
+    /*
+     * TODO: Implement BACKTRACK for this instruction (although Control registers are not likely to be a conduit for interesting data).
+     */
+};
+
+/**
+ * opMOVrd()
+ *
+ * op=0x0F,0x21 (MOV reg,dbgreg)
+ *
+ * NOTE: Since this instruction uses only 32-bit general-purpose registers, our ModRM decoders
+ * are going to be more hindrance than help, so we fully decode and execute the instruction ourselves.
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVrd = function()
+{
+    /*
+     * NOTE: The following code shouldn't need to also test X86.PS.VM, because V86-mode is CPL 3.
+     */
+    if (this.nCPL) {
+        /*
+         * You're not allowed to read control registers if the current privilege level is not zero.
+         */
+        X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0);
+        return;
+    }
+
+    var bModRM = this.getIPByte();
+    var iSrc = (bModRM & 0x38) >> 3;
+
+    if (iSrc == 4 || iSrc == 5) {
+        X86.opUndefined.call(this);
+        return;
+    }
+
+    this.setReg(bModRM & 0x7, this.regDR[iSrc]);
+
+    this.nStepCycles -= 22;
+
+    /*
+     * TODO: Implement BACKTRACK for this instruction (although Debug registers are not likely to be a conduit for interesting data).
+     */
+};
+
+/**
+ * opMOVcr()
+ *
+ * op=0x0F,0x22 (MOV ctlreg,reg)
+ *
+ * NOTE: Since this instruction uses only 32-bit general-purpose registers, our ModRM decoders
+ * are going to be more hindrance than help, so we fully decode and execute the instruction ourselves.
+ *
+ * From PCMag_Prog_TechRef, p.476: "The 80386 executes the MOV to/from control registers (CRn) regardless
+ * of the setting of the MOD field.  The MOD field should be set to 11, but an early 80386 documentation
+ * error indicated that the MOD field value was a don't care.  Early versions of the 80486 detect
+ * a MOD != 11 as an illegal opcode.  This was changed in later versions to ignore the value of MOD.
+ * Assemblers that generate MOD != 11 for these instructions will fail on some 80486s."
+ *
+ * And in fact, the COMPAQ DeskPro 386 ROM BIOS executes this instruction with MOD set to 00, so we have
+ * to ignore it.
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVcr = function()
+{
+    /*
+     * NOTE: The following code shouldn't need to also test X86.PS.VM, because V86-mode is CPL 3.
+     */
+    if (this.nCPL) {
+        /*
+         * You're not allowed to write control registers if the current privilege level is not zero.
+         */
+        X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0);
+        return;
+    }
+
+    var bModRM = this.getIPByte();
+    var reg = this.getReg(bModRM & 0x7);
+
+    switch((bModRM & 0x38) >> 3) {
+    case 0x0:
+        X86.helpLoadCR0.call(this, reg);
+        this.nStepCycles -= 10;
+        break;
+    case 0x2:
+        this.regCR2 = reg;
+        this.nStepCycles -= 4;
+        break;
+    case 0x3:
+        X86.helpLoadCR3.call(this, reg);
+        this.nStepCycles -= 5;
+        break;
+    default:
+        X86.opUndefined.call(this);
+        return;
+    }
+
+    /*
+     * TODO: Implement BACKTRACK for this instruction (although Control registers are not likely to be a conduit for interesting data).
+     */
+};
+
+/**
+ * opMOVdr()
+ *
+ * op=0x0F,0x23 (MOV dbgreg,reg)
+ *
+ * NOTE: Since this instruction uses only 32-bit general-purpose registers, our ModRM decoders
+ * are going to be more hindrance than help, so we fully decode and execute the instruction ourselves.
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVdr = function()
+{
+    /*
+     * NOTE: The following code shouldn't need to also test X86.PS.VM, because V86-mode is CPL 3.
+     */
+    if (this.nCPL) {
+        /*
+         * You're not allowed to write control registers if the current privilege level is not zero.
+         */
+        X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0);
+        return;
+    }
+
+    var bModRM = this.getIPByte();
+    var iDst = (bModRM & 0x38) >> 3;
+
+    if (iDst == 4 || iDst == 5) {
+        X86.opUndefined.call(this);
+        return;
+    }
+
+    var regDR = this.getReg(bModRM & 0x7);
+
+    if (regDR != this.regDR[iDst]) {
+        this.checkDebugRegisters(false);
+        this.regDR[iDst] = regDR;
+        this.checkDebugRegisters(true);
+    }
+
+    this.nStepCycles -= (iDst < 4? 22 : 14);
+
+    /*
+     * TODO: Implement BACKTRACK for this instruction (although Debug registers are not likely to be a conduit for interesting data).
+     */
+};
+
+/**
+ * opMOVrt()
+ *
+ * op=0x0F,0x24 (MOV reg,tstreg)
+ *
+ * NOTE: Since this instruction uses only 32-bit general-purpose registers, our ModRM decoders
+ * are going to be more hindrance than help, so we fully decode and execute the instruction ourselves.
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVrt = function()
+{
+    /*
+     * NOTE: The following code shouldn't need to also test X86.PS.VM, because V86-mode is CPL 3.
+     */
+    if (this.nCPL) {
+        /*
+         * You're not allowed to read control registers if the current privilege level is not zero.
+         */
+        X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0);
+        return;
+    }
+
+    var bModRM = this.getIPByte();
+    var iSrc = (bModRM & 0x38) >> 3;
+
+    /*
+     * Only TR6 and TR7 are defined, and only for the 80386 and 80486.  From the PC Magazine Prog. TechRef, p.64:
+     *
+     *  "The 80386 provides two 32-bit test registers, TR6 and TR7, as a mechanism for programmers to verify proper
+     *   operation of the Translation Lookaside Buffer (TLB) when power is applied to the chip. The TLB is a cache used
+     *   internally by the 80386 to translate linear addresses to physical addresses."
+     */
+    if (iSrc < 6) {
+        X86.opUndefined.call(this);
+        return;
+    }
+
+    this.setReg(bModRM & 0x7, this.regTR[iSrc]);
+    this.nStepCycles -= 12;
+
+    /*
+     * TODO: Implement BACKTRACK for this instruction (although Test registers are not likely to be a conduit for interesting data).
+     */
+};
+
+/**
+ * opMOVtr()
+ *
+ * op=0x0F,0x26 (MOV tstreg,reg)
+ *
+ * NOTE: Since this instruction uses only 32-bit general-purpose registers, our ModRM decoders
+ * are going to be more hindrance than help, so we fully decode and execute the instruction ourselves.
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVtr = function()
+{
+    /*
+     * NOTE: The following code shouldn't need to also test X86.PS.VM, because V86-mode is CPL 3.
+     */
+    if (this.nCPL) {
+        /*
+         * You're not allowed to write control registers if the current privilege level is not zero.
+         */
+        X86.helpFault.call(this, X86.EXCEPTION.GP_FAULT, 0);
+        return;
+    }
+
+    var bModRM = this.getIPByte();
+    var iDst = (bModRM & 0x38) >> 3;
+
+    /*
+     * Only TR6 and TR7 are defined, and only for the 80386 and 80486.  From the PC Magazine Prog. TechRef, p.64:
+     *
+     *  "The 80386 provides two 32-bit test registers, TR6 and TR7, as a mechanism for programmers to verify proper
+     *   operation of the Translation Lookaside Buffer (TLB) when power is applied to the chip. The TLB is a cache used
+     *   internally by the 80386 to translate linear addresses to physical addresses."
+     */
+    if (iDst < 6) {
+        X86.opUndefined.call(this);
+        return;
+    }
+
+    /*
+     * TODO: Do something useful with the Test registers.
+     */
+    this.regTR[iDst] = this.getReg(bModRM & 0x7);
+
+    this.nStepCycles -= 12;
+
+    /*
+     * TODO: Implement BACKTRACK for this instruction (although Test registers are not likely to be a conduit for interesting data).
+     */
+};
+
+/*
+ * NOTE: The following 16 new conditional jumps actually rely on the OPERAND override setting
+ * for determining whether a signed 16-bit or 32-bit displacement will be fetched, even though
+ * the ADDRESS override might seem more intuitive.  Think of them as instructions that are loading
+ * a new operand into IP/EIP.
+ *
+ * Also, in 16-bit code, even though a signed rel16 value would seem to imply a range of -32768
+ * to +32767, any location within a 64Kb code segment outside that range can be reached by choosing
+ * a displacement in the opposite direction, causing the 16-bit value in EIP to underflow or overflow;
+ * any underflow or overflow doesn't matter, because only the low 16 bits of EIP are updated when a
+ * 16-bit OPERAND size is in effect.
+ *
+ * In fact, for 16-bit jumps, it's simpler to always think of rel16 as an UNSIGNED value added to
+ * the current EIP, where the result is then truncated to a 16-bit value.  This is why we don't have
+ * to sign-extend rel16 before adding it to the current EIP.
+ */
+
+/**
+ * opJOw()
+ *
+ * op=0x0F,0x80 (JO rel16/rel32)
+ *
+ * @this {X86CPU}
+ */
+X86.opJOw = function()
+{
+    var disp = this.getIPWord();
+    if (this.getOF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * opJNOw()
+ *
+ * op=0x0F,0x81 (JNO rel16/rel32)
+ *
+ * @this {X86CPU}
+ */
+X86.opJNOw = function()
+{
+    var disp = this.getIPWord();
+    if (!this.getOF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * opJCw()
+ *
+ * op=0x0F,0x82 (JC rel16/rel32)
+ *
+ * @this {X86CPU}
+ */
+X86.opJCw = function()
+{
+    var disp = this.getIPWord();
+    if (this.getCF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * opJNCw()
+ *
+ * op=0x0F,0x83 (JNC rel16/rel32)
+ *
+ * @this {X86CPU}
+ */
+X86.opJNCw = function()
+{
+    var disp = this.getIPWord();
+    if (!this.getCF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * opJZw()
+ *
+ * op=0x0F,0x84 (JZ rel16/rel32)
+ *
+ * @this {X86CPU}
+ */
+X86.opJZw = function()
+{
+    var disp = this.getIPWord();
+    if (this.getZF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * opJNZw()
+ *
+ * op=0x0F,0x85 (JNZ rel16/rel32)
+ *
+ * @this {X86CPU}
+ */
+X86.opJNZw = function()
+{
+    var disp = this.getIPWord();
+    if (!this.getZF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * opJBEw()
+ *
+ * op=0x0F,0x86 (JBE rel16/rel32)
+ *
+ * @this {X86CPU}
+ */
+X86.opJBEw = function()
+{
+    var disp = this.getIPWord();
+    if (this.getCF() || this.getZF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * opJNBEw()
+ *
+ * op=0x0F,0x87 (JNBE rel16/rel32)
+ *
+ * @this {X86CPU}
+ */
+X86.opJNBEw = function()
+{
+    var disp = this.getIPWord();
+    if (!this.getCF() && !this.getZF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * opJSw()
+ *
+ * op=0x0F,0x88 (JS rel16/rel32)
+ *
+ * @this {X86CPU}
+ */
+X86.opJSw = function()
+{
+    var disp = this.getIPWord();
+    if (this.getSF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * opJNSw()
+ *
+ * op=0x0F,0x89 (JNS rel16/rel32)
+ *
+ * @this {X86CPU}
+ */
+X86.opJNSw = function()
+{
+    var disp = this.getIPWord();
+    if (!this.getSF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * opJPw()
+ *
+ * op=0x0F,0x8A (JP rel16/rel32)
+ *
+ * @this {X86CPU}
+ */
+X86.opJPw = function()
+{
+    var disp = this.getIPWord();
+    if (this.getPF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * opJNPw()
+ *
+ * op=0x0F,0x8B (JNP rel16/rel32)
+ *
+ * @this {X86CPU}
+ */
+X86.opJNPw = function()
+{
+    var disp = this.getIPWord();
+    if (!this.getPF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * opJLw()
+ *
+ * op=0x0F,0x8C (JL rel16/rel32)
+ *
+ * @this {X86CPU}
+ */
+X86.opJLw = function()
+{
+    var disp = this.getIPWord();
+    if (!this.getSF() != !this.getOF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * opJNLw()
+ *
+ * op=0x0F,0x8D (JNL rel16/rel32)
+ *
+ * @this {X86CPU}
+ */
+X86.opJNLw = function()
+{
+    var disp = this.getIPWord();
+    if (!this.getSF() == !this.getOF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * opJLEw()
+ *
+ * op=0x0F,0x8E (JLE rel16/rel32)
+ *
+ * @this {X86CPU}
+ */
+X86.opJLEw = function()
+{
+    var disp = this.getIPWord();
+    if (this.getZF() || !this.getSF() != !this.getOF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * opJNLEw()
+ *
+ * op=0x0F,0x8F (JNLE rel16/rel32)
+ *
+ * @this {X86CPU}
+ */
+X86.opJNLEw = function()
+{
+    var disp = this.getIPWord();
+    if (!this.getZF() && !this.getSF() == !this.getOF()) {
+        this.setIP(this.getIP() + disp);
+        this.nStepCycles -= this.cycleCounts.nOpCyclesJmpC;
+        return;
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesJmpCFall;
+};
+
+/**
+ * opSETO()
+ *
+ * op=0x0F,0x90 (SETO b)
+ *
+ * @this {X86CPU}
+ */
+X86.opSETO = function()
+{
+    X86.helpSETcc.call(this, X86.fnSETO);
+};
+
+/**
+ * opSETNO()
+ *
+ * op=0x0F,0x91 (SETNO b)
+ *
+ * @this {X86CPU}
+ */
+X86.opSETNO = function()
+{
+    X86.helpSETcc.call(this, X86.fnSETO);
+};
+
+/**
+ * opSETC()
+ *
+ * op=0x0F,0x92 (SETC b)
+ *
+ * @this {X86CPU}
+ */
+X86.opSETC = function()
+{
+    X86.helpSETcc.call(this, X86.fnSETC);
+};
+
+/**
+ * opSETNC()
+ *
+ * op=0x0F,0x93 (SETNC b)
+ *
+ * @this {X86CPU}
+ */
+X86.opSETNC = function()
+{
+    X86.helpSETcc.call(this, X86.fnSETNC);
+};
+
+/**
+ * opSETZ()
+ *
+ * op=0x0F,0x94 (SETZ b)
+ *
+ * @this {X86CPU}
+ */
+X86.opSETZ = function()
+{
+    X86.helpSETcc.call(this, X86.fnSETZ);
+};
+
+/**
+ * opSETNZ()
+ *
+ * op=0x0F,0x95 (SETNZ b)
+ *
+ * @this {X86CPU}
+ */
+X86.opSETNZ = function()
+{
+    X86.helpSETcc.call(this, X86.fnSETNZ);
+};
+
+/**
+ * opSETBE()
+ *
+ * op=0x0F,0x96 (SETBE b)
+ *
+ * @this {X86CPU}
+ */
+X86.opSETBE = function()
+{
+    X86.helpSETcc.call(this, X86.fnSETBE);
+};
+
+/**
+ * opSETNBE()
+ *
+ * op=0x0F,0x97 (SETNBE b)
+ *
+ * @this {X86CPU}
+ */
+X86.opSETNBE = function()
+{
+    X86.helpSETcc.call(this, X86.fnSETNBE);
+};
+
+/**
+ * opSETS()
+ *
+ * op=0x0F,0x98 (SETS b)
+ *
+ * @this {X86CPU}
+ */
+X86.opSETS = function()
+{
+    X86.helpSETcc.call(this, X86.fnSETS);
+};
+
+/**
+ * opSETNS()
+ *
+ * op=0x0F,0x99 (SETNS b)
+ *
+ * @this {X86CPU}
+ */
+X86.opSETNS = function()
+{
+    X86.helpSETcc.call(this, X86.fnSETNS);
+};
+
+/**
+ * opSETP()
+ *
+ * op=0x0F,0x9A (SETP b)
+ *
+ * @this {X86CPU}
+ */
+X86.opSETP = function()
+{
+    X86.helpSETcc.call(this, X86.fnSETP);
+};
+
+/**
+ * opSETNP()
+ *
+ * op=0x0F,0x9B (SETNP b)
+ *
+ * @this {X86CPU}
+ */
+X86.opSETNP = function()
+{
+    X86.helpSETcc.call(this, X86.fnSETNP);
+};
+
+/**
+ * opSETL()
+ *
+ * op=0x0F,0x9C (SETL b)
+ *
+ * @this {X86CPU}
+ */
+X86.opSETL = function()
+{
+    X86.helpSETcc.call(this, X86.fnSETL);
+};
+
+/**
+ * opSETNL()
+ *
+ * op=0x0F,0x9D (SETNL b)
+ *
+ * @this {X86CPU}
+ */
+X86.opSETNL = function()
+{
+    X86.helpSETcc.call(this, X86.fnSETNL);
+};
+
+/**
+ * opSETLE()
+ *
+ * op=0x0F,0x9E (SETLE b)
+ *
+ * @this {X86CPU}
+ */
+X86.opSETLE = function()
+{
+    X86.helpSETcc.call(this, X86.fnSETLE);
+};
+
+/**
+ * opSETNLE()
+ *
+ * op=0x0F,0x9F (SETNLE b)
+ *
+ * @this {X86CPU}
+ */
+X86.opSETNLE = function()
+{
+    X86.helpSETcc.call(this, X86.fnSETNLE);
+};
+
+/**
+ * opPUSHFS()
+ *
+ * op=0x0F,0xA0 (PUSH FS)
+ *
+ * @this {X86CPU}
+ */
+X86.opPUSHFS = function()
+{
+    /*
+     * When the OPERAND size is 32 bits, the 80386 will decrement the stack pointer by 4, write the selector
+     * into the 2 lower bytes, and leave the 2 upper bytes untouched; to properly emulate that, we must use the
+     * more generic pushData() instead of pushWord().
+     */
+    if (!I386) {
+        this.pushWord(this.segFS.sel);
+    } else {
+        this.pushData(this.segFS.sel, this.sizeData, 2);
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPushSeg;
+};
+
+/**
+ * opPOPFS()
+ *
+ * op=0x0F,0xA1 (POP FS)
+ *
+ * @this {X86CPU}
+ */
+X86.opPOPFS = function()
+{
+    /*
+     * Any operation that modifies the stack before loading a new segment must snapshot regLSP first.
+     */
+    this.opLSP = this.regLSP;
+    this.setFS(this.popWord());
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPopReg;
+    this.opLSP = X86.ADDR_INVALID;
+};
+
+/**
+ * opBT()
+ *
+ * op=0x0F,0xA3 (BT mem/reg,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opBT = function()
+{
+    this.decodeModMemWord.call(this, X86.fnBTMem);
+    if (this.regEA !== X86.ADDR_INVALID) this.nStepCycles -= 6;
+};
+
+/**
+ * opSHLDn()
+ *
+ * op=0x0F,0xA4 (SHLD mem/reg,reg,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opSHLDn = function()
+{
+    this.decodeModMemWord.call(this, this.sizeData == 2? X86.fnSHLDwi : X86.fnSHLDdi);
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 3 : 7);
+};
+
+/**
+ * opSHLDcl()
+ *
+ * op=0x0F,0xA5 (SHLD mem/reg,reg,CL)
+ *
+ * @this {X86CPU}
+ */
+X86.opSHLDcl = function()
+{
+    this.decodeModMemWord.call(this, this.sizeData == 2? X86.fnSHLDwCL : X86.fnSHLDdCL);
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 3 : 7);
+};
+
+/**
+ * opXBTS()
+ *
+ * op=0x0F,0xA6 (XBTS reg,mem/reg,[E]AX,CL)
+ *
+ * @this {X86CPU}
+ */
+X86.opXBTS = function()
+{
+    this.decodeModRegWord.call(this, X86.fnXBTS);
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 6 : 13);
+};
+
+/**
+ * opIBTS()
+ *
+ * op=0x0F,0xA7 (IBTS mem/reg,[E]AX,CL,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opIBTS = function()
+{
+    this.decodeModMemWord.call(this, X86.fnIBTS);
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 12 : 19);
+};
+
+/**
+ * opPUSHGS()
+ *
+ * op=0x0F,0xA8 (PUSH GS)
+ *
+ * @this {X86CPU}
+ */
+X86.opPUSHGS = function()
+{
+    /*
+     * When the OPERAND size is 32 bits, the 80386 will decrement the stack pointer by 4, write the selector
+     * into the 2 lower bytes, and leave the 2 upper bytes untouched; to properly emulate that, we must use the
+     * more generic pushData() instead of pushWord().
+     */
+    if (!I386) {
+        this.pushWord(this.segGS.sel);
+    } else {
+        this.pushData(this.segGS.sel, this.sizeData, 2);
+    }
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPushSeg;
+};
+
+/**
+ * opPOPGS()
+ *
+ * op=0x0F,0xA9 (POP GS)
+ *
+ * @this {X86CPU}
+ */
+X86.opPOPGS = function()
+{
+    /*
+     * Any operation that modifies the stack before loading a new segment must snapshot regLSP first.
+     */
+    this.opLSP = this.regLSP;
+    this.setGS(this.popWord());
+    this.nStepCycles -= this.cycleCounts.nOpCyclesPopReg;
+    this.opLSP = X86.ADDR_INVALID;
+};
+
+/**
+ * opBTS()
+ *
+ * op=0x0F,0xAB (BTC mem/reg,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opBTS = function()
+{
+    this.decodeModMemWord.call(this, X86.fnBTSMem);
+    if (this.regEA !== X86.ADDR_INVALID) this.nStepCycles -= 5;
+};
+
+/**
+ * opSHRDn()
+ *
+ * op=0x0F,0xAC (SHRD mem/reg,reg,imm8)
+ *
+ * @this {X86CPU}
+ */
+X86.opSHRDn = function()
+{
+    this.decodeModMemWord.call(this, this.sizeData == 2? X86.fnSHRDwi : X86.fnSHRDdi);
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 3 : 7);
+};
+
+/**
+ * opSHRDcl()
+ *
+ * op=0x0F,0xAD (SHRD mem/reg,reg,CL)
+ *
+ * @this {X86CPU}
+ */
+X86.opSHRDcl = function()
+{
+    this.decodeModMemWord.call(this, this.sizeData == 2? X86.fnSHRDwCL : X86.fnSHRDdCL);
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 3 : 7);
+};
+
+/**
+ * opIMUL()
+ *
+ * op=0x0F,0xAF (IMUL reg,mem/reg) (80386 and up)
+ *
+ * @this {X86CPU}
+ */
+X86.opIMUL = function()
+{
+    this.decodeModRegWord.call(this, this.sizeData == 2? X86.fnIMULrw : X86.fnIMULrd);
+};
+
+/**
+ * opLSS()
+ *
+ * op=0x0F,0xB2 (LSS reg,word)
+ *
+ * This is like a "MOV reg,rm" operation, but it also loads SS from the next word.
+ *
+ * @this {X86CPU}
+ */
+X86.opLSS = function()
+{
+    this.decodeModRegWord.call(this, X86.fnLSS);
+};
+
+/**
+ * opBTR()
+ *
+ * op=0x0F,0xB3 (BTC mem/reg,reg) (80386 and up)
+ *
+ * @this {X86CPU}
+ */
+X86.opBTR = function()
+{
+    this.decodeModMemWord.call(this, X86.fnBTRMem);
+    if (this.regEA !== X86.ADDR_INVALID) this.nStepCycles -= 5;
+};
+
+/**
+ * opLFS()
+ *
+ * op=0x0F,0xB4 (LFS reg,word)
+ *
+ * This is like a "MOV reg,rm" operation, but it also loads FS from the next word.
+ *
+ * @this {X86CPU}
+ */
+X86.opLFS = function()
+{
+    this.decodeModRegWord.call(this, X86.fnLFS);
+};
+
+/**
+ * opLGS()
+ *
+ * op=0x0F,0xB5 (LGS reg,word)
+ *
+ * This is like a "MOV reg,rm" operation, but it also loads GS from the next word.
+ *
+ * @this {X86CPU}
+ */
+X86.opLGS = function()
+{
+    this.decodeModRegWord.call(this, X86.fnLGS);
+};
+
+/**
+ * opMOVZXb()
+ *
+ * op=0x0F,0xB6 (MOVZX reg,byte)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVZXb = function()
+{
+    this.decodeModRegByte.call(this, X86.fnMOVXb);
+    var reg = (this.bModRM >> 3) & 0x7;
+    switch(reg) {
+    case 0x0:
+        this.regEAX = (this.regEAX & ~this.maskData) | (this.regEAX & 0xff);
+        break;
+    case 0x1:
+        this.regECX = (this.regECX & ~this.maskData) | (this.regECX & 0xff);
+        break;
+    case 0x2:
+        this.regEDX = (this.regEDX & ~this.maskData) | (this.regEDX & 0xff);
+        break;
+    case 0x3:
+        this.regEBX = (this.regEBX & ~this.maskData) | (this.regEBX & 0xff);
+        break;
+    case 0x4:
+        this.regESP = (this.regESP & ~this.maskData) | ((this.regEAX >> 8) & 0xff);
+        this.regEAX = this.regXX;
+        break;
+    case 0x5:
+        this.regEBP = (this.regEBP & ~this.maskData) | ((this.regECX >> 8) & 0xff);
+        this.regECX = this.regXX;
+        break;
+    case 0x6:
+        this.regESI = (this.regESI & ~this.maskData) | ((this.regEDX >> 8) & 0xff);
+        this.regEDX = this.regXX;
+        break;
+    case 0x7:
+        this.regEDI = (this.regEDI & ~this.maskData) | ((this.regEBX >> 8) & 0xff);
+        this.regEBX = this.regXX;
+        break;
+    }
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 3 : 6);
+};
+
+/**
+ * opMOVZXw()
+ *
+ * op=0x0F,0xB7 (MOVZX reg,word)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVZXw = function()
+{
+    this.setDataSize(2);
+    this.decodeModRegWord.call(this, X86.fnMOVXw);
+    switch((this.bModRM >> 3) & 0x7) {
+    case 0x0:
+        this.regEAX = (this.regEAX & 0xffff);
+        break;
+    case 0x1:
+        this.regECX = (this.regECX & 0xffff);
+        break;
+    case 0x2:
+        this.regEDX = (this.regEDX & 0xffff);
+        break;
+    case 0x3:
+        this.regEBX = (this.regEBX & 0xffff);
+        break;
+    case 0x4:
+        this.regESP = (this.regESP & 0xffff);
+        break;
+    case 0x5:
+        this.regEBP = (this.regEBP & 0xffff);
+        break;
+    case 0x6:
+        this.regESI = (this.regESI & 0xffff);
+        break;
+    case 0x7:
+        this.regEDI = (this.regEDI & 0xffff);
+        break;
+    }
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 3 : 6);
+};
+
+/**
+ * op=0x0F,0xBA (GRP8 mem/reg) (80386 and up)
+ *
+ * @this {X86CPU}
+ */
+X86.opGRP8 = function()
+{
+    this.decodeModGrpWord.call(this, X86.aOpGrp8, this.getIPByte);
+};
+
+/**
+ * opBTC()
+ *
+ * op=0x0F,0xBB (BTC mem/reg,reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opBTC = function()
+{
+    this.decodeModMemWord.call(this, X86.fnBTCMem);
+    if (this.regEA !== X86.ADDR_INVALID) this.nStepCycles -= 5;
+};
+
+/**
+ * opBSF()
+ *
+ * op=0x0F,0xBC (BSF reg,mem/reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opBSF = function()
+{
+    this.decodeModRegWord.call(this, X86.fnBSF);
+};
+
+/**
+ * opBSR()
+ *
+ * op=0x0F,0xBD (BSR reg,mem/reg)
+ *
+ * @this {X86CPU}
+ */
+X86.opBSR = function()
+{
+    this.decodeModRegWord.call(this, X86.fnBSR);
+};
+
+/**
+ * opMOVSXb()
+ *
+ * op=0x0F,0xBE (MOVSX reg,byte)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVSXb = function()
+{
+    this.decodeModRegByte.call(this, X86.fnMOVXb);
+    var reg = (this.bModRM >> 3) & 0x7;
+    switch(reg) {
+    case 0x0:
+        this.regEAX = (this.regEAX & ~this.maskData) | ((((this.regEAX & 0xff) << 24) >> 24) & this.maskData);
+        break;
+    case 0x1:
+        this.regECX = (this.regECX & ~this.maskData) | ((((this.regECX & 0xff) << 24) >> 24) & this.maskData);
+        break;
+    case 0x2:
+        this.regEDX = (this.regEDX & ~this.maskData) | ((((this.regEDX & 0xff) << 24) >> 24) & this.maskData);
+        break;
+    case 0x3:
+        this.regEBX = (this.regEBX & ~this.maskData) | ((((this.regEBX & 0xff) << 24) >> 24) & this.maskData);
+        break;
+    case 0x4:
+        this.regESP = (this.regESP & ~this.maskData) | (((this.regEAX << 16) >> 24) & this.maskData);
+        this.regEAX = this.regXX;
+        break;
+    case 0x5:
+        this.regEBP = (this.regEBP & ~this.maskData) | (((this.regECX << 16) >> 24) & this.maskData);
+        this.regECX = this.regXX;
+        break;
+    case 0x6:
+        this.regESI = (this.regESI & ~this.maskData) | (((this.regEDX << 16) >> 24) & this.maskData);
+        this.regEDX = this.regXX;
+        break;
+    case 0x7:
+        this.regEDI = (this.regEDI & ~this.maskData) | (((this.regEBX << 16) >> 24) & this.maskData);
+        this.regEBX = this.regXX;
+        break;
+    }
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 3 : 6);
+};
+
+/**
+ * opMOVSXw()
+ *
+ * op=0x0F,0xBF (MOVSX reg,word)
+ *
+ * @this {X86CPU}
+ */
+X86.opMOVSXw = function()
+{
+    this.setDataSize(2);
+    this.decodeModRegWord.call(this, X86.fnMOVXw);
+    switch((this.bModRM >> 3) & 0x7) {
+    case 0x0:
+        this.regEAX = ((this.regEAX << 16) >> 16);
+        break;
+    case 0x1:
+        this.regECX = ((this.regECX << 16) >> 16);
+        break;
+    case 0x2:
+        this.regEDX = ((this.regEDX << 16) >> 16);
+        break;
+    case 0x3:
+        this.regEBX = ((this.regEBX << 16) >> 16);
+        break;
+    case 0x4:
+        this.regESP = ((this.regESP << 16) >> 16);
+        break;
+    case 0x5:
+        this.regEBP = ((this.regEBP << 16) >> 16);
+        break;
+    case 0x6:
+        this.regESI = ((this.regESI << 16) >> 16);
+        break;
+    case 0x7:
+        this.regEDI = ((this.regEDI << 16) >> 16);
+        break;
+    }
+    this.nStepCycles -= (this.regEA === X86.ADDR_INVALID? 3 : 6);
+};
+
+X86.aOps0F = new Array(256);
+
+X86.aOps0F[0x00] = X86.opGRP6;
+X86.aOps0F[0x01] = X86.opGRP7;
+X86.aOps0F[0x02] = X86.opLAR;
+X86.aOps0F[0x03] = X86.opLSL;
+X86.aOps0F[0x05] = X86.opLOADALL286;
+X86.aOps0F[0x06] = X86.opCLTS;
+
+/*
+ * On all processors (except the 8086/8088, of course), X86.OPCODE.UD2 (0x0F,0x0B), aka "UD2", is an
+ * instruction guaranteed to raise a #UD (Invalid Opcode) exception (INT 0x06) on all post-8086 processors.
+ */
+X86.aOps0F[0x0B] = X86.opInvalid;
+
+/*
+ * The following 0x0F opcodes are of no consequence to us, since they were all introduced post-80386;
+ * 0x0F,0xA6 and 0x0F,0xA7 were introduced on some 80486 processors (and then deprecated), while 0x0F,0xB0
+ * and 0x0F,0xB1 were introduced on 80586 (aka Pentium) processors.
+ *
+ *      CMPXCHG r/m8,reg8           ; 0F B0 /r          [PENT]
+ *      CMPXCHG r/m16,reg16         ; o16 0F B1 /r      [PENT]
+ *      CMPXCHG r/m32,reg32         ; o32 0F B1 /r      [PENT]
+ *      CMPXCHG486 r/m8,reg8        ; 0F A6 /r          [486,UNDOC]
+ *      CMPXCHG486 r/m16,reg16      ; o16 0F A7 /r      [486,UNDOC]
+ *      CMPXCHG486 r/m32,reg32      ; o32 0F A7 /r      [486,UNDOC]
+ *
+ * So why are we even mentioning them here? Only because some software (eg, Windows 3.00) attempts to execute
+ * 0x0F,0xA6, so we need to explicitly mark it as invalid.  TODO: Purely out of curiosity, I would like to
+ * eventually learn *why* Windows 3.00 does this; is it hoping to use the CMPXCHG486 opcode, or is it performing
+ * a CPU/stepping check to detect/work-around some errata, or....?
+ */
+X86.aOps0F[0xA6] = X86.opInvalid;
+
+/*
+ * When Windows 95 Setup initializes in protected-mode, it sets a DPMI exception handler for UD_FAULT and
+ * then attempts to generate that exception with undefined opcode 0x0F,0xFF.  Apparently, whoever wrote that code
+ * didn't get the Intel memo regarding the preferred invalid opcode (0x0F,0x0B, aka UD2), or perhaps Intel hadn't
+ * written that memo yet -- although if that's the case, then Intel should have followed Microsoft's lead and
+ * selected 0x0F,0xFF instead of 0x0F,0x0B.
+ *
+ * In any case, this means we need to explicitly set the handler for that opcode to opInvalid(), too.
+ */
+X86.aOps0F[0xFF] = X86.opInvalid;
+
+/*
+ * NOTE: Any other opcode slots NOT explicitly initialized above with either a dedicated function OR opInvalid()
+ * will be set to opUndefined() when initProcessor() finalizes the opcode tables.  If the processor is an 80386,
+ * initProcessor() will also incorporate all the handlers listed below in aOps0F386.
+ *
+ * A call to opUndefined() implies something serious has occurred that merits our attention (eg, perhaps someone
+ * is using an undocumented opcode that we haven't implemented yet), whereas a call to opInvalid() may or may not.
+ */
+
+if (I386) {
+    X86.aOps0F386 = [];
+    X86.aOps0F386[0x05] = X86.opInvalid;        // the 80286 LOADALL opcode (LOADALL286) is invalid on the 80386
+    X86.aOps0F386[0x07] = X86.opLOADALL386;
+    X86.aOps0F386[0x10] = X86.opMOVmb;          // see the undocumented [UMOV](/docs/x86/ops/UMOV/) instruction
+    X86.aOps0F386[0x11] = X86.opMOVmw;          // see the undocumented [UMOV](/docs/x86/ops/UMOV/) instruction
+    X86.aOps0F386[0x12] = X86.opMOVrb;          // see the undocumented [UMOV](/docs/x86/ops/UMOV/) instruction
+    X86.aOps0F386[0x13] = X86.opMOVrw;          // see the undocumented [UMOV](/docs/x86/ops/UMOV/) instruction
+    X86.aOps0F386[0x20] = X86.opMOVrc;
+    X86.aOps0F386[0x21] = X86.opMOVrd;
+    X86.aOps0F386[0x22] = X86.opMOVcr;
+    X86.aOps0F386[0x23] = X86.opMOVdr;
+    X86.aOps0F386[0x24] = X86.opMOVrt;
+    X86.aOps0F386[0x26] = X86.opMOVtr;
+    X86.aOps0F386[0x80] = X86.opJOw;
+    X86.aOps0F386[0x81] = X86.opJNOw;
+    X86.aOps0F386[0x82] = X86.opJCw;
+    X86.aOps0F386[0x83] = X86.opJNCw;
+    X86.aOps0F386[0x84] = X86.opJZw;
+    X86.aOps0F386[0x85] = X86.opJNZw;
+    X86.aOps0F386[0x86] = X86.opJBEw;
+    X86.aOps0F386[0x87] = X86.opJNBEw;
+    X86.aOps0F386[0x88] = X86.opJSw;
+    X86.aOps0F386[0x89] = X86.opJNSw;
+    X86.aOps0F386[0x8A] = X86.opJPw;
+    X86.aOps0F386[0x8B] = X86.opJNPw;
+    X86.aOps0F386[0x8C] = X86.opJLw;
+    X86.aOps0F386[0x8D] = X86.opJNLw;
+    X86.aOps0F386[0x8E] = X86.opJLEw;
+    X86.aOps0F386[0x8F] = X86.opJNLEw;
+    X86.aOps0F386[0x90] = X86.opSETO;
+    X86.aOps0F386[0x91] = X86.opSETNO;
+    X86.aOps0F386[0x92] = X86.opSETC;
+    X86.aOps0F386[0x93] = X86.opSETNC;
+    X86.aOps0F386[0x94] = X86.opSETZ;
+    X86.aOps0F386[0x95] = X86.opSETNZ;
+    X86.aOps0F386[0x96] = X86.opSETBE;
+    X86.aOps0F386[0x97] = X86.opSETNBE;
+    X86.aOps0F386[0x98] = X86.opSETS;
+    X86.aOps0F386[0x99] = X86.opSETNS;
+    X86.aOps0F386[0x9A] = X86.opSETP;
+    X86.aOps0F386[0x9B] = X86.opSETNP;
+    X86.aOps0F386[0x9C] = X86.opSETL;
+    X86.aOps0F386[0x9D] = X86.opSETNL;
+    X86.aOps0F386[0x9E] = X86.opSETLE;
+    X86.aOps0F386[0x9F] = X86.opSETNLE;
+    X86.aOps0F386[0xA0] = X86.opPUSHFS;
+    X86.aOps0F386[0xA1] = X86.opPOPFS;
+    X86.aOps0F386[0xA3] = X86.opBT;
+    X86.aOps0F386[0xA4] = X86.opSHLDn;
+    X86.aOps0F386[0xA5] = X86.opSHLDcl;
+    X86.aOps0F386[0xA8] = X86.opPUSHGS;
+    X86.aOps0F386[0xA9] = X86.opPOPGS;
+    X86.aOps0F386[0xAB] = X86.opBTS;
+    X86.aOps0F386[0xAC] = X86.opSHRDn;
+    X86.aOps0F386[0xAD] = X86.opSHRDcl;
+    X86.aOps0F386[0xAF] = X86.opIMUL;
+    X86.aOps0F386[0xB2] = X86.opLSS;
+    X86.aOps0F386[0xB3] = X86.opBTR;
+    X86.aOps0F386[0xB4] = X86.opLFS;
+    X86.aOps0F386[0xB5] = X86.opLGS;
+    X86.aOps0F386[0xB6] = X86.opMOVZXb;
+    X86.aOps0F386[0xB7] = X86.opMOVZXw;
+    X86.aOps0F386[0xBA] = X86.opGRP8;
+    X86.aOps0F386[0xBB] = X86.opBTC;
+    X86.aOps0F386[0xBC] = X86.opBSF;
+    X86.aOps0F386[0xBD] = X86.opBSR;
+    X86.aOps0F386[0xBE] = X86.opMOVSXb;
+    X86.aOps0F386[0xBF] = X86.opMOVSXw;
+}
+
+/*
+ * These instruction groups are not as orthogonal as the original 8086/8088 groups (Grp1 through Grp4); some of
+ * the instructions in Grp6 and Grp7 only read their dst operand (eg, LLDT), which means the ModRM helper function
+ * must insure that setEAWord() is disabled, while others only write their dst operand (eg, SLDT), which means that
+ * getEAWord() should be disabled *prior* to calling the ModRM helper function.  This latter case requires that
+ * we decode the reg field of the ModRM byte before dispatching.
+ */
+X86.aOpGrp6Prot = [
+    X86.fnSLDT,             X86.fnSTR,              X86.fnLLDT,             X86.fnLTR,              // 0x0F,0x00(reg=0x0-0x3)
+    X86.fnVERR,             X86.fnVERW,             X86.fnGRPUndefined,     X86.fnGRPUndefined      // 0x0F,0x00(reg=0x4-0x7)
+];
+
+X86.aOpGrp6Real = [
+    X86.fnGRPInvalid,       X86.fnGRPInvalid,       X86.fnGRPInvalid,       X86.fnGRPInvalid,       // 0x0F,0x00(reg=0x0-0x3)
+    X86.fnGRPInvalid,       X86.fnGRPInvalid,       X86.fnGRPUndefined,     X86.fnGRPUndefined      // 0x0F,0x00(reg=0x4-0x7)
+];
+
+/*
+ * Unlike Grp6, Grp7 and Grp8 do not require separate real-mode and protected-mode dispatch tables, because
+ * all Grp7 and Grp8 instructions are valid in both modes.
+ */
+X86.aOpGrp7 = [
+    X86.fnSGDT,             X86.fnSIDT,             X86.fnLGDT,             X86.fnLIDT,             // 0x0F,0x01(reg=0x0-0x3)
+    X86.fnSMSW,             X86.fnGRPUndefined,     X86.fnLMSW,             X86.fnGRPUndefined      // 0x0F,0x01(reg=0x4-0x7)
+];
+
+X86.aOpGrp8 = [
+    X86.fnGRPUndefined,     X86.fnGRPUndefined,     X86.fnGRPUndefined,     X86.fnGRPUndefined,     // 0x0F,0xBA(reg=0x0-0x3)
+    X86.fnBT,               X86.fnBTS,              X86.fnBTR,              X86.fnBTC               // 0x0F,0xBA(reg=0x4-0x7)
+];
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/chipset.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class ChipSet extends Component {
+    /**
+     * ChipSet(parmsChipSet)
+     *
+     * The ChipSet component has the following component-specific (parmsChipSet) properties:
+     *
+     *      model:          eg, "5150", "5160", "5170", "deskpro386" (should be a member of ChipSet.MODELS)
+     *      sw1:            8-character binary string representing the SW1 DIP switches (SW1[1-8]); see Switches Overview
+     *      sw2:            8-character binary string representing the SW2 DIP switches (SW2[1-8]) (MODEL_5150 only)
+     *      sound:          true to enable (experimental) sound support (default); false to disable
+     *      scaleTimers:    true to divide timer cycle counts by the CPU's cycle multiplier (default is false)
+     *      floppies:       array of floppy drive sizes in Kb (default is "[360, 360]" if no sw1 value provided)
+     *      monitor:        none|tv|color|mono|ega|vga (if no sw1 value provided, default is "ega" for 5170, "mono" otherwise)
+     *      rtcDate:        optional RTC date/time (in GMT) to use on reset; use the ISO 8601 format; eg: "2014-10-01T08:00:00"
+     *
+     * As support for IBM-compatible machines grows, we should refrain from adding new model strings (eg, "att6300")
+     * and corresponding model checks, and instead add more ChipSet configuration properties, such as:
+     *
+     *      pit1port:       0x48 to enable PIT1 at base port 0x48 (as used by COMPAQ_DESKPRO386); default to undefined
+     *      kbdchip:        8041 to select 8041 emulation (eg, for ATT_6300); default to 8255 for MODEL_5150/MODEL_5160, 8042 for MODEL_5170
+     *
+     * @this {ChipSet}
+     * @param {Object} parmsChipSet
+     */
+    constructor(parmsChipSet)
+    {
+        super("ChipSet", parmsChipSet, Messages.CHIPSET);
+
+        var model = parmsChipSet['model'];
+
+        /*
+         * this.model is a numeric version of the 'model' string; when comparing this.model to standard IBM
+         * model numbers, you should generally compare (this.model|0) to the target value, which truncates it.
+         */
+        if (model && !ChipSet.MODELS[model]) {
+            Component.notice("Unrecognized ChipSet model: " + model);
+        }
+
+        this.model = ChipSet.MODELS[model] || ChipSet.MODEL_5150_OTHER;
+
+        var bSwitches;
+        this.aDIPSwitches = [];
+
+        /*
+         * SW1 describes the number of floppy drives, the amount of base memory, the primary monitor type,
+         * and (on the MODEL_5160) whether or not a coprocessor is installed.  If no SW1 settings are provided,
+         * we look for individual 'floppies' and 'monitor' settings and build a default SW1 value.
+         *
+         * The defaults below select max memory, monochrome monitor (EGA monitor for MODEL_5170), and two floppies.
+         * Don't get too excited about "max memory" either: on a MODEL_5150, the max was 64Kb, and on a MODEL_5160,
+         * the max was 256Kb.  However, the RAM component is free to install as much base memory as it likes,
+         * overriding the SW1 memory setting.
+         *
+         * Given that the ROM BIOS is hard-coded to load boot sectors @0000:7C00, the minimum amount of system RAM
+         * required to boot is therefore 32Kb.  Whether that's actually enough to run any or all versions of PC-DOS is
+         * a separate question.  FYI, with only 16Kb, the ROM BIOS will still try to boot, and fail miserably.
+         */
+        bSwitches = this.parseDIPSwitches(parmsChipSet[ChipSet.CONTROLS.SW1]);
+        this.aDIPSwitches[0] = [bSwitches, bSwitches];
+
+        if (bSwitches == null) {
+            this.aFloppyDrives = [360, 360];
+            var aFloppyDrives = parmsChipSet['floppies'];
+            if (aFloppyDrives && aFloppyDrives.length) this.aFloppyDrives = aFloppyDrives;
+            this.setDIPSwitches(ChipSet.SWITCH_TYPE.FLOPNUM, this.aFloppyDrives.length);
+
+            var sMonitor = parmsChipSet['monitor'] || (this.model < ChipSet.MODEL_5170? "mono" : "ega");
+            this.setDIPSwitches(ChipSet.SWITCH_TYPE.MONITOR, sMonitor);
+        }
+
+        /*
+         * SW2 describes the number of 32Kb blocks of I/O expansion RAM that's present in the system. The MODEL_5150
+         * ROM BIOS only checked/supported the first four switches, so the maximum amount of additional RAM specifiable
+         * was 15 * 32Kb, or 480Kb.  So with a 16Kb-64Kb motherboard, the MODEL_5150 ROM BIOS could support a grand
+         * total of 544Kb.  With the 64Kb-256Kb motherboard revision, a 5150 could use the first FIVE SW2 switches,
+         * allowing for a grand total as high as 640Kb.
+         *
+         * For MODEL_5160 (PC XT) and up, memory expansion cards had their own switches, and the motherboard
+         * SW2 switches for I/O expansion RAM were eliminated.  Instead, the ROM BIOS scans the entire address space
+         * (up to 0xA0000) looking for additional memory.  As a result, the only mechanism we provide for adding RAM
+         * (above the maximum of 256Kb supported on the motherboard) is the "size" parameter of the RAM component.
+         *
+         * NOTE: If you use the "size" parameter, you will not be able to dynamically alter the memory configuration;
+         * the RAM component will ignore any changes to SW1.
+         */
+        bSwitches = this.parseDIPSwitches(parmsChipSet[ChipSet.CONTROLS.SW2]);
+        this.aDIPSwitches[1] = [bSwitches, bSwitches];
+
+        this.sCellClass = PCX86.CSSCLASS + "-bitCell";
+
+        this.cDMACs = this.cPICs = 1;
+        if (this.model >= ChipSet.MODEL_5170) {
+            this.cDMACs = this.cPICs = 2;
+        }
+
+        this.fScaleTimers = parmsChipSet['scaleTimers'] || false;
+        this.sRTCDate = parmsChipSet['rtcDate'];
+
+        /*
+         * Here, I'm finally getting around to trying the Web Audio API.  Fortunately, based on what little I know about
+         * sound generation, using the API to make the same noises as the IBM PC speaker seems straightforward.
+         *
+         * To start, we create an audio context, unless the 'sound' parameter has been explicitly set to false.
+         *
+         * From:
+         *
+         *      http://developer.apple.com/library/safari/#documentation/AudioVideo/Conceptual/Using_HTML5_Audio_Video/PlayingandSynthesizingSounds/PlayingandSynthesizingSounds.html
+         *
+         * "Similar to how HTML5 canvas requires a context on which lines and curves are drawn, Web Audio requires an audio context
+         *  on which sounds are played and manipulated. This context will be the parent object of further audio objects to come....
+         *  Your audio context is typically created when your page initializes and should be long-lived. You can play multiple sounds
+         *  coming from multiple sources within the same context, so it is unnecessary to create more than one audio context per page."
+         */
+        this.fSpeaker = false;
+        if (parmsChipSet['sound']) {
+            this.classAudio = this.contextAudio = null;
+            if (window) {
+                this.classAudio = window['AudioContext'] || window['webkitAudioContext'];
+            }
+            if (this.classAudio) {
+                this.contextAudio = new this.classAudio();
+            } else {
+                if (DEBUG) this.log("AudioContext not available");
+            }
+        }
+
+        /*
+         * I used to defer ChipSet's reset() to powerUp(), which then gave us the option of doing either
+         * reset() OR restore(), instead of both.  However, on MODEL_5170 machines, the initial CMOS data
+         * needs to be created earlier, so that when other components are initializing their state (eg, when
+         * HDC calls setCMOSDriveType() or RAM calls addCMOSMemory()), the CMOS will be ready to take their calls.
+         */
+        this.reset(true);
+
+        this.setReady();
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * @this {ChipSet}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "sw1")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        switch (sBinding) {
+
+        case ChipSet.CONTROLS.SW1:
+            this.bindings[sBinding] = control;
+            this.addDIPSwitches(0, sBinding);
+            return true;
+
+        case ChipSet.CONTROLS.SW2:
+            if ((this.model|0) == ChipSet.MODEL_5150 || this.model == ChipSet.MODEL_ATT_6300) {
+                this.bindings[sBinding] = control;
+                this.addDIPSwitches(1, sBinding);
+                return true;
+            }
+            break;
+
+        case ChipSet.CONTROLS.SWDESC:
+            this.bindings[sBinding] = control;
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {ChipSet}
+     * @param {Computer} cmp
+     * @param {Bus} bus
+     * @param {X86CPU} cpu
+     * @param {DebuggerX86} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+        this.cmp = cmp;
+
+        this.fpu = cmp.getMachineComponent("FPU");
+        this.setDIPSwitches(ChipSet.SWITCH_TYPE.FPU, this.fpu?1:0, true);
+
+        this.kbd = cmp.getMachineComponent("Keyboard");
+
+        /*
+         * This divisor is invariant, so we calculate it as soon as we're able to query the CPU's base speed.
+         */
+        this.nTicksDivisor = (cpu.getCyclesPerSecond() / ChipSet.TIMER_TICKS_PER_SEC);
+
+        bus.addPortInputTable(this, ChipSet.aPortInput);
+        bus.addPortOutputTable(this, ChipSet.aPortOutput);
+        if (this.model < ChipSet.MODEL_5170) {
+            if (this.model != ChipSet.MODEL_ATT_6300) {
+                bus.addPortInputTable(this, ChipSet.aPortInput5150);
+                bus.addPortOutputTable(this, ChipSet.aPortOutput5150);
+            } else {
+                bus.addPortInputTable(this, ChipSet.aPortInput6300);
+                bus.addPortOutputTable(this, ChipSet.aPortOutput6300);
+            }
+        } else {
+            bus.addPortInputTable(this, ChipSet.aPortInput5170);
+            bus.addPortOutputTable(this, ChipSet.aPortOutput5170);
+            if (DESKPRO386 && (this.model|0) == ChipSet.MODEL_COMPAQ_DESKPRO386) {
+                bus.addPortInputTable(this, ChipSet.aPortInputDeskPro386);
+                bus.addPortOutputTable(this, ChipSet.aPortOutputDeskPro386);
+            }
+        }
+        if (DEBUGGER) {
+            if (dbg) {
+                var chipset = this;
+                /*
+                 * TODO: Add more "dumpers" (eg, for DMA, RTC, 8042, etc)
+                 */
+                dbg.messageDump(Messages.PIC, function onDumpPIC() {
+                    chipset.dumpPIC();
+                });
+                dbg.messageDump(Messages.TIMER, function onDumpTimer(asArgs) {
+                    chipset.dumpTimer(asArgs);
+                });
+                dbg.messageDump(Messages.CMOS, function onDumpCMOS() {
+                    chipset.dumpCMOS();
+                });
+            }
+            cpu.addIntNotify(Interrupts.RTC, this.intBIOSRTC.bind(this));
+        }
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {ChipSet}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            if (!data) {
+                this.reset();
+            } else {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {ChipSet}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * reset(fHard)
+     *
+     * @this {ChipSet}
+     * @param {boolean} [fHard] true on the initial reset (not a normal "soft" reset)
+     */
+    reset(fHard)
+    {
+        /*
+         * We propagate the initial DIP switch values to the current DIP switch values on reset;
+         * the user is only allowed to tweak the initial values, which require a reset to take effect.
+         */
+        var i;
+        this.updateDIPSwitches();
+
+        /*
+         * DMA (Direct Memory Access) Controller initialization
+         */
+        this.aDMACs = new Array(this.cDMACs);
+        for (i = 0; i < this.cDMACs; i++) {
+            this.initDMAController(i);
+        }
+
+        /*
+         * PIC (Programmable Interupt Controller) initialization
+         */
+        this.aPICs = new Array(this.cPICs);
+        this.initPIC(ChipSet.PIC0.INDEX, ChipSet.PIC0.PORT_LO);
+        if (this.cPICs > 1) {
+            this.initPIC(ChipSet.PIC1.INDEX, ChipSet.PIC1.PORT_LO);
+        }
+
+        /*
+         * PIT (Programmable Interval Timer) initialization
+         *
+         * Although the DeskPro 386 refers to the timers in the first PIT as "Timer 1, Counter 0",
+         * "Timer 1, Counter 1" and "Timer 1, Counter 2", we're sticking with IBM's nomenclature:
+         * TIMER0, TIMER1 and TIMER2.  Which means that we refer to the "counters" in the second PIT
+         * as TIMER3, TIMER4 and TIMER5; that numbering also matches their indexes in the aTimers array.
+         */
+        this.bPIT0Ctrl = null;          // tracks writes to port 0x43
+        this.bPIT1Ctrl = null;          // tracks writes to port 0x4B (MODEL_COMPAQ_DESKPRO386 only)
+        this.aTimers = new Array((this.model|0) == ChipSet.MODEL_COMPAQ_DESKPRO386? 6 : 3);
+        for (i = 0; i < this.aTimers.length; i++) {
+            this.initTimer(i);
+        }
+
+        /*
+         * PPI and other misc ports
+         */
+        this.bPPIA = null;              // tracks writes to port 0x60, in case PPI_CTRL.A_IN is not set
+        this.bPPIB = null;              // tracks writes to port 0x61, in case PPI_CTRL.B_IN is not set
+        this.bPPIC = null;              // tracks writes to port 0x62, in case PPI_CTRL.C_IN_LO or PPI_CTRL.C_IN_HI is not set
+        this.bPPICtrl = null;           // tracks writes to port 0x63 (eg, 0x99); read-only
+        this.bNMI = ChipSet.NMI.DISABLE;// tracks writes to the NMI Mask Register
+
+        if (this.model == ChipSet.MODEL_ATT_6300) {
+            this.b8041Status = 0;       // similar to b8042Status (but apparently only bits 0 and 1 are used)
+        }
+
+        /*
+         * ChipSet state introduced by the MODEL_5170
+         */
+        if (this.model >= ChipSet.MODEL_5170) {
+            /*
+             * The 8042 input buffer is treated as a "command byte" when written via port 0x64 and as a "data byte"
+             * when written via port 0x60.  So, whenever the KC8042.CMD.WRITE_CMD "command byte" is written to the input
+             * buffer, the subsequent command data byte is saved in b8042CmdData.  Similarly, for KC8042.CMD.WRITE_OUTPORT,
+             * the subsequent data byte is saved in b8042OutPort.
+             *
+             * TODO: Consider a UI for the Keyboard INHIBIT switch.  By default, our keyboard is never inhibited
+             * (ie, locked).  Also, note that the hardware changes this bit only when new data is sent to b8042OutBuff.
+             */
+            this.b8042Status = ChipSet.KC8042.STATUS.NO_INHIBIT;
+            this.b8042InBuff = 0;
+            this.b8042CmdData = ChipSet.KC8042.DATA.CMD.NO_CLOCK;
+            this.b8042OutBuff = 0;
+
+            /*
+             * TODO: Provide more control over these 8042 "Input Port" bits (eg, the keyboard lock)
+             */
+            this.b8042InPort = ChipSet.KC8042.INPORT.MFG_OFF | ChipSet.KC8042.INPORT.KBD_UNLOCKED;
+
+            if (this.getDIPMemorySize() >= 512) {
+                this.b8042InPort |= ChipSet.KC8042.INPORT.ENABLE_256KB;
+            }
+
+            if (this.getDIPVideoMonitor() == ChipSet.MONITOR.MONO) {
+                this.b8042InPort |= ChipSet.KC8042.INPORT.MONO;
+            }
+
+            if (DESKPRO386 && (this.model|0) == ChipSet.MODEL_COMPAQ_DESKPRO386) {
+                this.b8042InPort |= ChipSet.KC8042.INPORT.COMPAQ_NO80387 | ChipSet.KC8042.INPORT.COMPAQ_NOWEITEK;
+            }
+
+            this.b8042OutPort = ChipSet.KC8042.OUTPORT.NO_RESET | ChipSet.KC8042.OUTPORT.A20_ON;
+
+            this.abDMAPageSpare = new Array(8);
+
+            this.bCMOSAddr = 0;         // NMI is enabled, since the ChipSet.CMOS.ADDR.NMI_DISABLE bit is not set in bCMOSAddr
+
+            /*
+             * Now that we call reset() from the ChipSet constructor, enabling other components to update
+             * their own CMOS information as needed, we must distinguish between the initial ("hard") reset
+             * and any later ("soft") resets (eg, from powerUp() calls), and make sure the latter preserves
+             * existing CMOS information.
+             */
+            if (fHard) {
+                this.abCMOSData = new Array(ChipSet.CMOS.ADDR.TOTAL);
+            }
+
+            this.initRTCTime(this.sRTCDate);
+
+            /*
+             * initCMOSData() will initialize a variety of "legacy" CMOS bytes, but it will NOT overwrite any memory
+             * size or hard drive type information that might have been set, via addCMOSMemory() or setCMOSDriveType().
+             */
+            this.initCMOSData();
+        }
+
+        if (DEBUGGER && MAXDEBUG) {
+            /*
+             * Arrays for interrupt counts (one count per IRQ) and timer data
+             */
+            this.acInterrupts = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+            this.acTimersFired = [0, 0, 0];
+            this.acTimer0Counts = [];
+        }
+    }
+
+    /**
+     * initRTCTime(sDate)
+     *
+     * Initialize the RTC portion of the CMOS registers to match the specified date/time (or if none is specified,
+     * the current date/time).  The date/time should be expressed in the ISO 8601 format; eg: "2011-10-10T14:48:00".
+     *
+     * NOTE: There are two approaches we could take here: always store the RTC bytes in binary, and convert them
+     * to/from BCD on-demand (ie, as the simulation reads/writes the CMOS RTC registers); or init/update them in the
+     * format specified by CMOS.STATUSB.BINARY (1 for binary, 0 for BCD).  Both approaches require BCD conversion
+     * functions, but the former seems more efficient, in part because the periodic calls to updateRTCTime() won't
+     * require any conversions.
+     *
+     * We take the same approach with the CMOS.STATUSB.HOUR24 setting: internally, we always operate in 24-hour mode,
+     * but externally, we convert the RTC hour values to the 12-hour format as needed.
+     *
+     * Thus, all I/O to the RTC bytes must be routed through the getRTCByte() and setRTCByte() functions, to ensure
+     * that all the necessary on-demand conversions occur.
+     *
+     * @this {ChipSet}
+     * @param {string} [sDate]
+     */
+    initRTCTime(sDate)
+    {
+        /*
+         * NOTE: I've already been burned once by a JavaScript library function that did NOT treat an undefined
+         * parameter (ie, a parameter === undefined) the same as an omitted parameter (eg, the async parameter in
+         * xmlHTTP.open() in IE), so I'm taking no chances here: if sDate is undefined, then explicitly call Date()
+         * with no parameters.
+         */
+        var date = sDate? new Date(sDate) : new Date();
+
+        /*
+         * Example of a valid Date string:
+         *
+         *      2014-10-01T08:00:00 (interpreted as GMT, resulting in "Wed Oct 01 2014 01:00:00 GMT-0700 (PDT)")
+         *
+         * Examples of INVALID Date strings:
+         *
+         *      2014-10-01T08:00:00PST
+         *      2014-10-01T08:00:00-0700 (actually, this DOES work in Chrome, but NOT in Safari)
+         *
+         * In the case of INVALID Date strings, the Date object is invalid, but there's no obvious test for an "invalid"
+         * object, so I've adapted the following test from StackOverflow.
+         *
+         * See http://stackoverflow.com/questions/1353684/detecting-an-invalid-date-date-instance-in-javascript
+         */
+        if (Object.prototype.toString.call(date) !== "[object Date]" || isNaN(date.getTime())) {
+            date = new Date();
+            this.println("CMOS date invalid (" + sDate + "), using " + date);
+        } else if (sDate) {
+            this.println("CMOS date: " + date);
+        }
+
+        this.abCMOSData[ChipSet.CMOS.ADDR.RTC_SEC] = date.getSeconds();
+        this.abCMOSData[ChipSet.CMOS.ADDR.RTC_SEC_ALRM] = 0;
+        this.abCMOSData[ChipSet.CMOS.ADDR.RTC_MIN] = date.getMinutes();
+        this.abCMOSData[ChipSet.CMOS.ADDR.RTC_MIN_ALRM] = 0;
+        this.abCMOSData[ChipSet.CMOS.ADDR.RTC_HOUR] = date.getHours();
+        this.abCMOSData[ChipSet.CMOS.ADDR.RTC_HOUR_ALRM] = 0;
+        this.abCMOSData[ChipSet.CMOS.ADDR.RTC_WEEK_DAY] = date.getDay() + 1;
+        this.abCMOSData[ChipSet.CMOS.ADDR.RTC_MONTH_DAY] = date.getDate();
+        this.abCMOSData[ChipSet.CMOS.ADDR.RTC_MONTH] = date.getMonth() + 1;
+        var nYear = date.getFullYear();
+        this.abCMOSData[ChipSet.CMOS.ADDR.RTC_YEAR] = nYear % 100;
+        var nCentury = (nYear / 100);
+        this.abCMOSData[ChipSet.CMOS.ADDR.CENTURY_DATE] = (nCentury % 10) | ((nCentury / 10) << 4);
+
+        this.abCMOSData[ChipSet.CMOS.ADDR.STATUSA] = 0x26;                          // hard-coded default; refer to ChipSet.CMOS.STATUSA.DV and ChipSet.CMOS.STATUSA.RS
+        this.abCMOSData[ChipSet.CMOS.ADDR.STATUSB] = ChipSet.CMOS.STATUSB.HOUR24;   // default to BCD mode (ChipSet.CMOS.STATUSB.BINARY not set)
+        this.abCMOSData[ChipSet.CMOS.ADDR.STATUSC] = 0x00;
+        this.abCMOSData[ChipSet.CMOS.ADDR.STATUSD] = ChipSet.CMOS.STATUSD.VRB;
+
+        this.nRTCCyclesLastUpdate = this.nRTCCyclesNextUpdate = 0;
+        this.nRTCPeriodsPerSecond = this.nRTCCyclesPerPeriod = null;
+    }
+
+    /**
+     * getRTCByte(iRTC)
+     *
+     * @param {number} iRTC
+     * @return {number} b
+     */
+    getRTCByte(iRTC)
+    {
+
+
+        var b = this.abCMOSData[iRTC];
+
+        if (iRTC < ChipSet.CMOS.ADDR.STATUSA) {
+            var f12HourValue = false;
+            if (iRTC == ChipSet.CMOS.ADDR.RTC_HOUR || iRTC == ChipSet.CMOS.ADDR.RTC_HOUR_ALRM) {
+                if (!(this.abCMOSData[ChipSet.CMOS.ADDR.STATUSB] & ChipSet.CMOS.STATUSB.HOUR24)) {
+                    if (b < 12) {
+                        b = (!b? 12 : b);
+                    } else {
+                        b -= 12;
+                        b = (!b? 0x8c : b + 0x80);
+                    }
+                    f12HourValue = true;
+                }
+            }
+            if (!(this.abCMOSData[ChipSet.CMOS.ADDR.STATUSB] & ChipSet.CMOS.STATUSB.BINARY)) {
+                /*
+                 * We're in BCD mode, so we must convert b from BINARY to BCD.  But first:
+                 *
+                 *      If b is a 12-hour value (ie, we're in 12-hour mode) AND the hour is a PM value
+                 *      (ie, in the range 0x81-0x8C), then it must be adjusted to yield 81-92 in BCD.
+                 *
+                 *      AM hour values (0x01-0x0C) need no adjustment; they naturally convert to 01-12 in BCD.
+                 */
+                if (f12HourValue && b > 0x80) {
+                    b -= (0x81 - 81);
+                }
+                b = (b % 10) | ((b / 10) << 4);
+            }
+        } else {
+            if (iRTC == ChipSet.CMOS.ADDR.STATUSA) {
+                /*
+                 * HACK: Perform a mindless toggling of the "Update-In-Progress" bit, so that it's flipped
+                 * on the next read; this makes the MODEL_5170 BIOS ("POST2_RTCUP") happy.
+                 */
+                this.abCMOSData[iRTC] ^= ChipSet.CMOS.STATUSA.UIP;
+            }
+        }
+        return b;
+    }
+
+    /**
+     * setRTCByte(iRTC, b)
+     *
+     * @param {number} iRTC
+     * @param {number} b proposed byte to write
+     * @return {number} actual byte to write
+     */
+    setRTCByte(iRTC, b)
+    {
+
+
+        if (iRTC < ChipSet.CMOS.ADDR.STATUSA) {
+            var fBCD = false;
+            if (!(this.abCMOSData[ChipSet.CMOS.ADDR.STATUSB] & ChipSet.CMOS.STATUSB.BINARY)) {
+                /*
+                 * We're in BCD mode, so we must convert b from BCD to BINARY (we assume it's valid
+                 * BCD; ie, that both nibbles contain only 0-9, not A-F).
+                 */
+                b = (b >> 4) * 10 + (b & 0xf);
+                fBCD = true;
+            }
+            if (iRTC == ChipSet.CMOS.ADDR.RTC_HOUR || iRTC == ChipSet.CMOS.ADDR.RTC_HOUR_ALRM) {
+                if (fBCD) {
+                    /*
+                     * If the original BCD hour was 0x81-0x92, then the previous BINARY-to-BCD conversion
+                     * transformed it to 0x51-0x5C, so we must add 0x30.
+                     */
+                    if (b > 23) {
+
+                        b += 0x30;
+                    }
+                }
+                if (!(this.abCMOSData[ChipSet.CMOS.ADDR.STATUSB] & ChipSet.CMOS.STATUSB.HOUR24)) {
+                    if (b <= 12) {
+                        b = (b == 12? 0 : b);
+                    } else {
+                        b -= (0x80 - 12);
+                        b = (b == 24? 12 : b);
+                    }
+                }
+            }
+        }
+        return b;
+    }
+
+    /**
+     * calcRTCCyclePeriod()
+     *
+     * This should be called whenever the timings in STATUSA may have changed.
+     *
+     * TODO: 1024 is a hard-coded number of periods per second based on the default interrupt rate of 976.562us
+     * (ie, 1000000 / 976.562).  Calculate the actual number based on the values programmed in the STATUSA register.
+     *
+     * @this {ChipSet}
+     */
+    calcRTCCyclePeriod()
+    {
+        this.nRTCCyclesLastUpdate = this.cpu.getCycles(this.fScaleTimers);
+        this.nRTCPeriodsPerSecond = 1024;
+        this.nRTCCyclesPerPeriod = Math.floor(this.cpu.getCyclesPerSecond() / this.nRTCPeriodsPerSecond);
+        this.setRTCCycleLimit();
+    }
+
+    /**
+     * getRTCCycleLimit(nCycles)
+     *
+     * This is called by the CPU to determine the maximum number of cycles it can process for the current burst.
+     *
+     * @this {ChipSet}
+     * @param {number} nCycles desired
+     * @return {number} maximum number of cycles (<= nCycles)
+     */
+    getRTCCycleLimit(nCycles)
+    {
+        if (this.abCMOSData && this.abCMOSData[ChipSet.CMOS.ADDR.STATUSB] & ChipSet.CMOS.STATUSB.PIE) {
+            var nCyclesUpdate = this.nRTCCyclesNextUpdate - this.cpu.getCycles(this.fScaleTimers);
+            if (nCyclesUpdate > 0) {
+                if (nCycles > nCyclesUpdate) {
+                    if (DEBUG && this.messageEnabled(Messages.RTC)) {
+                        this.printMessage("getRTCCycleLimit(" + nCycles + "): reduced to " + nCyclesUpdate + " cycles", true);
+                    }
+                    nCycles = nCyclesUpdate;
+                } else {
+                    if (DEBUG && this.messageEnabled(Messages.RTC)) {
+                        this.printMessage("getRTCCycleLimit(" + nCycles + "): already less than " + nCyclesUpdate + " cycles", true);
+                    }
+                }
+            } else {
+                if (DEBUG && this.messageEnabled(Messages.RTC)) {
+                    this.printMessage("RTC next update has passed by " + nCyclesUpdate + " cycles", true);
+                }
+            }
+        }
+        return nCycles;
+    }
+
+    /**
+     * setRTCCycleLimit(nCycles)
+     *
+     * This should be called when PIE becomes set in STATUSB (and whenever PF is cleared in STATUSC while PIE is still set).
+     *
+     * @this {ChipSet}
+     * @param {number} [nCycles]
+     */
+    setRTCCycleLimit(nCycles)
+    {
+        if (nCycles === undefined) nCycles = this.nRTCCyclesPerPeriod;
+        this.nRTCCyclesNextUpdate = this.cpu.getCycles(this.fScaleTimers) + nCycles;
+        if (this.abCMOSData[ChipSet.CMOS.ADDR.STATUSB] & ChipSet.CMOS.STATUSB.PIE) {
+            this.cpu.setBurstCycles(nCycles);
+        }
+    }
+
+    /**
+     * updateRTCTime()
+     *
+     * @this {ChipSet}
+     */
+    updateRTCTime()
+    {
+        var nCyclesPerSecond = this.cpu.getCyclesPerSecond();
+        var nCyclesUpdate = this.cpu.getCycles(this.fScaleTimers);
+
+        /*
+         * We must arrange for the very first calcRTCCyclePeriod() call to occur here, on the very first
+         * updateRTCTime() call, because this is the first point we can be guaranteed that CPU cycle counts
+         * are initialized (the CPU is the last component to be powered up/restored).
+         *
+         * TODO: A side-effect of this is that it undermines the save/restore code's preservation of last
+         * and next RTC cycle counts, which may affect when the next RTC event is delivered.
+         */
+        if (this.nRTCCyclesPerPeriod == null) this.calcRTCCyclePeriod();
+
+        /*
+         * Step 1: Deal with Periodic Interrupts
+         */
+        if (nCyclesUpdate >= this.nRTCCyclesNextUpdate) {
+            var bPrev = this.abCMOSData[ChipSet.CMOS.ADDR.STATUSC];
+            this.abCMOSData[ChipSet.CMOS.ADDR.STATUSC] |= ChipSet.CMOS.STATUSC.PF;
+            if (this.abCMOSData[ChipSet.CMOS.ADDR.STATUSB] & ChipSet.CMOS.STATUSB.PIE) {
+                /*
+                 * When PIE is set, setBurstCycles() should be getting called as needed to ensure
+                 * that updateRTCTime() is called more frequently, so let's assert that we don't have
+                 * an excess of cycles and thus possibly some missed Periodic Interrupts.
+                 */
+                if (DEBUG) {
+                    if (nCyclesUpdate - this.nRTCCyclesNextUpdate > this.nRTCCyclesPerPeriod) {
+                        if (bPrev & ChipSet.CMOS.STATUSC.PF) {
+                            this.printMessage("RTC interrupt handler failed to clear STATUSC", Messages.RTC);
+                        } else {
+                            this.printMessage("CPU took too long trigger new RTC periodic interrupt", Messages.RTC);
+                        }
+                    }
+                }
+                this.abCMOSData[ChipSet.CMOS.ADDR.STATUSC] |= ChipSet.CMOS.STATUSC.IRQF;
+                this.setIRR(ChipSet.IRQ.RTC);
+                /*
+                 * We could also call setRTCCycleLimit() at this point, but I don't think there's any
+                 * benefit until the interrupt had been acknowledged and STATUSC has been read, thereby
+                 * clearing the way for another Periodic Interrupt; it seems to me that when STATUSC
+                 * is read, that's the more appropriate time to call setRTCCycleLimit().
+                 */
+            }
+            this.nRTCCyclesNextUpdate = nCyclesUpdate + this.nRTCCyclesPerPeriod;
+        }
+
+        /*
+         * Step 2: Deal with Alarm Interrupts
+         */
+        if (this.abCMOSData[ChipSet.CMOS.ADDR.RTC_SEC] == this.abCMOSData[ChipSet.CMOS.ADDR.RTC_SEC_ALRM]) {
+            if (this.abCMOSData[ChipSet.CMOS.ADDR.RTC_MIN] == this.abCMOSData[ChipSet.CMOS.ADDR.RTC_MIN_ALRM]) {
+                if (this.abCMOSData[ChipSet.CMOS.ADDR.RTC_HOUR] == this.abCMOSData[ChipSet.CMOS.ADDR.RTC_HOUR_ALRM]) {
+                    this.abCMOSData[ChipSet.CMOS.ADDR.STATUSC] |= ChipSet.CMOS.STATUSC.AF;
+                    if (this.abCMOSData[ChipSet.CMOS.ADDR.STATUSB] & ChipSet.CMOS.STATUSB.AIE) {
+                        this.abCMOSData[ChipSet.CMOS.ADDR.STATUSC] |= ChipSet.CMOS.STATUSC.IRQF;
+                        this.setIRR(ChipSet.IRQ.RTC);
+                    }
+                }
+            }
+        }
+
+        /*
+         * Step 3: Update the RTC date/time and deal with Update Interrupts
+         */
+        var nCyclesDelta = nCyclesUpdate - this.nRTCCyclesLastUpdate;
+        // DEBUG:
+        var nSecondsDelta = Math.floor(nCyclesDelta / nCyclesPerSecond);
+
+        /*
+         * We trust that updateRTCTime() is being called as part of updateAllTimers(), and is therefore
+         * being called often enough to ensure that nSecondsDelta will never be greater than one.  In fact,
+         * it would always be LESS than one if it weren't also for the fact that we plow any "unused" cycles
+         * (nCyclesDelta % nCyclesPerSecond) back into nRTCCyclesLastUpdate, so that we will eventually
+         * see a one-second delta.
+         */
+        // DEBUG:
+
+        /*
+         * Make sure that CMOS.STATUSB.SET isn't set; if it is, then the once-per-second RTC updates must be
+         * disabled so that software can write new RTC date/time values without interference.
+         */
+        if (nSecondsDelta && !(this.abCMOSData[ChipSet.CMOS.ADDR.STATUSB] & ChipSet.CMOS.STATUSB.SET)) {
+            while (nSecondsDelta--) {
+                if (++this.abCMOSData[ChipSet.CMOS.ADDR.RTC_SEC] >= 60) {
+                    this.abCMOSData[ChipSet.CMOS.ADDR.RTC_SEC] = 0;
+                    if (++this.abCMOSData[ChipSet.CMOS.ADDR.RTC_MIN] >= 60) {
+                        this.abCMOSData[ChipSet.CMOS.ADDR.RTC_MIN] = 0;
+                        if (++this.abCMOSData[ChipSet.CMOS.ADDR.RTC_HOUR] >= 24) {
+                            this.abCMOSData[ChipSet.CMOS.ADDR.RTC_HOUR] = 0;
+                            this.abCMOSData[ChipSet.CMOS.ADDR.RTC_WEEK_DAY] = (this.abCMOSData[ChipSet.CMOS.ADDR.RTC_WEEK_DAY] % 7) + 1;
+                            var nDayMax = Usr.getMonthDays(this.abCMOSData[ChipSet.CMOS.ADDR.RTC_MONTH], this.abCMOSData[ChipSet.CMOS.ADDR.RTC_YEAR]);
+                            if (++this.abCMOSData[ChipSet.CMOS.ADDR.RTC_MONTH_DAY] > nDayMax) {
+                                this.abCMOSData[ChipSet.CMOS.ADDR.RTC_MONTH_DAY] = 1;
+                                if (++this.abCMOSData[ChipSet.CMOS.ADDR.RTC_MONTH] > 12) {
+                                    this.abCMOSData[ChipSet.CMOS.ADDR.RTC_MONTH] = 1;
+                                    this.abCMOSData[ChipSet.CMOS.ADDR.RTC_YEAR] = (this.abCMOSData[ChipSet.CMOS.ADDR.RTC_YEAR] + 1) % 100;
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            this.abCMOSData[ChipSet.CMOS.ADDR.STATUSC] |= ChipSet.CMOS.STATUSC.UF;
+            if (this.abCMOSData[ChipSet.CMOS.ADDR.STATUSB] & ChipSet.CMOS.STATUSB.UIE) {
+                this.abCMOSData[ChipSet.CMOS.ADDR.STATUSC] |= ChipSet.CMOS.STATUSC.IRQF;
+                this.setIRR(ChipSet.IRQ.RTC);
+            }
+        }
+
+        this.nRTCCyclesLastUpdate = nCyclesUpdate - (nCyclesDelta % nCyclesPerSecond);
+    }
+
+    /**
+     * initCMOSData()
+     *
+     * Initialize all the CMOS configuration bytes in the range 0x0E-0x2F (TODO: Decide what to do about 0x30-0x3F)
+     *
+     * Note that the MODEL_5170 "SETUP" utility is normally what sets all these bytes, including the checksum, and then
+     * the BIOS verifies it, but since we want our machines to pass BIOS verification "out of the box", we go the extra
+     * mile here, even though it's not really our responsibility.
+     *
+     * @this {ChipSet}
+     */
+    initCMOSData()
+    {
+        /*
+         * On all reset() calls, the RAM component(s) will (re)add their totals, so we have to make sure that
+         * the addition always starts with 0.  That also means that ChipSet must always be initialized before RAM.
+         */
+        var iCMOS;
+        for (iCMOS = ChipSet.CMOS.ADDR.BASEMEM_LO; iCMOS <= ChipSet.CMOS.ADDR.EXTMEM_HI; iCMOS++) {
+            this.abCMOSData[iCMOS] = 0;
+        }
+
+        /*
+         * Make sure all the "checksummed" CMOS bytes are initialized (not just the handful we set below) to ensure
+         * that the checksum will be valid.
+         */
+        for (iCMOS = ChipSet.CMOS.ADDR.DIAG; iCMOS < ChipSet.CMOS.ADDR.CHKSUM_HI; iCMOS++) {
+            if (this.abCMOSData[iCMOS] === undefined) this.abCMOSData[iCMOS] = 0;
+        }
+
+        /*
+         * We propagate all compatible "legacy" SW1 bits to the CMOS.EQUIP byte using the old SW masks, but any further
+         * access to CMOS.ADDR.EQUIP should use the new CMOS_EQUIP flags (eg, CMOS.EQUIP.FPU, CMOS.EQUIP.MONITOR.CGA80, etc).
+         */
+        this.abCMOSData[ChipSet.CMOS.ADDR.EQUIP] = this.getDIPLegacyBits(0);
+        this.abCMOSData[ChipSet.CMOS.ADDR.FDRIVE] = (this.getDIPFloppyDriveType(0) << 4) | this.getDIPFloppyDriveType(1);
+
+        /*
+         * The final step is calculating the CMOS checksum, which we then store into the CMOS as a courtesy, so that the
+         * user doesn't get unnecessary CMOS errors.
+         */
+        this.updateCMOSChecksum();
+    }
+
+    /**
+     * setCMOSByte(iCMOS, b)
+     *
+     * This is ONLY for use by components that need to update CMOS configuration bytes to match their internal configuration.
+     *
+     * @this {ChipSet}
+     * @param {number} iCMOS
+     * @param {number} b
+     * @return {boolean} true if successful, false if not (eg, CMOS not initialized yet, or no CMOS on this machine)
+     */
+    setCMOSByte(iCMOS, b)
+    {
+        if (this.abCMOSData) {
+
+            this.abCMOSData[iCMOS] = b;
+            this.updateCMOSChecksum();
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * addCMOSMemory(addr, size)
+     *
+     * For use by the RAM component, to dynamically update the CMOS memory configuration.
+     *
+     * @this {ChipSet}
+     * @param {number} addr (if 0, BASEMEM_LO/BASEMEM_HI is updated; if >= 0x100000, then EXTMEM_LO/EXTMEM_HI is updated)
+     * @param {number} size (in bytes; we convert to Kb)
+     * @return {boolean} true if successful, false if not (eg, CMOS not initialized yet, or no CMOS on this machine)
+     */
+    addCMOSMemory(addr, size)
+    {
+        if (this.abCMOSData) {
+            var iCMOS = (addr < 0x100000? ChipSet.CMOS.ADDR.BASEMEM_LO : ChipSet.CMOS.ADDR.EXTMEM_LO);
+            var wKb = this.abCMOSData[iCMOS] | (this.abCMOSData[iCMOS+1] << 8);
+            wKb += (size >> 10);
+            this.abCMOSData[iCMOS] = wKb & 0xff;
+            this.abCMOSData[iCMOS+1] = wKb >> 8;
+            this.updateCMOSChecksum();
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * setCMOSDriveType(iDrive, bType)
+     *
+     * For use by the HDC component, to update the CMOS drive configuration to match HDC's internal configuration.
+     *
+     * TODO: Consider extending this to support FDC drive updates, so that the FDC can specify diskette drive types
+     * (ie, FD360 or FD1200) in the same way that HDC does.  However, historically, the ChipSet has been responsible for
+     * floppy drive configuration, at least in terms of *number* of drives, through the use of SW1 settings, and we've
+     * continued that tradition with the addition of the ChipSet 'floppies' parameter, which allows both the number *and*
+     * capacity of drives to be specified with a simple array (eg, [360, 360] for two 360Kb drives).
+     *
+     * @this {ChipSet}
+     * @param {number} iDrive (0 or 1)
+     * @param {number} bType (0 for none, 1-14 for original drive type, 16-255 for extended drive type; 15 reserved)
+     * @return {boolean} true if successful, false if not (eg, CMOS not initialized yet, or no CMOS on this machine)
+     */
+    setCMOSDriveType(iDrive, bType)
+    {
+        if (this.abCMOSData) {
+            var bExt = null, iExt;
+            var bOrig = this.abCMOSData[ChipSet.CMOS.ADDR.HDRIVE];
+            if (bType > 15) {
+                bExt = bType;  bType = 15;
+            }
+            if (iDrive) {
+                bOrig = (bOrig & ChipSet.CMOS.HDRIVE.D0_MASK) | bType;
+                iExt = ChipSet.CMOS.ADDR.EXTHDRIVE1;
+            } else {
+                bOrig = (bOrig & ChipSet.CMOS.HDRIVE.D1_MASK) | (bType << 4);
+                iExt = ChipSet.CMOS.ADDR.EXTHDRIVE0;
+            }
+            this.setCMOSByte(ChipSet.CMOS.ADDR.HDRIVE, bOrig);
+            if (bExt != null) this.setCMOSByte(iExt, bExt);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * updateCMOSChecksum()
+     *
+     * This sums all the CMOS bytes from 0x10-0x2D, creating a 16-bit checksum.  That's a total of 30 (unsigned) 8-bit
+     * values which could sum to at most 30*255 or 7650 (0x1DE2).  Since there's no way that can overflow 16 bits, we don't
+     * worry about masking it with 0xffff.
+     *
+     * WARNING: The IBM PC AT TechRef, p.1-53 (p.75) claims that the checksum is on bytes 0x10-0x20, but that's simply wrong.
+     *
+     * @this {ChipSet}
+     */
+    updateCMOSChecksum()
+    {
+        var wChecksum = 0;
+        for (var iCMOS = ChipSet.CMOS.ADDR.FDRIVE; iCMOS < ChipSet.CMOS.ADDR.CHKSUM_HI; iCMOS++) {
+            wChecksum += this.abCMOSData[iCMOS];
+        }
+        this.abCMOSData[ChipSet.CMOS.ADDR.CHKSUM_LO] = wChecksum & 0xff;
+        this.abCMOSData[ChipSet.CMOS.ADDR.CHKSUM_HI] = wChecksum >> 8;
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the ChipSet component.
+     *
+     * @this {ChipSet}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, [this.aDIPSwitches]);
+        state.set(1, [this.saveDMAControllers()]);
+        state.set(2, [this.savePICs()]);
+        state.set(3, [this.bPIT0Ctrl, this.saveTimers(), this.bPIT1Ctrl]);
+        state.set(4, [this.bPPIA, this.bPPIB, this.bPPIC, this.bPPICtrl, this.bNMI]);
+        if (this.model >= ChipSet.MODEL_5170) {
+            state.set(5, [this.b8042Status, this.b8042InBuff, this.b8042CmdData,
+                          this.b8042OutBuff, this.b8042InPort, this.b8042OutPort]);
+            state.set(6, [this.abDMAPageSpare[7], this.abDMAPageSpare, this.bCMOSAddr, this.abCMOSData, this.nRTCCyclesLastUpdate, this.nRTCCyclesNextUpdate]);
+        }
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the ChipSet component.
+     *
+     * @this {ChipSet}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        var a, i;
+        a = data[0];
+
+        if (Array.isArray(a[0])) {
+            this.aDIPSwitches = a[0];
+        } else {
+            this.aDIPSwitches[0][0] = a[0];
+            this.aDIPSwitches[1][0] = a[1] & 0x0F;  // we do honor SW2[5] now, but it was erroneously set on some machines
+            this.aDIPSwitches[0][1] = a[2];
+            this.aDIPSwitches[1][1] = a[3] & 0x0F;  // we do honor SW2[5] now, but it was erroneously set on some machines
+        }
+        this.updateDIPSwitches();
+
+        a = data[1];
+        for (i = 0; i < this.cDMACs; i++) {
+            this.initDMAController(i, a.length == 1? a[0][i] : a);
+        }
+
+        a = data[2];
+        for (i = 0; i < this.cPICs; i++) {
+            this.initPIC(i, i === 0? ChipSet.PIC0.PORT_LO : ChipSet.PIC1.PORT_LO, a[0][i]);
+        }
+
+        a = data[3];
+        this.bPIT0Ctrl = a[0];
+        this.bPIT1Ctrl = a[2];
+        for (i = 0; i < this.aTimers.length; i++) {
+            this.initTimer(i, a[1][i]);
+        }
+
+        a = data[4];
+        this.bPPIA = a[0];
+        this.bPPIB = a[1];
+        this.bPPIC = a[2];
+        this.bPPICtrl = a[3];
+        this.bNMI  = a[4];
+
+        a = data[5];
+        if (a) {
+
+            this.b8042Status = a[0];
+            this.b8042InBuff = a[1];
+            this.b8042CmdData = a[2];
+            this.b8042OutBuff = a[3];
+            this.b8042InPort = a[4];
+            this.b8042OutPort = a[5];
+        }
+
+        a = data[6];
+        if (a) {
+
+            this.abDMAPageSpare = a[1];
+            this.abDMAPageSpare[7] = a[0];  // formerly bMFGData
+            this.bCMOSAddr = a[2];
+            this.abCMOSData = a[3];
+            this.nRTCCyclesLastUpdate = a[4];
+            this.nRTCCyclesNextUpdate = a[5];
+            /*
+             * TODO: Decide whether restore() should faithfully preserve the RTC date/time that save() saved,
+             * or always reinitialize the date/time, or give the user (or the machine configuration) the option.
+             *
+             * For now, we're always reinitializing the RTC date.  Alternatively, we could selectively update
+             * the CMOS bytes above, instead of overwriting them all, in which case this extra call to initRTCTime()
+             * could be avoided.
+             */
+            this.initRTCTime();
+        }
+        return true;
+    }
+
+    /**
+     * start()
+     *
+     * Notification from the CPU that it's starting.
+     *
+     * @this {ChipSet}
+     */
+    start()
+    {
+        /*
+         * Currently, all we do with this notification is allow the speaker to make noise.
+         */
+        this.setSpeaker();
+    }
+
+    /**
+     * stop()
+     *
+     * Notification from the CPU that it's stopping.
+     *
+     * @this {ChipSet}
+     */
+    stop()
+    {
+        /*
+         * Currently, all we do with this notification is prevent the speaker from making noise.
+         */
+        this.setSpeaker();
+    }
+
+    /**
+     * initDMAController(iDMAC, aState)
+     *
+     * @this {ChipSet}
+     * @param {number} iDMAC
+     * @param {Array} [aState]
+     */
+    initDMAController(iDMAC, aState)
+    {
+        var controller = this.aDMACs[iDMAC];
+        if (!controller) {
+
+            controller = {
+                aChannels: new Array(4)
+            };
+        }
+        var a = aState && aState.length >= 5? aState : ChipSet.aDMAControllerInit;
+        controller.bStatus = a[0];
+        controller.bCmd = a[1];
+        controller.bReq = a[2];
+        controller.bIndex = a[3];
+        controller.nChannelBase = iDMAC << 2;
+        for (var iChannel = 0; iChannel < controller.aChannels.length; iChannel++) {
+            this.initDMAChannel(controller, iChannel, a[4][iChannel]);
+        }
+        controller.bTemp = a[5] || 0;       // not present in older states
+        this.aDMACs[iDMAC] = controller;
+    }
+
+    /**
+     * initDMAChannel(controller, iChannel, aState)
+     *
+     * @this {ChipSet}
+     * @param {Object} controller
+     * @param {number} iChannel
+     * @param {Array} [aState]
+     */
+    initDMAChannel(controller, iChannel, aState)
+    {
+        var channel = controller.aChannels[iChannel];
+        if (!channel) {
+
+            channel = {
+                addrInit: [0,0],
+                countInit: [0,0],
+                addrCurrent: [0,0],
+                countCurrent: [0,0]
+            };
+        }
+        var a = aState && aState.length == 8? aState : ChipSet.aDMAChannelInit;
+        channel.masked = a[0];
+        channel.addrInit[0] = a[1][0]; channel.addrInit[1] = a[1][1];
+        channel.countInit[0] = a[2][0];  channel.countInit[1] = a[2][1];
+        channel.addrCurrent[0] = a[3][0]; channel.addrCurrent[1] = a[3][1];
+        channel.countCurrent[0] = a[4][0]; channel.countCurrent[1] = a[4][1];
+        channel.mode = a[5];
+        channel.bPage = a[6];
+        // a[7] is deprecated
+        channel.controller = controller;
+        channel.iChannel = iChannel;
+        this.initDMAFunction(channel, a[8], a[9]);
+        controller.aChannels[iChannel] = channel;
+    }
+
+    /**
+     * initDMAFunction(channel)
+     *
+     * @param {Object} channel
+     * @param {Component|string} [component]
+     * @param {string} [sFunction]
+     * @param {Object} [obj]
+     * @return {*}
+     */
+    initDMAFunction(channel, component, sFunction, obj)
+    {
+        if (typeof component == "string") {
+            component = Component.getComponentByID(component);
+        }
+        if (component) {
+            channel.done = null;
+            channel.sDevice = component.id;
+            channel.sFunction = sFunction;
+            channel.component = component;
+            channel.fnTransfer = component[sFunction];
+            channel.obj = obj;
+        }
+        return channel.fnTransfer;
+    }
+
+    /**
+     * saveDMAControllers()
+     *
+     * @this {ChipSet}
+     * @return {Array}
+     */
+    saveDMAControllers()
+    {
+        var data = [];
+        for (var iDMAC = 0; iDMAC < this.aDMACs; iDMAC++) {
+            var controller = this.aDMACs[iDMAC];
+            data[iDMAC] = [
+                controller.bStatus,
+                controller.bCmd,
+                controller.bReq,
+                controller.bIndex,
+                this.saveDMAChannels(controller),
+                controller.bTemp
+            ];
+        }
+        return data;
+    }
+
+    /**
+     * saveDMAChannels(controller)
+     *
+     * @this {ChipSet}
+     * @param {Object} controller
+     * @return {Array}
+     */
+    saveDMAChannels(controller)
+    {
+        var data = [];
+        for (var iChannel = 0; iChannel < controller.aChannels.length; iChannel++) {
+            var channel = controller.aChannels[iChannel];
+            data[iChannel] = [
+                channel.masked,
+                channel.addrInit,
+                channel.countInit,
+                channel.addrCurrent,
+                channel.countCurrent,
+                channel.mode,
+                channel.bPage,
+                channel.sDevice,
+                channel.sFunction
+            ];
+        }
+        return data;
+    }
+
+    /**
+     * initPIC(iPIC, port, aState)
+     *
+     * @this {ChipSet}
+     * @param {number} iPIC
+     * @param {number} port
+     * @param {Array} [aState]
+     */
+    initPIC(iPIC, port, aState)
+    {
+        var pic = this.aPICs[iPIC];
+        if (!pic) {
+            pic = {
+                aICW:   [null,null,null,null]
+            };
+        }
+        var a = aState && aState.length == 8? aState : ChipSet.aPICInit;
+        pic.port = port;
+        pic.nIRQBase = iPIC << 3;
+        pic.nDelay = a[0];
+        pic.aICW[0] = a[1][0]; pic.aICW[1] = a[1][1]; pic.aICW[2] = a[1][2]; pic.aICW[3] = a[1][3];
+        pic.nICW = a[2];
+        pic.bIMR = a[3];
+        pic.bIRR = a[4];
+        pic.bISR = a[5];
+        pic.bIRLow = a[6];
+        pic.bOCW3 = a[7];
+        this.aPICs[iPIC] = pic;
+    }
+
+    /**
+     * savePICs()
+     *
+     * @this {ChipSet}
+     * @return {Array}
+     */
+    savePICs()
+    {
+        var data = [];
+        for (var iPIC = 0; iPIC < this.aPICs.length; iPIC++) {
+            var pic = this.aPICs[iPIC];
+            data[iPIC] = [
+                pic.nDelay,
+                pic.aICW,
+                pic.nICW,
+                pic.bIMR,
+                pic.bIRR,
+                pic.bISR,
+                pic.bIRLow,
+                pic.bOCW3
+            ];
+        }
+        return data;
+    }
+
+    /**
+     * initTimer(iTimer, aState)
+     *
+     * @this {ChipSet}
+     * @param {number} iTimer
+     * @param {Array} [aState]
+     */
+    initTimer(iTimer, aState)
+    {
+        var timer = this.aTimers[iTimer];
+        if (!timer) {
+            timer = {
+                countInit: [0,0],
+                countStart: [0,0],
+                countCurrent: [0,0],
+                countLatched: [0,0]
+            };
+        }
+        var a = aState && aState.length >= 13? aState : ChipSet.aTimerInit;
+        timer.countInit[0] = a[0][0]; timer.countInit[1] = a[0][1];
+        timer.countStart[0] = a[1][0]; timer.countStart[1] = a[1][1];
+        timer.countCurrent[0] = a[2][0]; timer.countCurrent[1] = a[2][1];
+        timer.countLatched[0] = a[3][0]; timer.countLatched[1] = a[3][1];
+        timer.bcd = a[4];
+        timer.mode = a[5];
+        timer.rw = a[6];
+        timer.countIndex = a[7];
+        timer.countBytes = a[8];
+        timer.fOUT = a[9];
+        timer.fCountLatched = a[10];
+        timer.fCounting = a[11];
+        timer.nCyclesStart = a[12];
+        timer.bStatus = a[13] || 0;
+        timer.fStatusLatched = a[14] || false;
+        this.aTimers[iTimer] = timer;
+    }
+
+    /**
+     * saveTimers()
+     *
+     * @this {ChipSet}
+     * @return {Array}
+     */
+    saveTimers()
+    {
+        var data = [];
+        for (var iTimer = 0; iTimer < this.aTimers.length; iTimer++) {
+            var timer = this.aTimers[iTimer];
+            data[iTimer] = [
+                timer.countInit,
+                timer.countStart,
+                timer.countCurrent,
+                timer.countLatched,
+                timer.bcd,
+                timer.mode,
+                timer.rw,
+                timer.countIndex,
+                timer.countBytes,
+                timer.fOUT,
+                timer.fCountLatched,
+                timer.fCounting,
+                timer.nCyclesStart,
+                timer.bStatus,
+                timer.fStatusLatched
+            ];
+        }
+        return data;
+    }
+
+    /**
+     * addDIPSwitches(iDIP, sBinding)
+     *
+     * @this {ChipSet}
+     * @param {number} iDIP (0 or 1)
+     * @param {string} sBinding is the name of the control
+     */
+    addDIPSwitches(iDIP, sBinding)
+    {
+        var sHTML = "";
+        var control = this.bindings[sBinding];
+        for (var i = 1; i <= 8; i++) {
+            var sCellClasses = this.sCellClass;
+            if (!i) sCellClasses += " " + this.sCellClass + "Left";
+            var sCellID = sBinding + "-" + i;
+            sHTML += "<div id=\"" + sCellID + "\" class=\"" + sCellClasses + "\" data-value=\"0\">" + i + "</div>\n";
+        }
+        control.innerHTML = sHTML;
+        this.updateDIPSwitchControls(iDIP, sBinding, true);
+    }
+
+    /**
+     * findDIPSwitch(iDIP, iSwitch)
+     *
+     * @this {ChipSet}
+     * @param {number} iDIP
+     * @param {number} iSwitch
+     * @return {Object|null} DIPSW switchGroup containing the DIP switch's MASK, VALUES, and LABEL, or null if none
+     */
+    findDIPSwitch(iDIP, iSwitch)
+    {
+        var switchDIPs = ChipSet.DIPSW[this.model|0];
+        var switchTypes = switchDIPs && switchDIPs[iDIP];
+        if (switchTypes) {
+            for (var iType in switchTypes) {
+                var switchGroup = switchTypes[iType];
+                if (switchGroup.MASK & (1 << iSwitch)) {
+                    return switchGroup;
+                }
+            }
+        }
+        return null;
+    }
+
+    /**
+     * getDIPLegacyBits(iDIP)
+     *
+     * @this {ChipSet}
+     * @param {number} iDIP
+     * @return {number|undefined}
+     */
+    getDIPLegacyBits(iDIP)
+    {
+        var b;
+        if (!iDIP) {
+            b = 0;
+            b |= (this.getDIPVideoMonitor() << ChipSet.PPI_SW.MONITOR.SHIFT) & ChipSet.PPI_SW.MONITOR.MASK;
+            b |= (this.getDIPCoprocessor()? ChipSet.PPI_SW.FPU : 0);
+            var nDrives = this.getDIPFloppyDrives();
+            b |= (nDrives? ((((nDrives - 1) << ChipSet.PPI_SW.FDRIVE.SHIFT) & ChipSet.PPI_SW.FDRIVE.MASK) | ChipSet.PPI_SW.FDRIVE.IPL) : 0);
+        }
+        return b;
+    }
+
+    /**
+     * getDIPSwitches(iType, fInit)
+     *
+     * @this {ChipSet}
+     * @param {number} iType
+     * @param {boolean} [fInit] is true for initial switch value, current value otherwise
+     * @return {*|null}
+     */
+    getDIPSwitches(iType, fInit)
+    {
+        var value = null;
+        var switchDIPs = ChipSet.DIPSW[this.model] || ChipSet.DIPSW[this.model|0] || ChipSet.DIPSW[ChipSet.MODEL_5150];
+        for (var iDIP = 0; iDIP < switchDIPs.length; iDIP++) {
+            var switchTypes = switchDIPs[iDIP];
+            if (switchTypes) {
+                var switchGroup = switchTypes[iType];
+                if (switchGroup) {
+                    var bits = this.aDIPSwitches[iDIP][fInit?0:1] & switchGroup.MASK;
+                    for (var v in switchGroup.VALUES) {
+                        if (switchGroup.VALUES[v] == bits) {
+                            value = v;
+                            /*
+                             * We prefer numeric properties, and all switch definitions must provide them
+                             * if their helper functions (eg, getDIPVideoMonitor()) expect numeric properties.
+                             */
+                            if (typeof +value == 'number') break;
+                        }
+                    }
+                    break;
+                }
+            }
+        }
+        return value;
+    }
+
+    /**
+     * getDIPCoprocessor(fInit)
+     *
+     * @this {ChipSet}
+     * @param {boolean} [fInit] is true for init switch value(s) only, current value(s) otherwise
+     * @return {number} 1 if installed, 0 if not
+     */
+    getDIPCoprocessor(fInit)
+    {
+        var n = /** @type {number} */ (this.getDIPSwitches(ChipSet.SWITCH_TYPE.FPU, fInit));
+        return +n;
+    }
+
+    /**
+     * getDIPFloppyDrives(fInit)
+     *
+     * @this {ChipSet}
+     * @param {boolean} [fInit] is true for init switch value(s) only, current value(s) otherwise
+     * @return {number} number of floppy drives specified by SW1 (range is 0 to 4)
+     */
+    getDIPFloppyDrives(fInit)
+    {
+        var n = /** @type {number} */ (this.getDIPSwitches(ChipSet.SWITCH_TYPE.FLOPNUM, fInit));
+        return +n;
+    }
+
+    /**
+     * getDIPFloppyDriveType(iDrive)
+     *
+     * @this {ChipSet}
+     * @param {number} iDrive (0-based)
+     * @return {number} one of the ChipSet.CMOS.FDRIVE.FD* values (FD360, FD1200, etc)
+     */
+    getDIPFloppyDriveType(iDrive)
+    {
+        if (iDrive < this.getDIPFloppyDrives()) {
+            if (!this.aFloppyDrives) {
+                return ChipSet.CMOS.FDRIVE.FD360;
+            }
+            if (iDrive < this.aFloppyDrives.length) {
+                switch(this.aFloppyDrives[iDrive]) {
+                case 160:
+                case 180:
+                case 320:
+                case 360:
+                    return ChipSet.CMOS.FDRIVE.FD360;
+                case 720:
+                    return ChipSet.CMOS.FDRIVE.FD720;
+                case 1200:
+                    return ChipSet.CMOS.FDRIVE.FD1200;
+                case 1440:
+                    return ChipSet.CMOS.FDRIVE.FD1440;
+                }
+            }
+
+        }
+        return ChipSet.CMOS.FDRIVE.NONE;
+    }
+
+    /**
+     * getDIPFloppyDriveSize(iDrive)
+     *
+     * @this {ChipSet}
+     * @param {number} iDrive (0-based)
+     * @return {number} capacity of drive in Kb (eg, 360, 1200, 1440, etc), or 0 if none
+     */
+    getDIPFloppyDriveSize(iDrive)
+    {
+        if (iDrive < this.getDIPFloppyDrives()) {
+            if (!this.aFloppyDrives) {
+                return 360;
+            }
+            if (iDrive < this.aFloppyDrives.length) {
+                return this.aFloppyDrives[iDrive];
+            }
+
+        }
+        return 0;
+    }
+
+    /**
+     * getDIPMemorySize(fInit)
+     *
+     * @this {ChipSet}
+     * @param {boolean} [fInit] is true for init switch value(s) only, current value(s) otherwise
+     * @return {number} number of Kb of specified memory (NOT necessarily the same as installed memory; see RAM component)
+     */
+    getDIPMemorySize(fInit)
+    {
+        var nKBLowMem = /** @type {number} */ (this.getDIPSwitches(ChipSet.SWITCH_TYPE.LOWMEM, fInit));
+        var nKBExpMem = /** @type {number} */ (this.getDIPSwitches(ChipSet.SWITCH_TYPE.EXPMEM, fInit));
+        return +nKBLowMem + +nKBExpMem;
+    }
+
+    /**
+     * getDIPVideoMonitor(fInit)
+     *
+     * @this {ChipSet}
+     * @param {boolean} [fInit] is true for init switch value(s) only, current value(s) otherwise
+     * @return {number} one of ChipSet.MONITOR.*
+     */
+    getDIPVideoMonitor(fInit)
+    {
+        var n = /** @type {number} */ (this.getDIPSwitches(ChipSet.SWITCH_TYPE.MONITOR, fInit));
+        return +n;
+    }
+
+    /**
+     * parseDIPSwitches(sBits, bDefault)
+     *
+     * @this {ChipSet}
+     * @param {string} sBits describing switch settings
+     * @param {number} [bDefault]
+     * @return {number|undefined}
+     */
+    parseDIPSwitches(sBits, bDefault)
+    {
+        var b = bDefault;
+        if (sBits) {
+            /*
+             * NOTE: We can't use parseInt() with a base of 2, because both bit order and bit sense are reversed.
+             */
+            b = 0;
+            var bit = 0x1;
+            for (var i = 0; i < sBits.length; i++) {
+                if (sBits.charAt(i) == "0") b |= bit;
+                bit <<= 1;
+            }
+        }
+        return b;
+    }
+
+    /**
+     * setDIPSwitches(iType, value, fInit)
+     *
+     * @this {ChipSet}
+     * @param {number} iType
+     * @param {*} value
+     * @param {boolean} [fInit]
+     * @return {boolean} true if successful, false if unrecognized type and/or value
+     */
+    setDIPSwitches(iType, value, fInit)
+    {
+        var switchDIPs = ChipSet.DIPSW[this.model] || ChipSet.DIPSW[this.model|0] || ChipSet.DIPSW[ChipSet.MODEL_5150];
+        for (var iDIP = 0; iDIP < switchDIPs.length; iDIP++) {
+            var switchTypes = switchDIPs[iDIP];
+            if (switchTypes) {
+                var switchGroup = switchTypes[iType];
+                if (switchGroup) {
+                    for (var v in switchGroup.VALUES) {
+                        if (v == value) {
+                            this.aDIPSwitches[iDIP][fInit?0:1] &= ~switchGroup.MASK;
+                            this.aDIPSwitches[iDIP][fInit?0:1] |= switchGroup.VALUES[v];
+                            return true;
+                        }
+                    }
+                }
+            }
+        }
+        return false;
+    }
+
+    /**
+     * getDIPSwitchControl(control)
+     *
+     * @this {ChipSet}
+     * @param {Object} control is an HTML control DOM object
+     * @return {boolean} true if the switch represented by e is "on", false if "off"
+     */
+    getDIPSwitchControl(control)
+    {
+        return control.getAttribute("data-value") == "1";
+    }
+
+    /**
+     * setDIPSwitchControl(control, f)
+     *
+     * @this {ChipSet}
+     * @param {Object} control is an HTML control DOM object
+     * @param {boolean} f is true if the switch represented by control should be "on", false if "off"
+     */
+    setDIPSwitchControl(control, f)
+    {
+        control.setAttribute("data-value", f? "1" : "0");
+        control.style.color = (f? "#ffffff" : "#000000");
+        control.style.backgroundColor = (f? "#000000" : "#ffffff");
+    }
+
+    /**
+     * toggleDIPSwitchControl(control)
+     *
+     * @this {ChipSet}
+     * @param {Object} control is an HTML control DOM object
+     */
+    toggleDIPSwitchControl(control)
+    {
+        var f = !this.getDIPSwitchControl(control);
+        this.setDIPSwitchControl(control, f);
+        var sID = control.getAttribute("id");
+        var asParts = sID.split("-");
+        var b = (0x1 << (+asParts[1] - 1));
+        switch (asParts[0]) {
+        case ChipSet.CONTROLS.SW1:
+            this.aDIPSwitches[0][0] = (this.aDIPSwitches[0][0] & ~b) | (f? 0 : b);
+            break;
+        case ChipSet.CONTROLS.SW2:
+            this.aDIPSwitches[1][0] = (this.aDIPSwitches[1][0] & ~b) | (f? 0 : b);
+            break;
+        default:
+            break;
+        }
+        this.updateDIPSwitchDescriptions();
+    }
+
+    /**
+     * updateDIPSwitches()
+     *
+     * @this {ChipSet}
+     */
+    updateDIPSwitches()
+    {
+        this.updateDIPSwitchControls(0, ChipSet.CONTROLS.SW1);
+        this.updateDIPSwitchControls(1, ChipSet.CONTROLS.SW2);
+        this.updateDIPSwitchDescriptions();
+    }
+
+    /**
+     * updateDIPSwitchControls(iDIP, sBinding, fInit)
+     *
+     * @this {ChipSet}
+     * @param {number} iDIP (0 or 1)
+     * @param {string} sBinding is the name of the control
+     * @param {boolean} [fInit]
+     */
+    updateDIPSwitchControls(iDIP, sBinding, fInit)
+    {
+        var control = this.bindings[sBinding];
+        if (control) {
+            var v;
+            if (fInit) {
+                v = this.aDIPSwitches[iDIP][0];
+            } else {
+                v = this.aDIPSwitches[iDIP][1] = this.aDIPSwitches[iDIP][0];
+            }
+            var aeCells = Component.getElementsByClass(control, this.sCellClass);
+            for (var i = 0; i < aeCells.length; i++) {
+                var switchGroup = this.findDIPSwitch(iDIP, i);
+                var sLabel = switchGroup && switchGroup.LABEL || "Reserved";
+                aeCells[i].setAttribute("title", sLabel);
+                this.setDIPSwitchControl(aeCells[i], !(v & (0x1 << i)));
+                aeCells[i].onclick = function(chipset, eSwitch) {
+                    /*
+                     *  If we defined the onclick handler below as "function(e)" instead of simply "function()", then we could
+                     *  also receive an event object (e); however, IE reportedly requires that we examine a global (window.event)
+                     *  instead.  If that's true, and if we ever care to get more details about the click event, then we might
+                     *  have to worry about that (eg, define a local var: "var event = window.event || e").
+                     */
+                    return function onClickSwitch() {
+                        chipset.toggleDIPSwitchControl(eSwitch);
+                    };
+                }(this, aeCells[i]);
+            }
+        }
+    }
+
+    /**
+     * updateDIPSwitchDescriptions()
+     *
+     * @this {ChipSet}
+     */
+    updateDIPSwitchDescriptions()
+    {
+        var controlDesc = this.bindings[ChipSet.CONTROLS.SWDESC];
+        if (controlDesc != null) {
+            var sText = "";
+            /*
+             * TODO: Monitor type 0 used to be "None" (ie, "No Monitor"), which was correct in a pre-EGA world,
+             * but in the post-EGA world, it depends.  We should ask the Video component for a definitive answer.
+             */
+            var asMonitorTypes = {
+                0: "Enhanced Color",
+                1: "TV",
+                2: "Color",
+                3: "Monochrome"
+            };
+            sText += this.getDIPMemorySize(true) + "Kb";
+            sText += ", " + (+this.getDIPCoprocessor(true)? "" : "No ") + "FPU";
+            sText += ", " + asMonitorTypes[this.getDIPVideoMonitor(true)] + " Monitor";
+            sText += ", " + this.getDIPFloppyDrives(true) + " Floppy Drives";
+            if (this.aDIPSwitches[0][1] != null && this.aDIPSwitches[0][1] != this.aDIPSwitches[0][0] ||
+                this.aDIPSwitches[1][1] != null && this.aDIPSwitches[1][1] != this.aDIPSwitches[1][0]) {
+                sText += " (Reset required)";
+            }
+            controlDesc.textContent = sText;
+        }
+    }
+
+    /**
+     * dumpPIC()
+     *
+     * @this {ChipSet}
+     */
+    dumpPIC()
+    {
+        if (DEBUGGER) {
+            for (var iPIC = 0; iPIC < this.aPICs.length; iPIC++) {
+                var pic = this.aPICs[iPIC];
+                var sDump = "PIC" + iPIC + ":";
+                for (var i = 0; i < pic.aICW.length; i++) {
+                    var b = pic.aICW[i];
+                    sDump += " IC" + (i + 1) + '=' + Str.toHexByte(b);
+                }
+                sDump += " IMR=" + Str.toHexByte(pic.bIMR) + " IRR=" + Str.toHexByte(pic.bIRR) + " ISR=" + Str.toHexByte(pic.bISR) + " DELAY=" + pic.nDelay;
+                this.dbg.println(sDump);
+            }
+        }
+    }
+
+    /**
+     * dumpTimer(asArgs)
+     *
+     * Use "d timer" to dump all timers, or "d timer n" to dump only timer n.
+     *
+     * @this {ChipSet}
+     * @param {Array.<string>} asArgs
+     */
+    dumpTimer(asArgs)
+    {
+        if (DEBUGGER) {
+            var sParm = asArgs[0];
+            var nTimer = (sParm? +sParm : null);
+            for (var iTimer = 0; iTimer < this.aTimers.length; iTimer++) {
+                if (nTimer != null && iTimer != nTimer) continue;
+                this.updateTimer(iTimer);
+                var timer = this.aTimers[iTimer];
+                var sDump = "TIMER" + iTimer + ":";
+                var count = 0;
+                if (timer.countBytes != null) {
+                    for (var i = 0; i <= timer.countBytes; i++) {
+                        count |= (timer.countCurrent[i] << (i * 8));
+                    }
+                }
+                sDump += " mode=" + (timer.mode >> 1) + " bytes=" + timer.countBytes + " count=" + Str.toHexWord(count);
+                this.dbg.println(sDump);
+            }
+        }
+    }
+
+    /**
+     * dumpCMOS()
+     *
+     * @this {ChipSet}
+     */
+    dumpCMOS()
+    {
+        if (DEBUGGER) {
+            var sDump = "";
+            for (var iCMOS = 0; iCMOS < ChipSet.CMOS.ADDR.TOTAL; iCMOS++) {
+                var b = (iCMOS <= ChipSet.CMOS.ADDR.STATUSD? this.getRTCByte(iCMOS) : this.abCMOSData[iCMOS]);
+                if (sDump) sDump += '\n';
+                sDump += "CMOS[" + Str.toHexByte(iCMOS) + "]: " + Str.toHexByte(b);
+            }
+            this.dbg.println(sDump);
+        }
+    }
+
+    /**
+     * inDMAChannelAddr(iDMAC, iChannel, port, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iDMAC
+     * @param {number} iChannel
+     * @param {number} port (0x00, 0x02, 0x04, 0x06 for DMAC 0, 0xC0, 0xC4, 0xC8, 0xCC for DMAC 1)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inDMAChannelAddr(iDMAC, iChannel, port, addrFrom)
+    {
+        var controller = this.aDMACs[iDMAC];
+        var channel = controller.aChannels[iChannel];
+        var b = channel.addrCurrent[controller.bIndex];
+        if (this.messageEnabled(Messages.DMA | Messages.PORT)) {
+            this.printMessageIO(port, null, addrFrom, "DMA" + iDMAC + ".CHANNEL" + iChannel + ".ADDR[" + controller.bIndex + "]", b, true);
+        }
+        controller.bIndex ^= 0x1;
+        /*
+         * Technically, aTimers[1].fOut is what drives DMA requests for DMA channel 0 (ChipSet.DMA_REFRESH),
+         * every 15us, once the BIOS has initialized the channel's "mode" with MODE_SINGLE, INCREMENT, AUTOINIT,
+         * and TYPE_READ (0x58) and initialized TIMER1 appropriately.
+         *
+         * However, we don't need to be that particular.  Simply simulate an ever-increasing address after every
+         * read of the full DMA channel 0 address.
+         */
+        if (!iDMAC && iChannel == ChipSet.DMA_REFRESH && !controller.bIndex) {
+            channel.addrCurrent[0]++;
+            if (channel.addrCurrent[0] > 0xff) {
+                channel.addrCurrent[0] = 0;
+                channel.addrCurrent[1]++;
+                if (channel.addrCurrent[1] > 0xff) {
+                    channel.addrCurrent[1] = 0;
+                }
+            }
+        }
+        return b;
+    }
+
+    /**
+     * outDMAChannelAddr(iDMAC, iChannel, port, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iDMAC
+     * @param {number} iChannel
+     * @param {number} port (0x00, 0x02, 0x04, 0x06 for DMAC 0, 0xC0, 0xC4, 0xC8, 0xCC for DMAC 1)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     */
+    outDMAChannelAddr(iDMAC, iChannel, port, bOut, addrFrom)
+    {
+        var controller = this.aDMACs[iDMAC];
+        if (this.messageEnabled(Messages.DMA | Messages.PORT)) {
+            this.printMessageIO(port, bOut, addrFrom, "DMA" + iDMAC + ".CHANNEL" + iChannel + ".ADDR[" + controller.bIndex + "]", null, true);
+        }
+        var channel = controller.aChannels[iChannel];
+        channel.addrCurrent[controller.bIndex] = channel.addrInit[controller.bIndex] = bOut;
+        controller.bIndex ^= 0x1;
+    }
+
+    /**
+     * inDMAChannelCount(iDMAC, iChannel, port, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iDMAC
+     * @param {number} iChannel
+     * @param {number} port (0x01, 0x03, 0x05, 0x07 for DMAC 0, 0xC2, 0xC6, 0xCA, 0xCE for DMAC 1)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inDMAChannelCount(iDMAC, iChannel, port, addrFrom)
+    {
+        var controller = this.aDMACs[iDMAC];
+        var channel = controller.aChannels[iChannel];
+        var b = channel.countCurrent[controller.bIndex];
+        if (this.messageEnabled(Messages.DMA | Messages.PORT)) {
+            this.printMessageIO(port, null, addrFrom, "DMA" + iDMAC + ".CHANNEL" + iChannel + ".COUNT[" + controller.bIndex + "]", b, true);
+        }
+        controller.bIndex ^= 0x1;
+        /*
+         * Technically, aTimers[1].fOut is what drives DMA requests for DMA channel 0 (ChipSet.DMA_REFRESH),
+         * every 15us, once the BIOS has initialized the channel's "mode" with MODE_SINGLE, INCREMENT, AUTOINIT,
+         * and TYPE_READ (0x58) and initialized TIMER1 appropriately.
+         *
+         * However, we don't need to be that particular.  Simply simulate an ever-decreasing count after every
+         * read of the full DMA channel 0 count.
+         */
+        if (!iDMAC && iChannel == ChipSet.DMA_REFRESH && !controller.bIndex) {
+            channel.countCurrent[0]--;
+            if (channel.countCurrent[0] < 0) {
+                channel.countCurrent[0] = 0xff;
+                channel.countCurrent[1]--;
+                if (channel.countCurrent[1] < 0) {
+                    channel.countCurrent[1] = 0xff;
+                    /*
+                     * This is the logical point to indicate Terminal Count (TC), but again, there's no need to be
+                     * so particular; inDMAStatus() has its own logic for periodically signalling TC.
+                     */
+                }
+            }
+        }
+        return b;
+    }
+
+    /**
+     * outDMAChannelCount(iDMAC, iChannel, port, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iDMAC
+     * @param {number} iChannel (ports 0x01, 0x03, 0x05, 0x07)
+     * @param {number} port (0x01, 0x03, 0x05, 0x07 for DMAC 0, 0xC2, 0xC6, 0xCA, 0xCE for DMAC 1)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     */
+    outDMAChannelCount(iDMAC, iChannel, port, bOut, addrFrom)
+    {
+        var controller = this.aDMACs[iDMAC];
+        if (this.messageEnabled(Messages.DMA | Messages.PORT)) {
+            this.printMessageIO(port, bOut, addrFrom, "DMA" + iDMAC + ".CHANNEL" + iChannel + ".COUNT[" + controller.bIndex + "]", null, true);
+        }
+        var channel = controller.aChannels[iChannel];
+        channel.countCurrent[controller.bIndex] = channel.countInit[controller.bIndex] = bOut;
+        controller.bIndex ^= 0x1;
+    }
+
+    /**
+     * inDMAStatus(iDMAC, port, addrFrom)
+     *
+     * From the 8237A spec:
+     *
+     * "The Status register is available to be read out of the 8237A by the microprocessor.
+     * It contains information about the status of the devices at this point. This information includes
+     * which channels have reached Terminal Count (TC) and which channels have pending DMA requests.
+     *
+     * Bits 0–3 are set every time a TC is reached by that channel or an external EOP is applied.
+     * These bits are cleared upon Reset and on each Status Read.
+     *
+     * Bits 4–7 are set whenever their corresponding channel is requesting service."
+     *
+     * TRIVIA: This hook wasn't installed when I was testing with the MODEL_5150 ROM BIOS, and it
+     * didn't matter, but the MODEL_5160 ROM BIOS checks it several times, including @F000:E156, where
+     * it verifies that TIMER1 didn't request service on channel 0.
+     *
+     * @this {ChipSet}
+     * @param {number} iDMAC
+     * @param {number} port (0x08 for DMAC 0, 0xD0 for DMAC 1)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inDMAStatus(iDMAC, port, addrFrom)
+    {
+        /*
+         * HACK: Unlike the MODEL_5150, the MODEL_5160 ROM BIOS checks DMA channel 0 for TC (@F000:E4DF)
+         * after running a number of unrelated tests, since enough time would have passed for channel 0 to
+         * have reached TC at least once.  So I simply OR in a hard-coded TC bit for channel 0 every time
+         * status is read.
+         */
+        var controller = this.aDMACs[iDMAC];
+        var b = controller.bStatus | ChipSet.DMA_STATUS.CH0_TC;
+        controller.bStatus &= ~ChipSet.DMA_STATUS.ALL_TC;
+        if (this.messageEnabled(Messages.DMA | Messages.PORT)) {
+            this.printMessageIO(port, null, addrFrom, "DMA" + iDMAC + ".STATUS", b, true);
+        }
+        return b;
+    }
+
+    /**
+     * outDMACmd(iDMAC, port, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iDMAC
+     * @param {number} port (0x08 for DMAC 0, 0xD0 for DMAC 1)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     */
+    outDMACmd(iDMAC, port, bOut, addrFrom)
+    {
+        if (this.messageEnabled(Messages.DMA | Messages.PORT)) {
+            this.printMessageIO(port, bOut, addrFrom, "DMA" + iDMAC + ".CMD", null, true);
+        }
+        this.aDMACs[iDMAC].bCmd = bOut;
+    }
+
+    /**
+     * outDMAReq(iDMAC, port, bOut, addrFrom)
+     *
+     * From the 8237A spec:
+     *
+     * "The 8237A can respond to requests for DMA service which are initiated by software as well as by a DREQ.
+     * Each channel has a request bit associated with it in the 4-bit Request register. These are non-maskable and subject
+     * to prioritization by the Priority Encoder network. Each register bit is set or reset separately under software
+     * control or is cleared upon generation of a TC or external EOP. The entire register is cleared by a Reset.
+     *
+     * To set or reset a bit the software loads the proper form of the data word.... In order to make a software request,
+     * the channel must be in Block Mode."
+     *
+     * @this {ChipSet}
+     * @param {number} iDMAC
+     * @param {number} port (0x09 for DMAC 0, 0xD2 for DMAC 1)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     */
+    outDMAReq(iDMAC, port, bOut, addrFrom)
+    {
+        var controller = this.aDMACs[iDMAC];
+        if (this.messageEnabled(Messages.DMA | Messages.PORT)) {
+            this.printMessageIO(port, bOut, addrFrom, "DMA" + iDMAC + ".REQ", null, true);
+        }
+        /*
+         * Bits 0-1 contain the channel number
+         */
+        var iChannel = (bOut & 0x3);
+        /*
+         * Bit 2 is the request bit (0 to reset, 1 to set), which must be propagated to the corresponding bit (4-7) in the status register
+         */
+        var iChannelBit = ((bOut & 0x4) << (iChannel + 2));
+        controller.bStatus = (controller.bStatus & ~(0x10 << iChannel)) | iChannelBit;
+        controller.bReq = bOut;
+    }
+
+    /**
+     * outDMAMask(iDMAC, port, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iDMAC
+     * @param {number} port (0x0A for DMAC 0, 0xD4 for DMAC 1)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     */
+    outDMAMask(iDMAC, port, bOut, addrFrom)
+    {
+        var controller = this.aDMACs[iDMAC];
+        if (this.messageEnabled(Messages.DMA | Messages.PORT)) {
+            this.printMessageIO(port, bOut, addrFrom, "DMA" + iDMAC + ".MASK", null, true);
+        }
+        var iChannel = bOut & ChipSet.DMA_MASK.CHANNEL;
+        var channel = controller.aChannels[iChannel];
+        channel.masked = !!(bOut & ChipSet.DMA_MASK.CHANNEL_SET);
+        if (!channel.masked) this.requestDMA(controller.nChannelBase + iChannel);
+    }
+
+    /**
+     * outDMAMode(iDMAC, port, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iDMAC
+     * @param {number} port (0x0B for DMAC 0, 0xD6 for DMAC 1)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     */
+    outDMAMode(iDMAC, port, bOut, addrFrom)
+    {
+        if (this.messageEnabled(Messages.DMA | Messages.PORT)) {
+            this.printMessageIO(port, bOut, addrFrom, "DMA" + iDMAC + ".MODE", null, true);
+        }
+        var iChannel = bOut & ChipSet.DMA_MODE.CHANNEL;
+        this.aDMACs[iDMAC].aChannels[iChannel].mode = bOut;
+    }
+
+    /**
+     * outDMAResetFF(iDMAC, port, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iDMAC
+     * @param {number} port (0x0C for DMAC 0, 0xD8 for DMAC 1)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     *
+     * Any write to this port simply resets the controller's "first/last flip-flop", which determines whether
+     * the even or odd byte of a DMA address or count register will be accessed next.
+     */
+    outDMAResetFF(iDMAC, port, bOut, addrFrom)
+    {
+        if (this.messageEnabled(Messages.DMA | Messages.PORT)) {
+            this.printMessageIO(port, bOut, addrFrom, "DMA" + iDMAC + ".RESET_FF", null, true);
+        }
+        this.aDMACs[iDMAC].bIndex = 0;
+    }
+
+    /**
+     * inDMATemp(iDMAC, port, addrFrom)
+     *
+     * From the 8237A spec:
+     *
+     * "The Temporary register is used to hold data during memory-to-memory transfers  Following the
+     * completion of the transfers, the last word moved can be read by the microprocessor in the Program Condition.
+     * The Temporary register always contains the last byte transferred in the previous memory-to-memory operation,
+     * unless cleared by a Reset."
+     *
+     * TRIVIA: This hook wasn't installed when I was testing with ANY of the IBM ROMs, but it's required
+     * by the AT&T 6300 (aka Olivetti M24) ROM.
+     *
+     * TODO: When support is added for memory-to-memory transfers, bTemp needs to be updated according to spec.
+     *
+     * @this {ChipSet}
+     * @param {number} iDMAC
+     * @param {number} port (0x0D for DMAC 0, 0xDA for DMAC 1)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inDMATemp(iDMAC, port, addrFrom)
+    {
+        var controller = this.aDMACs[iDMAC];
+        var b = controller.bTemp;
+        if (this.messageEnabled(Messages.DMA | Messages.PORT)) {
+            this.printMessageIO(port, null, addrFrom, "DMA" + iDMAC + ".TEMP", b, true);
+        }
+        return b;
+    }
+
+    /**
+     * outDMAMasterClear(iDMAC, port, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iDMAC
+     * @param {number} port (0x0D for DMAC 0, 0xDA for DMAC 1)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     */
+    outDMAMasterClear(iDMAC, port, bOut, addrFrom)
+    {
+        if (this.messageEnabled(Messages.DMA | Messages.PORT)) {
+            this.printMessageIO(port, bOut, addrFrom, "DMA" + iDMAC + ".MASTER_CLEAR", null, true);
+        }
+        /*
+         * The value written to this port doesn't matter; any write triggers a "master clear" operation
+         *
+         * TODO: Can't we just call initDMAController(), which would also take care of clearing controller.bStatus?
+         */
+        var controller = this.aDMACs[iDMAC];
+        for (var i = 0; i < controller.aChannels.length; i++) {
+            this.initDMAChannel(controller, i);
+        }
+    }
+
+    /**
+     * inDMAPageReg(iDMAC, iChannel, port, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iDMAC
+     * @param {number} iChannel
+     * @param {number} port
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inDMAPageReg(iDMAC, iChannel, port, addrFrom)
+    {
+        var bIn = this.aDMACs[iDMAC].aChannels[iChannel].bPage;
+        if (this.messageEnabled(Messages.DMA | Messages.PORT)) {
+            this.printMessageIO(port, null, addrFrom, "DMA" + iDMAC + ".CHANNEL" + iChannel + ".PAGE", bIn, true);
+        }
+        return bIn;
+    }
+
+    /**
+     * outDMAPageReg(iDMAC, iChannel, port, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iDMAC
+     * @param {number} iChannel
+     * @param {number} port
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     */
+    outDMAPageReg(iDMAC, iChannel, port, bOut, addrFrom)
+    {
+        if (this.messageEnabled(Messages.DMA | Messages.PORT)) {
+            this.printMessageIO(port, bOut, addrFrom, "DMA" + iDMAC + ".CHANNEL" + iChannel + ".PAGE", null, true);
+        }
+        this.aDMACs[iDMAC].aChannels[iChannel].bPage = bOut;
+    }
+
+    /**
+     * inDMAPageSpare(iSpare, port, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iSpare
+     * @param {number} port
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inDMAPageSpare(iSpare, port, addrFrom)
+    {
+        var bIn = this.abDMAPageSpare[iSpare];
+        if (this.messageEnabled(Messages.DMA | Messages.PORT)) {
+            this.printMessageIO(port, null, addrFrom, "DMA.SPARE" + iSpare + ".PAGE", bIn, true);
+        }
+        return bIn;
+    }
+
+    /**
+     * outDMAPageSpare(iSpare, port, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iSpare
+     * @param {number} port
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     */
+    outDMAPageSpare(iSpare, port, bOut, addrFrom)
+    {
+        /*
+         * TODO: Remove this DEBUG-only DESKPRO386 code once we're done debugging DeskPro 386 ROMs;
+         * it enables logging of all DeskPro 386 ROM checkpoint I/O to port 0x84.
+         */
+        if (this.messageEnabled(Messages.DMA | Messages.PORT) || DEBUG && (this.model|0) == ChipSet.MODEL_COMPAQ_DESKPRO386 && port == 0x84) {
+            this.printMessageIO(port, bOut, addrFrom, "DMA.SPARE" + iSpare + ".PAGE", null, true);
+        }
+        this.abDMAPageSpare[iSpare] = bOut;
+    }
+
+    /**
+     * connectDMA(iDMAChannel, component, sFunction, obj)
+     *
+     * @param {number} iDMAChannel
+     * @param {Component|string} component
+     * @param {string} sFunction
+     * @param {Object} obj (eg, when the HDC connects, it passes a drive object)
+     */
+    connectDMA(iDMAChannel, component, sFunction, obj)
+    {
+        var iDMAC = iDMAChannel >> 2;
+        var controller = this.aDMACs[iDMAC];
+
+        var iChannel = iDMAChannel & 0x3;
+        var channel = controller.aChannels[iChannel];
+
+        this.initDMAFunction(channel, component, sFunction, obj);
+    }
+
+    /**
+     * requestDMA(iDMAChannel, done)
+     *
+     * @this {ChipSet}
+     * @param {number} iDMAChannel
+     * @param {function(boolean)} [done]
+     *
+     * For DMA_MODE.TYPE_WRITE transfers, fnTransfer(-1) must return bytes as long as we request them (although it may
+     * return -1 if it runs out of bytes prematurely).
+     *
+     * Similarly, for DMA_MODE.TYPE_READ transfers, fnTransfer(b) must accept bytes as long as we deliver them (although
+     * it is certainly free to ignore bytes it no longer wants).
+     */
+    requestDMA(iDMAChannel, done)
+    {
+        var iDMAC = iDMAChannel >> 2;
+        var controller = this.aDMACs[iDMAC];
+
+        var iChannel = iDMAChannel & 0x3;
+        var channel = controller.aChannels[iChannel];
+
+        if (!channel.component || !channel.fnTransfer || !channel.obj) {
+            if (DEBUG && this.messageEnabled(Messages.DMA | Messages.DATA)) {
+                this.printMessage("requestDMA(" + iDMAChannel + "): not connected to a component", true);
+            }
+            if (done) done(true);
+            return;
+        }
+
+        /*
+         * We can't simply slam done into channel.done; that would be fine if requestDMA() was called only by functions
+         * like HDC.doRead() and HDC.doWrite(), but we're also called whenever a DMA channel is unmasked, and in those cases,
+         * we need to preserve whatever handler may have been previously set.
+         *
+         * However, in an effort to ensure we don't end up with stale done handlers, connectDMA() will reset channel.done.
+         */
+        if (done) channel.done = done;
+
+        if (channel.masked) {
+            if (DEBUG && this.messageEnabled(Messages.DMA | Messages.DATA)) {
+                this.printMessage("requestDMA(" + iDMAChannel + "): channel masked, request queued", true);
+            }
+            return;
+        }
+
+        /*
+         * Let's try to do async DMA without asking the CPU for help...
+         *
+         *      this.cpu.setDMA(true);
+         */
+        this.advanceDMA(channel, true);
+    }
+
+    /**
+     * advanceDMA(channel, fInit)
+     *
+     * @this {ChipSet}
+     * @param {Object} channel
+     * @param {boolean} [fInit]
+     */
+    advanceDMA(channel, fInit)
+    {
+        if (fInit) {
+            channel.count = (channel.countCurrent[1] << 8) | channel.countCurrent[0];
+            channel.type = (channel.mode & ChipSet.DMA_MODE.TYPE);
+            channel.fWarning = channel.fError = false;
+            if (DEBUG && DEBUGGER) {
+                channel.cbDebug = channel.count + 1;
+                channel.sAddrDebug = (DEBUG && DEBUGGER? null : undefined);
+            }
+        }
+        /*
+         * To support async DMA without requiring help from the CPU (ie, without relying upon cpu.setDMA()), we require that
+         * the data transfer functions provide an fAsync parameter to their callbacks; fAsync must be true if the callback was
+         * truly asynchronous (ie, it had to wait for a remote I/O request to finish), or false if the data was already available
+         * and the callback was performed synchronously.
+         *
+         * Whenever a callback is issued asynchronously, we will immediately daisy-chain another pair of updateDMA()/advanceDMA()
+         * calls, which will either finish the DMA operation if no more remote I/O requests are required, or will queue up another
+         * I/O request, which will in turn trigger another async callback.  Thus, the DMA request keeps itself going without
+         * requiring any special assistance from the CPU via setDMA().
+         */
+        var bto = null;
+        var chipset = this;
+        var fAsyncRequest = false;
+        var controller = channel.controller;
+        var iDMAChannel = controller.nChannelBase + channel.iChannel;
+
+        while (true) {
+            if (channel.count >= 0) {
+                var b;
+                var addr = (channel.bPage << 16) | (channel.addrCurrent[1] << 8) | channel.addrCurrent[0];
+                if (DEBUG && DEBUGGER && channel.sAddrDebug === null) {
+                    channel.sAddrDebug = Str.toHex(addr >> 4, 4) + ":" + Str.toHex(addr & 0xf, 4);
+                    if (this.messageEnabled(this.messageBitsDMA(iDMAChannel)) && channel.type != ChipSet.DMA_MODE.TYPE_WRITE) {
+                        this.printMessage("advanceDMA(" + iDMAChannel + ") transferring " + channel.cbDebug + " bytes from " + channel.sAddrDebug, true);
+                        this.dbg.doDump(["db", channel.sAddrDebug, 'l', channel.cbDebug]);
+                    }
+                }
+                if (channel.type == ChipSet.DMA_MODE.TYPE_WRITE) {
+                    fAsyncRequest = true;
+                    (function advanceDMAWrite(addrCur) {
+                        channel.fnTransfer.call(channel.component, channel.obj, -1, function onTransferDMA(b, fAsync, obj, off) {
+                            if (b < 0) {
+                                if (!channel.fWarning) {
+                                    if (DEBUG && chipset.messageEnabled(Messages.DMA)) {
+                                        chipset.printMessage("advanceDMA(" + iDMAChannel + ") ran out of data, assuming 0xff", true);
+                                    }
+                                    channel.fWarning = true;
+                                }
+                                /*
+                                 * TODO: Determine whether to abort, as we do for DMA_MODE.TYPE_READ.
+                                 */
+                                b = 0xff;
+                            }
+                            if (!channel.masked) {
+                                chipset.bus.setByte(addrCur, b);
+                                /*
+                                 * WARNING: Do NOT assume that obj is valid; if the sector data was not found, there will be no obj.
+                                 */
+                                if (BACKTRACK && obj) {
+                                    if (!off && obj.file) {
+                                        if (chipset.messageEnabled(Messages.DISK)) {
+                                            chipset.printMessage("loading " + obj.file.sPath + '[' + obj.offFile + "] at %" + Str.toHex(addrCur), true);
+                                        }
+                                        /*
+                                        if (obj.file.sPath == "\\SYSBAS.EXE" && obj.offFile == 512) {
+                                            chipset.cpu.stopCPU();
+                                        }
+                                        */
+                                    }
+                                    bto = chipset.bus.addBackTrackObject(obj, bto, off);
+                                    chipset.bus.writeBackTrackObject(addrCur, bto, off);
+                                }
+                            }
+                            fAsyncRequest = fAsync;
+                            if (fAsync) {
+                                setTimeout(function() {
+                                    if (!chipset.updateDMA(channel)) chipset.advanceDMA(channel);
+                                }, 0);
+                            }
+                        });
+                    }(addr));
+                }
+                else if (channel.type == ChipSet.DMA_MODE.TYPE_READ) {
+                    /*
+                     * TODO: Determine whether we should support async dmaWrite() functions (currently not required)
+                     */
+                    b = chipset.bus.getByte(addr);
+                    if (channel.fnTransfer.call(channel.component, channel.obj, b) < 0) {
+                        /*
+                         * In this case, I think I have no choice but to terminate the DMA operation in response to a failure,
+                         * because the ROM BIOS FDC.REG_DATA.CMD.FORMAT_TRACK command specifies a count that is MUCH too large
+                         * (a side-effect of the ROM BIOS using the same "DMA_SETUP" code for reads, writes AND formats).
+                         */
+                        channel.fError = true;
+                    }
+                }
+                else if (channel.type == ChipSet.DMA_MODE.TYPE_VERIFY) {
+                    /*
+                     * Nothing to read or write; just call updateDMA()
+                     */
+                }
+                else {
+                    if (DEBUG && this.messageEnabled(Messages.DMA | Messages.WARN)) {
+                        this.printMessage("advanceDMA(" + iDMAChannel + ") unsupported transfer type: " + Str.toHexWord(channel.type), true);
+                    }
+                    channel.fError = true;
+                }
+            }
+            if (fAsyncRequest || this.updateDMA(channel)) break;
+        }
+    }
+
+    /**
+     * updateDMA(channel)
+     *
+     * @this {ChipSet}
+     * @param {Object} channel
+     * @return {boolean} true if DMA operation complete, false if not
+     */
+    updateDMA(channel)
+    {
+        if (!channel.fError && --channel.count >= 0) {
+            if (channel.mode & ChipSet.DMA_MODE.DECREMENT) {
+                channel.addrCurrent[0]--;
+                if (channel.addrCurrent[0] < 0) {
+                    channel.addrCurrent[0] = 0xff;
+                    channel.addrCurrent[1]--;
+                    if (channel.addrCurrent[1] < 0) channel.addrCurrent[1] = 0xff;
+                }
+            } else {
+                channel.addrCurrent[0]++;
+                if (channel.addrCurrent[0] > 0xff) {
+                    channel.addrCurrent[0] = 0x00;
+                    channel.addrCurrent[1]++;
+                    if (channel.addrCurrent[1] > 0xff) channel.addrCurrent[1] = 0x00;
+                }
+            }
+            /*
+             * In situations where an HDC DMA operation took too long, the Fixed Disk BIOS would give up, but the DMA operation would continue.
+             *
+             * TODO: Verify that the Fixed Disk BIOS shuts down (ie, re-masks) a DMA channel for failed requests, and that this handles those failures.
+             */
+            if (!channel.masked) return false;
+        }
+
+        var controller = channel.controller;
+        var iDMAChannel = controller.nChannelBase + channel.iChannel;
+        controller.bStatus = (controller.bStatus & ~(0x10 << channel.iChannel)) | (0x1 << channel.iChannel);
+
+        /*
+         * EOP is supposed to automatically (re)mask the channel, unless it's set for auto-initialize.
+         */
+        if (!(channel.mode & ChipSet.DMA_MODE.AUTOINIT)) {
+            channel.masked = true;
+            channel.component = channel.obj = null;
+        }
+
+        if (DEBUG && this.messageEnabled(this.messageBitsDMA(iDMAChannel)) && channel.type == ChipSet.DMA_MODE.TYPE_WRITE && channel.sAddrDebug) {
+            this.printMessage("updateDMA(" + iDMAChannel + ") transferred " + channel.cbDebug + " bytes to " + channel.sAddrDebug, true);
+            this.dbg.doDump(["db", channel.sAddrDebug, 'l', channel.cbDebug]);
+        }
+
+        if (channel.done) {
+            channel.done(!channel.fError);
+            channel.done = null;
+        }
+
+        /*
+         * While it might make sense to call cpu.setDMA() here, it's simpler to let the CPU issue one more call
+         * to chipset.checkDMA() and let the CPU update INTR.DMA on its own, based on the return value from checkDMA().
+         */
+        return true;
+    }
+
+    /**
+     * inPICLo(iPIC, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iPIC
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inPICLo(iPIC, addrFrom)
+    {
+        var b = 0;
+        var pic = this.aPICs[iPIC];
+        if (pic.bOCW3 != null) {
+            var bReadReg = pic.bOCW3 & ChipSet.PIC_LO.OCW3_READ_CMD;
+            switch (bReadReg) {
+                case ChipSet.PIC_LO.OCW3_READ_IRR:
+                    b = pic.bIRR;
+                    break;
+                case ChipSet.PIC_LO.OCW3_READ_ISR:
+                    b = pic.bISR;
+                    break;
+                default:
+                    break;
+            }
+        }
+        if (this.messageEnabled(Messages.PIC | Messages.PORT | Messages.CHIPSET)) {
+            this.printMessageIO(pic.port, null, addrFrom, "PIC" + iPIC, b, true);
+        }
+        return b;
+    }
+
+    /**
+     * outPICLo(iPIC, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iPIC
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     */
+    outPICLo(iPIC, bOut, addrFrom)
+    {
+        var pic = this.aPICs[iPIC];
+        if (this.messageEnabled(Messages.PIC | Messages.PORT | Messages.CHIPSET)) {
+            this.printMessageIO(pic.port, bOut, addrFrom, "PIC" + iPIC, null, true);
+        }
+        if (bOut & ChipSet.PIC_LO.ICW1) {
+            /*
+             * This must be an ICW1...
+             */
+            pic.nICW = 0;
+            pic.aICW[pic.nICW++] = bOut;
+            /*
+             * I used to do the rest of this initialization in outPICHi(), once all the ICW commands had been received,
+             * but a closer reading of the 8259A spec indicates that that should happen now, on receipt on ICW1.
+             *
+             * Also, on p.10 of that spec, it says "The Interrupt Mask Register is cleared".  I originally took that to
+             * mean that all interrupts were masked, but based on what MS-DOS 4.0M expects to happen after this code runs:
+             *
+             *      0070:44C6 B013          MOV      AL,13
+             *      0070:44C8 E620          OUT      20,AL
+             *      0070:44CA B050          MOV      AL,50
+             *      0070:44CC E621          OUT      21,AL
+             *      0070:44CE B009          MOV      AL,09
+             *      0070:44D0 E621          OUT      21,AL
+             *
+             * (ie, it expects its next call to INT 0x13 will still generate an interrupt), I've decided the spec
+             * must be read literally, meaning that all IMR bits must be zeroed.  Unmasking all possible interrupts by
+             * default seems unwise to me, but who am I to judge....
+             */
+            pic.bIMR = 0x00;
+            pic.bIRLow = 7;
+            /*
+             * TODO: I'm also zeroing both IRR and ISR, even though that's not actually mentioned as part of the ICW
+             * sequence, because they need to be (re)initialized at some point.  However, if some component is currently
+             * requesting an interrupt, what should I do about that?  Originally, I had decided to clear them ONLY if they
+             * were still undefined, but that change appeared to break the ROM BIOS handling of CTRL-ALT-DEL, so I'm back
+             * to unconditionally zeroing them.
+             */
+            pic.bIRR = pic.bISR = 0;
+            /*
+             * The spec also says that "Special Mask Mode is cleared and Status Read is set to IRR".  I attempt to insure
+             * the latter, but as for special mask mode... well, that mode isn't supported yet.
+             */
+            pic.bOCW3 = ChipSet.PIC_LO.OCW3 | ChipSet.PIC_LO.OCW3_READ_IRR;
+        }
+        else if (!(bOut & ChipSet.PIC_LO.OCW3)) {
+            /*
+             * This must be an OCW2...
+             */
+            var bOCW2 = bOut & ChipSet.PIC_LO.OCW2_OP_MASK;
+            if (bOCW2 & ChipSet.PIC_LO.OCW2_EOI) {
+                /*
+                 * This OCW2 must be an EOI command...
+                 */
+                var nIRL, bIREnd = 0;
+                if ((bOCW2 & ChipSet.PIC_LO.OCW2_EOI_SPEC) == ChipSet.PIC_LO.OCW2_EOI_SPEC) {
+                    /*
+                     * More "specifically", a specific EOI command...
+                     */
+                    nIRL = bOut & ChipSet.PIC_LO.OCW2_IR_LVL;
+                    bIREnd = 1 << nIRL;
+                } else {
+                    /*
+                     * Less "specifically", a non-specific EOI command.  The search for the highest priority in-service
+                     * interrupt must start with whichever interrupt is opposite the lowest priority interrupt (normally 7,
+                     * but technically whatever bIRLow is currently set to).  For example:
+                     *
+                     *      If bIRLow is 7, then the priority order is: 0, 1, 2, 3, 4, 5, 6, 7.
+                     *      If bIRLow is 6, then the priority order is: 7, 0, 1, 2, 3, 4, 5, 6.
+                     *      If bIRLow is 5, then the priority order is: 6, 7, 0, 1, 2, 3, 4, 5.
+                     *      etc.
+                     */
+                    nIRL = pic.bIRLow + 1;
+                    while (true) {
+                        nIRL &= 0x7;
+                        var bIR = 1 << nIRL;
+                        if (pic.bISR & bIR) {
+                            bIREnd = bIR;
+                            break;
+                        }
+                        if (nIRL++ == pic.bIRLow) break;
+                    }
+                    if (DEBUG && !bIREnd) nIRL = null;      // for unexpected non-specific EOI commands, there's no IRQ to report
+                }
+                var nIRQ = (nIRL == null? undefined : pic.nIRQBase + nIRL);
+                if (pic.bISR & bIREnd) {
+                    if (DEBUG && this.messageEnabled(this.messageBitsIRQ(nIRQ))) {
+                        this.printMessage("outPIC" + iPIC + '(' + Str.toHexByte(pic.port) + "): IRQ " + nIRQ + " ending @" + this.dbg.toHexOffset(this.cpu.getIP(), this.cpu.getCS()) + " stack=" + this.dbg.toHexOffset(this.cpu.getSP(), this.cpu.getSS()), true);
+                    }
+                    pic.bISR &= ~bIREnd;
+                    this.checkIRR();
+                } else {
+                    if (DEBUG && this.messageEnabled(Messages.PIC | Messages.WARN)) {
+                        this.printMessage("outPIC" + iPIC + '(' + Str.toHexByte(pic.port) + "): unexpected EOI command, IRQ " + nIRQ + " not in service", true, true);
+                        if (MAXDEBUG) this.dbg.stopCPU();
+                    }
+                }
+                /*
+                 * TODO: Support EOI commands with automatic rotation (eg, ChipSet.PIC_LO.OCW2_EOI_ROT and ChipSet.PIC_LO.OCW2_EOI_ROTSPEC)
+                 */
+                if (bOCW2 & ChipSet.PIC_LO.OCW2_SET_ROTAUTO) {
+                    if (this.messageEnabled(/*Messages.PIC | */Messages.WARN)) {
+                        this.printMessage("PIC" + iPIC + '(' + Str.toHexByte(pic.port) + "): unsupported OCW2 rotate command " + Str.toHexByte(bOut), true, true);
+                    }
+                }
+            }
+            else  if (bOCW2 == ChipSet.PIC_LO.OCW2_SET_PRI) {
+                /*
+                 * This OCW2 changes the lowest priority interrupt to the specified level (the default is 7)
+                 */
+                pic.bIRLow = bOut & ChipSet.PIC_LO.OCW2_IR_LVL;
+            }
+            else {
+                /*
+                 * TODO: Remaining commands to support: ChipSet.PIC_LO.OCW2_SET_ROTAUTO and ChipSet.PIC_LO.OCW2_CLR_ROTAUTO
+                 */
+                if (this.messageEnabled(/*Messages.PIC | */Messages.WARN)) {
+                    this.printMessage("PIC" + iPIC + '(' + Str.toHexByte(pic.port) + "): unsupported OCW2 automatic EOI command " + Str.toHexByte(bOut), true, true);
+                }
+            }
+        } else {
+            /*
+             * This must be an OCW3 request. If it's a "Read Register" command (PIC_LO.OCW3_READ_CMD), inPICLo() will take care it.
+             *
+             * TODO: If OCW3 specified a "Poll" command (PIC_LO.OCW3_POLL_CMD) or a "Special Mask Mode" command (PIC_LO.OCW3_SMM_CMD),
+             * that's unfortunate, because I don't support them yet.
+             */
+            if (bOut & (ChipSet.PIC_LO.OCW3_POLL_CMD | ChipSet.PIC_LO.OCW3_SMM_CMD)) {
+                if (this.messageEnabled(/*Messages.PIC | */Messages.WARN)) {
+                    this.printMessage("PIC" + iPIC + '(' + Str.toHexByte(pic.port) + "): unsupported OCW3 command " + Str.toHexByte(bOut), true, true);
+                }
+            }
+            pic.bOCW3 = bOut;
+        }
+    }
+
+    /**
+     * inPICHi(iPIC, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iPIC
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inPICHi(iPIC, addrFrom)
+    {
+        var pic = this.aPICs[iPIC];
+        var b = pic.bIMR;
+        if (this.messageEnabled(Messages.PIC | Messages.PORT | Messages.CHIPSET)) {
+            this.printMessageIO(pic.port+1, null, addrFrom, "PIC" + iPIC, b, true);
+        }
+        return b;
+    }
+
+    /**
+     * outPICHi(iPIC, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iPIC
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     */
+    outPICHi(iPIC, bOut, addrFrom)
+    {
+        var pic = this.aPICs[iPIC];
+        if (this.messageEnabled(Messages.PIC | Messages.PORT | Messages.CHIPSET)) {
+            this.printMessageIO(pic.port+1, bOut, addrFrom, "PIC" + iPIC, null, true);
+        }
+        if (pic.nICW < pic.aICW.length) {
+            pic.aICW[pic.nICW++] = bOut;
+            if (pic.nICW == 2 && (pic.aICW[0] & ChipSet.PIC_LO.ICW1_SNGL))
+                pic.nICW++;
+            if (pic.nICW == 3 && !(pic.aICW[0] & ChipSet.PIC_LO.ICW1_ICW4))
+                pic.nICW++;
+        }
+        else {
+            /*
+             * We have all our ICW "words" (ie, bytes), so this must be an OCW1 write (which is simply an IMR write)
+             */
+            pic.bIMR = bOut;
+            /*
+             * See the CPU's delayINTR() function for an explanation of why this explicit delay is necessary.
+             */
+            this.cpu.delayINTR();
+            /*
+             * Alas, we need a longer delay for the MODEL_5170's "KBD_RESET" function (F000:17D2), which must drop
+             * into a loop and decrement CX at least once after unmasking the KBD IRQ.  The "KBD_RESET" function on
+             * previous models could be handled with a 4-instruction delay provided by the Keyboard.resetDevice() call
+             * to setIRR(), but the MODEL_5170 needs a roughly 6-instruction delay after it unmasks the KBD IRQ.
+             */
+            this.checkIRR(!iPIC && bOut == 0xFD? 6 : 0);
+        }
+    }
+
+    /**
+     * checkIMR(nIRQ)
+     *
+     * @this {ChipSet}
+     * @param {number} nIRQ
+     * @return {boolean} true if the specified IRQ is masked, false if not
+     */
+    checkIMR(nIRQ)
+    {
+        var iPIC = nIRQ >> 3;
+        var nIRL = nIRQ & 0x7;
+        var pic = this.aPICs[iPIC];
+        return !!(pic.bIMR & (0x1 << nIRL));
+    }
+
+    /**
+     * setIRR(nIRQ, nDelay)
+     *
+     * @this {ChipSet}
+     * @param {number} nIRQ (IRQ 0-7 implies iPIC 0, and IRQ 8-15 implies iPIC 1)
+     * @param {number} [nDelay] is an optional number of instructions to delay acknowledgment of the IRQ (see getIRRVector)
+     */
+    setIRR(nIRQ, nDelay)
+    {
+        var iPIC = nIRQ >> 3;
+        var nIRL = nIRQ & 0x7;
+        var pic = this.aPICs[iPIC];
+        var bIRR = (1 << nIRL);
+        if (!(pic.bIRR & bIRR)) {
+            pic.bIRR |= bIRR;
+            if (DEBUG && this.messageEnabled(this.messageBitsIRQ(nIRQ) | Messages.CHIPSET)) {
+                this.printMessage("setIRR(" + nIRQ + ")", true);
+            }
+            pic.nDelay = nDelay || 0;
+            this.checkIRR();
+        }
+    }
+
+    /**
+     * clearIRR(nIRQ)
+     *
+     * @this {ChipSet}
+     * @param {number} nIRQ (IRQ 0-7 implies iPIC 0, and IRQ 8-15 implies iPIC 1)
+     */
+    clearIRR(nIRQ)
+    {
+        var iPIC = nIRQ >> 3;
+        var nIRL = nIRQ & 0x7;
+        var pic = this.aPICs[iPIC];
+        var bIRR = (1 << nIRL);
+        if (pic.bIRR & bIRR) {
+            pic.bIRR &= ~bIRR;
+            if (DEBUG && this.messageEnabled(this.messageBitsIRQ(nIRQ) | Messages.CHIPSET)) {
+                this.printMessage("clearIRR(" + nIRQ + ")", true);
+            }
+            this.checkIRR();
+        }
+    }
+
+    /**
+     * checkIRR(nDelay)
+     *
+     * @this {ChipSet}
+     * @param {number} [nDelay] is an optional number of instructions to delay acknowledgment of a pending interrupt
+     */
+    checkIRR(nDelay)
+    {
+        /*
+         * Look for any IRR bits that aren't masked and aren't already in service; in theory, all we'd have to
+         * check is the master PIC (which is the *only* PIC on pre-5170 models), because when any IRQs are set or
+         * cleared on the slave, that would automatically be reflected in IRQ.SLAVE on the master; that's what
+         * setIRR() and clearIRR() used to do.
+         *
+         * Unfortunately, despite setIRR() and clearIRR()'s efforts, whenever a slave interrupt is acknowledged,
+         * getIRRVector() ends up clearing the IRR bits for BOTH the slave's IRQ and the master's IRQ.SLAVE.
+         * So if another lower-priority slave IRQ is waiting to be dispatched, that fact is no longer reflected
+         * in IRQ.SLAVE.
+         *
+         * Since checkIRR() is called on every EOI, we can resolve that problem here, by first checking the slave
+         * PIC for any unmasked, unserviced interrupts and updating the master's IRQ.SLAVE.
+         *
+         * And since this is ALSO called by both setIRR() and clearIRR(), those functions no longer need to perform
+         * their own IRQ.SLAVE updates.  This function consolidates the propagation of slave interrupts to the master.
+         */
+        var pic;
+        var bIR = -1;
+
+        if (this.cPICs > 1) {
+            pic = this.aPICs[1];
+            bIR = ~(pic.bISR | pic.bIMR) & pic.bIRR;
+        }
+
+        pic = this.aPICs[0];
+
+        if (bIR >= 0) {
+            if (bIR) {
+                pic.bIRR |= (1 << ChipSet.IRQ.SLAVE);
+            } else {
+                pic.bIRR &= ~(1 << ChipSet.IRQ.SLAVE);
+            }
+        }
+
+        bIR = ~(pic.bISR | pic.bIMR) & pic.bIRR;
+
+        this.cpu.updateINTR(!!bIR);
+
+        if (bIR && nDelay) pic.nDelay = nDelay;
+    }
+
+    /**
+     * getIRRVector()
+     *
+     * getIRRVector() is called by the CPU whenever PS_IF is set and OP_NOINTR is clear.  Ordinarily, an immediate
+     * response would seem perfectly reasonable, but unfortunately, there are places in the original ROM BIOS like
+     * "KBD_RESET" (F000:E688) that enable interrupts but still expect nothing to happen for several more instructions.
+     *
+     * So, in addition to the two normal responses (an IDT vector #, or -1 indicating no pending interrupts), we must
+     * support a third response (-2) that basically means: don't change the CPU interrupt state, just keep calling until
+     * we return one of the first two responses.  The number of times we delay our normal response is determined by the
+     * component that originally called setIRR with an optional delay parameter.
+     *
+     * @this {ChipSet}
+     * @param {number} [iPIC]
+     * @return {number} IDT vector # of the next highest-priority interrupt, -1 if none, or -2 for "please try your call again later"
+     */
+    getIRRVector(iPIC)
+    {
+        if (iPIC === undefined) iPIC = 0;
+
+        /*
+         * Look for any IRR bits that aren't masked and aren't already in service...
+         */
+        var nIDT = -1;
+        var pic = this.aPICs[iPIC];
+        if (!pic.nDelay) {
+            var bIR = pic.bIRR & ((pic.bISR | pic.bIMR) ^ 0xff);
+            /*
+             * The search for the next highest priority requested interrupt (that's also not in-service and not masked)
+             * must start with whichever interrupt is opposite the lowest priority interrupt (normally 7, but technically
+             * whatever bIRLow is currently set to).  For example:
+             *
+             *      If bIRLow is 7, then the priority order is: 0, 1, 2, 3, 4, 5, 6, 7.
+             *      If bIRLow is 6, then the priority order is: 7, 0, 1, 2, 3, 4, 5, 6.
+             *      If bIRLow is 5, then the priority order is: 6, 7, 0, 1, 2, 3, 4, 5.
+             *      etc.
+             *
+             * This process is similar to the search performed by non-specific EOIs, except those apply only to a single
+             * PIC (which is why a slave interrupt must be EOI'ed twice: once for the slave PIC and again for the master),
+             * whereas here we must search across all PICs.
+             */
+            var nIRL = pic.bIRLow + 1;
+            while (true) {
+
+                nIRL &= 0x7;
+                var bIRNext = 1 << nIRL;
+
+                /*
+                 * If we encounter an interrupt that's still in-service BEFORE we encounter a requested interrupt,
+                 * then we're done; we must allow a higher priority in-service interrupt to finish before acknowledging
+                 * any lower priority interrupts.
+                 */
+                if (pic.bISR & bIRNext) break;
+
+                if (bIR & bIRNext) {
+
+                    if (!iPIC && nIRL == ChipSet.IRQ.SLAVE) {
+                        /*
+                         * Slave interrupts are tied to the master PIC on IRQ2; query the slave PIC for the vector #
+                         */
+                        nIDT = this.getIRRVector(1);
+                    } else {
+                        /*
+                         * Get the starting IDT vector # from ICW2 and add the IR level to obtain the target IDT vector #
+                         */
+                        nIDT = pic.aICW[1] + nIRL;
+                    }
+
+                    if (nIDT >= 0) {
+                        pic.bISR |= bIRNext;
+
+                        /*
+                         * Setting the ISR implies clearing the IRR, but clearIRR() has side-effects we don't want
+                         * (eg, clearing the slave IRQ, notifying the CPU, etc), so we clear the IRR ourselves.
+                         */
+                        pic.bIRR &= ~bIRNext;
+
+                        var nIRQ = pic.nIRQBase + nIRL;
+                        if (DEBUG && this.messageEnabled(this.messageBitsIRQ(nIRQ))) {
+                            this.printMessage("getIRRVector(): IRQ " + nIRQ + " interrupting stack " + this.dbg.toHexOffset(this.cpu.getSP(), this.cpu.getSS()), true, true);
+                        }
+                        if (MAXDEBUG && DEBUGGER) {
+                            this.acInterrupts[nIRQ]++;
+                        }
+                    }
+                    break;
+                }
+
+                if (nIRL++ == pic.bIRLow) break;
+            }
+        } else {
+            nIDT = -2;
+            pic.nDelay--;
+        }
+        return nIDT;
+    }
+
+    /**
+     * setFPUInterrupt()
+     *
+     * @this {ChipSet}
+     */
+    setFPUInterrupt()
+    {
+        if (this.model >= ChipSet.MODEL_5170) {
+            this.setIRR(ChipSet.IRQ.FPU);
+        } else {
+            /*
+             * TODO: Determine whether we need to maintain an "Active NMI" state; ie, if NMI.DISABLE is cleared
+             * later, and the FPU coprocessor is still indicating an error condition, should we then generate an NMI?
+             */
+            if (!(this.bNMI & ChipSet.NMI.DISABLE)) {
+                X86.helpInterrupt.call(this.cpu, X86.EXCEPTION.NMI);
+            }
+        }
+    }
+
+    /**
+     * clearFPUInterrupt(fSet)
+     *
+     * @this {ChipSet}
+     */
+    clearFPUInterrupt()
+    {
+        if (this.model >= ChipSet.MODEL_5170) {
+            this.clearIRR(ChipSet.IRQ.FPU);
+        } else {
+            /*
+             * TODO: If we maintain an "Active NMI" state, then we will need code here to clear that state, as well
+             * as code in outNMI() to clear that state and generate an NMI as needed.
+             */
+        }
+    }
+
+    /**
+     * inTimer(iPIT, iPITTimer, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iPIT (0 or 1)
+     * @param {number} iPITTimer (0, 1, or 2)
+     * @param {number} port (0x40, 0x41, 0x42, etc)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inTimer(iPIT, iPITTimer, port, addrFrom)
+    {
+        var b;
+        var iBaseTimer = (iPIT? 3 : 0);
+        var timer = this.aTimers[iBaseTimer + iPITTimer];
+
+        if (timer.fStatusLatched) {
+            b = timer.bStatus;
+            timer.fStatusLatched = false;
+        }
+        else {
+            if (timer.countIndex == timer.countBytes) {
+                this.resetTimerIndex(iBaseTimer + iPITTimer);
+            }
+            if (timer.fCountLatched) {
+                b = timer.countLatched[timer.countIndex++];
+                if (timer.countIndex == timer.countBytes) {
+                    timer.fCountLatched = false
+                }
+            }
+            else {
+                this.updateTimer(iBaseTimer + iPITTimer);
+                b = timer.countCurrent[timer.countIndex++];
+            }
+        }
+        if (this.messageEnabled(Messages.TIMER | Messages.PORT)) {
+            this.printMessageIO(port, null, addrFrom, "PIT" + iPIT + ".TIMER" + iPITTimer, b, true);
+        }
+        return b;
+    }
+
+    /**
+     * outTimer(iPIT, iPITTimer, port, bOut, addrFrom)
+     *
+     * We now rely EXCLUSIVELY on setBurstCycles() to address situations where quick timer interrupt turn-around
+     * is expected; eg, by the ROM BIOS POST when it sets TIMER0 to a low test count (0x16); since we typically
+     * don't update any of the timers until after we've finished a burst of CPU cycles, we must reduce the current
+     * burst cycle count, so that the current instruction burst will end at the same time a timer interrupt is expected.
+     *
+     * Note that in some cases, if the number of cycles remaining in the current burst is less than the target,
+     * this may have the effect of *lengthening* the current burst instead of shortening it, but stepCPU() should be
+     * OK with that.
+     *
+     * @this {ChipSet}
+     * @param {number} iPIT (0 or 1)
+     * @param {number} iPITTimer (0, 1, or 2)
+     * @param {number} port (0x40, 0x41, 0x42, etc)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     */
+    outTimer(iPIT, iPITTimer, port, bOut, addrFrom)
+    {
+        if (this.messageEnabled(Messages.TIMER | Messages.PORT)) {
+            this.printMessageIO(port, bOut, addrFrom, "PIT" + iPIT + ".TIMER" + iPITTimer, null, true);
+        }
+
+        var iBaseTimer = (iPIT? 3 : 0);
+        var timer = this.aTimers[iBaseTimer + iPITTimer];
+
+        if (timer.countIndex == timer.countBytes) {
+            this.resetTimerIndex(iBaseTimer + iPITTimer);
+        }
+
+        timer.countInit[timer.countIndex++] = bOut;
+
+        if (timer.countIndex == timer.countBytes) {
+            /*
+             * In general, writing a new count to a timer that's already counting isn't supposed to affect the current
+             * count, with the notable exceptions of MODE0 and MODE4.
+             */
+            if (!timer.fCounting || timer.mode == ChipSet.PIT_CTRL.MODE0 || timer.mode == ChipSet.PIT_CTRL.MODE4) {
+                timer.fCountLatched = false;
+                timer.countCurrent[0] = timer.countStart[0] = timer.countInit[0];
+                timer.countCurrent[1] = timer.countStart[1] = timer.countInit[1];
+                timer.nCyclesStart = this.cpu.getCycles(this.fScaleTimers);
+                timer.fCounting = true;
+
+                /*
+                 * I believe MODE0 is the only mode where OUT (fOUT) starts out low (false); for the rest of the modes,
+                 * OUT (fOUT) starts high (true).  It's also my understanding that the way edge-triggered interrupts work
+                 * on the original PC is that an interrupt is requested only when the corresponding OUT transitions from
+                 * low to high.
+                 */
+                timer.fOUT = (timer.mode != ChipSet.PIT_CTRL.MODE0);
+
+                if (iPIT == ChipSet.PIT0.INDEX && iPITTimer == ChipSet.PIT0.TIMER0) {
+                    /*
+                     * TODO: Determine if there are situations/modes where I should NOT automatically clear IRQ0 on behalf of TIMER0.
+                     */
+                    this.clearIRR(ChipSet.IRQ.TIMER0);
+                    var countInit = this.getTimerInit(ChipSet.PIT0.TIMER0);
+                    var nCyclesRemain = (countInit * this.nTicksDivisor) | 0;
+                    if (timer.mode == ChipSet.PIT_CTRL.MODE3) nCyclesRemain >>= 1;
+                    this.cpu.setBurstCycles(nCyclesRemain);
+                }
+            }
+
+            if (iPIT == ChipSet.PIT0.INDEX && iPITTimer == ChipSet.PIT0.TIMER2) this.setSpeaker();
+        }
+    }
+
+    /**
+     * inTimerCtrl(iPIT, port, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iPIT (0 or 1)
+     * @param {number} port (0x43 or 0x4B)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number|null} simulated port value
+     */
+    inTimerCtrl(iPIT, port, addrFrom)
+    {
+        this.printMessageIO(port, null, addrFrom, "PIT" + iPIT + ".CTRL", null, Messages.TIMER);
+        /*
+         * NOTE: Even though reads to port 0x43 are undefined (I think), I'm going to "define" it
+         * as returning the last value written, purely for the Debugger's benefit.
+         */
+        return iPIT? this.bPIT1Ctrl : this.bPIT0Ctrl;
+    }
+
+    /**
+     * outTimerCtrl(iPIT, port, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iPIT (0 or 1)
+     * @param {number} port (0x43)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     */
+    outTimerCtrl(iPIT, port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "PIT" + iPIT + ".CTRL", null, Messages.TIMER);
+
+        /*
+         * Extract the SC (Select Counter) bits.
+         */
+        var iBaseTimer = 0;
+        var iPITTimer = (bOut & ChipSet.PIT_CTRL.SC);
+        if (!iPIT) {
+            this.bPIT0Ctrl = bOut;
+        } else {
+            iBaseTimer = 3;
+            this.bPIT1Ctrl = bOut;
+        }
+
+        /*
+         * Check for the Read-Back command and process as needed.
+         */
+        if (iPITTimer == ChipSet.PIT_CTRL.SC_BACK) {
+            if (!(bOut & ChipSet.PIT_CTRL.RB_STATUS)) {
+                for (iPITTimer = 0; iPITTimer <= 2; iPITTimer++) {
+                    if (bOut & (ChipSet.PIT_CTRL.RB_CTR0 << iPITTimer)) {
+                        this.latchTimerStatus(iBaseTimer + iPITTimer);
+                    }
+                }
+            }
+            if (!(bOut & ChipSet.PIT_CTRL.RB_COUNTS)) {
+                for (iPITTimer = 0; iPITTimer <= 2; iPITTimer++) {
+                    if (bOut & (ChipSet.PIT_CTRL.RB_CTR0 << iPITTimer)) {
+                        this.latchTimerCount(iBaseTimer + iPITTimer);
+                    }
+                }
+            }
+            return;
+        }
+
+        /*
+         * Convert the SC (Select Counter) bits into an iPITTimer index (0-2).
+         */
+        iPITTimer >>= ChipSet.PIT_CTRL.SC_SHIFT;
+
+        /*
+         * Extract BCD (bit 0), MODE (bits 1-3), and RW (bits 4-5), which we simply store as-is (see setTimerMode).
+         */
+        var bcd = (bOut & ChipSet.PIT_CTRL.BCD);
+        var mode = (bOut & ChipSet.PIT_CTRL.MODE);
+        var rw = (bOut & ChipSet.PIT_CTRL.RW);
+
+        if (rw == ChipSet.PIT_CTRL.RW_LATCH) {
+            /*
+             * Of all the RW bit combinations, this is the only one that "countermands" normal control register
+             * processing (the BCD and MODE bits are "don't care").
+             */
+            this.latchTimerCount(iBaseTimer + iPITTimer);
+        }
+        else {
+            this.setTimerMode(iBaseTimer + iPITTimer, bcd, mode, rw);
+
+            /*
+             * The 5150 ROM BIOS code @F000:E285 ("TEST.7") would fail after a warm boot (eg, after a CTRL-ALT-DEL) because
+             * it assumed that no TIMER0 interrupt would occur between the point it unmasked the TIMER0 interrupt and the
+             * point it started reprogramming TIMER0.
+             *
+             * Similarly, the 5160 ROM BIOS @F000:E35D ("8253 TIMER CHECKOUT") would fail after initializing the EGA BIOS,
+             * because the EGA BIOS uses TIMER0 during its diagnostics; as in the previous example, by the time the 8253
+             * test code runs later, there's now a pending TIMER0 interrupt, which triggers an interrupt as soon as IRQ0 is
+             * unmasked @F000:E364.
+             *
+             * After looking at this problem at bit more closely the second time around (while debugging the EGA BIOS),
+             * it turns out I missed an important 8253 feature: whenever a new MODE0 control word OR a new MODE0 count
+             * is written, fOUT (which is what drives IRQ0) goes low.  So, by simply adding an appropriate clearIRR() call
+             * both here and in outTimer(), this annoying problem seems to be gone.
+             *
+             * TODO: Determine if there are situations/modes where I should NOT automatically clear IRQ0 on behalf of TIMER0.
+             */
+            if (iPIT == ChipSet.PIT0.INDEX && iPITTimer == ChipSet.PIT0.TIMER0) this.clearIRR(ChipSet.IRQ.TIMER0);
+
+            /*
+             * Another TIMER0 HACK: The "CASSETTE DATA WRAP TEST" @F000:E51E occasionally reports an error when the second of
+             * two TIMER0 counts it latches is greater than the first.  You would think the ROM BIOS would expect this, since
+             * TIMER0 can reload its count at any time.  Is the ROM BIOS assuming that TIMER0 was initialized sufficiently
+             * recently that this should never happen?  I'm not sure, but for now, let's try resetting TIMER0's count immediately
+             * after TIMER2 has been reprogrammed for the test in question (ie, when interrupts are masked and PPIB is set as
+             * shown below).
+             *
+             * FWIW, I believe the cassette hardware was discontinued after MODEL_5150, and even if the test fails, it's non-fatal;
+             * the ROM BIOS displays an error (131) and moves on.
+             */
+            if (iPIT == ChipSet.PIT0.INDEX && iPITTimer == ChipSet.PIT0.TIMER2) {
+                var pic = this.aPICs[0];
+                if (pic.bIMR == 0xff && this.bPPIB == (ChipSet.PPI_B.CLK_TIMER2 | ChipSet.PPI_B.ENABLE_SW2 | ChipSet.PPI_B.CASS_MOTOR_OFF | ChipSet.PPI_B.CLK_KBD)) {
+                    var timer = this.aTimers[0];
+                    timer.countStart[0] = timer.countInit[0];
+                    timer.countStart[1] = timer.countInit[1];
+                    timer.nCyclesStart = this.cpu.getCycles(this.fScaleTimers);
+                    if (DEBUG && this.messageEnabled(Messages.TIMER)) {
+                        this.printMessage("PIT0.TIMER0 count reset @" + timer.nCyclesStart + " cycles", true);
+                    }
+                }
+            }
+        }
+    }
+
+    /**
+     * getTimerInit(iTimer)
+     *
+     * @this {ChipSet}
+     * @param {number} iTimer
+     * @return {number} initial timer count
+     */
+    getTimerInit(iTimer)
+    {
+        var timer = this.aTimers[iTimer];
+        var countInit = (timer.countInit[1] << 8) | timer.countInit[0];
+        if (!countInit) countInit = (timer.countBytes == 1? 0x100 : 0x10000);
+        return countInit;
+    }
+
+    /**
+     * getTimerStart(iTimer)
+     *
+     * @this {ChipSet}
+     * @param {number} iTimer
+     * @return {number} starting timer count (from the initial timer count for the current countdown)
+     */
+    getTimerStart(iTimer)
+    {
+        var timer = this.aTimers[iTimer];
+        var countStart = (timer.countStart[1] << 8) | timer.countStart[0];
+        if (!countStart) countStart = (timer.countBytes == 1? 0x100 : 0x10000);
+        return countStart;
+    }
+
+    /**
+     * getTimerCycleLimit(iTimer, nCycles)
+     *
+     * This is called by the CPU to determine the maximum number of cycles it can process for the current burst.
+     * It's presumed that no instructions have been executed since the last updateTimer(iTimer) call.
+     *
+     * @this {ChipSet}
+     * @param {number} iTimer
+     * @param {number} nCycles desired
+     * @return {number} maximum number of cycles remaining for the specified timer (<= nCycles)
+     */
+    getTimerCycleLimit(iTimer, nCycles)
+    {
+        var timer = this.aTimers[iTimer];
+        if (timer.fCounting) {
+            var nCyclesUpdate = this.cpu.getCycles(this.fScaleTimers);
+            var ticksElapsed = ((nCyclesUpdate - timer.nCyclesStart) / this.nTicksDivisor) | 0;
+            // DEBUG:
+            var countStart = this.getTimerStart(iTimer);
+            var count = countStart - ticksElapsed;
+            if (timer.mode == ChipSet.PIT_CTRL.MODE3) count -= ticksElapsed;
+            // DEBUG:
+            var nCyclesRemain = (count * this.nTicksDivisor) | 0;
+            if (timer.mode == ChipSet.PIT_CTRL.MODE3) nCyclesRemain >>= 1;
+            if (nCycles > nCyclesRemain) nCycles = nCyclesRemain;
+        }
+        return nCycles;
+    }
+
+    /**
+     * latchTimerCount(iTimer)
+     *
+     * @this {ChipSet}
+     * @param {number} iTimer
+     */
+    latchTimerCount(iTimer)
+    {
+        /*
+         * Update the timer's current count.
+         */
+        this.updateTimer(iTimer);
+
+        /*
+         * Now we can latch it.
+         */
+        var timer = this.aTimers[iTimer];
+        timer.countLatched[0] = timer.countCurrent[0];
+        timer.countLatched[1] = timer.countCurrent[1];
+        timer.fCountLatched = true;
+
+        /*
+         * VERIFY: That a latch request resets the timer index.
+         */
+        this.resetTimerIndex(iTimer);
+    }
+
+    /**
+     * latchTimerStatus(iTimer)
+     *
+     * @this {ChipSet}
+     * @param {number} iTimer
+     */
+    latchTimerStatus(iTimer)
+    {
+        var timer = this.aTimers[iTimer];
+        if (!timer.fStatusLatched) {
+            this.updateTimer(iTimer);
+            timer.bStatus = timer.bcd | timer.mode | timer.rw | (timer.countIndex < timer.countBytes? ChipSet.PIT_CTRL.RB_NULL : 0) | (timer.fOUT? ChipSet.PIT_CTRL.RB_OUT : 0);
+            timer.fStatusLatched = true;
+        }
+    }
+
+    /**
+     * setTimerMode(iTimer, bcd, mode, rw)
+     *
+     * FYI: After setting a timer's mode, the CPU must set the timer's count before it becomes operational;
+     * ie, before fCounting becomes true.
+     *
+     * @this {ChipSet}
+     * @param {number} iTimer
+     * @param {number} bcd
+     * @param {number} mode
+     * @param {number} rw
+     */
+    setTimerMode(iTimer, bcd, mode, rw)
+    {
+        var timer = this.aTimers[iTimer];
+        timer.rw = rw;
+        timer.mode = mode;
+        timer.bcd = bcd;
+        timer.countInit = [0, 0];
+        timer.countCurrent = [0, 0];
+        timer.countLatched = [0, 0];
+        timer.fOUT = false;
+        timer.fCountLatched = false;
+        timer.fCounting = false;
+        timer.fStatusLatched = false;
+        this.resetTimerIndex(iTimer);
+    }
+
+    /**
+     * resetTimerIndex(iTimer)
+     *
+     * @this {ChipSet}
+     * @param {number} iTimer
+     */
+    resetTimerIndex(iTimer)
+    {
+        var timer = this.aTimers[iTimer];
+        timer.countIndex = (timer.rw == ChipSet.PIT_CTRL.RW_MSB? 1 : 0);
+        timer.countBytes = (timer.rw == ChipSet.PIT_CTRL.RW_BOTH? 2 : 1);
+    }
+
+    /**
+     * updateTimer(iTimer, fCycleReset)
+     *
+     * updateTimer() calculates and updates a timer's current count purely on an "on-demand" basis; we don't
+     * actually adjust timer counters every 4 CPU cycles on a 4.77Mhz PC, since updating timers that frequently
+     * would be prohibitively slow.  If you're single-stepping the CPU, then yes, updateTimer() will be called
+     * after every stepCPU(), via updateAllTimers(), but if we're doing our job correctly here, the frequency
+     * of calls to updateTimer() should not affect timer counts across otherwise identical runs.
+     *
+     * TODO: Implement support for all TIMER modes, and verify that all the modes currently implemented are
+     * "up to spec"; they're close enough to make the ROM BIOS happy, but beyond that, I've done very little.
+     *
+     * @this {ChipSet}
+     * @param {number} iTimer
+     *      0: Time-of-Day interrupt (~18.2 interrupts/second)
+     *      1: DMA refresh
+     *      2: Sound/Cassette
+     * @param {boolean} [fCycleReset] is true if a cycle-count reset is about to occur
+     * @return {Object} timer
+     */
+    updateTimer(iTimer, fCycleReset)
+    {
+        var timer = this.aTimers[iTimer];
+
+        /*
+         * Every timer's counting state is gated by its own fCounting flag; TIMER2 is further gated by PPI_B's
+         * CLK_TIMER2 bit.
+         */
+        if (timer.fCounting && (iTimer != ChipSet.PIT0.TIMER2 || (this.bPPIB & ChipSet.PPI_B.CLK_TIMER2))) {
+            /*
+             * We determine the current timer count based on how many instruction cycles have elapsed since we started
+             * the timer.  Timers are supposed to be "ticking" at a rate of 1193181.8181 times per second, which is
+             * the system clock of 14.31818Mhz, divided by 12.
+             *
+             * Similarly, for an 8088, there are supposed to be 4.77Mhz instruction cycles per second, which comes from
+             * the system clock of 14.31818Mhz, divided by 3.
+             *
+             * If we divide 4,772,727 CPU cycles per second by 1,193,181 ticks per second, we get 4 cycles per tick,
+             * which agrees with the ratio of the clock divisors: 12 / 3 == 4.
+             *
+             * However, if getCycles() is being called with fScaleTimers == true AND the CPU is running faster than its
+             * base cycles-per-second setting, then getCycles() will divide the cycle count by the CPU's cycle multiplier,
+             * so that the timers fire with the same real-world frequency that the user expects.  However, that will
+             * break any code (eg, the ROM BIOS diagnostics) that assumes that the timers are ticking once every 4 cycles
+             * (or more like every 5 cycles on a 6Mhz 80286).
+             *
+             * So, when using a machine with the ChipSet "scaletimers" property set, make sure you reset the machine's
+             * speed prior to rebooting, otherwise you're likely to see ROM BIOS errors.  Ditto for any application code
+             * that makes similar assumptions about the relationship between CPU and timer speeds.
+             *
+             * In general, you're probably better off NOT using the "scaletimers" property, and simply allowing the timers
+             * to tick faster as you increase CPU speed (which is why fScaleTimers defaults to false).
+             */
+            var nCycles = this.cpu.getCycles(this.fScaleTimers);
+
+            /*
+             * Instead of maintaining partial tick counts, we calculate a fresh countCurrent from countStart every
+             * time we're called, using the cycle count recorded when the timer was initialized.  countStart is set
+             * to countInit when fCounting is first set, and then it is refreshed from countInit at the expiration of
+             * every count, so that if someone loaded a new countInit in the meantime (eg, BASICA), we'll pick it up.
+             *
+             * For the original MODEL_5170, the number of cycles per tick is approximately 6,000,000 / 1,193,181,
+             * or 5.028575, so we can no longer always divide cycles by 4 with a simple right-shift by 2.  The proper
+             * divisor (eg, 4 for MODEL_5150 and MODEL_5160, 5 for MODEL_5170, etc) is nTicksDivisor, which initBus()
+             * calculates using the base CPU speed returned by cpu.getCyclesPerSecond().
+             */
+            var ticksElapsed = ((nCycles - timer.nCyclesStart) / this.nTicksDivisor) | 0;
+
+            if (ticksElapsed < 0) {
+                if (DEBUG && this.messageEnabled(Messages.TIMER)) {
+                    this.printMessage("updateTimer(" + iTimer + "): negative tick count (" + ticksElapsed + ")", true);
+                }
+                timer.nCyclesStart = nCycles;
+                ticksElapsed = 0;
+            }
+
+            var countInit = this.getTimerInit(iTimer);
+            var countStart = this.getTimerStart(iTimer);
+
+            var fFired = false;
+            var count = countStart - ticksElapsed;
+
+            /*
+             * NOTE: This mode is used by ROM BIOS test code that wants to verify timer interrupts are arriving
+             * neither too slowly nor too quickly.  As a result, I've had to add some corresponding trickery
+             * in outTimer() to force interrupt simulation immediately after a low initial count (0x16) has been set.
+             */
+            if (timer.mode == ChipSet.PIT_CTRL.MODE0) {
+                if (count <= 0) count = 0;
+                if (DEBUG && this.messageEnabled(Messages.TIMER)) {
+                    this.printMessage("updateTimer(" + iTimer + "): MODE0 timer count=" + count, true);
+                }
+                if (!count) {
+                    timer.fOUT = true;
+                    timer.fCounting = false;
+                    if (!iTimer) {
+                        fFired = true;
+                        this.setIRR(ChipSet.IRQ.TIMER0);
+                        if (MAXDEBUG && DEBUGGER) this.acTimersFired[iTimer]++;
+                    }
+                }
+            }
+            /*
+             * Early implementation of this mode was minimal because when using this mode, the ROM BIOS simply wanted
+             * to see the count changing; it wasn't looking for interrupts.  See ROM BIOS "TEST.03" code @F000:E0DE,
+             * where TIMER1 is programmed for MODE2, LSB (the same settings, incidentally, used immediately afterward
+             * for TIMER1 in conjunction with DMA channel 0 memory refreshes).
+             *
+             * Now this mode generates interrupts.  Note that OUT goes low when the count reaches 1, then high
+             * one tick later, at which point the count is reloaded and counting continues.
+             *
+             * Chances are, we will often miss the exact point at which the count becomes 1 (or more importantly,
+             * one tick later, when the count *would* become 0, since that's when OUT transitions from low to high),
+             * but as with MODE3, hopefully no one will mind.
+             *
+             * FYI, technically, it appears that the count is never supposed to reach 0, and that an initial count of 1
+             * is "illegal", whatever that means.
+             */
+            else if (timer.mode == ChipSet.PIT_CTRL.MODE2) {
+                timer.fOUT = (count != 1);          // yes, this line does seem rather pointless....
+                if (count <= 0) {
+                    count = countInit + count;
+                    if (count <= 0) {
+                        /*
+                         * TODO: Consider whether we ever care about TIMER1 or TIMER2 underflow
+                         */
+                        if (DEBUG && this.messageEnabled(Messages.TIMER) && !iTimer) {
+                            this.printMessage("updateTimer(" + iTimer + "): mode=2, underflow=" + count, true);
+                        }
+                        count = countInit;
+                    }
+                    timer.countStart[0] = count & 0xff;
+                    timer.countStart[1] = (count >> 8) & 0xff;
+                    timer.nCyclesStart = nCycles;
+                    if (!iTimer && timer.fOUT) {
+                        fFired = true;
+                        this.setIRR(ChipSet.IRQ.TIMER0);
+                        if (MAXDEBUG && DEBUGGER) this.acTimersFired[iTimer]++;
+                    }
+                }
+            }
+            /*
+             * NOTE: This is the normal mode for TIMER0, which the ROM BIOS uses to generate h/w interrupts roughly
+             * 18.2 times per second.  In this mode, the count must be decremented twice as fast (hence the extra ticks
+             * subtraction below, in addition to the subtraction above), but IRQ_TIMER0 is raised only on alternate
+             * iterations; ie, only when fOUT transitions to true ("high").  The equal alternating fOUT states is why
+             * this mode is referred to as "square wave" mode.
+             *
+             * TODO: Implement the correct behavior for this mode when the count is ODD.  In that case, fOUT is supposed
+             * to be "high" for (N + 1) / 2 ticks and "low" for (N - 1) / 2 ticks.
+             */
+            else if (timer.mode == ChipSet.PIT_CTRL.MODE3) {
+                count -= ticksElapsed;
+                if (count <= 0) {
+                    timer.fOUT = !timer.fOUT;
+                    count = countInit + count;
+                    if (count <= 0) {
+                        /*
+                         * TODO: Consider whether we ever care about TIMER1 or TIMER2 underflow
+                         */
+                        if (DEBUG && this.messageEnabled(Messages.TIMER) && !iTimer) {
+                            this.printMessage("updateTimer(" + iTimer + "): mode=3, underflow=" + count, true);
+                        }
+                        count = countInit;
+                    }
+                    if (MAXDEBUG && DEBUGGER && !iTimer) {
+                        var nCycleDelta = 0;
+                        if (this.acTimer0Counts.length > 0) nCycleDelta = nCycles - this.acTimer0Counts[0][1];
+                        this.acTimer0Counts.push([count, nCycles, nCycleDelta]);
+                    }
+                    timer.countStart[0] = count & 0xff;
+                    timer.countStart[1] = (count >> 8) & 0xff;
+                    timer.nCyclesStart = nCycles;
+                    if (!iTimer && timer.fOUT) {
+                        fFired = true;
+                        this.setIRR(ChipSet.IRQ.TIMER0);
+                        if (MAXDEBUG && DEBUGGER) this.acTimersFired[iTimer]++;
+                    }
+                }
+            }
+
+            if (DEBUG && this.messageEnabled(Messages.TIMER | Messages.LOG)) {
+                this.log("TIMER" + iTimer + " count: " + count + ", ticks: " + ticksElapsed + ", fired: " + (fFired? "true" : "false"));
+            }
+
+            timer.countCurrent[0] = count & 0xff;
+            timer.countCurrent[1] = (count >> 8) & 0xff;
+            if (fCycleReset) this.nCyclesStart = 0;
+        }
+        return timer;
+    }
+
+    /**
+     * updateAllTimers(fCycleReset)
+     *
+     * @this {ChipSet}
+     * @param {boolean} [fCycleReset] is true if a cycle-count reset is about to occur
+     */
+    updateAllTimers(fCycleReset)
+    {
+        for (var iTimer = 0; iTimer < this.aTimers.length; iTimer++) {
+            this.updateTimer(iTimer, fCycleReset);
+        }
+        if (this.model >= ChipSet.MODEL_5170) this.updateRTCTime();
+    }
+
+    /**
+     * inPPIA(port, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x60)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inPPIA(port, addrFrom)
+    {
+        var b = this.bPPIA;
+        if (this.bPPICtrl & ChipSet.PPI_CTRL.A_IN) {
+            if (this.bPPIB & ChipSet.PPI_B.CLEAR_KBD) {
+                b = this.aDIPSwitches[0][1];
+            }
+            else if (this.kbd) {
+                b = this.kbd.readScanCode();
+            }
+        }
+        this.printMessageIO(port, null, addrFrom, "PPI_A", b);
+        return b;
+    }
+
+    /**
+     * outPPIA(port, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x60)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     */
+    outPPIA(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "PPI_A");
+        this.bPPIA = bOut;
+    }
+
+    /**
+     * inPPIB(port, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x61)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inPPIB(port, addrFrom)
+    {
+        var b = this.bPPIB;
+        this.printMessageIO(port, null, addrFrom, "PPI_B", b);
+        return b;
+    }
+
+    /**
+     * outPPIB(port, bOut, addrFrom)
+     *
+     * This is the original (MODEL_5150 and MODEL_5160) handler for port 0x61.  Functionality common
+     * to all models must be placed in updatePPIB().
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x61)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     */
+    outPPIB(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "PPI_B");
+        this.updatePPIB(bOut);
+    }
+
+    /**
+     * updatePPIB(bOut)
+     *
+     * On MODEL_5170 and up, this updates the "simulated" PPI_B.  The only common (and well-documented) PPI_B bits
+     * across all models are PPI_B.CLK_TIMER2 and PPI_B.SPK_TIMER2, so its possible that this function may need to
+     * limit its updates to just those bits, and move any model-specific requirements back into the appropriate I/O
+     * handlers (PPIB or 8042RWReg).  We'll see.
+     *
+     * UPDATE: The WOLF3D keyboard interrupt handler toggles the CLEAR_KBD bit of port 0x61 (ie, it sets and then
+     * clears the bit) after reading the scan code from port 0x60; assuming that they use the same interrupt handler
+     * for all machine models (which I haven't verified), the clear implication is that updatePPIB() also needs to
+     * support CLEAR_KBD and CLK_KBD, so I've moved that code from outPPIB() to updatePPIB().
+     *
+     * @this {ChipSet}
+     * @param {number} bOut
+     */
+    updatePPIB(bOut)
+    {
+        var fNewSpeaker = !!(bOut & ChipSet.PPI_B.SPK_TIMER2);
+        var fOldSpeaker = !!(this.bPPIB & ChipSet.PPI_B.SPK_TIMER2);
+        this.bPPIB = bOut;
+        if (this.kbd) this.kbd.setEnabled(!(bOut & ChipSet.PPI_B.CLEAR_KBD), !!(bOut & ChipSet.PPI_B.CLK_KBD));
+        if (fNewSpeaker != fOldSpeaker) {
+            /*
+             * Originally, this code didn't catch the "ERROR_BEEP" case @F000:EC34, which first turns both PPI_B.CLK_TIMER2 (0x01)
+             * and PPI_B.SPK_TIMER2 (0x02) off, then turns on only PPI_B.SPK_TIMER2 (0x02), then restores the original port value.
+             *
+             * So, when the ROM BIOS keyboard buffer got full, we didn't issue a BEEP alert.  I've fixed that by limiting the test
+             * to PPI_B.SPK_TIMER2 and ignoring PPI_B.CLK_TIMER2.
+             */
+            this.setSpeaker(fNewSpeaker);
+        }
+    }
+
+    /**
+     * inPPIC(port, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x62)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inPPIC(port, addrFrom)
+    {
+        var b = 0;
+
+        /*
+         * If you ever wanted to simulate I/O channel errors or R/W memory parity errors, you could
+         * add either PPI_C.IO_CHANNEL_CHK (0x40) or PPI_C.RW_PARITY_CHK (0x80) to the return value (b).
+         */
+        if ((this.model|0) == ChipSet.MODEL_5150) {
+            if (this.bPPIB & ChipSet.PPI_B.ENABLE_SW2) {
+                b |= this.aDIPSwitches[1][1] & ChipSet.PPI_C.SW;
+            } else {
+                b |= (this.aDIPSwitches[1][1] >> 4) & 0x1;
+            }
+        } else {
+            if (this.bPPIB & ChipSet.PPI_B.ENABLE_SW_HI) {
+                b |= this.aDIPSwitches[0][1] >> 4;
+            } else {
+                b |= this.aDIPSwitches[0][1] & 0xf;
+            }
+        }
+
+        if (this.bPPIB & ChipSet.PPI_B.CLK_TIMER2) {
+            var timer = this.updateTimer(ChipSet.PIT0.TIMER2);
+            if (timer.fOUT) {
+                if (this.bPPIB & ChipSet.PPI_B.SPK_TIMER2)
+                    b |= ChipSet.PPI_C.TIMER2_OUT;
+                else
+                    b |= ChipSet.PPI_C.CASS_DATA_IN;
+            }
+        }
+
+        /*
+         * The ROM BIOS polls this port incessantly during its memory tests, checking for memory parity errors
+         * (which of course we never report), so we further restrict these port messages to Messages.MEM.
+         */
+        this.printMessageIO(port, null, addrFrom, "PPI_C", b, Messages.CHIPSET | Messages.MEM);
+        return b;
+    }
+
+    /**
+     * outPPIC(port, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x62)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     */
+    outPPIC(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "PPI_C");
+        this.bPPIC = bOut;
+    }
+
+    /**
+     * inPPICtrl(port, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x63)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inPPICtrl(port, addrFrom)
+    {
+        var b = this.bPPICtrl;
+        this.printMessageIO(port, null, addrFrom, "PPI_CTRL", b);
+        return b;
+    }
+
+    /**
+     * outPPICtrl(port, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x63)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to write the specified port)
+     */
+    outPPICtrl(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "PPI_CTRL");
+        this.bPPICtrl = bOut;
+    }
+
+    /**
+     * in8041Kbd(port, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x60)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    in8041Kbd(port, addrFrom)
+    {
+        var b = this.kbd? this.kbd.readScanCode() : 0;
+        this.printMessageIO(port, null, addrFrom, "8041_KBD", b);
+        this.b8041Status &= ~ChipSet.KC8042.STATUS.OUTBUFF_FULL;
+        return b;
+    }
+
+    /**
+     * out8041Kbd(port, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x60)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     */
+    out8041Kbd(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "8041_KBD");
+        // if (this.kbd) this.kbd.sendCmd(bOut);
+    }
+
+    /**
+     * in8041Ctrl(port, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x61)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    in8041Ctrl(port, addrFrom)
+    {
+        var b = this.bPPIB;
+        this.printMessageIO(port, null, addrFrom, "8041_CTRL", b);
+        return b;
+    }
+
+    /**
+     * out8041Ctrl(port, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x61)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     */
+    out8041Ctrl(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "8041_CTRL");
+        this.updatePPIB(bOut);
+    }
+
+    /**
+     * in8041Status(port, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x64)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    in8041Status(port, addrFrom)
+    {
+        var b = this.b8041Status;
+        this.printMessageIO(port, null, addrFrom, "8041_STATUS", b);
+        return b;
+    }
+
+    /**
+     * in8042OutBuff(port, addrFrom)
+     *
+     * Return the contents of the OUTBUFF register and clear the OUTBUFF_FULL status bit.
+     *
+     * This function then calls kbd.checkScanCode(), on the theory that the next buffered scan
+     * code, if any, can now be delivered to OUTBUFF.  However, there are applications like
+     * BASICA that install a keyboard interrupt handler that reads OUTBUFF, do some scan code
+     * preprocessing, and then pass control on to the ROM's interrupt handler.  As a result,
+     * OUTBUFF is read multiple times during a single interrupt, so filling it with new data
+     * after every read would result in lost scan codes.
+     *
+     * To avoid that problem, kbd.checkScanCode() also requires that kbd.setEnabled() be called
+     * before it supplies any more data via notifyKbdData().  That will happen as soon as the
+     * ROM re-enables the controller, and is why KC8042.CMD.ENABLE_KBD processing also ends with a
+     * call to kbd.checkScanCode().
+     *
+     * Note that, the foregoing notwithstanding, I still clear the OUTBUFF_FULL bit here (as I
+     * believe I should); fortunately, none of the interrupt handlers rely on OUTBUFF_FULL as a
+     * prerequisite for reading OUTBUFF (not the BASICA handler, and not the ROM).  The assumption
+     * seems to be that if an interrupt occurred, OUTBUFF must contain data, regardless of the
+     * state of OUTBUFF_FULL.
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x60)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    in8042OutBuff(port, addrFrom)
+    {
+        var b = this.b8042OutBuff;
+        this.printMessageIO(port, null, addrFrom, "8042_OUTBUFF", b, Messages.C8042);
+        this.b8042Status &= ~(ChipSet.KC8042.STATUS.OUTBUFF_FULL | ChipSet.KC8042.STATUS.OUTBUFF_DELAY);
+        if (this.kbd) this.kbd.checkScanCode();
+        return b;
+    }
+
+    /**
+     * out8042InBuffData(port, bOut, addrFrom)
+     *
+     * This writes to the 8042's input buffer; using this port (ie, 0x60 instead of 0x64) designates the
+     * the byte as a KC8042.DATA.CMD "data byte".  Before clearing KC8042.STATUS.CMD_FLAG, however, we see if it's set,
+     * and then based on the previous KC8042.CMD "command byte", we do whatever needs to be done with this "data byte".
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x60)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to write the specified port)
+     */
+    out8042InBuffData(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "8042_INBUF.DATA", null, Messages.C8042);
+
+        if (this.b8042Status & ChipSet.KC8042.STATUS.CMD_FLAG) {
+
+            switch (this.b8042InBuff) {
+
+            case ChipSet.KC8042.CMD.WRITE_CMD:
+                this.set8042CmdData(bOut);
+                break;
+
+            case ChipSet.KC8042.CMD.WRITE_OUTPORT:
+                this.set8042OutPort(bOut);
+                break;
+
+            /*
+             * This case is reserved for command bytes that the 8042 is not expecting, which should therefore be passed
+             * on to the Keyboard itself.
+             *
+             * Here's some relevant MODEL_5170 ROM BIOS code, "XMIT_8042" (missing from the original MODEL_5170 ROM BIOS
+             * listing), which sends a command code in AL to the Keyboard and waits for a response, returning it in AL.
+             * Note that the only "success" exit path from this function involves LOOPing 64K times before finally reading
+             * the Keyboard's response; either the hardware and/or this code seems a bit brain-damaged if that's REALLY
+             * what you had to do to ensure a valid response....
+             *
+             *      F000:1B25 86E0          XCHG     AH,AL
+             *      F000:1B27 2BC9          SUB      CX,CX
+             *      F000:1B29 E464          IN       AL,64
+             *      F000:1B2B A802          TEST     AL,02      ; WAIT FOR INBUFF_FULL TO BE CLEAR
+             *      F000:1B2D E0FA          LOOPNZ   1B29
+             *      F000:1B2F E334          JCXZ     1B65       ; EXIT WITH ERROR (CX == 0)
+             *      F000:1B31 86E0          XCHG     AH,AL
+             *      F000:1B33 E660          OUT      60,AL      ; SAFE TO WRITE KEYBOARD CMD TO INBUFF NOW
+             *      F000:1B35 2BC9          SUB      CX,CX
+             *      F000:1B37 E464          IN       AL,64
+             *      F000:1B39 8AE0          MOV      AH,AL
+             *      F000:1B3B A801          TEST     AL,01
+             *      F000:1B3D 7402          JZ       1B41
+             *      F000:1B3F E460          IN       AL,60      ; READ PORT 0x60 IF OUTBUFF_FULL SET ("FLUSH"?)
+             *      F000:1B41 F6C402        TEST     AH,02
+             *      F000:1B44 E0F1          LOOPNZ   1B37
+             *      F000:1B46 751D          JNZ      1B65       ; EXIT WITH ERROR (CX == 0)
+             *      F000:1B48 B306          MOV      BL,06
+             *      F000:1B4A 2BC9          SUB      CX,CX
+             *      F000:1B4C E464          IN       AL,64
+             *      F000:1B4E A801          TEST     AL,01
+             *      F000:1B50 E1FA          LOOPZ    1B4C
+             *      F000:1B52 7508          JNZ      1B5C       ; PROCEED TO EXIT NOW THAT OUTBUFF_FULL IS SET
+             *      F000:1B54 FECB          DEC      BL
+             *      F000:1B56 75F4          JNZ      1B4C
+             *      F000:1B58 FEC3          INC      BL
+             *      F000:1B5A EB09          JMP      1B65       ; EXIT WITH ERROR (CX == 0)
+             *      F000:1B5C 2BC9          SUB      CX,CX
+             *      F000:1B5E E2FE          LOOP     1B5E       ; LOOOOOOPING....
+             *      F000:1B60 E460          IN       AL,60
+             *      F000:1B62 83E901        SUB      CX,0001    ; EXIT WITH SUCCESS (CX != 0)
+             *      F000:1B65 C3            RET
+             *
+             * But WAIT, the FUN doesn't end there.  After this function returns, "KBD_RESET" waits for a Keyboard
+             * interrupt to occur, hoping for scan code 0xAA as the Keyboard's final response.  "KBD_RESET" also returns
+             * CX to the caller, and the caller ("TEST.21") assumes there was no interrupt if CX is zero.
+             *
+             *              MOV     AL,0FDH
+             *              OUT     INTA01,AL
+             *              MOV     INTR_FLAG,0
+             *              STI
+             *              MOV     BL,10
+             *              SUB     CX,CX
+             *      G11:    TEST    [1NTR_FLAG],02H
+             *              JNZ     G12
+             *              LOOP    G11
+             *              DEC     BL
+             *              JNZ     G11
+             *              ...
+             *
+             * However, if [INTR_FLAG] is set immediately, the above code will exit immediately, without ever decrementing
+             * CX.  CX can be zero not only if the loop exhausted it, but also if no looping was required; the latter is not
+             * an error, but "TEST.21" assumes that it is.
+             */
+            default:
+                this.set8042CmdData(this.b8042CmdData & ~ChipSet.KC8042.DATA.CMD.NO_CLOCK);
+                if (this.kbd) this.set8042OutBuff(this.kbd.sendCmd(bOut));
+                break;
+            }
+        }
+        this.b8042InBuff = bOut;
+        this.b8042Status &= ~ChipSet.KC8042.STATUS.CMD_FLAG;
+    }
+
+    /**
+     * in8042RWReg(port, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x61)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    in8042RWReg(port, addrFrom)
+    {
+        /*
+         * Normally, we return whatever was last written to this port, but we do need to mask the
+         * two upper-most bits (KC8042.RWREG.NMI_ERROR), as those are output-only bits used to signal
+         * parity errors.
+         *
+         * Also, "TEST.09" of the MODEL_5170 BIOS expects the REFRESH_BIT to alternate, so we used to
+         * do this:
+         *
+         *      this.bPPIB ^= ChipSet.KC8042.RWREG.REFRESH_BIT;
+         *
+         * However, the MODEL_5170_REV3 BIOS not only checks REFRESH_BIT in "TEST.09", but includes
+         * an additional test right before "TEST.11A", which requires the bit change "a bit less"
+         * frequently.  This new test sets CX to zero, and at the end of the test (@F000:05B8), CX
+         * must be in the narrow range of 0xF600 through 0xF9FD.
+         *
+         * In fact, the new "WAITF" function @F000:1A3A tells us exactly how frequently REFRESH_BIT
+         * is expected to change now.  That function performs a "FIXED TIME WAIT", where CX is a
+         * "COUNT OF 15.085737us INTERVALS TO WAIT".
+         *
+         * So we now tie the state of the REFRESH_BIT to bit 6 of the current CPU cycle count,
+         * effectively toggling the bit after every 64 cycles.  On an 8Mhz CPU that can do 8 cycles
+         * in 1us, 64 cycles represents 8us, so that might be a bit fast for "WAITF", but bit 6
+         * is the only choice that also satisfies the pre-"TEST.11A" test as well.
+         */
+        var b = this.bPPIB & ~(ChipSet.KC8042.RWREG.NMI_ERROR | ChipSet.KC8042.RWREG.REFRESH_BIT) | ((this.cpu.getCycles() & 0x40)? ChipSet.KC8042.RWREG.REFRESH_BIT : 0);
+        /*
+         * Thanks to the WAITF function, this has become a very "busy" port, so if this generates too
+         * many messages, try adding Messages.LOG to the criteria.
+         */
+        this.printMessageIO(port, null, addrFrom, "8042_RWREG", b, Messages.C8042);
+        return b;
+    }
+
+    /**
+     * out8042RWReg(port, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x61)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     */
+    out8042RWReg(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "8042_RWREG", null, Messages.C8042);
+        this.updatePPIB(bOut);
+    }
+
+    /**
+     * in8042Status(port, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x64)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    in8042Status(port, addrFrom)
+    {
+        this.printMessageIO(port, null, addrFrom, "8042_STATUS", this.b8042Status, Messages.C8042);
+        var b = this.b8042Status & 0xff;
+        /*
+         * There's code in the 5170 BIOS (F000:03BF) that writes an 8042 command (0xAA), waits for
+         * KC8042.STATUS.INBUFF_FULL to go clear (which it always is, because we always accept commands
+         * immediately), then checks KC8042.STATUS.OUTBUFF_FULL and performs a "flush" on port 0x60 if
+         * it's set, then waits for KC8042.STATUS.OUTBUFF_FULL *again*.  Unfortunately, the "flush" throws
+         * away our response if we respond immediately.
+         *
+         * So now when out8042InBuffCmd() has a response, it sets KC8042.STATUS.OUTBUFF_DELAY instead
+         * (which is outside the 0xff range of bits we return); when we see KC8042.STATUS.OUTBUFF_DELAY,
+         * we clear it and set KC8042.STATUS.OUTBUFF_FULL, which will be returned on the next read.
+         *
+         * This provides a single poll delay, so that the aforementioned "flush" won't toss our response.
+         * If longer delays are needed down the road, we may need to set a delay count in the upper (hidden)
+         * bits of b8042Status, instead of using a single delay bit.
+         */
+        if (this.b8042Status & ChipSet.KC8042.STATUS.OUTBUFF_DELAY) {
+            this.b8042Status |= ChipSet.KC8042.STATUS.OUTBUFF_FULL;
+            this.b8042Status &= ~ChipSet.KC8042.STATUS.OUTBUFF_DELAY;
+        }
+        return b;
+    }
+
+    /**
+     * out8042InBuffCmd(port, bOut, addrFrom)
+     *
+     * This writes to the 8042's input buffer; using this port (ie, 0x64 instead of 0x60) designates the
+     * the byte as a "command byte".  We immediately set KC8042.STATUS.CMD_FLAG, and then see if we can act upon
+     * the command immediately (some commands requires us to wait for a "data byte").
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x64)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to write the specified port)
+     */
+    out8042InBuffCmd(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "8042_INBUFF.CMD", null, Messages.C8042);
+
+        this.b8042InBuff = bOut;
+
+        this.b8042Status |= ChipSet.KC8042.STATUS.CMD_FLAG;
+
+        var bPulseBits = 0;
+        if (this.b8042InBuff >= ChipSet.KC8042.CMD.PULSE_OUTPORT) {
+            bPulseBits = (this.b8042InBuff ^ 0xf);
+            /*
+             * Now that we have isolated the bit(s) to pulse, map all pulse commands to KC8042.CMD.PULSE_OUTPORT
+             */
+            this.b8042InBuff = ChipSet.KC8042.CMD.PULSE_OUTPORT;
+        }
+
+        switch (this.b8042InBuff) {
+        case ChipSet.KC8042.CMD.READ_CMD:           // 0x20
+            this.set8042OutBuff(this.b8042CmdData);
+            break;
+
+        case ChipSet.KC8042.CMD.WRITE_CMD:          // 0x60
+            /*
+             * No further action required for this command; more data is expected via out8042InBuffData()
+             */
+            break;
+
+        case ChipSet.KC8042.CMD.DISABLE_KBD:        // 0xAD
+            this.set8042CmdData(this.b8042CmdData | ChipSet.KC8042.DATA.CMD.NO_CLOCK);
+            if (DEBUG) this.printMessage("keyboard disabled", Messages.KEYBOARD | Messages.PORT);
+            /*
+             * NOTE: The MODEL_5170 BIOS calls "KBD_RESET" (F000:17D2) while the keyboard interface is disabled,
+             * yet we must still deliver the Keyboard's CMDRES.BAT_OK response code?  Seems like an odd thing for
+             * a "disabled interface" to do.
+             */
+            break;
+
+        case ChipSet.KC8042.CMD.ENABLE_KBD:         // 0xAE
+            this.set8042CmdData(this.b8042CmdData & ~ChipSet.KC8042.DATA.CMD.NO_CLOCK);
+            if (DEBUG) this.printMessage("keyboard re-enabled", Messages.KEYBOARD | Messages.PORT);
+            if (this.kbd) this.kbd.checkScanCode();
+            break;
+
+        case ChipSet.KC8042.CMD.SELF_TEST:          // 0xAA
+            if (this.kbd) this.kbd.flushScanCode();
+            this.set8042CmdData(this.b8042CmdData | ChipSet.KC8042.DATA.CMD.NO_CLOCK);
+            if (DEBUG) this.printMessage("keyboard disabled on reset", Messages.KEYBOARD | Messages.PORT);
+            this.set8042OutBuff(ChipSet.KC8042.DATA.SELF_TEST.OK);
+            this.set8042OutPort(ChipSet.KC8042.OUTPORT.NO_RESET | ChipSet.KC8042.OUTPORT.A20_ON);
+            break;
+
+        case ChipSet.KC8042.CMD.INTF_TEST:          // 0xAB
+            /*
+             * TODO: Determine all the side-effects of the Interface Test, if any.
+             */
+            this.set8042OutBuff(ChipSet.KC8042.DATA.INTF_TEST.OK);
+            break;
+
+        case ChipSet.KC8042.CMD.READ_INPORT:        // 0xC0
+            this.set8042OutBuff(this.b8042InPort);
+            break;
+
+        case ChipSet.KC8042.CMD.READ_OUTPORT:       // 0xD0
+            this.set8042OutBuff(this.b8042OutPort);
+            break;
+
+        case ChipSet.KC8042.CMD.WRITE_OUTPORT:      // 0xD1
+            /*
+             * No further action required for this command; more data is expected via out8042InBuffData()
+             */
+            break;
+
+        case ChipSet.KC8042.CMD.READ_TEST:          // 0xE0
+            this.set8042OutBuff((this.b8042CmdData & ChipSet.KC8042.DATA.CMD.NO_CLOCK)? 0 : ChipSet.KC8042.TESTPORT.KBD_CLOCK);
+            break;
+
+        case ChipSet.KC8042.CMD.PULSE_OUTPORT:      // 0xF0-0xFF
+            if (bPulseBits & 0x1) {
+                /*
+                 * Bit 0 of the 8042's output port is connected to RESET.  If it's pulsed, the processor resets.
+                 * We don't want to clear *all* CPU state (eg, cycle counts), so we call cpu.resetRegs() instead
+                 * of cpu.reset().
+                 */
+                this.cpu.resetRegs();
+            }
+            break;
+
+        default:
+            if (DEBUG && this.messageEnabled(Messages.C8042)) {
+                this.printMessage("unrecognized 8042 command: " + Str.toHexByte(this.b8042InBuff), true);
+                this.dbg.stopCPU();
+            }
+            break;
+        }
+    }
+
+    /**
+     * set8042CmdData(b)
+     *
+     * @this {ChipSet}
+     * @param {number} b
+     */
+    set8042CmdData(b)
+    {
+        this.b8042CmdData = b;
+
+        this.b8042Status = (this.b8042Status & ~ChipSet.KC8042.STATUS.SYS_FLAG) | (b & ChipSet.KC8042.DATA.CMD.SYS_FLAG);
+        if (this.kbd) {
+            /*
+             * This seems to be what the doctor ordered for the MODEL_5170_REV3 BIOS @F000:0A6D, where it
+             * sends ChipSet.KC8042.CMD.WRITE_CMD to port 0x64, followed by 0x4D to port 0x60, which clears NO_CLOCK
+             * and enables the keyboard.  The BIOS then waits for OUTBUFF_FULL to be set, at which point it seems
+             * to be anticipating an 0xAA response in the output buffer.
+             *
+             * And indeed, if we call the original MODEL_5150/MODEL_5160 setEnabled() Keyboard interface here,
+             * and both the data and clock lines have transitioned high (ie, both parameters are true), then it
+             * will call resetDevice(), generating a Keyboard.CMDRES.BAT_OK response.
+             *
+             * This agrees with my understanding of what happens when the 8042 toggles the clock line high
+             * (ie, clears NO_CLOCK): the TechRef's "Basic Assurance Test" section says that when the Keyboard is
+             * powered on, it performs the BAT, and then when the clock and data lines go high, the keyboard sends
+             * a completion code (eg, 0xAA for success, or 0xFC or something else for failure).
+             */
+            this.kbd.setEnabled(!!(b & ChipSet.KC8042.DATA.CMD.NO_INHIBIT), !(b & ChipSet.KC8042.DATA.CMD.NO_CLOCK));
+        }
+    }
+
+    /**
+     * set8042OutBuff(b, fNoDelay)
+     *
+     * The 5170 ROM BIOS assumed there would be a slight delay after certain 8042 commands, like SELF_TEST
+     * (0xAA), before there was an OUTBUFF response; in fact, there is BIOS code that will fail without such
+     * a delay.  This is discussed in greater detail in in8042Status().
+     *
+     * So we default to a "single poll" delay, setting OUTBUFF_DELAY instead of OUTBUFF_FULL, unless the caller
+     * explicitly asks for no delay.  The fNoDelay parameter was added later, so that notifyKbdData() could
+     * request immediate delivery of keyboard scan codes, because some operating systems (eg, Microport's 1986
+     * version of Unix for PC AT machines) poll the status port only once, immediately giving up if no data is
+     * available.
+     *
+     * TODO: Determine if we should invert the fNoDelay default (from false to true) and delay only in specific
+     * cases; ie, perhaps only the SELF_TEST command required a delay.
+     *
+     * @this {ChipSet}
+     * @param {number} b
+     * @param {boolean} [fNoDelay]
+     */
+    set8042OutBuff(b, fNoDelay)
+    {
+        if (b >= 0) {
+            this.b8042OutBuff = b;
+            if (fNoDelay) {
+                this.b8042Status |= ChipSet.KC8042.STATUS.OUTBUFF_FULL;
+            } else {
+                this.b8042Status &= ~ChipSet.KC8042.STATUS.OUTBUFF_FULL;
+                this.b8042Status |= ChipSet.KC8042.STATUS.OUTBUFF_DELAY;
+            }
+            if (DEBUG && this.messageEnabled(Messages.KEYBOARD | Messages.PORT)) {
+                this.printMessage("set8042OutBuff(" + Str.toHexByte(b) + ',' + (fNoDelay? "no" : "") + "delay)", true);
+            }
+        }
+    }
+
+    /**
+     * set8042OutPort(b)
+     *
+     * When ChipSet.KC8042.CMD.WRITE_OUTPORT (0xD1) is written to port 0x64, the next byte written to port 0x60 comes here,
+     * to the KBC's OUTPORT.  One of the most important bits in the OUTPORT is the A20_ON bit (0x02): set it to turn A20 on,
+     * clear it to turn A20 off.
+     *
+     * @this {ChipSet}
+     * @param {number} b
+     */
+    set8042OutPort(b)
+    {
+        this.b8042OutPort = b;
+
+        this.bus.setA20(!!(b & ChipSet.KC8042.OUTPORT.A20_ON));
+
+        if (!(b & ChipSet.KC8042.OUTPORT.NO_RESET)) {
+            /*
+             * Bit 0 of the 8042's output port is connected to RESET.  Normally, it's "pulsed" with the
+             * KC8042.CMD.PULSE_OUTPORT command, so if a RESET is detected via this command, we should try to
+             * determine if that's what the caller intended.
+             */
+            if (DEBUG && this.messageEnabled(Messages.C8042)) {
+                this.printMessage("unexpected 8042 output port reset: " + Str.toHexByte(b), true);
+                this.dbg.stopCPU();
+            }
+            this.cpu.resetRegs();
+        }
+    }
+
+    /**
+     * notifyKbdData(b)
+     *
+     * In the old days of PCx86, the Keyboard component would simply call setIRR() when it had some data for the
+     * keyboard controller.  However, the Keyboard's sole responsibility is to emulate an actual keyboard and call
+     * notifyKbdData() whenever it has some data; it's not allowed to mess with IRQ lines.
+     *
+     * If there's an 8042, we check (this.b8042CmdData & ChipSet.KC8042.DATA.CMD.NO_CLOCK); if NO_CLOCK is clear,
+     * we can raise the IRQ immediately.  Well, not quite immediately....
+     *
+     * Notes regarding the MODEL_5170 (eg, /devices/pc/machine/5170/ega/1152kb/rev3/machine.xml):
+     *
+     * The "Rev3" BIOS, dated 11-Nov-1985, contains the following code in the keyboard interrupt handler at K26A:
+     *
+     *      F000:3704 FA            CLI
+     *      F000:3705 B020          MOV      AL,20
+     *      F000:3707 E620          OUT      20,AL
+     *      F000:3709 B0AE          MOV      AL,AE
+     *      F000:370B E88D02        CALL     SHIP_IT
+     *      F000:370E FA            CLI                     <-- window of opportunity
+     *      F000:370F 07            POP      ES
+     *      F000:3710 1F            POP      DS
+     *      F000:3711 5F            POP      DI
+     *      F000:3712 5E            POP      SI
+     *      F000:3713 5A            POP      DX
+     *      F000:3714 59            POP      CX
+     *      F000:3715 5B            POP      BX
+     *      F000:3716 58            POP      AX
+     *      F000:3717 5D            POP      BP
+     *      F000:3718 CF            IRET
+     *
+     * and SHIP_IT looks like this:
+     *
+     *      F000:399B 50            PUSH     AX
+     *      F000:399C FA            CLI
+     *      F000:399D 2BC9          SUB      CX,CX
+     *      F000:399F E464          IN       AL,64
+     *      F000:39A1 A802          TEST     AL,02
+     *      F000:39A3 E0FA          LOOPNZ   399F
+     *      F000:39A5 58            POP      AX
+     *      F000:39A6 E664          OUT      64,AL
+     *      F000:39A8 FB            STI
+     *      F000:39A9 C3            RET
+     *
+     * This code *appears* to be trying to ensure that another keyboard interrupt won't occur until after the IRET,
+     * but sadly, it looks to me like the CLI following the call to SHIP_IT is too late.  SHIP_IT should have been
+     * written with PUSHF/CLI and POPF intro/outro sequences, thereby honoring the first CLI at the top of K26A and
+     * eliminating the need for the second CLI (@F000:370E).
+     *
+     * Of course, in "real life", this was probably never a problem, because the 8042 probably wasn't fast enough to
+     * generate another interrupt so soon after receiving the ChipSet.KC8042.CMD.ENABLE_KBD command.  In my case, I ran
+     * into this problem by 1) turning on "kbd" Debugger messages and 2) rapidly typing lots of keys.  The Debugger
+     * messages bogged the machine down enough for me to hit the "window of opportunity", generating this message in
+     * PC-DOS 3.20:
+     *
+     *      "FATAL: Internal Stack Failure, System Halted."
+     *
+     * and halting the system @0070:0923 (JMP 0923).
+     *
+     * That wasn't the only spot in the BIOS where I hit this problem; here's another "window of opportunity":
+     *
+     *      F000:3975 FA            CLI
+     *      F000:3976 B020          MOV      AL,20
+     *      F000:3978 E620          OUT      20,AL
+     *      F000:397A B0AE          MOV      AL,AE
+     *      F000:397C E81C00        CALL     SHIP_IT
+     *      F000:397F B80291        MOV      AX,9102        <-- window of opportunity
+     *      F000:3982 CD15          INT      15
+     *      F000:3984 80269600FC    AND      [0096],FC
+     *      F000:3989 E982FD        JMP      370E
+     *
+     * In this second, lengthier, example, I counted about 60 instructions being executed from the EOI @F000:3978 to
+     * the final IRET @F000:3718, most of them in the INT 0x15 handler.  So, I'm going to double that count to 120
+     * instructions, just to be safe, and pass that along to every setIRR() call we make here.
+     *
+     * @this {ChipSet}
+     * @param {number} b
+     */
+    notifyKbdData(b)
+    {
+        if (DEBUG && this.messageEnabled(Messages.KEYBOARD | Messages.PORT)) {
+            this.printMessage("notifyKbdData(" + Str.toHexByte(b) + ')', true);
+        }
+        if (this.model < ChipSet.MODEL_5170) {
+            /*
+             * TODO: Should we be checking bPPI for PPI_B.CLK_KBD on these older machines, before calling setIRR()?
+             */
+            this.setIRR(ChipSet.IRQ.KBD, 4);
+            this.b8041Status |= ChipSet.KC8042.STATUS.OUTBUFF_FULL;
+        }
+        else {
+            if (!(this.b8042CmdData & ChipSet.KC8042.DATA.CMD.NO_CLOCK)) {
+                /*
+                 * The next read of b8042OutBuff will clear both of these bits and call kbd.checkScanCode(),
+                 * which will call notifyKbdData() again if there's still keyboard data to process.
+                 */
+                if (!(this.b8042Status & (ChipSet.KC8042.STATUS.OUTBUFF_FULL | ChipSet.KC8042.STATUS.OUTBUFF_DELAY))) {
+                    this.set8042OutBuff(b, true);
+                    this.kbd.shiftScanCode();
+                    /*
+                     * A delay of 4 instructions was originally requested as part of the the Keyboard's resetDevice()
+                     * response, but a larger delay (120) is now needed for MODEL_5170 machines, per the discussion above.
+                     */
+                    this.setIRR(ChipSet.IRQ.KBD, 120);
+                }
+                else {
+                    if (DEBUG && this.messageEnabled(Messages.KEYBOARD | Messages.PORT)) {
+                        this.printMessage("notifyKbdData(" + Str.toHexByte(b) + "): output buffer full", true);
+                    }
+                }
+            } else {
+                if (DEBUG && this.messageEnabled(Messages.KEYBOARD | Messages.PORT)) {
+                    this.printMessage("notifyKbdData(" + Str.toHexByte(b) + "): disabled", true);
+                }
+            }
+        }
+    }
+
+    /**
+     * in6300DIPSwitches(iDIP, port, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} iDIP (0 or 1)
+     * @param {number} port (0x66 or 0x67)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    in6300DIPSwitches(iDIP, port, addrFrom)
+    {
+        var b = this.aDIPSwitches[iDIP][1];
+        this.printMessageIO(port, null, addrFrom, "DIPSW-" + iDIP, b, Messages.CHIPSET);
+        return b;
+    }
+
+    /**
+     * inCMOSAddr(port, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x70)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inCMOSAddr(port, addrFrom)
+    {
+        this.printMessageIO(port, null, addrFrom, "CMOS.ADDR", this.bCMOSAddr, Messages.CMOS);
+        return this.bCMOSAddr;
+    }
+
+    /**
+     * outCMOSAddr(port, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x70)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to write the specified port)
+     */
+    outCMOSAddr(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "CMOS.ADDR", null, Messages.CMOS);
+        this.bCMOSAddr = bOut;
+        this.bNMI = (bOut & ChipSet.CMOS.ADDR.NMI_DISABLE)? ChipSet.NMI.DISABLE : ChipSet.NMI.ENABLE;
+    }
+
+    /**
+     * inCMOSData(port, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x71)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to read the specified port)
+     * @return {number} simulated port value
+     */
+    inCMOSData(port, addrFrom)
+    {
+        var bAddr = this.bCMOSAddr & ChipSet.CMOS.ADDR.MASK;
+        var bIn = (bAddr <= ChipSet.CMOS.ADDR.STATUSD? this.getRTCByte(bAddr) : this.abCMOSData[bAddr]);
+        if (this.messageEnabled(Messages.CMOS | Messages.PORT)) {
+            this.printMessageIO(port, null, addrFrom, "CMOS.DATA[" + Str.toHexByte(bAddr) + "]", bIn, true);
+        }
+        if (addrFrom != null) {
+            if (bAddr == ChipSet.CMOS.ADDR.STATUSC) {
+                /*
+                 * When software reads the STATUSC port, all interrupt bits (PF, AF, and UF) are automatically
+                 * cleared, which in turn clears the IRQF bit, which in turn clears the IRQ.
+                 */
+                this.abCMOSData[bAddr] &= ChipSet.CMOS.STATUSC.RESERVED;
+                if (bIn & ChipSet.CMOS.STATUSC.IRQF) this.clearIRR(ChipSet.IRQ.RTC);
+                /*
+                 * If we just cleared PF, and PIE is still set, then we need to make sure the next Periodic Interrupt
+                 * occurs in a timely manner, too.
+                 */
+                if ((bIn & ChipSet.CMOS.STATUSC.PF) && (this.abCMOSData[ChipSet.CMOS.ADDR.STATUSB] & ChipSet.CMOS.STATUSB.PIE)) {
+                    if (DEBUG) this.printMessage("RTC periodic interrupt cleared", Messages.RTC);
+                    this.setRTCCycleLimit();
+                }
+            }
+        }
+        return bIn;
+    }
+
+    /**
+     * outCMOSData(port, bOut, addrFrom)
+     *
+     * @this {ChipSet}
+     * @param {number} port (0x71)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to write the specified port)
+     */
+    outCMOSData(port, bOut, addrFrom)
+    {
+        var bAddr = this.bCMOSAddr & ChipSet.CMOS.ADDR.MASK;
+        if (this.messageEnabled(Messages.CMOS | Messages.PORT)) {
+            this.printMessageIO(port, bOut, addrFrom, "CMOS.DATA[" + Str.toHexByte(bAddr) + "]", null, true);
+        }
+        var bDelta = bOut ^ this.abCMOSData[bAddr];
+        this.abCMOSData[bAddr] = (bAddr <= ChipSet.CMOS.ADDR.STATUSD? this.setRTCByte(bAddr, bOut) : bOut);
+        if (bAddr == ChipSet.CMOS.ADDR.STATUSB && (bDelta & ChipSet.CMOS.STATUSB.PIE)) {
+            if (bOut & ChipSet.CMOS.STATUSB.PIE) {
+                if (DEBUG) this.printMessage("RTC periodic interrupts enabled", Messages.RTC);
+                this.setRTCCycleLimit();
+            } else {
+                if (DEBUG) this.printMessage("RTC periodic interrupts disabled", Messages.RTC);
+            }
+        }
+    }
+
+    /**
+     * outNMI(port, bOut, addrFrom)
+     *
+     * This handler is installed only for models before MODEL_5170.
+     *
+     * @this {ChipSet}
+     * @param {number} port (0xA0)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to write the specified port)
+     */
+    outNMI(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "NMI");
+        this.bNMI = bOut;
+    }
+
+    /**
+     * outFPUClear(port, bOut, addrFrom)
+     *
+     * This handler is installed only for MODEL_5170.
+     *
+     * @this {ChipSet}
+     * @param {number} port (0xF0)
+     * @param {number} bOut (0x00 is the only expected output)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to write the specified port)
+     */
+    outFPUClear(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "FPU.CLEAR");
+
+        if (this.fpu) this.fpu.clearBusy();
+    }
+
+    /**
+     * outFPUReset(port, bOut, addrFrom)
+     *
+     * This handler is installed only for MODEL_5170.
+     *
+     * @this {ChipSet}
+     * @param {number} port (0xF1)
+     * @param {number} bOut (0x00 is the only expected output)
+     * @param {number} [addrFrom] (not defined if the Debugger is trying to write the specified port)
+     */
+    outFPUReset(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "FPU.RESET");
+
+        if (this.fpu) this.fpu.resetFPU();
+    }
+
+    /**
+     * intBIOSRTC(addr)
+     *
+     * INT 0x1A Quick Reference:
+     *
+     *      AH
+     *      ----
+     *      0x00    Get current clock count in CX:DX
+     *      0x01    Set current clock count from CX:DX
+     *      0x02    Get real-time clock using BCD (CH=hours, CL=minutes, DH=seconds)
+     *      0x03    Set real-time clock using BCD (CH=hours, CL=minutes, DH=seconds, DL=1 if Daylight Savings Time option)
+     *      0x04    Get real-time date using BCD (CH=century, CL=year, DH=month, DL=day)
+     *      0x05    Set real-time date using BCD (CH=century, CL=year, DH=month, DL=day)
+     *      0x06    Set alarm using BCD (CH=hours, CL=minutes, DH=seconds)
+     *      0x07    Reset alarm
+     *
+     * @this {ChipSet}
+     * @param {number} addr
+     * @return {boolean} true to proceed with the INT 0x1A software interrupt, false to skip
+     */
+    intBIOSRTC(addr)
+    {
+        if (DEBUGGER) {
+            if (this.messageEnabled(Messages.INT) && this.dbg.messageInt(Interrupts.RTC, addr)) {
+                /*
+                 * By computing AH now, we get the incoming AH value; if we computed it below, along with
+                 * the rest of the register values, we'd get the outgoing AH value, which is not what we want.
+                 */
+                var AH = this.cpu.regEAX >> 8;
+                this.cpu.addIntReturn(addr, function(chipset, nCycles) {
+                    return function onBIOSRTCReturn(nLevel) {
+                        nCycles = chipset.cpu.getCycles() - nCycles;
+                        var sResult;
+                        var CL = chipset.cpu.regEDX & 0xff;
+                        var CH = chipset.cpu.regEDX >> 8;
+                        var DL = chipset.cpu.regEDX & 0xff;
+                        var DH = chipset.cpu.regEDX >> 8;
+                        if (AH == 0x02 || AH == 0x03) {
+                            sResult = " CH(hour)=" + Str.toHexWord(CH) + " CL(min)=" + Str.toHexByte(CL) + " DH(sec)=" + Str.toHexByte(DH);
+                        } else if (AH == 0x04 || AH == 0x05) {
+                            sResult = " CX(year)=" + Str.toHexWord(chipset.cpu.regECX) + " DH(month)=" + Str.toHexByte(DH) + " DL(day)=" + Str.toHexByte(DL);
+                        }
+                        chipset.dbg.messageIntReturn(Interrupts.RTC, nLevel, nCycles, sResult);
+                    };
+                }(this, this.cpu.getCycles()));
+            }
+        }
+        return true;
+    }
+
+    /**
+     * setSpeaker(fOn)
+     *
+     * @this {ChipSet}
+     * @param {boolean} [fOn] true to turn speaker on, false to turn off, otherwise update as appropriate
+     */
+    setSpeaker(fOn)
+    {
+        if (this.contextAudio) {
+            try {
+                if (fOn !== undefined) {
+                    this.fSpeaker = fOn;
+                } else {
+                    fOn = !!(this.fSpeaker && this.cpu && this.cpu.isRunning());
+                }
+                var freq = Math.round(ChipSet.TIMER_TICKS_PER_SEC / this.getTimerInit(ChipSet.PIT0.TIMER2));
+                /*
+                 * Treat frequencies outside the normal hearing range (below 20hz or above 20Khz) as a clever attempt
+                 * to turn sound off; we have to explicitly turn the sound off in those cases, to prevent the Audio API
+                 * from "easing" the audio to the target frequency and creating odd sound effects.
+                 */
+                if (freq < 20 || freq > 20000) fOn = false;
+                if (fOn) {
+                    if (this.sourceAudio) {
+                        this.sourceAudio['frequency']['value'] = freq;
+                        if (this.messageEnabled(Messages.SPEAKER)) this.printMessage("speaker set to " + freq + "hz", true);
+                    } else {
+                        this.sourceAudio = this.contextAudio['createOscillator']();
+                        if (this.sourceAudio) {
+                            if (typeof this.sourceAudio['type'] == "number") {
+                                this.sourceAudio['type'] = 1;   // deprecated: 0: "sine", 1: "square", 2: "sawtooth", 3: "triangle"
+                            } else {
+                                this.sourceAudio['type'] = "square";
+                            }
+                            this.sourceAudio['connect'](this.contextAudio['destination']);
+                            this.sourceAudio['frequency']['value'] = freq;
+                            if ('start' in this.sourceAudio) {
+                                this.sourceAudio['start'](0);
+                            } else {
+                                this.sourceAudio['noteOn'](0);  // deprecated: this.sourceAudio['noteOn'](0)
+                            }
+                            if (this.messageEnabled(Messages.SPEAKER)) this.printMessage("speaker on at  " + freq + "hz", true);
+                        }
+                    }
+                } else {
+                    if (this.sourceAudio) {
+                        if ('stop' in this.sourceAudio) {
+                            this.sourceAudio['stop'](0);
+                        } else {
+                            this.sourceAudio['noteOff'](0);     // deprecated: this.sourceAudio['noteOff'](0)
+                        }
+                        this.sourceAudio['disconnect']();       // QUESTION: is this automatic following a stop(), since this particular source cannot be started again?
+                        delete this.sourceAudio;                // QUESTION: ditto?
+                        if (this.messageEnabled(Messages.SPEAKER)) this.printMessage("speaker off at " + freq + "hz", true);
+                    }
+                }
+            } catch(e) {
+                this.notice("AudioContext exception: " + e.message);
+                this.contextAudio = null;
+            }
+        } else if (fOn) {
+            this.printMessage("BEEP", Messages.SPEAKER);
+        }
+    }
+
+    /**
+     * messageBitsDMA(iChannel)
+     *
+     * @this {ChipSet}
+     * @param {number} [iChannel] if the message is associated with a particular IRQ #
+     * @return {number}
+     */
+    messageBitsDMA(iChannel)
+    {
+        var bitsMessage = 0;
+        if (DEBUG) {
+            bitsMessage = Messages.DATA;
+            if (iChannel == ChipSet.DMA_FDC) {
+                bitsMessage |= Messages.FDC;
+            } else if (iChannel == ChipSet.DMA_HDC) {
+                bitsMessage |= Messages.HDC;
+            }
+        }
+        return bitsMessage;
+    }
+
+    /**
+     * messageBitsIRQ(nIRQ)
+     *
+     * @this {ChipSet}
+     * @param {number|undefined} [nIRQ] if the message is associated with a particular IRQ #
+     * @return {number}
+     */
+    messageBitsIRQ(nIRQ)
+    {
+        var bitsMessage = 0;
+        if (DEBUG) {
+            bitsMessage = Messages.PIC;
+            if (nIRQ == ChipSet.IRQ.TIMER0) {           // IRQ 0
+                bitsMessage |= Messages.TIMER;
+            } else if (nIRQ == ChipSet.IRQ.KBD) {       // IRQ 1
+                bitsMessage |= Messages.KEYBOARD;
+            } else if (nIRQ == ChipSet.IRQ.SLAVE) {     // IRQ 2 (MODEL_5170 and up)
+                bitsMessage |= Messages.CHIPSET;
+            } else if (nIRQ == ChipSet.IRQ.COM1 || nIRQ == ChipSet.IRQ.COM2) {
+                bitsMessage |= Messages.SERIAL;
+            } else if (nIRQ == ChipSet.IRQ.XTC) {       // IRQ 5 (MODEL_5160)
+                bitsMessage |= Messages.HDC;
+            } else if (nIRQ == ChipSet.IRQ.FDC) {       // IRQ 6
+                bitsMessage |= Messages.FDC;
+            } else if (nIRQ == ChipSet.IRQ.RTC) {       // IRQ 8 (MODEL_5170 and up)
+                bitsMessage |= Messages.RTC;
+            } else if (nIRQ == ChipSet.IRQ.ATC) {       // IRQ 14 (MODEL_5170 and up)
+                bitsMessage |= Messages.HDC;
+            }
+        }
+        return bitsMessage;
+    }
+
+    /**
+     * checkDMA()
+     *
+     * Called by the CPU whenever INTR.DMA is set.
+     *
+     * @return {boolean} true if one or more async DMA channels are still active (unmasked), false to reset INTR.DMA
+     *
+     checkDMA()
+     {
+         var fActive = false;
+         for (var iDMAC = 0; iDMAC < this.aDMACs; iDMAC++) {
+             var controller = this.aDMACs[iDMAC];
+             for (var iChannel = 0; iChannel < controller.aChannels.length; iChannel++) {
+                 var channel = controller.aChannels[iChannel];
+                 if (!channel.masked) {
+                     this.advanceDMA(channel);
+                     if (!channel.masked) fActive = true;
+                 }
+             }
+         }
+         return fActive;
+     }
+     */
+
+    /**
+     * ChipSet.init()
+     *
+     * This function operates on every HTML element of class "chipset", extracting the
+     * JSON-encoded parameters for the ChipSet constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a ChipSet component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeChipSet = Component.getElementsByClass(document, PCX86.APPCLASS, "chipset");
+        for (var iChip = 0; iChip < aeChipSet.length; iChip++) {
+            var eChipSet = aeChipSet[iChip];
+            var parmsChipSet = Component.getComponentParms(eChipSet);
+            var chipset = new ChipSet(parmsChipSet);
+            Component.bindComponentControls(chipset, eChipSet, PCX86.APPCLASS);
+            chipset.updateDIPSwitchDescriptions();
+        }
+    }
+}
+
+/*
+ * Ports Overview
+ * --------------
+ *
+ * This module provides support for many of the following components (except where a separate component is noted).
+ * This list is taken from p.1-8 ("System Unit") of the IBM 5160 (PC XT) Technical Reference Manual (as revised
+ * April 1983), only because I didn't see a similar listing in the original 5150 Technical Reference.
+ *
+ *      Port(s)         Description
+ *      -------         -----------
+ *      000-00F         DMA Chip 8237A-5                                [see below]
+ *      020-021         Interrupt 8259A                                 [see below]
+ *      040-043         Timer 8253-5                                    [see below]
+ *      060-063         PPI 8255A-5                                     [see below]
+ *      080-083         DMA Page Registers                              [see below]
+ *          0Ax [1]     NMI Mask Register                               [see below]
+ *          0Cx         Reserved
+ *          0Ex         Reserved
+ *      200-20F         Game Control
+ *      210-217         Expansion Unit
+ *      220-24F         Reserved
+ *      278-27F         Reserved
+ *      2F0-2F7         Reserved
+ *      2F8-2FF         Asynchronous Communications (Secondary)         [see the SerialPort component]
+ *      300-31F         Prototype Card
+ *      320-32F         Hard Drive Controller (XTC)                     [see the HDC component]
+ *      378-37F         Printer
+ *      380-38C [2]     SDLC Communications
+ *      380-389 [2]     Binary Synchronous Communications (Secondary)
+ *      3A0-3A9         Binary Synchronous Communications (Primary)
+ *      3B0-3BF         IBM Monochrome Display/Printer                  [see the Video component]
+ *      3C0-3CF         Reserved
+ *      3D0-3DF         Color/Graphics (Motorola 6845)                  [see the Video component]
+ *      3EO-3E7         Reserved
+ *      3FO-3F7         Floppy Drive Controller                         [see the FDC component]
+ *      3F8-3FF         Asynchronous Communications (Primary)           [see the SerialPort component]
+ *
+ * [1] At power-on time, NMI is masked off, perhaps because models 5150 and 5160 also tie coprocessor
+ * (FPU) interrupts to NMI.  Suppressing NMI by default seems odd, because that would also suppress memory
+ * parity errors.  TODO: Determine whether "power-on time" refers to the initial power-on state of the
+ * NMI Mask Register or the state that the BIOS "POST" (Power-On Self-Test) sets.
+ *
+ * [2] These devices cannot be used together since their port addresses overlap.
+ *
+ *      MODEL_5170      Description
+ *      ----------      -----------
+ *          070 [3]     CMOS Address                                    ChipSet.CMOS.ADDR.PORT
+ *          071         CMOS Data                                       ChipSet.CMOS.DATA.PORT
+ *          0F0         FPU Coprocessor Clear Busy (output 0x00)
+ *          0F1         FPU Coprocessor Reset (output 0x00)
+ *      1F0-1F7         Hard Drive Controller (ATC)                     [see the HDC component]
+ *
+ * [3] Port 0x70 doubles as the NMI Mask Register: output a CMOS address with bit 7 clear to enable NMI
+ * or with bit 7 set to disable NMI (apparently the inverse of the older NMI Mask Register at port 0xA0).
+ * Also, apparently unlike previous models, the MODEL_5170 POST leaves NMI enabled.  And fortunately, the
+ * FPU coprocessor interrupt line is no longer tied to NMI (it uses IRQ 13).
+ */
+
+/*
+ * Supported model numbers
+ *
+ * In general, when comparing this.model to "base" model numbers (ie, non-REV numbers), you should use
+ * (this.model|0), which truncates the current model number.
+ *
+ * Note that there were two 5150 motherboard revisions: the "REV A" 16Kb-64Kb motherboard and the
+ * "REV B" 64Kb-256Kb motherboard.  There may have been a manufacturing correlation between motherboard
+ * revisions ("REV A" and "REV B") and the ROM BIOS revisions shown below, but in general, we can't assume
+ * any correlation, because newer ROMs could be installed with either motherboard.
+ *
+ * I do know that, for "REV A" motherboards, the Apr 1984 5150 TechRef says that "To expand the memory
+ * of your system beyond 544K requires your IBM Personal Computer System Unit to have a BIOS ROM module
+ * dated 10/27/82 or later."  Which suggests that SW2[5] was not used until the REV3 5150 ROM BIOS.
+ *
+ * For now, we treat all our MODEL_5150 systems as 16Kb-64Kb motherboards; if you want a 64Kb-256Kb motherboard,
+ * then step up to a MODEL_5160 system.  We use a multiplier of 16 for 5150 LOWMEM values, and a multiplier
+ * of 64 for 5160 LOWMEM values.
+ */
+ChipSet.MODEL_5150              = 5150;     // used in reference to the 1st 5150 ROM BIOS, dated Apr 24, 1981
+ChipSet.MODEL_5150_REV2         = 5150.2;   // used in reference to the 2nd 5150 ROM BIOS, dated Oct 19, 1981
+ChipSet.MODEL_5150_REV3         = 5150.3;   // used in reference to the 3rd 5150 ROM BIOS, dated Oct 27, 1982
+ChipSet.MODEL_5150_OTHER        = 5150.9;
+
+ChipSet.MODEL_5160              = 5160;     // used in reference to the 1st 5160 ROM BIOS, dated Nov 08, 1982
+ChipSet.MODEL_5160_REV2         = 5160.2;   // used in reference to the 1st 5160 ROM BIOS, dated Jan 10, 1986
+ChipSet.MODEL_5160_REV3         = 5160.3;   // used in reference to the 1st 5160 ROM BIOS, dated May 09, 1986
+ChipSet.MODEL_5160_OTHER        = 5160.9;
+
+ChipSet.MODEL_5170              = 5170;     // used in reference to the 1st 5170 ROM BIOS, dated Jan 10, 1984
+ChipSet.MODEL_5170_REV2         = 5170.2;   // used in reference to the 2nd 5170 ROM BIOS, dated Jun 10, 1985
+ChipSet.MODEL_5170_REV3         = 5170.3;   // used in reference to the 3rd 5170 ROM BIOS, dated Nov 15, 1985
+ChipSet.MODEL_5170_OTHER        = 5170.9;
+
+/*
+ * Assorted non-IBM models (we don't put "IBM" in the IBM models, but non-IBM models should include the company name).
+ */
+ChipSet.MODEL_CDP_MPC1600       = 5150.101; // Columbia Data Products MPC 1600 ("Copyright Columbia Data Products 1983, ROM/BIOS Ver 4.34")
+ChipSet.MODEL_COMPAQ_PORTABLE   = 5150.102; // COMPAQ Portable (COMPAQ's first PC)
+
+ChipSet.MODEL_ATT_6300          = 5160.101; // AT&T Personal Computer 6300/Olivetti M24 ("COPYRIGHT (C) OLIVETTI 1984","04/03/86",v1.43)
+ChipSet.MODEL_ZENITH_Z150       = 5160.150; // Zenith Data Systems Z-150 ("08/11/88 (C)ZDS CORP")
+
+ChipSet.MODEL_COMPAQ_DESKPRO386 = 5180;     // COMPAQ DeskPro 386 (COMPAQ's first 80386-based PC); should be > MODEL_5170
+
+/*
+ * Last but not least, a complete list of supported model strings, and corresponding internal model numbers.
+ */
+ChipSet.MODELS = {
+    "5150":         ChipSet.MODEL_5150,
+    "5160":         ChipSet.MODEL_5160,
+    "5170":         ChipSet.MODEL_5170,
+    "att6300":      ChipSet.MODEL_ATT_6300,
+    "mpc1600":      ChipSet.MODEL_CDP_MPC1600,
+    "z150":         ChipSet.MODEL_ZENITH_Z150,
+    "compaq":       ChipSet.MODEL_COMPAQ_PORTABLE,
+    "other":        ChipSet.MODEL_5150_OTHER
+};
+
+if (DESKPRO386) {
+    ChipSet.MODELS["deskpro386"] = ChipSet.MODEL_COMPAQ_DESKPRO386;
+}
+
+ChipSet.CONTROLS = {
+    SW1:    "sw1",
+    SW2:    "sw2",
+    SWDESC: "swdesc"
+};
+
+/*
+ * Values returned by ChipSet.getDIPVideoMonitor()
+ */
+ChipSet.MONITOR = {
+    NONE:               0,
+    TV:                 1,  // Composite monitor (lower resolution; no support)
+    COLOR:              2,  // Color Display (5153)
+    MONO:               3,  // Monochrome Display (5151)
+    EGACOLOR:           4,  // Enhanced Color Display (5154) in High-Res Mode
+    EGAEMULATION:       6,  // Enhanced Color Display (5154) in Emulation Mode
+    VGACOLOR:           7   // VGA Color Display
+};
+
+/*
+ *  8237A DMA Controller (DMAC) I/O ports
+ *
+ *  MODEL_5150 and up uses DMA channel 0 for memory refresh cycles and channel 2 for the FDC.
+ *
+ *  MODEL_5160 and up uses DMA channel 3 for HDC transfers (XTC only).
+ *
+ *  DMA0 refers to the original DMA controller found on all models, and DMA1 refers to the additional
+ *  controller found on MODEL_5170 and up; channel 4 on DMA1 is used to "cascade" channels 0-3 from DMA0,
+ *  so only channels 5-7 are available on DMA1.
+ *
+ *  For FDC DMA notes, refer to http://wiki.osdev.org/ISA_DMA
+ *  For general DMA notes, refer to http://www.freebsd.org/doc/en/books/developers-handbook/dma.html
+ *
+ *  TODO: Determine why the MODEL_5150 ROM BIOS sets the DMA channel 1 page register (port 0x83) to zero.
+ */
+ChipSet.DMA0 = {
+    INDEX:              0,
+    PORT: {
+        CH0_ADDR:       0x00,   // OUT: starting address        IN: current address
+        CH0_COUNT:      0x01,   // OUT: starting word count     IN: remaining word count
+        CH1_ADDR:       0x02,   // OUT: starting address        IN: current address
+        CH1_COUNT:      0x03,   // OUT: starting word count     IN: remaining word count
+        CH2_ADDR:       0x04,   // OUT: starting address        IN: current address
+        CH2_COUNT:      0x05,   // OUT: starting word count     IN: remaining word count
+        CH3_ADDR:       0x06,   // OUT: starting address        IN: current address
+        CH3_COUNT:      0x07,   // OUT: starting word count     IN: remaining word count
+        CMD_STATUS:     0x08,   // OUT: command register        IN: status register
+        REQUEST:        0x09,
+        MASK:           0x0A,
+        MODE:           0x0B,
+        RESET_FF:       0x0C,   // reset flip-flop
+        MASTER_CLEAR:   0x0D,   // OUT: master clear            IN: temporary register
+        MASK_CLEAR:     0x0E,   // TODO: Provide handlers
+        MASK_ALL:       0x0F,   // TODO: Provide handlers
+        CH2_PAGE:       0x81,   // OUT: DMA channel 2 page register
+        CH3_PAGE:       0x82,   // OUT: DMA channel 3 page register
+        CH1_PAGE:       0x83,   // OUT: DMA channel 1 page register
+        CH0_PAGE:       0x87    // OUT: DMA channel 0 page register (unusable; See "The Inside Out" book, p.246)
+    }
+};
+ChipSet.DMA1 = {
+    INDEX:              1,
+    PORT: {
+        CH6_PAGE:       0x89,   // OUT: DMA channel 6 page register (MODEL_5170)
+        CH7_PAGE:       0x8A,   // OUT: DMA channel 7 page register (MODEL_5170)
+        CH5_PAGE:       0x8B,   // OUT: DMA channel 5 page register (MODEL_5170)
+        CH4_PAGE:       0x8F,   // OUT: DMA channel 4 page register (MODEL_5170; unusable; aka "Refresh" page register?)
+        CH4_ADDR:       0xC0,   // OUT: starting address        IN: current address
+        CH4_COUNT:      0xC2,   // OUT: starting word count     IN: remaining word count
+        CH5_ADDR:       0xC4,   // OUT: starting address        IN: current address
+        CH5_COUNT:      0xC6,   // OUT: starting word count     IN: remaining word count
+        CH6_ADDR:       0xC8,   // OUT: starting address        IN: current address
+        CH6_COUNT:      0xCA,   // OUT: starting word count     IN: remaining word count
+        CH7_ADDR:       0xCC,   // OUT: starting address        IN: current address
+        CH7_COUNT:      0xCE,   // OUT: starting word count     IN: remaining word count
+        CMD_STATUS:     0xD0,   // OUT: command register        IN: status register
+        REQUEST:        0xD2,
+        MASK:           0xD4,
+        MODE:           0xD6,
+        RESET_FF:       0xD8,   // reset flip-flop
+        MASTER_CLEAR:   0xDA,   // master clear
+        MASK_CLEAR:     0xDC,   // TODO: Provide handlers
+        MASK_ALL:       0xDE    // TODO: Provide handlers
+    }
+};
+
+ChipSet.DMA_CMD = {
+    M2M_ENABLE:         0x01,
+    CH0HOLD_ENABLE:     0x02,
+    CTRL_DISABLE:       0x04,
+    COMP_TIMING:        0x08,
+    ROT_PRIORITY:       0x10,
+    EXT_WRITE_SEL:      0x20,
+    DREQ_ACTIVE_LO:     0x40,
+    DACK_ACTIVE_HI:     0x80
+};
+
+ChipSet.DMA_STATUS = {
+    CH0_TC:             0x01,   // Channel 0 has reached Terminal Count (TC)
+    CH1_TC:             0x02,   // Channel 1 has reached Terminal Count (TC)
+    CH2_TC:             0x04,   // Channel 2 has reached Terminal Count (TC)
+    CH3_TC:             0x08,   // Channel 3 has reached Terminal Count (TC)
+    ALL_TC:             0x0f,   // all TC bits are cleared whenever DMA_STATUS is read
+    CH0_REQ:            0x10,   // Channel 0 DMA requested
+    CH1_REQ:            0x20,   // Channel 1 DMA requested
+    CH2_REQ:            0x40,   // Channel 2 DMA requested
+    CH3_REQ:            0x80    // Channel 3 DMA requested
+};
+
+ChipSet.DMA_MASK = {
+    CHANNEL:            0x03,
+    CHANNEL_SET:        0x04
+};
+
+ChipSet.DMA_MODE = {
+    CHANNEL:            0x03,   // bits 0-1 select 1 of 4 possible channels
+    TYPE:               0x0C,   // bits 2-3 select 1 of 3 valid (4 possible) transfer types
+    TYPE_VERIFY:        0x00,   // pseudo transfer (generates addresses, responds to EOP, but nothing is moved)
+    TYPE_WRITE:         0x04,   // write to memory (move data FROM an I/O device; eg, reading a sector from a disk)
+    TYPE_READ:          0x08,   // read from memory (move data TO an I/O device; eg, writing a sector to a disk)
+    AUTOINIT:           0x10,
+    DECREMENT:          0x20,   // clear for INCREMENT
+    MODE:               0xC0,   // bits 6-7 select 1 of 4 possible transfer modes
+    MODE_DEMAND:        0x00,
+    MODE_SINGLE:        0x40,
+    MODE_BLOCK:         0x80,
+    MODE_CASCADE:       0xC0
+};
+
+ChipSet.DMA_REFRESH   = 0x00;   // DMA channel assigned to memory refresh
+ChipSet.DMA_FDC       = 0x02;   // DMA channel assigned to the Floppy Drive Controller (FDC)
+ChipSet.DMA_HDC       = 0x03;   // DMA channel assigned to the Hard Drive Controller (HDC; XTC only)
+
+/*
+ * 8259A Programmable Interrupt Controller (PIC) I/O ports
+ *
+ * Internal registers:
+ *
+ *      ICW1    Initialization Command Word 1 (sent to port ChipSet.PIC_LO)
+ *      ICW2    Initialization Command Word 2 (sent to port ChipSet.PIC_HI)
+ *      ICW3    Initialization Command Word 3 (sent to port ChipSet.PIC_HI)
+ *      ICW4    Initialization Command Word 4 (sent to port ChipSet.PIC_HI)
+ *      IMR     Interrupt Mask Register
+ *      IRR     Interrupt Request Register
+ *      ISR     Interrupt Service Register
+ *      IRLow   (IR having lowest priority; IR+1 will have highest priority; default is 7)
+ *
+ * Note that ICW2 effectively contains the starting IDT vector number (ie, for IRQ 0),
+ * which must be multiplied by 4 to calculate the vector offset, since every vector is 4 bytes long.
+ *
+ * Also, since the low 3 bits of ICW2 are ignored in 8086/8088 mode (ie, they are effectively
+ * treated as zeros), this means that the starting IDT vector can only be a multiple of 8.
+ *
+ * So, if ICW2 is set to 0x08, the starting vector number (ie, for IRQ 0) will be 0x08, and the
+ * 4-byte address for the corresponding ISR will be located at offset 0x20 in the real-mode IDT.
+ *
+ * ICW4 is typically set to 0x09, indicating 8086 mode, non-automatic EOI, buffered/slave mode.
+ *
+ * TODO: Determine why the original ROM BIOS chose buffered/slave over buffered/master.
+ * Did it simply not matter in pre-AT systems with only one PIC, or am I misreading something?
+ *
+ * TODO: Consider support for level-triggered PIC interrupts, even though the original IBM PCs
+ * (up through MODEL_5170) used only edge-triggered interrupts.
+ */
+ChipSet.PIC0 = {                // all models: the "master" PIC
+    INDEX:              0,
+    PORT_LO:            0x20,
+    PORT_HI:            0x21
+};
+
+ChipSet.PIC1 = {                // MODEL_5170 and up: the "slave" PIC
+    INDEX:              1,
+    PORT_LO:            0xA0,
+    PORT_HI:            0xA1
+};
+
+ChipSet.PIC_LO = {              // ChipSet.PIC1.PORT_LO or ChipSet.PIC2.PORT_LO
+    ICW1:               0x10,   // set means ICW1
+    ICW1_ICW4:          0x01,   // ICW4 needed (otherwise ICW4 must be sent)
+    ICW1_SNGL:          0x02,   // single PIC (and therefore no ICW3; otherwise there is another "cascaded" PIC)
+    ICW1_ADI:           0x04,   // call address interval is 4 (otherwise 8; presumably ignored in 8086/8088 mode)
+    ICW1_LTIM:          0x08,   // level-triggered interrupt mode (otherwise edge-triggered mode, which is what PCs use)
+    OCW2:               0x00,   // bit 3 (PIC_LO.OCW3) and bit 4 (ChipSet.PIC_LO.ICW1) are clear in an OCW2 command byte
+    OCW2_IR_LVL:        0x07,
+    OCW2_OP_MASK:       0xE0,   // of the following valid OCW2 operations, the first 4 are EOI commands (all have ChipSet.PIC_LO.OCW2_EOI set)
+    OCW2_EOI:           0x20,   // non-specific EOI (end-of-interrupt)
+    OCW2_EOI_SPEC:      0x60,   // specific EOI
+    OCW2_EOI_ROT:       0xA0,   // rotate on non-specific EOI
+    OCW2_EOI_ROTSPEC:   0xE0,   // rotate on specific EOI
+    OCW2_SET_ROTAUTO:   0x80,   // set rotate in automatic EOI mode
+    OCW2_CLR_ROTAUTO:   0x00,   // clear rotate in automatic EOI mode
+    OCW2_SET_PRI:       0xC0,   // bits 0-2 specify the lowest priority interrupt
+    OCW3:               0x08,   // bit 3 (PIC_LO.OCW3) is set and bit 4 (PIC_LO.ICW1) clear in an OCW3 command byte (bit 7 should be clear, too)
+    OCW3_READ_IRR:      0x02,   // read IRR register
+    OCW3_READ_ISR:      0x03,   // read ISR register
+    OCW3_READ_CMD:      0x03,
+    OCW3_POLL_CMD:      0x04,   // poll
+    OCW3_SMM_RESET:     0x40,   // special mask mode: reset
+    OCW3_SMM_SET:       0x60,   // special mask mode: set
+    OCW3_SMM_CMD:       0x60
+};
+
+ChipSet.PIC_HI = {              // ChipSet.PIC1.PORT_HI or ChipSet.PIC2.PORT_HI
+    ICW2_VECTOR:        0xF8,   // starting vector number (bits 0-2 are effectively treated as zeros in 8086/8088 mode)
+    ICW4_8086:          0x01,
+    ICW4_AUTO_EOI:      0x02,
+    ICW4_MASTER:        0x04,
+    ICW4_BUFFERED:      0x08,
+    ICW4_FULLY_NESTED:  0x10,
+    OCW1_IMR:           0xFF
+};
+
+/*
+ * The priorities of IRQs 0-7 are normally high to low, unless the master PIC has been reprogrammed.
+ * Also, if a slave PIC is present, the priorities of IRQs 8-15 fall between the priorities of IRQs 1 and 3.
+ *
+ * As the MODEL_5170 TechRef states:
+ *
+ *      "Interrupt requests are prioritized, with IRQ9 through IRQ12 and IRQ14 through IRQ15 having the
+ *      highest priority (IRQ9 is the highest) and IRQ3 through IRQ7 having the lowest priority (IRQ7 is
+ *      the lowest).
+ *
+ *      Interrupt 13 (IRQ.FPU) is used on the system board and is not available on the I/O channel.
+ *      Interrupt 8 (IRQ.RTC) is used for the real-time clock."
+ *
+ * This priority scheme is a byproduct of IRQ8 through IRQ15 (slave PIC interrupts) being tied to IRQ2 of
+ * the master PIC.  As a result, the two other system board interrupts, IRQ0 and IRQ1, continue to have the
+ * highest priority, by default.
+ */
+ChipSet.IRQ = {
+    TIMER0:             0x00,
+    KBD:                0x01,
+    SLAVE:              0x02,   // MODEL_5170
+    COM2:               0x03,
+    COM1:               0x04,
+    XTC:                0x05,   // MODEL_5160 uses IRQ 5 for HDC (XTC version)
+    LPT2:               0x05,   // MODEL_5170 uses IRQ 5 for LPT2
+    FDC:                0x06,
+    LPT1:               0x07,
+    RTC:                0x08,   // MODEL_5170
+    IRQ2:               0x09,   // MODEL_5170
+    FPU:                0x0D,   // MODEL_5170
+    ATC:                0x0E    // MODEL_5170 uses IRQ 14 for HDC (ATC version)
+};
+
+/*
+ * 8253 Programmable Interval Timer (PIT) I/O ports
+ *
+ * Although technically, a PIT provides 3 "counters" rather than 3 "timers", we have
+ * adopted IBM's TechRef nomenclature, which refers to the PIT's counters as TIMER0,
+ * TIMER1, and TIMER2.  For machines with a second PIT (eg, the DeskPro 386), we refer
+ * to those additional counters as TIMER3, TIMER4, and TIMER5.
+ *
+ * In addition, if there's a need to refer to a specific PIT, use PIT0 for the first PIT
+ * and PIT1 for the second.  This mirrors how we refer to multiple DMA controllers
+ * (eg, DMA0 and DMA1) and multiple PICs (eg, PIC0 and PIC1).
+ *
+ * This differs from COMPAQ's nomenclature, which used "Timer 1" to refer to the first
+ * PIT, and "Timer 2" for the second PIT, and then referred to "Counter 0", "Counter 1",
+ * and "Counter 2" within each PIT.
+ */
+ChipSet.PIT0 = {
+    PORT:               0x40,
+    INDEX:              0,
+    TIMER0:             0,      // used for time-of-day (prior to MODEL_5170)
+    TIMER1:             1,      // used for memory refresh
+    TIMER2:             2       // used for speaker tone generation
+};
+
+ChipSet.PIT1 = {
+    PORT:               0x48,   // MODEL_COMPAQ_DESKPRO386 only
+    INDEX:              1,
+    TIMER3:             0,      // used for fail-safe clock
+    TIMER4:             1,      // N/A
+    TIMER5:             2       // used for refresher request extend/speed control
+};
+
+ChipSet.PIT_CTRL = {
+    PORT1:              0x43,   // write-only control register (use the Read-Back command to get status)
+    PORT2:              0x4B,   // write-only control register (use the Read-Back command to get status)
+    BCD:                0x01,
+    MODE:               0x0E,
+    MODE0:              0x00,   // interrupt on Terminal Count (TC)
+    MODE1:              0x02,   // programmable one-shot
+    MODE2:              0x04,   // rate generator
+    MODE3:              0x06,   // square wave generator
+    MODE4:              0x08,   // software-triggered strobe
+    MODE5:              0x0A,   // hardware-triggered strobe
+    RW:                 0x30,
+    RW_LATCH:           0x00,
+    RW_LSB:             0x10,
+    RW_MSB:             0x20,
+    RW_BOTH:            0x30,
+    SC:                 0xC0,
+    SC_CTR0:            0x00,
+    SC_CTR1:            0x40,
+    SC_CTR2:            0x80,
+    SC_BACK:            0xC0,
+    SC_SHIFT:           6,
+    RB_CTR0:            0x02,
+    RB_CTR1:            0x04,
+    RB_CTR2:            0x08,
+    RB_STATUS:          0x10,   // if this bit is CLEAR, then latch the current status of the selected counter(s)
+    RB_COUNTS:          0x20,   // if this bit is CLEAR, then latch the current count(s) of the selected counter(s)
+    RB_NULL:            0x40,   // bit set in Read-Back status byte if the counter has not been "fully loaded" yet
+    RB_OUT:             0x80    // bit set in Read-Back status byte if fOUT is true
+};
+
+ChipSet.TIMER_TICKS_PER_SEC = 1193181;
+
+/*
+ * 8255A Programmable Peripheral Interface (PPI) I/O ports, for Cassette/Speaker/Keyboard/SW1/etc
+ *
+ * Normally, 0x99 is written to PPI_CTRL.PORT, indicating that PPI_A.PORT and PPI_C.PORT are INPUT ports
+ * and PPI_B.PORT is an OUTPUT port.
+ *
+ * However, the MODEL_5160 ROM BIOS initially writes 0x89 instead, making PPI_A.PORT an OUTPUT port.
+ * I'm guessing that's just part of some "diagnostic mode", because all it writes to PPI_A.PORT are a series
+ * of "checkpoint" values (ie, 0x01, 0x02, and 0x03) before updating PPI_CTRL.PORT with the usual 0x99.
+ */
+ChipSet.PPI_A = {               // this.bPPIA (port 0x60)
+    PORT:               0x60    // INPUT: keyboard scan code (PPI_B.CLEAR_KBD must be clear)
+};
+
+ChipSet.PPI_B = {               // this.bPPIB (port 0x61)
+    PORT:               0x61,   // OUTPUT (although it has to be treated as INPUT, too; the keyboard interrupt handler reads it, OR's PPI_B.CLEAR_KBD, writes it, and then rewrites the original read value)
+    CLK_TIMER2:         0x01,   // ALL: set to enable clock to TIMER2
+    SPK_TIMER2:         0x02,   // ALL: set to connect output of TIMER2 to speaker (MODEL_5150: clear for cassette)
+    ENABLE_SW2:         0x04,   // MODEL_5150: set to enable SW2[1-4] through PPI_C.PORT, clear to enable SW2[5]; MODEL_5160: unused (there is no SW2 switch block on the MODEL_5160 motherboard)
+    CASS_MOTOR_OFF:     0x08,   // MODEL_5150: cassette motor off
+    ENABLE_SW_HI:       0x08,   // MODEL_5160: clear to read SW1[1-4], set to read SW1[5-8]
+    DISABLE_RW_MEM:     0x10,   // ALL: clear to enable RAM parity check, set to disable
+    DISABLE_IO_CHK:     0x20,   // ALL: clear to enable I/O channel check, set to disable
+    CLK_KBD:            0x40,   // ALL: clear to force keyboard clock low
+    CLEAR_KBD:          0x80    // ALL: clear to enable keyboard scan codes (MODEL_5150: set to enable SW1 through PPI_A.PORT)
+};
+
+ChipSet.PPI_C = {               // this.bPPIC (port 0x62)
+    PORT:               0x62,   // INPUT (see below)
+    SW:                 0x0F,   // MODEL_5150: SW2[1-4] or SW2[5], depending on whether PPI_B.ENABLE_SW2 is set or clear; MODEL_5160: SW1[1-4] or SW1[5-8], depending on whether PPI_B.ENABLE_SW_HI is clear or set
+    CASS_DATA_IN:       0x10,
+    TIMER2_OUT:         0x20,
+    IO_CHANNEL_CHK:     0x40,   // used by NMI handler to detect I/O channel errors
+    RW_PARITY_CHK:      0x80    // used by NMI handler to detect R/W memory parity errors
+};
+
+ChipSet.PPI_CTRL = {            // this.bPPICtrl (port 0x63)
+    PORT:               0x63,   // OUTPUT: initialized to 0x99, defining PPI_A and PPI_C as INPUT and PPI_B as OUTPUT
+    A_IN:               0x10,
+    B_IN:               0x02,
+    C_IN_LO:            0x01,
+    C_IN_HI:            0x08,
+    B_MODE:             0x04,
+    A_MODE:             0x60
+};
+
+/*
+ * Switches Overview
+ * -----------------
+ *
+ * The conventions used for the sw1 and sw2 strings are that the left-most character represents DIP switch [1],
+ * the right-most character represents DIP switch [8], and "1" means the DIP switch is ON and "0" means it is OFF.
+ *
+ * Internally, we convert the above strings into binary values that the 8255A PPI returns, where DIP switch [1]
+ * is bit 0 and DIP switch [8] is bit 7, and 0 indicates the switch is ON and 1 indicates it is OFF.
+ *
+ * For reference, here's how the SW1 and SW2 switches correspond to the internal 8255A PPI bit values:
+ *
+ *      SW1[1]    (bit 0)     "0xxxxxxx" (1):  IPL,  "1xxxxxxx" (0):  No IPL
+ *      SW1[2]    (bit 1)     reserved on the 5150; OFF (1) if FPU installed in a 5160
+ *      SW1[3,4]  (bits 3-2)  "xx11xxxx" (00): 16Kb, "xx01xxxx" (10): 32Kb,  "xx10xxxx" (01): 48Kb,  "xx00xxxx" (11): 64Kb
+ *      SW1[5,6]  (bits 5-4)  "xxxx11xx" (00): none, "xxxx01xx" (10): tv,    "xxxx10xx" (01): color, "xxxx00xx" (11): mono
+ *      SW1[7,8]  (bits 7-6)  "xxxxxx11" (00): 1 FD, "xxxxxx01" (10): 2 FD,  "xxxxxx10" (01): 3 FD,  "xxxxxx00" (11): 4 FD
+ *
+ * Note: FD refers to floppy drive, and IPL refers to an "Initial Program Load" floppy drive.
+ *
+ *      SW2[1-5]    (bits 4-0)  "NNNxxxxx": number of 32Kb blocks of I/O expansion RAM present
+ *
+ * For example, sw1="01110011" indicates that all SW1 DIP switches are ON, except for SW1[1], SW1[5] and SW1[6],
+ * which are OFF.  Internally, the order of these bits must reversed (to 11001110) and then inverted (to 00110001)
+ * to yield the value that the 8255A PPI returns.  Reading the final value right-to-left, 00110001 indicates an
+ * IPL floppy drive, 1X of RAM (where X is 16Kb on a MODEL_5150 and 64Kb on a MODEL_5160), MDA, and 1 floppy drive.
+ *
+ * WARNING: It is possible to set SW1 to indicate more memory than the RAM component has been configured to provide.
+ * This is a configuration error which will cause the machine to crash after reporting a "201" error code (memory
+ * test failure), which is presumably what a real machine would do if it was similarly misconfigured.  Surprisingly,
+ * the BIOS forges ahead, setting SP to the top of the memory range indicated by SW1 (via INT 0x12), but the lack of
+ * a valid stack causes the system to crash after the next IRET.  The BIOS should have either halted or modified
+ * the actual memory size to match the results of the memory test.
+ *
+ * MODEL 5150 Switches
+ * -------------------
+ *
+ * PPI_SW bits are exposed via port PPI_A.
+ *
+ * MODEL 5160 Switches
+ * ------------------------
+ *
+ * PPI_SW bits 0-3 are exposed via PPI_C.SW if PPI_B.ENABLE_SW_HI is clear; bits 4-7 if PPI_B.ENABLE_SW_HI is set.
+ *
+ * AT&T 6300 Switches
+ * ------------------
+ *
+ * Based on ATT_PC_6300_Service_Manual.pdf, there are two 8-switch blocks, DIPSW-0 and DIPSW-1, where:
+ *
+ *      DIPSW-0[1-4] Total RAM
+ *      DIPSW-0[5] - ON if 8087 not installed, OFF if installed
+ *      DIPSW-0[6] - ON if 8250 ACE serial interface present, OFF if Z-8530 SCC interface present
+ *      DIPSW-0[7] - Not used
+ *      DIPSW-0[8] - Type of EPROM chip for ROM 1.21 or lower, or presence of RAM in bank 1 for ROM 1.43 or higher
+ *
+ * and:
+ *
+ *      DIPSW-1[1] - Floppy Type (ON for 48TPI, OFF for 96TPI)
+ *      DIPSW-1[2] - Floppy Speed (ON for slow startup, OFF for fast startup)
+ *      DIPSW-1[3] - HDU ROM (ON for indigenous, OFF for external)
+ *      DIPSW-1[4] - Not used (ROM 1.21 or lower) or Scroll Speed (ROM 1.43 or higher: ON for fast, OFF for slow)
+ *      DIPSW-1[5-6] - Display Type (11=EGA or none, 01=color 40x25, 10=color 80x25, 00=monochrome 80x25)
+ *      DIPSW-1[7-8] - Number of Floppy Drives (11=one, 01=two, 10=three, 00=four)
+ *
+ * For AT&T 6300 ROM 1.43 and up, DIPSW-0 supports the following RAM combinations:
+ *
+ *      0111xxx1: 128Kb on motherboard
+ *      1011xxx0: 256Kb on motherboard
+ *      1101xxx0: 256Kb on motherboard, 256Kb on expansion board (512Kb total)
+ *      1110xxx1: 512Kb on motherboard
+ *      0101xxx0: 256Kb on motherboard, 384Kb on expansion board (640Kb total)
+ *      0100xxx0: 640Kb on motherboard (128Kb bank 0, 512Kb bank 1)
+ *      0110xxx0: 640Kb on motherboard (512Kb bank 0, 128Kb bank 1)
+ *
+ * Inspection of the AT&T 6300 Plus ROM BIOS reveals that DIPSW-0[1-8] are obtained from bits 0-7
+ * of port 0x66 ("sys_conf_a") and DIPSW-1[1-8] are obtained from bits 0-7 of port 0x67 ("sys_conf_b").
+ */
+
+ChipSet.PPI_SW = {
+    FDRIVE: {
+        IPL:            0x01,   // MODEL_5150: IPL ("Initial Program Load") floppy drive attached; MODEL_5160: "Loop on POST"
+        ONE:            0x00,   // 1 floppy drive attached (or 0 drives if PPI_SW.FDRIVE_IPL is not set -- MODEL_5150 only)
+        TWO:            0x40,   // 2 floppy drives attached
+        THREE:          0x80,   // 3 floppy drives attached
+        FOUR:           0xC0,   // 4 floppy drives attached
+        MASK:           0xC0,
+        SHIFT:          6
+    },
+    FPU:                0x02,   // MODEL_5150: reserved; MODEL_5160: FPU coprocessor installed
+    MEMORY: {                   // MODEL_5150: "X" is 16Kb; MODEL_5160: "X" is 64Kb
+        X1:             0x00,   // 16Kb or 64Kb
+        X2:             0x04,   // 32Kb or 128Kb
+        X3:             0x08,   // 48Kb or 192Kb
+        X4:             0x0C,   // 64Kb or 256Kb
+        MASK:           0x0C,
+        SHIFT:          2
+    },
+    MONITOR: {
+        TV:             0x10,
+        COLOR:          0x20,
+        MONO:           0x30,
+        MASK:           0x30,
+        SHIFT:          4
+    }
+};
+
+/*
+ * Some models have completely different DIP switch implementations from the MODEL_5150, which, being
+ * the first IBM PC, was the model that we, um, modeled our DIP switch support on.  So, to support other
+ * implementations, we now get and set DIP switch values according to SWITCH_TYPE, and rely on the
+ * tables that follow to define which DIP switch(es) correspond to each SWITCH_TYPE.
+ *
+ * Not every model needs its own tables.  The getDIPSwitches() and setDIPSwitches() functions look first
+ * for an *exact* model match, then a "truncated" model match, and failing that, they fall back to the
+ * MODEL_5150 switch definitions.
+ */
+ChipSet.SWITCH_TYPE = {
+    FLOPNUM:    1,
+    FLOPTYPE:   2,
+    FPU:        3,
+    MONITOR:    4,
+    LOWMEM:     5,
+    EXPMEM:     6
+};
+
+ChipSet.DIPSW = {};
+ChipSet.DIPSW[ChipSet.MODEL_5150] = [{},{}];
+ChipSet.DIPSW[ChipSet.MODEL_5150][0][ChipSet.SWITCH_TYPE.FLOPNUM] = {
+    MASK:       0xC0,
+    VALUES: {
+        1:      0x00,
+        2:      0x40,
+        3:      0x80,
+        4:      0xC0
+    },
+    LABEL: "Number of Floppy Drives"
+};
+/*
+ * NOTE: Both the Aug 1981 and the Apr 1984 IBM 5150 Technical Reference Manuals list SW1[2] as "RESERVED",
+ * but the Aug 1981 edition (p. 2-28) also says SW1[2] "MUST BE ON (RESERVED FOR CO-PROCESSOR)".  Contemporary
+ * articles discussing 8087 support in early PCs all indicate that switch SW1[2] must OFF if a coprocessor
+ * is installed, and the 1984 5150 Guide to Operations (p. 5-34) confirms it.
+ *
+ * The Aug 1981 5150 TechRef makes no further mention of coprocessor support, whereas the Apr 1984 5150 TechRef
+ * discusses it in a fair bit of detail, including the fact that 8087 exceptions generate an NMI, despite Intel's
+ * warning in their iAPX 86,88 User's Manual, p. S-27, that "[t]he 8087 should not be tied to the CPU's NMI
+ * (non-maskable interrupt) line.")
+ */
+ChipSet.DIPSW[ChipSet.MODEL_5150][0][ChipSet.SWITCH_TYPE.FPU] = {
+    MASK:       0x02,
+    VALUES: {
+        0:      0x00,   // 0 means an FPU is NOT installed
+        1:      0x02    // 1 means an FPU is installed
+    },
+    LABEL: "FPU"
+};
+ChipSet.DIPSW[ChipSet.MODEL_5150][0][ChipSet.SWITCH_TYPE.MONITOR] = {
+    MASK:       0x30,
+    VALUES: {
+        0:      0x00,
+        1:      0x10,
+        2:      0x20,
+        3:      0x30,
+        "none": 0x00,
+        "tv":   0x10,   // aka composite
+        "color":0x20,
+        "cga":  0x20,   // alias for color
+        "mda":  0x30,   // alias for mono
+        "mono": 0x30,
+        "ega":  0x00,
+        "vga":  0x00
+    },
+    LABEL: "Monitor Type"
+};
+ChipSet.DIPSW[ChipSet.MODEL_5150][0][ChipSet.SWITCH_TYPE.LOWMEM] = {
+    MASK:       0x0C,
+    VALUES: {
+        16:     0x00,
+        32:     0x04,
+        48:     0x08,
+        64:     0x0C
+    },
+    LABEL: "Base Memory (16Kb Increments)"
+};
+ChipSet.DIPSW[ChipSet.MODEL_5150][1][ChipSet.SWITCH_TYPE.EXPMEM] = {
+    MASK:       0x1F,   // technically, this mask should be 0x0F for ROM revisions prior to 5150_REV3, and 0x1F on 5150_REV3
+    VALUES: {
+        0:      0x00,
+        32:     0x01,
+        64:     0x02,
+        96:     0x03,
+        128:    0x04,
+        160:    0x05,
+        192:    0x06,
+        224:    0x07,
+        256:    0x08,
+        288:    0x09,
+        320:    0x0A,
+        352:    0x0B,
+        384:    0x0C,
+        416:    0x0D,
+        448:    0x0E,
+        480:    0x0F,
+        512:    0x10,
+        544:    0x11,
+        576:    0x12
+        /*
+         * Obviously, more bit combinations are possible here (up to 0x1F), but assuming a minimum of 64Kb already on
+         * the motherboard, any amount of expansion memory above 576Kb would break the 640Kb barrier.  Yes, if you used
+         * only MDA or CGA video cards, you could go as high as 704Kb in a real system.  But in our happy little world,
+         * this is where we stop.
+         *
+         * TODO: A value larger than 0x12 usually comes from a misconfigured machine (ie, it forgot to leave SW2[5] ON).
+         * To compensate, when getDIPMemorySize() gets null back from its EXPMEM request, perhaps it should try truncating
+         * the DIP switch value.  However, that would introduce a machine-specific hack into a function that's supposed
+         * be machine-independent now.
+         */
+    },
+    LABEL: "Expansion Memory (32Kb Increments)"
+};
+
+ChipSet.DIPSW[ChipSet.MODEL_5160] = [{},{}];
+ChipSet.DIPSW[ChipSet.MODEL_5160][0][ChipSet.SWITCH_TYPE.FLOPNUM] = ChipSet.DIPSW[ChipSet.MODEL_5150][0][ChipSet.SWITCH_TYPE.FLOPNUM];
+ChipSet.DIPSW[ChipSet.MODEL_5160][0][ChipSet.SWITCH_TYPE.FPU]     = ChipSet.DIPSW[ChipSet.MODEL_5150][0][ChipSet.SWITCH_TYPE.FPU];
+ChipSet.DIPSW[ChipSet.MODEL_5160][0][ChipSet.SWITCH_TYPE.MONITOR] = ChipSet.DIPSW[ChipSet.MODEL_5150][0][ChipSet.SWITCH_TYPE.MONITOR];
+ChipSet.DIPSW[ChipSet.MODEL_5160][0][ChipSet.SWITCH_TYPE.LOWMEM]  = {
+    MASK:       0x0C,
+    VALUES: {
+        64:     0x00,
+        128:    0x04,
+        192:    0x08,
+        256:    0x0C
+    },
+    LABEL: "Base Memory (64Kb Increments)"
+};
+ChipSet.DIPSW[ChipSet.MODEL_5160][1][ChipSet.SWITCH_TYPE.EXPMEM]  = ChipSet.DIPSW[ChipSet.MODEL_5150][1][ChipSet.SWITCH_TYPE.EXPMEM];
+
+ChipSet.DIPSW[ChipSet.MODEL_ATT_6300] = [{},{}];
+ChipSet.DIPSW[ChipSet.MODEL_ATT_6300][0][ChipSet.SWITCH_TYPE.LOWMEM] = {
+    MASK:       0x8F,
+    VALUES: {
+        128:    0x01,   // "0111xxx1"
+        256:    0x82,   // "1011xxx0"
+        512:    0x08,   // "1110xxx1"
+        640:    0x8D    // "0100xxx0"
+    },
+    LABEL: "Base Memory (128Kb Increments)"
+};
+ChipSet.DIPSW[ChipSet.MODEL_ATT_6300][0][ChipSet.SWITCH_TYPE.FPU] = {
+    MASK:       0x10,
+    VALUES: {
+        0:      0x00,
+        1:      0x10
+    },
+    LABEL: "FPU"
+};
+ChipSet.DIPSW[ChipSet.MODEL_ATT_6300][1][ChipSet.SWITCH_TYPE.FLOPTYPE] = {
+    MASK:       0x01,
+    VALUES: {
+        0:      0x00,
+        1:      0x01
+    },
+    LABEL: "Floppy Type"
+};
+ChipSet.DIPSW[ChipSet.MODEL_ATT_6300][1][ChipSet.SWITCH_TYPE.FLOPNUM] = ChipSet.DIPSW[ChipSet.MODEL_5150][0][ChipSet.SWITCH_TYPE.FLOPNUM];
+ChipSet.DIPSW[ChipSet.MODEL_ATT_6300][1][ChipSet.SWITCH_TYPE.MONITOR] = ChipSet.DIPSW[ChipSet.MODEL_5150][0][ChipSet.SWITCH_TYPE.MONITOR];
+
+/*
+ * 8041 Keyboard Controller I/O ports (MODEL_ATT_6300)
+ *
+ * The AT&T 6300 uses an 8041 for its Keyboard Controller, which has the following ports:
+ *
+ *      Port    Description
+ *      ----    -----------
+ *      0x60    Keyboard Scan Code (input)
+ *      0x61    Keyboard Control Port (output)
+ *      0x64    Keyboard Status Port (input)
+ *
+ * And the Keyboard Control Port (0x61) has the following bit definitions:
+ *
+ *      0x01    Speaker gate to 8253 (counter 2)
+ *      0x02    Speaker data
+ *      0x0C    Not used
+ *      0x10    RAM Parity (NMI) Enable
+ *      0x20    I/O Channel (NMI) Enable
+ *      0x40    Keyboard Clock Reset
+ *      0x80    Reset Interrupt Pending
+ */
+
+/*
+ * 8042 Keyboard Controller I/O ports (MODEL_5170)
+ *
+ * On the MODEL_5170, port 0x60 is designated KC8042.DATA rather than PPI_A, although the BIOS also refers to it
+ * as "PORT_A: 8042 KEYBOARD SCAN/DIAG OUTPUTS").  This is the 8042's output buffer and should be read only when
+ * KC8042.STATUS.OUTBUFF_FULL is set.
+ *
+ * Similarly, port 0x61 is designated KC8042.RWREG rather than PPI_B; the BIOS also refers to it as "PORT_B: 8042
+ * READ WRITE REGISTER", but it is not otherwise discussed in the MODEL_5170 TechRef's 8042 documentation.
+ *
+ * There are brief references to bits 0 and 1 (KC8042.RWREG.CLK_TIMER2 and KC8042.RWREG.SPK_TIMER2), and the BIOS sets
+ * bits 2-7 to "DISABLE PARITY CHECKERS" (principally KC8042.RWREG.DISABLE_NMI, which are bits 2 and 3); why the BIOS
+ * also sets bits 4-7 (or if those bits are even settable) is unclear, since it uses 11111100b rather than defined
+ * constants.
+ *
+ * The bottom line: on a MODEL_5170, port 0x61 is still used for speaker control and parity checking, so we use
+ * the same register (bPPIB) but install different I/O handlers.  It's also bi-directional: at one point, the BIOS
+ * reads KC8042.RWREG.REFRESH_BIT (bit 4) to verify that it's alternating.
+ *
+ * PPI_C and PPI_CTRL don't seem to be documented or used by the MODEL_5170 BIOS, so I'm assuming they're obsolete.
+ *
+ * NOTE: For more information on the 8042 Controller, including information on undocumented commands, refer to the
+ * documents in /devices/pc/keyboard, as well as the following websites:
+ *
+ *      http://halicery.com/8042/8042_INTERN_TXT.htm
+ *      http://www.os2museum.com/wp/ibm-pcat-8042-keyboard-controller-commands/
+ */
+ChipSet.KC8042 = {
+    DATA: {                     // this.b8042OutBuff (PPI_A on previous models, still referred to as "PORT A" by the MODEL_5170 BIOS)
+        PORT:           0x60,
+        CMD: {                  // this.b8042CmdData (KC8042.DATA.CMD "data bytes" written to port 0x60, after writing a KC8042.CMD byte to port 0x64)
+            INT_ENABLE: 0x01,   // generate an interrupt when the controller places data in the output buffer
+            SYS_FLAG:   0x04,   // this value is propagated to ChipSet.KC8042.STATUS.SYS_FLAG
+            NO_INHIBIT: 0x08,   // disable inhibit function
+            NO_CLOCK:   0x10,   // disable keyboard by driving "clock" line low
+            PC_MODE:    0x20,
+            PC_COMPAT:  0x40    // generate IBM PC-compatible scan codes
+        },
+        SELF_TEST: {            // result of ChipSet.KC8042.CMD.SELF_TEST command (0xAA)
+            OK:         0x55
+        },
+        INTF_TEST: {            // result of ChipSet.KC8042.CMD.INTF_TEST command (0xAB)
+            OK:         0x00,   // no error
+            CLOCK_LO:   0x01,   // keyboard clock line stuck low
+            CLOCK_HI:   0x02,   // keyboard clock line stuck high
+            DATA_LO:    0x03,   // keyboard data line stuck low
+            DATA_HI:    0x04    // keyboard data line stuck high
+        }
+    },
+    INPORT: {                   // this.b8042InPort
+        COMPAQ_50MHZ:   0x01,   // 50Mhz system clock enabled (0=48Mhz); see COMPAQ 386/25 TechRef p2-106
+        UNDEFINED:      0x02,   // undefined
+        COMPAQ_NO80387: 0x04,   // 80387 coprocessor NOT installed; see COMPAQ 386/25 TechRef p2-106
+        COMPAQ_NOWEITEK:0x08,   // Weitek coprocessor NOT installed; see COMPAQ 386/25 TechRef p2-106
+        ENABLE_256KB:   0x10,   // enable 2nd 256Kb of system board RAM
+        COMPAQ_HISPEED: 0x10,   // high-speed enabled (0=auto); see COMPAQ 386/25 TechRef p2-106
+        MFG_OFF:        0x20,   // manufacturing jumper not installed
+        COMPAQ_DIP5OFF: 0x20,   // system board DIP switch #5 OFF (0=ON); see COMPAQ 386/25 TechRef p2-106
+        MONO:           0x40,   // monochrome monitor is primary display
+        COMPAQ_NONDUAL: 0x40,   // COMPAQ Dual-Mode monitor NOT installed; see COMPAQ 386/25 TechRef p2-106
+        KBD_UNLOCKED:   0x80    // keyboard not inhibited (in COMPAQ parlance: security lock is unlocked)
+    },
+    OUTPORT: {                  // this.b8042OutPort
+        NO_RESET:       0x01,   // set by default
+        A20_ON:         0x02,   // set by default
+        COMPAQ_SLOWD:   0x08,   // SL0WD* NOT asserted (refer to timer 2, counter 2); see COMPAQ 386/25 TechRef p2-105
+        OUTBUFF_FULL:   0x10,   // output buffer full
+        INBUFF_EMPTY:   0x20,   // input buffer empty
+        KBD_CLOCK:      0x40,   // keyboard clock (output)
+        KBD_DATA:       0x80    // keyboard data (output)
+    },
+    TESTPORT: {                 // generated "on the fly"
+        KBD_CLOCK:      0x01,   // keyboard clock (input)
+        KBD_DATA:       0x02    // keyboard data (input)
+    },
+    RWREG: {                    // this.bPPIB (since CLK_TIMER2 and SPK_TIMER2 are in both PPI_B and RWREG)
+        PORT:           0x61,
+        CLK_TIMER2:     0x01,   // set to enable clock to TIMER2 (R/W)
+        SPK_TIMER2:     0x02,   // set to connect output of TIMER2 to speaker (R/W)
+        COMPAQ_FSNMI:   0x04,   // set to disable RAM/FS NMI (R/W, DESKPRO386)
+        COMPAQ_IONMI:   0x08,   // set to disable IOCHK NMI (R/W, DESKPRO386)
+        DISABLE_NMI:    0x0C,   // set to disable IOCHK and RAM/FS NMI, clear to enable (R/W)
+        REFRESH_BIT:    0x10,   // 0 if RAM refresh occurring, 1 if RAM not in refresh cycle (R/O)
+        OUT_TIMER2:     0x20,   // state of TIMER2 output signal (R/O, DESKPRO386)
+        IOCHK_NMI:      0x40,   // IOCHK NMI (R/O); to reset, pulse bit 3 (0x08)
+        RAMFS_NMI:      0x80,   // RAM/FS (parity or fail-safe) NMI (R/O); to reset, pulse bit 2 (0x04)
+        NMI_ERROR:      0xC0
+    },
+    CMD: {                      // this.b8042InBuff (on write to port 0x64, interpret this as a CMD)
+        PORT:           0x64,
+        READ_CMD:       0x20,   // sends the current CMD byte (this.b8042CmdData) to KC8042.DATA.PORT
+        WRITE_CMD:      0x60,   // followed by a command byte written to KC8042.DATA.PORT (see KC8042.DATA.CMD)
+        COMPAQ_SLOWD:   0xA3,   // enable system slow down; see COMPAQ 386/25 TechRef p2-111
+        COMPAQ_TOGGLE:  0xA4,   // toggle speed-control bit; see COMPAQ 386/25 TechRef p2-111
+        COMPAQ_SPCREAD: 0xA5,   // special read of "port 2"; see COMPAQ 386/25 TechRef p2-111
+        SELF_TEST:      0xAA,   // self-test (KC8042.DATA.SELF_TEST.OK is placed in the output buffer if no errors)
+        INTF_TEST:      0xAB,   // interface test
+        DIAG_DUMP:      0xAC,   // diagnostic dump
+        DISABLE_KBD:    0xAD,   // disable keyboard
+        ENABLE_KBD:     0xAE,   // enable keyboard
+        READ_INPORT:    0xC0,   // read input port and place data in output buffer (use only if output buffer empty)
+        READ_OUTPORT:   0xD0,   // read output port and place data in output buffer (use only if output buffer empty)
+        WRITE_OUTPORT:  0xD1,   // next byte written to KC8042.DATA.PORT (port 0x60) is placed in the output port (see KC8042.OUTPORT)
+        READ_TEST:      0xE0,
+        PULSE_OUTPORT:  0xF0    // this is the 1st of 16 commands (0xF0-0xFF) that pulse bits 0-3 of the output port
+    },
+    STATUS: {                   // this.b8042Status (on read from port 0x64)
+        PORT:           0x64,
+        OUTBUFF_FULL:   0x01,
+        INBUFF_FULL:    0x02,   // set if the controller has received but not yet read data from the input buffer (not normally set)
+        SYS_FLAG:       0x04,
+        CMD_FLAG:       0x08,   // set on write to KC8042.CMD (port 0x64), clear on write to KC8042.DATA (port 0x60)
+        NO_INHIBIT:     0x10,   // (in COMPAQ parlance: security lock not engaged)
+        XMT_TIMEOUT:    0x20,
+        RCV_TIMEOUT:    0x40,
+        PARITY_ERR:     0x80,   // last byte of data received had EVEN parity (ODD parity is normally expected)
+        OUTBUFF_DELAY:  0x100
+    }
+};
+
+/*
+ * MC146818A RTC/CMOS Ports (MODEL_5170)
+ *
+ * Write a CMOS address to ChipSet.CMOS.ADDR.PORT, then read/write data from/to ChipSet.CMOS.DATA.PORT.
+ *
+ * The ADDR port also controls NMI: write an address with bit 7 clear to enable NMI or set to disable NMI.
+ */
+ChipSet.CMOS = {
+    ADDR: {                     // this.bCMOSAddr
+        PORT:           0x70,
+        RTC_SEC:        0x00,
+        RTC_SEC_ALRM:   0x01,
+        RTC_MIN:        0x02,
+        RTC_MIN_ALRM:   0x03,
+        RTC_HOUR:       0x04,
+        RTC_HOUR_ALRM:  0x05,
+        RTC_WEEK_DAY:   0x06,
+        RTC_MONTH_DAY:  0x07,
+        RTC_MONTH:      0x08,
+        RTC_YEAR:       0x09,
+        STATUSA:        0x0A,
+        STATUSB:        0x0B,
+        STATUSC:        0x0C,
+        STATUSD:        0x0D,
+        DIAG:           0x0E,
+        SHUTDOWN:       0x0F,
+        FDRIVE:         0x10,
+        HDRIVE:         0x12,   // bits 4-7 contain type of drive 0, bits 0-3 contain type of drive 1 (type 0 means none)
+        EQUIP:          0x14,
+        BASEMEM_LO:     0x15,
+        BASEMEM_HI:     0x16,   // the BASEMEM values indicate the total Kb of base memory, up to 0x280 (640Kb)
+        EXTMEM_LO:      0x17,
+        EXTMEM_HI:      0x18,   // the EXTMEM values indicate the total Kb of extended memory, up to 0x3C00 (15Mb)
+        EXTHDRIVE0:     0x19,   // if bits 4-7 of HDRIVE contains 15, then the type of drive 0 is stored here (16-255)
+        EXTHDRIVE1:     0x1A,   // if bits 0-3 of HDRIVE contains 15, then the type of drive 1 is stored here (16-255)
+        CHKSUM_HI:      0x2E,
+        CHKSUM_LO:      0x2F,   // CMOS bytes included in the checksum calculation: 0x10-0x2D
+        EXTMEM2_LO:     0x30,
+        EXTMEM2_HI:     0x31,
+        CENTURY_DATE:   0x32,   // BCD value for the current century (eg, 0x19 for 20th century, 0x20 for 21st century)
+        BOOT_INFO:      0x33,   // 0x80 if 128Kb expansion memory installed, 0x40 if Setup Utility wants an initial setup message
+        MASK:           0x3F,
+        TOTAL:          0x40,
+        NMI_DISABLE:    0x80
+    },
+    DATA: {                     // this.abCMOSData
+        PORT:           0x71
+    },
+    STATUSA: {                  // abCMOSData[ChipSet.CMOS.ADDR.STATUSA]
+        UIP:            0x80,   // bit 7: 1 indicates Update-In-Progress, 0 indicates date/time ready to read
+        DV:             0x70,   // bits 6-4 (DV2-DV0) are programmed to 010 to select a 32.768Khz time base
+        RS:             0x0F    // bits 3-0 (RS3-RS0) are programmed to 0110 to select a 976.562us interrupt rate
+    },
+    STATUSB: {                  // abCMOSData[ChipSet.CMOS.ADDR.STATUSB]
+        SET:            0x80,   // bit 7: 1 to set any/all of the 14 time-bytes
+        PIE:            0x40,   // bit 6: 1 for Periodic Interrupt Enable
+        AIE:            0x20,   // bit 5: 1 for Alarm Interrupt Enable
+        UIE:            0x10,   // bit 4: 1 for Update Interrupt Enable
+        SQWE:           0x08,   // bit 3: 1 for Square Wave Enabled (as set by the STATUSA rate selection bits)
+        BINARY:         0x04,   // bit 2: 1 for binary Date Mode, 0 for BCD Date Mode
+        HOUR24:         0x02,   // bit 1: 1 for 24-hour mode, 0 for 12-hour mode
+        DST:            0x01    // bit 0: 1 for Daylight Savings Time enabled
+    },
+    STATUSC: {                  // abCMOSData[ChipSet.CMOS.ADDR.STATUSC]
+        IRQF:           0x80,   // bit 7: 1 indicates one or more of the following bits (PF, AF, UF) are set
+        PF:             0x40,   // bit 6: 1 indicates Periodic Interrupt
+        AF:             0x20,   // bit 5: 1 indicates Alarm Interrupt
+        UF:             0x10,   // bit 4: 1 indicates Update Interrupt
+        RESERVED:       0x0F
+    },
+    STATUSD: {                  // abCMOSData[ChipSet.CMOS.ADDR.STATUSD]
+        VRB:            0x80,   // bit 7: 1 indicates Valid RAM Bit (0 implies power was and/or is lost)
+        RESERVED:       0x7F
+    },
+    DIAG: {                     // abCMOSData[ChipSet.CMOS.ADDR.DIAG]
+        RTCFAIL:        0x80,   // bit 7: 1 indicates RTC lost power
+        CHKSUMFAIL:     0x40,   // bit 6: 1 indicates bad CMOS checksum
+        CONFIGFAIL:     0x20,   // bit 5: 1 indicates bad CMOS configuration info
+        MEMSIZEFAIL:    0x10,   // bit 4: 1 indicates memory size miscompare
+        HDRIVEFAIL:     0x08,   // bit 3: 1 indicates hard drive controller or drive init failure
+        TIMEFAIL:       0x04,   // bit 2: 1 indicates time failure
+        RESERVED:       0x03
+    },
+    FDRIVE: {                   // abCMOSData[ChipSet.CMOS.ADDR.FDRIVE]
+        D0_MASK:        0xF0,   // Drive 0 type in high nibble
+        D1_MASK:        0x0F,   // Drive 1 type in lower nibble
+        NONE:           0,      // no drive
+        /*
+         * There's at least one floppy drive type that IBM didn't bother defining a CMOS drive type for:
+         * single-sided drives that were only capable of storing 160Kb (or 180Kb when using 9 sectors/track).
+         * So, as you can see in getDIPFloppyDriveType(), we lump all standard diskette capacities <= 360Kb
+         * into the FD360 bucket.
+         */
+        FD360:          1,      // 5.25-inch double-sided double-density (DSDD 48TPI) drive: 40 tracks, 9 sectors/track, 360Kb max
+        FD1200:         2,      // 5.25-inch double-sided high-density (DSHD 96TPI) drive: 80 tracks, 15 sectors/track, 1200Kb max
+        FD720:          3,      // 3.5-inch drive capable of storing 80 tracks and up to 9 sectors/track, 720Kb max
+        FD1440:         4       // 3.5-inch drive capable of storing 80 tracks and up to 18 sectors/track, 1440Kb max
+    },
+    /*
+     * HDRIVE types are defined by table in the HDC component, which uses setCMOSDriveType() to update the CMOS
+     */
+    HDRIVE: {                   // abCMOSData[ChipSet.CMOS.ADDR.HDRIVE]
+        D0_MASK:        0xF0,   // Drive 0 type in high nibble
+        D1_MASK:        0x0F    // Drive 1 type in lower nibble
+    },
+    /*
+     * The CMOS equipment flags use the same format as the older PPI equipment flags
+     */
+    EQUIP: {                    // abCMOSData[ChipSet.CMOS.ADDR.EQUIP]
+        MONITOR:        ChipSet.PPI_SW.MONITOR,         // PPI_SW.MONITOR.MASK == 0x30
+        FPU:            ChipSet.PPI_SW.FPU,             // PPI_SW.FPU == 0x02
+        FDRIVE:         ChipSet.PPI_SW.FDRIVE           // PPI_SW.FDRIVE.IPL == 0x01 and PPI_SW.FDRIVE.MASK = 0xC0
+    }
+};
+
+/*
+ * DMA Page Registers
+ *
+ * The MODEL_5170 TechRef lists 0x80-0x9F as the range for DMA page registers, but that may be a bit
+ * overbroad.  There are a total of 8 (7 usable) DMA channels on the MODEL_5170, each of which has the
+ * following assigned DMA page registers:
+ *
+ *      Channel #   Page Reg
+ *      ---------   --------
+ *          0         0x87
+ *          1         0x83
+ *          2         0x81
+ *          3         0x82
+ *          4         0x8F (not usable; the 5170 TechRef refers to this as the "Refresh" page register)
+ *          5         0x8B
+ *          6         0x89
+ *          7         0x8A
+ *
+ * That leaves 0x80, 0x84, 0x85, 0x86, 0x88, 0x8C, 0x8D and 0x8E unaccounted for in the range 0x80-0x8F.
+ * (I'm saving the question of what, if anything, is available in the range 0x90-0x9F for another day.)
+ *
+ * As for port 0x80, the TechRef says:
+ *
+ *      "I/O address hex 080 is used as a diagnostic-checkpoint port or register.
+ *      This port corresponds to a read/write register in the DMA page register (74LS612)."
+ *
+ * so I used to have dedicated handlers and storage (bMFGData) for the register at port 0x80, but I've since
+ * appended it to abDMAPageSpare, an 8-element array that captures all I/O to the 8 unassigned (aka "spare")
+ * DMA page registers.  The 5170 BIOS uses 0x80 as a "checkpoint" register, and the DESKPRO386 uses 0x84 in a
+ * similar fashion.  The 5170 also contains "MFG_TST" code that uses other unassigned DMA page registers as
+ * scratch registers, which come in handy when RAM hasn't been tested/initialized yet.
+ *
+ * Here's our mapping of entries in the abDMAPageSpare array to the unassigned ("spare") DMA page registers:
+ *
+ *      Index #     Page Reg
+ *      --------    --------
+ *          0         0x84
+ *          1         0x85
+ *          2         0x86
+ *          3         0x88
+ *          4         0x8C
+ *          5         0x8D
+ *          6         0x8E
+ *          7         0x80
+ *
+ * The only reason port 0x80 is out of sequence (ie, at the end of the array, at index 7 instead of index 0) is
+ * because it was added the array later, and the entire array gets written to our save/restore data structures, so
+ * reordering the elements would be a bad idea.
+ */
+
+/*
+ * NMI Mask Register (MODEL_5150 and MODEL_5160 only)
+ */
+ChipSet.NMI = {                 // this.bNMI
+    PORT:               0xA0,
+    ENABLE:             0x80,
+    DISABLE:            0x00
+};
+
+/*
+ * FPU Coprocessor Control Registers (MODEL_5170)
+ */
+ChipSet.FPU = {                 // TODO: Define a variable for this?
+    PORT_CLEAR:         0xF0,   // clear the FPU's "busy" state
+    PORT_RESET:         0xF1    // reset the FPU
+};
+
+ChipSet.aDMAControllerInit = [0, null, null, 0, new Array(4), 0];
+
+ChipSet.aDMAChannelInit = [true, [0,0], [0,0], [0,0], [0,0]];
+
+ChipSet.aPICInit = [0, new Array(4)];
+
+ChipSet.aTimerInit = [[0,0], [0,0], [0,0], [0,0]];
+
+/*
+ * Port input notification tables
+ */
+ChipSet.aPortInput = {
+    0x00: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAChannelAddr(ChipSet.DMA0.INDEX, 0, port, addrFrom); },
+    0x01: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAChannelCount(ChipSet.DMA0.INDEX, 0, port, addrFrom); },
+    0x02: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAChannelAddr(ChipSet.DMA0.INDEX, 1, port, addrFrom); },
+    0x03: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAChannelCount(ChipSet.DMA0.INDEX, 1, port, addrFrom); },
+    0x04: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAChannelAddr(ChipSet.DMA0.INDEX, 2, port, addrFrom); },
+    0x05: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAChannelCount(ChipSet.DMA0.INDEX, 2, port, addrFrom); },
+    0x06: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAChannelAddr(ChipSet.DMA0.INDEX, 3, port, addrFrom); },
+    0x07: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAChannelCount(ChipSet.DMA0.INDEX, 3, port, addrFrom); },
+    0x08: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAStatus(ChipSet.DMA0.INDEX, port, addrFrom); },
+    0x0D: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMATemp(ChipSet.DMA0.INDEX, port, addrFrom); },
+    0x20: /** @this {ChipSet} */ function(port, addrFrom) { return this.inPICLo(ChipSet.PIC0.INDEX, addrFrom); },
+    0x21: /** @this {ChipSet} */ function(port, addrFrom) { return this.inPICHi(ChipSet.PIC0.INDEX, addrFrom); },
+    0x40: /** @this {ChipSet} */ function(port, addrFrom) { return this.inTimer(ChipSet.PIT0.INDEX, ChipSet.PIT0.TIMER0, port, addrFrom); },
+    0x41: /** @this {ChipSet} */ function(port, addrFrom) { return this.inTimer(ChipSet.PIT0.INDEX, ChipSet.PIT0.TIMER1, port, addrFrom); },
+    0x42: /** @this {ChipSet} */ function(port, addrFrom) { return this.inTimer(ChipSet.PIT0.INDEX, ChipSet.PIT0.TIMER2, port, addrFrom); },
+    0x43: /** @this {ChipSet} */ function(port, addrFrom) { return this.inTimerCtrl(ChipSet.PIT0.INDEX, port, addrFrom); },
+    0x81: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAPageReg(ChipSet.DMA0.INDEX, 2, port, addrFrom); },
+    0x82: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAPageReg(ChipSet.DMA0.INDEX, 3, port, addrFrom); },
+    0x83: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAPageReg(ChipSet.DMA0.INDEX, 1, port, addrFrom); },
+    0x87: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAPageReg(ChipSet.DMA0.INDEX, 0, port, addrFrom); }
+};
+
+ChipSet.aPortInput5150 = {
+    0x60: ChipSet.prototype.inPPIA,
+    0x61: ChipSet.prototype.inPPIB,
+    0x62: ChipSet.prototype.inPPIC,
+    0x63: ChipSet.prototype.inPPICtrl   // technically, not actually readable, but I want the Debugger to be able to read it
+};
+
+ChipSet.aPortInput5170 = {
+    0x60: ChipSet.prototype.in8042OutBuff,
+    0x61: ChipSet.prototype.in8042RWReg,
+    0x64: ChipSet.prototype.in8042Status,
+    0x70: ChipSet.prototype.inCMOSAddr,
+    0x71: ChipSet.prototype.inCMOSData,
+    0x80: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAPageSpare(7, port, addrFrom); },
+    0x84: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAPageSpare(0, port, addrFrom); },
+    0x85: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAPageSpare(1, port, addrFrom); },
+    0x86: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAPageSpare(2, port, addrFrom); },
+    0x88: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAPageSpare(3, port, addrFrom); },
+    0x89: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAPageReg(ChipSet.DMA1.INDEX, 2, port, addrFrom); },
+    0x8A: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAPageReg(ChipSet.DMA1.INDEX, 3, port, addrFrom); },
+    0x8B: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAPageReg(ChipSet.DMA1.INDEX, 1, port, addrFrom); },
+    0x8C: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAPageSpare(4, port, addrFrom); },
+    0x8D: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAPageSpare(5, port, addrFrom); },
+    0x8E: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAPageSpare(6, port, addrFrom); },
+    0x8F: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAPageReg(ChipSet.DMA1.INDEX, 0, port, addrFrom); },
+    0xA0: /** @this {ChipSet} */ function(port, addrFrom) { return this.inPICLo(ChipSet.PIC1.INDEX, addrFrom); },
+    0xA1: /** @this {ChipSet} */ function(port, addrFrom) { return this.inPICHi(ChipSet.PIC1.INDEX, addrFrom); },
+    0xC0: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAChannelAddr(ChipSet.DMA1.INDEX, 0, port, addrFrom); },
+    0xC2: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAChannelCount(ChipSet.DMA1.INDEX, 0, port, addrFrom); },
+    0xC4: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAChannelAddr(ChipSet.DMA1.INDEX, 1, port, addrFrom); },
+    0xC6: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAChannelCount(ChipSet.DMA1.INDEX, 1, port, addrFrom); },
+    0xC8: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAChannelAddr(ChipSet.DMA1.INDEX, 2, port, addrFrom); },
+    0xCA: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAChannelCount(ChipSet.DMA1.INDEX, 2, port, addrFrom); },
+    0xCC: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAChannelAddr(ChipSet.DMA1.INDEX, 3, port, addrFrom); },
+    0xCE: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAChannelCount(ChipSet.DMA1.INDEX, 3, port, addrFrom); },
+    0xD0: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMAStatus(ChipSet.DMA1.INDEX, port, addrFrom); },
+    0xDA: /** @this {ChipSet} */ function(port, addrFrom) { return this.inDMATemp(ChipSet.DMA1.INDEX, port, addrFrom); }
+};
+
+ChipSet.aPortInput6300 = {
+    0x60: ChipSet.prototype.in8041Kbd,
+    0x61: ChipSet.prototype.in8041Ctrl,
+    0x64: ChipSet.prototype.in8041Status,
+    0x66: /** @this {ChipSet} */ function(port, addrFrom) { return this.in6300DIPSwitches(0, port, addrFrom); },
+    0x67: /** @this {ChipSet} */ function(port, addrFrom) { return this.in6300DIPSwitches(1, port, addrFrom); }
+};
+
+if (DESKPRO386) {
+    ChipSet.aPortInputDeskPro386 = {
+        0x48: /** @this {ChipSet} */ function(port, addrFrom) { return this.inTimer(ChipSet.PIT1.INDEX, ChipSet.PIT1.TIMER3, port, addrFrom); },
+        0x49: /** @this {ChipSet} */ function(port, addrFrom) { return this.inTimer(ChipSet.PIT1.INDEX, ChipSet.PIT1.TIMER4, port, addrFrom); },
+        0x4A: /** @this {ChipSet} */ function(port, addrFrom) { return this.inTimer(ChipSet.PIT1.INDEX, ChipSet.PIT1.TIMER5, port, addrFrom); },
+        0x4B: /** @this {ChipSet} */ function(port, addrFrom) { return this.inTimerCtrl(ChipSet.PIT1.INDEX, port, addrFrom); }
+    };
+}
+
+/*
+ * Port output notification tables
+ */
+ChipSet.aPortOutput = {
+    0x00: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAChannelAddr(ChipSet.DMA0.INDEX, 0, port, bOut, addrFrom); },
+    0x01: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAChannelCount(ChipSet.DMA0.INDEX, 0, port, bOut, addrFrom); },
+    0x02: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAChannelAddr(ChipSet.DMA0.INDEX, 1, port, bOut, addrFrom); },
+    0x03: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAChannelCount(ChipSet.DMA0.INDEX, 1, port, bOut, addrFrom); },
+    0x04: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAChannelAddr(ChipSet.DMA0.INDEX, 2, port, bOut, addrFrom); },
+    0x05: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAChannelCount(ChipSet.DMA0.INDEX, 2, port, bOut, addrFrom); },
+    0x06: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAChannelAddr(ChipSet.DMA0.INDEX, 3, port, bOut, addrFrom); },
+    0x07: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAChannelCount(ChipSet.DMA0.INDEX, 3, port, bOut, addrFrom); },
+    0x08: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMACmd(ChipSet.DMA0.INDEX, port, bOut, addrFrom); },
+    0x09: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAReq(ChipSet.DMA0.INDEX, port, bOut, addrFrom); },
+    0x0A: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAMask(ChipSet.DMA0.INDEX, port, bOut, addrFrom); },
+    0x0B: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAMode(ChipSet.DMA0.INDEX, port, bOut, addrFrom); },
+    0x0C: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAResetFF(ChipSet.DMA0.INDEX, port, bOut, addrFrom); },
+    0x0D: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAMasterClear(ChipSet.DMA0.INDEX, port, bOut, addrFrom); },
+    0x20: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outPICLo(ChipSet.PIC0.INDEX, bOut, addrFrom); },
+    0x21: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outPICHi(ChipSet.PIC0.INDEX, bOut, addrFrom); },
+    0x40: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outTimer(ChipSet.PIT0.INDEX, ChipSet.PIT0.TIMER0, port, bOut, addrFrom); },
+    0x41: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outTimer(ChipSet.PIT0.INDEX, ChipSet.PIT0.TIMER1, port, bOut, addrFrom); },
+    0x42: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outTimer(ChipSet.PIT0.INDEX, ChipSet.PIT0.TIMER2, port, bOut, addrFrom); },
+    0x43: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outTimerCtrl(ChipSet.PIT0.INDEX, port, bOut, addrFrom); },
+    0x81: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAPageReg(ChipSet.DMA0.INDEX, 2, port, bOut, addrFrom); },
+    0x82: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAPageReg(ChipSet.DMA0.INDEX, 3, port, bOut, addrFrom); },
+    0x83: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAPageReg(ChipSet.DMA0.INDEX, 1, port, bOut, addrFrom); },
+    0x87: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAPageReg(ChipSet.DMA0.INDEX, 0, port, bOut, addrFrom); }
+};
+
+ChipSet.aPortOutput5150 = {
+    0x60: ChipSet.prototype.outPPIA,
+    0x61: ChipSet.prototype.outPPIB,
+    0x62: ChipSet.prototype.outPPIC,
+    0x63: ChipSet.prototype.outPPICtrl,
+    0xA0: ChipSet.prototype.outNMI
+};
+
+ChipSet.aPortOutput5170 = {
+    0x60: ChipSet.prototype.out8042InBuffData,
+    0x61: ChipSet.prototype.out8042RWReg,
+    0x64: ChipSet.prototype.out8042InBuffCmd,
+    0x70: ChipSet.prototype.outCMOSAddr,
+    0x71: ChipSet.prototype.outCMOSData,
+    0x80: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAPageSpare(7, port, bOut, addrFrom); },
+    0x84: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAPageSpare(0, port, bOut, addrFrom); },
+    0x85: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAPageSpare(1, port, bOut, addrFrom); },
+    0x86: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAPageSpare(2, port, bOut, addrFrom); },
+    0x88: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAPageSpare(3, port, bOut, addrFrom); },
+    0x89: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAPageReg(ChipSet.DMA1.INDEX, 2, port, bOut, addrFrom); },
+    0x8A: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAPageReg(ChipSet.DMA1.INDEX, 3, port, bOut, addrFrom); },
+    0x8B: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAPageReg(ChipSet.DMA1.INDEX, 1, port, bOut, addrFrom); },
+    0x8C: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAPageSpare(4, port, bOut, addrFrom); },
+    0x8D: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAPageSpare(5, port, bOut, addrFrom); },
+    0x8E: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAPageSpare(6, port, bOut, addrFrom); },
+    0x8F: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAPageReg(ChipSet.DMA1.INDEX, 0, port, bOut, addrFrom); },
+    0xA0: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outPICLo(ChipSet.PIC1.INDEX, bOut, addrFrom); },
+    0xA1: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outPICHi(ChipSet.PIC1.INDEX, bOut, addrFrom); },
+    0xC0: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAChannelAddr(ChipSet.DMA1.INDEX, 0, port, bOut, addrFrom); },
+    0xC2: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAChannelCount(ChipSet.DMA1.INDEX, 0, port, bOut, addrFrom); },
+    0xC4: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAChannelAddr(ChipSet.DMA1.INDEX, 1, port, bOut, addrFrom); },
+    0xC6: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAChannelCount(ChipSet.DMA1.INDEX, 1, port, bOut, addrFrom); },
+    0xC8: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAChannelAddr(ChipSet.DMA1.INDEX, 2, port, bOut, addrFrom); },
+    0xCA: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAChannelCount(ChipSet.DMA1.INDEX, 2, port, bOut, addrFrom); },
+    0xCC: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAChannelAddr(ChipSet.DMA1.INDEX, 3, port, bOut, addrFrom); },
+    0xCE: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAChannelCount(ChipSet.DMA1.INDEX, 3, port, bOut, addrFrom); },
+    0xD0: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMACmd(ChipSet.DMA1.INDEX, port, bOut, addrFrom); },
+    0xD2: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAReq(ChipSet.DMA1.INDEX, port, bOut, addrFrom); },
+    0xD4: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAMask(ChipSet.DMA1.INDEX, port, bOut, addrFrom); },
+    0xD6: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAMode(ChipSet.DMA1.INDEX, port, bOut, addrFrom); },
+    0xD8: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAResetFF(ChipSet.DMA1.INDEX, port, bOut, addrFrom); },
+    0xDA: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outDMAMasterClear(ChipSet.DMA1.INDEX, port, bOut, addrFrom); },
+    0xF0: ChipSet.prototype.outFPUClear,
+    0xF1: ChipSet.prototype.outFPUReset
+};
+
+ChipSet.aPortOutput6300 = {
+    0x60: ChipSet.prototype.out8041Kbd,
+    0x61: ChipSet.prototype.out8041Ctrl,
+    0xA0: ChipSet.prototype.outNMI
+};
+
+if (DESKPRO386) {
+    ChipSet.aPortOutputDeskPro386 = {
+        0x48: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outTimer(ChipSet.PIT1.INDEX, ChipSet.PIT1.TIMER3, port, bOut, addrFrom); },
+        0x49: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outTimer(ChipSet.PIT1.INDEX, ChipSet.PIT1.TIMER4, port, bOut, addrFrom); },
+        0x4A: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outTimer(ChipSet.PIT1.INDEX, ChipSet.PIT1.TIMER5, port, bOut, addrFrom); },
+        0x4B: /** @this {ChipSet} */ function(port, bOut, addrFrom) { this.outTimerCtrl(ChipSet.PIT1.INDEX, port, bOut, addrFrom); }
+    };
+}
+
+/*
+ * Initialize every ChipSet module on the page.
+ */
+Web.onInit(ChipSet.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/rom.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class ROM extends Component {
+    /**
+     * ROM(parmsROM)
+     *
+     * The ROM component expects the following (parmsROM) properties:
+     *
+     *      addr: physical address of ROM
+     *      size: amount of ROM, in bytes
+     *      alias: physical alias address (null if none)
+     *      file: name of ROM data file
+     *      notify: ID of a component to notify once the ROM is in place (optional)
+     *
+     * NOTE: The ROM data will not be copied into place until the Bus is ready (see initBus()) AND the
+     * ROM data file has finished loading (see doneLoad()).
+     *
+     * Also, while the size parameter may seem redundant, I consider it useful to confirm that the ROM you received
+     * is the ROM you expected.
+     *
+     * @this {ROM}
+     * @param {Object} parmsROM
+     */
+    constructor(parmsROM)
+    {
+        super("ROM", parmsROM);
+
+        this.abROM = null;
+        this.addrROM = parmsROM['addr'];
+        this.sizeROM = parmsROM['size'];
+
+        /*
+         * The new 'alias' property can now be EITHER a single physical address (like 'addr') OR an array of
+         * physical addresses; eg:
+         *
+         *      [0xf0000,0xffff0000,0xffff8000]
+         *
+         * We could have overloaded 'addr' to accomplish the same thing, but I think it's better to have any
+         * aliased locations listed under a separate property.
+         *
+         * Most ROMs are not aliased, in which case the 'alias' property should have the default value of null.
+         */
+        this.addrAlias = parmsROM['alias'];
+        this.sFilePath = parmsROM['file'];
+
+        /*
+         * The 'notify' property can now (as of v1.18.2) contain an array of parameters that the notified
+         * component (typically Video) may use as it sees fit.  For example, the Video component is generally
+         * interested in knowing the offsets of specific font tables within the ROM, which used to be hard-coded
+         * when all we supported were a few specific IBM video cards, but that's no longer feasible as we move
+         * beyond the original handful of IBM cards.
+         *
+         * It's up to the notified component to decide how to interpret the parameters it receives, if any.
+         */
+        this.idNotify = parmsROM['notify'];
+        this.aNotifyParms = null;
+        if (this.idNotify) {
+            var i = this.idNotify.indexOf('[');
+            if (i > 0) {
+                try {
+                    this.aNotifyParms = eval(this.idNotify.substr(i));
+                } catch (e) {}
+                this.idNotify = this.idNotify.substr(0, i);
+            }
+        }
+        if (this.sFilePath) {
+            var sFileURL = this.sFilePath;
+            var sFileName = Str.getBaseName(sFileURL);
+            if (DEBUG) this.log('load("' + sFileURL + '")');
+            /*
+             * If the selected ROM file has a ".json" extension, then we assume it's pre-converted
+             * JSON-encoded ROM data, so we load it as-is; ditto for ROM files with a ".hex" extension.
+             * Otherwise, we ask our server-side ROM converter to return the file in a JSON-compatible format.
+             */
+            var sFileExt = Str.getExtension(sFileName);
+            if (sFileExt != DumpAPI.FORMAT.JSON && sFileExt != DumpAPI.FORMAT.HEX) {
+                sFileURL = Web.getHost() + DumpAPI.ENDPOINT + '?' + DumpAPI.QUERY.FILE + '=' + this.sFilePath + '&' + DumpAPI.QUERY.FORMAT + '=' + DumpAPI.FORMAT.BYTES + '&' + DumpAPI.QUERY.DECIMAL + '=true';
+            }
+            var rom = this;
+            Web.getResource(sFileURL, null, true, function(sURL, sResponse, nErrorCode) {
+                rom.doneLoad(sURL, sResponse, nErrorCode);
+            });
+        }
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {ROM}
+     * @param {Computer} cmp
+     * @param {Bus} bus
+     * @param {X86CPU} cpu
+     * @param {DebuggerX86} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+        this.copyROM();
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {ROM}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (this.aSymbols) {
+            if (this.dbg) {
+                this.dbg.addSymbols(this.id, 0, this.addrROM >>> 4, 0, this.addrROM, this.sizeROM, this.aSymbols);
+            }
+            /*
+             * Our only role in the handling of symbols is to hand them off to the Debugger at our
+             * first opportunity. Now that we've done that, our copy of the symbols, if any, are toast.
+             */
+            delete this.aSymbols;
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * Since we have nothing to do on powerDown(), and no state to return, we could simply omit
+     * this function.  But it doesn't hurt anything, and maybe we'll use our state to save something
+     * useful down the road, like user-defined symbols (ie, symbols that the Debugger may have
+     * created, above and beyond those symbols we automatically loaded, if any, along with the ROM).
+     *
+     * @this {ROM}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return true;
+    }
+
+    /**
+     * doneLoad(sURL, sROMData, nErrorCode)
+     *
+     * @this {ROM}
+     * @param {string} sURL
+     * @param {string} sROMData
+     * @param {number} nErrorCode (response from server if anything other than 200)
+     */
+    doneLoad(sURL, sROMData, nErrorCode)
+    {
+        if (nErrorCode) {
+            this.notice("Unable to load system ROM (error " + nErrorCode + ": " + sURL + ")");
+            return;
+        }
+
+        Component.addMachineResource(this.idMachine, sURL, sROMData);
+
+        if (sROMData.charAt(0) == "[" || sROMData.charAt(0) == "{") {
+            try {
+                /*
+                 * The most likely source of any exception will be here: parsing the JSON-encoded ROM data.
+                 */
+                var rom = eval("(" + sROMData + ")");
+                var ab = rom['bytes'];
+                /*
+                 * Resource 'longs' should always be 32-bit DWORD values, whereas 'data' bit lengths
+                 * will vary according to the machine architecture for which the resource was designed.
+                 */
+                var adw = rom['longs'] || rom['data'];
+
+                if (ab) {
+                    this.abROM = ab;
+                }
+                else if (adw) {
+                    /*
+                     * Convert all the DWORDs into BYTEs, so that subsequent code only has to deal with abROM.
+                     */
+                    this.abROM = new Array(adw.length * 4);
+                    for (var idw = 0, ib = 0; idw < adw.length; idw++) {
+                        this.abROM[ib++] = adw[idw] & 0xff;
+                        this.abROM[ib++] = (adw[idw] >> 8) & 0xff;
+                        this.abROM[ib++] = (adw[idw] >> 16) & 0xff;
+                        this.abROM[ib++] = (adw[idw] >> 24) & 0xff;
+                    }
+                }
+                else {
+                    this.abROM = rom;
+                }
+
+                this.aSymbols = rom['symbols'];
+
+                if (!this.abROM.length) {
+                    Component.error("Empty ROM: " + sURL);
+                    return;
+                }
+                else if (this.abROM.length == 1) {
+                    Component.error(this.abROM[0]);
+                    return;
+                }
+            } catch (e) {
+                this.notice("ROM data error: " + e.message);
+                return;
+            }
+        }
+        else {
+            /*
+             * Parse the ROM data manually; we assume it's in "simplified" hex form (a series of hex byte-values
+             * separated by whitespace).
+             */
+            var sHexData = sROMData.replace(/\n/gm, " ").replace(/ +$/, "");
+            var asHexData = sHexData.split(" ");
+            this.abROM = new Array(asHexData.length);
+            for (var i = 0; i < asHexData.length; i++) {
+                this.abROM[i] = Str.parseInt(asHexData[i], 16);
+            }
+        }
+        this.copyROM();
+    }
+
+    /**
+     * copyROM()
+     *
+     * This function is called by both initBus() and doneLoad(), but it cannot copy the the ROM data into place
+     * until after initBus() has received the Bus component AND doneLoad() has received the abROM data.  When both
+     * those criteria are satisfied, the component becomes "ready".
+     *
+     * @this {ROM}
+     */
+    copyROM()
+    {
+        if (!this.isReady()) {
+            if (!this.sFilePath) {
+                this.setReady();
+            }
+            else if (this.abROM && this.bus) {
+                /*
+                 * If no explicit size was specified, then use whatever the actual size is.
+                 */
+                if (!this.sizeROM) {
+                    this.sizeROM = this.abROM.length;
+                }
+                if (this.abROM.length != this.sizeROM) {
+                    /*
+                     * Note that setError() sets the component's fError flag, which in turn prevents setReady() from
+                     * marking the component ready.  TODO: Revisit this decision.  On the one hand, it sounds like a
+                     * good idea to stop the machine in its tracks whenever a setError() occurs, but there may also be
+                     * times when we'd like to forge ahead anyway.
+                     */
+                    this.setError("ROM size (" + Str.toHexLong(this.abROM.length) + ") does not match specified size (" + Str.toHexLong(this.sizeROM) + ")");
+                }
+                else if (this.addROM(this.addrROM)) {
+
+                    var aliases = [];
+                    if (typeof this.addrAlias == "number") {
+                        aliases.push(this.addrAlias);
+                    } else if (this.addrAlias != null && this.addrAlias.length) {
+                        aliases = this.addrAlias;
+                    }
+                    for (var i = 0; i < aliases.length; i++) {
+                        this.cloneROM(aliases[i]);
+                    }
+                    /*
+                     * If there's a component we should notify, notify it now, and give it the internal byte array, so that
+                     * it doesn't have to ask the CPU for the data.  Currently, the only component that uses this notification
+                     * option is the Video component, and only when the associated ROM contains font data that it needs.
+                     */
+                    if (this.idNotify) {
+                        var component = Component.getComponentByID(this.idNotify, this.id);
+                        if (component) {
+                            component.onROMLoad(this.abROM, this.aNotifyParms);
+                        } else {
+                            this.notice("Unable to find component: " + this.idNotify);
+                        }
+                    }
+                    /*
+                     * We used to hang onto the original ROM data so that we could restore any bytes the CPU overwrote,
+                     * using memory write-notification handlers, but with the introduction of read-only memory blocks, that's
+                     * no longer necessary.
+                     *
+                     * TODO: Consider an option to retain the ROM data, and give the user some way of restoring ROMs.
+                     * That may be useful for "resumable" machines that save/restore all dirty block of memory, regardless
+                     * whether they're ROM or RAM.  However, the only way to modify a machine's ROM is with the Debugger,
+                     * and Debugger users should know better.
+                     */
+                    delete this.abROM;
+                }
+                this.setReady();
+            }
+        }
+    }
+
+    /**
+     * addROM(addr)
+     *
+     * @this {ROM}
+     * @param {number} addr
+     * @return {boolean}
+     */
+    addROM(addr)
+    {
+        if (this.bus.addMemory(addr, this.sizeROM, Memory.TYPE.ROM)) {
+            if (DEBUG) this.log("addROM(): copying ROM to " + Str.toHexLong(addr) + " (" + Str.toHexLong(this.abROM.length) + " bytes)");
+            var bto = null;
+            for (var off = 0; off < this.abROM.length; off++) {
+                this.bus.setByteDirect(addr + off, this.abROM[off]);
+                if (BACKTRACK) {
+                    bto = this.bus.addBackTrackObject(this, bto, off);
+                    this.bus.writeBackTrackObject(addr + off, bto, off);
+                }
+            }
+            return true;
+        }
+        /*
+         * We don't need to report an error here, because addMemory() already takes care of that.
+         */
+        return false;
+    }
+
+    /**
+     * cloneROM(addr)
+     *
+     * For ROMs with one or more alias addresses, we used to call addROM() for each address.  However,
+     * that obviously wasted memory, since each alias was an independent copy, and if you used the
+     * Debugger to edit the ROM in one location, the changes would not appear in the other location(s).
+     *
+     * Now that the Bus component provides low-level getMemoryBlocks() and setMemoryBlocks() methods
+     * to manually get and set the blocks of any memory range, it is now possible to create true aliases.
+     *
+     * @this {ROM}
+     * @param {number} addr
+     */
+    cloneROM(addr)
+    {
+        var aBlocks = this.bus.getMemoryBlocks(this.addrROM, this.sizeROM);
+        this.bus.setMemoryBlocks(addr, this.sizeROM, aBlocks);
+    }
+
+    /**
+     * ROM.init()
+     *
+     * This function operates on every HTML element of class "rom", extracting the
+     * JSON-encoded parameters for the ROM constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a ROM component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeROM = Component.getElementsByClass(document, PCX86.APPCLASS, "rom");
+        for (var iROM = 0; iROM < aeROM.length; iROM++) {
+            var eROM = aeROM[iROM];
+            var parmsROM = Component.getComponentParms(eROM);
+            var rom = new ROM(parmsROM);
+            Component.bindComponentControls(rom, eROM, PCX86.APPCLASS);
+        }
+    }
+}
+
+/*
+ * ROM BIOS Data Area (RBDA) definitions, in physical address form, using the same ALL-CAPS names
+ * found in the original IBM PC ROM BIOS listing.  TODO: Fill in remaining RBDA holes.
+ */
+ROM.BIOS = {
+    RS232_BASE:     0x400,              // 4 (word) I/O addresses of RS-232 adapters
+    PRINTER_BASE:   0x408,              // 4 (word) I/O addresses of printer adapters
+    EQUIP_FLAG:     0x410,              // installed hardware (word)
+    MFG_TEST:       0x412,              // initialization flag (byte)
+    MEMORY_SIZE:    0x413,              // memory size in K-bytes (word)
+    RESET_FLAG:     0x472               // set to 0x1234 if keyboard reset underway (word)
+};
+
+// RESET_FLAG is the traditional end of the RBDA, as originally defined at real-mode segment 0x40.
+
+ROM.BIOS.RESET_FLAG_WARMBOOT = 0x1234;  // value stored at ROM.BIOS.RESET_FLAG to indicate a "warm boot", bypassing memory tests
+
+/*
+ * NOTE: There's currently no need for this component to have a reset() function, since
+ * once the ROM data is loaded, it can't be changed, so there's nothing to reinitialize.
+ *
+ * OK, well, I take that back, because the Debugger, if installed, has the ability to modify
+ * ROM contents, so in that case, having a reset() function that restores the original ROM data
+ * might be useful; then again, it might not, depending on what you're trying to debug.
+ *
+ * If we do add reset(), then we'll want to change copyROM() to hang onto the original
+ * ROM data; currently, we release it after copying it into the read-only memory allocated
+ * via bus.addMemory().
+ */
+
+/*
+ * Initialize all the ROM modules on the page.
+ */
+Web.onInit(ROM.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/ram.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class RAM extends Component {
+    /**
+     * RAM(parmsRAM)
+     *
+     * The RAM component expects the following (parmsRAM) properties:
+     *
+     *      addr: starting physical address of RAM (default is 0)
+     *      size: amount of RAM, in bytes (default is 0, which means defer to motherboard switch settings)
+     *      test: true (default) means don't interfere with any BIOS memory tests, false means "fake a warm boot"
+     *
+     * NOTE: We make a note of the specified size, but no memory is initially allocated for the RAM until the
+     * Computer component calls powerUp().
+     *
+     * @this {RAM}
+     * @param {Object} parmsRAM
+     */
+    constructor(parmsRAM)
+    {
+        super("RAM", parmsRAM);
+
+        this.addrRAM = parmsRAM['addr'];
+        this.sizeRAM = parmsRAM['size'];
+        this.fTestRAM = parmsRAM['test'];
+        this.fInstalled = (!!this.sizeRAM); // 0 is the default value for 'size' when none is specified
+        this.fAllocated = false;
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {RAM}
+     * @param {Computer} cmp
+     * @param {Bus} bus
+     * @param {X86CPU} cpu
+     * @param {DebuggerX86} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+        this.chipset = cmp.getMachineComponent("ChipSet");
+        this.setReady();
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {RAM}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            /*
+             * The Computer powers up the CPU last, at which point X86CPU state is restored,
+             * which includes the Bus state, and since we use the Bus to allocate all our memory,
+             * memory contents are already restored for us, so we don't need the usual restore
+             * logic.  We just need to call reset(), to allocate memory for the RAM.
+             *
+             * The only exception is when there's a custom Memory controller (eg, CompaqController).
+             */
+            this.reset();
+            if (data && this.controller) {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {RAM}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        /*
+         * The Computer powers down the CPU first, at which point X86CPU state is saved,
+         * which includes the Bus state, and since we use the Bus component to allocate all
+         * our memory, memory contents are already saved for us, so we don't need the usual
+         * save logic.
+         *
+         * The only exception is when there's a custom Memory controller (eg, CompaqController).
+         */
+        return (fSave && this.controller)? this.save() : true;
+    }
+
+    /**
+     * reset()
+     *
+     * NOTE: When we were initialized, we were given an amount of INSTALLED memory (see sizeRAM above).
+     * The ChipSet component, on the other hand, tells us how much SPECIFIED memory there is -- which,
+     * like a real PC, may not match the amount of installed memory (due to either user error or perhaps
+     * an attempt to prevent some portion of the installed memory from being used).
+     *
+     * However, since we're a virtual machine, we can defer allocation of RAM until we're able to query the
+     * ChipSet component, and then allocate an amount of memory that matches the SPECIFIED memory, making
+     * it easy to reconfigure the machine on the fly and prevent mismatches.
+     *
+     * But, we do that ONLY for the RAM instance configured with an addrRAM of 0x0000, and ONLY if that RAM
+     * object was not given a specific size (see fInstalled).  If there are other RAM objects in the system,
+     * they must necessarily specify a non-conflicting, non-zero start address, in which case their sizeRAM
+     * value will never be affected by the ChipSet settings.
+     *
+     * @this {RAM}
+     */
+    reset()
+    {
+        if (!this.addrRAM && !this.fInstalled && this.chipset) {
+            var baseRAM = this.chipset.getDIPMemorySize() * 1024;
+            if (this.sizeRAM && baseRAM != this.sizeRAM) {
+                this.bus.removeMemory(this.addrRAM, this.sizeRAM);
+                this.fAllocated = false;
+            }
+            this.sizeRAM = baseRAM;
+        }
+        if (!this.fAllocated && this.sizeRAM) {
+            if (this.bus.addMemory(this.addrRAM, this.sizeRAM, Memory.TYPE.RAM)) {
+                this.fAllocated = true;
+
+                /*
+                 * NOTE: I'm specifying MAXDEBUG for status() messages because I'm not yet sure I want these
+                 * messages buried in the app, since they're seen only when a Control Panel is active.  Another
+                 * and perhaps better alternative is to add "comment" attributes to the XML configuration file
+                 * for these components, which the Computer component will display as it "powers up" components.
+                 */
+                if (MAXDEBUG && this.fInstalled) this.status("specified size overrides SW1");
+
+                /*
+                 * Memory with an ID of "ramCPQ" is reserved for built-in memory located just below the 16Mb
+                 * boundary on COMPAQ DeskPro 386 machines.
+                 *
+                 * Technically, that memory is part of the first 1Mb of memory that also provides up to 640Kb
+                 * of conventional memory (ie, memory below 1Mb).
+                 *
+                 * However, PCx86 doesn't support individual memory allocations that (a) are discontiguous
+                 * or (b) dynamically change location.  Components must simulate those features by performing
+                 * a separate allocation for each starting address, and removing/adding memory allocations
+                 * whenever their starting address changes.
+                 *
+                 * Therefore, a DeskPro 386's first 1Mb of physical memory is allocated by PCx86 in two pieces,
+                 * and the second piece must have an ID of "ramCPQ", triggering the additional allocation of
+                 * COMPAQ-specific memory-mapped registers.
+                 *
+                 * See CompaqController for more details.
+                 */
+                if (DESKPRO386) {
+                    if (this.idComponent == "ramCPQ") {
+                        this.controller = new CompaqController(this);
+                        this.bus.addMemory(CompaqController.ADDR, 4, Memory.TYPE.CTRL, this.controller);
+                    }
+                }
+            }
+        }
+        if (this.fAllocated) {
+            if (!this.fTestRAM) {
+                /*
+                 * HACK: Set the word at 40:72 in the ROM BIOS Data Area (RBDA) to 0x1234 to bypass the ROM BIOS
+                 * memory storage tests. See rom.js for all RBDA definitions.
+                 */
+                if (MAXDEBUG) this.status("ROM BIOS memory test has been disabled");
+                this.bus.setShortDirect(ROM.BIOS.RESET_FLAG, ROM.BIOS.RESET_FLAG_WARMBOOT);
+            }
+            /*
+             * Don't add the "ramCPQ" memory to the CMOS total, because addCMOSMemory() will add it to the extended
+             * memory total, which will just confuse the COMPAQ BIOS.
+             */
+            if (!DESKPRO386 || this.idComponent != "ramCPQ") {
+                if (this.chipset) this.chipset.addCMOSMemory(this.addrRAM, this.sizeRAM);
+            }
+        } else {
+            Component.error("No RAM allocated");
+        }
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the RAM component.
+     *
+     * @this {RAM}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        if (this.controller) state.set(0, this.controller.save());
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the RAM component.
+     *
+     * @this {RAM}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        if (this.controller) return this.controller.restore(data[0]);
+        return true;
+    }
+
+    /**
+     * RAM.init()
+     *
+     * This function operates on every HTML element of class "ram", extracting the
+     * JSON-encoded parameters for the RAM constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a RAM component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeRAM = Component.getElementsByClass(document, PCX86.APPCLASS, "ram");
+        for (var iRAM = 0; iRAM < aeRAM.length; iRAM++) {
+            var eRAM = aeRAM[iRAM];
+            var parmsRAM = Component.getComponentParms(eRAM);
+            var ram = new RAM(parmsRAM);
+            Component.bindComponentControls(ram, eRAM, PCX86.APPCLASS);
+        }
+    }
+}
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class CompaqController {
+    /**
+     * CompaqController(ram)
+     *
+     * DeskPro 386 machines came with a minimum of 1Mb of RAM, which could be configured (via jumpers)
+     * for 256Kb, 512Kb or 640Kb of conventional memory, starting at address 0x00000000, with the
+     * remainder (768Kb, 512Kb, or 384Kb) accessible only at an address just below 0x01000000.  In PCx86,
+     * this second chunk of RAM must be separately allocated, with an ID of "ramCPQ".
+     *
+     * The typical configuration was 640Kb of conventional memory, leaving 384Kb accessible at 0x00FA0000.
+     * Presumably, the other configurations (256Kb and 512Kb) would leave 768Kb and 512Kb accessible at
+     * 0x00F40000 and 0x00F80000, respectively.
+     *
+     * The DeskPro 386 also contained two memory-mapped registers at 0x80C00000.  The first is a write-only
+     * mapping register that provides the ability to map the 128Kb at 0x00FE0000 to 0x000E0000, replacing
+     * any ROMs in the range 0x000E0000-0x000FFFFF, and optionally write-protecting that 128Kb; internally,
+     * this register corresponds to wMappings.
+     *
+     * The second register is a read-only diagnostics register that indicates jumper configuration and
+     * parity errors; internally, this register corresponds to wSettings.
+     *
+     * To emulate the memory-mapped registers at 0x80C00000, the RAM component allocates a block at that
+     * address using this custom controller once it sees an allocation for "ramCPQ".
+     *
+     * Later, when the addressability of "ramCPQ" memory is altered, we record the blocks in all the
+     * memory slots spanning 0x000E0000-0x000FFFFF, and then update those slots with the blocks from
+     * 0x00FE0000-0x00FFFFFF.  Note that only the top 128Kb of "ramCPQ" addressability is affected; the
+     * rest of that memory, ranging anywhere from 256Kb to 640Kb, remains addressable at its original
+     * location.  COMPAQ's CEMM and VDISK utilities were generally the only software able to access that
+     * remaining memory (what COMPAQ refers to as "Compaq Built-in Memory").
+     *
+     * @this {CompaqController}
+     * @param {RAM} ram
+     */
+    constructor(ram)
+    {
+        this.ram = ram;
+        this.wMappings = CompaqController.MAPPINGS.DEFAULT;
+        /*
+         * TODO: wSettings needs to reflect the actual amount of configured memory....
+         */
+        this.wSettings = CompaqController.SETTINGS.DEFAULT;
+        this.wRAMSetup = CompaqController.RAMSETUP.DEFAULT;
+        this.aBlocksDst = null;
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the CompaqController component.
+     *
+     * @this {CompaqController}
+     * @return {Array}
+     */
+    save()
+    {
+        return [this.wMappings, this.wRAMSetup];
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the CompaqController component.
+     *
+     * @this {CompaqController}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        this.setByte(0, data[0] & 0xff);
+        this.setByte(2, data[1] & 0xff);
+        return true;
+    }
+
+    /**
+     * getByte(off)
+     *
+     * @this {CompaqController}
+     * @param {number} off
+     * @return {number}
+     */
+    getByte(off)
+    {
+        /*
+         * Offsets 0-3 correspond to reads from 0x80C00000-0x80C00003; anything outside that range
+         * returns our standard non-responsive value of 0xff.
+         */
+        var b = 0xff;
+        if (off < 0x02) {
+            b = (off & 0x1)? (this.wSettings >> 8) : (this.wSettings & 0xff);
+        }
+        else if (off < 0x4) {
+            b = (off & 0x1)? (this.wRAMSetup >> 8) : (this.wRAMSetup & 0xff);
+        }
+        return b;
+    }
+
+    /**
+     * setByte(off, b)
+     *
+     * @this {CompaqController}
+     * @param {number} off (relative to 0x80C00000)
+     * @param {number} b
+     */
+    setByte(off, b)
+    {
+        if (!off) {
+            /*
+             * This is a write to 0x80C00000
+             */
+            if (b != (this.wMappings & 0xff)) {
+                var bus = this.ram.bus;
+                if (!(b & CompaqController.MAPPINGS.UNMAPPED)) {
+                    if (!this.aBlocksDst) {
+                        this.aBlocksDst = bus.getMemoryBlocks(CompaqController.MAP_DST, CompaqController.MAP_SIZE);
+                    }
+                    /*
+                     * You might think that the next three lines could ALSO be moved to the preceding IF,
+                     * but it's possible for the write-protection feature to be enabled/disabled separately
+                     * from the mapping feature.  We could avoid executing this code as well by checking the
+                     * current read-write state, but this is an infrequent operation, so there's no point.
+                     */
+                    var aBlocks = bus.getMemoryBlocks(CompaqController.MAP_SRC, CompaqController.MAP_SIZE);
+                    var type = (b & CompaqController.MAPPINGS.READWRITE)? Memory.TYPE.RAM : Memory.TYPE.ROM;
+                    bus.setMemoryBlocks(CompaqController.MAP_DST, CompaqController.MAP_SIZE, aBlocks, type);
+                }
+                else {
+                    if (this.aBlocksDst) {
+                        bus.setMemoryBlocks(CompaqController.MAP_DST, CompaqController.MAP_SIZE, this.aBlocksDst);
+                        this.aBlocksDst = null;
+                    }
+                }
+                this.wMappings = (this.wMappings & ~0xff) | b;
+            }
+        }
+        else if (off == 0x2) {
+            /*
+             * This is a write to 0x80C00002
+             */
+            this.wRAMSetup = (this.wRAMSetup & ~0xff) | b;
+        }
+    }
+
+    /**
+     * getMemoryBuffer(addr)
+     *
+     * @this {CompaqController}
+     * @param {number} addr
+     * @return {Array} containing the buffer (and an offset within that buffer)
+     */
+    getMemoryBuffer(addr)
+    {
+        return CompaqController.BUFFER;
+    }
+
+    /**
+     * getMemoryAccess()
+     *
+     * @this {CompaqController}
+     * @return {Array.<function()>}
+     */
+    getMemoryAccess()
+    {
+        return CompaqController.ACCESS;
+    }
+
+    /**
+     * readByte(off, addr)
+     *
+     * NOTE: Even though we asked bus.addMemory() for only 4 bytes, corresponding to the 4 memory-mapped register
+     * locations we must manage, we're at the mercy of the Bus component's physical block allocation granularity,
+     * which, on 80386-based machines, is fixed at 4K (the same as the 80386 page size, to simplify emulation of paging).
+     *
+     * So we must allow for requests outside that 4-byte range.
+     *
+     * @this {Memory}
+     * @param {number} off (relative to 0x80C00000)
+     * @param {number} [addr]
+     * @return {number}
+     */
+    static readByte(off, addr)
+    {
+        var b = this.controller.getByte(off);
+        if (DEBUG) {
+            this.controller.ram.printMessage("CompaqController.readByte(" + Str.toHexWord(off) + ") returned " + Str.toHexByte(b), 0, true);
+        }
+        return b;
+    }
+
+    /**
+     * writeByte(off, b, addr)
+     *
+     * NOTE: Even though we asked bus.addMemory() for only 4 bytes, corresponding to the 4 memory-mapped register
+     * locations we must manage, we're at the mercy of the Bus component's physical memory allocation granularity,
+     * which, on 80386-based machines, is fixed at 4K (the same as the 80386 page size, to simplify emulation of paging).
+     *
+     * So we must allow for requests outside that 4-byte range.
+     *
+     * @this {Memory}
+     * @param {number} off (relative to 0x80C00000)
+     * @param {number} b
+     * @param {number} [addr]
+     */
+    static writeByte(off, b, addr)
+    {
+        this.controller.setByte(off, b);
+        /*
+         * All bits in 0x80C00001 and 0x80C00003 are reserved, so we can simply ignore those writes.
+         */
+        if (DEBUG) {
+            this.controller.ram.printMessage("CompaqController.writeByte(" + Str.toHexWord(off) + "," + Str.toHexByte(b) + ")", 0, true);
+        }
+    }
+}
+
+CompaqController.ADDR       = 0x80C00000|0;
+CompaqController.MAP_SRC    = 0x00FE0000;
+CompaqController.MAP_DST    = 0x000E0000;
+CompaqController.MAP_SIZE   = 0x00020000;
+
+/*
+ * Bit definitions for the 16-bit write-only memory-mapping register (wMappings)
+ *
+ * NOTE: Although COMPAQ says the memory at %FE0000 is "relocated", it actually remains addressable
+ * at %FE0000; it simply becomes addressable at %0E0000 as well, displacing any ROMs that used to be
+ * addressable at %0E0000 through %0FFFFF.
+ */
+CompaqController.MAPPINGS = {
+    UNMAPPED:   0x0001,             // is this bit is CLEAR, the last 128Kb (at 0x00FE0000) is mapped to 0x000E0000
+    READWRITE:  0x0002,             // if this bit is CLEAR, the last 128Kb (at 0x00FE0000) is read-only (ie, write-protected)
+    RESERVED:   0xFFFC,             // the remaining 6 bits are reserved and should always be SET
+    DEFAULT:    0xFFFF              // our default settings (no mapping, no write-protection)
+};
+
+/*
+ * Bit definitions for the 16-bit read-only settings/diagnostics register (wSettings)
+ *
+ * SW1-7 and SW1-8 are mapped to bits 5 and 4 of wSettings, respectively, as follows:
+ *
+ *      SW1-7   SW1-8   Bit5    Bit4    Amount (of base memory provided by the COMPAQ 32-bit memory board)
+ *      -----   -----   ----    ----    ------
+ *        ON      ON      0       0     640Kb
+ *        ON      OFF     0       1     Invalid
+ *        OFF     ON      1       0     512Kb
+ *        OFF     OFF     1       1     256Kb
+ *
+ * Other SW1 switches include:
+ *
+ *      SW1-1:  ON enables fail-safe timer
+ *      SW1-2:  ON indicates 80387 coprocessor installed
+ *      SW1-3:  ON sets memory from 0xC00000 to 0xFFFFFF (between 12 and 16 megabytes) non-cacheable
+ *      SW1-4:  ON selects AUTO system speed (OFF selects HIGH system speed)
+ *      SW1-5:  RESERVED (however, the system can read its state; see below)
+ *      SW1-6:  COMPAQ Dual-Mode Monitor or Color Monitor (OFF selects Monochrome monitor other than COMPAQ)
+ *
+ * While SW1-7 and SW1-8 are connected to this memory-mapped register, other SW1 DIP switches are accessible
+ * through the 8042 Keyboard Controller's KBC.INPORT register, as follows:
+ *
+ *      SW1-1:  TODO: Determine
+ *      SW1-2:  ChipSet.KC8042.INPORT.COMPAQ_NO80387 clear if ON, set (0x04) if OFF
+ *      SW1-3:  TODO: Determine
+ *      SW1-4:  ChipSet.KC8042.INPORT.COMPAQ_HISPEED clear if ON, set (0x10) if OFF
+ *      SW1-5:  ChipSet.KC8042.INPORT.COMPAQ_DIP5OFF clear if ON, set (0x20) if OFF
+ *      SW1-6:  ChipSet.KC8042.INPORT.COMPAQ_NONDUAL clear if ON, set (0x40) if OFF
+ */
+CompaqController.SETTINGS = {
+    B0_PARITY:  0x0001,         // parity OK in byte 0
+    B1_PARITY:  0x0002,         // parity OK in byte 1
+    B2_PARITY:  0x0004,         // parity OK in byte 2
+    B3_PARITY:  0x0008,         // parity OK in byte 3
+    BASE_640KB: 0x0000,         // SW1-7,8: ON  ON   Bits 5,4: 00
+    BASE_ERROR: 0x0010,         // SW1-7,8: ON  OFF  Bits 5,4: 01
+    BASE_512KB: 0x0020,         // SW1-7,8: OFF ON   Bits 5,4: 10
+    BASE_256KB: 0x0030,         // SW1-7,8: OFF OFF  Bits 5,4: 11
+    /*
+     * TODO: The DeskPro 386/25 TechRef says bit 6 (0x40) is always set,
+     * but setting it results in memory configuration errors; review.
+     */
+    ADDED_1MB:  0x0040,
+    /*
+     * TODO: The DeskPro 386/25 TechRef says bit 7 (0x80) is always clear; review.
+     */
+    PIGGYBACK:  0x0080,
+    SYS_4MB:    0x0100,         // 4Mb on system board
+    SYS_1MB:    0x0200,         // 1Mb on system board
+    SYS_NONE:   0x0300,         // no memory on system board
+    MODA_4MB:   0x0400,         // 4Mb on module A board
+    MODA_1MB:   0x0800,         // 1Mb on module A board
+    MODA_NONE:  0x0C00,         // no memory on module A board
+    MODB_4MB:   0x1000,         // 4Mb on module B board
+    MODB_1MB:   0x2000,         // 1Mb on module B board
+    MODB_NONE:  0x3000,         // no memory on module B board
+    MODC_4MB:   0x4000,         // 4Mb on module C board
+    MODC_1MB:   0x8000,         // 1Mb on module C board
+    MODC_NONE:  0xC000,         // no memory on module C board
+    /*
+     * NOTE: It doesn't seem to matter to the ROM whether I set any of bits 8-15 or not....
+     */
+    DEFAULT:    0x0A0F          // our default settings (ie, parity OK, 640Kb base memory, 1Mb system memory, 1Mb module A memory)
+};
+
+CompaqController.RAMSETUP = {
+    SETUP:      0x000F,
+    CACHE:      0x0040,
+    RESERVED:   0xFFB0,
+    DEFAULT:    0x0002          // our default settings (ie, 2Mb, cache disabled)
+};
+
+CompaqController.BUFFER = [null, 0];
+CompaqController.ACCESS = [CompaqController.readByte, null, null, CompaqController.writeByte, null, null];
+
+/*
+ * Initialize all the RAM modules on the page.
+ */
+Web.onInit(RAM.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/keyboard.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class Keyboard extends Component {
+    /**
+     * Keyboard(parmsKbd)
+     *
+     * The Keyboard component can be configured with the following (parmsKbd) properties:
+     *
+     *      model: keyboard model string, which must match one of the values listed in Keyboard.MODELS:
+     *
+     *          "US83" (default)
+     *          "US84"
+     *          "US101"
+     *
+     *      autoType: string of keys to automatically inject when the machine is ready (undefined if none)
+     *
+     * Its main purpose is to receive binding requests for various keyboard events, and to use those events
+     * to simulate the PC's keyboard hardware.
+     *
+     * @this {Keyboard}
+     * @param {Object} parmsKbd
+     */
+    constructor(parmsKbd)
+    {
+        super("Keyboard", parmsKbd, Messages.KEYBOARD);
+
+        this.setModel(parmsKbd['model']);
+
+        this.fMobile = Web.isMobile();
+        this.fMSIE = Web.isUserAgent("MSIE");
+        this.printMessage("mobile keyboard support: " + (this.fMobile? "true" : "false"));
+
+        /*
+         * This is count of the number of "soft keyboard" keys present.  At the moment, its only
+         * purpose is to signal findBinding() whether to waste any time looking for SOFTCODE matches.
+         */
+        this.cSoftCodes = 0;
+
+        /*
+         * Updated by onFocusChange()
+         */
+        this.fHasFocus = true;
+
+        /*
+         * This is true whenever the physical Escape key is disabled (eg, by pointer locking code),
+         * giving us the opportunity to map a different physical key to machine's virtual Escape key.
+         */
+        this.fEscapeDisabled = false;
+
+        /*
+         * This is set whenever we notice a discrepancy between our internal CAPS_LOCK state and its
+         * apparent state; we check whenever aKeysActive has been emptied.
+         */
+        this.fToggleCapsLock = false;
+
+        /*
+         * New unified approach to key event processing: When we process a key on the "down" event,
+         * we check the aKeysActive array: if the key is already active, do nothing; otherwise, insert
+         * it into the table, generate the "make" scan code(s), and set a timeout for "repeat" if it's
+         * a repeatable key (most are).
+         *
+         * Similarly, when a key goes "up", if it's already not active, do nothing; otherwise, generate
+         * the "break" scan code(s), cancel any pending timeout, and remove it from the active key table.
+         *
+         * If a "press" event is received, then if the key is already active, remove it and (re)insert
+         * it at the head of the table, generate the "make" scan code(s), set nRepeat to -1, and set a
+         * timeout for "break".
+         *
+         * This requires an aKeysActive array that keeps track of the status of every active key; only the
+         * first entry in the array is allowed to repeat.  Each entry is a key object with the following
+         * properties:
+         *
+         *      simCode:    our simulated keyCode from onKeyDown, onKeyUp, or onKeyPress
+         *      fDown:      next state to simulate (true for down, false for up)
+         *      nRepeat:    > 0 if timer should generate more "make" scan code(s), -1 for "break" scan code(s)
+         *      timer:      timer for next key operation, if any
+         *
+         * Keys are inserted at the head of aKeysActive, using splice(0, 0, key), but not before zeroing
+         * nRepeat of any repeating key that already occupies the head (index 0), so that at most only one
+         * key (ie, the most recent) will ever be in a repeating state.
+         *
+         * IBM PC keyboard repeat behavior: when pressing CTRL, then C, and then releasing CTRL while still
+         * holding C, the repeated CTRL_C characters turn into 'c' characters.  We emulate that behavior.
+         * However, when pressing C, then CTRL, all repeating stops: not a single CTRL_C is generated, and
+         * even if the CTRL is released before the C, no more more 'c' characters are generated either.
+         * We do NOT fully emulate that behavior -- we DO stop the repeating, but we also generate one CTRL_C.
+         * More investigation is required, because I need to confirm whether the IBM keyboard automatically
+         * "breaks" all non-shift keys before it "makes" the CTRL.
+         */
+        this.aKeysActive = [];
+
+        this.msAutoRepeat   = 500;
+        this.msNextRepeat   = 100;
+        this.msAutoRelease  = 50;
+        this.msInjectDelay  = 150;          // number of milliseconds between injected keystrokes
+
+        /*
+         * autoType records the machine's specified autoType sequence, if any.  At the appropriate signal(s),
+         * autoType will be copied to autoInject, and injection will commence.
+         */
+        this.autoInject = null;
+        this.autoType = parmsKbd['autoType'];
+
+        /*
+         * HACK: We set fAllDown to false to ignore all down/up events for keys not explicitly marked as ONDOWN;
+         * even though that prevents those keys from being repeated properly (ie, at the simulation's repeat rate
+         * rather than the browser's repeat rate), it's the safest thing to do when dealing with international keyboards,
+         * because our mapping tables are designed for US keyboards, and testing all the permutations of international
+         * keyboards and web browsers is more work than I can take on right now.  TODO: Dig into this some day.
+         */
+        this.fAllDown = false;
+
+        this.setReady();
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * @this {Keyboard}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "esc")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        /*
+         * There's a special binding that the Video component uses ("screen") to effectively bind its
+         * screen to the entire keyboard, in Video.powerUp(); ie:
+         *
+         *      video.kbd.setBinding("canvas", "screen", video.canvasScreen);
+         * or:
+         *      video.kbd.setBinding("textarea", "screen", video.textareaScreen);
+         *
+         * However, it's also possible for the keyboard XML definition to define a control that serves
+         * a similar purpose; eg:
+         *
+         *      <control type="text" binding="kbd" width="2em">Keyboard</control>
+         *
+         * The latter is purely experimental, while we work on finding ways to trigger the soft keyboard on
+         * certain pesky devices (like the Kindle Fire).  Note that even if you use the latter, the former will
+         * still be enabled (there's currently no way to configure the Video component to not bind its screen,
+         * but we could certainly add one if the need ever arose).
+         */
+        var kbd = this;
+        var id = sHTMLType + '-' + sBinding;
+
+        if (this.bindings[id] === undefined) {
+            switch (sBinding) {
+            case "kbd":
+            case "screen":
+                /*
+                 * Recording the binding ID prevents multiple controls (or components) from attempting to erroneously
+                 * bind a control to the same ID, but in the case of a "dual display" configuration, we actually want
+                 * to allow BOTH video components to call setBinding() for "screen", so that it doesn't matter which
+                 * display the user gives focus to.
+                 *
+                 *      this.bindings[id] = control;
+                 */
+                control.onkeydown = function onKeyDown(event) {
+                    return kbd.onKeyDown(event, true);
+                };
+                control.onkeypress = function onKeyPressKbd(event) {
+                    return kbd.onKeyPress(event);
+                };
+                control.onkeyup = function onKeyUp(event) {
+                    return kbd.onKeyDown(event, false);
+                };
+                return true;
+
+            case "caps-lock":
+                this.bindings[id] = control;
+                control.onclick = function onClickCapsLock(event) {
+                    if (kbd.cmp) kbd.cmp.updateFocus();
+                    return kbd.toggleCapsLock();
+                };
+                return true;
+
+            case "num-lock":
+                this.bindings[id] = control;
+                control.onclick = function onClickNumLock(event) {
+                    if (kbd.cmp) kbd.cmp.updateFocus();
+                    return kbd.toggleNumLock();
+                };
+                return true;
+
+            case "scroll-lock":
+                this.bindings[id] = control;
+                control.onclick = function onClickScrollLock(event) {
+                    if (kbd.cmp) kbd.cmp.updateFocus();
+                    return kbd.toggleScrollLock();
+                };
+                return true;
+
+            default:
+                /*
+                 * Maintain support for older button codes; eg, map button code "ctrl-c" to CLICKCODE "CTRL_C"
+                 */
+                var sCode = sBinding.toUpperCase().replace(/-/g, '_');
+                if (Keyboard.CLICKCODES[sCode] !== undefined && sHTMLType == "button") {
+                    this.bindings[id] = control;
+                    control.onclick = function(kbd, sKey, simCode) {
+                        return function onKeyboardBindingClick(event) {
+                            if (!COMPILED && kbd.messageEnabled()) kbd.printMessage(sKey + " clicked", Messages.KEYS);
+                            if (kbd.cmp) kbd.cmp.updateFocus();
+                            kbd.sInjectBuffer = "";                 // actual key events should stop any injection currently in progress
+                            kbd.updateShiftState(simCode, true);    // future-proofing if/when any LOCK keys are added to CLICKCODES
+                            kbd.addActiveKey(simCode, true);
+                        };
+                    }(this, sCode, Keyboard.CLICKCODES[sCode]);
+                    return true;
+                }
+                else if (Keyboard.SOFTCODES[sBinding] !== undefined) {
+                    this.cSoftCodes++;
+                    this.bindings[id] = control;
+                    var fnDown = function(kbd, sKey, simCode) {
+                        return function onKeyboardBindingDown(event) {
+                            kbd.sInjectBuffer = "";                 // actual key events should stop any injection currently in progress
+                            kbd.addActiveKey(simCode);
+                        };
+                    }(this, sBinding, Keyboard.SOFTCODES[sBinding]);
+                    var fnUp = function(kbd, sKey, simCode) {
+                        return function onKeyboardBindingUp(event) {
+                            kbd.removeActiveKey(simCode);
+                        };
+                    }(this, sBinding, Keyboard.SOFTCODES[sBinding]);
+                    if ('ontouchstart' in window) {
+                        control.ontouchstart = fnDown;
+                        control.ontouchend = fnUp;
+                    } else {
+                        control.onmousedown = fnDown;
+                        control.onmouseup = control.onmouseout = fnUp;
+                    }
+                    return true;
+                }
+                else if (sValue) {
+                    /*
+                     * Instead of just having a dedicated "test" control, we now treat any unrecognized control with
+                     * a "value" attribute as a test control.  The only caveat is that such controls must have binding IDs
+                     * that do not conflict with predefined controls (which, of course, is the only way you can get here).
+                     */
+                    this.bindings[id] = control;
+                    control.onclick = function onClickTest(event) {
+                        if (kbd.cmp) kbd.cmp.updateFocus();
+                        return kbd.injectKeys(sValue);
+                    };
+                    return true;
+                }
+                break;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * findBinding(simCode, sType, fDown)
+     *
+     * TODO: This function is woefully inefficient, because the SOFTCODES table is designed for converting
+     * soft key presses into SIMCODES, whereas this function is doing the reverse: looking for the soft key,
+     * if any, that corresponds to a SIMCODE, simply so we can provide visual feedback of keys activated
+     * by other means (eg, real keyboard events, button clicks that generate key sequences like CTRL_ALT_DEL,
+     * etc).
+     *
+     * To minimize this function's cost, we would want to dynamically create a reverse-lookup table after
+     * all the setBinding() calls for the soft keys have been established; note that the reverse-lookup table
+     * would contain MORE entries than the SOFTCODES table, because there are multiple simCodes that correspond
+     * to a given soft key (eg, '1' and '!' both map to the same soft key).
+     *
+     * @this {Keyboard}
+     * @param {number} simCode
+     * @param {string} sType is the type of control (eg, "button" or "key")
+     * @param {boolean} [fDown] is true if the key is going down, false if up, or undefined if unchanged
+     * @return {Object} is the HTML control DOM object (eg, HTMLButtonElement), or undefined if no such control exists
+     */
+    findBinding(simCode, sType, fDown)
+    {
+        var control;
+        if (this.cSoftCodes) {
+            for (var code in Keys.SHIFTED_KEYCODES) {
+                if (simCode == Keys.SHIFTED_KEYCODES[code]) {
+                    simCode = +code;
+                    code = Keys.NONASCII_KEYCODES[code];
+                    if (code) simCode = code;
+                    break;
+                }
+            }
+            for (var sBinding in Keyboard.SOFTCODES) {
+                if (Keyboard.SOFTCODES[sBinding] == simCode || Keyboard.SOFTCODES[sBinding] == this.toUpperKey(simCode)) {
+                    var id = sType + '-' + sBinding;
+                    control = this.bindings[id];
+                    if (control && fDown !== undefined) {
+                        this.setSoftKeyState(control, fDown);
+                    }
+                    break;
+                }
+            }
+        }
+        return control;
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {Keyboard}
+     * @param {Computer} cmp
+     * @param {Bus} bus
+     * @param {X86CPU} cpu
+     * @param {DebuggerX86} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cmp = cmp;
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+        this.chipset = cmp.getMachineComponent("ChipSet");
+        this.autoType = cmp.getMachineParm('autoType') || this.autoType;
+        cpu.addIntNotify(Interrupts.DOS, this.intDOS.bind(this));
+    }
+
+    /**
+     * intDOS()
+     *
+     * Monitors selected DOS interrupts for signals to initialize 'autoType' injection.
+     *
+     * @this {Keyboard}
+     * @param {number} addr
+     * @return {boolean} true to proceed with the INT 0x21 software interrupt, false to skip
+     */
+    intDOS(addr)
+    {
+        var AH = (this.cpu.regEAX >> 8) & 0xff;
+        if (AH == 0x0A) {
+            this.injectInit();
+        }
+        return true;
+    }
+
+    /**
+     * notifyEscape(fDisabled, fAllDown)
+     *
+     * When ESC is used by the browser to disable pointer lock, this gives us the option of mapping a different key to ESC.
+     *
+     * @this {Keyboard}
+     * @param {boolean} fDisabled
+     * @param {boolean} [fAllDown] (an experimental option to re-enable processing of all onkeydown/onkeyup events)
+     */
+    notifyEscape(fDisabled, fAllDown)
+    {
+        this.fEscapeDisabled = fDisabled;
+        if (fAllDown !== undefined) this.fAllDown = fAllDown;
+    }
+
+    /**
+     * setModel(sModel)
+     *
+     * This breaks a model string (eg, "US83") into two parts: modelCountry (eg, "US") and modelKeys (eg, 83).
+     * If the model string isn't recognized, we use Keyboard.MODELS[0] (ie, the first entry in the model array).
+     *
+     * @this {Keyboard}
+     * @param {string|undefined} sModel
+     */
+    setModel(sModel)
+    {
+        var iModel = 0;
+        this.model = null;
+        if (typeof sModel == "string") {
+            this.model = sModel.toUpperCase();
+            iModel = Keyboard.MODELS.indexOf(this.model);
+            if (iModel < 0) iModel = 0;
+        }
+        sModel = Keyboard.MODELS[iModel];
+        if (sModel) {
+            this.modelCountry = sModel.substr(0, 2);
+            this.modelKeys = parseInt(sModel.substr(2), 10);
+        }
+    }
+
+    /**
+     * resetDevice(fNotify)
+     *
+     * @this {Keyboard}
+     * @param {boolean} [fNotify]
+     */
+    resetDevice(fNotify)
+    {
+        /*
+         * TODO: There's more to reset, like LED indicators, default type rate, and emptying the scan code buffer.
+         */
+        this.printMessage("keyboard reset", Messages.KEYBOARD | Messages.PORT);
+        this.abBuffer = [];
+        this.setResponse(Keyboard.CMDRES.BAT_OK);
+    }
+
+    /**
+     * setEnabled(fData, fClock)
+     *
+     * This is the ChipSet's primary interface for toggling keyboard "data" and "clock" lines.
+     * For MODEL_5150 and MODEL_5160 machines, this function is called from the ChipSet's PPI_B
+     * output handler.  For MODEL_5170 machines, this function is called when selected CMD
+     * "data bytes" have been written.
+     *
+     * @this {Keyboard}
+     * @param {boolean} fData is true if the keyboard simulated data line should be enabled
+     * @param {boolean} fClock is true if the keyboard's simulated clock line should be enabled
+     * @return {boolean} true if keyboard was re-enabled, false if not (or no change)
+     */
+    setEnabled(fData, fClock)
+    {
+        var fReset = false;
+        if (this.fClock !== fClock) {
+            if (!COMPILED && this.messageEnabled(Messages.KEYBOARD | Messages.PORT)) {
+                this.printMessage("keyboard clock line changing to " + fClock, true);
+            }
+            /*
+             * Toggling the clock line low and then high signals a "reset", which we acknowledge once the
+             * data line is high as well.
+             */
+            this.fClock = this.fResetOnEnable = fClock;
+            /*
+             * Allow the next buffered scan code, if any, to advance.
+             */
+            if (fClock) this.fAdvance = true;
+        }
+        if (this.fData !== fData) {
+            if (!COMPILED && this.messageEnabled(Messages.KEYBOARD | Messages.PORT)) {
+                this.printMessage("keyboard data line changing to " + fData, true);
+            }
+            this.fData = fData;
+            /*
+             * TODO: Review this code; it was added during the early days of MODEL_5150 testing and may not be
+             * *exactly* what's called for here.
+             */
+            if (fData && !this.fResetOnEnable) {
+                this.shiftScanCode(true);
+            }
+        }
+        if (this.fData && this.fResetOnEnable) {
+            this.resetDevice(true);
+            this.fResetOnEnable = false;
+            fReset = true;
+        }
+        return fReset;
+    }
+
+    /**
+     * setLEDs(b)
+     *
+     * This processes the option byte received after a SET_LEDS command byte.
+     *
+     * @this {Keyboard}
+     * @param {number} b
+     */
+    setLEDs(b)
+    {
+        this.bLEDs = b;             // TODO: Implement
+    }
+
+    /**
+     * setRate(b)
+     *
+     * This processes the rate parameter byte received after a SET_RATE command byte.
+     *
+     * @this {Keyboard}
+     * @param {number} b
+     */
+    setRate(b)
+    {
+        this.bRate = b;             // TODO: Implement
+    }
+
+    /**
+     * setResponse(b)
+     *
+     * @this {Keyboard}
+     * @param {number} b
+     */
+    setResponse(b)
+    {
+        if (this.chipset) {
+            this.abBuffer.unshift(b);
+            this.fAdvance = true;
+            this.chipset.notifyKbdData(b);
+        }
+    }
+
+    /**
+     * sendCmd(bCmd)
+     *
+     * This is the ChipSet's primary interface for controlling "Model M" keyboards (ie, those used
+     * with MODEL_5170 machines).  Commands are delivered through the ChipSet's 8042 Keyboard Controller.
+     *
+     * @this {Keyboard}
+     * @param {number} bCmd should be one of the Keyboard.CMD.* command codes (Model M keyboards only)
+     * @return {number} response should be one of the Keyboard.CMDRES.* response codes, or -1 if unrecognized
+     */
+    sendCmd(bCmd)
+    {
+        var b = -1;
+
+        if (this.messageEnabled()) this.printMessage("sendCmd(" + Str.toHexByte(bCmd) + ")");
+
+        switch(this.bCmdPending || bCmd) {
+
+        case Keyboard.CMD.RESET:            // 0xFF
+            /*
+             * TODO: Determine whether we really need to also return CMDRES.ACK. resetDevice() operates
+             * like setResponse(CMDRES.BAT_OK).  Do we need both the ACK and the BAT_OK?
+             */
+            b = Keyboard.CMDRES.ACK;
+            this.resetDevice();
+            break;
+
+        case Keyboard.CMD.SET_RATE:         // 0xF3
+            if (this.bCmdPending) {
+                this.setRate(bCmd);
+                bCmd = 0;
+            }
+            this.setResponse(Keyboard.CMDRES.ACK);
+            this.bCmdPending = bCmd;
+            break;
+
+        case Keyboard.CMD.SET_LEDS:         // 0xED
+            if (this.bCmdPending) {
+                this.setLEDs(bCmd);
+                bCmd = 0;
+            }
+            this.setResponse(Keyboard.CMDRES.ACK);
+            this.bCmdPending = bCmd;
+            break;
+
+        default:
+            this.printMessage("sendCmd(): unrecognized command");
+            break;
+        }
+
+        return b;
+    }
+
+    /**
+     * checkScanCode()
+     *
+     * This is the ChipSet's interface for checking data availability.
+     *
+     * Note that even if we have data, we don't provide it unless fAdvance is set as well.
+     * This ensures that we wait until the ROM to disable and re-enable the controller before
+     * making more data available.
+     *
+     * @this {Keyboard}
+     * @return {number} next scan code, or 0 if none
+     */
+    checkScanCode()
+    {
+        var b = 0;
+        if (this.abBuffer.length && this.fAdvance) {
+            b = this.abBuffer[0];
+            if (this.chipset) this.chipset.notifyKbdData(b);
+        }
+        if (this.messageEnabled()) {
+            this.printMessage(b? ("scan code " + Str.toHexByte(b) + " available") : "no scan codes available");
+        }
+        return b;
+    }
+
+    /**
+     * readScanCode()
+     *
+     * This is the ChipSet's interface for reading scan codes.
+     *
+     * @this {Keyboard}
+     * @return {number} next scan code, or 0 if none
+     */
+    readScanCode()
+    {
+        var b = 0;
+        if (this.abBuffer.length) {
+            b = this.abBuffer[0];
+        }
+        if (this.messageEnabled()) this.printMessage("scan code " + Str.toHexByte(b) + " delivered");
+        return b;
+    }
+
+    /**
+     * flushScanCode()
+     *
+     * This is the ChipSet's interface to flush scan codes.
+     *
+     * @this {Keyboard}
+     */
+    flushScanCode()
+    {
+        this.abBuffer = [];
+        if (this.messageEnabled()) this.printMessage("scan codes flushed");
+    }
+
+    /**
+     * shiftScanCode(fNotify)
+     *
+     * This is the ChipSet's interface to advance scan codes.
+     *
+     * @this {Keyboard}
+     * @param {boolean} [fNotify] is true to notify ChipSet if more data is available.
+     */
+    shiftScanCode(fNotify)
+    {
+        if (this.abBuffer.length > 0) {
+            /*
+             * The keyboard interrupt service routine toggles the enable bit after reading a scan code, so
+             * presumably this is the proper point at which to shift the last scan code out, and then assert
+             * another interrupt if more scan codes exist.
+             */
+            this.abBuffer.shift();
+            this.fAdvance = fNotify;
+            if (fNotify) {
+                if (!this.abBuffer.length || !this.chipset) {
+                    fNotify = false;
+                } else {
+                    this.chipset.notifyKbdData(this.abBuffer[0]);
+                }
+            }
+            if (this.messageEnabled()) this.printMessage("scan codes shifted, notify " + (fNotify? "true" : "false"));
+        }
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {Keyboard}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            /*
+             * TODO: Save/restore support for Keyboard is the barest minimum.  In fact, originally, I wasn't
+             * saving/restoring anything, and that was OK, but if we don't at least re-initialize fClock/fData,
+             * we can get a spurious reset following a restore.  In an ideal world, we might choose to save/restore
+             * abBuffer as well, but realistically, I think it's going to be safer to always start with an
+             * empty buffer--and who's going to notice anyway?
+             *
+             * So, like Debugger, we deviate from the typical save/restore pattern: instead of reset OR restore,
+             * we always reset and then perform a (very limited) restore.
+             */
+            this.reset();
+            if (data && this.restore) {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {Keyboard}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * reset()
+     *
+     * @this {Keyboard}
+     */
+    reset()
+    {
+        /*
+         * If no keyboard model was specified, our initial setModel() call will select the "US83" keyboard as the
+         * default, but now that the ChipSet is initialized, we can pick a better default, based on the ChipSet model.
+         */
+        if (!this.model && this.chipset) {
+            switch(this.chipset.model) {
+            case ChipSet.MODEL_5150:
+            case ChipSet.MODEL_5160:
+                this.setModel(Keyboard.MODELS[0]);
+                break;
+            case ChipSet.MODEL_5170:
+            default:
+                this.setModel(Keyboard.MODELS[1]);
+                break;
+            }
+        }
+        this.initState();
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the Keyboard component.
+     *
+     * @this {Keyboard}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, this.saveState());
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the Keyboard component.
+     *
+     * @this {Keyboard}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        return this.initState(data[0]);
+    }
+
+    /**
+     * initState(data)
+     *
+     * @this {Keyboard}
+     * @param {Array} [data]
+     * @return {boolean} true if successful, false if failure
+     */
+    initState(data)
+    {
+        var i = 0;
+        if (!data) {
+            data = [];
+            this.autoInject = null;
+        } else {
+            this.autoInject = this.autoType;
+        }
+        this.fClock = this.fAdvance = data[i++];
+        this.fData = data[i];
+        this.bCmdPending = 0;       // when non-zero, a command is pending (eg, SET_LED or SET_RATE)
+
+        /*
+         * The current (assumed) physical (and simulated) states of the various shift/lock keys.
+         *
+         * TODO: Determine how (or whether) we can query the browser's initial shift/lock key states.
+         */
+        this.bitsState = this.bitsStateSim = 0;
+
+        /*
+         * New scan codes are "pushed" onto abBuffer and then "shifted" off.
+         */
+        this.abBuffer = [];
+        this.fAdvance = true;
+
+        this.prevCharDown = 0;
+        this.prevKeyDown = 0;
+
+        /*
+         * Make sure the auto-injection buffer is empty (an injection could have been in progress on any reset after the first).
+         */
+        this.sInjectBuffer = "";
+        return true;
+    }
+
+    /**
+     * saveState()
+     *
+     * @this {Keyboard}
+     * @return {Array}
+     */
+    saveState()
+    {
+        var data = [];
+        data[0] = this.fClock;
+        data[1] = this.fData;
+        return data;
+    }
+
+    /**
+     * setSoftKeyState(control, f)
+     *
+     * @this {Keyboard}
+     * @param {Object} control is an HTML control DOM object
+     * @param {boolean} f is true if the key represented by e should be "on", false if "off"
+     */
+    setSoftKeyState(control, f)
+    {
+        control.style.color = (f? "#ffffff" : "#000000");
+        control.style.backgroundColor = (f? "#000000" : "#ffffff");
+    }
+
+    /**
+     * addScanCode(bScan)
+     *
+     * @this {Keyboard}
+     * @param {number} bScan
+     */
+    addScanCode(bScan)
+    {
+        /*
+         * Prepare for the possibility that our reset() function may not have been called yet.
+         *
+         * TODO: Determine whether we need to reset() the Keyboard sooner (ie, in the constructor),
+         * or if we need to protect other methods from prematurely accessing certain Keyboard structures,
+         * as a result of calls from any of the key event handlers established by setBinding().
+         */
+        if (this.abBuffer) {
+            if (this.abBuffer.length < Keyboard.LIMIT.MAX_SCANCODES) {
+                if (this.messageEnabled()) this.printMessage("scan code " + Str.toHexByte(bScan) + " buffered");
+                this.abBuffer.push(bScan);
+                if (this.abBuffer.length == 1) {
+                    if (this.chipset) this.chipset.notifyKbdData(bScan);
+                }
+                return;
+            }
+            if (this.abBuffer.length == Keyboard.LIMIT.MAX_SCANCODES) {
+                this.abBuffer.push(Keyboard.CMDRES.BUFF_FULL);
+            }
+            this.printMessage("scan code buffer overflow");
+        }
+    }
+
+    /**
+     * injectInit()
+     *
+     * @this {Keyboard}
+     */
+    injectInit()
+    {
+        if (!this.autoInject && this.autoType) {
+            this.autoInject = this.autoType;
+            this.injectKeys(this.autoInject);
+        }
+    }
+
+    /**
+     * injectKeys(sKeys, msDelay)
+     *
+     * @this {Keyboard}
+     * @param {string|undefined} sKeys
+     * @param {number} [msDelay] is an optional injection delay (default is msInjectDelay)
+     */
+    injectKeys(sKeys, msDelay)
+    {
+        if (sKeys && !this.sInjectBuffer) {
+            this.sInjectBuffer = sKeys;
+            if (!COMPILED) this.log("injectKeys(" + this.sInjectBuffer.split("\n").join("\\n") + ")");
+            this.injectKeysFromBuffer(msDelay || this.msInjectDelay);
+        }
+    }
+
+    /**
+     * injectKeysFromBuffer(msDelay)
+     *
+     * @this {Keyboard}
+     * @param {number} msDelay is the delay between injected keys
+     */
+    injectKeysFromBuffer(msDelay)
+    {
+        var charCode = 0;
+        while (this.sInjectBuffer.length > 0 && !charCode) {
+            var ch = this.sInjectBuffer.charAt(0);
+            this.sInjectBuffer = this.sInjectBuffer.substr(1);
+            charCode = ch.charCodeAt(0);
+            /*
+             * charCodes 0xF1-0xFF establish a new delay of 100-1500ms between keys; 0xF0 reverts to
+             * the default delay.  For example:
+             *
+             *      \r\rb:\rrt\r\xff\xf0test;\r
+             *
+             * performs two return key presses, then "b:" followed by return, "rt" followed by return,
+             * then a delay of 1500ms, then a reversion to the default delay (normally 150ms), followed
+             * by "test;" and return.
+             */
+            if (charCode >= 0xF0) {
+                msDelay = ((charCode - 0xF0) * 100) || this.msInjectDelay;
+                charCode = 0;
+                break;
+            }
+        }
+        if (charCode) {
+            /*
+             * I could require all callers to supply CRs instead of LFs, but this is friendlier.
+             */
+            if (charCode == 0x0A) charCode = 0x0D;
+            this.addActiveKey(charCode, true);
+        }
+        if (this.sInjectBuffer.length > 0) {
+            setTimeout(function(kbd) {
+                return function onInjectKeyTimeout() {
+                    kbd.injectKeysFromBuffer(msDelay);
+                };
+            }(this), msDelay);
+        }
+    }
+
+    /**
+     * setLED(control, f)
+     *
+     * @this {Keyboard}
+     * @param {Object} control is an HTML control DOM object
+     * @param {boolean} f is true if the LED represented by control should be "on", false if "off"
+     */
+    setLED(control, f)
+    {
+        /*
+         * TODO: Add support for user-definable LED colors
+         */
+        control.style.backgroundColor = (f? "#00ff00" : "#000000");
+    }
+
+    /**
+     * updateLEDs(bitState)
+     *
+     * Updates any and all shift-related LEDs with the corresponding state in bitsStateSim.
+     *
+     * @this {Keyboard}
+     * @param {number} [bitState] is the bit in bitsStateSim that may have changed, if known; undefined if not
+     */
+    updateLEDs(bitState)
+    {
+        var control;
+        for (var sBinding in Keyboard.LEDSTATES) {
+            var id = "led-" + sBinding;
+            var bitLED = Keyboard.LEDSTATES[sBinding];
+            if ((!bitState || bitState == bitLED) && (control = this.bindings[id])) {
+                this.setLED(control, !!(this.bitsStateSim & bitLED));
+            }
+        }
+    }
+
+    /**
+     * toggleCapsLock()
+     *
+     * @this {Keyboard}
+     */
+    toggleCapsLock()
+    {
+        this.addActiveKey(Keyboard.SIMCODE.CAPS_LOCK, true);
+    }
+
+    /**
+     * toggleNumLock()
+     *
+     * @this {Keyboard}
+     */
+    toggleNumLock()
+    {
+        this.addActiveKey(Keyboard.SIMCODE.NUM_LOCK, true);
+    }
+
+    /**
+     * toggleScrollLock()
+     *
+     * @this {Keyboard}
+     */
+    toggleScrollLock()
+    {
+        this.addActiveKey(Keyboard.SIMCODE.SCROLL_LOCK, true);
+    }
+
+    /**
+     * updateShiftState(simCode, fSim, fDown)
+     *
+     * For non-locking shift keys, this function is straightforward: when fDown is true, the corresponding bitState
+     * is set, and when fDown is false, it's cleared.  However, for LOCK keys, fDown true means toggle, and fDown false
+     * means no change.
+     *
+     * @this {Keyboard}
+     * @param {number} simCode (includes any ONDOWN and/or ONRIGHT modifiers)
+     * @param {boolean} [fSim] is true to update simulated state only
+     * @param {boolean|null} [fDown] is true for down, false for up, undefined for toggle
+     * @return {boolean} true if simCode was a shift key, false if not
+     */
+    updateShiftState(simCode, fSim, fDown)
+    {
+        if (Keyboard.SIMCODES[simCode]) {
+            var fRight = (Math.floor(simCode / 1000) & 2);
+            var bitState = Keyboard.KEYSTATES[simCode] || 0;
+            if (bitState) {
+                if (fRight && !(bitState & Keyboard.STATE.ALL_RIGHT)) {
+                    bitState >>= 1;
+                }
+                if (bitState & Keyboard.STATE.ALL_LOCKS) {
+                    if (fDown === false) return true;
+                    fDown = null;
+                }
+                if (fDown == null) {        // ie, null or undefined
+                    fDown = !((fSim? this.bitsStateSim : this.bitsState) & bitState);
+                }
+                else if (!fDown) {
+                    /*
+                     * In current webkit browsers, pressing and then releasing both left and right shift keys together
+                     * (or both alt keys, or both cmd/windows keys, or presumably both ctrl keys) results in 4 events, as
+                     * you would expect, but 3 of the 4 are "down" events; only the last of the 4 is an "up" event.
+                     *
+                     * Perhaps this is a browser accessibility feature (ie, deliberately suppressing the "up" event
+                     * of one of the shift keys to implement a "sticky shift mode"?), but in any case, to maintain our
+                     * internal consistency, if this is an "up" event and the shift state bit is any of ALL_SHIFT, then
+                     * we set it to ALL_SHIFT, so that we'll automatically clear ALL shift states.
+                     *
+                     * TODO: The only downside to this work-around is that the simulation will still think a shift key is
+                     * down.  So in effect, we have enabled a "sticky shift mode" inside the simulation, whether or not that
+                     * was the browser's intent.  To fix that, we would have to identify the shift key that never went up
+                     * and simulate the "up".  That's more work than I think the problem merits.  The user just needs to tap
+                     * a single shift key to get out that mode.
+                     */
+                    if (bitState & Keyboard.STATE.ALL_SHIFT) bitState = Keyboard.STATE.ALL_SHIFT;
+                }
+                if (!fSim) {
+                    this.bitsState &= ~bitState;
+                    if (fDown) this.bitsState |= bitState;
+                } else {
+                    this.bitsStateSim &= ~bitState;
+                    if (fDown) this.bitsStateSim |= bitState;
+                    this.updateLEDs(bitState);
+                }
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * addActiveKey(simCode, fPress)
+     *
+     * @this {Keyboard}
+     * @param {number} simCode
+     * @param {boolean} [fPress]
+     */
+    addActiveKey(simCode, fPress)
+    {
+        var wCode = Keyboard.SIMCODES[simCode] || Keyboard.SIMCODES[simCode += Keys.KEYCODE.ONDOWN];
+
+        if (!wCode) {
+            if (!COMPILED && this.messageEnabled(Messages.KEYS)) {
+                this.printMessage("addActiveKey(" + simCode + "," + (fPress? "press" : "down") + "): unrecognized", true);
+            }
+            return;
+        }
+
+        /*
+         * Ignore all active keys if the CPU is not running.
+         */
+        if (!this.cpu || !this.cpu.isRunning()) return;
+
+        /*
+         * If this simCode is in the KEYSTATE table, then stop all repeating.
+         */
+        if (Keyboard.KEYSTATES[simCode] && this.aKeysActive.length) {
+            if (this.aKeysActive[0].nRepeat > 0) this.aKeysActive[0].nRepeat = 0;
+        }
+
+        var key;
+        for (var i = 0; i < this.aKeysActive.length; i++) {
+            key = this.aKeysActive[i];
+            if (key.simCode == simCode) {
+                /*
+                 * This key is already active, so if this a "down" request (or a "press" for a key we already
+                 * processed as a "down"), ignore it.
+                 */
+                if (!fPress || key.nRepeat >= 0) {
+                    i = -1;
+                    break;
+                }
+                if (i > 0) {
+                    if (this.aKeysActive[0].nRepeat > 0) this.aKeysActive[0].nRepeat = 0;
+                    this.aKeysActive.splice(i, 1);
+                }
+                break;
+            }
+        }
+
+        if (!COMPILED && this.messageEnabled(Messages.KEYS)) {
+            this.printMessage("addActiveKey(" + simCode + "," + (fPress? "press" : "down") + "): " + (i < 0? "already active" : (i == this.aKeysActive.length? "adding" : "updating")), true);
+        }
+
+        if (i < 0) return;
+
+        if (i == this.aKeysActive.length) {
+            key = {};
+            key.simCode = simCode;
+            key.bitsState = this.bitsState;
+            this.findBinding(simCode, "key", true);
+            i++;
+        }
+        if (i > 0) {
+            this.aKeysActive.splice(0, 0, key);
+        }
+
+        key.fDown = true;
+        key.nRepeat = (fPress? -1: (Keyboard.KEYSTATES[simCode]? 0 : 1));
+
+        this.updateActiveKey(key);
+    }
+
+    /**
+     * checkActiveKey()
+     *
+     * @this {Keyboard}
+     * @return {number} simCode of active key, 0 if none
+     */
+    checkActiveKey()
+    {
+        return this.aKeysActive.length? this.aKeysActive[0].simCode : 0;
+    }
+
+    /**
+     * isAlphaKey(code)
+     *
+     * @this {Keyboard}
+     * @param {number} code
+     * @returns {boolean} true if alpha key, false if not
+     */
+    isAlphaKey(code)
+    {
+        return (code >= Keys.ASCII.A && code <= Keys.ASCII.Z || code >= Keys.ASCII.a && code <= Keys.ASCII.z);
+    }
+
+    /**
+     * toUpperKey(code)
+     *
+     * @this {Keyboard}
+     * @param {number} code
+     * @returns {number}
+     */
+    toUpperKey(code)
+    {
+        if (code >= Keys.ASCII.a && code <= Keys.ASCII.z) {
+            code -= (Keys.ASCII.a - Keys.ASCII.A);
+        }
+        return code;
+    }
+
+    /**
+     * clearActiveKeys()
+     *
+     * Force all active keys to "self-deactivate".
+     *
+     * TODO: Consider limiting this to non-shift keys only.
+     *
+     * @this {Keyboard}
+     */
+    clearActiveKeys()
+    {
+        for (var i = 0; i < this.aKeysActive.length; i++) {
+            var key = this.aKeysActive[i];
+            key.fDown = false;
+            if (key.nRepeat > 0) key.nRepeat = 0;
+        }
+    }
+
+    /**
+     * removeActiveKey(simCode, fFlush)
+     *
+     * @param {number} simCode
+     * @param {boolean} [fFlush] is true whenever the key must be removed, independent of other factors
+     * @return {boolean} true if successfully removed, false if not
+     */
+    removeActiveKey(simCode, fFlush)
+    {
+        if (!Keyboard.SIMCODES[simCode]) {
+            if (!COMPILED && this.messageEnabled(Messages.KEYS)) {
+                this.printMessage("removeActiveKey(" + simCode + "): unrecognized", true);
+            }
+            return false;
+        }
+
+        /*
+         * Ignore all active keys if the CPU is not running.
+         */
+        if (!fFlush && (!this.cpu || !this.cpu.isRunning())) return false;
+
+        var fRemoved = false;
+        for (var i = 0; i < this.aKeysActive.length; i++) {
+            var key = this.aKeysActive[i];
+            if (key.simCode == simCode || key.simCode == Keys.SHIFTED_KEYCODES[simCode]) {
+                this.aKeysActive.splice(i, 1);
+                if (key.timer) clearTimeout(key.timer);
+                if (key.fDown && !fFlush) this.keySimulate(key.simCode, false);
+                this.findBinding(simCode, "key", false);
+                fRemoved = true;
+                break;
+            }
+        }
+        if (!COMPILED && !fFlush && this.messageEnabled(Messages.KEYS)) {
+            this.printMessage("removeActiveKey(" + simCode + "): " + (fRemoved? "removed" : "not active"), true);
+        }
+        if (!this.aKeysActive.length && this.fToggleCapsLock) {
+            if (!COMPILED) this.printMessage("removeActiveKey(): inverting caps-lock now", Messages.KEYS);
+            this.updateShiftState(Keyboard.SIMCODE.CAPS_LOCK);
+            this.fToggleCapsLock = false;
+        }
+        return fRemoved;
+    }
+
+    /**
+     * updateActiveKey(key, msTimer)
+     *
+     * @param {Object} key
+     * @param {number} [msTimer]
+     */
+    updateActiveKey(key, msTimer)
+    {
+        /*
+         * All active keys are automatically removed once the CPU stops running.
+         */
+        if (!this.cpu || !this.cpu.isRunning()) {
+            this.removeActiveKey(key.simCode, true);
+            return;
+        }
+
+        if (!COMPILED && this.messageEnabled(Messages.KEYS)) {
+            this.printMessage((msTimer? '\n' : "") + "updateActiveKey(" + key.simCode + (msTimer? "," + msTimer + "ms" : "") + "): " + (key.fDown? "down" : "up"), true);
+        }
+
+        if (!this.keySimulate(key.simCode, key.fDown)) return;
+
+        if (!key.nRepeat) return;
+
+        var ms;
+        if (key.nRepeat < 0) {
+            if (!key.fDown) {
+                this.removeActiveKey(key.simCode);
+                return;
+            }
+            key.fDown = false;
+            ms = this.msAutoRelease;
+        }
+        else {
+            ms = (key.nRepeat++ == 1? this.msAutoRepeat : this.msNextRepeat);
+        }
+        key.timer = setTimeout(function(kbd) {
+            return function onUpdateActiveKey() {
+                kbd.updateActiveKey(key, ms);
+            };
+        }(this), ms);
+    }
+
+    /**
+     * getSimCode(keyCode)
+     *
+     * @this {Keyboard}
+     * @param {number} keyCode
+     * @param {boolean} fShifted
+     * @return {number} simCode
+     */
+    getSimCode(keyCode, fShifted)
+    {
+        var code;
+        var simCode = keyCode;
+
+        if (keyCode >= Keys.ASCII.A && keyCode <= Keys.ASCII.Z) {
+            if (!(this.bitsState & (Keyboard.STATE.SHIFT | Keyboard.STATE.RSHIFT | Keyboard.STATE.CAPS_LOCK)) == fShifted) {
+                simCode = keyCode + (Keys.ASCII.a - Keys.ASCII.A);
+            }
+        }
+        else if (keyCode >= Keys.ASCII.a && keyCode <= Keys.ASCII.z) {
+            if (!!(this.bitsState & (Keyboard.STATE.SHIFT | Keyboard.STATE.RSHIFT | Keyboard.STATE.CAPS_LOCK)) == fShifted) {
+                simCode = keyCode - (Keys.ASCII.a - Keys.ASCII.A);
+            }
+        }
+        else if (!!(this.bitsState & (Keyboard.STATE.SHIFT | Keyboard.STATE.RSHIFT)) == fShifted) {
+            if (code = Keys.SHIFTED_KEYCODES[keyCode]) {
+                simCode = code;
+            }
+        }
+        else {
+            if (code = Keys.NONASCII_KEYCODES[keyCode]) {
+                simCode = code;
+            }
+        }
+        return simCode;
+    }
+
+    /**
+     * onFocusChange(fFocus)
+     *
+     * @this {Keyboard}
+     * @param {boolean} fFocus is true if gaining focus, false if losing it
+     */
+    onFocusChange(fFocus)
+    {
+        if (this.fHasFocus != fFocus && !COMPILED && this.messageEnabled(Messages.KEYS)) {
+            this.printMessage("onFocusChange(" + (fFocus? "true" : "false") + ")", true);
+        }
+        this.fHasFocus = fFocus;
+        /*
+         * Since we can't be sure of any shift states after losing focus, we clear them all.
+         */
+        if (!fFocus) this.bitsState &= ~Keyboard.STATE.ALL_SHIFT;
+    }
+
+    /**
+     * onKeyDown(event, fDown)
+     *
+     * @this {Keyboard}
+     * @param {Object} event
+     * @param {boolean} fDown is true for a keyDown event, false for a keyUp event
+     * @return {boolean} true to pass the event along, false to consume it
+     */
+    onKeyDown(event, fDown)
+    {
+        var fPass = true;
+        var fPress = false;
+        var fIgnore = false;
+
+        var keyCode = event.keyCode;
+
+        this.sInjectBuffer = "";        // actual key events should stop any injection currently in progress
+
+        /*
+         * Although it would be nice to pay attention ONLY to these "up" and "down" events, and ignore "press"
+         * events, iOS devices force us to process "press" events, because they don't give us shift-key events,
+         * so we have to infer the shift state from the character code in the "press" event.
+         *
+         * So, to seamlessly blend "up" and "down" events with "press" events, we must convert any keyCodes we
+         * receive here to a compatibly shifted simCode.
+         */
+        var simCode = this.getSimCode(keyCode, true);
+
+        if (this.fEscapeDisabled && simCode == Keys.ASCII['`']) {
+            keyCode = simCode = Keys.KEYCODE.ESC;
+        }
+
+        if (Keyboard.SIMCODES[keyCode + Keys.KEYCODE.ONDOWN]) {
+
+            simCode += Keys.KEYCODE.ONDOWN;
+            if (event.location == Keys.LOCATION.RIGHT) {
+                simCode += Keys.KEYCODE.ONRIGHT;
+            }
+
+            if (this.updateShiftState(simCode, false, fDown)) {
+
+                if (keyCode == Keys.KEYCODE.CAPS_LOCK || keyCode == Keys.KEYCODE.NUM_LOCK || keyCode == Keys.KEYCODE.SCROLL_LOCK) {
+                    /*
+                     * FYI, "lock" keys generate a "down" event ONLY when getting locked and an "up" event ONLY
+                     * when getting unlocked--which is a little odd, since the key did go UP and DOWN each time.
+                     *
+                     * We must treat each event like a "down", and also as a "press", so that addActiveKey() will
+                     * automatically generate both the "make" and "break".
+                     *
+                     * Of course, there have to be exceptions, most notably MSIE, which sends both "up" and down"
+                     * on every press, so there's no need for trickery.
+                     */
+                    if (!this.fMSIE) {
+                        fDown = fPress = true;
+                    }
+                }
+                /*
+                 * As a safeguard, whenever the CMD key goes up, clear all active keys, because there appear to be
+                 * cases where we don't always get notification of a CMD key's companion key going up (this probably
+                 * overlaps with most if not all situations where we also lose focus).
+                 */
+                if (!fDown && (keyCode == Keys.KEYCODE.CMD || keyCode == Keys.KEYCODE.RCMD)) {
+                    this.clearActiveKeys();
+                }
+            }
+            else {
+                /*
+                 * Here we have all the non-shift keys in the ONDOWN category; eg, BS, TAB, ESC, UP, DOWN, LEFT, RIGHT,
+                 * and many more.
+                 *
+                 * For various reasons (some of which are discussed below), we don't want to pass these on (ie, we want
+                 * to suppress their "press" event), which means we must perform all key simulation on the "up" and "down"
+                 * events.
+                 *
+                 * Regarding BS: I never want the browser to act on BS, since it does double-duty as the BACK button,
+                 * leaving the current page.
+                 *
+                 * Regarding TAB: If I don't consume TAB on the "down" event, then that's all I'll see, because the browser
+                 * act on it by giving focus to the next control.
+                 *
+                 * Regarding ESC: This key generates "down" and "up" events (LOTS of "down" events for that matter), but no
+                 * "press" event.
+                 */
+
+                /*
+                 * HACK for simulating CTRL_BREAK using CTRL_DEL (Mac) or CTRL_BS (Windows)
+                 */
+                if (keyCode == Keys.KEYCODE.BS && (this.bitsState & (Keyboard.STATE.CTRL|Keyboard.STATE.ALT)) == Keyboard.STATE.CTRL) {
+                    simCode = Keyboard.SIMCODE.CTRL_BREAK;
+                }
+
+                /*
+                 * There are a number of other common key sequences that interfere with our machines; for example,
+                 * the up/down arrows have a "default" behavior of scrolling the web page up and down, which is
+                 * definitely NOT a behavior we want.  Since we mark those keys as ONDOWN, we'll catch them all here.
+                 */
+                fPass = false;
+            }
+        }
+        else {
+            /*
+             * When I have defined system-wide CTRL-key sequences to perform common editing operations (eg, CTRL_W
+             * and CTRL_Z to scroll pages of text), the browser likes to act on those operations, so let's set fPass
+             * to false to prevent that.
+             *
+             * Also, we don't want to set fIgnore in such cases, because the browser may not give us a press event for
+             * these CTRL-key sequences, so we can't risk ignoring them.
+             */
+            if (Keyboard.SIMCODES[simCode] && (this.bitsState & (Keyboard.STATE.CTRLS | Keyboard.STATE.ALTS))) {
+                fPass = false;
+            }
+
+            /*
+             * Don't simulate any key not explicitly marked ONDOWN, as well as any key sequence with the CMD key held.
+             */
+            if (!this.fAllDown && fPass && fDown || !!(this.bitsState & Keyboard.STATE.CMDS)) fIgnore = true;
+        }
+
+        if (!fPass) {
+            event.preventDefault();
+        }
+
+        if (!COMPILED && this.messageEnabled(Messages.KEYS)) {
+            this.printMessage("\nonKey" + (fDown? "Down" : "Up") + "(" + keyCode + "): " + (fIgnore? "ignore" : (fPass? "true" : "false")), true);
+        }
+
+        /*
+         * Mobile (eg, iOS) keyboards don't fully support onKeyDown/onKeyUp events; for example, they usually
+         * don't generate ANY events when a shift key is pressed, and even for normal keys, they seem to generate
+         * rapid (ie, fake) "up" and "down" events around "press" events, probably more to satisfy compatibility
+         * issues rather than making a serious effort to indicate when a key ACTUALLY went down or up.
+         */
+        if (!fIgnore && (!this.fMobile || !fPass)) {
+            if (fDown) {
+                this.addActiveKey(simCode, fPress);
+            } else {
+                if (!this.removeActiveKey(simCode)) {
+                    var code = this.getSimCode(keyCode, false);
+                    if (code != simCode) this.removeActiveKey(code);
+                }
+            }
+        }
+
+        return fPass;
+    }
+
+    /**
+     * onKeyPress(event)
+     *
+     * @this {Keyboard}
+     * @param {Object} event
+     * @return {boolean} true to pass the event along, false to consume it
+     */
+    onKeyPress(event)
+    {
+        event = event || window.event;
+        var keyCode = event.which || event.keyCode;
+
+        this.sInjectBuffer = "";        // actual key events should stop any injection currently in progress
+
+        if (this.fAllDown) {
+            var simCode = this.checkActiveKey();
+            if (simCode && this.isAlphaKey(simCode) && this.isAlphaKey(keyCode) && simCode != keyCode) {
+                if (!COMPILED && this.messageEnabled(Messages.KEYS)) {
+                    this.printMessage("onKeyPress(" + keyCode + ") out of sync with " + simCode + ", invert caps-lock", true);
+                }
+                this.fToggleCapsLock = true;
+                keyCode = simCode;
+            }
+        }
+
+        var fPass = !Keyboard.SIMCODES[keyCode] || !!(this.bitsState & Keyboard.STATE.CMD);
+
+        if (!COMPILED && this.messageEnabled(Messages.KEYS)) {
+            this.printMessage("\nonKeyPress(" + keyCode + "): " + (fPass? "true" : "false"), true);
+        }
+
+        if (!fPass) {
+            this.addActiveKey(keyCode, true);
+        }
+
+        return fPass;
+    }
+
+    /**
+     * keySimulate(simCode, fDown)
+     *
+     * @this {Keyboard}
+     * @param {number} simCode
+     * @param {boolean} fDown
+     * @return {boolean} true if successfully simulated, false if unrecognized/unsupported key
+     */
+    keySimulate(simCode, fDown)
+    {
+        var fSimulated = false;
+
+        this.updateShiftState(simCode, true, fDown);
+
+        var wCode = Keyboard.SIMCODES[simCode] || Keyboard.SIMCODES[simCode + Keys.KEYCODE.ONDOWN];
+
+        if (wCode !== undefined) {
+
+            /*
+             * Hack to transform the IBM "BACKSPACE" key (which we normally map to KEYCODE_DELETE) to the IBM "DEL" key
+             * whenever both CTRL and ALT are pressed as well, so that it's easier to simulate that old favorite: CTRL_ALT_DEL
+             */
+            if (wCode == Keyboard.SCANCODE.BS) {
+                if ((this.bitsState & (Keyboard.STATE.CTRL | Keyboard.STATE.ALT)) == (Keyboard.STATE.CTRL | Keyboard.STATE.ALT)) {
+                    wCode = Keyboard.SCANCODE.NUM_DEL;
+                }
+            }
+
+            var abScanCodes = [];
+            var bCode = wCode & 0xff;
+
+            /*
+             * TODO: Update the following restrictions to address 84-key and 101-key keyboard limitations.
+             */
+            if (bCode > 83 && this.modelKeys == 83) {
+                return false;
+            }
+
+            abScanCodes.push(bCode | (fDown? 0 : Keyboard.SCANCODE.BREAK));
+
+            var fAlpha = (simCode >= Keys.ASCII.A && simCode <= Keys.ASCII.Z || simCode >= Keys.ASCII.a && simCode <= Keys.ASCII.z);
+
+            while (wCode >>>= 8) {
+                var bShift = 0;
+                var bScan = wCode & 0xff;
+                /*
+                 * TODO: The handling of SIMCODE entries with "extended" codes still needs to be tested, and
+                 * moreover, if any of them need to perform any shift-state modifications, those modifications
+                 * may need to be encoded differently.
+                 */
+                if (bCode == Keyboard.SCANCODE.EXTEND1 || bCode == Keyboard.SCANCODE.EXTEND2) {
+                    abScanCodes.push(bCode | (fDown? 0 : Keyboard.SCANCODE.BREAK));
+                    continue;
+                }
+                if (bScan == Keyboard.SCANCODE.SHIFT) {
+                    if (!(this.bitsStateSim & (Keyboard.STATE.SHIFT | Keyboard.STATE.RSHIFT))) {
+                        if (!(this.bitsStateSim & Keyboard.STATE.CAPS_LOCK) || !fAlpha) {
+                            bShift = bScan;
+                        }
+                    }
+                } else if (bScan == Keyboard.SCANCODE.CTRL) {
+                    if (!(this.bitsStateSim & (Keyboard.STATE.CTRL | Keyboard.STATE.RCTRL))) {
+                        bShift = bScan;
+                    }
+                } else if (bScan == Keyboard.SCANCODE.ALT) {
+                    if (!(this.bitsStateSim & (Keyboard.STATE.ALT | Keyboard.STATE.RALT))) {
+                        bShift = bScan;
+                    }
+                } else {
+                    abScanCodes.push(bCode | (fDown? 0 : Keyboard.SCANCODE.BREAK));
+
+                }
+                if (bShift) {
+                    if (fDown)
+                        abScanCodes.unshift(bShift);
+                    else
+                        abScanCodes.push(bShift | Keyboard.SCANCODE.BREAK);
+                }
+            }
+
+            for (var i = 0; i < abScanCodes.length; i++) {
+                this.addScanCode(abScanCodes[i]);
+            }
+
+            fSimulated = true;
+        }
+
+        if (!COMPILED && this.messageEnabled(Messages.KEYS)) {
+            this.printMessage("keySimulate(" + simCode + "," + (fDown? "down" : "up") + "): " + (fSimulated? "true" : "false"), true);
+        }
+
+        return fSimulated;
+    }
+
+    /**
+     * checkActiveKeyShift()
+     *
+     * @this {Keyboard}
+     * @return {number|null} bitsState for active key, null if none
+     *
+     checkActiveKeyShift()
+     {
+         return this.aKeysActive.length? this.aKeysActive[0].bitsState : null;
+     }
+     */
+
+    /**
+     * Keyboard.init()
+     *
+     * This function operates on every HTML element of class "keyboard", extracting the
+     * JSON-encoded parameters for the Keyboard constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a Keyboard component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeKbd = Component.getElementsByClass(document, PCX86.APPCLASS, "keyboard");
+        for (var iKbd = 0; iKbd < aeKbd.length; iKbd++) {
+            var eKbd = aeKbd[iKbd];
+            var parmsKbd = Component.getComponentParms(eKbd);
+            var kbd = new Keyboard(parmsKbd);
+            Component.bindComponentControls(kbd, eKbd, PCX86.APPCLASS);
+        }
+    }
+}
+
+/*
+ * Supported keyboard models (the first entry is the default if the specified model isn't recognized)
+ */
+Keyboard.MODELS = ["US83", "US84", "US101"];
+
+Keyboard.SIMCODE = {
+    BS:           Keys.KEYCODE.BS          + Keys.KEYCODE.ONDOWN,
+    TAB:          Keys.KEYCODE.TAB         + Keys.KEYCODE.ONDOWN,
+    SHIFT:        Keys.KEYCODE.SHIFT       + Keys.KEYCODE.ONDOWN,
+    RSHIFT:       Keys.KEYCODE.SHIFT       + Keys.KEYCODE.ONDOWN + Keys.KEYCODE.ONRIGHT,
+    CTRL:         Keys.KEYCODE.CTRL        + Keys.KEYCODE.ONDOWN,
+    ALT:          Keys.KEYCODE.ALT         + Keys.KEYCODE.ONDOWN,
+    CAPS_LOCK:    Keys.KEYCODE.CAPS_LOCK   + Keys.KEYCODE.ONDOWN,
+    ESC:          Keys.KEYCODE.ESC         + Keys.KEYCODE.ONDOWN,
+    /*
+     * It seems that a recent change to Safari on iOS (first noticed in iOS 9.1) treats SPACE
+     * differently now, at least with regard to <textarea> controls, and possibly only readonly
+     * or hidden controls, like the hidden <textarea> we overlay on the Video <canvas> element.
+     *
+     * Whatever the exact criteria are, Safari on iOS now performs SPACE's default behavior
+     * after the onkeydown event but before the onkeypress event.  So we must now process SPACE
+     * as an ONDOWN key, so that we can call preventDefault() and properly simulate the key at
+     * the time the key goes down.
+     */
+    SPACE:        Keys.KEYCODE.SPACE       + Keys.KEYCODE.ONDOWN,
+    F1:           Keys.KEYCODE.F1          + Keys.KEYCODE.ONDOWN,
+    F2:           Keys.KEYCODE.F2          + Keys.KEYCODE.ONDOWN,
+    F3:           Keys.KEYCODE.F3          + Keys.KEYCODE.ONDOWN,
+    F4:           Keys.KEYCODE.F4          + Keys.KEYCODE.ONDOWN,
+    F5:           Keys.KEYCODE.F5          + Keys.KEYCODE.ONDOWN,
+    F6:           Keys.KEYCODE.F6          + Keys.KEYCODE.ONDOWN,
+    F7:           Keys.KEYCODE.F7          + Keys.KEYCODE.ONDOWN,
+    F8:           Keys.KEYCODE.F8          + Keys.KEYCODE.ONDOWN,
+    F9:           Keys.KEYCODE.F9          + Keys.KEYCODE.ONDOWN,
+    F10:          Keys.KEYCODE.F10         + Keys.KEYCODE.ONDOWN,
+    F11:          Keys.KEYCODE.F11         + Keys.KEYCODE.ONDOWN,
+    F12:          Keys.KEYCODE.F12         + Keys.KEYCODE.ONDOWN,
+    NUM_LOCK:     Keys.KEYCODE.NUM_LOCK    + Keys.KEYCODE.ONDOWN,
+    SCROLL_LOCK:  Keys.KEYCODE.SCROLL_LOCK + Keys.KEYCODE.ONDOWN,
+    PRTSC:        Keys.KEYCODE.PRTSC       + Keys.KEYCODE.ONDOWN,
+    HOME:         Keys.KEYCODE.HOME        + Keys.KEYCODE.ONDOWN,
+    UP:           Keys.KEYCODE.UP          + Keys.KEYCODE.ONDOWN,
+    PGUP:         Keys.KEYCODE.PGUP        + Keys.KEYCODE.ONDOWN,
+    NUM_SUB:      Keys.KEYCODE.NUM_SUB     + Keys.KEYCODE.ONDOWN,
+    LEFT:         Keys.KEYCODE.LEFT        + Keys.KEYCODE.ONDOWN,
+    NUM_CENTER:   Keys.KEYCODE.NUM_CENTER  + Keys.KEYCODE.ONDOWN,
+    RIGHT:        Keys.KEYCODE.RIGHT       + Keys.KEYCODE.ONDOWN,
+    NUM_ADD:      Keys.KEYCODE.NUM_ADD     + Keys.KEYCODE.ONDOWN,
+    END:          Keys.KEYCODE.END         + Keys.KEYCODE.ONDOWN,
+    DOWN:         Keys.KEYCODE.DOWN        + Keys.KEYCODE.ONDOWN,
+    PGDN:         Keys.KEYCODE.PGDN        + Keys.KEYCODE.ONDOWN,
+    INS:          Keys.KEYCODE.INS         + Keys.KEYCODE.ONDOWN,
+    DEL:          Keys.KEYCODE.DEL         + Keys.KEYCODE.ONDOWN,
+    CMD:          Keys.KEYCODE.CMD         + Keys.KEYCODE.ONDOWN,
+    RCMD:         Keys.KEYCODE.RCMD        + Keys.KEYCODE.ONDOWN,
+    FF_CMD:       Keys.KEYCODE.FF_CMD      + Keys.KEYCODE.ONDOWN,
+    SYSREQ:       Keys.KEYCODE.ESC         + Keys.KEYCODE.FAKE,
+    CTRL_C:       Keys.ASCII.CTRL_C        + Keys.KEYCODE.FAKE,
+    CTRL_BREAK:   Keys.KEYCODE.BS          + Keys.KEYCODE.FAKE,
+    CTRL_ALT_DEL: Keys.KEYCODE.DEL         + Keys.KEYCODE.FAKE,
+    CTRL_ALT_INS: Keys.KEYCODE.INS         + Keys.KEYCODE.FAKE,
+    CTRL_ALT_ENTER: Keys.KEYCODE.CR        + Keys.KEYCODE.FAKE
+};
+
+/*
+ * Scan code constants
+ */
+Keyboard.SCANCODE = {
+    /* 0x01 */ ESC:         1,
+    /* 0x02 */ ONE:         2,
+    /* 0x03 */ TWO:         3,
+    /* 0x04 */ THREE:       4,
+    /* 0x05 */ FOUR:        5,
+    /* 0x06 */ FIVE:        6,
+    /* 0x07 */ SIX:         7,
+    /* 0x08 */ SEVEN:       8,
+    /* 0x09 */ EIGHT:       9,
+    /* 0x0A */ NINE:        10,
+    /* 0x0B */ ZERO:        11,
+    /* 0x0C */ DASH:        12,
+    /* 0x0D */ EQUALS:      13,
+    /* 0x0E */ BS:          14,
+    /* 0x0F */ TAB:         15,
+    /* 0x10 */ Q:           16,
+    /* 0x11 */ W:           17,
+    /* 0x12 */ E:           18,
+    /* 0x13 */ R:           19,
+    /* 0x14 */ T:           20,
+    /* 0x15 */ Y:           21,
+    /* 0x16 */ U:           22,
+    /* 0x17 */ I:           23,
+    /* 0x18 */ O:           24,
+    /* 0x19 */ P:           25,
+    /* 0x1A */ LBRACK:      26,
+    /* 0x1B */ RBRACK:      27,
+    /* 0x1C */ ENTER:       28,
+    /* 0x1D */ CTRL:        29,
+    /* 0x1E */ A:           30,
+    /* 0x1F */ S:           31,
+    /* 0x20 */ D:           32,
+    /* 0x21 */ F:           33,
+    /* 0x22 */ G:           34,
+    /* 0x23 */ H:           35,
+    /* 0x24 */ J:           36,
+    /* 0x25 */ K:           37,
+    /* 0x26 */ L:           38,
+    /* 0x27 */ SEMI:        39,
+    /* 0x28 */ QUOTE:       40,
+    /* 0x29 */ BQUOTE:      41,
+    /* 0x2A */ SHIFT:       42,
+    /* 0x2B */ BSLASH:      43,
+    /* 0x2C */ Z:           44,
+    /* 0x2D */ X:           45,
+    /* 0x2E */ C:           46,
+    /* 0x2F */ V:           47,
+    /* 0x30 */ B:           48,
+    /* 0x31 */ N:           49,
+    /* 0x32 */ M:           50,
+    /* 0x33 */ COMMA:       51,
+    /* 0x34 */ PERIOD:      52,
+    /* 0x35 */ SLASH:       53,
+    /* 0x36 */ RSHIFT:      54,
+    /* 0x37 */ PRTSC:       55,         // unshifted '*'; becomes dedicated 'Print Screen' key on 101-key keyboards
+    /* 0x38 */ ALT:         56,
+    /* 0x39 */ SPACE:       57,
+    /* 0x3A */ CAPS_LOCK:   58,
+    /* 0x3B */ F1:          59,
+    /* 0x3C */ F2:          60,
+    /* 0x3D */ F3:          61,
+    /* 0x3E */ F4:          62,
+    /* 0x3F */ F5:          63,
+    /* 0x40 */ F6:          64,
+    /* 0x41 */ F7:          65,
+    /* 0x42 */ F8:          66,
+    /* 0x43 */ F9:          67,
+    /* 0x44 */ F10:         68,
+    /* 0x45 */ NUM_LOCK:    69,
+    /* 0x46 */ SCROLL_LOCK: 70,
+    /* 0x47 */ NUM_HOME:    71,
+    /* 0x48 */ NUM_UP:      72,
+    /* 0x49 */ NUM_PGUP:    73,
+    /* 0x4A */ NUM_SUB:     74,
+    /* 0x4B */ NUM_LEFT:    75,
+    /* 0x4C */ NUM_CENTER:  76,
+    /* 0x4D */ NUM_RIGHT:   77,
+    /* 0x4E */ NUM_ADD:     78,
+    /* 0x4F */ NUM_END:     79,
+    /* 0x50 */ NUM_DOWN:    80,
+    /* 0x51 */ NUM_PGDN:    81,
+    /* 0x52 */ NUM_INS:     82,
+    /* 0x53 */ NUM_DEL:     83,
+    /* 0x54 */ SYSREQ:      84,         // 84-key keyboard only (simulated with 'alt'+'prtsc' on 101-key keyboards)
+    /* 0x54 */ PAUSE:       84,         // 101-key keyboard only
+    /* 0x57 */ F11:         87,
+    /* 0x58 */ F12:         88,
+    /* 0x5B */ WIN:         91,         // aka CMD
+    /* 0x5C */ RWIN:        92,
+    /* 0x5D */ MENU:        93,         // aka CMD + ONRIGHT
+    /* 0x7F */ MAKE:        127,
+    /* 0x80 */ BREAK:       128,
+    /* 0xE0 */ EXTEND1:     224,
+    /* 0xE1 */ EXTEND2:     225
+};
+
+/**
+ * These internal "shift key" states are used to indicate BOTH the physical shift-key states (in bitsState)
+ * and the simulated shift-key states (in bitsStateSim).  The LOCK keys are problematic in both cases: the
+ * browsers give us no way to query the LOCK key states, so we can only infer them, and because they are "soft"
+ * locks, the machine's notion of their state is subject to change at any time as well.  Granted, the IBM PC
+ * ROM BIOS will store its LOCK states in the ROM BIOS Data Area (@0040:0017), but that's just a BIOS convention.
+ *
+ * Also, because this is purely for internal use, don't make the mistake of thinking that these bits have any
+ * connection to the ROM BIOS bits @0040:0017 (they don't).  We emulate hardware, not ROMs.
+ *
+ * TODO: Consider taking notice of the ROM BIOS Data Area state anyway, even though I'd rather remain ROM-agnostic;
+ * at the very least, it would help us keep our LOCK LEDs in sync with the machine's LOCK states.  However, the LED
+ * issue will be largely moot (at least for MODEL_5170 machines) once we add support for PC AT keyboard LED commands.
+ *
+ * Note that right-hand state bits are equal to the left-hand bits shifted right 1 bit; makes sense, "right"? ;-)
+ *
+ * @enum {number}
+ */
+Keyboard.STATE = {
+    RSHIFT:         0x0001,
+    SHIFT:          0x0002,
+    SHIFTS:         0x0003,
+    RCTRL:          0x0004,             // 101-key keyboard only
+    CTRL:           0x0008,
+    CTRLS:          0x000C,
+    RALT:           0x0010,             // 101-key keyboard only
+    ALT:            0x0020,
+    ALTS:           0x0030,
+    RCMD:           0x0040,             // 101-key keyboard only
+    CMD:            0x0080,             // 101-key keyboard only
+    CMDS:           0x00C0,
+    ALL_RIGHT:      0x0055,             // RSHIFT | RCTRL | RALT | RCMD
+    ALL_SHIFT:      0x00FF,             // SHIFT | RSHIFT | CTRL | RCTRL | ALT | RALT | CMD | RCMD
+    INSERT:         0x0100,             // TODO: Placeholder (we currently have no notion of any "insert" states)
+    CAPS_LOCK:      0x0200,
+    NUM_LOCK:       0x0400,
+    SCROLL_LOCK:    0x0800,
+    ALL_LOCKS:      0x0E00              // CAPS_LOCK | NUM_LOCK | SCROLL_LOCK
+};
+
+/**
+ * Maps KEYCODES of shift/modifier keys to their corresponding (default) STATES bit above.
+ *
+ * @enum {number}
+ */
+Keyboard.KEYSTATES = {};
+Keyboard.KEYSTATES[Keyboard.SIMCODE.RSHIFT]      = Keyboard.STATE.RSHIFT;
+Keyboard.KEYSTATES[Keyboard.SIMCODE.SHIFT]       = Keyboard.STATE.SHIFT;
+Keyboard.KEYSTATES[Keyboard.SIMCODE.CTRL]        = Keyboard.STATE.CTRL;
+Keyboard.KEYSTATES[Keyboard.SIMCODE.ALT]         = Keyboard.STATE.ALT;
+Keyboard.KEYSTATES[Keyboard.SIMCODE.CMD]         = Keyboard.STATE.CMD;
+Keyboard.KEYSTATES[Keyboard.SIMCODE.RCMD]        = Keyboard.STATE.RCMD;
+Keyboard.KEYSTATES[Keyboard.SIMCODE.FF_CMD]      = Keyboard.STATE.CMD;
+Keyboard.KEYSTATES[Keyboard.SIMCODE.CAPS_LOCK]   = Keyboard.STATE.CAPS_LOCK;
+Keyboard.KEYSTATES[Keyboard.SIMCODE.NUM_LOCK]    = Keyboard.STATE.NUM_LOCK;
+Keyboard.KEYSTATES[Keyboard.SIMCODE.SCROLL_LOCK] = Keyboard.STATE.SCROLL_LOCK;
+
+/**
+ * Maps CLICKCODE (string) to SIMCODE (number).
+ *
+ * NOTE: Unlike SOFTCODES, CLICKCODES are upper-case and use underscores instead of dashes, so that this
+ * and other components can reference them using "dot" property syntax; using upper-case merely adheres to
+ * our convention for constants.  setBinding() will automatically convert any incoming CLICKCODE bindings
+ * that use lower-case and dashes to upper-case and underscores before performing property lookup.
+ *
+ * @enum {number}
+ */
+Keyboard.CLICKCODES = {
+    'TAB':          Keyboard.SIMCODE.TAB,
+    'ESC':          Keyboard.SIMCODE.ESC,
+    'F1':           Keyboard.SIMCODE.F1,
+    'F2':           Keyboard.SIMCODE.F2,
+    'F3':           Keyboard.SIMCODE.F3,
+    'F4':           Keyboard.SIMCODE.F4,
+    'F5':           Keyboard.SIMCODE.F5,
+    'F6':           Keyboard.SIMCODE.F6,
+    'F7':           Keyboard.SIMCODE.F7,
+    'F8':           Keyboard.SIMCODE.F8,
+    'F9':           Keyboard.SIMCODE.F9,
+    'F10':          Keyboard.SIMCODE.F10,
+    'LEFT':         Keyboard.SIMCODE.LEFT,      // formerly "left-arrow"
+    'UP':           Keyboard.SIMCODE.UP,        // formerly "up-arrow"
+    'RIGHT':        Keyboard.SIMCODE.RIGHT,     // formerly "right-arrow"
+    'DOWN':         Keyboard.SIMCODE.DOWN,      // formerly "down-arrow"
+    'SYSREQ':       Keyboard.SIMCODE.SYSREQ,
+    /*
+     * These bindings are for convenience (common key combinations that can be bound to a single control)
+     */
+    'CTRL_C':       Keyboard.SIMCODE.CTRL_C,
+    'CTRL_BREAK':   Keyboard.SIMCODE.CTRL_BREAK,
+    'CTRL_ALT_DEL': Keyboard.SIMCODE.CTRL_ALT_DEL,
+    'CTRL_ALT_INS': Keyboard.SIMCODE.CTRL_ALT_INS,
+    'CTRL_ALT_ENTER':   Keyboard.SIMCODE.CTRL_ALT_ENTER
+};
+
+/**
+ * Maps SOFTCODE (string) to KEYCODE or SIMCODE (number).
+ *
+ * We define identifiers for all possible keys, based on their primary (unshifted) character or function.
+ * This also serves as a definition of all supported keys, making it possible to create full-featured
+ * "soft keyboards".
+ *
+ * One exception to the (unshifted) rule above is 'prtsc': on the original IBM 83-key and 84-key keyboards,
+ * its primary (unshifted) character was '*', but on 101-key keyboards, it became a separate key ('prtsc',
+ * now labeled "Print Screen"), as did the num-pad '*' ('num-mul'), so 'prtsc' seems worthy of an exception
+ * to the rule.
+ *
+ * On 83-key and 84-key keyboards, 'ctrl'+'num-lock' triggered a "pause" operation and 'ctrl'+'scroll-lock'
+ * triggered a "break" operation.
+ *
+ * On 101-key keyboards, IBM decided to move both those special operations to a new 'pause' ("Pause/Break")
+ * key, near the new dedicated 'prtsc' ("Print Screen/SysRq") key -- and to drop the "e" from "SysReq".
+ * Those keys behave as follows:
+ *
+ *      When 'pause' is pressed alone, it generates 0xe1 0x1d 0x45 0xe1 0x9d 0xc5 on make (nothing on break),
+ *      which essentially simulates the make-and-break of the 'ctrl' and 'num-lock' keys (ignoring the 0xe1),
+ *      triggering a "pause" operation.
+ *
+ *      When 'pause' is pressed with 'ctrl', it generates 0xe0 0x46 0xe0 0xc6 on make (nothing on break) and
+ *      does not repeat, which essentially simulates the make-and-break of 'scroll-lock', which, in conjunction
+ *      with the separate make-and-break of 'ctrl', triggers a "break" operation.
+ *
+ *      When 'prtsc' is pressed alone, it generates 0xe0 0x2a 0xe0 0x37, simulating the make of both 'shift'
+ *      and 'prtsc'; when pressed with 'shift' or 'ctrl', it generates only 0xe0 0x37; and when pressed with
+ *      'alt', it generates only 0x54 (to simulate 'sysreq').
+ *
+ *      TODO: Implement the above behaviors.
+ *
+ * All key identifiers must be quotable using single-quotes, because that's how components.xsl will encode them
+ * *inside* the "data-value" attribute of the corresponding HTML control.  Which, in turn, is why the single-quote
+ * key is defined as 'quote' rather than "'".  Similarly, if there was unshifted "double-quote" key, it could
+ * not be called '"', because components.xsl quotes the *entire* "data-value" attribute using double-quotes.
+ *
+ * In the (informal) numbering of keys below, two keys are deliberately numbered 84, reflecting the fact that
+ * the 'sysreq' key was added to the 84-key keyboard but then dropped from the 101-key keyboard as a stand-alone key.
+ *
+ * @enum {number}
+ */
+Keyboard.SOFTCODES = {
+    /*  1 */    'esc':          Keyboard.SIMCODE.ESC,
+    /*  2 */    '1':            Keys.ASCII['1'],
+    /*  3 */    '2':            Keys.ASCII['2'],
+    /*  4 */    '3':            Keys.ASCII['3'],
+    /*  5 */    '4':            Keys.ASCII['4'],
+    /*  6 */    '5':            Keys.ASCII['5'],
+    /*  7 */    '6':            Keys.ASCII['6'],
+    /*  8 */    '7':            Keys.ASCII['7'],
+    /*  9 */    '8':            Keys.ASCII['8'],
+    /* 10 */    '9':            Keys.ASCII['9'],
+    /* 11 */    '0':            Keys.ASCII['0'],
+    /* 12 */    '-':            Keys.ASCII['-'],
+    /* 13 */    '=':            Keys.ASCII['='],
+    /* 14 */    'bs':           Keyboard.SIMCODE.BS,
+    /* 15 */    'tab':          Keyboard.SIMCODE.TAB,
+    /* 16 */    'q':            Keys.ASCII.Q,
+    /* 17 */    'w':            Keys.ASCII.W,
+    /* 18 */    'e':            Keys.ASCII.E,
+    /* 19 */    'r':            Keys.ASCII.R,
+    /* 20 */    't':            Keys.ASCII.T,
+    /* 21 */    'y':            Keys.ASCII.Y,
+    /* 22 */    'u':            Keys.ASCII.U,
+    /* 23 */    'i':            Keys.ASCII.I,
+    /* 24 */    'o':            Keys.ASCII.O,
+    /* 25 */    'p':            Keys.ASCII.P,
+    /* 26 */    '[':            Keys.ASCII['['],
+    /* 27 */    ']':            Keys.ASCII[']'],
+    /* 28 */    'enter':        Keys.KEYCODE.CR,
+    /* 29 */    'ctrl':         Keyboard.SIMCODE.CTRL,
+    /* 30 */    'a':            Keys.ASCII.A,
+    /* 31 */    's':            Keys.ASCII.S,
+    /* 32 */    'd':            Keys.ASCII.D,
+    /* 33 */    'f':            Keys.ASCII.F,
+    /* 34 */    'g':            Keys.ASCII.G,
+    /* 35 */    'h':            Keys.ASCII.H,
+    /* 36 */    'j':            Keys.ASCII.J,
+    /* 37 */    'k':            Keys.ASCII.K,
+    /* 38 */    'l':            Keys.ASCII.L,
+    /* 39 */    ';':            Keys.ASCII[';'],
+    /* 40 */    'quote':        Keys.ASCII["'"],                // formerly "squote"
+    /* 41 */    '`':            Keys.ASCII['`'],                // formerly "bquote"
+    /* 42 */    'shift':        Keyboard.SIMCODE.SHIFT,         // formerly "lshift"
+    /* 43 */    '\\':           Keys.ASCII['\\'],               // formerly "bslash"
+    /* 44 */    'z':            Keys.ASCII.Z,
+    /* 45 */    'x':            Keys.ASCII.X,
+    /* 46 */    'c':            Keys.ASCII.C,
+    /* 47 */    'v':            Keys.ASCII.V,
+    /* 48 */    'b':            Keys.ASCII.B,
+    /* 49 */    'n':            Keys.ASCII.N,
+    /* 50 */    'm':            Keys.ASCII.M,
+    /* 51 */    ',':            Keys.ASCII[','],
+    /* 52 */    '.':            Keys.ASCII['.'],
+    /* 53 */    '/':            Keys.ASCII['/'],
+    /* 54 */    'right-shift':  Keyboard.SIMCODE.RSHIFT,        // formerly "rshift"
+    /* 55 */    'prtsc':        Keyboard.SIMCODE.PRTSC,         // unshifted '*'; becomes dedicated 'Print Screen' key on 101-key keyboards
+    /* 56 */    'alt':          Keyboard.SIMCODE.ALT,
+    /* 57 */    'space':        Keyboard.SIMCODE.SPACE,
+    /* 58 */    'caps-lock':    Keyboard.SIMCODE.CAPS_LOCK,
+    /* 59 */    'f1':           Keyboard.SIMCODE.F1,
+    /* 60 */    'f2':           Keyboard.SIMCODE.F2,
+    /* 61 */    'f3':           Keyboard.SIMCODE.F3,
+    /* 62 */    'f4':           Keyboard.SIMCODE.F4,
+    /* 63 */    'f5':           Keyboard.SIMCODE.F5,
+    /* 64 */    'f6':           Keyboard.SIMCODE.F6,
+    /* 65 */    'f7':           Keyboard.SIMCODE.F7,
+    /* 66 */    'f8':           Keyboard.SIMCODE.F8,
+    /* 67 */    'f9':           Keyboard.SIMCODE.F9,
+    /* 68 */    'f10':          Keyboard.SIMCODE.F10,
+    /* 69 */    'num-lock':     Keyboard.SIMCODE.NUM_LOCK,
+    /* 70 */    'scroll-lock':  Keyboard.SIMCODE.SCROLL_LOCK,   // TODO: 0xe046 on 101-key keyboards?
+    /* 71 */    'num-home':     Keyboard.SIMCODE.HOME,          // formerly "home"
+    /* 72 */    'num-up':       Keyboard.SIMCODE.UP,            // formerly "up-arrow"
+    /* 73 */    'num-pgup':     Keyboard.SIMCODE.PGUP,          // formerly "page-up"
+    /* 74 */    'num-sub':      Keyboard.SIMCODE.NUM_SUB,       // formerly "num-minus"
+    /* 75 */    'num-left':     Keyboard.SIMCODE.LEFT,          // formerly "left-arrow"
+    /* 76 */    'num-center':   Keyboard.SIMCODE.NUM_CENTER,    // formerly "center"
+    /* 77 */    'num-right':    Keyboard.SIMCODE.RIGHT,         // formerly "right-arrow"
+    /* 78 */    'num-add':      Keyboard.SIMCODE.NUM_ADD,       // formerly "num-plus"
+    /* 79 */    'num-end':      Keyboard.SIMCODE.END,           // formerly "end"
+    /* 80 */    'num-down':     Keyboard.SIMCODE.DOWN,          // formerly "down-arrow"
+    /* 81 */    'num-pgdn':     Keyboard.SIMCODE.PGDN,          // formerly "page-down"
+    /* 82 */    'num-ins':      Keyboard.SIMCODE.INS,           // formerly "ins"
+    /* 83 */    'num-del':      Keyboard.SIMCODE.DEL,           // formerly "del"
+    /* 84 */    'sysreq':       Keyboard.SCANCODE.SYSREQ        // 84-key keyboard only (simulated with 'alt'+'prtsc' on 101-key keyboards)
+//  /* 84 */    'pause':        Keyboard.SCANCODE.PAUSE,        // 101-key keyboard only
+//  /* 85 */    'f11':          Keyboard.SCANCODE.F11,
+//  /* 86 */    'f12':          Keyboard.SCANCODE.F12,
+//  /* 87 */    'num-enter':    Keyboard.SCANCODE.EXTEND1 | (Keyboard.SCANCODE.ENTER << 8),
+//  /* 88 */    'right-ctrl':   Keyboard.SCANCODE.EXTEND1 | (Keyboard.SCANCODE.CTRL << 8),
+//  /* 89 */    'num-div':      Keyboard.SCANCODE.EXTEND1 | (Keyboard.SCANCODE.SLASH << 8),
+//  /* 90 */    'num-mul':      Keyboard.SCANCODE.EXTEND1 | (Keyboard.SCANCODE.PRTSC << 8),
+//  /* 91 */    'right-alt':    Keyboard.SCANCODE.EXTEND1 | (Keyboard.SCANCODE.ALT << 8),
+//  /* 92 */    'home':         Keyboard.SCANCODE.EXTEND1 | (Keyboard.SCANCODE.NUM_HOME << 8),
+//  /* 93 */    'up':           Keyboard.SCANCODE.EXTEND1 | (Keyboard.SCANCODE.NUM_UP << 8),
+//  /* 94 */    'pgup':         Keyboard.SCANCODE.EXTEND1 | (Keyboard.SCANCODE.NUM_PGUP << 8),
+//  /* 95 */    'left':         Keyboard.SCANCODE.EXTEND1 | (Keyboard.SCANCODE.NUM_LEFT << 8),
+//  /* 96 */    'right':        Keyboard.SCANCODE.EXTEND1 | (Keyboard.SCANCODE.NUM_RIGHT << 8),
+//  /* 97 */    'end':          Keyboard.SCANCODE.EXTEND1 | (Keyboard.SCANCODE.NUM_END << 8),
+//  /* 98 */    'down':         Keyboard.SCANCODE.EXTEND1 | (Keyboard.SCANCODE.NUM_DOWN << 8),
+//  /* 99 */    'pgdn':         Keyboard.SCANCODE.EXTEND1 | (Keyboard.SCANCODE.NUM_PGDN << 8),
+//  /*100 */    'ins':          Keyboard.SCANCODE.EXTEND1 | (Keyboard.SCANCODE.NUM_INS << 8),
+//  /*101 */    'del':          Keyboard.SCANCODE.EXTEND1 | (Keyboard.SCANCODE.NUM_DEL << 8),
+//              'win':          Keyboard.SCANCODE.EXTEND1 | (Keyboard.SCANCODE.WIN << 8),
+//              'right-win':    Keyboard.SCANCODE.EXTEND1 | (Keyboard.SCANCODE.RWIN << 8),
+//              'menu':         Keyboard.SCANCODE.EXTEND1 | (Keyboard.SCANCODE.MENU << 8)
+};
+
+/**
+ * Maps "soft-key" definitions (above) of shift/modifier keys to their corresponding (default) STATES bit.
+ *
+ * @enum {number}
+ */
+Keyboard.LEDSTATES = {
+    'caps-lock':    Keyboard.STATE.CAPS_LOCK,
+    'num-lock':     Keyboard.STATE.NUM_LOCK,
+    'scroll-lock':  Keyboard.STATE.SCROLL_LOCK
+};
+
+/**
+ * Maps SIMCODE (number) to SCANCODE (number(s)).
+ *
+ * This array is used by keySimulate() to lookup a given SIMCODE and convert it to a SCANCODE
+ * (lower byte), plus any required shift key SCANCODES (upper bytes).
+ *
+ * Using keyCodes from keyPress events proved to be more robust than using keyCodes from keyDown and
+ * keyUp events, in part because of differences in the way browsers generate the keyDown and keyUp events.
+ * For example, Safari on iOS devices will not generate up/down events for shift keys, and for other keys,
+ * the up/down events are usually generated after the actual press is complete, and in rapid succession.
+ *
+ * The other problem (which is more of a problem with keyboards like the C1P than any IBM keyboards) is
+ * that the shift/modifier state for a character on the "source" keyboard may not match the shift/modifier
+ * state for the same character on the "target" keyboard.  And since this code is inherited from C1Pjs,
+ * we've inherited the same solution: keySimulate() has the ability to "undo" any states in bitsState
+ * that conflict with the state(s) required for the character in question.
+ *
+ * @enum {number}
+ */
+Keyboard.SIMCODES = {};
+Keyboard.SIMCODES[Keyboard.SIMCODE.ESC]         = Keyboard.SCANCODE.ESC;
+Keyboard.SIMCODES[Keys.ASCII['1']]              = Keyboard.SCANCODE.ONE;
+Keyboard.SIMCODES[Keys.ASCII['!']]              = Keyboard.SCANCODE.ONE    | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII['2']]              = Keyboard.SCANCODE.TWO;
+Keyboard.SIMCODES[Keys.ASCII['@']]              = Keyboard.SCANCODE.TWO    | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII['3']]              = Keyboard.SCANCODE.THREE;
+Keyboard.SIMCODES[Keys.ASCII['#']]              = Keyboard.SCANCODE.THREE  | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII['4']]              = Keyboard.SCANCODE.FOUR;
+Keyboard.SIMCODES[Keys.ASCII['$']]              = Keyboard.SCANCODE.FOUR   | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII['5']]              = Keyboard.SCANCODE.FIVE;
+Keyboard.SIMCODES[Keys.ASCII['%']]              = Keyboard.SCANCODE.FIVE   | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII['6']]              = Keyboard.SCANCODE.SIX;
+Keyboard.SIMCODES[Keys.ASCII['^']]              = Keyboard.SCANCODE.SIX    | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII['7']]              = Keyboard.SCANCODE.SEVEN;
+Keyboard.SIMCODES[Keys.ASCII['&']]              = Keyboard.SCANCODE.SEVEN  | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII['8']]              = Keyboard.SCANCODE.EIGHT;
+Keyboard.SIMCODES[Keys.ASCII['*']]              = Keyboard.SCANCODE.EIGHT  | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII['9']]              = Keyboard.SCANCODE.NINE;
+Keyboard.SIMCODES[Keys.ASCII['(']]              = Keyboard.SCANCODE.NINE   | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII['0']]              = Keyboard.SCANCODE.ZERO;
+Keyboard.SIMCODES[Keys.ASCII[')']]              = Keyboard.SCANCODE.ZERO   | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII['-']]              = Keyboard.SCANCODE.DASH;
+Keyboard.SIMCODES[Keys.ASCII['_']]              = Keyboard.SCANCODE.DASH   | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII['=']]              = Keyboard.SCANCODE.EQUALS;
+Keyboard.SIMCODES[Keys.ASCII['+']]              = Keyboard.SCANCODE.EQUALS | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keyboard.SIMCODE.BS]          = Keyboard.SCANCODE.BS;
+Keyboard.SIMCODES[Keyboard.SIMCODE.TAB]         = Keyboard.SCANCODE.TAB;
+Keyboard.SIMCODES[Keys.ASCII.q]                 = Keyboard.SCANCODE.Q;
+Keyboard.SIMCODES[Keys.ASCII.Q]                 = Keyboard.SCANCODE.Q      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.w]                 = Keyboard.SCANCODE.W;
+Keyboard.SIMCODES[Keys.ASCII.W]                 = Keyboard.SCANCODE.W      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.e]                 = Keyboard.SCANCODE.E;
+Keyboard.SIMCODES[Keys.ASCII.E]                 = Keyboard.SCANCODE.E      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.r]                 = Keyboard.SCANCODE.R;
+Keyboard.SIMCODES[Keys.ASCII.R]                 = Keyboard.SCANCODE.R      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.t]                 = Keyboard.SCANCODE.T;
+Keyboard.SIMCODES[Keys.ASCII.T]                 = Keyboard.SCANCODE.T      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.y]                 = Keyboard.SCANCODE.Y;
+Keyboard.SIMCODES[Keys.ASCII.Y]                 = Keyboard.SCANCODE.Y      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.u]                 = Keyboard.SCANCODE.U;
+Keyboard.SIMCODES[Keys.ASCII.U]                 = Keyboard.SCANCODE.U      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.i]                 = Keyboard.SCANCODE.I;
+Keyboard.SIMCODES[Keys.ASCII.I]                 = Keyboard.SCANCODE.I      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.o]                 = Keyboard.SCANCODE.O;
+Keyboard.SIMCODES[Keys.ASCII.O]                 = Keyboard.SCANCODE.O      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.p]                 = Keyboard.SCANCODE.P;
+Keyboard.SIMCODES[Keys.ASCII.P]                 = Keyboard.SCANCODE.P      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII['[']]              = Keyboard.SCANCODE.LBRACK;
+Keyboard.SIMCODES[Keys.ASCII['{']]              = Keyboard.SCANCODE.LBRACK | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII[']']]              = Keyboard.SCANCODE.RBRACK;
+Keyboard.SIMCODES[Keys.ASCII['}']]              = Keyboard.SCANCODE.RBRACK | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.KEYCODE.CR]              = Keyboard.SCANCODE.ENTER;
+Keyboard.SIMCODES[Keyboard.SIMCODE.CTRL]        = Keyboard.SCANCODE.CTRL;
+Keyboard.SIMCODES[Keys.ASCII.a]                 = Keyboard.SCANCODE.A;
+Keyboard.SIMCODES[Keys.ASCII.A]                 = Keyboard.SCANCODE.A      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.s]                 = Keyboard.SCANCODE.S;
+Keyboard.SIMCODES[Keys.ASCII.S]                 = Keyboard.SCANCODE.S      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.d]                 = Keyboard.SCANCODE.D;
+Keyboard.SIMCODES[Keys.ASCII.D]                 = Keyboard.SCANCODE.D      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.f]                 = Keyboard.SCANCODE.F;
+Keyboard.SIMCODES[Keys.ASCII.F]                 = Keyboard.SCANCODE.F      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.g]                 = Keyboard.SCANCODE.G;
+Keyboard.SIMCODES[Keys.ASCII.G]                 = Keyboard.SCANCODE.G      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.h]                 = Keyboard.SCANCODE.H;
+Keyboard.SIMCODES[Keys.ASCII.H]                 = Keyboard.SCANCODE.H      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.j]                 = Keyboard.SCANCODE.J;
+Keyboard.SIMCODES[Keys.ASCII.J]                 = Keyboard.SCANCODE.J      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.k]                 = Keyboard.SCANCODE.K;
+Keyboard.SIMCODES[Keys.ASCII.K]                 = Keyboard.SCANCODE.K      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.l]                 = Keyboard.SCANCODE.L;
+Keyboard.SIMCODES[Keys.ASCII.L]                 = Keyboard.SCANCODE.L      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII[';']]              = Keyboard.SCANCODE.SEMI;
+Keyboard.SIMCODES[Keys.ASCII[':']]              = Keyboard.SCANCODE.SEMI   | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII["'"]]              = Keyboard.SCANCODE.QUOTE;
+Keyboard.SIMCODES[Keys.ASCII['"']]              = Keyboard.SCANCODE.QUOTE  | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII['`']]              = Keyboard.SCANCODE.BQUOTE;
+Keyboard.SIMCODES[Keys.ASCII['~']]              = Keyboard.SCANCODE.BQUOTE | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keyboard.SIMCODE.SHIFT]       = Keyboard.SCANCODE.SHIFT;
+Keyboard.SIMCODES[Keys.ASCII['\\']]             = Keyboard.SCANCODE.BSLASH;
+Keyboard.SIMCODES[Keys.ASCII['|']]              = Keyboard.SCANCODE.BSLASH | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.z]                 = Keyboard.SCANCODE.Z;
+Keyboard.SIMCODES[Keys.ASCII.Z]                 = Keyboard.SCANCODE.Z      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.x]                 = Keyboard.SCANCODE.X;
+Keyboard.SIMCODES[Keys.ASCII.X]                 = Keyboard.SCANCODE.X      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.c]                 = Keyboard.SCANCODE.C;
+Keyboard.SIMCODES[Keys.ASCII.C]                 = Keyboard.SCANCODE.C      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.v]                 = Keyboard.SCANCODE.V;
+Keyboard.SIMCODES[Keys.ASCII.V]                 = Keyboard.SCANCODE.V      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.b]                 = Keyboard.SCANCODE.B;
+Keyboard.SIMCODES[Keys.ASCII.B]                 = Keyboard.SCANCODE.B      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.n]                 = Keyboard.SCANCODE.N;
+Keyboard.SIMCODES[Keys.ASCII.N]                 = Keyboard.SCANCODE.N      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII.m]                 = Keyboard.SCANCODE.M;
+Keyboard.SIMCODES[Keys.ASCII.M]                 = Keyboard.SCANCODE.M      | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII[',']]              = Keyboard.SCANCODE.COMMA;
+Keyboard.SIMCODES[Keys.ASCII['<']]              = Keyboard.SCANCODE.COMMA  | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII['.']]              = Keyboard.SCANCODE.PERIOD;
+Keyboard.SIMCODES[Keys.ASCII['>']]              = Keyboard.SCANCODE.PERIOD | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keys.ASCII['/']]              = Keyboard.SCANCODE.SLASH;
+Keyboard.SIMCODES[Keys.ASCII['?']]              = Keyboard.SCANCODE.SLASH  | (Keyboard.SCANCODE.SHIFT << 8);
+Keyboard.SIMCODES[Keyboard.SIMCODE.RSHIFT]      = Keyboard.SCANCODE.RSHIFT;
+Keyboard.SIMCODES[Keyboard.SIMCODE.PRTSC]       = Keyboard.SCANCODE.PRTSC;
+Keyboard.SIMCODES[Keyboard.SIMCODE.ALT]         = Keyboard.SCANCODE.ALT;
+Keyboard.SIMCODES[Keyboard.SIMCODE.SPACE]       = Keyboard.SCANCODE.SPACE;
+Keyboard.SIMCODES[Keyboard.SIMCODE.CAPS_LOCK]   = Keyboard.SCANCODE.CAPS_LOCK;
+Keyboard.SIMCODES[Keyboard.SIMCODE.F1]          = Keyboard.SCANCODE.F1;
+Keyboard.SIMCODES[Keyboard.SIMCODE.F2]          = Keyboard.SCANCODE.F2;
+Keyboard.SIMCODES[Keyboard.SIMCODE.F3]          = Keyboard.SCANCODE.F3;
+Keyboard.SIMCODES[Keyboard.SIMCODE.F4]          = Keyboard.SCANCODE.F4;
+Keyboard.SIMCODES[Keyboard.SIMCODE.F5]          = Keyboard.SCANCODE.F5;
+Keyboard.SIMCODES[Keyboard.SIMCODE.F6]          = Keyboard.SCANCODE.F6;
+Keyboard.SIMCODES[Keyboard.SIMCODE.F7]          = Keyboard.SCANCODE.F7;
+Keyboard.SIMCODES[Keyboard.SIMCODE.F8]          = Keyboard.SCANCODE.F8;
+Keyboard.SIMCODES[Keyboard.SIMCODE.F9]          = Keyboard.SCANCODE.F9;
+Keyboard.SIMCODES[Keyboard.SIMCODE.F10]         = Keyboard.SCANCODE.F10;
+Keyboard.SIMCODES[Keyboard.SIMCODE.NUM_LOCK]    = Keyboard.SCANCODE.NUM_LOCK;
+Keyboard.SIMCODES[Keyboard.SIMCODE.SCROLL_LOCK] = Keyboard.SCANCODE.SCROLL_LOCK;
+Keyboard.SIMCODES[Keyboard.SIMCODE.HOME]        = Keyboard.SCANCODE.NUM_HOME;
+Keyboard.SIMCODES[Keyboard.SIMCODE.UP]          = Keyboard.SCANCODE.NUM_UP;
+Keyboard.SIMCODES[Keyboard.SIMCODE.PGUP]        = Keyboard.SCANCODE.NUM_PGUP;
+Keyboard.SIMCODES[Keyboard.SIMCODE.NUM_SUB]     = Keyboard.SCANCODE.NUM_SUB;
+Keyboard.SIMCODES[Keyboard.SIMCODE.LEFT]        = Keyboard.SCANCODE.NUM_LEFT;
+Keyboard.SIMCODES[Keyboard.SIMCODE.NUM_CENTER]  = Keyboard.SCANCODE.NUM_CENTER;
+Keyboard.SIMCODES[Keyboard.SIMCODE.RIGHT]       = Keyboard.SCANCODE.NUM_RIGHT;
+Keyboard.SIMCODES[Keyboard.SIMCODE.NUM_ADD]     = Keyboard.SCANCODE.NUM_ADD;
+Keyboard.SIMCODES[Keyboard.SIMCODE.END]         = Keyboard.SCANCODE.NUM_END;
+Keyboard.SIMCODES[Keyboard.SIMCODE.DOWN]        = Keyboard.SCANCODE.NUM_DOWN;
+Keyboard.SIMCODES[Keyboard.SIMCODE.PGDN]        = Keyboard.SCANCODE.NUM_PGDN;
+Keyboard.SIMCODES[Keyboard.SIMCODE.INS]         = Keyboard.SCANCODE.NUM_INS;
+Keyboard.SIMCODES[Keyboard.SIMCODE.DEL]         = Keyboard.SCANCODE.NUM_DEL;
+Keyboard.SIMCODES[Keyboard.SIMCODE.SYSREQ]      = Keyboard.SCANCODE.SYSREQ;
+/*
+ * Entries beyond this point are for keys that existed only on 101-key keyboards (well, except for 'sysreq',
+ * which also existed on the 84-key keyboard), which ALSO means that these keys essentially did not exist
+ * for a MODEL_5150 or MODEL_5160 machine, because those machines could use only 83-key keyboards.  Remember
+ * that IBM machines and IBM keyboards are our reference point here, so while there were undoubtedly 5150/5160
+ * clones that could use newer keyboards, as well as 3rd-party keyboards that could work with older machines,
+ * support for non-IBM configurations is left for another day.
+ *
+ * TODO: The only relevance of newer keyboards to older machines is the fact that you're probably using a newer
+ * keyboard with your browser, which raises the question of what to do with newer keys that older machines
+ * wouldn't understand.  I don't attempt to filter out any of the entries below based on machine model, but that
+ * would seem like a wise thing to do.
+ *
+ * TODO: Add entries for 'num-mul', 'num-div', 'num-enter', the stand-alone arrow keys, etc, AND at the same time,
+ * make sure that keys with multi-byte sequences (eg, 0xe0 0x1c) work properly.
+ */
+Keyboard.SIMCODES[Keyboard.SIMCODE.F11]         = Keyboard.SCANCODE.F11;
+Keyboard.SIMCODES[Keyboard.SIMCODE.F12]         = Keyboard.SCANCODE.F12;
+Keyboard.SIMCODES[Keyboard.SIMCODE.CMD]         = Keyboard.SCANCODE.WIN;
+Keyboard.SIMCODES[Keyboard.SIMCODE.RCMD]        = Keyboard.SCANCODE.MENU;
+Keyboard.SIMCODES[Keyboard.SIMCODE.FF_CMD]      = Keyboard.SCANCODE.WIN;
+
+Keyboard.SIMCODES[Keyboard.SIMCODE.CTRL_C]          = Keyboard.SCANCODE.C           | (Keyboard.SCANCODE.CTRL << 8);
+Keyboard.SIMCODES[Keyboard.SIMCODE.CTRL_BREAK]      = Keyboard.SCANCODE.SCROLL_LOCK | (Keyboard.SCANCODE.CTRL << 8);
+Keyboard.SIMCODES[Keyboard.SIMCODE.CTRL_ALT_DEL]    = Keyboard.SCANCODE.NUM_DEL     | (Keyboard.SCANCODE.CTRL << 8) | (Keyboard.SCANCODE.ALT << 16);
+Keyboard.SIMCODES[Keyboard.SIMCODE.CTRL_ALT_INS]    = Keyboard.SCANCODE.NUM_INS     | (Keyboard.SCANCODE.CTRL << 8) | (Keyboard.SCANCODE.ALT << 16);
+Keyboard.SIMCODES[Keyboard.SIMCODE.CTRL_ALT_ENTER]  = Keyboard.SCANCODE.ENTER       | (Keyboard.SCANCODE.CTRL << 8) | (Keyboard.SCANCODE.ALT << 16);
+
+/**
+ * Commands that can be sent to the Keyboard via the 8042; see sendCmd()
+ *
+ * Aside from the commands listed below, 0xEF-0xF2 and 0xF7-0xFD are expressly documented as NOPs; ie:
+ *
+ *      These commands are reserved and are effectively no-operation or NOP. The system does not use these codes.
+ *      If sent, the keyboard will acknowledge the command and continue in its prior scanning state. No other
+ *      operation will occur.
+ *
+ * However, IBM's documentation is silent with regard to 0x00-0xEC.  It's likely that most if not all of those
+ * commands are NOPs as well.
+ *
+ * @enum {number}
+ */
+Keyboard.CMD = {
+    /*
+     * RESET (0xFF)
+     *
+     * The system issues a RESET command to start a program reset and a keyboard internal self-test. The keyboard
+     * acknowledges the command with an 'acknowledge' signal (ACK) and ensures the system accepts the ACK before
+     * executing the command. The system signals acceptance of the ACK by raising the clock and data for a minimum
+     * of 500 microseconds. The keyboard is disabled from the time it receives the RESET command until the ACK is
+     * accepted or until another command overrides the previous one. Following acceptance of the ACK, the keyboard
+     * begins the reset operation, which is similar to a power-on reset. The keyboard clears the output buffer and
+     * sets up default values for typematic and delay rates.
+     */
+    RESET:      0xFF,
+
+    /*
+     * RESEND (0xFE)
+     *
+     * The system can send this command when it detects an error in any transmission from the keyboard. It can be
+     * sent only after a keyboard transmission and before the system enables the interface to allow the next keyboard
+     * output. Upon receipt of RESEND, the keyboard sends the previous output again unless the previous output was
+     * RESEND. In this case, the keyboard will resend the last byte before the RESEND command.
+     */
+    RESEND:     0xFE,
+
+    /*
+     * SET DEFAULT (0xF6)
+     *
+     * The SET DEFAULT command resets all conditions to the power-on default state. The keyboard responds with ACK,
+     * clears its output buffer, sets default conditions, and continues scanning (only if the keyboard was previously
+     * enabled).
+     */
+    DEF_ON:     0xF6,
+
+    /*
+     * DEFAULT DISABLE (0xF5)
+     *
+     * This command is similar to SET DEFAULT, except the keyboard stops scanning and awaits further instructions.
+     */
+    DEF_OFF:    0xF5,
+
+    /*
+     * ENABLE (0xF4)
+     *
+     * Upon receipt of this command, the keyboard responds with ACK, clears its output buffer, and starts scanning.
+     */
+    ENABLE:     0xF4,
+
+    /*
+     * SET TYPEMATIC RATE/DELAY (0xF3)
+     *
+     * The system issues this command, followed by a parameter, to change the typematic rate and delay. The typematic
+     * rate and delay parameters are determined by the value of the byte following the command. Bits 6 and 5 serve as
+     * the delay parameter and bits 4,3,2, 1, and 0 (the least-significant bit) are the rate parameter. Bit 7, the
+     * most-significant bit, is always 0. The delay is equal to 1 plus the binary value of bits 6 and 5 multiplied by
+     * 250 milliseconds ±20%.
+     */
+    SET_RATE:   0xF3,
+
+    /*
+     * ECHO (0xEE)
+     *
+     * ECHO is a diagnostic aid. When the keyboard receives this command, it issues a 0xEE response and continues
+     * scanning if the keyboard was previously enabled.
+     */
+    ECHO:       0xEE,
+
+    /*
+     * SET/RESET MODE INDICATORS (0xED)
+     *
+     * Three mode indicators on the keyboard are accessible to the system. The keyboard activates or deactivates
+     * these indicators when it receives a valid command from the system. They can be activated or deactivated in
+     * any combination.
+     *
+     * The system remembers the previous state of an indicator so that its setting does not change when a command
+     * sequence is issued to change the state of another indicator.
+     *
+     * A SET/RESET MODE INDICATORS command consists of 2 bytes. The first is the command byte and has the following
+     * bit setup:
+     *
+     *      11101101 - 0xED
+     *
+     * The second byte is an option byte. It has a list of the indicators to be acted upon. The bit assignments for
+     * this option byte are as follows:
+     *
+     *      Bit         Indicator
+     *      ---         ---------
+     *       0          Scroll Lock Indicator
+     *       1          Num Lock Indicator
+     *       2          Caps Lock Indicator
+     *      3-7         Reserved (must be 0's)
+     *
+     * NOTE: Bit 7 is the most-significant bit; bit 0 is the least-significant.
+     *
+     * The keyboard will respond to the set/reset mode indicators command with an ACK, discontinue scanning, and wait
+     * for the option byte. The keyboard will respond to the option byte with an ACK, set the indicators, and continue
+     * scanning if the keyboard was previously enabled. If another command is received in place of the option byte,
+     * execution of the function of the SET/RESET MODE INDICATORS command is stopped with no change to the indicator
+     * states, and the new command is processed. Then scanning is resumed.
+     */
+    SET_LEDS:   0xED
+};
+
+/**
+ * Command responses returned to the Keyboard via the 8042; see sendCmd()
+ *
+ * @enum {number}
+ */
+Keyboard.CMDRES = {
+    /*
+     * OVERRUN (0x00)
+     *
+     * An overrun character is placed in position 17 of the keyboard buffer, overlaying the last code if the
+     * buffer becomes full. The code is sent to the system as an overrun when it reaches the top of the buffer.
+     */
+    OVERRUN:    0x00,
+
+    LOAD_TEST:  0x65,   // undocumented "LOAD MANUFACTURING TEST REQUEST" response code
+
+    /*
+     * BAT Completion Code (0xAA)
+     *
+     * Following satisfactory completion of the BAT, the keyboard sends 0xAA. 0xFC (or any other code)
+     * means the keyboard microprocessor check failed.
+     */
+    BAT_OK:     0xAA,
+
+    /*
+     * ECHO Response (0xEE)
+     *
+     * This is sent in response to an ECHO command (also 0xEE) from the system.
+     */
+    ECHO:       0xEE,
+
+    /*
+     * BREAK CODE PREFIX (0xF0)
+     *
+     * This code is sent as the first byte of a 2-byte sequence to indicate the release of a key.
+     */
+    BREAK_PREF: 0xF0,
+
+    /*
+     * ACK (0xFA)
+     *
+     * The keyboard issues an ACK response to any valid input other than an ECHO or RESEND command.
+     * If the keyboard is interrupted while sending ACK, it will discard ACK and accept and respond
+     * to the new command.
+     */
+    ACK:        0xFA,
+
+    /*
+     * BASIC ASSURANCE TEST FAILURE (0xFC)
+     */
+    BAT_FAIL:   0xFC,   // TODO: Verify this response code (is this just for older 83-key keyboards?)
+
+    /*
+     * DIAGNOSTIC FAILURE (0xFD)
+     *
+     * The keyboard periodically tests the sense amplifier and sends a diagnostic failure code if it detects
+     * any problems. If a failure occurs during BAT, the keyboard stops scanning and waits for a system command
+     * or power-down to restart. If a failure is reported after scanning is enabled, scanning continues.
+     */
+    DIAG_FAIL:  0xFD,
+
+    /*
+     * RESEND (0xFE)
+     *
+     * The keyboard issues a RESEND command following receipt of an invalid input, or any input with incorrect parity.
+     * If the system sends nothing to the keyboard, no response is required.
+     */
+    RESEND:     0xFE,
+
+    BUFF_FULL:  0xFF    // TODO: Verify this response code (is this just for older 83-key keyboards?)
+};
+
+Keyboard.LIMIT = {
+    MAX_SCANCODES: 20   // TODO: Verify this limit for newer keyboards (84-key and up)
+};
+
+/*
+ * Initialize every Keyboard module on the page.
+ */
+Web.onInit(Keyboard.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/video.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * MDA/CGA Support
+ *
+ * Since there's a lot of similarity between the MDA and CGA (eg, their text-mode video buffer
+ * format, and their use of the 6845 CRT controller), since the MDA ROM contains the fonts used
+ * by both devices, and since the same ROM BIOS supports both (in fact, the BIOS indiscriminately
+ * initializes both, regardless which is actually installed), this same component emulates both
+ * devices.
+ *
+ * When no model is specified, this component supports the ability to dynamically switch between
+ * MDA and CGA emulation, by simply toggling the SW1 motherboard "monitor type" switch settings
+ * and resetting the machine.  In that model-less configuration, we install I/O port handlers for
+ * both MDA and CGA cards, regardless which monitor type is initially selected.
+ *
+ * To simulate an IBM PC containing both an MDA and CGA (ie, a "dual display" system), the machine
+ * configuration simply defines two video components, one with model "mda" and the other with model
+ * "cga", resulting in two displays; setting a specific model forces each instance of this component
+ * to register only those I/O ports belonging to that model.
+ *
+ * In a single-display system, dynamically switching cards (ie, between MDA and CGA) creates some
+ * visual challenges.  For one, the MDA prefers a native screen size of 720x350, as it supports only
+ * one video mode, 80x25, with a 9x14 cell size.  The CGA, on the other hand, has an 8x8 cell size,
+ * so when using an MDA-size screen, an 80x25 CGA screen will end up with 40-pixel borders on the
+ * left and right, and 75-pixel borders on the top and bottom.  The result is a rather tiny CGA font
+ * surrounded by lots of wasted space, so it's best to turn on font scaling (see the "scale" property)
+ * and go with a larger screen size of, say, 960x400 (50% larger in width, 100% larger in height).
+ *
+ * I've also added support for font-doubling in createFont().  We use the 8x8 font for 80-column
+ * modes and the "doubled" 16x16 font for 40-column modes OR whenever the screen is large enough
+ * to use the 16x16 font, since font rendering without scaling provides the sharpest results.
+ * In fact, there's special logic in setDimensions() to ignore fScaleFont in certain cases (eg,
+ * 40-column modes, to improve sharpness and avoid stretching the font beyond readability).
+ *
+ * Graphics modes, on the other hand, are always scaled to the screen size.  Pixels are captured
+ * in an off-screen buffer, which is then drawn to match the size of the virtual screen.
+ *
+ * TODO: Whenever there are borders, they should be filled with the CGA's overscan colors.  However,
+ * in the case of graphics modes (and text modes whenever font scaling is enabled), we don't reserve
+ * any space for borders, so if borders are important, explicit border support will be required.
+ */
+
+/*
+ * EGA Support
+ *
+ * EGA support piggy-backs on the existing MDA/CGA support.  All the existing MDA/CGA port handlers
+ * now refer to either cardMono or cardColor (instead of directly to cardMDA or cardCGA), enabling
+ * the handlers to be redirected to cardMDA, cardCGA or cardEGA as appropriate.
+ *
+ * Note that an MDA card supported only a Monochrome Display and a CGA card supported only a Color
+ * Display (well, OK, *or* a TV monitor, which we don't currently support), but the EGA is much
+ * more flexible: the Enhanced Color Display was the preferred display, but the EGA also supported
+ * older displays; a Color Display on EGA wasn't ideal (same low resolutions but with more colors),
+ * but the EGA also brought high-resolution graphics to Monochrome displays, which was nice.  Anyway,
+ * while all those EGA/monitor combinations will be nice to support, our virtual display support
+ * will focus initially on the Enhanced Color Display.
+ *
+ * TODO: Add support for jumpers P1 and P3 (see EGA TechRef p.85).  P1 selects either 5-color-output
+ * for a CGA monitor or 6-color-output for an EGA monitor; we would presumably use this only to
+ * control certain assumptions about the virtual display's capabilities (ie, Color Display vs. Enhanced
+ * Color Display).  P3 can switch all the I/O ports from 0x3nn to 0x2nn; the default is 0x3nn, and
+ * that's the only port range the EGA ROM supports as well.
+ */
+
+/*
+ * VGA Support
+ *
+ * More will be said here about PCjs VGA support later.  But first, a word from IBM: "Video Graphics Array [VGA]
+ * Programming Considerations":
+ *
+ *      Certain internal timings must be guaranteed by the user, in order to have the CRTC perform properly.
+ *      This is due to the physical design of the chip. These timings can be guaranteed by ensuring that the
+ *      rules listed below are followed when programming the CRTC.
+ *
+ *           1. The Horizontal Total [HTOTAL] register (R0) must be greater than or equal to a value of
+ *              25 decimal.
+ *
+ *           2. The minimum positive pulse width of the HSYNC output must be four character clock units.
+ *
+ *           3. Register R5, Horizontal Sync End [HRETRACE_END], must be programmed such that the HSYNC
+ *              output goes to a logic 0 a minimum of one character clock time before the 'horizontal display enable'
+ *              signal goes to a logical 1.
+ *
+ *           4. Register R16, Vsync Start [VRETRACE_START], must be a minimum of one horizontal scan line greater
+ *              than register R18 [VDISP_END].  Register R18 defines where the 'vertical display enable' signal ends.
+ *
+ *     When bit 5 of the Attribute Mode Control register equals 1, a successful line compare (see Line Compare
+ *     [LINE_COMPARE] register) in the CRT Controller forces the output of the PEL Panning register to 0's until Vsync
+ *     occurs.  When Vsync occurs, the output returns to the programmed value.  This allows the portion of the screen
+ *     indicated by the Line Compare register to be operated on by the PEL Panning register.
+ *
+ *     A write to the Character Map Select register becomes valid on the next whole character line.  No deformed
+ *     characters are displayed by changing character generators in the middle of a character scan line.
+ *
+ *     For 256-color 320 x 200 graphics mode hex 13, the attribute controller is configured so that the 8-bit attribute
+ *     stored in video memory for each PEL becomes the 8-bit address (P0 - P7) into the integrated DAC.  The user should
+ *     not modify the contents of the internal Palette registers when using this mode.
+ *
+ *     The following sequence should be followed when accessing any of the Attribute Data registers pointed to by the
+ *     Attribute Index register:
+ *
+ *           1. Disable interrupts
+ *           2. Reset read/write flip/flop
+ *           3. Write to Index register
+ *           4. Read from or write to a data register
+ *           5. Enable interrupts
+ *
+ *      The Color Select register in the Attribute Controller section may be used to rapidly switch between sets of colors
+ *      in the video DAC.  When bit 7 of the Attribute Mode Control register equals 0, the 8-bit color value presented to the
+ *      video DAC is composed of 6 bits from the internal Palette registers and bits 2 and 3 from the Color Select register.
+ *      When bit 7 of the Attribute Mode Control register equals 1, the 8-bit color value presented to the video DAC is
+ *      composed of the lower four bits from the internal Palette registers and the four bits in the Color Select register.
+ *      By changing the value in the Color Select register, software rapidly switches between sets of colors in the video DAC.
+ *      Note that BIOS does not support multiple sets of colors in the video DAC.  The user must load these colors if this
+ *      function is to be used.  Also see the Attribute Controller block diagram on page 4-26.  Note that the above discussion
+ *      applies to all modes except 256 Color Graphics mode.  In this mode the Color Select register is not used to switch
+ *      between sets of colors.
+ *
+ *      An application that saves the "Video State" must store the 4 bytes of information contained in the system microprocessor
+ *      latches in the graphics controller subsection. These latches are loaded with 32 bits from video memory (8 bits per map)
+ *      each time the system microprocessor does a read from video memory.  The application needs to:
+ *
+ *           1. Use write mode 1 to write the values in the latches to a location in video memory that is not part of
+ *              the display buffer.  The last location in the address range is a good choice.
+ *
+ *           2. Save the values of the latches by reading them back from video memory.
+ *
+ *           Note: If in a chain 4 or odd/even mode, it will be necessary to reconfigure the memory organization as four
+ *           sequential maps prior to performing the sequence above.  BIOS provides support for completely saving and
+ *           restoring video state.  See the IBM Personal System/2 and Personal Computer BIOS Interface Technical Reference
+ *           for more information.
+ *
+ *      The description of the Horizontal PEL Panning register includes a figure showing the number of PELs shifted left
+ *      for each valid value of the PEL Panning register and each valid video mode.  Further panning beyond that shown in
+ *      the figure may be accomplished by changing the start address in the CRT Controller registers, Start Address High
+ *      and Start Address Low.  The sequence involved in further panning would be as follows:
+ *
+ *           1. Use the PEL Panning register to shift the maximum number of bits to the left. See Figure 4-103 on page
+ *              4-106 for the appropriate values.
+ *
+ *           2. Increment the start address.
+ *
+ *           3. If you are not using Modes 0 + , 1 + , 2 + , 3 + ,7, or7 + , set the PEL Panning register to 0.  If you
+ *              are using these modes, set the PEL Panning register to 8.  The screen will now be shifted one PEL left
+ *              of the position it was in at the end of step 1.  Step 1 through Step 3 may be repeated as desired.
+ *
+ *      The Line Compare register (CRTC register hex 18) should be programmed with even values in 200 line modes when
+ *      used in split screen applications that scroll a second screen on top of a first screen.  This is a requirement
+ *      imposed by the scan doubling logic in the CRTC.
+ *
+ *      If the Cursor Start register (CRTC register hex 0A) is programmed with a value greater than that in the Cursor End
+ *      register (CRTC register hex 0B), then no cursor is displayed.  A split cursor is not possible.
+ *
+ *      In 8-dot character modes, the underline attribute produces a solid line across adjacent characters, as in the IBM
+ *      Color/Graphics Monitor Adapter, Monochrome Display Adapter and the Enhanced Graphics Adapter.  In 9-dot modes, the
+ *      underline across adjacent characters is dashed, as in the IBM 327X display terminals.  In 9-dot modes, the line
+ *      graphics characters (C0 - DF character codes) have solid underlines.
+ *
+ *      For compatibility with the IBM Enhanced Graphics Adapter (EGA), the internal VGA palette is programmed the same
+ *      as the EGA.  The video DAC is programmed by BIOS so that the compatible values in the internal VGA palette produce
+ *      a color compatible with what was produced by EGA.  Mode hex 13 (256 colors) is programmed so that the first 16
+ *      locations in the DAC produce compatible colors.
+ *
+ *      Summing: When BIOS is used to load the video DAC palette for a color mode and a monochrome display is connected
+ *      to the system unit, the color palette is changed.  The colors are summed to produce shades of gray that allow
+ *      color applications to produce a readable screen.
+ *
+ *      There are 4 bits that should not be modified unless the sequencer is reset by setting bit 1 of the Reset register
+ *      to 0.  These bits are:
+ *
+ *           • Bit 3, or bit 0 of the Clocking Mode register
+ *           • Bit 3, or bit 2 of the Miscellaneous Output register
+ *
+ * Also, for quick reference, IBM VGA register values for the standard VGA modes (from http://www.pcjs.org/blog/2015/06/01/):
+ *
+ *      INT 0x10 Mode Requested:    0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x0D 0x0E 0x10 0x12 0x13
+ *
+ *      BIOSMODE:                   0x01 0x01 0x03 0x03 0x04 0x04 0x06 0x0D 0x0E 0x10 0x12 0x13
+ *      CRTC[0x00]: HTOTAL          0x2D 0x2D 0x5F 0x5F 0x2D 0x2D 0x5F 0x2D 0x5F 0x5F 0x5F 0x5F
+ *      CRTC[0x01]: HDISP_END       0x27 0x27 0x4F 0x4F 0x27 0x27 0x4F 0x27 0x4F 0x4F 0x4F 0x4F
+ *      CRTC[0x02]: HBLANK_START    0x28 0x28 0x50 0x50 0x28 0x28 0x50 0x28 0x50 0x50 0x50 0x50
+ *      CRTC[0x03]: HBLANK_END      0x90 0x90 0x82 0x82 0x90 0x90 0x82 0x90 0x82 0x82 0x82 0x82
+ *      CRTC[0x04]: HRETRACE_START  0x2B 0x2B 0x55 0x55 0x2B 0x2B 0x54 0x2B 0x54 0x54 0x54 0x54
+ *      CRTC[0x05]: HRETRACE_END    0xA0 0xA0 0x81 0x81 0x80 0x80 0x80 0x80 0x80 0x80 0x80 0x80
+ *      CRTC[0x06]: VTOTAL          0xBF 0xBF 0xBF 0xBF 0xBF 0xBF 0xBF 0xBF 0xBF 0xBF 0x0B 0xBF
+ *      CRTC[0x07]: OVERFLOW        0x1F 0x1F 0x1F 0x1F 0x1F 0x1F 0x1F 0x1F 0x1F 0x1F 0x3E 0x1F
+ *      CRTC[0x08]: PRESET_ROW      0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+ *      CRTC[0x09]: MAX_SCAN        0x4F 0x4F 0x4F 0x4F 0xC1 0xC1 0xC1 0xC0 0xC0 0x40 0x40 0x41
+ *      CRTC[0x0A]: CURSOR_START    0x0D 0x0D 0x0D 0x0D 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+ *      CRTC[0x0B]: CURSOR_END      0x0E 0x0E 0x0E 0x0E 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+ *      CRTC[0x0C]: START_ADDR_HI   0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+ *      CRTC[0x0D]: START_ADDR_LO   0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+ *      CRTC[0x0E]: CURSOR_ADDR_HI  0x01 0x01 0x01 0x01 0x01 0x01 0x01 0x01 0x01 0x01 0x01 0x00
+ *      CRTC[0x0F]: CURSOR_ADDR_LO  0x19 0x19 0x41 0x41 0x19 0x19 0x41 0x19 0x41 0x41 0xE1 0xA2
+ *      CRTC[0x10]: VRETRACE_START  0x9C 0x9C 0x9C 0x9C 0x9C 0x9C 0x9C 0x9C 0x9C 0x83 0xEA 0x9C
+ *      CRTC[0x11]: VRETRACE_END    0x8E 0x8E 0x8E 0x8E 0x8E 0x8E 0x8E 0x8E 0x8E 0x85 0x8C 0x8E
+ *      CRTC[0x12]: VDISP_END       0x8F 0x8F 0x8F 0x8F 0x8F 0x8F 0x8F 0x8F 0x8F 0x5D 0xDF 0x8F
+ *      CRTC[0x13]: OFFSET          0x14 0x14 0x28 0x28 0x14 0x14 0x28 0x14 0x28 0x28 0x28 0x28
+ *      CRTC[0x14]: UNDERLINE       0x1F 0x1F 0x1F 0x1F 0x00 0x00 0x00 0x00 0x00 0x0F 0x00 0x40
+ *      CRTC[0x15]: VBLANK_START    0x96 0x96 0x96 0x96 0x96 0x96 0x96 0x96 0x96 0x63 0xE7 0x96
+ *      CRTC[0x16]: VBLANK_END      0xB9 0xB9 0xB9 0xB9 0xB9 0xB9 0xB9 0xB9 0xB9 0xBA 0x04 0xB9
+ *      CRTC[0x17]: MODE_CTRL       0xA3 0xA3 0xA3 0xA3 0xA2 0xA2 0xC2 0xE3 0xE3 0xE3 0xE3 0xA3
+ *      CRTC[0x18]: LINE_COMPARE    0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF
+ *       GRC[0x00]: SRESET          0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+ *       GRC[0x01]: ESRESET         0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+ *       GRC[0x02]: COLORCMP        0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+ *       GRC[0x03]: DATAROT         0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+ *       GRC[0x04]: READMAP         0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+ *       GRC[0x05]: MODE            0x10 0x10 0x10 0x10 0x30 0x30 0x00 0x00 0x00 0x00 0x00 0x40
+ *       GRC[0x06]: MISC            0x0E 0x0E 0x0E 0x0E 0x0F 0x0F 0x0D 0x05 0x05 0x05 0x05 0x05
+ *       GRC[0x07]: COLORDC         0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x0F 0x0F 0x0F 0x0F 0x0F
+ *       GRC[0x08]: BITMASK         0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF
+ *       SEQ[0x00]: RESET           0x03 0x03 0x03 0x03 0x03 0x03 0x03 0x03 0x03 0x03 0x03 0x03
+ *       SEQ[0x01]: CLOCKING        0x08 0x08 0x00 0x00 0x09 0x09 0x01 0x09 0x01 0x01 0x01 0x01
+ *       SEQ[0x02]: MAPMASK         0x03 0x03 0x03 0x03 0x03 0x03 0x01 0x0F 0x0F 0x0F 0x0F 0x0F
+ *       SEQ[0x03]: CHARMAP         0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+ *       SEQ[0x04]: MEMMODE         0x03 0x03 0x03 0x03 0x02 0x02 0x06 0x06 0x06 0x06 0x06 0x0E
+ *       ATC[0x00]: PAL00           0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+ *       ATC[0x01]: PAL01           0x01 0x01 0x01 0x01 0x13 0x13 0x17 0x01 0x01 0x01 0x01 0x01
+ *       ATC[0x02]: PAL02           0x02 0x02 0x02 0x02 0x15 0x15 0x17 0x02 0x02 0x02 0x02 0x02
+ *       ATC[0x03]: PAL03           0x03 0x03 0x03 0x03 0x17 0x17 0x17 0x03 0x03 0x03 0x03 0x03
+ *       ATC[0x04]: PAL04           0x04 0x04 0x04 0x04 0x02 0x02 0x17 0x04 0x04 0x04 0x04 0x04
+ *       ATC[0x05]: PAL05           0x05 0x05 0x05 0x05 0x04 0x04 0x17 0x05 0x05 0x05 0x05 0x05
+ *       ATC[0x06]: PAL06           0x14 0x14 0x14 0x14 0x06 0x06 0x17 0x06 0x06 0x14 0x14 0x06
+ *       ATC[0x07]: PAL07           0x07 0x07 0x07 0x07 0x07 0x07 0x17 0x07 0x07 0x07 0x07 0x07
+ *       ATC[0x08]: PAL08           0x38 0x38 0x38 0x38 0x10 0x10 0x17 0x10 0x10 0x38 0x38 0x08
+ *       ATC[0x09]: PAL09           0x39 0x39 0x39 0x39 0x11 0x11 0x17 0x11 0x11 0x39 0x39 0x09
+ *       ATC[0x0A]: PAL0A           0x3A 0x3A 0x3A 0x3A 0x12 0x12 0x17 0x12 0x12 0x3A 0x3A 0x0A
+ *       ATC[0x0B]: PAL0B           0x3B 0x3B 0x3B 0x3B 0x13 0x13 0x17 0x13 0x13 0x3B 0x3B 0x0B
+ *       ATC[0x0C]: PAL0C           0x3C 0x3C 0x3C 0x3C 0x14 0x14 0x17 0x14 0x14 0x3C 0x3C 0x0C
+ *       ATC[0x0D]: PAL0D           0x3D 0x3D 0x3D 0x3D 0x15 0x15 0x17 0x15 0x15 0x3D 0x3D 0x0D
+ *       ATC[0x0E]: PAL0E           0x3E 0x3E 0x3E 0x3E 0x16 0x16 0x17 0x16 0x16 0x3E 0x3E 0x0E
+ *       ATC[0x0F]: PAL0F           0x3F 0x3F 0x3F 0x3F 0x17 0x17 0x17 0x17 0x17 0x3F 0x3F 0x0F
+ *       ATC[0x10]: MODE            0x0C 0x0C 0x0C 0x0C 0x01 0x01 0x01 0x01 0x01 0x01 0x01 0x41
+ *       ATC[0x11]: OVERSCAN        0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+ *       ATC[0x12]: PLANES          0x0F 0x0F 0x0F 0x0F 0x03 0x03 0x01 0x0F 0x0F 0x0F 0x0F 0x0F
+ *       ATC[0x13]: HPAN            0x08 0x08 0x08 0x08 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+ *
+ * TODO: Build a similar table for the IBM EGA, and then work on rationalizing the mode detection logic in checkMode().
+ */
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class Card {
+    /**
+     * Card(video, nCard, data, cbMemory)
+     *
+     * Creates an object representing an initial video card state;
+     * can also restore a video card from state data created by saveCard().
+     *
+     * WARNING: Since Card objects are low-level objects that have no UI requirements,
+     * they do not inherit from the Component class, so you should only use class methods
+     * of Component, such as Component.assert(), or methods of the parent (video) object.
+     *
+     * @this {Card}
+     * @param {Video} [video]
+     * @param {number} [nCard] (see Video.CARD.*)
+     * @param {Array|null} [data]
+     * @param {number} [cbMemory] is specified if the card must allocate its own memory buffer
+     */
+    constructor(video, nCard, data, cbMemory)
+    {
+        /*
+         * If a card was originally not present (eg, EGA), then the state will be empty,
+         * so we need to detect that case and continue indicating that the card is not present.
+         */
+        if (nCard !== undefined && (!data || data.length)) {
+
+            this.video = video;
+
+            var specs = Video.cardSpecs[nCard];
+            var nMonitorType = video.nMonitorType || specs[5];
+
+            if (!data || data.length < 6) {
+                data = [false, 0, null, null, 0, new Array(nCard < Video.CARD.EGA? Card.CRTC.TOTAL_REGS : Card.CRTC.EGA.TOTAL_REGS)];
+            }
+
+            /*
+             * If a Debugger is present, we want to stash a bit more info in each Card.
+             */
+            if (DEBUGGER) {
+                this.dbg = video.dbg;
+                this.type = specs[0];
+                this.port = specs[1];
+            }
+
+            this.nCard = nCard;
+            this.addrBuffer = specs[2];     // default (physical) video buffer address
+            this.sizeBuffer = specs[3];     // default video buffer length (this is the total size, not the current visible size; this.cbScreen is calculated on the fly to reflect the latter)
+
+            /*
+             * If no memory size is specified, then setMode() will use addMemory() to automatically add enough
+             * memory blocks to cover the video buffer specified above; otherwise, it instructs addMemory() to call
+             * getMemoryBuffer(), which will return a portion of the buffer (adwMemory) allocated below.  This allows
+             * a card like the EGA to move/resize its video buffer as needed, as well as giving it total control over
+             * the underlying memory.
+             */
+            this.cbMemory = cbMemory || specs[4];
+
+            /*
+             * All of our cardSpec video buffer sizes are based on the default text mode (eg, 4Kb for an MDA, 16Kb for
+             * a CGA), but for a card with 64Kb or more of memory (ie, any EGA card), the default text mode video buffer
+             * size should be dynamically recalculated as the smaller of: cbMemory divided by 4, or 32Kb.
+             */
+            if (this.cbMemory >= 0x10000 && this.addrBuffer >= 0xB0000) {
+                this.sizeBuffer = Math.min(this.cbMemory >> 2, 0x8000);
+            }
+
+            this.fActive    = data[0];
+            this.regMode    = data[1];      // see MDA.MODE* or CGA.MODE_* (use (MDA.MODE.HIRES | MDA.MODE.VIDEO_ENABLE | MDA.MODE.BLINK_ENABLE) if you want to test blinking immediately after the initial power-on reset)
+            this.regColor   = data[2];      // see CGA.COLOR.* (undefined on MDA)
+            this.regStatus  = data[3];      // see MDA.STATUS.* or CGA.STATUS.*
+            this.regCRTIndx = data[4] & 0xff;
+            this.regCRTPrev = (data[4] >> 8) & 0xff;
+            this.regCRTData = data[5];
+            this.nCRTCRegs  = Card.CRTC.TOTAL_REGS;
+            this.asCRTCRegs = DEBUGGER? Card.CRTC.REGS : [];
+
+            if (nCard >= Video.CARD.EGA) {
+                this.nCRTCRegs = Card.CRTC.EGA.TOTAL_REGS;
+                this.asCRTCRegs = DEBUGGER? Card.CRTC.EGA_REGS : [];
+                this.initEGA(data[6], nMonitorType);
+            }
+
+            var monitorSpecs = Video.monitorSpecs[nMonitorType] || Video.monitorSpecs[ChipSet.MONITOR.MONO];
+
+            var nCyclesPerSecond = video.cpu.getCyclesPerSecond();      // eg, 4772727
+            this.nCyclesHorzPeriod = (nCyclesPerSecond / monitorSpecs.nHorzPeriodsPerSec)|0;
+            this.nCyclesHorzActive = (this.nCyclesHorzPeriod * monitorSpecs.percentHorzActive / 100)|0;
+            this.nCyclesVertPeriod = (this.nCyclesHorzPeriod * monitorSpecs.nHorzPeriodsPerFrame)|0;
+            this.nCyclesVertActive = (this.nCyclesVertPeriod * monitorSpecs.percentVertActive / 100)|0;
+            this.nInitCycles = (data[7] || 0);
+        }
+    }
+
+    /**
+     * initEGA(data)
+     *
+     * Another one of my frustrations with JSON is that it encodes empty arrays with non-zero lengths as
+     * arrays of nulls, which means that any uninitialized register arrays whose elements were all originally
+     * undefined come back via the JSON round-trip as *initialized* arrays whose elements are now all null.
+     *
+     * I'm a bit surprised, because JavaScript purists tell us to always use the '===' operator (eg, use
+     * 'aReg[i] === undefined' to determine if an element is initialized), but because of this JSON stupidity,
+     * that would require all such tests to become 'aReg[i] === undefined || aReg[i] === null'.  I'm puzzled
+     * why the coercion of '==' is considered evil but JSON's coercion of undefined to null is perfectly fine.
+     *
+     * The simple solution is to change such comparisons to 'aReg[i] == null', because undefined is coerced
+     * to null, whereas numeric values are not.
+     *
+     * [What do I mean by "another" frustration?  Let me talk to you some day about disallowing hex constants,
+     * or insisting that property names be quoted, or refusing to allow comments.  I think it's fine for
+     * JSON.stringify() to produce output that adheres to rules like that -- although some parameters to control
+     * the output would be nice -- but it's completely unnecessary for JSON.parse() to refuse to parse objects
+     * that are perfectly valid.]
+     *
+     * @this {Card}
+     * @param {Array|undefined} data
+     * @param {number} nMonitorType
+     */
+    initEGA(data, nMonitorType)
+    {
+        if (data === undefined) {
+            data = [
+                /* 0*/  false,
+                /* 1*/  0,
+                /* 2*/  new Array(Card.ATC.TOTAL_REGS),
+                /* 3*/  0,
+                /* 4*/  (nMonitorType == ChipSet.MONITOR.MONO? 0: Card.MISC.IO_SELECT),
+                /* 5*/  0,
+                /* 6*/  0,
+                /* 7*/  new Array(Card.SEQ.TOTAL_REGS),
+                /* 8*/  0,
+                /* 9*/  0,
+                /*10*/  0,
+                /*11*/  new Array(Card.GRC.TOTAL_REGS),
+                /*12*/  0,
+                /*13*/  [this.addrBuffer, this.sizeBuffer, this.cbMemory],
+                /*14*/  new Array(this.cbMemory >> 2),      // divide cbMemory by 4 since this is an array of DWORDs (8 bits for each of 4 planes)
+                /*
+                 * Card.ACCESS.WRITE.MODE0 by itself is a pretty good default, but if we choose to "randomize" the screen with
+                 * text characters prior to starting the machine, defaulting to Card.ACCESS.WRITE.EVENODD is more faithful to how
+                 * characters and attributes are typically stored (ie, in planes 0 and 1, respectively).  As soon as the machine
+                 * starts up and initializes the hardware itself, these defaults won't matter.
+                 */
+                /*15*/  Card.ACCESS.READ.MODE0 | Card.ACCESS.READ.EVENODD | Card.ACCESS.WRITE.MODE0 | Card.ACCESS.WRITE.EVENODD | Card.ACCESS.V2,
+                /*16*/  0,
+                /*17*/  0xffffffff|0,
+                /*18*/  0,
+                /*19*/  0xffffffff|0,
+                /*20*/  0,
+                /*21*/  0xffffffff|0,
+                /*22*/  0,
+                /*23*/  0,
+                /*24*/  0,
+                /*25*/  0,
+                /*26*/  Card.VGA_ENABLE.ENABLED,
+                /*27*/  Card.DAC.MASK.DEFAULT,
+                /*28*/  0,
+                /*29*/  0,
+                /*30*/  Card.DAC.STATE.MODE_WRITE,
+                /*31*/  new Array(Card.DAC.TOTAL_REGS)
+            ];
+        }
+
+        this.fATCData   = data[0];
+        this.regATCIndx = data[1];
+        this.regATCData = data[2];
+        this.asATCRegs  = DEBUGGER? Card.ATC.REGS : [];
+        this.regStatus0 = data[3];      // aka STATUS0 (not to be confused with this.regStatus, which the EGA refers to as STATUS1)
+        this.regMisc    = data[4];
+        this.regFeat    = data[5];      // for feature control bits, see Card.FEAT_CTRL.BITS; for feature status bits, see Card.STATUS0.FEAT
+        this.regSEQIndx = data[6];
+        this.regSEQData = data[7];
+        this.asSEQRegs  = DEBUGGER? Card.SEQ.REGS : [];
+        this.regGRCPos1 = data[8];
+        this.regGRCPos2 = data[9];
+        this.regGRCIndx = data[10];
+        this.regGRCData = data[11];
+        this.asGRCRegs  = DEBUGGER? Card.GRC.REGS : [];
+        this.latches    = data[12];
+
+        /*
+         * Since we originally neglected to save/restore the card's active video buffer address and length,
+         * we're now stashing all that information in data[13].  So if we're presented with an old data entry
+         * that contains only the card's memory size, fix it up.
+         *
+         * TODO: This code just creates the required array; the correct video buffer address and length would
+         * still need to be calculated from the current GRC registers; checkMode() knows how to do that, but I'm
+         * not prepared to shoehorn in a call to checkMode() here, and potentially create more issues, for an
+         * old problem that will eventually disappear anyway.
+         */
+        var a = data[13];
+        if (typeof a == "number") {
+            a = [this.addrBuffer, this.sizeBuffer, a];
+        }
+        this.addrBuffer = a[0];
+        this.sizeBuffer = a[1];
+
+
+        var cdw = this.cbMemory >> 2;
+        this.adwMemory  = data[14];
+        if (this.adwMemory && this.adwMemory.length < cdw) {
+            this.adwMemory = State.decompressEvenOdd(this.adwMemory, cdw);
+        }
+
+        var nAccess = data[15];
+        if (nAccess) {
+            if (nAccess & Card.ACCESS.V2) {
+                nAccess &= ~Card.ACCESS.V2;
+            } else {
+
+                nAccess = Card.ACCESS.V1[nAccess & 0xff00] | Card.ACCESS.V1[nAccess & 0xff];
+            }
+        }
+        this.setMemoryAccess(nAccess);
+
+        /*
+         * nReadMapShift must perfectly track how the GRC.READMAP register is programmed, so that Card.ACCESS.READ.MODE0
+         * memory read functions read the appropriate plane.  This default is not terribly critical, unless Card.ACCESS.WRITE.MODE0
+         * is chosen as our default AND you want the screen randomizer to work.
+         */
+        this.nReadMapShift  = data[16];
+
+        /*
+         * Similarly, nSeqMapMask must perfectly track how the SEQ.MAPMASK register is programmed, so that memory write
+         * functions write the appropriate plane(s).  Again, this default is not terribly critical, unless Card.ACCESS.WRITE.MODE0
+         * is chosen as our default AND you want the screen randomizer to work.
+         */
+        this.nSeqMapMask    = data[17];
+        this.nDataRotate    = data[18];
+        this.nBitMapMask    = data[19];
+        this.nSetMapData    = data[20];
+        this.nSetMapMask    = data[21];
+        this.nSetMapBits    = data[22];
+        this.nColorCompare  = data[23];
+        this.nColorDontCare = data[24];
+        this.offStartAddr   = data[25];     // this is the last CRTC start address latched from CRTC.START_ADDR_HI,CRTC.START_ADDR_LO
+
+        this.nVertPeriods = this.nVertPeriodsStartAddr = 0;
+
+        if (this.nCard == Video.CARD.VGA) {
+            this.regVGAEnable   = data[26];
+            this.regDACMask     = data[27];
+            this.regDACAddr     = data[28];
+            this.regDACShift    = data[29];
+            this.regDACState    = data[30];
+            this.regDACData     = data[31];
+        }
+    }
+
+    /**
+     * saveCard()
+     *
+     * @this {Card}
+     * @return {Array}
+     */
+    saveCard()
+    {
+        var data = [];
+        if (this.nCard !== undefined) {
+            data[0] = this.fActive;
+            data[1] = this.regMode;
+            data[2] = this.regColor;
+            data[3] = this.regStatus;
+            data[4] = this.regCRTIndx | (this.regCRTPrev << 8);
+            data[5] = this.regCRTData;
+            if (this.nCard >= Video.CARD.EGA) {
+                data[6] = this.saveEGA();
+            }
+            data[7] = this.nInitCycles;
+        }
+        return data;
+    }
+
+    /**
+     * saveEGA()
+     *
+     * @this {Card}
+     * @return {Array}
+     */
+    saveEGA()
+    {
+        var data = [];
+        data[0]  = this.fATCData;
+        data[1]  = this.regATCIndx;
+        data[2]  = this.regATCData;
+        data[3]  = this.regStatus0;
+        data[4]  = this.regMisc;
+        data[5]  = this.regFeat;
+        data[6]  = this.regSEQIndx;
+        data[7]  = this.regSEQData;
+        data[8]  = this.regGRCPos1;
+        data[9]  = this.regGRCPos2;
+        data[10] = this.regGRCIndx;
+        data[11] = this.regGRCData;
+        data[12] = this.latches;
+        data[13] = [this.addrBuffer, this.sizeBuffer, this.cbMemory];
+        data[14] = State.compressEvenOdd(this.adwMemory);
+        data[15] = this.nAccess | Card.ACCESS.V2;
+        data[16] = this.nReadMapShift;
+        data[17] = this.nSeqMapMask;
+        data[18] = this.nDataRotate;
+        data[19] = this.nBitMapMask;
+        data[20] = this.nSetMapData;
+        data[21] = this.nSetMapMask;
+        data[22] = this.nSetMapBits;
+        data[23] = this.nColorCompare;
+        data[24] = this.nColorDontCare;
+        data[25] = this.offStartAddr;
+
+        if (this.nCard == Video.CARD.VGA) {
+            data[26] = this.regVGAEnable;
+            data[27] = this.regDACMask;
+            data[28] = this.regDACAddr;
+            data[29] = this.regDACShift;
+            data[30] = this.regDACState;
+            data[31] = this.regDACData;
+        }
+        return data;
+    }
+
+    /**
+     * dumpRegs()
+     *
+     * Since we don't pre-allocate the register arrays (eg, ATC, CRTC, GRC, etc) on a Card, we can't
+     * rely on their array length, so we instead rely on the number of register names supplied in asRegs.
+     *
+     * @this {Card}
+     * @param {string} sName
+     * @param {number} iReg
+     * @param {Array} [aRegs]
+     * @param {Array} [asRegs]
+     */
+    dumpRegs(sName, iReg, aRegs, asRegs)
+    {
+        if (DEBUGGER) {
+            if (!aRegs) {
+                this.dbg.println(sName + ": " + Str.toHex(iReg, 2));
+                return;
+            }
+            var i, cchMax = 18, s = "";
+            for (i = 0; i < asRegs.length; i++) {
+                var reg = (aRegs === this.regCRTData)? this.getCRTCReg(i) : aRegs[i];
+                if (s) s += '\n';
+                s += sName + "[" + Str.toHex(i, 2) + "]: " + Str.pad(asRegs[i], cchMax) + (i === iReg? '*' : ' ') + Str.toHex(reg, reg > 0xff? 4 : 2);
+                if (reg != null) s += " (" + reg + ".)"
+            }
+            this.dbg.println(s);
+        }
+    }
+
+    /**
+     * dumpVideoCard()
+     *
+     * @this {Card}
+     */
+    dumpVideoCard()
+    {
+        if (DEBUGGER) {
+            /*
+             * Start with registers that are common to all cards....
+             */
+            this.dumpRegs("CRTC", this.regCRTIndx, this.regCRTData, this.asCRTCRegs);
+
+            if (this.nCard >= Video.CARD.EGA) {
+                this.dumpRegs(" GRC", this.regGRCIndx, this.regGRCData, this.asGRCRegs);
+                this.dumpRegs(" SEQ", this.regSEQIndx, this.regSEQData, this.asSEQRegs);
+                this.dumpRegs(" ATC", this.regATCIndx, this.regATCData, this.asATCRegs);
+                this.dumpRegs(" ATCINDX", this.regATCIndx);
+                this.dbg.println(" ATCDATA: " + this.fATCData);
+                this.dumpRegs("    FEAT", this.regFeat);
+                this.dumpRegs("    MISC", this.regMisc);
+                this.dumpRegs(" STATUS0", this.regStatus0);
+                /*
+                 * There are few more EGA regs we could dump, like GRCPos1, GRCPos2, but does anyone care?
+                 */
+            }
+
+            /*
+             * TODO: This simply dumps the last value read from the STATUS1 register, not necessarily
+             * its current state; consider dumping getRetraceBits() instead of (or in addition to) this.
+             */
+            this.dumpRegs(" STATUS1", this.regStatus);
+
+            if (this.nCard == Video.CARD.MDA || this.nCard == Video.CARD.CGA) {
+                this.dumpRegs(" MODEREG", this.regMode);
+            }
+
+            if (this.nCard == Video.CARD.CGA) {
+                this.dumpRegs("   COLOR", this.regColor);
+            }
+
+            if (this.nCard >= Video.CARD.EGA) {
+                this.dbg.println(" LATCHES: " + Str.toHex(this.latches));
+                this.dbg.println("  ACCESS: " + Str.toHex(this.nAccess, 4));
+                this.dbg.println("Use 'dump video [addr]' to dump video memory");
+                /*
+                 * There are few more EGA regs we could dump, like GRCPos1, GRCPos2, but does anyone care?
+                 */
+            }
+        }
+    }
+
+    /**
+     * dumpVideoBuffer(asArgs)
+     *
+     * Rather than requiring the first parameter to ALWAYS be a frame buffer address OR a frame buffer
+     * offset, we'll just make a guess as to what the user intended and support BOTH; basically, if the
+     * value is less than the frame buffer address, we'll assume it's an offset.
+     *
+     * Also, we allow some special options to be encoded in asArgs: 'l' followed by a number means
+     * print that many rows of data.  'n' followed by a number (1-8) means print only that number of
+     * memory locations per row, and then adjust the starting address of the next row by the number
+     * of bytes per row (or whatever is specified by the 'w' option) so that the dump reflects a
+     * rectangular chunk of video data.  Finally, if asArgs contains 'p' followed by a number (0-3),
+     * we display only the bits from that plane for each memory location, in binary instead of hex.
+     *
+     * For example, assuming a standard VGA frame buffer with 640x480 pixels across 38400 (0x9600) memory
+     * locations, the following command will dump a vertical swath of bits from plane 0 that is 32 (0x20)
+     * rows tall and 8 columns wide, from roughly the center of the screen (0x4B00 + 0x28 - 2 = 0x4B26).
+     *
+     *      d video 4b26 l20 n8 p0
+     *
+     * Subsequent commands that omit a starting address or offset will continue where the last dump
+     * left off; eg:
+     *
+     *      d video n8 p0
+     *
+     * To dump a chunk of off-screen memory starting at 0x9600, where the Windows VGA driver typically
+     * stores a copy of the video memory containing the current mouse pointer:
+     *
+     *      d video 9600 l20 n5 w5 p0
+     *
+     * Alternatively, you could use decimal values:
+     *
+     *      d video 9600 l32. n5. w5. p0.
+     *
+     * NOTE: If these commands look suspiciously like weird Hayes modem command strings, trust me,
+     * that is ENTIRELY coincidental (but mildly amusing).
+     *
+     * TODO: Make these options more general-purpose (it currently assumes a conventional VGA planar layout).
+     *
+     * @this {Card}
+     * @param {Array.<string>} asArgs (all numeric arguments default to base 16 unless otherwise specified)
+     */
+    dumpVideoBuffer(asArgs)
+    {
+        if (DEBUGGER) {
+            if (!this.adwMemory) {
+                this.dbg.println("no buffer");
+                return;
+            }
+
+            var i, j, idw, fColAdjust = false;
+            var l = 8, n = 8, p = -1, w = this.video.nCols >> 3;
+
+            for (i = 0; i < asArgs.length; i++) {
+
+                var s = asArgs[i];
+                if (!i) {
+                    idw = Str.parseInt(s, 16);
+                    continue;
+                }
+
+                var ch = s.charAt(0);
+                j = Str.parseInt(s.substr(1), 16);
+
+                switch(ch) {
+                case 'l':
+                    l = j;
+                    break;
+                case 'n':
+                    if (j >= 1 && j <= 8) {
+                        n = j;
+                        fColAdjust = true;
+                    }
+                    break;
+                case 'p':
+                    if (j >= 0 && j <= 3) p = j;
+                    break;
+                case 'w':
+                    if (j < w) w = j;
+                    break;
+                default:
+                    this.dbg.println("unrecognized argument: " + s);
+                    break;
+                }
+            }
+
+            if (idw === undefined) {
+                idw = this.prevDump || 0;
+            } else if (idw >= this.addrBuffer) {
+                idw -= this.addrBuffer;
+            }
+
+            var sDump = "";
+            for (i = 0; i < l; i++) {
+                var sData = Str.toHex(this.addrBuffer + idw) + ":";
+                for (j = 0; j < n && idw < this.adwMemory.length; j++) {
+                    var dw = this.adwMemory[idw++];
+                    sData += ' ' + ((p < 0)? Str.toHex(dw) : Str.toBin((dw >> (p << 3)), 8));
+                }
+                if (fColAdjust) idw += w - n;
+                if (sDump) sDump += "\n";
+                sDump += sData;
+            }
+
+            if (sDump) this.dbg.println(sDump);
+            this.prevDump = idw;
+        }
+    }
+
+    /**
+     * getMemoryBuffer(addr)
+     *
+     * If we passed a controller object (ie, this card) to addMemory(), then each allocated Memory block
+     * will call this function to obtain a buffer.
+     *
+     * @this {Card}
+     * @param {number} addr
+     * @return {Array} containing the buffer (and the offset within that buffer that corresponds to the requested block)
+     */
+    getMemoryBuffer(addr)
+    {
+        return [this.adwMemory, addr - this.addrBuffer];
+    }
+
+    /**
+     * getMemoryAccess()
+     *
+     * WARNING: This is a public method, whereas most Card methods are private to the Video component;
+     * because a Card also acts as a Memory controller, it must provide getMemoryAccess() to the Memory component.
+     *
+     * Return the last set of memory access functions recorded by setMemoryAccess().
+     *
+     * @this {Card}
+     * @return {Array.<function()>}
+     */
+    getMemoryAccess()
+    {
+        return this.afnAccess;
+    }
+
+    /**
+     * setMemoryAccess(nAccess)
+     *
+     * This transforms the memory access value that getCardAccess() returns into the best available set of
+     * memory access functions, which are then returned via getMemoryAccess() to any memory blocks we allocate
+     * or modify.
+     *
+     * @this {Card}
+     * @param {number|undefined} nAccess
+     */
+    setMemoryAccess(nAccess)
+    {
+        if (nAccess != null && nAccess != this.nAccess) {
+
+            var nReadAccess = nAccess & Card.ACCESS.READ.MASK;
+            var fnReadByte = Card.ACCESS.afn[nReadAccess];
+            if (!fnReadByte) {
+                if (DEBUG && this.dbg && this.dbg.messageEnabled(Messages.VIDEO)) {
+                    this.dbg.message("Card.setMemoryAccess(" + Str.toHexWord(nAccess) + "): missing readByte handler");
+                    /*
+                     * I've taken a look, and the cases I've seen so far stem from the order in which the IBM VGA BIOS
+                     * reprograms registers during a mode change: it reprograms the Sequencer registers BEFORE the Graphics
+                     * Controller registers, so if GRC.MODE was set to READ.MODE1 prior to the mode change and the new mode
+                     * clears SEQ.MEMMODE.SEQUENTIAL, we will briefly be in an "odd" (unsupported) state.
+                     *
+                     * This didn't used to occur when we relied on the GRC.MODE register instead of the SEQ.MEMMODE for
+                     * determining the EVENODD state.  But, as explained in getCardAccess(), we've run into inconsistencies in
+                     * how GRC.MODE.EVENODD is programmed, so we must live with this warning.
+                     *
+                     * The ultimate solution is to provide a EVENODD handler for READ.MODE1, since there is the remote
+                     * possibility of third-party software that relies on that "odd" combination.
+                     *
+                     *      this.dbg.stopCPU();     // let's take a look
+                     */
+                }
+                if (nReadAccess & Card.ACCESS.READ.EVENODD) {
+                    fnReadByte = Card.ACCESS.afn[Card.ACCESS.READ.EVENODD];
+                }
+            }
+            var nWriteAccess = nAccess & Card.ACCESS.WRITE.MASK;
+            var fnWriteByte = Card.ACCESS.afn[nWriteAccess];
+            if (!fnWriteByte) {
+                if (DEBUG && this.dbg && this.dbg.messageEnabled(Messages.VIDEO)) {
+                    this.dbg.message("Card.setMemoryAccess(" + Str.toHexWord(nAccess) + "): missing writeByte handler");
+                    /*
+                     * I've taken a look, and the cases I've seen so far stem from the order in which the IBM VGA BIOS
+                     * reprograms registers during a mode change: it reprograms the Sequencer registers BEFORE the Graphics
+                     * Controller registers, so if GRC.MODE was set to WRITE.MODE2 prior to the mode change and the new mode
+                     * clears SEQ.MEMMODE.SEQUENTIAL, we will briefly be in an "odd" (unsupported) state.
+                     *
+                     * This didn't used to occur when we relied on the GRC.MODE register instead of the SEQ.MEMMODE for
+                     * determining the EVENODD state.  But, as explained in getCardAccess(), we've run into inconsistencies in
+                     * how GRC.MODE.EVENODD is programmed, so we must live with this warning.
+                     *
+                     * The ultimate solution is to provide EVENODD handlers for all modes other than WRITE.MODE0, since there
+                     * is the remote possibility of third-party software that relies on one of those "odd" combinations.
+                     *
+                     *      this.dbg.stopCPU();     // let's take a look
+                     */
+                }
+                if (nWriteAccess & Card.ACCESS.WRITE.EVENODD) {
+                    fnWriteByte = Card.ACCESS.afn[Card.ACCESS.WRITE.EVENODD];
+                }
+            }
+            if (!this.afnAccess) this.afnAccess = new Array(6);
+            this.afnAccess[0] = fnReadByte;
+            this.afnAccess[1] = fnWriteByte;
+            this.nAccess = nAccess;
+        }
+    }
+
+    /**
+     * getCRTCReg()
+     *
+     * @this {Card}
+     * @param {number} iReg
+     * @return {number}
+     */
+    getCRTCReg(iReg)
+    {
+        var reg = this.regCRTData[iReg];
+        if (reg != null && this.nCard >= Video.CARD.EGA) {
+            var bOvrflowBit8 = 0, bOvrflowBit9 = 0, bMaxScanBit9 = 0;
+            switch(iReg) {
+            case Card.CRTC.EGA.VTOTAL:              // 0x06
+                bOvrflowBit8 = Card.CRTC.EGA.OVERFLOW.VTOTAL_BIT8;          // 0x01
+                if (this.nCard == Video.CARD.VGA) bOvrflowBit9 = Card.CRTC.EGA.OVERFLOW.VTOTAL_BIT9;
+                break;
+            case Card.CRTC.EGA.CURSOR_START.INDX:   // 0x0A
+                if (this.nCard == Video.CARD.EGA) bOvrflowBit8 = Card.CRTC.EGA.OVERFLOW.CURSOR_START_BIT8;
+                break;
+            case Card.CRTC.EGA.VRETRACE_START:      // 0x10
+                bOvrflowBit8 = Card.CRTC.EGA.OVERFLOW.VRETRACE_START_BIT8;  // 0x04
+                if (this.nCard == Video.CARD.VGA) bOvrflowBit9 = Card.CRTC.EGA.OVERFLOW.VRETRACE_START_BIT9;
+                break;
+            case Card.CRTC.EGA.VDISP_END:           // 0x12
+                bOvrflowBit8 = Card.CRTC.EGA.OVERFLOW.VDISP_END_BIT8;       // 0x02
+                if (this.nCard == Video.CARD.VGA) bOvrflowBit9 = Card.CRTC.EGA.OVERFLOW.VDISP_END_BIT9;
+                break;
+            case Card.CRTC.EGA.VBLANK_START:        // 0x15
+                bOvrflowBit8 = Card.CRTC.EGA.OVERFLOW.VBLANK_START_BIT8;    // 0x08
+                if (this.nCard == Video.CARD.VGA) bMaxScanBit9 = Card.CRTC.EGA.MAX_SCAN.VBLANK_START_BIT9;
+                break;
+            case Card.CRTC.EGA.LINE_COMPARE:        // 0x18
+                bOvrflowBit8 = Card.CRTC.EGA.OVERFLOW.LINE_COMPARE_BIT8;    // 0x10
+                if (this.nCard == Video.CARD.VGA) bMaxScanBit9 = Card.CRTC.EGA.MAX_SCAN.LINE_COMPARE_BIT9;
+                break;
+            }
+            if (bOvrflowBit8) {
+                reg |= ((this.regCRTData[Card.CRTC.EGA.OVERFLOW.INDX] & bOvrflowBit8)? 0x100 : 0);
+                reg |= ((this.regCRTData[Card.CRTC.EGA.OVERFLOW.INDX] & bOvrflowBit9)? 0x200 : 0);
+                reg |= ((this.regCRTData[Card.CRTC.EGA.MAX_SCAN.INDX] & bMaxScanBit9)? 0x200 : 0);
+            }
+        }
+        return reg;
+    }
+}
+
+/*
+ * MDA Registers (ports 0x3B4, 0x3B5, 0x3B8, and 0x3BA)
+ */
+Card.MDA = {
+    CRTC: {
+        INDX: {
+            PORT:           0x3B4,      // NOTE: the low byte of this port address (0xB4) is mirrored at 40:0063 (0x0463)
+            MASK:           0x1F
+        },
+        DATA: {
+            PORT:           0x3B5
+        }
+    },
+    MODE: {
+        PORT:               0x3B8,      // Mode Select Register, aka CRT Control Port 1 (write-only); the BIOS mirrors this register at 40:0065 (0x0465)
+        HIRES:              0x01,
+        VIDEO_ENABLE:       0x08,
+        BLINK_ENABLE:       0x20
+    },
+    STATUS: {
+        PORT:               0x3BA,
+        HDRIVE:             0x01,
+        BWVIDEO:            0x08
+    },
+    /*
+     * TODO: Add support for parallel port(s) someday....
+     */
+    PRT_DATA: {
+        PORT:               0x3BC
+    },
+    PRT_STATUS: {
+        PORT:               0x3BD
+    },
+    PRT_CTRL: {
+        PORT:               0x3BE
+    }
+};
+
+/*
+ * CGA Registers (ports 0x3D4, 0x3D5, 0x3D8, 0x3D9, and 0x3DA)
+ */
+Card.CGA = {
+    CRTC: {
+        INDX: {
+            PORT:           0x3D4,      // NOTE: the low byte of this port address (0xB4) is mirrored at 40:0063 (0x0463)
+            MASK:           0x1F
+        },
+        DATA: {
+            PORT:           0x3D5
+        }
+    },
+    MODE: {
+        PORT:               0x3D8,      // Mode Select Register (write-only); the BIOS mirrors this register at 40:0065 (0x0465)
+        _80X25:             0x01,
+        GRAPHIC_SEL:        0x02,
+        BW_SEL:             0x04,
+        VIDEO_ENABLE:       0x08,       // same as MDA.MODE.VIDEO_ENABLE
+        HIRES_BW:           0x10,
+        BLINK_ENABLE:       0x20        // same as MDA.MODE.BLINK_ENABLE
+    },
+    COLOR: {
+        PORT:               0x3D9,      // write-only
+        BORDER:             0x07,
+        BRIGHT:             0x08,
+        BGND_ALT:           0x10,       // alternate, intensified background colors in text mode
+        COLORSET2:          0x20        // selects aCGAColorSet2 colors for 320x200 graphics mode; aCGAColorSet1 otherwise
+    },
+    STATUS: {
+        PORT:               0x3DA,      // read-only; same for EGA (although the EGA calls this STATUS1, to distinguish it from STATUS0)
+        RETRACE:            0x01,
+        PEN_TRIGGER:        0x02,
+        PEN_ON:             0x04,
+        VRETRACE:           0x08        // when set, this indicates the CGA is performing a vertical retrace
+    },
+    /*
+     * TODO: Add support for light pen port(s) someday....
+     */
+    CLEAR_PEN: {
+        PORT:               0x3DB
+    },
+    PRESET_PEN: {
+        PORT:               0x3DC
+    }
+};
+
+/*
+ * Common CRT hardware registers (ports 0x3B4/0x3B5 or 0x3D4/0x3D5)
+ *
+ * NOTE: In this implementation, because we have to make at least two of the registers readable (CURSOR_ADDR_HI and CURSOR_ADDR_LO),
+ * we end up making ALL the registers readable, otherwise we would have to explicitly block any register marked write-only.  I don't
+ * think making the CRT registers fully readable presents any serious compatibility issues, and it actually offers some benefits
+ * (eg, improved debugging).
+ *
+ * However, some things are broken: the (readable) light pen registers on the EGA are overloaded as (writable) vertical retrace
+ * registers, so the vertical retrace registers cannot actually be read that way.  I'm sure the VGA solved that problem, but I haven't
+ * looked into it yet.
+ */
+Card.CRTC = {
+    HTOTAL:                 0x00,
+    HDISP:                  0x01,
+    HSYNC_POS:              0x02,
+    HSYNC_WIDTH:            0x03,
+    VTOTAL:                 0x04,
+    VTOTAL_ADJ:             0x05,
+    VDISP_TOTAL:            0x06,
+    VSYNC_POS:              0x07,
+    INTERLACE_POS:          0x08,
+    MAX_SCAN: {
+        INDX:               0x09,
+        MASK:               0x1F
+    },
+    CURSOR_START: {
+        INDX:               0x0A,
+        MASK:               0x1F,
+        /*
+         * I don't entirely understand these cursor blink control bits.  Here's what the MC6845 datasheet says:
+         *
+         *      Bit 5 is the blink timing control.  When bit 5 is low, the blink frequency is 1/16 of the vertical field rate,
+         *      and when bit 5 is high, the blink frequency is 1/32 of the vertical field rate.  Bit 6 is used to enable a blink.
+         */
+        BLINKON:            0x00,       // (supposedly, 0x04 has the same effect as 0x00)
+        BLINKOFF:           0x20,       // if blinking is disabled, the cursor is effectively hidden
+        BLINKFAST:          0x60        // default is 1/16 of the frame rate; this switches to 1/32 of the frame rate
+    },
+    CURSOR_END: {
+        INDX:               0x0B,
+        MASK:               0x1F
+    },
+    START_ADDR_HI:          0x0C,
+    START_ADDR_LO:          0x0D,
+    CURSOR_ADDR_HI:         0x0E,
+    CURSOR_ADDR_LO:         0x0F,
+    LIGHT_PEN_HI:           0x10,
+    LIGHT_PEN_LO:           0x11,
+    TOTAL_REGS:             0x12,       // total CRT registers on MDA/CGA
+    EGA: {
+        HDISP_END:          0x01,
+        HBLANK_START:       0x02,
+        HBLANK_END:         0x03,
+        HRETRACE_START:     0x04,
+        HRETRACE_END:       0x05,
+        VTOTAL:             0x06,
+        OVERFLOW: {
+            INDX:               0x07,
+            VTOTAL_BIT8:        0x01,   // bit 8 of register 0x06
+            VDISP_END_BIT8:     0x02,   // bit 8 of register 0x12
+            VRETRACE_START_BIT8:0x04,   // bit 8 of register 0x10
+            VBLANK_START_BIT8:  0x08,   // bit 8 of register 0x15
+            LINE_COMPARE_BIT8:  0x10,   // bit 8 of register 0x18
+            CURSOR_START_BIT8:  0x20,   // bit 8 of register 0x0A (EGA only)
+            VTOTAL_BIT9:        0x20,   // bit 9 of register 0x06 (VGA only)
+            VDISP_END_BIT9:     0x40,   // bit 9 of register 0x12 (VGA only, unused on EGA)
+            VRETRACE_START_BIT9:0x80    // bit 9 of register 0x10 (VGA only, unused on EGA)
+        },
+        PRESET_SCAN:        0x08,
+        /*
+         * NOTE: EGA/VGA CRTC registers 0x09-0x0F are the same as the MDA/CGA CRTC registers defined above
+         */
+        MAX_SCAN: {
+            INDX:               0x09,
+            SCAN_LINE:          0x1f,
+            VBLANK_START_BIT9:  0x20,   // (VGA only)
+            LINE_COMPARE_BIT9:  0x40,   // (VGA only)
+            CONVERT400:         0x80    // 200-to-400 scan-line conversion is in effect (VGA only)
+        },
+        CURSOR_START: {
+            INDX:           0x0A,
+            MASK:           0x1F,
+            BLINKON:        0x00,       // (VGA only; supposedly, 0x04 has the same effect as 0x00)
+            BLINKOFF:       0x20,       // if blinking is disabled, the cursor is effectively hidden (VGA only)
+            BLINKFAST:      0x60        // default is 1/16 of the frame rate; this switches to 1/32 of the frame rate (VGA only)
+        },
+        CURSOR_END: {
+            INDX:           0x0B,
+            MASK:           0x1F
+        },
+        START_ADDR_HI:      0x0C,
+        START_ADDR_LO:      0x0D,
+        CURSOR_ADDR_HI:     0x0E,
+        CURSOR_ADDR_LO:     0x0F,
+        VRETRACE_START:     0x10,
+        VRETRACE_END:       0x11,
+        VDISP_END:          0x12,
+        /*
+         * The OFFSET register (bits 0-7) specifies the logical line width of the screen.  The starting memory address
+         * for the next character row is larger than the current character row by two or four times this amount.
+         * The OFFSET register is programmed with a word address.  Depending on the method of clocking the CRT Controller,
+         * this word address is [effectively] either a word or double-word address. #IBMVGATechRef
+         */
+        OFFSET:             0x13,
+        UNDERLINE: {
+            INDX:           0x14,
+            ROWSCAN:        0x1f,
+            COUNTBY4:       0x20,       // (VGA only)
+            DWORD:          0x40        // (VGA only)
+        },
+        VBLANK_START:       0x15,
+        VBLANK_END:         0x16,
+        MODE_CTRL: {
+            INDX:           0x17,
+            COMPAT_MODE:    0x01,       // Compatibility Mode Support (CGA A13 control)
+            SEL_ROW_SCAN:   0x02,       // Select Row Scan Counter
+            SEL_HRETRACE:   0x04,       // Horizontal Retrace Select
+            COUNTBY2:       0x08,       // Count By Two
+            OUTPUT_CTRL:    0x10,       // Output Control
+            ADDR_WRAP:      0x20,       // Address Wrap (in Word mode, 1 maps A15 to A0 and 0 maps A13; use the latter when only 64Kb is installed)
+            BYTE_MODE:      0x40,       // Byte Mode (1 selects Byte Mode; 0 selects Word Mode)
+            HARD_RESET:     0x80        // Hardware Reset
+        },
+        LINE_COMPARE:       0x18,
+        TOTAL_REGS:         0x19        // total CRT registers on EGA/VGA
+    },
+    ADDR_HI_MASK:           0x3F
+};
+
+if (DEBUGGER) {
+    Card.CRTC.REGS      = ["HTOTAL","HDISP","HSYNC_POS","HSYNC_WIDTH","VTOTAL","VTOTAL_ADJ",
+        "VDISP","VSYNC_POS","INTERLACE_POS","MAX_SCAN","CURSOR_START","CURSOR_END",
+        "START_ADDR_HI","START_ADDR_LO","CURSOR_ADDR_HI","CURSOR_ADDR_LO","LIGHT_PEN_HI","LIGHT_PEN_LO"];
+
+    Card.CRTC.EGA_REGS  = ["HTOTAL","HDISP_END","HBLANK_START","HBLANK_END","HRETRACE_START","HRETRACE_END",
+        "VTOTAL","OVERFLOW","PRESET_SCAN","MAX_SCAN","CURSOR_START","CURSOR_END",
+        "START_ADDR_HI","START_ADDR_LO","CURSOR_ADDR_HI","CURSOR_ADDR_LO","VRETRACE_START","VRETRACE_END",
+        "VDISP_END","OFFSET","UNDERLINE","VBLANK_START","VBLANK_END","MODE_CTRL","LINE_COMPARE"];
+}
+
+/*
+ * EGA/VGA Input Status 1 Register (port 0x3DA)
+ *
+ * STATUS1 bit 0 has confusing documentation: the EGA Tech Ref says "Logical 0 indicates the CRT raster is in a
+ * horizontal or vertical retrace interval", whereas the VGA Tech Ref says "Logical 1 indicates a horizontal or
+ * vertical retrace interval," but then clarifies: "This bit is the real-time status of the INVERTED display enable
+ * signal".  So, instead of calling bit 0 DISP_ENABLE (or more precisely, DISP_ENABLE_INVERTED), it's simply RETRACE.
+ *
+ * STATUS1 diagnostic bits 5 and 4 are set according to the Card.ATC.PLANES.MUX bits:
+ *
+ *      MUX     Bit 5   Bit 4
+ *      ---     ----    ----
+ *      00:     Red     Blue
+ *      01:     SecBlue Green
+ *      10:     SecRed  SecGreen
+ *      11:     unused  unused
+ */
+Card.STATUS1 = {
+    PORT:                   0x3DA,
+    RETRACE:                0x01,       // bit 0: logical OR of horizontal and vertical retrace
+    VRETRACE:               0x08,       // bit 3: set during vertical retrace interval
+    DIAGNOSTIC:             0x30,       // bits 5,4 are controlled by the Card.ATC.PLANES.MUX bits
+    RESERVED:               0xC6
+};
+
+/*
+ * EGA/VGA Attribute Controller Registers (port 0x3C0: regATCIndx and regATCData)
+ *
+ * The current ATC INDX value is stored in cardEGA.regATCIndx (including the Card.ATC.INDX_ENABLE bit), and the
+ * ATC DATA values are stored in cardEGA.regATCData.  The state of the ATC INDX/DATA flip-flop is stored in fATCData.
+ *
+ * Note that the ATC palette registers (0x0-0xf) all use the following 6 bit assignments, with bits 6 and 7 unused:
+ *
+ *      0: Blue
+ *      1: Green
+ *      2: Red
+ *      3: SecBlue (or mono video)
+ *      4: SecGreen (or intensity)
+ *      5: SecRed
+ */
+Card.ATC = {
+    PORT:                   0x3C0,      // ATC Index/Data Port
+    INDX_MASK:              0x1F,
+    INDX_PAL_ENABLE:        0x20,       // must be clear when loading palette registers
+    PALETTE: {
+        INDX:               0x00,       // 16 registers: 0x00 - 0x0F
+        MASK:               0x3f,
+        BLUE:               0x01,
+        GREEN:              0x02,
+        RED:                0x04,
+        SECBLUE:            0x08,
+        BRIGHT:             0x10,       // NOTE: The IBM EGA manual (p.56) also calls this the "intensity" bit
+        SECGREEN:           0x10,
+        SECRED:             0x20
+    },
+    PALETTE_REGS:           0x10,       // 16 total palette registers
+    MODE: {
+        INDX:               0x10,       // ATC Mode Control Register
+        GRAPHICS:           0x01,       // bit 0: set for graphics mode, clear for alphanumeric mode
+        MONOEM:             0x02,       // bit 1: set for monochrome emulation mode, clear for color emulation
+        TEXT_9DOT:          0x04,       // bit 2: set for 9-dot replication in character codes 0xC0-0xDF
+        BLINK_ENABLE:       0x08,       // bit 3: set for text/graphics blink, clear for background intensity
+        RESERVED:           0x10,       // bit 4: reserved
+        PANCOMPAT:          0x20,       // bit 5: set for pixel-panning compatibility
+        PELWIDTH:           0x40,       // bit 6: set for 256-color modes, clear for all other modes
+        COLORSEL_ALL:       0x80        // bit 7: set to enable all COLORSEL bits (ie, COLORSEL.DAC_BIT5 and COLORSEL.DAC_BIT4)
+    },
+    OVERSCAN: {
+        INDX:               0x11        // ATC Overscan Color Register
+    },
+    PLANES: {
+        INDX:               0x12,       // ATC Color Plane Enable Register
+        MASK:               0x0F,
+        MUX:                0x30,
+        RESERVED:           0xC0
+    },
+    HPAN: {
+        INDX:               0x13,       // ATC Horizontal PEL Panning Register
+        SHIFT_LEFT:         0x0F        // bits 0-3 indicate # of pixels to shift left
+    },
+    COLORSEL: {
+        INDX:               0x14,       // ATC Color Select Register (VGA only)
+        DAC_BIT7:           0x08,       // specifies bit 7 of DAC values (ignored in 256-color modes)
+        DAC_BIT6:           0x04,       // specifies bit 6 of DAC values (ignored in 256-color modes)
+        DAC_BIT5:           0x02,       // specifies bit 5 of DAC values (if ATC.MODE.COLORSEL_ALL is set; ignored in 256-color modes)
+        DAC_BIT4:           0x01        // specifies bit 4 of DAC values (if ATC.MODE.COLORSEL_ALL is set; ignored in 256-color modes)
+    },
+    TOTAL_REGS:             0x14
+};
+
+if (DEBUGGER) {
+    Card.ATC.REGS = ["PAL00","PAL01","PAL02","PAL03","PAL04","PAL05","PAL06","PAL07",
+        "PAL08","PAL09","PAL0A","PAL0B","PAL0C","PAL0D","PAL0E","PAL0F", "MODE","OVERSCAN","PLANES","HPAN"];
+}
+
+/*
+ * EGA/VGA Feature Control Register (port 0x3BA or 0x3DA: regFeat)
+ *
+ * The EGA BIOS writes 0x1 to Card.FEAT_CTRL.BITS and reads Card.STATUS0.FEAT, then writes 0x2 to
+ * Card.FEAT_CTRL.BITS and reads Card.STATUS0.FEAT.  The bits from the first and second reads are shifted
+ * into the high nibble of the byte at 40:88h.
+ */
+Card.FEAT_CTRL = {
+    PORT_MONO:              0x3BA,      // write port address (other than the two bits below, the rest are reserved and/or unused)
+    PORT_COLOR:             0x3DA,      // write port address (other than the two bits below, the rest are reserved and/or unused)
+    PORT_READ:              0x3CA,      // read port address (VGA only)
+    BITS:                   0x03        // feature control bits
+};
+
+/*
+ * EGA/VGA Miscellaneous Output Register (port 0x3C2: regMisc)
+ */
+Card.MISC = {
+    PORT_WRITE:             0x3C2,      // write port address (EGA and VGA)
+    PORT_READ:              0x3CC,      // read port addresss (VGA only)
+    IO_SELECT:              0x01,       // 0 sets CRT ports to 0x3Bn, 1 sets CRT ports to 0x3Dn
+    ENABLE_RAM:             0x02,       // 0 disables video RAM, 1 enables
+    CLOCK_SELECT:           0x0C,       // 0x0: 14Mhz I/O clock, 0x4: 16Mhz on-board clock, 0x8: external clock, 0xC: unused
+    DISABLE_DRV:            0x10,       // 0 activates internal video drivers, 1 activates feature connector direct drive outputs
+    PAGE_ODD_EVEN:          0x20,       // 0 selects the low 64Kb page of video RAM for text modes, 1 selects the high page
+    HPOLARITY:              0x40,       // 0 selects positive horizontal retrace
+    VPOLARITY:              0x80        // 0 selects positive vertical retrace
+};
+
+/*
+ * EGA/VGA Input Status 0 Register (port 0x3C2: regStatus0)
+ */
+Card.STATUS0 = {
+    PORT:                   0x3C2,      // read-only (aka STATUS0, to distinguish it from PORT_CGA_STATUS)
+    RESERVED:               0x0F,
+    SWSENSE:                0x10,
+    SWSENSE_SHIFT:          4,
+    FEAT:                   0x60,       // VGA: reserved
+    INTERRUPT:              0x80        // 1: video is being displayed; 0: vertical retrace is occurring
+};
+
+/*
+ * VGA Subsystem Enable Register (port 0x3C3: regVGAEnable)
+ */
+Card.VGA_ENABLE = {
+    PORT:                   0x3C3,
+    ENABLED:                0x01,       // when set, all VGA I/O and memory decoding is enabled; otherwise disabled (TODO: Implement)
+    RESERVED:               0xFE
+};
+
+/*
+ * EGA/VGA Sequencer Registers (ports 0x3C4/0x3C5: regSEQIndx and regSEQData)
+ */
+Card.SEQ = {
+    INDX: {
+        PORT:               0x3C4,      // Sequencer Index Port
+        MASK:               0x07
+    },
+    DATA: {
+        PORT:               0x3C5       // Sequencer Data Port
+    },
+    RESET: {
+        INDX:               0x00,       // Sequencer Reset Register
+        ASYNC:              0x01,
+        SYNC:               0x02
+    },
+    CLOCKING: {
+        INDX:               0x01,       // Sequencer Clocking Mode Register
+        DOTS8:              0x01,       // 1: 8 dots; 0: 9 dots
+        BANDWIDTH:          0x02,       // 0: CRTC has access 4 out of every 5 cycles (for high-res modes); 1: CRTC has access 2 out of 5 (VGA: reserved)
+        SHIFTLOAD:          0x04,
+        DOTCLOCK:           0x08,       // 0: normal dot clock; 1: master clock divided by two (used for 320x200 modes: 0, 1, 4, 5, and D)
+        SHIFT4:             0x10,       // VGA only
+        SCREEN_OFF:         0x20,       // VGA only
+        RESERVED:           0xC0
+    },
+    MAPMASK: {
+        INDX:               0x02,       // Sequencer Map Mask Register
+        PL0:                0x01,
+        PL1:                0x02,
+        PL2:                0x04,
+        PL3:                0x08,
+        MAPS:               0x0F,
+        RESERVED:           0xF0
+    },
+    CHARMAP: {
+        INDX:               0x03,       // Sequencer Character Map Select Register
+        SELB:               0x03,       // 0x0: 1st 8Kb of plane 2; 0x1: 2nd 8Kb; 0x2: 3rd 8Kb; 0x3: 4th 8Kb
+        SELA:               0x0C,       // 0x0: 1st 8Kb of plane 2; 0x4: 2nd 8Kb; 0x8: 3rd 8Kb; 0xC: 4th 8Kb
+        SELB_HIGH:          0x10,       // VGA only
+        SELA_HIGH:          0x20        // VGA only
+    },
+    MEMMODE: {
+        INDX:               0x04,       // Sequencer Memory Mode Register
+        ALPHA:              0x01,       // set for alphanumeric (A/N) mode, clear for graphics (APA or "All Points Addressable") mode (EGA only)
+        EXT:                0x02,       // set if memory expansion installed, clear if not installed
+        SEQUENTIAL:         0x04,       // set for sequential memory access, clear for mapping even addresses to planes 0/2, odd addresses to planes 1/3
+        CHAIN4:             0x08        // VGA only: set to select memory map (plane) based on low 2 bits of address
+    },
+    TOTAL_REGS:             0x05
+};
+
+if (DEBUGGER) Card.SEQ.REGS = ["RESET","CLOCKING","MAPMASK","CHARMAP","MEMMODE"];
+
+/*
+ * VGA Digital-to-Analog Converter (DAC) Registers (regDACMask, regDACState, regDACAddr, and regDACData)
+ *
+ * To write DAC data, write an address to DAC.ADDR.PORT_WRITE, then write 3 bytes to DAC.DATA.PORT; the low 6 bits
+ * of each byte will be concatenated to form an 18-bit DAC value (red is least significant, followed by green, then blue).
+ * When the final byte is received, the 18-bit DAC value is updated and regDACAddr is auto-incremented.
+ *
+ * To read DAC data, the process is similar, but the initial address is written to DAC.ADDR.PORT_READ instead.
+ *
+ * DAC.STATE.PORT and DAC.ADDR.PORT_WRITE can be read at any time and will not interfere with a read or write operation
+ * in progress.  To prevent "snow", reading or writing DAC values should be limited to retrace intervals (see regStatus1),
+ * or by using the SCREEN_OFF bit in the SEQ.CLOCKING register.
+ */
+Card.DAC = {
+    MASK: {
+        PORT:               0x3C6,      // initialized to 0xFF and should not be changed
+        DEFAULT:            0xFF
+    },
+    STATE: {
+        PORT:               0x3C7,
+        MODE_WRITE:         0x00,       // the DAC is in write mode if bits 0 and 1 are clear
+        MODE_READ:          0x03        // the DAC is in read mode if bits 0 and 1 are set
+    },
+    ADDR: {
+        PORT_READ:          0x3C7,      // write to initiate a read
+        PORT_WRITE:         0x3C8       // write to initiate a write; read to determine the current ADDR
+    },
+    DATA: {
+        PORT:               0x3C9
+    },
+    TOTAL_REGS:             0x100
+};
+
+/*
+ * EGA/VGA Graphics Controller Registers (ports 0x3CE/0x3CF: regGRCIndx and regGRCData)
+ *
+ * The VGA added Write Mode 3, which is described as follows:
+ *
+ *      "Each map is written with 8 bits of the value contained in the Set/Reset register for that map
+ *      (the Enable Set/Reset register has no effect). Rotated system microprocessor data is ANDed with the
+ *      Bit Mask register data to form an 8-bit value that performs the same function as the Bit Mask register
+ *      does in write modes 0 and 2."
+ */
+Card.GRC = {
+    POS1_PORT:              0x3CC,      // EGA only, write-only
+    POS2_PORT:              0x3CA,      // EGA only, write-only
+    INDX: {
+        PORT:               0x3CE,      // GRC Index Port
+        MASK:               0x0F
+    },
+    DATA: {
+        PORT:               0x3CF       // GRC Data Port
+    },
+    SRESET: {
+        INDX:               0x00        // GRC Set/Reset Register (write-only; each bit used only if WRITE.MODE0 and corresponding ESR bit set)
+    },
+    ESRESET: {
+        INDX:               0x01        // GRC Enable Set/Reset Register
+    },
+    COLORCMP: {
+        INDX:               0x02        // GRC Color Compare Register
+    },
+    DATAROT: {
+        INDX:               0x03,       // GRC Data Rotate Register
+        COUNT:              0x07,
+        AND:                0x08,
+        OR:                 0x10,
+        XOR:                0x18,
+        FUNC:               0x18,
+        MASK:               0x1F
+    },
+    READMAP: {
+        INDX:               0x04,       // GRC Read Map Select Register
+        NUM:                0x03
+    },
+    MODE: {
+        INDX:               0x05,       // GRC Mode Register
+        WRITE: {
+            MODE0:          0x00,       // write mode 0: each plane written with CPU data, rotated as needed, unless SR enabled
+            MODE1:          0x01,       // write mode 1: each plane written with contents of the processor latches (loaded by a read)
+            MODE2:          0x02,       // write mode 2: memory plane N is written with 8 bits matching data bit N
+            MODE3:          0x03,       // write mode 3: VGA only
+            MASK:           0x03
+        },
+        TEST:               0x04,
+        READ: {
+            MODE0:          0x00,       // read mode 0: read map mode
+            MODE1:          0x08,       // read mode 1: color compare mode
+            MASK:           0x08
+        },
+        EVENODD:            0x10,
+        SHIFT:              0x20,
+        COLOR256:           0x40        // VGA only
+    },
+    MISC: {
+        INDX:               0x06,       // GRC Miscellaneous Register
+        GRAPHICS:           0x01,       // set for graphics mode addressing, clear for text mode addressing
+        CHAIN:              0x02,       // set for odd/even planes selected with odd/even values of the processor AO bit
+        MAPMEM:             0x0C,       //
+        MAPA0128:           0x00,       //
+        MAPA064:            0x04,       //
+        MAPB032:            0x08,       //
+        MAPB832:            0x0C        //
+    },
+    COLORDC: {
+        INDX:               0x07        // GRC Color "Don't Care" Register
+    },
+    BITMASK: {
+        INDX:               0x08        // GRC Bit Mask Register
+    },
+    TOTAL_REGS:             0x09
+};
+
+if (DEBUGGER) Card.GRC.REGS = ["SRESET","ESRESET","COLORCMP","DATAROT","READMAP","MODE","MISC","COLORDC","BITMASK"];
+
+/*
+ * EGA Memory Access Functions
+ *
+ * Here's where we define all the getMemoryAccess() functions that know how to deal with "planar" EGA memory,
+ * which consists of 32-bit values for every byte of address space, allowing us to internally store plane 0
+ * bytes in bits 0-7, plane 1 bytes in bits 8-15, plane 2 bytes in bits 16-23, and plane 3 bytes in bits 24-31.
+ *
+ * All our functions have slightly more overhead than the standard Bus memory access functions, because the
+ * offset (off) parameter is block-relative, which we must transform into a buffer-relative offset.  Fortunately,
+ * all our Memory objects know this and have already recorded their buffer-relative offset in "this.offset".
+ *
+ * Also, the EGA includes a set of latches, one for each plane, which must be updated on most reads/writes;
+ * we rely on the Memory object's "this.controller" property to give us access to the Card's state.
+ *
+ * And we take a little extra time to conditionally set fDirty on writes, meaning if a write did not actually
+ * change the value of the memory, we will not set fDirty.  The default write functions in memory.js don't take
+ * that performance hit, but here, it may be worthwhile, because if it results in fewer dirty blocks, display
+ * updates may be faster.
+ *
+ * Note that we don't have to worry about dealing with word accesses that straddle block boundaries, because
+ * the Bus component automatically breaks those accesses into separate byte requests.  Similarly, byte and word
+ * values for the write functions have already been pre-masked by the Bus component to 8 and 16 bits, respectively.
+ *
+ * My motto: Be paranoid, but also be careful not to do any more work than you absolutely have to.
+ *
+ *
+ * CGA Emulation on the EGA
+ *
+ * Modes 4/5 (320x200 low-res graphics) emulate the same buffer format that the CGA uses.  To recap: 1 byte contains
+ * 4 pixels (pixel 0 in bits 7-6, pixel 1 in bits 5-4, etc), and thus one row of pixels is 80 (0x50) bytes long.
+ * Moreover, all even rows are stored in the first 8K of the video buffer (at 0xB8000), and all odd rows are stored
+ * in the second 8K (at 0xBA000).  Of each 8K, only 8000 (0x1F40) bytes are used (80 bytes X 100 rows); the remaining
+ * 192 bytes of each 8K are unused.
+ *
+ * For these modes, the EGA's GRC.MODE is programmed with 0x30: Card.GRC.MODE.EVENODD and Card.GRC.MODE.SHIFT.
+ * The latter claims to work by forming each 2-bit pixel with even bits from plane 0 and odd bits from plane 1;
+ * however, I'm unclear how that works if even bytes are only written to plane 0 and odd bytes are only written to
+ * plane 1, as Card.GRC.MODE.EVENODD implies, because plane 0 would never have any bits for the odd bytes, and
+ * plane 1 would never have any bits for the even bytes.  TODO: Figure this out.
+ *
+ *
+ * Even/Odd Memory Access Functions
+ *
+ * The "EVENODD" functions deal with the EGA's default text-mode addressing, where EVEN addresses are mapped to
+ * plane 0 (and 2) and ODD addresses are mapped to plane 1 (and 3).  This occurs when SEQ.MEMMODE.SEQUENTIAL is
+ * clear (and GRC.MODE.EVENODD is set), turning address bit 0 (A0) into a "plane select" bit.  Whether A0 is also
+ * used as a memory address bit depends on CRTC.MODE_CTRL.BYTE_MODE: if it's set, then we're in "Byte Mode" and A0 is
+ * used as-is; if it's clear, then we're in "Word Mode", and either A15 (when CRTC.MODE_CTRL.ADDR_WRAP is set) or A13
+ * (when CRTC.MODE_CTRL.ADDR_WRAP is clear, typically when only 64Kb of EGA memory is installed) is substituted for A0.
+ *
+ * Note that A13 remains clear until addresses reach 8K, at which point we've spanned 32Kb of EGA memory, so it makes
+ * sense to propagate A13 to A0 at that point, so that the next 8K of addresses start using ODD instead of EVEN bytes,
+ * and no memory is wasted on a 64Kb EGA card.
+ *
+ * These functions, however, don't yet deal with all those subtleties: A0 is currently used only as a "plane select"
+ * bit and set to zero for addressing purposes, meaning that only the EVEN bytes in EGA memory will ever be used.
+ * TODO: Implement the subtleties.
+ */
+
+/*
+ * Values returned by getCardAccess(); the high byte describes the read mode, and the low byte describes the write mode.
+ *
+ * V2 should never appear in any values used by getCardAccess() or setCardAccess(); the sole purpose of V2 is to
+ * distinguish newer (V2) access values from older (V1) access values in saved contexts.  It's set when the context
+ * is saved, and cleared when the context is restored.  Thus, if V2 is not set on restore, we assume we're dealing with
+ * a V1 value, so we run it through the V1 table (below) to produce a V2 value.  Hopefully at some point V1 contexts
+ * can be deprecated, and the V2 bit can be eliminated/repurposed.
+ */
+Card.ACCESS = {
+    READ: {                             // READ values are designed to be OR'ed with WRITE values
+        MODE0:              0x0400,
+        MODE1:              0x0500,
+        EVENODD:            0x1000,
+        CHAIN4:             0x4000,
+        MASK:               0xFF00
+    },
+    WRITE: {                            // and WRITE values are designed to be OR'ed with READ values
+        MODE0:              0x0000,
+        MODE1:              0x0001,
+        MODE2:              0x0002,
+        MODE3:              0x0003,     // VGA only
+        CHAIN4:             0x0004,
+        EVENODD:            0x0010,
+        ROT:                0x0020,
+        AND:                0x0060,
+        OR:                 0x00A0,
+        XOR:                0x00E0,
+        MASK:               0x00FF
+    },
+    V2:             (0x80000000|0)      // this is a signature bit used ONLY to differentiate V2 access values from V1
+};
+
+/*
+ * Table of older (V1) access values and their corresponding new values; the new values are similar but more orthogonal
+ */
+Card.ACCESS.V1 = [];
+Card.ACCESS.V1[0x0002] = Card.ACCESS.READ.MODE0;
+Card.ACCESS.V1[0x0003] = Card.ACCESS.READ.MODE0  | Card.ACCESS.READ.EVENODD;
+Card.ACCESS.V1[0x0010] = Card.ACCESS.READ.MODE1;
+Card.ACCESS.V1[0x0200] = Card.ACCESS.WRITE.MODE0;
+Card.ACCESS.V1[0x0400] = Card.ACCESS.WRITE.MODE0 | Card.ACCESS.WRITE.ROT;
+Card.ACCESS.V1[0x0600] = Card.ACCESS.WRITE.MODE0 | Card.ACCESS.WRITE.AND;
+Card.ACCESS.V1[0x0A00] = Card.ACCESS.WRITE.MODE0 | Card.ACCESS.WRITE.OR;
+Card.ACCESS.V1[0x0E00] = Card.ACCESS.WRITE.MODE0 | Card.ACCESS.WRITE.XOR;
+Card.ACCESS.V1[0x0300] = Card.ACCESS.WRITE.MODE0 | Card.ACCESS.WRITE.EVENODD;
+Card.ACCESS.V1[0x1000] = Card.ACCESS.WRITE.MODE1;
+Card.ACCESS.V1[0x2000] = Card.ACCESS.WRITE.MODE2;
+Card.ACCESS.V1[0x6000] = Card.ACCESS.WRITE.MODE2 | Card.ACCESS.WRITE.AND;
+Card.ACCESS.V1[0xA000] = Card.ACCESS.WRITE.MODE2 | Card.ACCESS.WRITE.OR;
+Card.ACCESS.V1[0xE000] = Card.ACCESS.WRITE.MODE2 | Card.ACCESS.WRITE.XOR;
+
+/**
+ * readByteMode0(off, addr)
+ *
+ * @this {Memory}
+ * @param {number} off
+ * @param {number} [addr]
+ * @return {number}
+ */
+Card.ACCESS.readByteMode0 = function readByteMode0(off, addr)
+{
+    off += this.offset;
+    var dw = this.controller.latches = this.adw[off];
+    return (dw >> this.controller.nReadMapShift) & 0xff;
+};
+
+/**
+ * readByteMode0Chain4(off, addr)
+ *
+ * See writeByteMode0Chain4 for a description of how writes are distributed across planes.
+ *
+ * @this {Memory}
+ * @param {number} off
+ * @param {number} [addr]
+ * @return {number}
+ */
+Card.ACCESS.readByteMode0Chain4 = function readByteMode0Chain4(off, addr)
+{
+    var idw = (off & ~0x3) + this.offset;
+    var shift = (off & 0x3) << 3;
+    return ((this.controller.latches = this.adw[idw]) >> shift) & 0xff;
+};
+
+/**
+ * readByteMode0EvenOdd(off, addr)
+ *
+ * @this {Memory}
+ * @param {number} off
+ * @param {number} [addr]
+ * @return {number}
+ */
+Card.ACCESS.readByteMode0EvenOdd = function readByteMode0EvenOdd(off, addr)
+{
+    /*
+     * TODO: As discussed in getCardAccess(), we need to run some tests on real EGA/VGA hardware to determine
+     * exactly what gets latched (ie, from which address) when EVENODD is in effect.  Whatever we learn may
+     * also dictate a special EVENODD function for READ.MODE1 as well.
+     */
+    off += this.offset;
+    var idw = off & ~0x1;
+    var dw = this.controller.latches = this.adw[idw];
+    return (!(off & 1)? dw : (dw >> 8)) & 0xff;
+};
+
+/**
+ * readByteMode1(off, addr)
+ *
+ * This mode requires us to step through each of the 8 sets of 4 bits in the specified DWORD of video memory,
+ * returning a 1 wherever all 4 match the Color Compare (COLORCMP) Register and a 0 otherwise.  An added wrinkle
+ * is that the Color Don't Care (COLORDC) Register can specify that any/all/none of the 4 bits must be ignored.
+ *
+ * We perform the comparison from most to least significant bit, because that matches how the nColorCompare and
+ * nColorDontCare masks are initialized; we could have gone either way, but this is more consistent with the rest
+ * of the component (eg, pixels are drawn across the screen from left to right, starting with the most significant
+ * bit of each byte).
+ *
+ * Also note that, while not well-documented, this mode also affects the internal latches, so we make sure those
+ * are updated as well.
+ *
+ * @this {Memory}
+ * @param {number} off
+ * @param {number} [addr]
+ * @return {number}
+ */
+Card.ACCESS.readByteMode1 = function readByteMode1(off, addr)
+{
+    off += this.offset;
+    var dw = this.controller.latches = this.adw[off];
+    /*
+     * Minor optimization: we could pre-mask nColorCompare with nColorDontCare, whenever either register
+     * is updated, but that's a drop in the bucket compared to all the other work this function must do.
+     */
+    var mask = this.controller.nColorDontCare;
+    var color = this.controller.nColorCompare & mask;
+    var b = 0, bit = 0x80;
+    while (bit) {
+        if ((dw & mask) == color) b |= bit;
+        color >>>= 1;  mask >>>= 1;  bit >>= 1;
+    }
+    return b;
+};
+
+/**
+ * writeByteMode0(off, b, addr)
+ *
+ * Supporting Set/Reset means that for every plane for which Set/Reset is enabled, we must
+ * replace the corresponding byte in dw with a byte of zeros or ones.  This is accomplished with
+ * nSetMapMask, nSetMapData, and nSetMapBits.  nSetMapMask is the inverse of the ESRESET bits,
+ * because we use it to mask the processor data, nSetMapData records the desired SRESET bits,
+ * and nSetMapBits contains the bits to replace those that we masked in the processor data.
+ *
+ * We could have done this:
+ *
+ *      dw = (dw & this.controller.nSetMapMask) | (this.controller.nSetMapData & ~this.controller.nSetMapMask)
+ *
+ * but by maintaining nSetMapBits equal to (nSetMapData & ~nSetMapMask), we are able to make
+ * the writes slightly more efficient.
+ *
+ * @this {Memory}
+ * @param {number} off
+ * @param {number} b (which should already be pre-masked to 8 bits; see cpu.setByte())
+ * @param {number} [addr]
+ */
+Card.ACCESS.writeByteMode0 = function writeByteMode0(off, b, addr)
+{
+    var idw = off + this.offset;
+    var dw = b | (b << 8) | (b << 16) | (b << 24);
+    dw = (dw & this.controller.nSetMapMask) | this.controller.nSetMapBits;
+    dw = (dw & this.controller.nBitMapMask) | (this.controller.latches & ~this.controller.nBitMapMask);
+    dw = (dw & this.controller.nSeqMapMask) | (this.adw[idw] & ~this.controller.nSeqMapMask);
+    if (this.adw[idw] != dw) {
+        this.adw[idw] = dw;
+        this.fDirty = true;
+    }
+    if (DEBUG && this.controller.video.messageEnabled(Messages.MEM | Messages.VIDEO)) {
+        this.controller.video.printMessage("writeByteMode0(" + Str.toHexLong(addr) + "): " + Str.toHexByte(b) + " -> " + Str.toHexLong(dw));
+    }
+};
+
+/**
+ * writeByteMode0Chain4(off, b, addr)
+ *
+ * This is how we distribute writes of 0xff across the address space to the planes (assuming that all
+ * planes are enabled by the Sequencer's MAPMASK register):
+ *
+ *      off     idw     adw[idw]
+ *      ------  ------  ----------
+ *      0x0000: 0x0000  0x000000ff
+ *      0x0001: 0x0000  0x0000ff00
+ *      0x0002: 0x0000  0x00ff0000
+ *      0x0003: 0x0000  0xff000000
+ *      0x0004: 0x0004  0x000000ff
+ *      0x0005: 0x0004  0x0000ff00
+ *      0x0006: 0x0004  0x00ff0000
+ *      0x0007: 0x0004  0xff000000
+ *      ...
+ *
+ * Some VGA emulations calculate the video buffer index (idw) by shifting the offset (off) right 2 bits,
+ * instead of simply masking off the low 2 bits, as we do here.  That would be a more "pleasing" arrangement,
+ * because we would be using sequential video buffer locations, instead of multiples of 4, and would match how
+ * pixels are stored in "Mode X".  However, I don't think that's how CHAIN4 modes operate (although that still
+ * needs to be confirmed, because multiple sources conflict on this point).  TODO: Confirm CHAIN4 operation on
+ * actual VGA hardware, including the extent to which ALU and other writeByteMode0() functionality needs to
+ * be folded into this.
+ *
+ * Address decoding may not matter that much, as long as both the read and write CHAIN4 functions decode their
+ * addresses in exactly the same manner; we'd only get into trouble with software that "unchained" or otherwise
+ * reconfigured the planes and then made assumptions about existing data in the video buffer.
+ *
+ * @this {Memory}
+ * @param {number} off
+ * @param {number} b (which should already be pre-masked to 8 bits; see cpu.setByte())
+ * @param {number} [addr]
+ */
+Card.ACCESS.writeByteMode0Chain4 = function writeByteMode0Chain4(off, b, addr)
+{
+    var idw = (off & ~0x3) + this.offset;
+    var shift = (off & 0x3) << 3;
+    /*
+     * TODO: Consider adding a separate "unmasked" version of this CHAIN4 write function when nSeqMapMask is -1
+     * (or removing nSeqMapMask from the equation altogether, if CHAIN4 is never used with any planes disabled).
+     */
+    var dw = ((b << shift) & this.controller.nSeqMapMask) | (this.adw[idw] & ~((0xff << shift) & this.controller.nSeqMapMask));
+    if (this.adw[idw] != dw) {
+        this.adw[idw] = dw;
+        this.fDirty = true;
+    }
+    if (DEBUG && this.controller.video.messageEnabled(Messages.MEM | Messages.VIDEO)) {
+        this.controller.video.printMessage("writeByteMode0Chain4(" + Str.toHexLong(addr) + "): " + Str.toHexByte(b) + " -> " + Str.toHexLong(dw));
+    }
+};
+
+/**
+ * writeByteMode0EvenOdd(off, b, addr)
+ *
+ * @this {Memory}
+ * @param {number} off
+ * @param {number} b (which should already be pre-masked to 8 bits; see cpu.setByte())
+ * @param {number} [addr]
+ */
+Card.ACCESS.writeByteMode0EvenOdd = function writeByteMode0EvenOdd(off, b, addr)
+{
+    off += this.offset;
+    var dw = b | (b << 8) | (b << 16) | (b << 24);
+    /*
+     * When even/odd addressing is enabled, nSeqMapMask must be cleared for planes 1
+     * and 3 if the address is even, and cleared for planes 0 and 2 if the address is odd.
+     */
+    var idw = off & ~0x1;
+    dw = (dw & this.controller.nBitMapMask) | (this.controller.latches & ~this.controller.nBitMapMask);
+    var maskMaps = this.controller.nSeqMapMask & (idw == off? 0x00ff00ff : (0xff00ff00|0));
+    dw = (dw & maskMaps) | (this.adw[idw] & ~maskMaps);
+    if (this.adw[idw] != dw) {
+        this.adw[idw] = dw;
+        this.fDirty = true;
+    }
+    if (DEBUG && this.controller.video.messageEnabled(Messages.MEM | Messages.VIDEO)) {
+        this.controller.video.printMessage("writeByteMode0EvenOdd(" + Str.toHexLong(addr) + "): " + Str.toHexByte(b) + " -> " + Str.toHexLong(dw));
+    }
+};
+
+/**
+ * writeByteMode0Rot(off, b, addr)
+ *
+ * @this {Memory}
+ * @param {number} off
+ * @param {number} b (which should already be pre-masked to 8 bits; see cpu.setByte())
+ * @param {number} [addr]
+ */
+Card.ACCESS.writeByteMode0Rot = function writeByteMode0Rot(off, b, addr)
+{
+    var idw = off + this.offset;
+    b = ((b >> this.controller.nDataRotate) | (b << (8 - this.controller.nDataRotate)) & 0xff);
+    var dw = b | (b << 8) | (b << 16) | (b << 24);
+    dw = (dw & this.controller.nSetMapMask) | this.controller.nSetMapBits;
+    dw = (dw & this.controller.nBitMapMask) | (this.controller.latches & ~this.controller.nBitMapMask);
+    dw = (dw & this.controller.nSeqMapMask) | (this.adw[idw] & ~this.controller.nSeqMapMask);
+    if (this.adw[idw] != dw) {
+        this.adw[idw] = dw;
+        this.fDirty = true;
+    }
+    if (DEBUG && this.controller.video.messageEnabled(Messages.MEM | Messages.VIDEO)) {
+        this.controller.video.printMessage("writeByteMode0Rot(" + Str.toHexLong(addr) + "): " + Str.toHexByte(b) + " -> " + Str.toHexLong(dw));
+    }
+};
+
+/**
+ * writeByteMode0And(off, b, addr)
+ *
+ * @this {Memory}
+ * @param {number} off
+ * @param {number} b (which should already be pre-masked to 8 bits; see cpu.setByte())
+ * @param {number} [addr]
+ */
+Card.ACCESS.writeByteMode0And = function writeByteMode0And(off, b, addr)
+{
+    var idw = off + this.offset;
+    b = ((b >> this.controller.nDataRotate) | (b << (8 - this.controller.nDataRotate)) & 0xff);
+    var dw = b | (b << 8) | (b << 16) | (b << 24);
+    dw = (dw & this.controller.nSetMapMask) | this.controller.nSetMapBits;
+    dw &= this.controller.latches;
+    dw = (dw & this.controller.nBitMapMask) | (this.controller.latches & ~this.controller.nBitMapMask);
+    dw = (dw & this.controller.nSeqMapMask) | (this.adw[idw] & ~this.controller.nSeqMapMask);
+    if (this.adw[idw] != dw) {
+        this.adw[idw] = dw;
+        this.fDirty = true;
+    }
+    if (DEBUG && this.controller.video.messageEnabled(Messages.MEM | Messages.VIDEO)) {
+        this.controller.video.printMessage("writeByteMode0And(" + Str.toHexLong(addr) + "): " + Str.toHexByte(b) + " -> " + Str.toHexLong(dw));
+    }
+};
+
+/**
+ * writeByteMode0Or(off, b, addr)
+ *
+ * @this {Memory}
+ * @param {number} off
+ * @param {number} b (which should already be pre-masked to 8 bits; see cpu.setByte())
+ * @param {number} [addr]
+ */
+Card.ACCESS.writeByteMode0Or = function writeByteMode0Or(off, b, addr)
+{
+    var idw = off + this.offset;
+    b = ((b >> this.controller.nDataRotate) | (b << (8 - this.controller.nDataRotate)) & 0xff);
+    var dw = b | (b << 8) | (b << 16) | (b << 24);
+    dw = (dw & this.controller.nSetMapMask) | this.controller.nSetMapBits;
+    dw |= this.controller.latches;
+    dw = (dw & this.controller.nBitMapMask) | (this.controller.latches & ~this.controller.nBitMapMask);
+    dw = (dw & this.controller.nSeqMapMask) | (this.adw[idw] & ~this.controller.nSeqMapMask);
+    if (this.adw[idw] != dw) {
+        this.adw[idw] = dw;
+        this.fDirty = true;
+    }
+    if (DEBUG && this.controller.video.messageEnabled(Messages.MEM | Messages.VIDEO)) {
+        this.controller.video.printMessage("writeByteMode0Or(" + Str.toHexLong(addr) + "): " + Str.toHexByte(b) + " -> " + Str.toHexLong(dw));
+    }
+};
+
+/**
+ * writeByteMode0Xor(off, b, addr)
+ *
+ * @this {Memory}
+ * @param {number} off
+ * @param {number} b (which should already be pre-masked to 8 bits; see cpu.setByte())
+ * @param {number} [addr]
+ */
+Card.ACCESS.writeByteMode0Xor = function writeByteMode0Xor(off, b, addr)
+{
+    var idw = off + this.offset;
+    b = ((b >> this.controller.nDataRotate) | (b << (8 - this.controller.nDataRotate)) & 0xff);
+    var dw = b | (b << 8) | (b << 16) | (b << 24);
+    dw = (dw & this.controller.nSetMapMask) | this.controller.nSetMapBits;
+    dw ^= this.controller.latches;
+    dw = (dw & this.controller.nBitMapMask) | (this.controller.latches & ~this.controller.nBitMapMask);
+    dw = (dw & this.controller.nSeqMapMask) | (this.adw[idw] & ~this.controller.nSeqMapMask);
+    if (this.adw[idw] != dw) {
+        this.adw[idw] = dw;
+        this.fDirty = true;
+    }
+    if (DEBUG && this.controller.video.messageEnabled(Messages.MEM | Messages.VIDEO)) {
+        this.controller.video.printMessage("writeByteMode0Xor(" + Str.toHexLong(addr) + "): " + Str.toHexByte(b) + " -> " + Str.toHexLong(dw));
+    }
+};
+
+/**
+ * writeByteMode1(off, b, addr)
+ *
+ * @this {Memory}
+ * @param {number} off
+ * @param {number} b (ignored; the EGA latches provide the source data)
+ * @param {number} [addr]
+ */
+Card.ACCESS.writeByteMode1 = function writeByteMode1(off, b, addr)
+{
+    var idw = off + this.offset;
+    var dw = (this.adw[idw] & ~this.controller.nSeqMapMask) | (this.controller.latches & this.controller.nSeqMapMask);
+    if (this.adw[idw] != dw) {
+        this.adw[idw] = dw;
+        this.fDirty = true;
+    }
+    if (DEBUG && this.controller.video.messageEnabled(Messages.MEM | Messages.VIDEO)) {
+        this.controller.video.printMessage("writeByteMode1(" + Str.toHexLong(addr) + "): " + Str.toHexLong(dw));
+    }
+};
+
+/**
+ * writeByteMode1EvenOdd(off, b, addr)
+ *
+ * @this {Memory}
+ * @param {number} off
+ * @param {number} b (ignored; the EGA latches provide the source data)
+ * @param {number} [addr]
+ */
+Card.ACCESS.writeByteMode1EvenOdd = function writeByteMode1EvenOdd(off, b, addr)
+{
+    /*
+     * TODO: As discussed in getCardAccess(), we need to run some tests on real EGA/VGA hardware to
+     * determine exactly where latches are written (ie, to which address) when EVENODD is in effect.
+     */
+    off += this.offset;
+    //
+    // When even/odd addressing is enabled, nSeqMapMask must be cleared for planes 1 and 3 if
+    // the address is even, and cleared for planes 0 and 2 if the address is odd.
+    //
+    var idw = off & ~0x1;
+    var maskMaps = this.controller.nSeqMapMask & (idw == off? 0x00ff00ff : (0xff00ff00|0));
+    var dw = (this.adw[idw] & ~maskMaps) | (this.controller.latches & maskMaps);
+    if (this.adw[idw] != dw) {
+        this.adw[idw] = dw;
+        this.fDirty = true;
+    }
+    if (DEBUG && this.controller.video.messageEnabled(Messages.MEM | Messages.VIDEO)) {
+        this.controller.video.printMessage("writeByteMode1EvenOdd(" + Str.toHexLong(addr) + "): " + Str.toHexByte(dw));
+    }
+};
+
+/**
+ * writeByteMode2(off, b, addr)
+ *
+ * @this {Memory}
+ * @param {number} off
+ * @param {number} b (which should already be pre-masked to 8 bits; see cpu.setByte())
+ * @param {number} [addr]
+ */
+Card.ACCESS.writeByteMode2 = function writeByteMode2(off, b, addr)
+{
+    var idw = off + this.offset;
+    var dw = Video.aEGAByteToDW[b & 0xf];
+    dw = (dw & this.controller.nBitMapMask) | (this.controller.latches & ~this.controller.nBitMapMask);
+    dw = (dw & this.controller.nSeqMapMask) | (this.adw[idw] & ~this.controller.nSeqMapMask);
+    if (this.adw[idw] != dw) {
+        this.adw[idw] = dw;
+        this.fDirty = true;
+    }
+    if (DEBUG && this.controller.video.messageEnabled(Messages.MEM | Messages.VIDEO)) {
+        this.controller.video.printMessage("writeByteMode2(" + Str.toHexLong(addr) + "): " + Str.toHexByte(b) + " -> " + Str.toHexLong(dw));
+    }
+};
+
+/**
+ * writeByteMode2And(off, b, addr)
+ *
+ * @this {Memory}
+ * @param {number} off
+ * @param {number} b (which should already be pre-masked to 8 bits; see cpu.setByte())
+ * @param {number} [addr]
+ */
+Card.ACCESS.writeByteMode2And = function writeByteMode2And(off, b, addr)
+{
+    var idw = off + this.offset;
+    var dw = Video.aEGAByteToDW[b & 0xf];
+    dw &= this.controller.latches;
+    dw = (dw & this.controller.nBitMapMask) | (this.controller.latches & ~this.controller.nBitMapMask);
+    dw = (dw & this.controller.nSeqMapMask) | (this.adw[idw] & ~this.controller.nSeqMapMask);
+    if (this.adw[idw] != dw) {
+        this.adw[idw] = dw;
+        this.fDirty = true;
+    }
+    if (DEBUG && this.controller.video.messageEnabled(Messages.MEM | Messages.VIDEO)) {
+        this.controller.video.printMessage("writeByteMode2And(" + Str.toHexLong(addr) + "): " + Str.toHexByte(b) + " -> " + Str.toHexLong(dw));
+    }
+};
+
+/**
+ * writeByteMode2Or(off, b, addr)
+ *
+ * @this {Memory}
+ * @param {number} off
+ * @param {number} b (which should already be pre-masked to 8 bits; see cpu.setByte())
+ * @param {number} [addr]
+ */
+Card.ACCESS.writeByteMode2Or = function writeByteMode2Or(off, b, addr)
+{
+    var idw = off + this.offset;
+    var dw = Video.aEGAByteToDW[b & 0xf];
+    dw |= this.controller.latches;
+    dw = (dw & this.controller.nBitMapMask) | (this.controller.latches & ~this.controller.nBitMapMask);
+    dw = (dw & this.controller.nSeqMapMask) | (this.adw[idw] & ~this.controller.nSeqMapMask);
+    if (this.adw[idw] != dw) {
+        this.adw[idw] = dw;
+        this.fDirty = true;
+    }
+    if (DEBUG && this.controller.video.messageEnabled(Messages.MEM | Messages.VIDEO)) {
+        this.controller.video.printMessage("writeByteMode2Or(" + Str.toHexLong(addr) + "): " + Str.toHexByte(b) + " -> " + Str.toHexLong(dw));
+    }
+};
+
+/**
+ * writeByteMode2Xor(off, b, addr)
+ *
+ * @this {Memory}
+ * @param {number} off
+ * @param {number} b (which should already be pre-masked to 8 bits; see cpu.setByte())
+ * @param {number} [addr]
+ */
+Card.ACCESS.writeByteMode2Xor = function writeByteMode2Xor(off, b, addr)
+{
+    var idw = off + this.offset;
+    var dw = Video.aEGAByteToDW[b & 0xf];
+    dw ^= this.controller.latches;
+    dw = (dw & this.controller.nBitMapMask) | (this.controller.latches & ~this.controller.nBitMapMask);
+    dw = (dw & this.controller.nSeqMapMask) | (this.adw[idw] & ~this.controller.nSeqMapMask);
+    if (this.adw[idw] != dw) {
+        this.adw[idw] = dw;
+        this.fDirty = true;
+    }
+    if (DEBUG && this.controller.video.messageEnabled(Messages.MEM | Messages.VIDEO)) {
+        this.controller.video.printMessage("writeByteMode2Xor(" + Str.toHexLong(addr) + "): " + Str.toHexByte(b) + " -> " + Str.toHexLong(dw));
+    }
+};
+
+/**
+ * writeByteMode3(off, b, addr)
+ *
+ * In MODE3, Set/Reset is always enabled, so the ESRESET bits (and therefore nSetMapMask and nSetMapBits)
+ * are ignored; we look only at the SRESET bits, which are stored in nSetMapData.
+ *
+ * Unlike MODE0, we currently have no non-rotate function for MODE3.  If performance dictates, we can add one;
+ * ditto for other features like the Sequencer's MAPMASK register (nSeqMapMask).
+ *
+ * @this {Memory}
+ * @param {number} off
+ * @param {number} b (which should already be pre-masked to 8 bits; see cpu.setByte())
+ * @param {number} [addr]
+ */
+Card.ACCESS.writeByteMode3 = function writeByteMode3(off, b, addr)
+{
+    var idw = off + this.offset;
+    b = ((b >> this.controller.nDataRotate) | (b << (8 - this.controller.nDataRotate)) & 0xff);
+    var dw = b | (b << 8) | (b << 16) | (b << 24);
+    var dwMask = (dw & this.controller.nBitMapMask);
+    dw = (this.controller.nSetMapData & dwMask) | (this.controller.latches & ~dwMask);
+    dw = (dw & this.controller.nSeqMapMask) | (this.adw[idw] & ~this.controller.nSeqMapMask);
+    if (this.adw[idw] != dw) {
+        this.adw[idw] = dw;
+        this.fDirty = true;
+    }
+    if (DEBUG && this.controller.video.messageEnabled(Messages.MEM | Messages.VIDEO)) {
+        this.controller.video.printMessage("writeByteMode3(" + Str.toHexLong(addr) + "): " + Str.toHexByte(b) + " -> " + Str.toHexLong(dw));
+    }
+};
+
+/*
+ * Mappings from getCardAccess() values to access functions above
+ */
+Card.ACCESS.afn = [];
+
+Card.ACCESS.afn[Card.ACCESS.READ.MODE0]  = Card.ACCESS.readByteMode0;
+Card.ACCESS.afn[Card.ACCESS.READ.MODE0  |  Card.ACCESS.READ.CHAIN4]  = Card.ACCESS.readByteMode0Chain4;
+Card.ACCESS.afn[Card.ACCESS.READ.MODE0  |  Card.ACCESS.READ.EVENODD] = Card.ACCESS.readByteMode0EvenOdd;
+Card.ACCESS.afn[Card.ACCESS.READ.MODE1]  = Card.ACCESS.readByteMode1;
+
+Card.ACCESS.afn[Card.ACCESS.WRITE.MODE0] = Card.ACCESS.writeByteMode0;
+Card.ACCESS.afn[Card.ACCESS.WRITE.MODE0 |  Card.ACCESS.WRITE.ROT] = Card.ACCESS.writeByteMode0Rot;
+Card.ACCESS.afn[Card.ACCESS.WRITE.MODE0 |  Card.ACCESS.WRITE.AND] = Card.ACCESS.writeByteMode0And;
+Card.ACCESS.afn[Card.ACCESS.WRITE.MODE0 |  Card.ACCESS.WRITE.OR]  = Card.ACCESS.writeByteMode0Or;
+Card.ACCESS.afn[Card.ACCESS.WRITE.MODE0 |  Card.ACCESS.WRITE.XOR] = Card.ACCESS.writeByteMode0Xor;
+Card.ACCESS.afn[Card.ACCESS.WRITE.MODE0 |  Card.ACCESS.WRITE.CHAIN4]  = Card.ACCESS.writeByteMode0Chain4;
+Card.ACCESS.afn[Card.ACCESS.WRITE.MODE0 |  Card.ACCESS.WRITE.EVENODD] = Card.ACCESS.writeByteMode0EvenOdd;
+Card.ACCESS.afn[Card.ACCESS.WRITE.MODE1] = Card.ACCESS.writeByteMode1;
+Card.ACCESS.afn[Card.ACCESS.WRITE.MODE1 |  Card.ACCESS.WRITE.EVENODD] = Card.ACCESS.writeByteMode1EvenOdd;
+Card.ACCESS.afn[Card.ACCESS.WRITE.MODE2] = Card.ACCESS.writeByteMode2;
+Card.ACCESS.afn[Card.ACCESS.WRITE.MODE2 |  Card.ACCESS.WRITE.AND] = Card.ACCESS.writeByteMode2And;
+Card.ACCESS.afn[Card.ACCESS.WRITE.MODE2 |  Card.ACCESS.WRITE.OR]  = Card.ACCESS.writeByteMode2Or;
+Card.ACCESS.afn[Card.ACCESS.WRITE.MODE2 |  Card.ACCESS.WRITE.XOR] = Card.ACCESS.writeByteMode2Xor;
+Card.ACCESS.afn[Card.ACCESS.WRITE.MODE3] = Card.ACCESS.writeByteMode3;
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class Video extends Component {
+    /**
+     * Video(parmsVideo, canvas, context, textarea, container)
+     *
+     * The Video component can be configured with the following (parmsVideo) properties:
+     *
+     *      model: model (eg, "mda" for Monochrome Display Adapter)
+     *      mode: initial video mode (default is null, which selects a mode based on model)
+     *      screenWidth: width of the screen canvas, in pixels
+     *      screenHeight: height of the screen canvas, in pixels
+     *      screenColor: background color of the screen canvas (default is black)
+     *      scale: true for font scaling, false (default) to center the display on the screen
+     *      charCols: number of character columns
+     *      charRows: number of character rows
+     *      fontROM: path to .rom file (or a JSON representation) containing the character set
+     *      touchScreen: string specifying desired touch-screen support (default is none)
+     *      autoLock: true to (attempt to) auto-lock the mouse to the canvas (default is false)
+     *
+     * An EGA/VGA may specify the following additional properties:
+     *
+     *      switches: string representing EGA switches (see "SW1-SW4" documentation below)
+     *      memory: the size of the EGA's on-board memory (overrides EGA's Video.cardSpecs)
+     *
+     * This calls the Bus to allocate a video buffer at the appropriate memory location whenever
+     * a reset() or setMode() occurs; setMode() is called whenever a mode change is detected at
+     * the port level, and whenever reset() is called.  setMode() also invokes updateScreen(true),
+     * which forces reallocation of our internal buffer (aCellCache) that mirrors the video buffer.
+     *
+     * The CPU periodically calls updateVideo(), which in turn calls updateScreen() for each Video
+     * instance.  These updates should occur at a rate of 60 times/second, to update any blinking
+     * elements (the cursor and any cells with the blink attribute), to compare/update the contents
+     * of our internal buffer with the video buffer, and to render any differences between the two
+     * buffers into the associated screen canvas, via either updateChar() or setPixel().
+     *
+     * Thanks to the Bus' new block-based memory manager that allows us to sparse-allocate memory
+     * (in 4Kb increments on 20-bit buses, 16Kb increments on 24-bit buses), updateScreen()
+     * can also ask the CPU for the "dirty" state of all the blocks underlying the video buffer,
+     * bypassing the update completely if the buffer is still clean.
+     *
+     * Sadly, that optimization is defeated if the count of active blink elements is non-zero,
+     * because we must rescan the entire buffer to locate and redraw them all; I'm assuming for now
+     * that, more often than not, very few (if any) blink attributes will be present, and therefore
+     * they're not worth a separate caching mechanism.  If the only blinking element is the cursor,
+     * that's no problem, as we redraw only the one cell containing the cursor (assuming the buffer
+     * is otherwise clean).
+     *
+     * @this {Video}
+     * @param {Object} parmsVideo
+     * @param {Object} [canvas]
+     * @param {Object} [context]
+     * @param {Object} [textarea]
+     * @param {Object} [container]
+     */
+    constructor(parmsVideo, canvas, context, textarea, container)
+    {
+        super("Video", parmsVideo, Messages.VIDEO);
+
+        var video = this;
+        this.fGecko = Web.isUserAgent("Gecko/");
+        var i, sEvent, asWebPrefixes = ['', 'moz', 'ms', 'webkit'];
+
+        /*
+         * This records the model specified (eg, "mda", "cga", "ega", "vga" or "" if none specified);
+         * when a model is specified, it overrides whatever model we infer from the ChipSet's switches
+         * (since those motherboard switches tell us only the type of monitor, not the type of card).
+         */
+        this.model = parmsVideo['model'];
+        var aModelDefaults = Video.MODEL[this.model] || Video.MODEL['mda'];
+
+        this.nCard = aModelDefaults[0];
+        this.cbMemory = parmsVideo['memory'] || 0;  // zero means fallback to the cardSpec's default size
+        this.sSwitches = parmsVideo['switches'];
+
+        /*
+         * powerUp() uses the default mode ONLY if ChipSet doesn't give us a default.
+         */
+        this.nModeDefault = parmsVideo['mode'];
+        if (this.nModeDefault == null || Video.aModeParms[this.nModeDefault] == null) {
+            this.nModeDefault = aModelDefaults[1];
+        }
+
+        /*
+         * setDimensions() uses these values ONLY if it doesn't recognize the video mode.
+         */
+        this.nColsDefault = parmsVideo['charCols'];
+        this.nRowsDefault = parmsVideo['charRows'];
+        if (this.nColsDefault === undefined || this.nRowsDefault === undefined) {
+            this.nColsDefault = Video.aModeParms[this.nModeDefault][0];
+            this.nRowsDefault = Video.aModeParms[this.nModeDefault][1];
+        }
+
+        /*
+         * setDimensions() uses these values unconditionally, as the machine has no idea what the
+         * physical screen size should be.
+         */
+        this.cxScreen = parmsVideo['screenWidth'];
+        this.cyScreen = parmsVideo['screenHeight'];
+
+        /*
+         * We might consider another component parameter to specify the font-doubling setting.
+         * For now, it's based on whether the default SCREEN cell size is sufficiently larger than
+         * the default FONT cell size.
+         */
+        this.fScaleFont = parmsVideo['scale'];
+        this.fDoubleFont = Math.round(this.cxScreen / this.nColsDefault) >= 12;
+
+        this.canvasScreen = canvas;
+        this.contextScreen = context;
+        this.textareaScreen = textarea;
+        this.inputScreen = textarea || canvas || null;
+
+        /*
+         * Support for disabling (or, less commonly, enabling) image smoothing, which all browsers
+         * seem to support now (well, OK, I still have to test the latest MS Edge browser), despite
+         * it still being labelled "experimental technology".  Let's hope the browsers standardize
+         * on this.  I see other options emerging, like the CSS property "image-rendering: pixelated"
+         * that's apparently been added to Chrome.  Sigh.
+         */
+        var fSmoothing = parmsVideo['smoothing'];
+        var sSmoothing = Web.getURLParm('smoothing');
+        if (sSmoothing) fSmoothing = (sSmoothing == "true");
+        if (fSmoothing != null) {
+            for (i = 0; i < asWebPrefixes.length; i++) {
+                sEvent = asWebPrefixes[i];
+                if (!sEvent) {
+                    sEvent = 'imageSmoothingEnabled';
+                } else {
+                    sEvent += 'ImageSmoothingEnabled';
+                }
+                if (this.contextScreen[sEvent] !== undefined) {
+                    this.contextScreen[sEvent] = fSmoothing;
+                    break;
+                }
+            }
+        }
+
+        /*
+         * initBus() will determine touch-screen support; for now, just record values and set defaults.
+         */
+        this.sTouchScreen = parmsVideo['touchScreen'];
+        this.nTouchConfig = Video.TOUCH.NONE;
+
+        /*
+         * If a Mouse exists, we'll be notified when it requests our canvas, and we make a note of it
+         * so that if lockPointer() is ever invoked, we can notify the Mouse.
+         */
+        this.mouse = null;
+        this.fAutoLock = parmsVideo['autoLock'];
+
+        /*
+         * Originally, setMode() would map/unmap the video buffer ONLY when the active card changed,
+         * because as long as an MDA or CGA remained active, its video buffer never changed.  However,
+         * since the EGA can change its video buffer on the fly, setMode() must also compare the card's
+         * hard-coded and/or programmed buffer address/size to the "active" address/size; the latter
+         * is recorded here.
+         */
+        this.addrBuffer = this.sizeBuffer = 0;
+
+        /*
+         * aFonts is an array of font objects indexed by FONT ID.  Font characters are arranged
+         * in 16x16 grids, with one grid per canvas object in the aCanvas array of each font object.
+         *
+         * Each element is a Font object that describes the font size and provides bitmaps for all the font
+         * color permutations.  aFonts.length will be non-zero if ANY fonts are loaded, but do NOT assume
+         * that EVERY font has been loaded; check for the existence of a font by checking for its unique ID
+         * within this sparse array.
+         */
+        this.aFonts = [];
+
+        /*
+         * Instead of (re)allocating a new color array every time getCardColors() is called, we preallocate
+         * an array and simply update the entries as needed.  Note that for an EGA (or a VGA operating in an
+         * EGA-compatible mode), only the first 16 entries get used (derived from the ATC); only when a VGA
+         * is operating in an 8bpp mode are 256 entries used (derived from the DAC rather than the ATC).
+         */
+        this.aRGB = new Array(this.nCard == Video.CARD.VGA? 256 : 16);
+        this.fRGBValid = false;     // whenever this is false, it signals getCardColors() to rebuild aRGB
+
+        /*
+         * Since I've not found clear documentation on a reliable way to check whether a particular DOM element
+         * (other than the BODY element) has focus at any given time, I've added onfocus() and onblur() handlers
+         * to the screen to maintain my own focus state.
+         */
+        this.fHasFocus = false;
+
+        /*
+         * Here's the gross code to handle full-screen support across all supported browsers.  The lack of standards
+         * is exasperating; browsers can't agree on 'full' or 'Full, 'request' or 'Request', 'screen' or 'Screen', and
+         * while some browsers honor other browser prefixes, most browsers don't.
+         */
+        this.container = container;
+        if (this.container) {
+            this.container.doFullScreen = container['requestFullscreen'] || container['msRequestFullscreen'] || container['mozRequestFullScreen'] || container['webkitRequestFullscreen'];
+            if (this.container.doFullScreen) {
+                for (i = 0; i < asWebPrefixes.length; i++) {
+                    sEvent = asWebPrefixes[i] + 'fullscreenchange';
+                    if ('on' + sEvent in document) {
+                        var onFullScreenChange = function() {
+                            var fFullScreen = (document['fullscreenElement'] || document['msFullscreenElement'] || document['mozFullScreenElement'] || document['webkitFullscreenElement']);
+                            video.notifyFullScreen(!!fFullScreen);
+                        };
+                        document.addEventListener(sEvent, onFullScreenChange, false);
+                        break;
+                    }
+                }
+                for (i = 0; i < asWebPrefixes.length; i++) {
+                    sEvent = asWebPrefixes[i] + 'fullscreenerror';
+                    if ('on' + sEvent in document) {
+                        var onFullScreenError = function() {
+                            video.notifyFullScreen(null);
+                        };
+                        document.addEventListener(sEvent, onFullScreenError, false);
+                        break;
+                    }
+                }
+            }
+        }
+
+        /*
+         * More gross code to handle pointer-locking support across all supported browsers.
+         *
+         * TODO: Consider "upgrading" this code to use the same asWebPrefixes array as above, especially once Microsoft
+         * finally releases a browser that supports pointer-locking (post-Windows 10?)
+         */
+        if (this.inputScreen) {
+            this.inputScreen.onfocus = function onFocusScreen() {
+                return video.onFocusChange(true);
+            };
+            this.inputScreen.onblur = function onBlurScreen() {
+                return video.onFocusChange(false);
+            };
+            this.inputScreen.lockPointer = this.inputScreen['requestPointerLock'] || this.inputScreen['mozRequestPointerLock'] || this.inputScreen['webkitRequestPointerLock'];
+            this.inputScreen.unlockPointer = this.inputScreen['exitPointerLock'] || this.inputScreen['mozExitPointerLock'] || this.inputScreen['webkitExitPointerLock'];
+            if (this.inputScreen.lockPointer) {
+                var onPointerLockChange = function() {
+                    var fLocked = (
+                        document['pointerLockElement'] === video.inputScreen ||
+                        document['mozPointerLockElement'] === video.inputScreen ||
+                        document['webkitPointerLockElement'] === video.inputScreen);
+                    video.notifyPointerLocked(fLocked);
+                };
+                if ('onpointerlockchange' in document) {
+                    document.addEventListener('pointerlockchange', onPointerLockChange, false);
+                } else if ('onmozpointerlockchange' in document) {
+                    document.addEventListener('mozpointerlockchange', onPointerLockChange, false);
+                } else if ('onwebkitpointerlockchange' in document) {
+                    document.addEventListener('webkitpointerlockchange', onPointerLockChange, false);
+                }
+            }
+        }
+
+        /*
+         * As far as overall image quality of scaled fonts, these options don't seem necessary for Safari (and
+         * don't have any discernible effect anyway). Turning 'webkitImageSmoothingEnabled' off DOES have an effect
+         * on Chrome, but it's not really a positive effect overall, so I'm leaving these off for now.
+         *
+         *  if (this.contextScreen) {
+         *      this.contextScreen['mozImageSmoothingEnabled'] = false;
+         *      this.contextScreen['webkitImageSmoothingEnabled'] = false;
+         *  }
+         */
+
+        var sFileURL = parmsVideo['fontROM'];
+        if (sFileURL) {
+            var sFileExt = Str.getExtension(sFileURL);
+            if (sFileExt != "json") {
+                sFileURL = Web.getHost() + DumpAPI.ENDPOINT + '?' + DumpAPI.QUERY.FILE + '=' + sFileURL + '&' + DumpAPI.QUERY.FORMAT + '=' + DumpAPI.FORMAT.BYTES;
+            }
+            Web.getResource(sFileURL, null, true, function(sURL, sResponse, nErrorCode) {
+                video.doneLoad(sURL, sResponse, nErrorCode);
+            });
+        }
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * This is a notification issued by the Computer component, after all the other components (notably the CPU)
+     * have had a chance to initialize.
+     *
+     * @this {Video}
+     * @param {Computer} cmp
+     * @param {Bus} bus
+     * @param {X86CPU} cpu
+     * @param {DebuggerX86} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+
+        /*
+         * nCard will be undefined if no model was explicitly set (whereas this.nCard is ALWAYS defined).
+         */
+        var aModel = Video.MODEL[this.model], nCard = aModel && aModel[0];
+
+        /*
+         * The only time we do NOT want to trap MDA ports is when the model has been explicitly set to CGA.
+         */
+        if (nCard !== Video.CARD.CGA) {
+            bus.addPortInputTable(this, Video.aMDAPortInput);
+            bus.addPortOutputTable(this, Video.aMDAPortOutput);
+        }
+
+        /*
+         * Similarly, the only time we do NOT want to trap CGA ports is when the model is explicitly set to MDA.
+         */
+        if (nCard !== Video.CARD.MDA) {
+            bus.addPortInputTable(this, Video.aCGAPortInput);
+            bus.addPortOutputTable(this, Video.aCGAPortOutput);
+        }
+
+        /*
+         * Note that in the case of EGA and VGA models, the above code ensures that we will trap both MDA and CGA
+         * port ranges -- which is good, because both the EGA and VGA can be reprogrammed to respond to those ports,
+         * but also potentially bad if you want to simulate a "dual display" system, where one of the displays is
+         * driven by either an MDA or CGA.
+         *
+         * However, you should still be able to make that work by loading the MDA or CGA video component first, because
+         * components should be initialized in the order they appear in the machine configuration file.  Any attempt
+         * by another component to trap the same ports should be ignored.
+         */
+        if (this.nCard >= Video.CARD.EGA) {
+            bus.addPortInputTable(this, Video.aEGAPortInput);
+            bus.addPortOutputTable(this, Video.aEGAPortOutput);
+        }
+
+        if (this.nCard == Video.CARD.VGA) {
+            bus.addPortInputTable(this, Video.aVGAPortInput);
+            bus.addPortOutputTable(this, Video.aVGAPortOutput);
+        }
+
+        if (DEBUGGER && dbg) {
+            var video = this;
+            dbg.messageDump(Messages.VIDEO, function onDumpVideo(asArgs) {
+                video.dumpVideo(asArgs);
+            });
+        }
+
+        /*
+         * If we have an associated keyboard, then ensure that the keyboard will be notified
+         * whenever the canvas gets focus and receives input.
+         */
+        this.kbd = cmp.getMachineComponent("Keyboard");
+        if (this.kbd && this.canvasScreen) {
+            for (var s in this.bindings) {
+                if (s.indexOf("lock") > 0) this.kbd.setBinding("led", s, this.bindings[s]);
+            }
+            this.kbd.setBinding(this.textareaScreen? "textarea" : "canvas", "screen", this.inputScreen);
+        }
+
+        this.bEGASwitches = 0x09;   // our default "switches" setting (see aEGAMonitorSwitches)
+        this.chipset = cmp.getMachineComponent("ChipSet");
+        if (this.chipset && this.sSwitches) {
+            if (this.nCard == Video.CARD.EGA) {
+                this.bEGASwitches = this.chipset.parseDIPSwitches(this.sSwitches, this.bEGASwitches);
+            }
+        }
+
+        /*
+         * The default value for the 'touchScreen' parameter is an empty string; machine configs must explicitly
+         * select one of the following values, via the 'touchscreen' attribute in the <video> element, to enable any
+         * touch-screen support.
+         */
+        if (this.sTouchScreen == "mouse") {
+            this.mouse = cmp.getMachineComponent("Mouse");
+            if (this.mouse) this.captureTouch(Video.TOUCH.MOUSE);
+        }
+        else if (this.sTouchScreen == "keygrid") {
+            if (this.kbd) this.captureTouch(Video.TOUCH.KEYGRID);
+        }
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * @this {Video}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "refresh")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        var video = this;
+
+        if (!this.bindings[sBinding]) {
+
+            /*
+             * We now save every binding that comes in, so that if there are bindings for "caps-lock' and the like,
+             * we can forward them to the Keyboard.  TODO: Perhaps we should limit this to sHTMLType == "led", and collect
+             * them in a separate object (eg, ledBindings), so that initBus() can safely enumerate JUST the LEDs.  This
+             * is what we do in PC8080.  Be aware that's there's also sHTMLType == "rled" now, too.
+             */
+            this.bindings[sBinding] = control;
+
+            switch (sBinding) {
+
+            case "fullScreen":
+                if (this.container && this.container.doFullScreen) {
+                    control.onclick = function onClickFullScreen() {
+                        if (DEBUG) video.printMessage("fullScreen()");
+                        video.doFullScreen();
+                    };
+                } else {
+                    if (DEBUG) this.log("FullScreen API not available");
+                    control.parentNode.removeChild(/** @type {Node} */ (control));
+                }
+                return true;
+
+            case "lockPointer":
+                this.sLockMessage = control.textContent;
+                if (this.inputScreen && this.inputScreen.lockPointer) {
+                    control.onclick = function onClickLockPointer() {
+                        if (DEBUG) video.printMessage("lockPointer()");
+                        video.lockPointer(true);
+                    };
+                } else {
+                    if (DEBUG) this.log("Pointer Lock API not available");
+                    control.parentNode.removeChild(/** @type {Node} */ (control));
+                }
+                return true;
+
+            case "refresh":
+                control.onclick = function onClickRefresh() {
+                    if (DEBUG) video.printMessage("refreshScreen()");
+                    video.updateScreen(true);
+                };
+                return true;
+
+            default:
+                break;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * setFocus()
+     *
+     * @this {Video}
+     */
+    setFocus()
+    {
+        if (this.inputScreen) this.inputScreen.focus();
+    }
+
+    /**
+     * getInput()
+     *
+     * This is an interface used by the Mouse component, so that it can invoke capture/release mouse events from the screen element.
+     *
+     * @this {Video}
+     * @param {Mouse} [mouse]
+     * @return {Object|undefined}
+     */
+    getInput(mouse)
+    {
+        this.mouse = mouse;
+        return this.inputScreen;
+    }
+
+    /**
+     * doFullScreen()
+     *
+     * @this {Video}
+     * @return {boolean} true if request successful, false if not (eg, failed OR not supported)
+     */
+    doFullScreen()
+    {
+        var fSuccess = false;
+        if (this.container) {
+            if (this.container.doFullScreen) {
+                /*
+                 * Styling the container with a width of "100%" and a height of "auto" works great when the aspect ratio
+                 * of our virtual screen is at least roughly equivalent to the physical screen's aspect ratio, but now that
+                 * we support virtual VGA screens with an aspect ratio of 1.33, that's very much out of step with modern
+                 * wide-screen monitors, which usually have an aspect ratio of 1.6 or greater.
+                 *
+                 * And unfortunately, none of the browsers I've tested appear to make any attempt to scale our container to
+                 * the physical screen's dimensions, so the bottom of our screen gets clipped.  To prevent that, I reduce
+                 * the width from 100% to whatever percentage will accommodate the entire height of the virtual screen.
+                 *
+                 * NOTE: Mozilla recommends both a width and a height of "100%", but all my tests suggest that using "auto"
+                 * for height works equally well, so I'm sticking with it, because "auto" is also consistent with how I've
+                 * implemented a responsive canvas when the browser window is being resized.
+                 */
+                var sWidth = "100%";
+                var sHeight = "auto";
+                if (screen && screen.width && screen.height) {
+                    var aspectPhys = screen.width / screen.height;
+                    var aspectVirt = this.cxScreen / this.cyScreen;
+                    if (aspectPhys > aspectVirt) {
+                        sWidth = Math.round(aspectVirt / aspectPhys * 100) + '%';
+                    }
+                    // TODO: We may need to someday consider the case of a physical screen with an aspect ratio < 1.0....
+                }
+                if (!this.fGecko) {
+                    this.container.style.width = sWidth;
+                    this.container.style.height = sHeight;
+                } else {
+                    /*
+                     * Sadly, the above code doesn't work for Firefox, because as http://developer.mozilla.org/en-US/docs/Web/Guide/API/DOM/Using_full_screen_mode
+                     * explains:
+                     *
+                     *      'It's worth noting a key difference here between the Gecko and WebKit implementations at this time:
+                     *      Gecko automatically adds CSS rules to the element to stretch it to fill the screen: "width: 100%; height: 100%".
+                     *
+                     * Which would be OK if Gecko did that BEFORE we're called, but apparently it does that AFTER, effectively
+                     * overwriting our careful calculations.  So we style the inner element (canvasScreen) instead, which
+                     * requires even more work to ensure that the canvas is properly centered.  FYI, this solution is consistent
+                     * with Mozilla's recommendation for working around their automatic CSS rules:
+                     *
+                     *      '[I]f you're trying to emulate WebKit's behavior on Gecko, you need to place the element you want
+                     *      to present inside another element, which you'll make fullscreen instead, and use CSS rules to adjust
+                     *      the inner element to match the appearance you want.'
+                     */
+                    this.canvasScreen.style.width = sWidth;
+                    this.canvasScreen.style.width = sWidth;
+                    this.canvasScreen.style.display = "block";
+                    this.canvasScreen.style.margin = "auto";
+                }
+                this.container.style.backgroundColor = "black";
+                this.container.doFullScreen();
+                fSuccess = true;
+            }
+            this.setFocus();
+        }
+        return fSuccess;
+    }
+
+    /**
+     * notifyFullScreen(fFullScreen)
+     *
+     * @this {Video}
+     * @param {boolean|null} fFullScreen (null if there was a full-screen error)
+     */
+    notifyFullScreen(fFullScreen)
+    {
+        if (!fFullScreen && this.container) {
+            if (!this.fGecko) {
+                this.container.style.width = this.container.style.height = "";
+            } else {
+                this.canvasScreen.style.width = this.canvasScreen.style.height = "";
+            }
+        }
+        this.printMessage("notifyFullScreen(" + fFullScreen + ")", true);
+        if (this.kbd) this.kbd.notifyEscape(fFullScreen);
+    }
+
+    /**
+     * lockPointer()
+     *
+     * @this {Video}
+     * @param {boolean} fLock
+     * @return {boolean} true if request successful, false if not (eg, failed OR not supported)
+     */
+    lockPointer(fLock)
+    {
+        var fSuccess = false;
+        if (this.inputScreen) {
+            if (fLock) {
+                if (this.inputScreen.lockPointer) {
+                    this.inputScreen.lockPointer();
+                    if (this.mouse) this.mouse.notifyPointerLocked(true);
+                    fSuccess = true;
+                }
+            } else {
+                if (this.inputScreen.unlockPointer) {
+                    this.inputScreen.unlockPointer();
+                    if (this.mouse) this.mouse.notifyPointerLocked(false);
+                    fSuccess = true;
+                }
+            }
+            this.setFocus();
+        }
+        return fSuccess;
+    }
+
+    /**
+     * notifyPointerActive(fActive)
+     *
+     * @this {Video}
+     * @param {boolean} fActive
+     * @return {boolean} true if autolock enabled AND pointer lock supported, false if not
+     */
+    notifyPointerActive(fActive)
+    {
+        if (this.fAutoLock) {
+            return this.lockPointer(fActive);
+        }
+        return false;
+    }
+
+    /**
+     * notifyPointerLocked(fLocked)
+     *
+     * @this {Video}
+     * @param {boolean} fLocked
+     */
+    notifyPointerLocked(fLocked)
+    {
+        if (this.mouse) {
+            this.mouse.notifyPointerLocked(fLocked);
+            if (this.kbd) this.kbd.notifyEscape(fLocked);
+        }
+        var control = this.bindings["lockPointer"];
+        if (control) control.textContent = (fLocked? "Press Esc to Unlock Pointer" : this.sLockMessage);
+    }
+
+    /**
+     * captureTouch(nTouchConfig)
+     *
+     * @this {Video}
+     * @param {number} nTouchConfig (must be one of the supported Video.TOUCH values)
+     */
+    captureTouch(nTouchConfig)
+    {
+        var control = this.inputScreen;
+        if (control) {
+            var video = this;
+            if (!this.nTouchConfig) {
+                control.addEventListener(
+                    'touchstart',
+                    function onTouchStart(event) { video.onTouchStart(event); },
+                    false                   // we'll specify false for the 'useCapture' parameter for now...
+                );
+                control.addEventListener(
+                    'touchmove',
+                    function onTouchMove(event) { video.onTouchMove(event); },
+                    true
+                );
+                control.addEventListener(
+                    'touchend',
+                    function onTouchEnd(event) { video.onTouchEnd(event); },
+                    false                   // we'll specify false for the 'useCapture' parameter for now...
+                );
+
+                /*
+                 * Using desktop mouse events to simulate touch events should only be enabled as needed.
+                 *
+                if (DEBUG) {
+                    control.addEventListener(
+                        'mousedown',
+                        function onMouseDown(event) { video.onTouchStart(event); },
+                        false               // we'll specify false for the 'useCapture' parameter for now...
+                    );
+                    control.addEventListener(
+                        'mousemove',
+                        function onMouseMove(event) { video.onTouchMove(event); },
+                        true
+                    );
+                    control.addEventListener(
+                        'mouseup',
+                        function onMouseUp(event) { video.onTouchEnd(event); },
+                        false               // we'll specify false for the 'useCapture' parameter for now...
+                    );
+                }
+                */
+
+                // this.log("touch events captured");
+
+                this.nTouchConfig = nTouchConfig;
+                this.xTouch = this.yTouch = this.timeTouch = -1;
+
+                /*
+                 * As long as fTouchDefault is false, we call preventDefault() on every touch event, to prevent
+                 * the page from moving/scrolling while the canvas is processing touch events.  However, there must
+                 * also be exceptions to permit the soft keyboard to activate; see processTouchEvent() for details.
+                 */
+                this.fTouchDefault = false;
+
+                /*
+                 * I also need to come up with some rules for when the simulated mouse's primary button stays down.
+                 * Let's try setting a timeout handler whenever a touchstart is received, which we'll immediately cancel
+                 * as soon as a touchmove or touchend event is received, and if the timeout handler fires, we'll set
+                 * fLongTouch to true.
+                 */
+                this.hLongTouch = null;
+                this.fLongTouch = false;
+                this.onLongTouch = function onLongTouch() { video.startLongTouch(); };
+            }
+        }
+    }
+
+    /**
+     * onFocusChange(fFocus)
+     *
+     * @this {Video}
+     * @param {boolean} fFocus is true if gaining focus, false if losing it
+     */
+    onFocusChange(fFocus)
+    {
+        /*
+         * As per http://stackoverflow.com/questions/6740253/disable-scrolling-when-changing-focus-form-elements-ipad-web-app,
+         * I decided to try this work-around to prevent the webpage from scrolling around whenever the canvas is given
+         * focus.  That sort of scrolling-into-view sounds great in principle, but in practice, if you were reading some other
+         * portion of the page, it can be irritating to be scrolled away from that portion when refreshing/returning to the page.
+         *
+         * However, this work-around doesn't seem to work with the latest version of Safari (or else I misunderstood something).
+         *
+         *  if (fFocus) {
+         *      window.scrollTo(0, 0);
+         *      document.body.scrollTop = 0;
+         *  }
+         */
+        this.fHasFocus = fFocus;
+        if (this.kbd) this.kbd.onFocusChange(fFocus);
+    }
+
+    /**
+     * onTouchStart(event)
+     *
+     * @this {Video}
+     * @param {Event} event object from a 'touch' event
+     */
+    onTouchStart(event)
+    {
+        if (DEBUG) this.printMessage("onTouchStart()");
+        this.processTouchEvent(event, true);
+    }
+
+    /**
+     * onTouchMove(event)
+     *
+     * @this {Video}
+     * @param {Event} event object from a 'touch' event
+     */
+    onTouchMove(event)
+    {
+        if (DEBUG) this.printMessage("onTouchMove()");
+        this.processTouchEvent(event);
+    }
+
+    /**
+     * onTouchEnd(event)
+     *
+     * @this {Video}
+     * @param {Event} event object from a 'touch' event
+     */
+    onTouchEnd(event)
+    {
+        if (DEBUG) this.printMessage("onTouchEnd()");
+        this.processTouchEvent(event, false);
+    }
+
+    /**
+     * processTouchEvent(event, fStart)
+     *
+     * If nTouchConfig is non-zero, touch event handlers are installed, which pass their events to this function.
+     *
+     * What we do with those events here depends on the value of nTouchConfig.  Originally, the only supported
+     * configuration was the experimental conversion of touch events into arrow keys, based on an invisible grid
+     * that divided the screen into thirds; that configuration is now identified as Video.TOUCH.KEYGRID.
+     *
+     * The new preferred configuration is Video.TOUCH.MOUSE, which does little more than allow you to "push" the
+     * simulated mouse around.  If Video.TOUCH.MOUSE is enabled, it's already been confirmed the machine has a mouse.
+     *
+     * @this {Video}
+     * @param {Event} event object from a 'touch' event
+     * @param {boolean} [fStart] (true if 'touchstart', false if 'touchend', undefined if 'touchmove')
+     */
+    processTouchEvent(event, fStart)
+    {
+        var xTouch, yTouch;
+
+        // if (!event) event = window.event;
+
+        /*
+         * Touch coordinates (that is, the pageX and pageY properties) are relative to the page, so to make
+         * them relative to the canvas, we must subtract the canvas's left and top positions.  This Apple web page:
+         *
+         *      https://developer.apple.com/library/safari/documentation/AudioVideo/Conceptual/HTML-canvas-guide/AddingMouseandTouchControlstoCanvas/AddingMouseandTouchControlstoCanvas.html
+         *
+         * makes it sound simple, but it turns out we have to walk the canvas' entire "parentage" of DOM elements
+         * to get the exact offsets.
+         *
+         * TODO: Determine whether the getBoundingClientRect() code used in panel.js for mouse events can also
+         * be used here to simplify this annoyingly complicated code for touch events.
+         */
+        var xTouchOffset = 0;
+        var yTouchOffset = 0;
+        var eCurrent = this.canvasScreen;
+
+        do {
+            if (!isNaN(eCurrent.offsetLeft)) {
+                xTouchOffset += eCurrent.offsetLeft;
+                yTouchOffset += eCurrent.offsetTop;
+            }
+        } while ((eCurrent = eCurrent.offsetParent));
+
+        /*
+         * Due to the responsive nature of our pages, the displayed size of the canvas may be smaller than the
+         * allocated size, and the coordinates we receive from touch events are based on the currently displayed size.
+         */
+        var xScale =  this.cxScreen / this.canvasScreen.offsetWidth;
+        var yScale = this.cyScreen / this.canvasScreen.offsetHeight;
+
+        /**
+         * @name Event
+         * @property {Array} targetTouches
+         */
+        if (!event.targetTouches || !event.targetTouches.length) {
+            xTouch = event.pageX;
+            yTouch = event.pageY;
+        } else {
+            xTouch = event.targetTouches[0].pageX;
+            yTouch = event.targetTouches[0].pageY;
+        }
+
+        xTouch = ((xTouch - xTouchOffset) * xScale);
+        yTouch = ((yTouch - yTouchOffset) * yScale);
+
+        if (this.nTouchConfig == Video.TOUCH.KEYGRID) {
+
+            var xThird = (xTouch / (this.cxScreen / 3)) | 0;
+            var yThird = (yTouch / (this.cyScreen / 3)) | 0;
+
+            /*
+             * At this point, xThird and yThird should both be one of 0, 1 or 2, indicating which horizontal and vertical
+             * third of the virtual screen the touch event occurred.
+             */
+            if (/* xThird == 1 && */ yThird != 1) {
+                if (!yThird) {
+                    this.kbd.addActiveKey(Keyboard.CLICKCODES.UP, true);
+                } else {
+                    this.kbd.addActiveKey(Keyboard.CLICKCODES.DOWN, true);
+                }
+            } else if (/* yThird == 1 && */ xThird != 1) {
+                if (!xThird) {
+                    this.kbd.addActiveKey(Keyboard.CLICKCODES.LEFT, true);
+                } else {
+                    this.kbd.addActiveKey(Keyboard.CLICKCODES.RIGHT, true);
+                }
+            }
+        } else {
+            if (this.mouse) {
+                /*
+                 * As long as fTouchDefault is false, we call preventDefault() on every touch event, to keep
+                 * the page stable.  However, we must allow some touch event(s) to perform their default action,
+                 * otherwise the soft keyboard can never be activated.  So if a touchstart occurs at least 1/2
+                 * second (500ms) after the last touchstart, with no intervening touchmove events, fTouchDefault
+                 * is allowed to become true.
+                 */
+                var fTouchDefault = this.fTouchDefault;
+                var timeDelta = event.timeStamp - this.timeTouch;
+
+                if (fStart === true) {
+                    this.fTouchDefault = (timeDelta > 500);
+                    this.timeTouch = event.timeStamp;
+                    this.hLongTouch = setTimeout(this.onLongTouch, 500);
+                } else {
+                    if (this.hLongTouch != null) {
+                        clearTimeout(this.hLongTouch);
+                        this.hLongTouch = null;
+                    }
+                }
+                if (fStart === undefined) {
+                    this.fTouchDefault = false;
+                }
+
+                if (DEBUG) {
+                    this.log("processTouchEvent(" + (fStart? "touchStart" : (fStart === false? "touchEnd" : "touchMove")) + "," + timeDelta + "ms," + fTouchDefault + ")");
+                }
+
+                if (!fTouchDefault) {
+                    event.preventDefault();
+                }
+
+                if (fStart === false) {
+                    /*
+                     * NOTE: 200ms is merely my initial stab at a reasonable number of milliseconds to interpret a
+                     * start/end touch sequence as a "tap"; I also make no note of any intervening move events (ie,
+                     * events where fStart is undefined), and perhaps I should....
+                     */
+                    if (this.endLongTouch()) {
+                        return;
+                    }
+                    if (timeDelta < 200) {
+                        this.mouse.clickMouse(Mouse.BUTTON.LEFT, true);
+                        this.mouse.clickMouse(Mouse.BUTTON.LEFT, false);
+                        return;
+                    }
+                }
+                /*
+                 * This 'touchmove" code mimics the 'mousemove' event processing in processMouseEvent() in mouse.js, with
+                 * one important difference: every time touching "restarts", we need to reset the variables used to calculate
+                 * the deltas, so that the mere act of lifting and replacing your finger doesn't generate a delta by itself.
+                 */
+                if (fStart || this.xTouch < 0 || this.yTouch < 0) {
+                    this.xTouch = xTouch;
+                    this.yTouch = yTouch;
+                }
+                var xDelta = Math.round(xTouch - this.xTouch);
+                var yDelta = Math.round(yTouch - this.yTouch);
+                this.xTouch = xTouch;
+                this.yTouch = yTouch;
+                // this.println("moveMouse(" + xDelta + "," + yDelta + ")");
+                this.mouse.moveMouse(xDelta, yDelta, this.xTouch, this.yTouch);
+            }
+        }
+    }
+
+    /**
+     * startLongTouch()
+     *
+     * @this {Video}
+     */
+    startLongTouch()
+    {
+        this.fLongTouch = true;
+        this.mouse.clickMouse(Mouse.BUTTON.LEFT, true);
+    }
+
+    /**
+     * endLongTouch()
+     *
+     * @this {Video}
+     * @return {boolean} true if long touch was active, false if not
+     */
+    endLongTouch()
+    {
+        if (this.fLongTouch) {
+            this.mouse.clickMouse(Mouse.BUTTON.LEFT, false);
+            this.fLongTouch = false;
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {Video}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            if (!data || !this.restore) {
+                this.reset();
+            } else {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * This is where we might add some method of blanking the display, without the disturbing the video
+     * buffer contents, and blocking all further updates to the display.
+     *
+     * @this {Video}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * reset()
+     *
+     * @this {Video}
+     */
+    reset()
+    {
+        var fRandomize = true;
+        var nMonitorType = ChipSet.MONITOR.NONE;
+
+        /*
+         * We'll ask the ChipSet what SW1 indicates for monitor type, but we may override it if a specific
+         * video card model is set.  For EGA, SW1 is supposed to be set to indicate NO monitor, and we rely
+         * on the EGA's own switch settings instead.
+         */
+        if (this.chipset) {
+            nMonitorType = this.chipset.getDIPVideoMonitor();
+        }
+
+        /*
+         * As we noted in the constructor, when a model is specified, that takes precedence over any monitor
+         * switch settings.  Conversely, when no model is specified, the nCard setting is considered provisional,
+         * so the monitor switch settings, if any, are allowed to determine the card type.
+         */
+        if (!this.model) {
+            this.nCard = (nMonitorType == ChipSet.MONITOR.MONO? Video.CARD.MDA : Video.CARD.CGA);
+        }
+
+        this.nModeDefault = Video.MODE.CGA_80X25;
+
+        switch (this.nCard) {
+        case Video.CARD.VGA:
+            nMonitorType = ChipSet.MONITOR.VGACOLOR;
+            break;
+        case Video.CARD.EGA:
+            var aMonitors = Video.aEGAMonitorSwitches[this.bEGASwitches];
+            /*
+             * TODO: Figure out how to deal with aMonitors[2], the boolean which indicates
+             * whether the EGA is driving the primary monitor (true) or the secondary monitor (false).
+             */
+            if (aMonitors) nMonitorType = aMonitors[0];
+            if (!nMonitorType) nMonitorType = ChipSet.MONITOR.EGACOLOR;
+            break;
+        case Video.CARD.MDA:
+            nMonitorType = ChipSet.MONITOR.MONO;
+            this.nModeDefault = Video.MODE.MDA_80X25;
+            break;
+        case Video.CARD.CGA:
+            /* falls through */
+        default:
+            nMonitorType = ChipSet.MONITOR.COLOR;
+            break;
+        }
+
+        if (this.nMonitorType !== nMonitorType) {
+            this.nMonitorType = nMonitorType;
+            fRandomize = true;
+        }
+
+        this.cardActive = null;
+        this.cardMono = this.cardMDA = new Card(this, Video.CARD.MDA);
+        this.cardColor = this.cardCGA = new Card(this, Video.CARD.CGA);
+
+        if (this.nCard < Video.CARD.EGA) {
+            this.cardEGA = new Card();      // define a dummy (uninitialized) EGA card for now
+        }
+        else {
+            this.cardEGA = new Card(this, this.nCard, null, this.cbMemory);
+            this.enableEGA();
+        }
+
+        /*
+         * We need to call buildFonts() *after* the card(s) are initialized but *before* setMode() is called.
+         */
+        this.buildFonts();
+
+        this.nMode = null;
+        this.iCellCursor = -1;  // initially, there is no visible cursor cell
+        this.cBlinks = -1;      // initially, blinking is not active
+        this.cBlinkVisible = 0; // no visible blinking characters (yet)
+
+        this.setMode(this.nModeDefault);
+
+        if (this.cardActive.addrBuffer && fRandomize) {
+            /*
+             * On the initial power-on, we initialize the video buffer to random characters, as a way of testing
+             * whether our font(s) were successfully loaded.  It's assumed that our default display mode is a text mode,
+             * and that since this is a reset, the CRTC.START_ADDR registers are zero as well.
+             *
+             * If this is an MDA device, then the buffer should reside at 0xB0000 through 0xB0FFF, for a total length
+             * of 4Kb (0x1000), where every even byte contains a character code, and every odd byte contains an attribute
+             * code.  See the ATTR bit definitions above for applicable color, intensity, and blink values.  On a CGA
+             * device, the buffer resides at 0xB8000 through 0xBBFFF, for a total length of 16Kb.
+             *
+             * Note that the only valid MDA display mode (7) is the 80x25 text mode, which uses 4000 bytes (2000 character
+             * bytes + 2000 attribute bytes), not all 4096 bytes; addrScreenLimit reflects the visible limit, not the
+             * physical limit.  Also, as noted in updateScreen(), this simplistic calculation of the extent of visible
+             * screen memory is valid only for text modes; in general, it's safer to use cardActive.sizeBuffer as the extent.
+             */
+            var addrScreenLimit = this.cardActive.addrBuffer + this.cbScreen;
+            for (var addrScreen = this.cardActive.addrBuffer; addrScreen < addrScreenLimit; addrScreen += 2) {
+                var dataRandom = (Math.random() * 0x10000)|0;
+                var bChar, bAttr;
+                if (this.nMonitorType == ChipSet.MONITOR.EGACOLOR || this.nMonitorType == ChipSet.MONITOR.VGACOLOR) {
+                    /*
+                     * For the EGA, we choose sequential characters; for random characters, copy the MDA/CGA code below.
+                     */
+                    bChar = (addrScreen >> 1) & 0xff;
+                    bAttr = (dataRandom >> 8) & ~Video.ATTRS.BGND_BLINK;    // TODO: turn blink attributes off unless we can ensure blinking is initially disabled
+                    if ((bAttr >> 4) == (bAttr & 0xf)) {
+                        bAttr ^= 0x0f;      // if background matches foreground, invert foreground to ensure character visibility
+                    }
+                } else {
+                    bChar = dataRandom & 0xff;
+                    bAttr = ((dataRandom & 0x100)? (Video.ATTRS.FGND_WHITE | Video.ATTRS.BGND_BLACK) : (Video.ATTRS.FGND_BLACK | Video.ATTRS.BGND_WHITE)) | ((Video.ATTRS.FGND_BRIGHT /* | Video.ATTRS.BGND_BLINK */) & (dataRandom >> 8));
+                }
+                this.bus.setShortDirect(addrScreen, bChar | (bAttr << 8));
+            }
+            this.updateScreen(true);
+        }
+    }
+
+    /**
+     * enableEGA()
+     *
+     * Redirect cardMono or cardColor to cardEGA as appropriate.
+     *
+     * @this {Video}
+     */
+    enableEGA()
+    {
+        if (!(this.cardEGA.regMisc & Card.MISC.IO_SELECT)) {
+            this.cardMono = this.cardEGA;
+            this.cardColor = this.cardCGA;  // this is done mainly to siphon away any CGA I/O
+        } else {
+            this.cardMono = this.cardMDA;   // similarly, this is done to siphon away any MDA I/O
+            this.cardColor = this.cardEGA;
+        }
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the Video component.
+     *
+     * @this {Video}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, this.cardMDA.saveCard());
+        state.set(1, this.cardCGA.saveCard());
+        state.set(2, [this.nMonitorType, this.nModeDefault, this.nMode]);
+        state.set(3, this.cardEGA.saveCard());
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the Video component.
+     *
+     * @this {Video}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        var a = data[2];
+        this.nMonitorType = a[0];
+        this.nModeDefault = a[1];
+        this.nMode = a[2];
+
+        this.cardActive = null;
+        this.cardMono = this.cardMDA = new Card(this, Video.CARD.MDA, data[0]);
+        this.cardColor = this.cardCGA = new Card(this, Video.CARD.CGA, data[1]);
+
+        /*
+         * If no EGA was originally initialized, then cardEGA will remain uninitialized.
+         */
+        this.cardEGA = new Card(this, this.nCard, data[3], this.cbMemory);
+        if (this.cardEGA.fActive) this.enableEGA();
+
+        /*
+         * We need to call buildFonts() *after* the card(s) are initialized but *before* setMode() is called.
+         */
+        this.buildFonts();
+
+        /*
+         * While I could restore the active card here, it's better for setMode() to do it, because
+         * setMode() will also take care of mapping the appropriate video buffer.  So, after restore() has
+         * finished, we call checkMode(), because the current video mode (nMode) is determined by the
+         * active card state.
+         *
+         * Unfortunately, that creates a chicken-and-egg problem, since I just said I didn't want to select
+         * the active card here.
+         *
+         * So, we'll add some "cop-out" code to checkMode(): if there's no active card, then fall-back
+         * to the last known video mode (nMode) and force a call to setMode().
+         *
+         *      this.cardActive = (this.cardMDA.fActive? this.cardMDA : (this.cardCGA.fActive? this.cardCGA : undefined));
+         */
+        if (!this.checkMode()) return false;
+
+        this.checkCursor();
+        return true;
+    }
+
+    /**
+     * doneLoad(sURL, sFontData, nErrorCode)
+     *
+     * @this {Video}
+     * @param {string} sURL
+     * @param {string} sFontData
+     * @param {number} nErrorCode (response from server if anything other than 200)
+     */
+    doneLoad(sURL, sFontData, nErrorCode)
+    {
+        if (nErrorCode) {
+            this.notice("Unable to load font ROM (error " + nErrorCode + ": " + sURL + ")");
+            return;
+        }
+
+        Component.addMachineResource(this.idMachine, sURL, sFontData);
+
+        try {
+            /*
+             * The most likely source of any exception will be right here, where we're parsing the JSON-encoded data.
+             */
+            var abFontData = eval("(" + sFontData + ")");
+
+            var ab = abFontData['bytes'] || abFontData;
+
+            if (!ab.length) {
+                Component.error("Empty font ROM: " + sURL);
+                return;
+            }
+            else if (ab.length == 1) {
+                Component.error(ab[0]);
+                return;
+            }
+            /*
+             * Translate the character data into separate "fonts", each of which will be a separate canvas object, with all
+             * 256 characters arranged in a 16x16 grid.
+             */
+            if (ab.length == 8192) {
+                /*
+                 * The assumption here is that we're dealing with the original (IBM) MDA/CGA font data, which apparently
+                 * was identical on both MDA and CGA cards (even though the former had no use for the latter, and vice versa).
+                 *
+                 * First, let's take a look at the MDA portion of the data.  Here are the first few rows of MDA font data,
+                 * at the 0K and 2K boundaries:
+                 *
+                 *      00000000  00 00 00 00 00 00 00 00  00 00 7e 81 a5 81 81 bd  |..........~.....|
+                 *      00000010  00 00 7e ff db ff ff c3  00 00 00 36 7f 7f 7f 7f  |..~........6....|
+                 *      ...
+                 *      00000800  00 00 00 00 00 00 00 00  99 81 7e 00 00 00 00 00  |..........~.....|
+                 *      00000810  e7 ff 7e 00 00 00 00 00  3e 1c 08 00 00 00 00 00  |..~.....>.......|
+                 *
+                 * 8 bytes of data from a row in each of the 2K chunks are combined to form a 8-bit wide character with
+                 * a maximum height of 16 bits.  Assembling the bits for character 0x01 (a happy face), we observe the following:
+                 *
+                 *      0 0 0 0 0 0 0 0  <== 00 from offset 0x0008
+                 *      0 0 0 0 0 0 0 0  <== 00 from offset 0x0009
+                 *      0 1 1 1 1 1 1 0  <== 7e from offset 0x000A
+                 *      1 0 0 0 0 0 0 1  <== 81 from offset 0x000B
+                 *      1 0 1 0 0 1 0 1  <== a5 from offset 0x000C
+                 *      1 0 0 0 0 0 0 1  <== 81 from offset 0x000D
+                 *      1 0 0 0 0 0 0 1  <== 81 from offset 0x000E
+                 *      1 0 1 1 1 1 0 1  <== bd from offset 0x000F
+                 *      1 0 0 1 1 0 0 1  <== 99 from offset 0x0808
+                 *      1 0 0 0 0 0 0 1  <== 81 from offset 0x0809
+                 *      0 1 1 1 1 1 1 0  <== 7e from offset 0x080A
+                 *      0 0 0 0 0 0 0 0  <== 00 from offset 0x080B
+                 *      0 0 0 0 0 0 0 0  <== 00 from offset 0x080C
+                 *      0 0 0 0 0 0 0 0  <== 00 from offset 0x080D
+                 *      0 0 0 0 0 0 0 0  <== 00 from offset 0x080E
+                 *      0 0 0 0 0 0 0 0  <== 00 from offset 0x080F
+                 *
+                 * In the second 2K chunk, we observe that the last two bytes of every font cell definition are zero;
+                 * this confirms our understanding that MDA font cell size is 8x14.
+                 *
+                 * Finally, there's the issue of screen cell size, which is actually 9x14 on the MDA.  We compensate for that
+                 * by building a 9x14 font, even though there's only 8x14 bits of data. As http://www.seasip.info/VintagePC/mda.html
+                 * explains:
+                 *
+                 *      "For characters C0h-DFh, the ninth pixel column is a duplicate of the eighth; for others, it's blank."
+                 *
+                 * This last point is confirmed by "The IBM Personal Computer From The Inside Out", p.295:
+                 *
+                 *      "Another unique feature of the monochrome adapter is a set of line-drawing and area-fill characters
+                 *      that give continuous lines and filled areas. This is unusual for a display with a 9x14 character box
+                 *      because the character generator provides a row only eight dots wide. On most displays, a blank 9th
+                 *      dot is then inserted between characters. On the monochrome display, there is circuitry that duplicates
+                 *      the 8th dot into the 9th dot position for characters whose ASCII codes are 0xB0 [sic] through 0xDF."
+                 *
+                 * However, the above text is mistaken about the start of the range.  While there ARE line-drawing characters
+                 * in the range 0xB0-0xBF, none of them extend all the way to the right edge; IBM carefully segregated them.
+                 * And in fact, characters 0xB0-0xB2 contain hash patterns that you would NOT want extended into the 9th column.
+                 *
+                 * The CGA font is part of the same ROM.  In fact, there are TWO CGA fonts in the ROM: a thin 5x7 "single dot"
+                 * font located at offset 0x1000, and a thick 7x7 "double dot" font at offset 0x1800.  The latter is the default
+                 * font, unless overridden by a jumper setting on the CGA card, so it is our default CGA font as well (although
+                 * someday we may provide a virtual jumper setting that allows you to select the thinner font).
+                 *
+                 * The first offset we must pass to setFontData() is the offset of the CGA font; we choose the thicker "double dot"
+                 * CGA font at 0x1800 (which was the PC's default font as well), instead of the thinner "single dot" font at 0x1000.
+                 * The second offset is for the MDA font.
+                 */
+                this.setFontData(ab, [0x1800, 0x0000]);
+            }
+            else if (ab.length == 2048) {
+                /*
+                 * The assumption here is that we're dealing strictly with CGA (8x8) font data, like the font data found
+                 * in the Columbia Data Products (CDP) Font ROM.
+                 */
+                this.setFontData(ab, [0x0000]);
+            }
+            else {
+                this.notice("Unrecognized font data length (" + ab.length + ")");
+                return;
+            }
+
+        } catch (e) {
+            this.notice("Font ROM data error: " + e.message);
+            return;
+        }
+        /*
+         * If we're still here, then we're ready!
+         *
+         * UPDATE: Per issue #21, I'm issuing setReady() *only* if a valid contextScreen exists *or* a Debugger is attached.
+         *
+         * TODO: Consider a more general-purpose solution for deciding whether or not the user wants to run in a "headless" mode.
+         */
+        if (this.contextScreen || this.dbg) this.setReady();
+    }
+
+    /**
+     * onROMLoad(abRom, aParms)
+     *
+     * Called by the ROM's copyROM() function whenever a ROM component with a 'notify' attribute containing
+     * our component ID has been loaded.
+     *
+     * @this {Video}
+     * @param {Array.<number>} abROM
+     * @param {Array.<number>} [aParms]
+     */
+    onROMLoad(abROM, aParms)
+    {
+        if (this.nCard == Video.CARD.EGA) {
+            /*
+             * TODO: Unlike the MDA/CGA font data, we may want to hang onto this data, so that we can
+             * regenerate the color font(s) whenever the foreground and/or background colors have changed.
+             */
+            if (DEBUG) this.printMessage("onROMLoad(): EGA fonts loaded");
+            /*
+             * For EGA cards, in the absence of any parameters, we assume that we're receiving the original
+             * IBM EGA ROM, which stores its 8x14 font data at 0x2230 as one continuous sequence; the total size
+             * of the 8x14 font is 0xE00 bytes.
+             *
+             * At 0x3030, there is an "ALPHA SUPPLEMENT" table, which contains 15 bytes per row instead of 14,
+             * because each row is preceded by one byte containing the corresponding ASCII code; there are 20
+             * entries in the supplemental table, for a total size of 0x12C bytes.
+             *
+             * Finally, at 0x3160, we have the 8x8 font data (also known as the thicker "double dot" CGA font);
+             * the total size of the 8x8 font is 0x800 bytes.  No other font data is present in the EGA ROM;
+             * the thin 5x7 "single dot" CGA font is notably absent, which is fine, because we never loaded it for
+             * the MDA/CGA either.
+             *
+             * TODO: Determine how the supplemental table is used and whether we need to add some "run-time"
+             * font generation to support it (as opposed to "init-time" generation, which is all we do now).
+             * There's probably a similar need for user-defined fonts; for now, they're simply not supported.
+             */
+            this.setFontData(abROM, aParms || [0x3160, 0x2230], 8);
+        }
+        else if (this.nCard == Video.CARD.VGA) {
+            if (DEBUG) this.printMessage("onROMLoad(): VGA fonts loaded");
+            /*
+             * For VGA cards, in the absence of any parameters, we assume that we're receiving the original
+             * IBM VGA ROM, which contains an 8x14 font at 0x3F8D (and corresponding supplemental table at 0x4D8D)
+             * and an 8x8 font at 0x378D; however, it also contains an 8x16 font at 0x4EBA (and corresponding
+             * supplemental table at 0x5EBA).  See our reconstructed source code in ibm-vga.nasm.
+             */
+            this.setFontData(abROM, aParms || [0x378d, 0x3f8d], 8);
+        }
+        this.setReady();
+    }
+
+    /**
+     * getCardColors(nBitsPerPixel)
+     *
+     * @this {Video}
+     * @param {number} [nBitsPerPixel]
+     * @returns {Array}
+     */
+    getCardColors(nBitsPerPixel)
+    {
+        if (nBitsPerPixel == 1) {
+            /*
+             * Only 2 total colors.
+             */
+            this.aRGB[0] = Video.aCGAColors[Video.ATTRS.FGND_BLACK];
+            this.aRGB[1] = Video.aCGAColors[Video.ATTRS.FGND_WHITE];
+            return this.aRGB;
+        }
+
+        if (nBitsPerPixel == 2) {
+            /*
+             * Of the 4 colors returned, the first color comes from regColor and the other 3 come from one of
+             * the two hard-coded CGA color sets:
+             *
+             *      Color Set 1             Color Set 2
+             *      -----------             -----------
+             *      Background (0x00)       Background (0x00)
+             *      Green      (0x12)       Cyan       (0x13)
+             *      Red        (0x14)       Magenta    (0x15)
+             *      Brown      (0x16)       White      (0x17)
+             *
+             * The numbers in parentheses are the EGA ATC palette register values that the EGA BIOS uses for each
+             * color set; on an EGA, I synthesize a fake CGA regColor value, until I (TODO:) figure out exactly how
+             * the EGA simulates the CGA color palette.
+             */
+            var regColor = this.cardActive.regColor;
+            if (this.cardActive === this.cardEGA) {
+                var bBackground = this.cardEGA.regATCData[0];
+                regColor = bBackground & Card.CGA.COLOR.BORDER;
+                if (bBackground & Card.ATC.PALETTE.BRIGHT) regColor |= Card.CGA.COLOR.BRIGHT;
+                if (this.cardEGA.regATCData[1] != 0x12) regColor |= Card.CGA.COLOR.COLORSET2;
+            }
+            this.aRGB[0] = Video.aCGAColors[regColor & (Card.CGA.COLOR.BORDER | Card.CGA.COLOR.BRIGHT)];
+            var aColorSet = (regColor & Card.CGA.COLOR.COLORSET2)? Video.aCGAColorSet2 : Video.aCGAColorSet1;
+            for (var iColor = 0; iColor < aColorSet.length; iColor++) {
+                this.aRGB[iColor+1] = Video.aCGAColors[aColorSet[iColor]];
+            }
+            return this.aRGB;
+        }
+
+        if (this.cardColor === this.cardCGA) {
+            /*
+             * There's no need to update this.aRGB if we simply want to return a hard-coded set of 16 colors.
+             */
+            return Video.aCGAColors;
+        }
+
+
+
+        if (this.fRGBValid && nBitsPerPixel && !this.aRGB[16]) {
+            this.fRGBValid = false;
+        }
+
+        if (!this.fRGBValid) {
+
+            var card = this.cardEGA;
+            var aDAC = card.regDACData;
+            var aRegs, i, dw, b, bRed, bGreen, bBlue;
+
+            if (nBitsPerPixel == 8) {
+                /*
+                 * The card must be a VGA, and it's using an (8bpp) mode that bypasses the ATC, so we need to pull
+                 * RGB data exclusively from the 256-entry DAC; each entry contains 6-bit red, green, and blue values
+                 * packed into bits 0-5, 6-11, and 12-17, respectively, each of which we effectively shift left 2 bits:
+                 * a crude 6-to-8-bit color conversion.
+                 */
+                for (i = 0; i < 256; i++) {
+                    dw = aDAC[i] || 0;
+
+                    bRed =   (dw << 2) & 0xfc;
+                    bGreen = (dw >> 4) & 0xfc;
+                    bBlue =  (dw >> 10) & 0xfc;
+                    this.aRGB[i] = [bRed, bGreen, bBlue, 0xff];
+                }
+            } else {
+                /*
+                 * We need to pull RGB data from the ATC; moreover, if the ATC hasn't been initialized yet,
+                 * we go with a default EGA-compatible 16-color palette.  We'll also use the DAC if there is one
+                 * (ie, this is actually a VGA) and it appears to be initialized (ie, the VGA BIOS has been run).
+                 */
+                var fDAC = (aDAC && aDAC[255]);
+                aRegs = (card.regATCData[15] != null? card.regATCData : Video.aEGAPalDef);
+                for (i = 0; i < 16; i++) {
+                    b = aRegs[i] & Card.ATC.PALETTE.MASK;
+                    /*
+                     * If the DAC is valid, we need to supplement the 6 bits of each ATC palette entry with the values
+                     * for bits 6 and 7 from the ATC COLORSEL register (and overwrite bits 4 and 5 if ATC.MODE.COLORSEL_ALL
+                     * is set as well).
+                     *
+                     * The only reasons the DAC wouldn't be valid are if 1) we're trying to display an image before the machine
+                     * and its BIOS have had a chance to initialize the DAC (because we don't preset it to anything, although
+                     * perhaps we should), or 2) this is an EGA, which doesn't have a DAC.
+                     */
+                    if (fDAC) {
+                        b |= (card.regATCData[Card.ATC.COLORSEL.INDX] & (Card.ATC.COLORSEL.DAC_BIT7 | Card.ATC.COLORSEL.DAC_BIT6)) << 4;
+                        if (card.regATCData[Card.ATC.MODE.INDX] & Card.ATC.MODE.COLORSEL_ALL) {
+                            b &= ~0x30;
+                            b |= (card.regATCData[Card.ATC.COLORSEL.INDX] & (Card.ATC.COLORSEL.DAC_BIT5 | Card.ATC.COLORSEL.DAC_BIT4)) << 4;
+                        }
+
+                        dw = aDAC[b];
+
+                        bRed =   (dw << 2) & 0xfc;
+                        bGreen = (dw >> 4) & 0xfc;
+                        bBlue =  (dw >> 10) & 0xfc;
+                    } else {
+                        bRed =   (((b & 0x04)? 0xaa : 0) | ((b & 0x20)? 0x55 : 0));
+                        bGreen = (((b & 0x02)? 0xaa : 0) | ((b & 0x10)? 0x55 : 0));
+                        bBlue =  (((b & 0x01)? 0xaa : 0) | ((b & 0x08)? 0x55 : 0));
+                    }
+                    this.aRGB[i] = [bRed, bGreen, bBlue, 0xff];
+                }
+            }
+            this.fRGBValid = true;
+        }
+
+        return this.aRGB;
+    }
+
+    /**
+     * setFontData(abFontData, aFontOffsets, cxFontChar)
+     *
+     * To support partial font rebuilds (required for the EGA), we now preserve the original font data (abFontData),
+     * font offsets (aFontOffsets), and font character width (8 for the EGA, undefined for the MDA/CGA).
+     *
+     * TODO: Ultimately, we want to have exactly one dedicated font for the EGA, the data for which we'll read directly
+     * from plane 2 of video memory, instead of relying on the original font data in ROM.  Relying on the ROM data was
+     * originally just a crutch to help get EGA support bootstrapped.
+     *
+     * Also, for the MDA/CGA, we should be discarding the font data after the first buildFonts() call, because we
+     * should not need to ever rebuild the fonts for those cards (both their font patterns and colors were hard-coded).
+     *
+     * @this {Video}
+     * @param {*} abFontData is the raw font data, from the ROM font file
+     * @param {Array.<number>} aFontOffsets contains offsets into abFontData: [0] for CGA, [1] for MDA
+     * @param {number} [cxFontChar] is a fixed character width to use for all fonts; undefined to use MDA/CGA defaults
+     */
+    setFontData(abFontData, aFontOffsets, cxFontChar)
+    {
+        this.abFontData = abFontData;
+        this.aFontOffsets = aFontOffsets;
+        this.cxFontChar = cxFontChar;
+    }
+
+    /**
+     * buildFonts()
+     *
+     * buildFonts() is called whenever the Video component is reset or restored; we used to build the fonts as soon
+     * as the ROM containing them was loaded, and then throw away the underlying font data, but with the EGA's ability
+     * to change the color of any font, font building must now be deferred until the reset or restore notifications,
+     * ensuring we have access to all the colors the card is currently programmed to use.
+     *
+     * We're also called whenever EGA palette registers are modified, since one or more fonts will likely need
+     * to be rebuilt (this is because our fonts contain pre-rendered images of all glyphs for all 16 active colors).
+     * Calls to buildFonts() should not be expensive though: the underlying createFont() function rebuilds a font only
+     * if its color has actually changed.
+     *
+     * TODO: Our font code is still written with the assumption that, like the MDA/CGA, the underlying font data never
+     * changes.  The EGA, however, stores its fonts in plane 2, which means fonts are dynamic; this needs to be fixed.
+     *
+     * Supporting dynamic EGA fonts should not be hard though.  We can get rid of abFontData and simply build a
+     * temporary snapshot of all the font bytes in plane 2 of the EGA's video buffer (adwMemory), and pass that on to
+     * buildFont() instead.  We'll also need to either invalidate the existing font's color (to trigger a rebuild) or
+     * pass a new "force rebuild" flag.
+     *
+     * Once that's done, an added benefit will be that we can build just the font(s) that have been loaded into plane 2,
+     * instead of the multitude of fonts that we now build on a just-in-case basis (eg, the MDA font, the 8x8 CGA font
+     * for 43-line mode, and so on).
+     *
+     * @this {Video}
+     * @param {boolean} [fRebuild] (true if this is a rebuild, not an initial build)
+     * @return {boolean} true if any or all fonts were (re)built, false if nothing changed
+     */
+    buildFonts(fRebuild)
+    {
+        var fChanges = false;
+
+        /*
+         * There's no point building fonts if this is a non-windowed (command-line) environment
+         * OR no font data is available (OR this is a rebuild AND we're currently in a graphics mode).
+         *
+         * In other words, build fonts if this IS a windowed environment AND font data is available
+         * AND this is not a rebuild, OR it IS a rebuild but we're in a graphics mode (ie, nFont is zero).
+         */
+        if (window && this.abFontData && (!fRebuild || this.nFont)) {
+
+            var offSplit = 0x0000;
+            var cxChar = this.cxFontChar? this.cxFontChar : 8;
+            var aRGBColors = this.getCardColors();
+
+            if (this.aFontOffsets[0] != null) {
+                if (this.buildFont(Video.FONT.CGA, this.aFontOffsets[0], offSplit, cxChar, 8, this.abFontData, aRGBColors)) {
+                    fChanges = true;
+                }
+            }
+
+            offSplit = this.cxFontChar? 0 : 0x0800;
+            cxChar = this.cxFontChar? this.cxFontChar : 9;
+
+            if (this.aFontOffsets[1] != null) {
+                if (this.buildFont(Video.FONT.MDA, this.aFontOffsets[1], offSplit, cxChar, 14, this.abFontData, Video.aMDAColors, Video.aMDAColorMap)) {
+                    fChanges = true;
+                }
+                if (this.cxFontChar) {
+                    if (this.buildFont(this.nCard, this.aFontOffsets[1], 0, this.cxFontChar, 14, this.abFontData, aRGBColors)) {
+                        fChanges = true;
+                    }
+                }
+            }
+        }
+        return fChanges;
+    }
+
+    /**
+     * buildFont(nFont, offData, offSplit, cxChar, cyChar, abFontData, aRGBColors, aColorMap)
+     *
+     * This is a wrapper for createFont() which also takes care loading double-size fonts when fDoubleFont is set.
+     *
+     * @this {Video}
+     * @param {number} nFont
+     * @param {number|null} offData is the offset of the font data, null if none
+     * @param {number} offSplit is the offset of any split font data, or zero if not split
+     * @param {number} cxChar is the width of the font characters
+     * @param {number} cyChar is the height of the font characters
+     * @param {*} abFontData is the raw font data, from the ROM font file
+     * @param {Array} aRGBColors is an array of color RGB variations, corresponding to supported FGND attribute values
+     * @param {Array} [aColorMap] contains color indexes corresponding to attribute values (if not supplied, the mapping is assumed to be 1-1)
+     * @return {boolean} true if any or all fonts were (re)built, false if nothing changed
+     */
+    buildFont(nFont, offData, offSplit, cxChar, cyChar, abFontData, aRGBColors, aColorMap)
+    {
+        var fChanges = false;
+
+        if (offData != null) {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage("buildFont(" + nFont + "): building " + Video.cardSpecs[nFont][0] + " font");
+            }
+            if (this.createFont(nFont, offData, offSplit, cxChar, cyChar, abFontData, aRGBColors, aColorMap)) fChanges = true;
+            /*
+             * If font-doubling is enabled, then load a double-size version of the font as well, as it provides
+             * sharper rendering, especially when the screen cell size is a multiple of the above font cell size;
+             * in the case of the CGA, this may also be useful for 40-column modes.
+             */
+            if (this.fDoubleFont) {
+                nFont <<= 1;
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage("buildFont(" + nFont + "): building " + Video.cardSpecs[nFont >> 1][0] + " double-size font");
+                }
+                if (this.createFont(nFont, offData, offSplit, cxChar, cyChar, abFontData, aRGBColors, aColorMap)) fChanges = true;
+            }
+        }
+        return fChanges;
+    }
+
+    /**
+     * createFont(nFont, offData, offSplit, cxChar, cyChar, abFontData, aRGBColors, aColorMap)
+     *
+     * All color variations are stored on the same font canvas, arranged vertically as a series of grids, where each
+     * grid is a 16x16 character glyph array.
+     *
+     * Since every character must be drawn first with its background color and then with the foreground shape on top,
+     * I used to include a series of empty cells at the top every font canvas containing all supported background colors
+     * (ie, before the character grids).  But now createFont() also creates an aCSSColors array that is saved alongside
+     * the font canvas, and updateChar() uses that array in conjunction with fillRect() to draw character backgrounds.
+     *
+     * @this {Video}
+     * @param {number} nFont
+     * @param {number} offData is the offset of the font data
+     * @param {number} offSplit is the offset of any split font data, or zero if not split
+     * @param {number} cxChar is the width of the font characters
+     * @param {number} cyChar is the height of the font characters
+     * @param {*} abFontData is the raw font data, from the ROM font file
+     * @param {Array} aRGBColors is an array of color RGB variations, corresponding to supported FGND attribute values
+     * @param {Array|undefined} aColorMap contains color indexes corresponding to attribute values (if not supplied, the mapping is assumed to be 1-1)
+     * @return {boolean} true if any or all fonts were (re)created, false if nothing changed
+     */
+    createFont(nFont, offData, offSplit, cxChar, cyChar, abFontData, aRGBColors, aColorMap)
+    {
+        var fChanges = false;
+        var nDouble = (nFont & 0x1)? 0 : 1;
+        var font = this.aFonts[nFont];
+        var nColors = (aRGBColors.length < 16? aRGBColors.length : 16);
+        if (!font) {
+            font = {
+                cxCell:     cxChar << nDouble,
+                cyCell:     cyChar << nDouble,
+                aCSSColors: new Array(nColors),
+                aRGBColors: aRGBColors.slice(0, nColors),   // using the Array slice() method to simply make a copy
+                aColorMap:  aColorMap,
+                aCanvas:    new Array(nColors)
+            };
+        }
+        for (var iColor = 0; iColor < nColors; iColor++) {
+            var rgbColor = aRGBColors[iColor];
+            var rgbColorOrig = font.aCSSColors[iColor]? font.aRGBColors[iColor] : [];
+            if (rgbColor[0] !== rgbColorOrig[0] || rgbColor[1] !== rgbColorOrig[1] || rgbColor[2] !== rgbColorOrig[2]) {
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage("creating font color " + iColor + " for font " + nFont);
+                }
+                this.createFontColor(font, iColor, rgbColor, nDouble, offData, offSplit, cxChar, cyChar, abFontData);
+                fChanges = true;
+            }
+        }
+        this.aFonts[nFont] = font;
+        return fChanges;
+    }
+
+    /**
+     * createFontColor(font, iColor, rgbColor, nDouble, offData, offSplit, cxChar, cyChar, abFontData)
+     *
+     * @this {Video}
+     * @param {Object} font
+     * @param {number} iColor
+     * @param {Array} rgbColor contains the RGB values for iColor
+     * @param {number} nDouble is 1 to double output font dimensions, 0 to match input dimensions
+     * @param {number} offData is the offset of the font data
+     * @param {number} offSplit is the offset of any split font data, or zero if not split
+     * @param {number} cxChar is the width of the font characters
+     * @param {number} cyChar is the height of the font characters
+     * @param {*} abFontData is the raw font data, from the ROM font file
+     */
+    createFontColor(font, iColor, rgbColor, nDouble, offData, offSplit, cxChar, cyChar, abFontData)
+    {
+        /*
+         * Now we're ready to create a 16x16 character grid for the specified color.  Note that all
+         * the character bits are opaque (alpha=0xff) while all the surrounding bits are transparent
+         * (alpha=0x00, as specified in the 4th byte of rgbOff).
+         *
+         * Originally, I created 256 ImageData objects, using context.createImageData(cxChar,cyChar),
+         * then setting its pixels to match those of an individual character, and then drawing characters
+         * with contextFont.putImageData().  But putImageData() is relatively slow....
+         *
+         * Now I create a new canvas, with dimensions that allow me to arrange all 256 characters in an
+         * 16x16 grid -- much like the "chargen.png" bitmap used in the C1Pjs version of the Video component.
+         * Then drawing becomes much the same as before, because it turns out that drawImage() accepts either
+         * an image object OR a canvas object.
+         *
+         * This also yields better performance, since drawImage() is much faster than putImageData().
+         * We still have to use putImageData() to build the font canvas, but that's a one-time operation.
+         */
+        var rgbOff = [0x00, 0x00, 0x00, 0x00];
+        var canvasFont = document.createElement("canvas");
+        canvasFont.width = font.cxCell << 4;
+        canvasFont.height = (font.cyCell << 4);
+        var contextFont = canvasFont.getContext("2d");
+
+        /*
+         * See notes above regarding ImageSmoothingEnabled....
+         *
+         contextFont['mozImageSmoothingEnabled'] = false;
+         contextFont['webkitImageSmoothingEnabled'] = false;
+         */
+
+        var iChar, x, y;
+        var cyLimit = (cyChar < 8 || !offSplit)? cyChar : 8;
+        var imageChar = contextFont.createImageData(font.cxCell, font.cyCell);
+
+        for (iChar = 0; iChar < 256; iChar++) {
+            for (y = 0; y < cyChar; y++) {
+                /*
+                 * fUnderline should be true only in the FONT_MDA case, and only for the odd color variations
+                 * (1 and 3, out of variations 0 to 4), and only for the two bottom-most rows of the character cell
+                 * (which I still need to confirm)
+                 */
+                var fUnderline = (font.aColorMap && (iColor & 0x1) && y >= cyChar - 2);
+                var offChar = (y < cyLimit? offData + iChar * cyLimit + y : offSplit + iChar * cyLimit + y - cyLimit);
+                var b = abFontData[offChar];
+                for (var nRowDoubler = 0; nRowDoubler <= nDouble; nRowDoubler++) {
+                    for (x = 0; x < cxChar; x++) {
+                        /*
+                         * This "bit" of logic takes care of those characters (0xC0-0xDF) whose 9th bit must mirror the 8th bit;
+                         * in all other cases, any bit past the 8th bit is automatically zero.  It also takes care of embedding a solid
+                         * row of bits whenever fUnderline is true.
+                         *
+                         * TODO: For EGA/VGA, replication of the 9th dot needs to be based on the TEXT_9DOT bit of the ATC.MODE
+                         * register, which is particularly important for user-defined fonts that do not want that bit replicated.
+                         */
+                        var bit = (fUnderline? 1 : (b & (0x80 >> (x >= 8 && iChar >= 0xC0 && iChar <= 0xDF? 7 : x))));
+                        var xDst = (x << nDouble);
+                        var yDst = (y << nDouble) + nRowDoubler;
+                        var rgb = (bit? rgbColor : rgbOff);
+                        this.setPixel(imageChar, xDst, yDst, rgb);
+                        if (nDouble) this.setPixel(imageChar, xDst + 1, yDst, rgb);
+                    }
+                }
+            }
+            /*
+             * (iChar >> 4) performs the integer equivalent of Math.floor(iChar / 16), and (iChar & 0xf) is the equivalent of (iChar % 16).
+             */
+            contextFont.putImageData(imageChar, x = (iChar & 0xf) * font.cxCell, y = (iChar >> 4) * font.cyCell);
+        }
+
+        /*
+         * The colors for cell backgrounds and cursor elements must be converted to CSS color strings.
+         */
+        font.aCSSColors[iColor] = "#" + Str.toHex(rgbColor[0], 2) + Str.toHex(rgbColor[1], 2) + Str.toHex(rgbColor[2], 2);
+        font.aRGBColors[iColor] = rgbColor;
+
+        /*
+         * Enable this code if you want to see what the generated font looks like....
+         *
+        if (MAXDEBUG) {
+            var iSrcColor = (iColor == 15? 0 : iColor + 1);
+            this.contextScreen.fillStyle = aCSSColors[iSrcColor];
+            this.contextScreen.fillRect(iColor*(font.cxCell<<2), 0, canvasFont.width>>2, font.cyCell<<4);
+            this.contextScreen.drawImage(canvasFont, 0, iColor*(font.cyCell<<4), canvasFont.width>>2, font.cyCell<<4, iColor*(font.cxCell<<2), 0, canvasFont.width>>2, font.cyCell<<4);
+        }
+         */
+
+        font.aCanvas[iColor] = canvasFont;
+    }
+
+    /**
+     * checkBlink()
+     *
+     * Called at the end of every updateScreen(), which may have updated cBlinkVisible to a non-zero value.
+     *
+     * Also called at the end of every checkCursor(); ie, whenever the CRT register(s) affecting the position or shape
+     * of the hardware cursor have been modified, and any of iCellCursor, yCursor or cyCursor have been modified as a result.
+     *
+     * Note that the cursor always blinks when it's ON; it can only be turned OFF, moved off-screen, or its rate set to half
+     * the normal blink rate (by default, it blinks at the normal blink rate).  Bits 5-6 of the CRTC.CURSOR_START register can
+     * be set as follows:
+     *
+     *    00: Cursor blinks at normal blink rate
+     *    01: Cursor is off
+     *    10: (Same as 00)
+     *    11: Cursor blinks at half the normal blink rate
+     *
+     * According to documentation, the normal blink rate is 1/16 of the frame rate (8 frames on, 8 off).
+     *
+     * TODO: As an aside, I've observed in the "real world" that the MDA cursor cycles about 3 times per second, and by "cycle"
+     * I mean one full off-and-on-again cycle.  I'm assuming that's the normal rate (00), not the slower "half rate" (11).
+     * Since that's faster than our current cursor blink rate, we should look into an option to boost our rate, without adversely
+     * affecting the attribute blink rate (which is currently hard-coded at half the cursor blink rate), and we should look into
+     * supporting "half rate" blinking, too.
+     *
+     * @this {Video}
+     * @return {boolean} true if there are things to blink, false if not
+     */
+    checkBlink()
+    {
+        if (this.cBlinkVisible > 0 || this.iCellCursor >= 0) {
+            if (this.cBlinks < 0) {
+                this.cBlinks = 0;
+                /*
+                 * At this point, we can either fire up our own timer (doBlink), or rely on updateScreen()
+                 * being called by the CPU at regular bursts (eg, CPU.VIDEO_UPDATES_PER_SECOND = 60) and advance
+                 * cBlinks at the start of updateScreen() accordingly.
+                 *
+                 * doBlink() wants to increment cBlinks every 266ms.  On the other hand, if updateScreen() is being
+                 * called 60 times per second, that's about once every 16ms, so if every 16th updateScreen() increments
+                 * cBlinks, cBlinks should advance at the same rate.
+                 *
+                 * The only downside to relying on the CPU driving our blink count is that whenever the CPU is halted
+                 * (eg, by the PCjs debugger) all blinking stops -- all characters with the blink attribute AND the cursor.
+                 *
+                 * But we can simply say that when we halt, we mean "halt everything" (ie, call it a feature).
+                 *
+                 *      this.doBlink(true);
+                 */
+            }
+            return true;
+        }
+        this.cBlinks = -1;
+        return false;
+    }
+
+    /**
+     * checkCursor()
+     *
+     * Called whenever a CRT data register is updated, since there are multiple registers that can affect the
+     * visibility of the cursor (more than these, actually, but I'm going to limit my initial support to standard
+     * ROM BIOS controller settings):
+     *
+     *      CRTC.MAX_SCAN
+     *      CRTC.CURSOR_START
+     *      CRTC.CURSOR_END
+     *      CRTC.START_ADDR_HI
+     *      CRTC.START_ADDR_LO
+     *      CRTC.CURSOR_ADDR_HI
+     *      CRTC.CURSOR_ADDR_LO
+     *
+     * @this {Video}
+     * @return {boolean} true if the cursor is visible, false if not
+     */
+    checkCursor()
+    {
+        /*
+         * The "hardware cursor" is never visible in graphics modes.
+         */
+        if (!this.nFont) return false;
+
+        for (var i = Card.CRTC.CURSOR_START.INDX; i <= Card.CRTC.CURSOR_ADDR_LO; i++) {
+            if (this.cardActive.regCRTData[i] == null)
+                return false;
+        }
+
+        var bCursorFlags = this.cardActive.regCRTData[Card.CRTC.CURSOR_START.INDX];
+        var bCursorStart = bCursorFlags & Card.CRTC.CURSOR_START.MASK;
+        var bCursorEnd = this.cardActive.regCRTData[Card.CRTC.CURSOR_END.INDX] & Card.CRTC.CURSOR_END.MASK;
+        var bCursorMax = this.cardActive.regCRTData[Card.CRTC.MAX_SCAN.INDX] & Card.CRTC.MAX_SCAN.MASK;
+
+        /*
+         * HACK: The original EGA BIOS has a cursor emulation bug when 43-line mode is enabled, so we attempt to detect
+         * that particular combination of bad values and automatically fix them (we're so thoughtful!)
+         */
+        var fEGAHack = false;
+        if (this.cardActive === this.cardEGA) {
+            fEGAHack = true;
+            if (bCursorMax == 7 && bCursorStart == 4 && !bCursorEnd) bCursorEnd = 7;
+        }
+
+        /*
+         * One way of disabling the cursor is to set bit 5 (Card.CRTC.CURSOR_START.BLINKOFF) of the CRTC.CURSOR_START flags;
+         * another way is setting bCursorStart > bCursorEnd (unless it's an EGA, in which case we must actually draw a
+         * "split block" cursor instead).
+         *
+         * TODO: Verify whether the second test (bCursorStart > bCursorMax) should also result in a hidden cursor;
+         * ThinkTank sets both start and end values to 0x0f, which doesn't make sense on a CGA, where the max is 0x07.
+         */
+        if ((bCursorFlags & Card.CRTC.CURSOR_START.BLINKOFF) || bCursorStart > bCursorEnd && !fEGAHack || bCursorStart > bCursorMax) {
+            this.removeCursor();
+            return false;
+        }
+
+        /*
+         * The most compatible way of disabling the cursor is to simply move the cursor to an off-screen position.
+         */
+        var iCellCursor = (this.cardActive.regCRTData[Card.CRTC.CURSOR_ADDR_LO] + ((this.cardActive.regCRTData[Card.CRTC.CURSOR_ADDR_HI] & Card.CRTC.ADDR_HI_MASK) << 8));
+        if (this.iCellCursor != iCellCursor) {
+            if (MAXDEBUG && this.messageEnabled()) {
+                this.printMessage("checkCursor(): cursor moved from " + this.iCellCursor + " to " + iCellCursor);
+            }
+            this.removeCursor();
+            this.iCellCursor = iCellCursor;
+        }
+
+        /*
+         * yCursor and cyCursor are no longer scaled at this point, because the necessary scaling will depend on whether we're
+         * drawing the cursor to the on-screen or off-screen buffer, and updateChar() is in the best position to determine that.
+         *
+         * We also record cyCursorCell, the hardware cell height, since we'll need to know what the yCursor and cyCursor values
+         * are relative to when it's time to scale them.
+         */
+        var bCursorSize = bCursorEnd - bCursorStart + 1;
+        if (this.yCursor != bCursorStart || this.cyCursor != bCursorSize) {
+            this.yCursor = bCursorStart;
+            this.cyCursor = bCursorSize;
+        }
+        this.cyCursorCell = bCursorMax + 1;
+
+        this.checkBlink();
+        return true;
+    }
+
+    /**
+     * removeCursor()
+     *
+     * @this {Video}
+     */
+    removeCursor()
+    {
+        if (this.iCellCursor >= 0) {
+            if (this.aCellCache !== undefined) {
+                var drawCursor = (Video.ATTRS.DRAW_CURSOR << 8);
+                var data = this.aCellCache[this.iCellCursor];
+                if (data & drawCursor) {
+                    data &= ~drawCursor;
+                    var col = this.iCellCursor % this.nCols;
+                    var row = (this.iCellCursor / this.nCols)|0;
+                    if (this.nFont && this.aFonts[this.nFont]) {
+                        /*
+                         * If we're using an off-screen buffer in text mode, then we need to keep it in sync with "reality".
+                         */
+                        if (this.contextBuffer) {
+                            this.updateChar(col, row, data, this.contextBuffer);
+                        }
+                        /*
+                         * While updating the on-screen canvas directly could open us up to potential subpixel artifacts again,
+                         * I'm hopeful that won't be the case, since removeCursor() is called only during certain well-defined
+                         * events.  The alternative to this simple updateChar() call is unappealing: redrawing the ENTIRE off-screen
+                         * buffer to the on-screen canvas, just as updateScreen() does.
+                         */
+                        this.updateChar(col, row, data);
+                    }
+                    if (MAXDEBUG && this.messageEnabled()) {
+                        this.printMessage("removeCursor(): removed from " + row + "," + col);
+                    }
+                    this.aCellCache[this.iCellCursor] = data;
+                }
+            }
+            this.iCellCursor = -1;
+        }
+    }
+
+    /**
+     * getCardAccess()
+     *
+     * @this {Video}
+     * @return {number|undefined} current memory access setting, or undefined if unknown
+     */
+    getCardAccess()
+    {
+        var nAccess;
+        var card = this.cardActive;
+
+        this.fColor256 = false;
+        var regGRCMode = card.regGRCData[Card.GRC.MODE.INDX];
+        if (regGRCMode != null) {
+            var nReadAccess = Card.ACCESS.READ.MODE0;
+            var nWriteAccess = Card.ACCESS.WRITE.MODE0;
+            var nWriteMode = regGRCMode & Card.GRC.MODE.WRITE.MASK;
+            var regDataRotate = card.regGRCData[Card.GRC.DATAROT.INDX] & Card.GRC.DATAROT.MASK;
+            switch (nWriteMode) {
+            case Card.GRC.MODE.WRITE.MODE0:
+                if (regDataRotate) {
+                    nWriteAccess = Card.ACCESS.WRITE.MODE0 | Card.ACCESS.WRITE.ROT;
+                    switch (regDataRotate & Card.GRC.DATAROT.FUNC) {
+                    case Card.GRC.DATAROT.AND:
+                        nWriteAccess = Card.ACCESS.WRITE.MODE0 | Card.ACCESS.WRITE.AND;
+                        break;
+                    case Card.GRC.DATAROT.OR:
+                        nWriteAccess = Card.ACCESS.WRITE.MODE0 | Card.ACCESS.WRITE.OR;
+                        break;
+                    case Card.GRC.DATAROT.XOR:
+                        nWriteAccess = Card.ACCESS.WRITE.MODE0 | Card.ACCESS.WRITE.XOR;
+                        break;
+                    default:
+                        break;
+                    }
+                    card.nDataRotate = regDataRotate & Card.GRC.DATAROT.COUNT;
+                }
+                break;
+            case Card.GRC.MODE.WRITE.MODE1:
+                nWriteAccess = Card.ACCESS.WRITE.MODE1;
+                break;
+            case Card.GRC.MODE.WRITE.MODE2:
+                switch (regDataRotate & Card.GRC.DATAROT.FUNC) {
+                default:
+                    nWriteAccess = Card.ACCESS.WRITE.MODE2;
+                    break;
+                case Card.GRC.DATAROT.AND:
+                    nWriteAccess = Card.ACCESS.WRITE.MODE2 | Card.ACCESS.WRITE.AND;
+                    break;
+                case Card.GRC.DATAROT.OR:
+                    nWriteAccess = Card.ACCESS.WRITE.MODE2 | Card.ACCESS.WRITE.OR;
+                    break;
+                case Card.GRC.DATAROT.XOR:
+                    nWriteAccess = Card.ACCESS.WRITE.MODE2 | Card.ACCESS.WRITE.XOR;
+                    break;
+                }
+                break;
+            case Card.GRC.MODE.WRITE.MODE3:
+                if (this.nCard == Video.CARD.VGA) {
+                    nWriteAccess = Card.ACCESS.WRITE.MODE3;
+                    card.nDataRotate = regDataRotate & Card.GRC.DATAROT.COUNT;
+                }
+                break;
+            default:
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage("getCardAccess(): invalid GRC mode (" + Str.toHexByte(regGRCMode) + ")");
+                }
+                break;
+            }
+            if (regGRCMode & Card.GRC.MODE.READ.MODE1) {
+                nReadAccess = Card.ACCESS.READ.MODE1;
+            }
+            /*
+             * I discovered that when the IBM EGA ROM scrolls the screen in graphics modes 0x0D and 0x0E, it
+             * reprograms this register for WRITE.MODE1 (which is fine) *and* EVENODD (which is, um, very odd).
+             * Moreover, it does NOT make the complementary change to the SEQ.MEMMODE.SEQUENTIAL bit; under
+             * normal circumstances, those two bits are always supposed to programmed oppositely.
+             *
+             * Until I can perform some tests on real hardware, I have to assume that the EGA scroll operation
+             * is supposed to actually WORK in modes 0x0D and 0x0E, so I've decided to tie the trigger for my own
+             * EVENODD functions to SEQ.MEMMODE.SEQUENTIAL being clear, instead of GRC.MODE.EVENODD being set.
+             *
+             * It's also possible that my EVENODD read/write functions are not implemented properly; when EVENODD
+             * is in effect, which addresses get latched by a read, and to which addresses are latches written?
+             * If EVENODD has no effect on the effective address used with the latches, then I should change the
+             * EVENODD read/write functions accordingly.
+             *
+             * However, I've also done some limited testing with an emulated VGA running in text mode, and I've
+             * discovered that toggling the GRC.MODE.EVENODD bit *alone* doesn't seem to affect the delivery of
+             * text mode attributes from plane 1.  So maybe this is the wiser change after all.
+             *
+             * TODO: Perform some tests on actual EGA/VGA hardware, to determine the proper course of action.
+             *
+             *  if (regGRCMode & Card.GRC.MODE.EVENODD) {
+             *      nReadAccess |= Card.ACCESS.READ.EVENODD;
+             *      nWriteAccess |= Card.ACCESS.WRITE.EVENODD;
+             *  }
+             */
+            var regSEQMode = card.regSEQData[Card.SEQ.MEMMODE.INDX];
+            if (regSEQMode != null) {
+                if (!(regSEQMode & Card.SEQ.MEMMODE.SEQUENTIAL)) {
+                    nReadAccess |= Card.ACCESS.READ.EVENODD;
+                    nWriteAccess |= Card.ACCESS.WRITE.EVENODD;
+                }
+                if (regGRCMode & Card.GRC.MODE.COLOR256) {
+                    if (regSEQMode & Card.SEQ.MEMMODE.CHAIN4) {
+                        nReadAccess |= Card.ACCESS.READ.CHAIN4;
+                        nWriteAccess |= Card.ACCESS.WRITE.CHAIN4;
+                    }
+                    this.fColor256 = true;
+                }
+            }
+            nAccess = nReadAccess | nWriteAccess;
+        }
+        return nAccess;
+    }
+
+    /**
+     * setCardAccess(nAccess)
+     *
+     * @this {Video}
+     * @param {number|undefined} nAccess (one of the Card.ACCESS.* constants)
+     * @return {boolean} true if access may have changed, false if not
+     */
+    setCardAccess(nAccess)
+    {
+        var card = this.cardActive;
+        if (card && nAccess != null && nAccess != card.nAccess) {
+
+            if (MAXDEBUG && this.messageEnabled()) {
+                this.printMessage("setCardAccess(" + Str.toHexWord(nAccess) + ")");
+            }
+
+            card.setMemoryAccess(nAccess);
+
+            /*
+             * Note that setMemoryAccess() can fail, in which case it will an report error, indicating either a
+             * misconfiguration or some sort of internal inconsistency; in any case, there's not much we can do about
+             * it at this point, other than possibly reverting the current access setting.  There's probably not much
+             * point, however, because there's no guarantee that setMemoryAccess() didn't modify one or more blocks
+             * before choking.
+             */
+            this.bus.setMemoryAccess(card.addrBuffer, card.sizeBuffer, card.getMemoryAccess(), true);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * setDimensions()
+     *
+     * This is the workhorse of setMode()
+     *
+     * @this {Video}
+     */
+    setDimensions()
+    {
+        this.nFont = 0;
+        this.nCols = this.nColsDefault;
+        this.nRows = this.nRowsDefault;
+        this.nColsLogical = this.nCols;
+        this.nCellsPerWord = Video.aModeParms[Video.MODE.MDA_80X25][2];
+
+        var cbPadding = 0;
+        var modeParms = Video.aModeParms[this.nMode];
+        if (modeParms) {
+
+            this.nCols = modeParms[0];
+            this.nRows = modeParms[1];
+            this.nCellsPerWord = modeParms[2];
+            cbPadding = modeParms[3];       // undefined for EGA/VGA graphics modes only
+            this.nFont = modeParms[4];      // this will be undefined for all graphics modes
+
+            if (this.nMonitorType == ChipSet.MONITOR.EGACOLOR || this.nMonitorType == ChipSet.MONITOR.VGACOLOR) {
+                /*
+                 * When an EGA is connected to a CGA monitor, the old aModeParms table is correct: we must
+                 * use the hard-coded 8x8 "CGA_80" font.  But when it's connected to an EGA monitor, we want
+                 * to use the 9x14 "EGA" color font instead.
+                 *
+                 * TODO: Can an EGA with a monochrome monitor be programmed for 43-line mode as well?  If so,
+                 * then we'll need to load another MDA font variation, because we only load the 9x14 font for MDA.
+                 */
+                if (this.cardActive === this.cardEGA && this.nFont == Video.FONT.CGA) {
+                    if ((this.cardEGA.regCRTData[Card.CRTC.EGA.MAX_SCAN.INDX] & Card.CRTC.EGA.MAX_SCAN.SCAN_LINE) == 7) {
+                        /*
+                         * Vertical resolution of 350 divided by 8 (ie, scan lines 0-7) yields 43 whole rows.
+                         */
+                        this.nRows = this.cardEGA.getCRTCReg(Card.CRTC.EGA.VDISP_END) < 350? 43 : 50;
+                    }
+                    /*
+                     * Since we can also be called before any hardware registers have been initialized,
+                     * it may be best to not perform the following test (which is why it's commented out).
+                     */
+                    else /* if (this.cardEGA.regCRTData[Card.CRTC.EGA.MAX_SCAN.INDX] == 13) */ {
+                        /*
+                         * Vertical resolution of 350 divided by 14 (ie, scan lines 0-13) yields exactly 25 rows.
+                         *
+                         * Note that a card's default font matches its card ID (eg, Video.CARD.EGA == Video.FONT.EGA,
+                         * and Video.CARD.VGA == Video.FONT.VGA)
+                         */
+                        this.nFont = this.nCard;
+                    }
+                }
+            }
+        }
+
+        this.nCells = (this.nCols * this.nRows)|0;
+        this.nCellCache = (this.nCells / this.nCellsPerWord)|0;
+        this.cbScreen = this.nCellCache;
+        this.cbSplit = 0;
+
+        if (cbPadding !== undefined) {
+            this.cbScreen = ((this.cbScreen << 1) + cbPadding)|0;
+            this.cbSplit = (this.cbScreen + cbPadding) >> 1;
+        }
+
+        /*
+         * If no fonts were successfully loaded, there's no point in initializing the remaining drawing parameters.
+         */
+        if (!this.aFonts.length) return;
+
+        this.cxScreenCell = (this.cxScreen / this.nCols)|0;
+        this.cyScreenCell = (this.cyScreen / this.nRows)|0;
+
+        /*
+         * Now we make the all-important scaling determination: if the font cell dimensions (cxCell, cyCell)
+         * don't match the physical screen cell dimensions (cxCell, cyCell), then we look at the caller's
+         * fScaleFont setting: if it's false, we draw the characters as-is, with a border if the characters
+         * are smaller than the cells; and if fScaleFont is true, we simply tell drawImage to draw the
+         * characters to fit.
+         *
+         * WARNING: The only problem with fScaleFont is that any stretching or shrinking tends to be accompanied
+         * by subpixel artifacts along the boundaries of the font images.  Definitely annoying, and apparently
+         * there are no standard mechanisms for turning that behavior off. So, for now, I've "neutered" the
+         * fScaleFont test slightly, by adding the "nCols == 80" test that prevents scaling from kicking in for
+         * 40-column modes.
+         *
+         * Also, whether scaling or not, if it makes sense to use a "doubled" font, we'll switch the font as
+         * well.  Note that the doubled font for any existing font also has an ID that is double the existing ID,
+         * making it easy to check for the existence of a font's "double" (shift the ID left by 1).
+         *
+         * TODO: Since we now use an off-screen buffer for ALL modes, both text and graphics, we should
+         * revisit changes that were made to work around subpixel artifacts; those should no longer be an issue.
+         */
+        if (this.nFont) {
+            var font = this.aFonts[this.nFont];
+            if (!font) {
+
+                return;
+            }
+            var fontDoubled = this.aFonts[this.nFont << 1];
+
+            if (this.fScaleFont && this.nCols == 80) {
+                if (fontDoubled) {
+                    if (this.cxScreenCell >= (fontDoubled.cxCell * 3) >> 2) { // && this.cyScreenCell > (fontDoubled.cyCell * 3) >> 2) {
+                        this.nFont <<= 1;
+                        font = fontDoubled;
+                        if (DEBUG) this.log("setDimensions(): switching to double-size font, scaled");
+                    }
+                }
+            } else {
+                if (fontDoubled) {
+                    if (this.cxScreenCell >= fontDoubled.cxCell) { // && this.cyScreenCell == fontDoubled.cyCell) {
+                        this.nFont <<= 1;
+                        font = fontDoubled;
+                        if (DEBUG) this.log("setDimensions(): switching to double-size font, unscaled");
+                    }
+                }
+                if (!this.fScaleFont) {
+                    this.cxScreenCell = font.cxCell;
+                    this.cyScreenCell = font.cyCell;
+                }
+            }
+
+            /*
+             * In text modes, we have the option of setting all the *Buffer variables to null instead of
+             * allocating them, because updateChar(), as currently written, is capable of writing characters to
+             * either an off-screen or on-screen context.
+             *
+             *      this.imageBuffer = this.canvasBuffer = this.contextBuffer = null;
+             */
+            this.cxBuffer = this.cyBuffer = 0;
+            if (font) {
+                this.cxBuffer = this.nCols * font.cxCell;
+                this.cyBuffer = this.nRows * font.cyCell;
+            }
+        } else {
+            /*
+             * CGA graphics modes have their "cells" (pixels) split evenly across two halves of the video buffer, with
+             * EVEN scan lines in the first half and ODD scan lines in the second half, so unlike text modes, we can't set a
+             * limit of what's visible on-screen to "columns * rows", so the screen limit is set to match the buffer limit.
+             *
+             * In addition, updateScreen() requires an off-screen imageData buffer that matches the size of the entire screen,
+             * so that updateScreen() can set all pixels that have changed and then update the screen with a single drawImage().
+             *
+             * An alternative approach, with a smaller footprint, would be to allocate an off-screen buffer large enough for a
+             * single scan line, and redraw one scan line at a time, but given how EVEN and ODD scan lines are spread across the
+             * entire buffer, it's not clear there would be enough unchanged scan lines on average to make that approach faster.
+             */
+            this.cxScreenCell = this.cyScreenCell = 1;  // in graphics mode, a cell is exactly one pixel
+            this.cxBuffer = this.nCols;
+            this.cyBuffer = this.nRows;
+        }
+
+        /*
+         * Allocate the off-screen buffers
+         */
+        this.imageBuffer = this.contextScreen.createImageData(this.cxBuffer, this.cyBuffer);
+        this.canvasBuffer = document.createElement("canvas");
+        this.canvasBuffer.width = this.cxBuffer;
+        this.canvasBuffer.height = this.cyBuffer;
+        this.contextBuffer = this.canvasBuffer.getContext("2d");
+
+        /*
+         * Since cxCell and cyCell were originally defined in terms of cxScreen/nCols and cyScreen/nRows, you might think
+         * these border calculations would always be zero, but that would mean you overlooked the code above which tries to
+         * avoid stretching 40-column modes into an unpleasantly wide shape.
+         */
+        this.xScreenOffset = this.yScreenOffset = 0;
+        this.cxScreenOffset = this.cxScreen;
+        this.cyScreenOffset = this.cyScreen;
+
+        var cxBorder = this.cxScreen - (this.nCols * this.cxScreenCell);
+        var cyBorder = this.cyScreen - (this.nRows * this.cyScreenCell);
+        if (cxBorder > 0) {
+            this.xScreenOffset = (cxBorder >> 1);
+            this.cxScreenOffset -= cxBorder;
+        }
+        if (cyBorder > 0) {
+            this.yScreenOffset = (cyBorder >> 1);
+            this.cyScreenOffset -= cyBorder;
+        }
+        if (cxBorder || cyBorder) {
+            this.contextScreen.fillStyle = this.canvasScreen.style.backgroundColor;
+            this.contextScreen.fillRect(0, 0, this.cxScreen, this.cyScreen);
+        }
+    }
+
+    /**
+     * checkMode(fForce)
+     *
+     * Called whenever the MDA/CGA's mode register (eg, Card.MDA.MODE.PORT, Card.CGA.MODE.PORT) is updated,
+     * or whenever the EGA/VGA's GRC.MISC register is updated, or when we've just finished a restore().
+     *
+     * @this {Video}
+     * @param {boolean} [fForce] is used to force a mode update, if we recognize the current mode
+     * @return {boolean} true if successful, false if not
+     */
+    checkMode(fForce)
+    {
+        var nAccess;
+        var nMode = this.nMode;
+        var card = this.cardActive;
+
+        if (!card) {
+            /*
+             * We are likely being called after a restore(), which needs us to call setMode() to insure the proper video
+             * buffer is mapped in.  So we unset this.nMode to guarantee that setMode() will be called, and if it wasn't set
+             * to anything before, then we fall-back to the default mode.
+             */
+            this.nMode = null;
+            if (nMode == null) nMode = this.nModeDefault;
+        }
+        else {
+            if (card.nCard == Video.CARD.MDA) {
+                nMode = Video.MODE.MDA_80X25;
+            }
+            else if (card.nCard >= Video.CARD.EGA) {
+                /*
+                 * The sizeBuffer we choose reflects the amount of physical address space that all 4 planes
+                 * of EGA memory normally span, NOT the total amount of EGA memory.  So for a 64Kb EGA card,
+                 * we would set card.sizeBuffer to 16Kb (0x4000).
+                 *
+                 * TODO: Need to take into account modes that "chain" planes together (eg, mode 0x0F, and
+                 * presumably mode 0x10, on an EGA card with only 64Kb).
+                 */
+                nMode = null;
+                var cbBuffer = card.cbMemory >> 2;
+                var cbBufferText = (cbBuffer > 0x8000? 0x8000 : cbBuffer);
+
+                var regGRCMisc = card.regGRCData[Card.GRC.MISC.INDX];
+                if (regGRCMisc != null) {
+
+                    switch(regGRCMisc & Card.GRC.MISC.MAPMEM) {
+                    case Card.GRC.MISC.MAPA0128:
+                        card.addrBuffer = 0xA0000;
+                        card.sizeBuffer = cbBuffer;     // 0x20000
+                        nMode = Video.MODE.UNKNOWN;     // no BIOS mode uses this mapping, but we don't want to leave nMode null if we've come this far
+                        break;
+                    case Card.GRC.MISC.MAPA064:
+                        card.addrBuffer = 0xA0000;
+                        card.sizeBuffer = cbBuffer;     // 0x10000
+                        nMode = (this.nMonitorType == ChipSet.MONITOR.MONO? Video.MODE.EGA_640X350_MONO : Video.MODE.EGA_640X350);
+                        break;
+                    case Card.GRC.MISC.MAPB032:
+                        card.addrBuffer = 0xB0000;
+                        card.sizeBuffer = cbBufferText;
+                        nMode = Video.MODE.MDA_80X25;
+                        break;
+                    case Card.GRC.MISC.MAPB832:
+                        card.addrBuffer = 0xB8000;
+                        card.sizeBuffer = cbBufferText;
+                        nMode = (this.nMonitorType == ChipSet.MONITOR.MONO? Video.MODE.CGA_80X25_BW : Video.MODE.CGA_80X25);
+                        break;
+                    default:
+                        break;
+                    }
+                    /*
+                     * TODO: The following mode discrimination code is all a bit haphazard, a byproduct of its slow evolution
+                     * from increasingly greater EGA support to increasingly greater VGA support.  Make it more rational someday,
+                     * so that as support is added for even more modes (eg, "Mode X" variations, monochrome modes, etc), it
+                     * doesn't get totally out of control.
+                     *
+                     * One of the problems with the current approach is that it depends on the card's registers being programmed
+                     * in at least roughly the same order that the IBM EGA and VGA ROMs program them.
+                     */
+                    var regGRCMode = card.regGRCData[Card.GRC.MODE.INDX];
+
+                    /*
+                     * This text/graphics hybrid test detects the way Windows 95 reprograms the VGA on boot; ie, switching
+                     * to graphics mode 0x13 (320x200) without disturbing the text buffer contents, then reprogramming it
+                     * to enable graphics mode 0x15 (320x400), then drawing a logo in the 2nd half of the video memory, and
+                     * finally reprogramming regGRCMode and regGRCMisc to move the frame buffer back to its original text mode
+                     * location.
+                     */
+                    var fTextGraphicsHybrid = (regGRCMode & (Card.GRC.MODE.COLOR256 | Card.GRC.MODE.EVENODD)) == (Card.GRC.MODE.COLOR256 | Card.GRC.MODE.EVENODD);
+                    if (fTextGraphicsHybrid) {
+                        /*
+                         * When fTextGraphicsHybrid is true, we should be at the end of the above process, so addrBuffer
+                         * will have changed.  Since we don't (yet) assign a special mode to that configuration, we must at
+                         * least set fForce to true, so that setMode() will notice the buffer address change and remap it.
+                         */
+                        if (card.addrBuffer != this.addrBuffer || card.sizeBuffer != this.sizeBuffer) {
+                            fForce = true;
+                        }
+                    }
+
+                    var nCRTCVertTotal = card.getCRTCReg(Card.CRTC.EGA.VTOTAL);
+                    var nCRTCMaxScan = card.regCRTData[Card.CRTC.EGA.MAX_SCAN.INDX];
+                    var nCRTCModeCtrl = card.regCRTData[Card.CRTC.EGA.MODE_CTRL.INDX];
+
+                    var fSEQDotClock = (card.regSEQData[Card.SEQ.CLOCKING.INDX] & Card.SEQ.CLOCKING.DOTCLOCK);
+
+                    if (nMode != Video.MODE.UNKNOWN) {
+                        if (!(regGRCMisc & Card.GRC.MISC.GRAPHICS)) {
+                            /*
+                             * Here's where we handle text modes; since nMode will have been assigned a default
+                             * of either 0x02 or 0x03, convert that to either 0x05 or 0x04 if we're in a low-res
+                             * graphics mode, 0x06 otherwise.
+                             */
+                            nMode -= (fSEQDotClock? 2 : 0);
+                        }
+                        else if (card.addrBuffer != 0xA0000 && !fTextGraphicsHybrid && !(nCRTCModeCtrl & Card.CRTC.EGA.MODE_CTRL.COMPAT_MODE)) {
+                            /*
+                             * Here's where we handle CGA graphics modes; since nMode will have been assigned a
+                             * default of either 0x02 or 0x03, convert that to either 0x05 or 0x04 if we're in a
+                             * low-res graphics mode, 0x06 otherwise.
+                             *
+                             * For Windows 95, I've had to add BOTH the fTextGraphicsHybrid test, to avoid misdetecting
+                             * the logo display mode, AND the COMPAT_MODE test, to avoid misinterpreting the VDD's physical
+                             * (NOT logical) card reprogramming during windowed VM creation; the latter seems like a VDD bug,
+                             * because only the Windows display driver should be *physically* reprogramming the card then.
+                             */
+                            nMode = fSEQDotClock? (7 - nMode) : Video.MODE.CGA_640X200;
+                        } else {
+                            /*
+                             * Here's where we handle EGA/VGA graphics modes, discriminating among modes 0x0D and up;
+                             * we've already defaulted to either 0x0F or 0x10.  If COLOR256 is set, then select mode
+                             * 0x13 (or greater), else if 200-to-400 scan-line conversion is in effect, select either
+                             * mode 0x0D or 0x0E, else if VGA resolution is set, select either mode 0x11 or 0x12.
+                             */
+                            if (card.regGRCData[Card.GRC.MODE.INDX] & Card.GRC.MODE.COLOR256) {
+                                if (nCRTCMaxScan & Card.CRTC.EGA.MAX_SCAN.SCAN_LINE) {
+                                    /*
+                                     * NOTE: Technically, VDISP_END is one of those CRTC registers that should be read using
+                                     * card.getCRTCReg(), because there are overflow bits (8 and 9).  However, all known modes
+                                     * always SET bit 8 and CLEAR bit 9, so examining only bits 0-7 is sorta OK.
+                                     */
+                                    if (card.regCRTData[Card.CRTC.EGA.VDISP_END] <= 0x8F) {
+                                        nMode = Video.MODE.VGA_320X200;
+                                    }
+                                    else { /* (card.regCRTData[Card.CRTC.EGA.VDISP_END] == 0xDF) */
+                                        nMode = Video.MODE.VGA_320X240;
+                                    }
+                                } else {
+                                    nMode = Video.MODE.VGA_320X400;
+                                }
+                            }
+                            else if ((nCRTCMaxScan & Card.CRTC.EGA.MAX_SCAN.CONVERT400) || nCRTCVertTotal < 350) {
+                                nMode = (fSEQDotClock? Video.MODE.EGA_320X200 : Video.MODE.EGA_640X200);
+                            } else if (nCRTCVertTotal >= 480) {
+                                nMode = (this.nMonitorType == ChipSet.MONITOR.MONO? Video.MODE.VGA_640X480_MONO : Video.MODE.VGA_640X480);
+                            }
+                            if (DEBUG && this.messageEnabled()) {
+                                this.printMessage("checkMode(): nCRTCVertTotal=" + nCRTCVertTotal + ", mode=" + Str.toHexByte(nMode));
+                            }
+                        }
+                    }
+                    nAccess = this.getCardAccess();
+                }
+            }
+            else if (card.regMode & Card.CGA.MODE.VIDEO_ENABLE) {
+                /*
+                 * NOTE: For the CGA, we precondition any mode change on CGA.MODE.VIDEO_ENABLE being set, otherwise
+                 * we'll get spoofed by the ROM BIOS scroll code, which waits for vertical retrace and then turns CGA.MODE.VIDEO_ENABLE
+                 * off, using a hard-coded mode value (0x25) that does NOT necessarily match the the CGA video mode currently in effect.
+                 */
+                if (!(card.regMode & Card.CGA.MODE.GRAPHIC_SEL)) {
+                    nMode = ((card.regMode & Card.CGA.MODE._80X25)? Video.MODE.CGA_80X25 : Video.MODE.CGA_40X25);
+                    if (card.regMode & Card.CGA.MODE.BW_SEL) nMode -= 1;
+                } else {
+                    nMode = ((card.regMode & Card.CGA.MODE.HIRES_BW)? Video.MODE.CGA_640X200 : Video.MODE.CGA_320X200_BW);
+                    if (!(card.regMode & Card.CGA.MODE.BW_SEL)) nMode -= 1;
+                }
+            }
+        }
+
+        /*
+         * NOTE: If setMode() remaps the video memory, that will trigger calls to setCardAccess() to also update the
+         * memory's access functions.  However, if the memory access setting (nAccess) is about to change as well, those
+         * changes will be moot until the setCardAccess() call that follows.  Basically, whenever both memory mapping AND
+         * access functions are changing, the memory will be in an inconsistent state until both setMode() and setCardAccess()
+         * are finished.
+         *
+         * The setMode() call takes precedence; if we called setCardAccess() first, it might attempt to modify memory access
+         * functions based on the card's addrBuffer setting, and if that doesn't match what's currently mapped, assertions
+         * will be triggered (probably not fatal, but it would defeat the point of the assertions).
+         */
+        if (!this.setMode(nMode, fForce)) return false;
+
+        this.setCardAccess(nAccess);
+
+        return true;
+    }
+
+    /**
+     * setMode(nMode, fForce)
+     *
+     * Set fForce to true to update the mode regardless of previous mode, or false to perform
+     * a normal update that bypasses updateScreen() but still calls initCache().
+     *
+     * @this {Video}
+     * @param {number|null} nMode
+     * @param {boolean|undefined} [fForce] is set when checkMode() wants to force a mode update
+     * @return {boolean} true if successful, false if failure
+     */
+    setMode(nMode, fForce)
+    {
+        if (nMode != null && (nMode != this.nMode || fForce)) {
+
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage("setMode(" + Str.toHexByte(nMode) + (fForce? ",force" : "") + ")", true, true);
+            }
+
+            this.cUpdates = 0;      // count updateScreen() calls as a means of driving blink updates
+            this.nMode = nMode;
+            this.fRGBValid = false;
+
+            /*
+             * On an EGA, it's CRITICAL that a reset() invalidate cardActive, to ensure that the code below
+             * releases the previous video buffer and installs a new one, even if there was no change in the
+             * video buffer address or size, because otherwise the Memory blocks installed at the video buffer
+             * address may still be using blocks of the EGA's previous memory buffer.
+             *
+             * When the EGA is reinitialized, a new memory buffer (adwMemory) is allocated (see initEGA()), and
+             * this is where the mapping of that EGA memory buffer to the video buffer occurs.  Other cards
+             * (MDA or CGA) don't allocate/manage their own memory buffer, but even then, it's still a good idea
+             * to always force this operation (eg, in case a switch setting changed the active video card).
+             */
+            var card = this.cardActive || (nMode == Video.MODE.MDA_80X25? this.cardMono : this.cardColor);
+
+            if (card != this.cardActive || card.addrBuffer != this.addrBuffer || card.sizeBuffer != this.sizeBuffer) {
+
+                this.removeCursor();
+
+                if (this.addrBuffer) {
+
+                    if (DEBUG && this.messageEnabled()) {
+                        this.printMessage("setMode(" + Str.toHexByte(nMode) + "): removing " + Str.toHexLong(this.sizeBuffer) + " bytes from " + Str.toHexLong(this.addrBuffer));
+                    }
+
+                    if (!this.bus.removeMemory(this.addrBuffer, this.sizeBuffer)) {
+                        /*
+                         * TODO: Force this failure case and see how well the Video component deals with it.
+                         */
+                        return false;
+                    }
+                    if (this.cardActive) this.cardActive.fActive = false;
+                }
+
+                this.cardActive = card;
+                card.fActive = true;
+
+                this.addrBuffer = card.addrBuffer;
+                this.sizeBuffer = card.sizeBuffer;
+
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage("setMode(" + Str.toHexByte(nMode) + "): adding " + Str.toHexLong(this.sizeBuffer) + " bytes to " + Str.toHexLong(this.addrBuffer));
+                }
+
+                var controller = (card === this.cardEGA? card : null);
+
+                if (!this.bus.addMemory(card.addrBuffer, card.sizeBuffer, Memory.TYPE.VIDEO, controller)) {
+                    /*
+                     * TODO: Force this failure case and see how well the Video component deals with it.
+                     */
+                    return false;
+                }
+            }
+            this.setDimensions();
+            this.invalidateCache(true);
+            this.updateScreen();
+        }
+        return true;
+    }
+
+    /**
+     * setPixel(imageData, x, y, rgb)
+     *
+     * Worker function used by createFontColor() and updateScreen() (graphics modes only).
+     *
+     * @this {Video}
+     * @param {Object} imageData
+     * @param {number} x
+     * @param {number} y
+     * @param {Array.<number>} rgb is a 4-element array containing the red, green, blue and alpha values
+     */
+    setPixel(imageData, x, y, rgb)
+    {
+        var index = (x + y * imageData.width) * rgb.length;
+        imageData.data[index]   = rgb[0];
+        imageData.data[index+1] = rgb[1];
+        imageData.data[index+2] = rgb[2];
+        imageData.data[index+3] = rgb[3];
+    }
+
+    /**
+     * initCache()
+     *
+     * Initializes the contents of our internal cell cache.
+     *
+     * TODO: Consider changing this to a cache of RGB values, so that when the buffer is merely being color-cycled,
+     * we don't have to update the entire screen.  This will also allow invalidateCache() to honor the fModified flag,
+     * bypassing initCache() when it is false.
+     *
+     * @this {Video}
+     */
+    initCache()
+    {
+        this.cBlinkVisible = -1;                // invalidate the visible blinking character count, to force updateScreen() to recount
+        this.fCellCacheValid = false;
+        var nCells = this.nCellCache;
+        if (this.aCellCache === undefined || this.aCellCache.length != nCells) {
+            this.aCellCache = new Array(nCells);
+        }
+    }
+
+    /**
+     * invalidateCache(fModified)
+     *
+     * Ensure that the next updateScreen() will update every cell; intended for situations where the entire screen needs
+     * to be redrawn, even though the underlying data in the video buffer has not changed (and therefore cleanMemory() will
+     * report that the buffer is still clean, and/or all the video data still matches everything in our cell cache).
+     *
+     * For example, when the palette is being cycled, the screen is being panned, the page is being flipped, etc.
+     *
+     * @this {Video}
+     * @param {boolean} [fModified] (true if the buffer may have been modified, false if only color(s) may have changed)
+     */
+    invalidateCache(fModified)
+    {
+        if (!fModified) this.fRGBValid = false;
+        this.initCache();
+    }
+
+    /**
+     * updateChar(col, row, data, context)
+     *
+     * Updates a particular character cell (row,col) in the associated window.
+     *
+     * The data parameter is the attribute byte from the display buffer (fgnd attribute in the low nibble,
+     * bgnd attribute in the high nibble), but updateScreen() supplements data with a couple internal attribute bits:
+     *
+     *      ATTRS.DRAW_FGND:    set for every cell whose fgnd element is currently on (ie, non-blinking, or whenever blink is on)
+     *      ATTRS.DRAW_CURSOR:  set only for the cell containing the cursor, if any
+     *
+     * To make a character blink, we alternately draw its cell with ATTRS.DRAW_FGND set, and then again with
+     * ATTRS.DRAW_FGND clear (meaning only the cell background is drawn).
+     *
+     * To make the cursor blink, we must alternately draw its entire cell with ATTRS.DRAW_CURSOR set, and then
+     * draw it again with ATTRS.DRAW_CURSOR clear.
+     *
+     * @this {Video}
+     * @param {number} col
+     * @param {number} row
+     * @param {number} data (if text mode, character code in low byte, attribute code in high byte)
+     * @param {Object} [context]
+     */
+    updateChar(col, row, data, context)
+    {
+        /*
+         * The caller MUST promise this.nFont is defined, and that the font in this.aFonts[this.nFont] has been loaded.
+         */
+        var bChar = data & 0xff;
+        var bAttr = data >> 8;
+        var iFgnd = bAttr & 0xf;
+        var font = this.aFonts[this.nFont];
+        if (font.aColorMap) iFgnd = font.aColorMap[iFgnd];
+
+        /*
+         * Just as aColorMap maps the foreground attribute to the appropriate foreground character grid,
+         * it also maps the background attribute to the appropriate background color.
+         */
+        var xDst, yDst;
+        var iBgnd = (bAttr >> 4) & 0xf;
+        if (font.aColorMap) iBgnd = font.aColorMap[iBgnd];
+
+        if (context) {
+            xDst = col * font.cxCell;
+            yDst = row * font.cyCell;
+            context.fillStyle = font.aCSSColors[iBgnd];
+            context.fillRect(xDst, yDst, font.cxCell, font.cyCell);
+        } else {
+            xDst = col * this.cxScreenCell + this.xScreenOffset;
+            yDst = row * this.cyScreenCell + this.yScreenOffset;
+            this.contextScreen.fillStyle = font.aCSSColors[iBgnd];
+            this.contextScreen.fillRect(xDst, yDst, this.cxScreenCell, this.cyScreenCell);
+        }
+
+        if (MAXDEBUG && this.messageEnabled(Messages.VIDEO | Messages.LOG)) {
+            this.log("updateCharBgnd(" + col + "," + row + "," + bChar + "): filled " + xDst + "," + yDst);
+        }
+
+        if (bAttr & Video.ATTRS.DRAW_FGND) {
+            /*
+             * (bChar & 0xf) is the equivalent of (bChar % 16), and (bChar >> 4) is the equivalent of Math.floor(bChar / 16)
+             */
+            var xSrcFgnd = (bChar & 0xf) * font.cxCell;
+            var ySrcFgnd = (bChar >> 4) * font.cyCell;
+
+            if (MAXDEBUG && this.messageEnabled(Messages.VIDEO | Messages.LOG)) {
+                this.log("updateCharFgnd(" + col + "," + row + "," + bChar + "): draw from " + xSrcFgnd + "," + ySrcFgnd + " (" + font.cxCell + "," + font.cyCell + ") to " + xDst + "," + yDst);
+            }
+
+            if (context) {
+                context.drawImage(font.aCanvas[iFgnd], xSrcFgnd, ySrcFgnd, font.cxCell, font.cyCell, xDst, yDst, font.cxCell, font.cyCell);
+            } else {
+                this.contextScreen.drawImage(font.aCanvas[iFgnd], xSrcFgnd, ySrcFgnd, font.cxCell, font.cyCell, xDst, yDst, this.cxScreenCell, this.cyScreenCell);
+            }
+        }
+
+        if (bAttr & Video.ATTRS.DRAW_CURSOR) {
+            /*
+             * Drawing the cursor with lineTo() seemed logical, but it was complicated by the fact that the
+             * TOP of the line must appear at "yDst + this.yCursor", whereas lineTo() wants to know the CENTER
+             * of the line. So it's simpler to draw the cursor with another fillRect().  Here's the old code:
+             *
+             *      this.contextScreen.strokeStyle = font.aCSSColors[iFgnd];
+             *      this.contextScreen.lineWidth = this.cyCursor;
+             *      this.contextScreen.beginPath();
+             *      this.contextScreen.moveTo(xDst, yDst + this.yCursor);
+             *      this.contextScreen.lineTo(xDst + this.cxScreenCell, yDst + this.yCursor);
+             *      this.contextScreen.stroke();
+             *
+             * Also, note that we're scaling the yCursor and cyCursor values here, instead of in checkCursor(), because
+             * this is where we have all the required information: in the first case (off-screen buffer), the scaling must
+             * be based on the font cell size (cxCell, cyCell), whereas in the second case (on-screen buffer), the scaling
+             * must be based on the screen cell size (cxScreenCell,cyScreenCell).
+             *
+             * yCursor and cyCursor are actual hardware values, both relative to another hardware value: cyCursorCell.
+             */
+            var yCursor = this.yCursor;
+            var cyCursor = this.cyCursor;
+            if (context) {
+                if (this.cyCursorCell && this.cyCursorCell !== font.cyCell) {
+                    yCursor = ((yCursor * font.cyCell) / this.cyCursorCell)|0;
+                    cyCursor = ((cyCursor * font.cyCell) / this.cyCursorCell)|0;
+                }
+                context.fillStyle = font.aCSSColors[iFgnd];
+                context.fillRect(xDst, yDst + yCursor, font.cxCell, cyCursor);
+            } else {
+                if (this.cyCursorCell && this.cyCursorCell !== this.cyScreenCell) {
+                    yCursor = ((yCursor * this.cyScreenCell) / this.cyCursorCell)|0;
+                    cyCursor = ((cyCursor * this.cyScreenCell) / this.cyCursorCell)|0;
+                }
+                this.contextScreen.fillStyle = font.aCSSColors[iFgnd];
+                this.contextScreen.fillRect(xDst, yDst + yCursor, this.cxScreenCell, cyCursor);
+            }
+        }
+    }
+
+    /**
+     * updateScreen(fForce)
+     *
+     * Propagates the video buffer to the cell cache and updates the screen with any changes.  Forced updates
+     * are generally internal updates triggered by an I/O operation or other state change, while non-forced updates
+     * are the periodic updates coming from the CPU.
+     *
+     * For every cell in the video buffer, compare it to the cell stored in the cell cache, render if it differs,
+     * and then update the cell cache to match.  Since initCache() sets every cell in the cell cache to an
+     * invalid value, we're assured that the next call to updateScreen() will redraw the entire (visible) video buffer.
+     *
+     * @this {Video}
+     * @param {boolean} [fForce] is used by setMode() to reset the cell cache and force a redraw
+     */
+    updateScreen(fForce)
+    {
+        /*
+         * The Computer component maintains the fPowered setting on our behalf, so we use it.
+         */
+        if (!this.flags.powered) return;
+
+        /*
+         * If the card's video signal is disabled (eg, during a mode change), then skip the update,
+         * unless fForce is set.
+         */
+        var fEnabled = false;
+        var card = this.cardActive;
+
+        if (card) {
+            if (card !== this.cardEGA) {
+                if (card.regMode & Card.CGA.MODE.VIDEO_ENABLE) fEnabled = true;
+            }
+            else {
+                if (card.regATCIndx & Card.ATC.INDX_PAL_ENABLE) fEnabled = true;
+            }
+        }
+
+        if (!fEnabled && !fForce) return;
+
+        if (fForce) {
+            this.initCache();
+        }
+        else {
+            /*
+             * This should never happen, but since updateScreen() is also called by CPU.updateVideo(),
+             * better safe than sorry.
+             */
+            if (this.aCellCache === undefined) return;
+        }
+
+        /*
+         * If cBlinks is "enabled" (ie, >= 0), then advance it once every 16 updateScreen() calls
+         * (assuming an updateScreen() frequency of 60 per second; see CPU.VIDEO_UPDATES_PER_SECOND).
+         *
+         * We assume that the CPU is calling us whenever fForce is undefined.
+         */
+        var fBlinkUpdate = false;
+        if (!fForce && !(++this.cUpdates & 0xf) && this.cBlinks >= 0) {
+            this.cBlinks++;
+            fBlinkUpdate = true;
+        }
+
+        var iCell = 0;
+        var nCells = this.nCells;
+
+        /*
+         * Calculate the VISIBLE start of screen memory (addrScreen), not merely the PHYSICAL start,
+         * as well as the extent of it (cbScreen) and use those values for all addressing operations to follow.
+         * FYI, in these calculations, offScreen does not refer to "off-screen" memory, but rather the "offset"
+         * of the start of visible screen memory.
+         */
+        var addrBuffer = this.addrBuffer;
+        var addrScreen = addrBuffer;
+        var addrScreenLimit = addrScreen + this.sizeBuffer;
+
+        /*
+         * HACK: To deal with the fTextGraphicsHybrid 320x400 mode that Windows 95 uses (ie, when the buffer
+         * is mapped to B800:0000 instead of A000:0000 and is configured for text mode access, but graphics are
+         * still being displayed from the second half of video memory), we must ignore the programmed address.
+         *
+         * In that case, the hard-coded address range below isn't actually active either, but it doesn't matter;
+         * we just have to get through the rest of this function and make it to the updateScreenGraphicsVGA() call,
+         * which will draw from our video buffer (adwMemory) directly; these addresses are only used for bounds
+         * checking.
+         */
+        if (this.nMode >= Video.MODE.VGA_320X200) {
+            addrBuffer = addrScreen = 0xA0000;
+            addrScreenLimit = addrScreen + 0x10000;
+        }
+
+        /*
+         * HACK: The CRTC's START_ADDR_HI and START_ADDR_LO registers are supposed to be "latched" into
+         * offStartAddr ONLY at the start of every VRETRACE interval; this is an attempt to honor that behavior,
+         * but unfortunately, updateScreen() is currently called at the CPU's discretion, not necessarily in
+         * sync with nCyclesVertPeriod.  As a result, we must rely on other criteria, like the number of vertical
+         * periods that have elapsed since the last CRTC write, writes to the ATC (see outATC()), etc.
+         *
+         * TODO: Consider matching the CPU's nCyclesNextVideoUpdate to the card's nCyclesVertPeriod, ensuring
+         * that CPU bursts are in sync with VRETRACE.  Note, however, that that will be complicated by other
+         * factors, such as the horizontal retrace interval, and the timing requirements of other cards in a
+         * multi-display configuration.
+         */
+        if ((this.getRetraceBits(card) & Card.CGA.STATUS.VRETRACE) || card.nVertPeriodsStartAddr && card.nVertPeriodsStartAddr < card.nVertPeriods) {
+            /*
+             * PARANOIA: Don't call invalidateCache() unless the address we're about to "latch" actually changed.
+             */
+            var offStartAddr = ((card.regCRTData[Card.CRTC.START_ADDR_HI] << 8) + card.regCRTData[Card.CRTC.START_ADDR_LO])|0;
+            if (card.offStartAddr !== offStartAddr) {
+                card.offStartAddr = offStartAddr;
+                this.invalidateCache();
+            }
+            card.nVertPeriodsStartAddr = 0;
+        }
+
+        var offScreen = card.offStartAddr;
+
+        /*
+         * Any screen (aka "page") offset must be doubled for text modes, due to the attribute bytes.
+         * TODO: Come up with a more robust method of deciding when any screen offset should be doubled.
+         */
+        if (this.nFont) offScreen <<= 1;
+
+        addrScreen += offScreen;
+        var cbScreen = this.cbScreen;
+
+        if (this.nCard >= Video.CARD.EGA && card.regCRTData[Card.CRTC.EGA.OFFSET] && (card.regCRTData[Card.CRTC.EGA.OFFSET] << 1) != card.regCRTData[Card.CRTC.EGA.HDISP_END] + 1) {
+            /*
+             * Pre-EGA, the extent of visible screen memory (cbScreen) was derived from nCols * nRows, but since
+             * then, the logical width of screen memory (nColsLogical) can differ from the visible width (nCols).
+             * We now calculate the logical width, and the compute a new cbScreen in much the same way the original
+             * cbScreen was computed (but without any CGA-related padding considerations).
+             *
+             * TODO: I'm taking a lot of shortcuts in this calculation (eg, relying on nFont to detect text modes,
+             * ignoring MODE_CTRL.BYTE_MODE, etc); generalize this someday.  In addition, dividing the total number of
+             * cells by nCellsPerWord yields total WORDS, not BYTES, so we need to double cbScreen -- EXCEPT that the
+             * notion of cell has a slightly different meaning for EGA and VGA-specific modes.  nCellsPerWord should
+             * not be overloaded like that.
+             */
+            this.nColsLogical = card.regCRTData[Card.CRTC.EGA.OFFSET] << (this.nFont? 1 : (card.regCRTData[Card.CRTC.EGA.UNDERLINE.INDX] & Card.CRTC.EGA.UNDERLINE.DWORD)? 3 : 4);
+            cbScreen = ((this.nColsLogical * (this.nRows-1) + this.nCols) / this.nCellsPerWord)|0;
+            if (this.nMode <= Video.MODE.MDA_80X25) cbScreen <<= 1;
+        }
+
+        if (addrScreen + cbScreen > addrScreenLimit) {
+            cbScreen = addrScreenLimit - addrScreen;
+            if (cbScreen < 0) cbScreen = 0;
+        }
+
+        /*
+         * addrScreenLimit was initially the limit of the entire video buffer, but we now adjust it
+         * to the limit of what's visible, since that's all we want to draw.
+         */
+        addrScreenLimit = addrScreen + cbScreen;
+
+        /*
+         * This next bit of code can be completely disabled if we discover problems with the dirty
+         * memory block tracking feature, or if we need to remove or disable that feature in the future.
+         *
+         * We use cleanMemory() to check the video buffer's dirty state.  If the buffer is clean
+         * AND there are no visible blinking characters (as of the last updateScreen) AND there is
+         * no visible cursor, then we're done; simply return.  Otherwise, if there's only a blinking
+         * cursor, then update JUST that one cell.
+         *
+         * When dealing with blinking characters, note that we need to run through the entire buffer
+         * ONLY if the low bits of the blink count just transitioned to 2 or 0; hence, we could return if
+         * the blink count was ODD.  But we'd still have to worry about the cursor, so it's simpler to blow
+         * that small optimization off.  Further optimizations are certainly possible, such as a hash table
+         * of all blinking character locations, but all those optimizations are saved for a rainy day.
+         */
+        if (!fForce && this.fCellCacheValid && this.bus.cleanMemory(addrScreen, cbScreen)) {
+            if (!fBlinkUpdate) return;
+            if (!this.cBlinkVisible) {
+                /*
+                 * Note that since iCellCursor is a cell-based (not byte-based) index, we must subtract
+                 * offStartAddr, which is also cell-based; subtracting offScreen would not be appropriate,
+                 * as it has already been converted to a byte-based offset (remember that in text modes,
+                 * cell are words, not bytes).
+                 */
+                iCell = this.iCellCursor - card.offStartAddr;
+                /*
+                 * Note that iCellCursor may have already been negative (-1 hides the cursor), and
+                 * since offStartAddr should never be negative, we only need one iCell underflow check.
+                 */
+                if (iCell < 0) return;
+                nCells = iCell + 1;
+            }
+            // else if (this.cBlinks & 0x1) return;
+        }
+
+        if (this.nFont) {
+            /*
+             * This is the text-mode update case.  We're required to FIRST verify that the current font
+             * has been successfully loaded, because we're not allowed to call updateChar() if there's no font.
+             */
+            if (this.aFonts[this.nFont]) {
+                this.updateScreenText(addrScreen, addrScreenLimit, iCell, nCells);
+                this.checkBlink();
+            }
+        }
+        else if (this.cbSplit) {
+            /*
+             * All CGA graphics modes have the goofy split-buffer layout, hence the simple test above.
+             */
+            this.updateScreenGraphicsCGA(addrScreen, addrScreenLimit);
+        }
+        else if (!this.fColor256) {
+            /*
+             * All EGA graphics modes are taken care of here, including all 16-color VGA graphics modes.
+             */
+            this.updateScreenGraphicsEGA(addrBuffer, addrScreen, addrScreenLimit);
+        }
+        else {
+            /*
+             * Finally, all 256-color VGA modes are processed here.
+             */
+            this.updateScreenGraphicsVGA(addrBuffer, addrScreen, addrScreenLimit);
+        }
+    }
+
+    /**
+     * updateScreenText(addrScreen, addrScreenLimit, iCell, nCells)
+     *
+     * @param addrScreen
+     * @param addrScreenLimit
+     * @param iCell
+     * @param nCells
+     */
+    updateScreenText(addrScreen, addrScreenLimit, iCell, nCells)
+    {
+        var addr, data, cUpdated = 0;
+
+        /*
+         * If MDA.MODE.BLINK_ENABLE is set and a cell's blink bit is set, then if (cBlinks & 0x2) != 0,
+         * we want the foreground element of the cell to be drawn; otherwise we don't.  So every 16-bit
+         * data word we pull from the video buffer will be supplemented with our own special attribute bit
+         * (ATTRS.DRAW_FGND = 0x100) accordingly; and to simplify the drawing code, we will also mask the
+         * blink bit from the cell's attribute bits.
+         *
+         * If MDA.MODE.BLINK_ENABLE is clear, then we always set ATTRS.DRAW_FGND and never mask the blink
+         * bit in a cell's attributes bits, since it's actually an intensity bit in that case.
+         */
+        this.cBlinkVisible = 0;
+        var dataBlink = 0;
+        var dataDraw = (Video.ATTRS.DRAW_FGND << 8);
+        var dataMask = 0xfffff;
+
+        var fBlinkEnable = (this.cardActive.regMode & Card.MDA.MODE.BLINK_ENABLE);
+        if (this.nCard >= Video.CARD.EGA) {
+            fBlinkEnable = (this.cardActive.regATCData[Card.ATC.MODE.INDX] & Card.ATC.MODE.BLINK_ENABLE);
+        }
+
+        /*
+         * Since iCell is always relative to addrScreen, we must make iCellCursor similarly relative,
+         * otherwise the cursor test below fails when the active video page is something other than page 0.
+         */
+        var iCellCursor = this.iCellCursor - this.cardActive.offStartAddr;
+
+        if (fBlinkEnable) {
+            dataBlink = (Video.ATTRS.BGND_BLINK << 8);
+            dataMask &= ~dataBlink;
+            if (!(this.cBlinks & 0x2)) dataMask &= ~dataDraw;
+        }
+
+        addr = addrScreen + (iCell << 1);
+        while (addr < addrScreenLimit && iCell < nCells) {
+            data = this.bus.getShortDirect(addr);
+            data |= dataDraw;
+            if (data & dataBlink) {
+                this.cBlinkVisible++;
+                data &= dataMask;
+            }
+            if (iCell == iCellCursor) {
+                data |= ((this.cBlinks & 0x1)? (Video.ATTRS.DRAW_CURSOR << 8) : 0);
+            }
+
+            if (!this.fCellCacheValid || data !== this.aCellCache[iCell]) {
+                var col = iCell % this.nCols;
+                var row = (iCell / this.nCols)|0;
+                this.updateChar(col, row, data, this.contextBuffer);
+                this.aCellCache[iCell] = data;
+                cUpdated++;
+            }
+            addr += 2;
+            iCell++;
+        }
+
+        this.fCellCacheValid = true;
+
+        if (cUpdated && this.contextBuffer) {
+            this.contextScreen.drawImage(this.canvasBuffer, 0, 0, this.cxBuffer, this.cyBuffer, this.xScreenOffset, this.yScreenOffset, this.cxScreenOffset, this.cyScreenOffset);
+        }
+    }
+
+    /**
+     * updateScreenGraphicsCGA(addrScreen, addrScreenLimit)
+     *
+     * @param addrScreen
+     * @param addrScreenLimit
+     */
+    updateScreenGraphicsCGA(addrScreen, addrScreenLimit)
+    {
+        var addr, data;
+
+        /*
+         * This is the CGA graphics-mode update case, where cells are pixels spread across two halves of the buffer.
+         */
+        addr = addrScreen;
+        this.cBlinkVisible = 0;
+        var iCell = 0, nPixelsPerCell = this.nCellsPerWord;
+        var wPixelMask = (nPixelsPerCell == 16? 0x10000 : 0x30000);
+        var nPixelShift = (nPixelsPerCell == 16? 1 : 2);
+        var aPixelColors = this.getCardColors(nPixelShift);
+
+        var x = 0, y = 0;
+        var xDirty = this.nCols, xMaxDirty = 0, yDirty = this.nRows, yMaxDirty = 0;
+        while (addr < addrScreenLimit) {
+            data = this.bus.getShortDirect(addr);
+
+            if (this.fCellCacheValid && data === this.aCellCache[iCell]) {
+                x += nPixelsPerCell;
+            } else {
+                this.aCellCache[iCell] = data;
+                var wPixels = (data >> 8) | ((data & 0xff) << 8);
+                var wMask = wPixelMask, nShift = 16;
+                if (x < xDirty) xDirty = x;
+                for (var iPixel = 0; iPixel < nPixelsPerCell; iPixel++) {
+                    var bPixel = (wPixels & (wMask >>= nPixelShift)) >> (nShift -= nPixelShift);
+                    this.setPixel(this.imageBuffer, x++, y, aPixelColors[bPixel]);
+                }
+                if (x > xMaxDirty) xMaxDirty = x;
+                if (y < yDirty) yDirty = y;
+                if (y >= yMaxDirty) yMaxDirty = y + 1;
+            }
+            addr += 2;
+            iCell++;
+            if (x >= this.nCols) {
+                x = 0;
+                y += 2;
+                if (y > this.nRows)
+                    break;
+                if (y == this.nRows) {
+                    y = 1;
+                    addr = addrScreen + this.cbSplit;
+                }
+            }
+        }
+
+        this.fCellCacheValid = true;
+
+        /*
+         * Instead of blasting the ENTIRE imageBuffer into contextBuffer, and then blasting the ENTIRE
+         * canvasBuffer onto contextScreen, even for the smallest change, let's try to be a bit smarter about
+         * the update (well, to the extent that the canvas APIs permit).
+         */
+        if (xDirty < this.nCols) {
+            var cxDirty = xMaxDirty - xDirty;
+            var cyDirty = yMaxDirty - yDirty;
+            // this.contextBuffer.putImageData(this.imageBuffer, 0, 0);
+            this.contextBuffer.putImageData(this.imageBuffer, 0, 0, xDirty, yDirty, cxDirty, cyDirty);
+            /*
+             * While ideally I would draw only the dirty portion of canvasBuffer, there usually isn't a 1-1 pixel mapping
+             * between canvasBuffer and contextScreen.  In fact, the WHOLE POINT of the canvasBuffer is to leverage
+             * drawImage()'s scaling ability; for example, a CGA graphics mode might be 640x200, whereas the canvas representing
+             * the screen might be 960x400.  In those situations, if we draw interior rectangles, we often end up with subpixel
+             * artifacts along the edges of those rectangles.  So it appears I must continue to redraw the entire canvasBuffer
+             * on every change.
+             *
+            var xScreen = (((xDirty * this.cxScreen) / this.nCols) | 0);
+            var yScreen = (((yDirty * this.cyScreen) / this.nRows) | 0);
+            var cxScreen = (((cxDirty * this.cxScreen) / this.nCols) | 0);
+            var cyScreen = (((cyDirty * this.cyScreen) / this.nRows) | 0);
+            this.contextScreen.drawImage(this.canvasBuffer, xDirty, yDirty, cxDirty, cyDirty, xScreen, yScreen, cxScreen, cyScreen);
+             */
+            this.contextScreen.drawImage(this.canvasBuffer, 0, 0, this.nCols, this.nRows, 0, 0, this.cxScreen, this.cyScreen);
+        }
+    }
+
+    /**
+     * updateScreenGraphicsEGA(addrBuffer, addrScreen, addrScreenLimit)
+     *
+     * TODO: Add support for blinking graphics (ATC.MODE.BLINK_ENABLE)
+     *
+     * @param {number} addrBuffer
+     * @param {number} addrScreen
+     * @param {number} addrScreenLimit
+     */
+    updateScreenGraphicsEGA(addrBuffer, addrScreen, addrScreenLimit)
+    {
+        var addr, data;
+
+        addr = addrScreen;
+        this.cBlinkVisible = 0;
+
+        var iCell = 0;
+        var aPixelColors = this.getCardColors();
+        var adwMemory = this.cardActive.adwMemory;
+
+        var x = 0, y = 0;
+        var xDirty = this.nCols, xMaxDirty = 0, yDirty = this.nRows, yMaxDirty = 0;
+
+        var iPixelFirst = this.cardActive.regATCData[Card.ATC.HPAN.INDX] & Card.ATC.HPAN.SHIFT_LEFT;
+        /*
+         * TODO: What should happen if the card is programmed such that nColsLogical is LESS THAN nCols?
+         */
+        var nRowAdjust = (this.nColsLogical > this.nCols? ((this.nColsLogical - this.nCols - iPixelFirst) >> 3) : 0);
+
+        while (addr < addrScreenLimit) {
+            var idw = addr++ - addrBuffer;
+
+            data = adwMemory[idw];
+
+            /*
+             * Figure out how many visible pixels this data represents; usually 8, unless panning is being used.
+             */
+            var iPixel, nPixels = 8;
+
+            if (iPixelFirst) {
+                /*
+                 * Notice that we're not using the cell cache when panning is active, because the cached cell data no
+                 * longer aligns with the data we're pulling out of the video buffer, and it's not clear that the effort
+                 * to realign the data and make a valid cache comparison would save enough work to make it worthwhile.
+                 */
+                if (!x) {
+                    data <<= iPixelFirst;
+                    nPixels -= iPixelFirst;
+                    /*
+                     * This is as good a place as any to invalidate the cell cache when panning is active; this ensures
+                     * we don't rely on stale cache contents once panning stops.
+                     */
+                    this.fCellCacheValid = false;
+                } else {
+                    iPixel = this.nCols - x;
+                    if (nPixels > iPixel) nPixels = iPixel;
+                }
+            } else {
+
+                if (this.fCellCacheValid && data === this.aCellCache[iCell]) {
+                    x += nPixels;
+                    nPixels = 0;
+                } else {
+                    this.aCellCache[iCell] = data;
+                }
+                iCell++;
+            }
+
+            if (nPixels) {
+                if (x < xDirty) xDirty = x;
+                for (iPixel = 0; iPixel < nPixels; iPixel++) {
+                    /*
+                     * 0x80808080 may LOOK like a 32-bit value, but it is not, because JavaScript treats it as a POSITIVE
+                     * number, and therefore outside the normal 32-bit integer range; however, the AND operator guarantees
+                     * that the result will be a 32-bit value, so it doesn't matter.
+                     */
+                    var dwPixel = data & 0x80808080;
+
+                    /*
+                     * Since assertions don't fix problems (only catch them, and only in DEBUG builds), I'm also ensuring
+                     * that bPixel will default to 0 if an undefined value ever slips through again.
+                     *
+                     * How did an undefined value slip through?  We had (incorrectly) initialized entries in aEGADWToByte;
+                     * for example, we used to set aEGADWToByte[0x80808080] instead of aEGADWToByte[0x80808080|0].  The
+                     * former is a POSITIVE index that is outside the 32-bit integer range, whereas the latter is a NEGATIVE
+                     * index, which is what this code requires.
+                     */
+                    var bPixel = Video.aEGADWToByte[dwPixel] || 0;
+                    this.setPixel(this.imageBuffer, x++, y, aPixelColors[bPixel]);
+                    data <<= 1;
+                }
+                if (x > xMaxDirty) xMaxDirty = x;
+                if (y < yDirty) yDirty = y;
+                if (y >= yMaxDirty) yMaxDirty = y + 1;
+            }
+
+
+
+            if (x >= this.nCols) {
+                x = 0;
+                if (++y > this.nRows) break;
+                addr += nRowAdjust;
+            }
+        }
+
+        if (!iPixelFirst) this.fCellCacheValid = true;
+
+        /*
+         * For a fascinating discussion of the best way to update the screen canvas at this point, see updateScreenGraphicsCGA().
+         */
+        if (xDirty < this.nCols) {
+            var cxDirty = xMaxDirty - xDirty;
+            var cyDirty = yMaxDirty - yDirty;
+            this.contextBuffer.putImageData(this.imageBuffer, 0, 0, xDirty, yDirty, cxDirty, cyDirty);
+            this.contextScreen.drawImage(this.canvasBuffer, 0, 0, this.nCols, this.nRows, 0, 0, this.cxScreen, this.cyScreen);
+        }
+    }
+
+    /**
+     * updateScreenGraphicsVGA(addrBuffer, addrScreen, addrScreenLimit)
+     *
+     * This function name is a slight misnomer: updateScreenGraphicsEGA() takes care of all the 4bpp video modes
+     * (first introduced by the EGA and later expanded by the VGA), where each pixel's bits are spread across the 4
+     * planes, whereas this function takes care of just the 8bpp video modes introduced by the VGA, such as mode 0x13
+     * (320x200x256), where each pixel's bits are contained within a single plane.  This is essentially all 256-color
+     * modes (CHAIN4, "Mode X", etc), hence the hard-coded call to getCardColors(8).
+     *
+     * TODO: Add support for blinking graphics (ATC.MODE.BLINK_ENABLE)
+     *
+     * @param {number} addrBuffer
+     * @param {number} addrScreen
+     * @param {number} addrScreenLimit
+     */
+    updateScreenGraphicsVGA(addrBuffer, addrScreen, addrScreenLimit)
+    {
+        var addr, data;
+
+        addr = addrScreen;
+        this.cBlinkVisible = 0;
+
+        var iCell = 0;
+        var aPixelColors = this.getCardColors(8);
+        var adwMemory = this.cardActive.adwMemory;
+
+        var x = 0, y = 0;
+        var xDirty = this.nCols, xMaxDirty = 0, yDirty = this.nRows, yMaxDirty = 0;
+
+        var cbInc = (this.cardActive.regSEQData[Card.SEQ.MEMMODE.INDX] & Card.SEQ.MEMMODE.CHAIN4)? 4 : 1;
+        var iPixelFirst = this.cardActive.regATCData[Card.ATC.HPAN.INDX] & Card.ATC.HPAN.SHIFT_LEFT;
+        /*
+         * TODO: What should happen if the card is programmed such that nColsLogical is LESS THAN nCols?
+         */
+        var nRowAdjust = (this.nColsLogical > this.nCols? ((this.nColsLogical - this.nCols - iPixelFirst) >> 3) : 0);
+
+        while (addr < addrScreenLimit) {
+            var idw = addr - addrBuffer;
+
+            data = adwMemory[idw];
+
+            /*
+             * Figure out how many visible pixels this data represents; usually 4, unless panning is being used.
+             */
+            var iPixel, nPixels = 4;
+
+            if (iPixelFirst) {
+                /*
+                 * TODO: Implement support for 8bpp panning
+                 */
+            } else {
+
+                if (this.fCellCacheValid && data === this.aCellCache[iCell]) {
+                    x += nPixels;
+                    nPixels = 0;
+                } else {
+                    this.aCellCache[iCell] = data;
+                }
+                iCell++;
+            }
+
+            if (nPixels) {
+                if (x < xDirty) xDirty = x;
+                for (iPixel = 0; iPixel < nPixels; iPixel++) {
+                    this.setPixel(this.imageBuffer, x++, y, aPixelColors[data & 0xff]);
+                    data >>= 8;
+                }
+                if (x > xMaxDirty) xMaxDirty = x;
+                if (y < yDirty) yDirty = y;
+                if (y >= yMaxDirty) yMaxDirty = y + 1;
+            }
+
+
+
+            addr += cbInc;
+
+            if (x >= this.nCols) {
+                x = 0;
+                if (++y > this.nRows) break;
+                addr += nRowAdjust;
+            }
+        }
+
+        if (!iPixelFirst) this.fCellCacheValid = true;
+
+        /*
+         * For a fascinating discussion of the best way to update the screen canvas at this point, see updateScreenGraphicsCGA().
+         */
+        if (xDirty < this.nCols) {
+            var cxDirty = xMaxDirty - xDirty;
+            var cyDirty = yMaxDirty - yDirty;
+            this.contextBuffer.putImageData(this.imageBuffer, 0, 0, xDirty, yDirty, cxDirty, cyDirty);
+            this.contextScreen.drawImage(this.canvasBuffer, 0, 0, this.nCols, this.nRows, 0, 0, this.cxScreen, this.cyScreen);
+        }
+    }
+
+    /**
+     * getRetraceBits(card)
+     *
+     * This returns a byte value with two bits set or clear as appropriate: RETRACE and VRETRACE.
+     *
+     * @this {Video}
+     * @param {Object} card
+     * @return {number}
+     */
+    getRetraceBits(card)
+    {
+        var b = 0;
+
+        /*
+         * NOTE: The CGA bits CGA.STATUS.RETRACE (0x01) and CGA.STATUS.VRETRACE (0x08) match the EGA definitions,
+         * and they also correspond to the MDA bits MDA.STATUS.HDRIVE (0x01) and MDA.STATUS.BWVIDEO (0x08); I'm not sure
+         * why the MDA uses different designations, but the bits appear to serve the same purpose.
+         *
+         * TODO: Decide whether this more faithful emulation of the retrace bits should be extended to the MDA/CGA, too;
+         * doing so might slow down the BIOS scroll code a bit, though.
+         *
+         * TODO: Verify that when a saved machine state is restored, both the CPU's cycle count AND the card's nInitCycles
+         * are properly restored.  It's probably not a big deal, but details like that bother me.
+         */
+        var nCycles = this.cpu.getCycles();
+        var nElapsedCycles = nCycles - card.nInitCycles;
+        if (nElapsedCycles < 0) {           // perhaps the CPU decided to reset its cycle count?
+            card.nInitCycles = nElapsedCycles;
+            nElapsedCycles = -nElapsedCycles|0;
+        }
+        var nCyclesHorzRemain = nElapsedCycles % card.nCyclesHorzPeriod;
+        if (nCyclesHorzRemain > card.nCyclesHorzActive) b |= Card.CGA.STATUS.RETRACE;
+        var nCyclesVertRemain = nElapsedCycles % card.nCyclesVertPeriod;
+        if (nCyclesVertRemain > card.nCyclesVertActive) b |= Card.CGA.STATUS.VRETRACE | Card.CGA.STATUS.RETRACE;
+        /*
+         * Some callers also want to know how many vertical retrace periods have occurred since the last time they checked,
+         * so we compute that now.
+         */
+        card.nVertPeriods = (nElapsedCycles / card.nCyclesVertPeriod)|0;
+        /*
+         * The number of CPU cycles that remain in the current vertical period is all we USED to keep track of, since
+         * keeping track of the total number of cycles since the card was initialized can result in an extremely large
+         * delta after a while.
+         *
+         *      card.nInitCycles = nCycles - nCyclesVertRemain;
+         *
+         * HOWEVER, now that we're calling getRetraceBits() more frequently (ie, for internal retrace checks), resetting
+         * nInitCycles in this fashion alters the horizontal period too much, causing grief in ROM BIOS code that requires
+         * strict horizontal retrace times.  Also, the CPU reserves the right to occasionally reset its own cycle count.
+         * A final complication is that nVertPeriods would no longer be accurate if we constantly reduced nInitCycles.
+         *
+         * None of those are insurmountable problems, but the simple solution is to never reduce nInitCycles (well, except
+         * when forced to by a reduction in the CPU's cycle count).
+         */
+        return b;
+    }
+
+    /**
+     * inMDAIndx(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3B4)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number|undefined}
+     */
+    inMDAIndx(port, addrFrom)
+    {
+        return this.inCRTCIndx(this.cardMono, port, addrFrom);
+    }
+
+    /**
+     * outMDAIndx(port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3B4)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outMDAIndx(port, bOut, addrFrom)
+    {
+        this.outCRTCIndx(this.cardMono, port, bOut, addrFrom);
+    }
+
+    /**
+     * inMDAData(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3B5)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number|undefined}
+     */
+    inMDAData(port, addrFrom)
+    {
+        return this.inCRTCData(this.cardMono, port, addrFrom);
+    }
+
+    /**
+     * outMDAData(port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3B5)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outMDAData(port, bOut, addrFrom)
+    {
+        this.outCRTCData(this.cardMono, port, bOut, addrFrom);
+    }
+
+    /**
+     * inMDAMode(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3B8)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inMDAMode(port, addrFrom)
+    {
+        return this.inCardMode(this.cardMono, addrFrom);
+    }
+
+    /**
+     * outMDAMode(port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3B8)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outMDAMode(port, bOut, addrFrom)
+    {
+        this.outCardMode(this.cardMono, bOut, addrFrom);
+    }
+
+    /**
+     * inMDAStatus(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3BA)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inMDAStatus(port, addrFrom)
+    {
+        return this.inCardStatus(this.cardMono, addrFrom);
+    }
+
+    /**
+     * outFeat(port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3BA or 0x3DA)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     *
+     * NOTE: While this port also existed on the MDA and CGA, it existed only as an INPUT port, not an OUTPUT port.
+     */
+    outFeat(port, bOut, addrFrom)
+    {
+        this.cardEGA.regFeat = (this.cardEGA.regFeat & ~Card.FEAT_CTRL.BITS) | (bOut & Card.FEAT_CTRL.BITS);
+        this.printMessageIO(port, bOut, addrFrom, "FEAT");
+    }
+
+    /**
+     * inATCIndx(port, addrFrom)
+     *
+     * Technically, port 0x3C0 is readable only on a VGA, but we allow reads on an EGA as well,
+     * primarily for debugging purposes.  Moreover, ATC port reads do NOT toggle the ATC address/data
+     * flip-flop; only writes have that effect.
+     *
+     * @this {Video}
+     * @param {number} port (0x3C0)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inATCIndx(port, addrFrom)
+    {
+        var b = this.cardEGA.regATCIndx;
+        if (!addrFrom || this.messageEnabled()) {
+            this.printMessageIO(Card.ATC.PORT, null, addrFrom, "ATC.INDX", b);
+        }
+        return b;
+    }
+
+    /**
+     * inATCData(port, addrFrom)
+     *
+     * Technically, port 0x3C0 is readable only on a VGA, but we allow reads on an EGA as well,
+     * primarily for debugging purposes.  Moreover, ATC port reads do NOT toggle the ATC address/data
+     * flip-flop; only writes have that effect.
+     *
+     * @this {Video}
+     * @param {number} port (0x3C1)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inATCData(port, addrFrom)
+    {
+        var b = this.cardEGA.regATCData[this.cardEGA.regATCIndx & Card.ATC.INDX_MASK];
+        if (!addrFrom || this.messageEnabled()) {
+            this.printMessageIO(Card.ATC.PORT, null, addrFrom, "ATC." + this.cardEGA.asATCRegs[this.cardEGA.regATCIndx & Card.ATC.INDX_MASK], b);
+        }
+        return b;
+    }
+
+    /**
+     * outATC(port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3C0)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outATC(port, bOut, addrFrom)
+    {
+        var card = this.cardEGA;
+        var fPalEnabled = (card.regATCIndx & Card.ATC.INDX_PAL_ENABLE);
+        if (!card.fATCData) {
+            card.regATCIndx = bOut;
+            this.printMessageIO(port, bOut, addrFrom, "ATC.INDX");
+            card.fATCData = true;
+            if ((bOut & Card.ATC.INDX_PAL_ENABLE) && !fPalEnabled) {
+                if (!this.buildFonts(true)) {
+                    if (DEBUG && (!addrFrom || this.messageEnabled())) {
+                        this.printMessage("outATC(" + Str.toHexByte(bOut) + "): no font changes required");
+                    }
+                } else {
+                    if (DEBUG && (!addrFrom || this.messageEnabled())) {
+                        this.printMessage("outATC(" + Str.toHexByte(bOut) + "): redraw screen for font changes");
+                    }
+                    this.updateScreen(true);
+                }
+            }
+            else {
+                /*
+                 * TODO: We might want a screen blanking function, suitable for any mode, when INDX_PAL_ENABLE is cleared.
+                 * powerDown() might like to use such a function, too.  updateScreen() already disables any further screen
+                 * updates while INDX_PAL_ENABLE is clear (except when fForce is true), but that's all we currently do.
+                 *
+                 *      if (!(bOut & Card.ATC.INDX_PAL_ENABLE) && fPalEnabled) this.blankScreen();
+                 *
+                 * However, there also needs to be a delay, because when the IBM VGA BIOS changes the mode, it updates
+                 * the ATC palette registers in such a way that INDX_PAL_ENABLE is constantly toggled; here's one iteration:
+                 *
+                 *      C000:2B39 EC              IN       AL,DX
+                 *      C000:2B3A B2C0            MOV      DL,C0
+                 *      C000:2B3C 8BC3            MOV      AX,BX
+                 *      C000:2B3E 86C4            XCHG     AL,AH
+                 *      C000:2B40 EE              OUT      DX,AL    <-- this ATC index value does NOT contain 0x20
+                 *      C000:2B41 86C4            XCHG     AL,AH
+                 *      C000:2B43 EE              OUT      DX,AL
+                 *      C000:2B44 B020            MOV      AL,20
+                 *      C000:2B46 EE              OUT      DX,AL    <-- this ATC index value obviously DOES contain 0x20
+                 *
+                 * I'm not sure there are any situations where deliberately flickering the screen is a good thing -- unless
+                 * someone REALLY wants to recreate the ugly flickering scroll of a CGA...?
+                 */
+            }
+            /*
+             * HACK: offStartAddr is supposed to be "latched" ONLY at the start of every VRETRACE interval, but
+             * other "triggers" are helpful; see updateScreen() for details.
+             *
+             * PARANOIA: Don't call invalidateCache() unless the start address we just "latched" actually changed.
+             */
+            var offStartAddr = ((card.regCRTData[Card.CRTC.START_ADDR_HI] << 8) + card.regCRTData[Card.CRTC.START_ADDR_LO])|0;
+            if (card.offStartAddr != offStartAddr) {
+                card.offStartAddr = offStartAddr;
+                this.invalidateCache();
+            }
+            card.nVertPeriodsStartAddr = 0;
+        } else {
+            card.fATCData = false;
+            var iReg = card.regATCIndx & Card.ATC.INDX_MASK;
+            if (iReg >= Card.ATC.PALETTE_REGS || !fPalEnabled) {
+                if (Video.TRAPALL || card.regATCData[iReg] !== bOut) {
+                    if (!addrFrom || this.messageEnabled()) {
+                        this.printMessageIO(port, bOut, addrFrom, "ATC." + card.asATCRegs[iReg]);
+                    }
+                    card.regATCData[iReg] = bOut;
+                    this.invalidateCache(false);
+                }
+            }
+        }
+    }
+
+    /**
+     * inStatus0(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3C2)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inStatus0(port, addrFrom)
+    {
+        var bSWBit = 0;
+        if (this.nCard == Video.CARD.EGA) {
+            var iBit = 3 - ((this.cardEGA.regMisc & Card.MISC.CLOCK_SELECT) >> 2);    // this is the desired SW # (0-3)
+            bSWBit = (this.bEGASwitches & (1 << iBit)) << (Card.STATUS0.SWSENSE_SHIFT - iBit);
+        } else {
+            /*
+             * The IBM VGA ROM expects the SWSENSE bit to change according to how the DAC is programmed.
+             *
+             * At C000:0391, the ROM selects the following array at 0x0454:
+             *
+             *      db  0x12,0x12,0x12,0x10
+             *
+             * and writes the first 3 bytes to DAC register #0, and then compares SWSENSE to the 4th byte (0x10).
+             *
+             * If the 4th byte matches, then the ROM clears the BIOS "monochrome monitor" bit, and does the same
+             * thing again with 5 more arrays, expecting the 4th byte in all 5 arrays to match SWSENSE, and being
+             * very unhappy if they don't:
+             *
+             *      db  0x14,0x14,0x14,0x10
+             *      db  0x2D,0x14,0x14,0x00
+             *      db  0x14,0x2D,0x14,0x00
+             *      db  0x14,0x14,0x2D,0x00
+             *      db  0x2D,0x2D,0x2D,0x00
+             *
+             * I ensure much happiness by setting SWSENSE unless any of the three 6-bit DAC values contain 0x2D.
+             *
+             * This hard-coded behavior assumes a color monitor.  If you really want to simulate a monochrome monitor,
+             * then the 1st array (above) must mismatch, and a different set of arrays must all match:
+             *
+             *      db  0x04,0x12,0x04,0x10
+             *      db  0x1E,0x12,0x04,0x00
+             *      db  0x04,0x2D,0x04,0x00
+             *      db  0x04,0x16,0x15,0x00
+             *      db  0x00,0x00,0x00,0x10
+             *
+             * In other words, for a monochrome monitor, set SWSENSE only when DAC register #0 matches the first and last
+             * sets of values.
+             */
+            var dwDAC = this.cardEGA.regDACData[0];
+            if ((dwDAC & 0x3f) != 0x2d && (dwDAC & (0x3f << 6)) != (0x2d << 6) && (dwDAC & (0x3f << 12)) != (0x2d << 12)) {
+                bSWBit |= Card.STATUS0.SWSENSE;
+            }
+        }
+        var b = ((this.cardEGA.regStatus0 & ~Card.STATUS0.SWSENSE) | bSWBit);
+        /*
+         * TODO: Figure out where Card.STATUS0.FEAT bits should come from....
+         */
+        this.cardEGA.regStatus0 = b;
+        this.printMessageIO(Card.STATUS0.PORT, null, addrFrom, "STATUS0", b);
+        return b;
+    }
+
+    /**
+     * @this {Video}
+     * @param {number} port (0x3C2)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outMisc(port, bOut, addrFrom)
+    {
+        this.cardEGA.regMisc = bOut;
+        this.enableEGA();
+        this.printMessageIO(Card.MISC.PORT_WRITE, bOut, addrFrom, "MISC");
+    }
+
+    /**
+     * inVGAEnable(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3C3)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inVGAEnable(port, addrFrom)
+    {
+        var b = this.cardEGA.regVGAEnable;
+        this.printMessageIO(Card.VGA_ENABLE.PORT, null, addrFrom, "VGA_ENABLE", b);
+        return b;
+    }
+
+    /**
+     * outVGAEnable(port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3C3)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outVGAEnable(port, bOut, addrFrom)
+    {
+        this.cardEGA.regVGAEnable = bOut;
+        this.printMessageIO(Card.VGA_ENABLE.PORT, bOut, addrFrom, "VGA_ENABLE");
+    }
+
+    /**
+     * inSEQIndx(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3C4)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inSEQIndx(port, addrFrom)
+    {
+        var b = this.cardEGA.regSEQIndx;
+        this.printMessageIO(Card.SEQ.INDX.PORT, null, addrFrom, "SEQ.INDX", b);
+        return b;
+    }
+
+    /**
+     * outSEQIndx(port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3C4)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outSEQIndx(port, bOut, addrFrom)
+    {
+        this.cardEGA.regSEQIndx = bOut;
+        this.printMessageIO(Card.SEQ.INDX.PORT, bOut, addrFrom, "SEQ.INDX");
+    }
+
+    /**
+     * inSEQData(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3C5)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inSEQData(port, addrFrom)
+    {
+        var b = this.cardEGA.regSEQData[this.cardEGA.regSEQIndx];
+        if (!addrFrom || this.messageEnabled()) {
+            this.printMessageIO(Card.SEQ.DATA.PORT, null, addrFrom, "SEQ." + this.cardEGA.asSEQRegs[this.cardEGA.regSEQIndx], b);
+        }
+        return b;
+    }
+
+    /**
+     * outSEQData(port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3C5)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outSEQData(port, bOut, addrFrom)
+    {
+        if (Video.TRAPALL || this.cardEGA.regSEQData[this.cardEGA.regSEQIndx] !== bOut) {
+            if (!addrFrom || this.messageEnabled()) {
+                this.printMessageIO(Card.SEQ.DATA.PORT, bOut, addrFrom, "SEQ." + this.cardEGA.asSEQRegs[this.cardEGA.regSEQIndx]);
+            }
+            this.cardEGA.regSEQData[this.cardEGA.regSEQIndx] = bOut;
+        }
+        switch(this.cardEGA.regSEQIndx) {
+        case Card.SEQ.MAPMASK.INDX:
+            this.cardEGA.nSeqMapMask = Video.aEGAByteToDW[bOut & Card.SEQ.MAPMASK.MAPS];
+            break;
+        case Card.SEQ.MEMMODE.INDX:
+            if (this.setCardAccess(this.getCardAccess())) {
+                /*
+                 * When switching screens (via SysReq) on early revisions of OS/2 (eg, FOOTBALL), the screen would go
+                 * blank; this appeared to be because when the card is reprogrammed, we first think the card is going into
+                 * graphics mode, then we reverse course when it becomes clear that the card is going back into text mode,
+                 * but unfortunately, at that precise moment, the Sequencer hasn't been fully reprogrammed, so when we're
+                 * reading screen memory, we're getting back ZEROS for every odd byte (which are the text attribute bytes),
+                 * so the screen is redrawn as black-on-black.
+                 *
+                 * My solution was to change setCardAccess() to indicate whether it actually altered the video buffer
+                 * address and/or format, and if so, then force another screen update.
+                 *
+                 * TODO: This scenario does not seem unique; it suggests that we should generally force a screen update
+                 * whenever the video buffer has undergone a significant change.
+                 *
+                 * UPDATE: This change was NOT sufficient to resolve the OS/2 screen-switching bug described above; in fact,
+                 * it's apparently not even necessary, because the REAL problem was caused by PAGED blocks with stale
+                 * physical video memory blocks; the solution was for the Bus addMemory() and removeMemory() functions to
+                 * call the the CPU flushPageBlocks() function.  With that change in place, the window now stays in sync
+                 * with the buffer.
+                 *
+                 * However, calling updateScreen() here still seems like a good idea, and it shouldn't hurt performance,
+                 * since we're doing it only when setCardAccess() indicates a change, so I'm leaving this addition in place.
+                 */
+                this.updateScreen(true);
+            }
+            break;
+        default:
+            break;
+        }
+    }
+
+    /**
+     * inDACMask(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3C6)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inDACMask(port, addrFrom)
+    {
+        var b = this.cardEGA.regDACMask;
+        if (!addrFrom || this.messageEnabled()) {
+            this.printMessageIO(Card.DAC.MASK.PORT, null, addrFrom, "DAC.MASK", b);
+        }
+        return b;
+    }
+
+    /**
+     * outDACMask(port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3C6)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outDACMask(port, bOut, addrFrom)
+    {
+        if (Video.TRAPALL || this.cardEGA.regDACMask !== bOut) {
+            if (!addrFrom || this.messageEnabled()) {
+                this.printMessageIO(Card.DAC.MASK.PORT, bOut, addrFrom, "DAC.MASK");
+            }
+            this.cardEGA.regDACMask = bOut;
+        }
+    }
+
+    /**
+     * inDACState(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3C7)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inDACState(port, addrFrom)
+    {
+        var b = this.cardEGA.regDACState;
+        if (!addrFrom || this.messageEnabled()) {
+            this.printMessageIO(Card.DAC.STATE.PORT, null, addrFrom, "DAC.STATE", b);
+        }
+        return b;
+    }
+
+    /**
+     * outDACRead(port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3C7)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outDACRead(port, bOut, addrFrom)
+    {
+        if (!addrFrom || this.messageEnabled()) {
+            this.printMessageIO(Card.DAC.ADDR.PORT_READ, bOut, addrFrom, "DAC.READ");
+        }
+        this.cardEGA.regDACAddr = bOut;
+        this.cardEGA.regDACState = Card.DAC.STATE.MODE_READ;
+        this.cardEGA.regDACShift = 0;
+    }
+
+    /**
+     * outDACWrite(port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3C8)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outDACWrite(port, bOut, addrFrom)
+    {
+        if (!addrFrom || this.messageEnabled()) {
+            this.printMessageIO(Card.DAC.ADDR.PORT_WRITE, bOut, addrFrom, "DAC.WRITE");
+        }
+        this.cardEGA.regDACAddr = bOut;
+        this.cardEGA.regDACState = Card.DAC.STATE.MODE_WRITE;
+        this.cardEGA.regDACShift = 0;
+    }
+
+    /**
+     * inDACData(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3C9)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inDACData(port, addrFrom)
+    {
+        var b = (this.cardEGA.regDACData[this.cardEGA.regDACAddr] >> this.cardEGA.regDACShift) & 0x3f;
+        if (!addrFrom || this.messageEnabled()) {
+            this.printMessageIO(Card.DAC.DATA.PORT, null, addrFrom, "DAC.DATA[" + Str.toHexByte(this.cardEGA.regDACAddr) + "][" + Str.toHexByte(this.cardEGA.regDACShift) + "]", b);
+        }
+        this.cardEGA.regDACShift += 6;
+        if (this.cardEGA.regDACShift > 12) {
+            this.cardEGA.regDACShift = 0;
+            this.cardEGA.regDACAddr = (this.cardEGA.regDACAddr + 1) & (Card.DAC.TOTAL_REGS-1);
+        }
+        return b;
+    }
+
+    /**
+     * outDACData(port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3C9)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outDACData(port, bOut, addrFrom)
+    {
+        var dw = this.cardEGA.regDACData[this.cardEGA.regDACAddr];
+        if (!addrFrom || this.messageEnabled()) {
+            this.printMessageIO(Card.DAC.DATA.PORT, bOut, addrFrom, "DAC.DATA[" + Str.toHexByte(this.cardEGA.regDACAddr) + "][" + Str.toHexByte(this.cardEGA.regDACShift) + "]");
+        }
+        var dwNew = (dw & ~(0x3f << this.cardEGA.regDACShift)) | ((bOut & 0x3f) << this.cardEGA.regDACShift);
+        if (dw !== dwNew) {
+            this.cardEGA.regDACData[this.cardEGA.regDACAddr] = dwNew;
+            this.invalidateCache(false);
+        }
+        this.cardEGA.regDACShift += 6;
+        if (this.cardEGA.regDACShift > 12) {
+            this.cardEGA.regDACShift = 0;
+            this.cardEGA.regDACAddr = (this.cardEGA.regDACAddr + 1) & (Card.DAC.TOTAL_REGS-1);
+        }
+    }
+
+    /**
+     * inVGAFeat(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3CA)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inVGAFeat(port, addrFrom)
+    {
+        var b = this.cardEGA.regFeat;
+        this.printMessageIO(Card.FEAT_CTRL.PORT_READ, null, addrFrom, "FEAT", b);
+        return b;
+    }
+
+    /**
+     * outGRCPos2(port, bOut, addrFrom)
+     *
+     * "The EGA was originally implemented by IBM using two Graphics Controller Chips. This register is used to program
+     * the Graphics #2 chip. See the Graphics #1 Position Register for details."
+     *
+     * "A one should be loaded into this location to map host data bus bits 2 and 3 to display planes 2 and 3, respectively."
+     *
+     * @this {Video}
+     * @param {number} port (0x3CA)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outGRCPos2(port, bOut, addrFrom)
+    {
+        this.cardEGA.regGRCPos2 = bOut;
+        this.printMessageIO(Card.GRC.POS2_PORT, bOut, addrFrom, "GRC2");
+    }
+
+    /**
+     * inVGAMisc(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3CC)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inVGAMisc(port, addrFrom)
+    {
+        var b = this.cardEGA.regMisc;
+        this.printMessageIO(Card.MISC.PORT_READ, null, addrFrom, "MISC", b);
+        return b;
+    }
+
+    /**
+     * outGRCPos1(port, bOut, addrFrom)
+     *
+     * "The EGA was originally implemented by IBM using two Graphics Controller Chips. It was necessary to program
+     * each to respond to a different set of two consecutive bits of the 8-bit host data bus. In the IBM EGA implementation,
+     * a 0 must be loaded into this register. In the VGA, there is no analogous register."
+     *
+     * "A zero should be loaded into this location to map host data bus bits 0 and 1 to display planes 0 and 1 respectively."
+     *
+     * Note that this register was not readable on the EGA, and when the VGA came along, reads of this port read the Misc reg.
+     *
+     * @this {Video}
+     * @param {number} port (0x3CC)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outGRCPos1(port, bOut, addrFrom)
+    {
+        this.cardEGA.regGRCPos1 = bOut;
+        this.printMessageIO(Card.GRC.POS1_PORT, bOut, addrFrom, "GRC1");
+    }
+
+    /**
+     * inGRCIndx(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3CE)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inGRCIndx(port, addrFrom)
+    {
+        var b = this.cardEGA.regGRCIndx;
+        this.printMessageIO(Card.GRC.INDX.PORT, null, addrFrom, "GRC.INDX", b);
+        return b;
+    }
+
+    /**
+     * outGRCIndx(port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3CE)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outGRCIndx(port, bOut, addrFrom)
+    {
+        this.cardEGA.regGRCIndx = bOut;
+        this.printMessageIO(Card.GRC.INDX.PORT, bOut, addrFrom, "GRC.INDX");
+    }
+
+    /**
+     * inGRCData(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3CF)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inGRCData(port, addrFrom)
+    {
+        var b = this.cardEGA.regGRCData[this.cardEGA.regGRCIndx];
+        if (!addrFrom || this.messageEnabled()) {
+            this.printMessageIO(Card.GRC.DATA.PORT, null, addrFrom, "GRC." + this.cardEGA.asGRCRegs[this.cardEGA.regGRCIndx], b);
+        }
+        return b;
+    }
+
+    /**
+     * outGRCData(port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3CF)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outGRCData(port, bOut, addrFrom)
+    {
+        if (Video.TRAPALL || this.cardEGA.regGRCData[this.cardEGA.regGRCIndx] !== bOut) {
+            if (!addrFrom || this.messageEnabled()) {
+                this.printMessageIO(Card.GRC.DATA.PORT, bOut, addrFrom, "GRC." + this.cardEGA.asGRCRegs[this.cardEGA.regGRCIndx]);
+            }
+            this.cardEGA.regGRCData[this.cardEGA.regGRCIndx] = bOut;
+        }
+        switch(this.cardEGA.regGRCIndx) {
+        case Card.GRC.SRESET.INDX:
+            this.cardEGA.nSetMapData = Video.aEGAByteToDW[bOut & 0xf];
+            this.cardEGA.nSetMapBits = this.cardEGA.nSetMapData & ~this.cardEGA.nSetMapMask;
+            break;
+        case Card.GRC.ESRESET.INDX:
+            this.cardEGA.nSetMapMask = ~Video.aEGAByteToDW[bOut & 0xf];
+            this.cardEGA.nSetMapBits = this.cardEGA.nSetMapData & ~this.cardEGA.nSetMapMask;
+            break;
+        case Card.GRC.COLORCMP.INDX:
+            this.cardEGA.nColorCompare = Video.aEGAByteToDW[bOut & 0xf] & (0x80808080|0);
+            break;
+        case Card.GRC.DATAROT.INDX:
+        case Card.GRC.MODE.INDX:
+            this.setCardAccess(this.getCardAccess());
+            break;
+        case Card.GRC.READMAP.INDX:
+            this.cardEGA.nReadMapShift = (bOut & Card.GRC.READMAP.NUM) << 3;
+            break;
+        case Card.GRC.MISC.INDX:
+            this.checkMode(false);
+            break;
+        case Card.GRC.COLORDC.INDX:
+            this.cardEGA.nColorDontCare = Video.aEGAByteToDW[bOut & 0xf] & (0x80808080|0);
+            break;
+        case Card.GRC.BITMASK.INDX:
+            this.cardEGA.nBitMapMask = bOut | (bOut << 8) | (bOut << 16) | (bOut << 24);
+            break;
+        default:
+            break;
+        }
+    }
+
+    /**
+     * inCGAIndx(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3D4)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number|undefined}
+     */
+    inCGAIndx(port, addrFrom)
+    {
+        return this.inCRTCIndx(this.cardColor, port, addrFrom);
+    }
+
+    /**
+     * outCGAIndx(port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3D4)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outCGAIndx(port, bOut, addrFrom)
+    {
+        this.outCRTCIndx(this.cardColor, port, bOut, addrFrom);
+    }
+
+    /**
+     * inCGAData(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3D5)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number|undefined}
+     */
+    inCGAData(port, addrFrom)
+    {
+        return this.inCRTCData(this.cardColor, port, addrFrom);
+    }
+
+    /**
+     * outCGAData(port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3D5)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outCGAData(port, bOut, addrFrom)
+    {
+        this.outCRTCData(this.cardColor, port, bOut, addrFrom);
+    }
+
+    /**
+     * inCGAMode(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3D8)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inCGAMode(port, addrFrom)
+    {
+        return this.inCardMode(this.cardColor, addrFrom);
+    }
+
+    /**
+     * outCGAMode(port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3D8)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outCGAMode(port, bOut, addrFrom)
+    {
+        this.outCardMode(this.cardColor, bOut, addrFrom);
+    }
+
+    /**
+     * inCGAColor(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3D9)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inCGAColor(port, addrFrom)
+    {
+        var b = this.cardColor.regColor;
+        if (!addrFrom || this.messageEnabled()) {
+            this.printMessageIO(port /* this.cardColor.port + 5 */, null, addrFrom, this.cardColor.type + ".COLOR", b);
+        }
+        return b;
+    }
+
+    /**
+     * outCGAColor(port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3D9)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outCGAColor(port, bOut, addrFrom)
+    {
+        if (!addrFrom || this.messageEnabled()) {
+            this.printMessageIO(port /* this.cardColor.port + 5 */, bOut, addrFrom, this.cardColor.type + ".COLOR");
+        }
+        if (this.cardColor.regColor !== bOut) {
+            this.cardColor.regColor = bOut;
+            this.invalidateCache(false);
+        }
+    }
+
+    /**
+     * inCGAStatus(port, addrFrom)
+     *
+     * @this {Video}
+     * @param {number} port (0x3DA)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inCGAStatus(port, addrFrom)
+    {
+        return this.inCardStatus(this.cardColor, addrFrom);
+    }
+
+    /**
+     * inCRTCIndx(card, port, addrFrom)
+     *
+     * @this {Video}
+     * @param {Object} card
+     * @param {number} port
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number|undefined}
+     */
+    inCRTCIndx(card, port, addrFrom)
+    {
+        var b;
+        /*
+         * The IBM VGA ROM makes some hardware determinations based on how the CRTC controller responds when
+         * the IO_SELECT bit in the Miscellaneous Output Register is cleared; normally, that would mean ports
+         * 0x3B? are decoded and ports 0x3D? are ignored.  We didn't used to bother ignoring them, but the
+         * VGA ROM's logic requires it, so now we also check fActive.  However, we ignore only CTRC reads;
+         * we retain any writes in case that information proves useful later.
+         *
+         * Note that returning an undefined value now signals the Bus component to return whatever default value
+         * it prefers (normally 0xff).
+         */
+        if (card.fActive) b = card.regCRTIndx;
+        this.printMessageIO(port, null, addrFrom, "CRTC.INDX", b);
+        return b;
+    }
+
+    /**
+     * outCRTCIndx(card, port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {Object} card
+     * @param {number} port
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outCRTCIndx(card, port, bOut, addrFrom)
+    {
+        card.regCRTPrev = card.regCRTIndx;
+        card.regCRTIndx = bOut & Card.CGA.CRTC.INDX.MASK;
+        this.printMessageIO(port /* card.port */, bOut, addrFrom, "CRTC.INDX");
+    }
+
+    /**
+     * inCRTCData(card, port, addrFrom)
+     *
+     * @this {Video}
+     * @param {Object} card
+     * @param {number} port
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number|undefined}
+     */
+    inCRTCData(card, port, addrFrom)
+    {
+        var b;
+        /*
+         * The IBM VGA ROM makes some hardware determinations based on how the CRTC controller responds when
+         * the IO_SELECT bit in the Miscellaneous Output Register is cleared; normally, that would mean ports
+         * 0x3B? are decoded and ports 0x3D? are ignored.  We didn't used to bother ignoring them, but the
+         * VGA ROM's logic requires it, so now we also check fActive.  However, we ignore only CTRC reads;
+         * we retain any writes in case that information proves useful later.
+         *
+         * Note that returning an undefined value now signals the Bus component to return whatever default value
+         * it prefers (normally 0xff).
+         */
+        if (card.fActive && card.regCRTIndx < card.nCRTCRegs) b = card.regCRTData[card.regCRTIndx];
+        if (!addrFrom || this.messageEnabled()) {
+            this.printMessageIO(port /* card.port + 1 */, null, addrFrom, "CRTC." + card.asCRTCRegs[card.regCRTIndx], b);
+        }
+        return b;
+    }
+
+    /**
+     * outCRTCData(card, port, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {Object} card
+     * @param {number} port
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outCRTCData(card, port, bOut, addrFrom)
+    {
+        if (card.regCRTIndx < card.nCRTCRegs) {
+            if (Video.TRAPALL || card.regCRTData[card.regCRTIndx] !== bOut) {
+                if (!addrFrom || this.messageEnabled()) {
+                    this.printMessageIO(port /* card.port + 1 */, bOut, addrFrom, "CRTC." + card.asCRTCRegs[card.regCRTIndx]);
+                }
+                card.regCRTData[card.regCRTIndx] = bOut;
+            }
+            if (card.regCRTIndx == Card.CRTC.START_ADDR_HI || card.regCRTIndx == Card.CRTC.START_ADDR_LO) {
+                /*
+                 * HACK: offStartAddr is supposed to be "latched" ONLY at the start of every VRETRACE interval,
+                 * but the best we can currently do is latch it during retrace; beyond that, all we can do is snap
+                 * the vertical period count and latch it later, in updateScreen(), once the count has advanced.
+                 */
+                if (this.getRetraceBits(card) & Card.CGA.STATUS.RETRACE) {
+                    /*
+                     * PARANOIA: Don't call invalidateCache() unless the address we're about to "latch" actually changed.
+                     */
+                    var offStartAddr = ((card.regCRTData[Card.CRTC.START_ADDR_HI] << 8) + card.regCRTData[Card.CRTC.START_ADDR_LO])|0;
+                    if (card.offStartAddr !== offStartAddr) {
+                        card.offStartAddr = offStartAddr;
+                        this.invalidateCache();
+                    }
+                } else if (!card.nVertPeriodsStartAddr) {
+                    card.nVertPeriodsStartAddr = card.nVertPeriods;
+                }
+            }
+            /*
+             * During mode changes on the EGA, all the CRTC regs are typically programmed in sequence,
+             * and if that's all that's happening with Card.CRTC.MAX_SCAN.INDX, then we don't want to treat
+             * it special; let the mode change be detected normally (eg, when the GRC regs are written later).
+             *
+             * On the other hand, if this was an out-of-sequence write to Card.CRTC.MAX_SCAN.INDX, then
+             * yes, we want to force setMode() to call setDimensions(), which is key to setting the proper
+             * number of screen rows.
+             *
+             * The second part of the check is required to promptly detect a switch to "Mode X"; if we assume
+             * that anyone switching to "Mode X" will first switch to mode 0x13, then it's a given that they
+             * must reprogram the VDISP_END register, and that they will probably change it from 0x8F to 0xDF.
+             *
+             * Originally, I wasn't going to check specifically for 0xDF, to help catch other "Mode X" variations,
+             * but if I don't, then some spurious mode changes are triggered (eg, when Windows 1.0 switches from
+             * CGA graphics mode 0x06 to an EGA graphics mode).
+             */
+            if (card.regCRTIndx == Card.CRTC.MAX_SCAN.INDX && card.regCRTPrev != Card.CRTC.MAX_SCAN.INDX-1 || card.regCRTIndx == Card.CRTC.EGA.VDISP_END && bOut == 0xDF) {
+                this.checkMode(true);
+            }
+            this.checkCursor();
+        } else {
+            if (DEBUG && (!addrFrom || this.messageEnabled())) {
+                this.printMessage("outCRTCData(): ignoring unexpected write to CRTC[" + Str.toHexByte(card.regCRTIndx) + "]: " + Str.toHexByte(bOut));
+            }
+        }
+    }
+
+    /**
+     * inCardMode(card, addrFrom)
+     *
+     * @this {Video}
+     * @param {Object} card
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inCardMode(card, addrFrom)
+    {
+        var b = card.regMode;
+        this.printMessageIO(card.port + 4, null, addrFrom, "MODE", b);
+        return b;
+    }
+
+    /**
+     * outCardMode(card, bOut, addrFrom)
+     *
+     * @this {Video}
+     * @param {Object} card
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outCardMode(card, bOut, addrFrom)
+    {
+        this.printMessageIO(card.port + 4, bOut, addrFrom, "MODE");
+        card.regMode = bOut;
+        this.checkMode(false);
+    }
+
+    /**
+     * inCardStatus(card, addrFrom)
+     *
+     * On an EGA, this register is called "Status Register One" (0x3BA/0x3DA aka STATUS1), to distinguish it from
+     * "Status Register Zero" (0x3C2 aka STATUS0).  One of the side-effects of reading STATUS1 is that it resets the
+     * ATC address/data flip-flop to "address" mode, which we emulate by setting cardEGA.fATCData to false, indicating
+     * that the ATC is not in "data" mode.
+     *
+     * @this {Video}
+     * @param {Object} card
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number}
+     */
+    inCardStatus(card, addrFrom)
+    {
+        var b = this.getRetraceBits(card);
+
+        if (card === this.cardEGA) {
+            /*
+             * STATUS1 diagnostic bits 5 and 4 are set according to the Card.ATC.PLANES.MUX bits:
+             *
+             *      MUX     Bit 5   Bit 4
+             *      ---     ----    ----
+             *      00:     Red     Blue
+             *      01:     SecBlue Green
+             *      10:     SecRed  SecGreen
+             *      11:     unused  unused
+             *
+             * Depending on where we are in the horizontal and vertical periods (which can be inferred from the
+             * same elapsed cycle count that we used to simulate the retrace bits above), we could extract 4 bits
+             * from a corresponding region of the video buffer, "and" them with Card.ATC.PLANES.MASK, use
+             * that to index into the palette registers (cardEGA.regATCData), and use the resulting palette register
+             * bits to set these diagnostics bits.  However, that's all rather tedious, and the process of extracting
+             * 4 appropriate bits from the video buffer varies depending on the video mode.
+             *
+             * Why are we even considering this?  Because the EGA BIOS diagnostic code draws a bright reverse-video
+             * line of text blocks across the top of the screen, writes 0x3F to palette register 0x0f, and then
+             * monitors the STATUS1 diagnostic bits, waiting for those palette bits to show up.  It turns out, however,
+             * that we can easily fool the EGA BIOS by simply toggling the diagnostic bits.  So we take the easy way out.
+             *
+             * TODO: Faithful emulation of these bits is certainly doable, so consider doing that at some point.
+             */
+            b |= ((card.regStatus & Card.STATUS1.DIAGNOSTIC) ^ Card.STATUS1.DIAGNOSTIC);
+
+            /*
+             * Last but not least, we must reset the EGA's ATC flip-flop whenever this register is read.
+             */
+            card.fATCData = false;
+        }
+        else {
+            /*
+             * On the MDA/CGA, to satisfy ROM BIOS testing ("TEST.10"), it's sufficient to do a simple toggle of
+             * bits 0 and 3 on every read.
+             *
+             * Also, according to http://www.seasip.info/VintagePC/mda.html, on an MDA, bits 7-4 are always ON and
+             * bits 2-1 are always OFF, hence the "OR" of 0xf0.
+             *
+             * TODO: Decide whether to preserve the bits from getRetraceBits() on the MDA/CGA; we're continuing
+             * to do a simple toggle, partly on the theory that that may speed up the CGA BIOS scroll code a bit.
+             */
+            b = (card.regStatus ^= (Card.CGA.STATUS.RETRACE | Card.CGA.STATUS.VRETRACE)) | 0xf0;
+        }
+
+        card.regStatus = b;
+        this.printMessageIO(card.port + 6, null, addrFrom, (card === this.cardEGA? "STATUS1" : "STATUS"), b);
+        return b;
+    }
+
+    /**
+     * dumpVideo(asArgs)
+     *
+     * @this {Video}
+     * @param {Array.<string>} asArgs
+     */
+    dumpVideo(asArgs)
+    {
+        if (DEBUGGER) {
+            if (!this.cardActive) {
+                this.dbg.println("no active video card");
+                return;
+            }
+            if (asArgs[0]) {
+                this.cardActive.dumpVideoBuffer(asArgs);
+                return;
+            }
+            this.dbg.println("BIOSMODE: " + Str.toHexByte(this.nMode));
+            this.cardActive.dumpVideoCard();
+        }
+    }
+
+    /*
+     releaseTouch()
+     {
+     }
+     */
+
+    /**
+     * doBlink()
+     *
+     * This function is obsolete, now that the checkBlink() function is called on every updateScreen()
+     * and checkCursor() call.  updateScreen() is driven by CPU bursts, so piggy-backing on that to drive
+     * blink updates seems preferable to having another active timer in the system.
+     *
+     * @this {Video}
+     * @param {boolean} [fStart]
+     *
+     doBlink(fStart)
+     {
+        if (this.cBlinks >= 0) {
+            this.cBlinks++;
+            if (this.cBlinkVisible || this.iCellCursor >= 0) {
+                if (!fStart && !this.cpu.isRunning()) {
+                    this.updateScreen();
+                }
+                setTimeout(function(video) { return function onBlinkTimeout() {video.doBlink();}; }(this), 266);
+                return;
+            }
+            this.cBlinks = -1;
+        }
+    },
+     */
+
+    /**
+     * Video.init()
+     *
+     * This function operates on every HTML element of class "video", extracting the
+     * JSON-encoded parameters for the Video constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a Video component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeVideo = Component.getElementsByClass(document, PCX86.APPCLASS, "video");
+        for (var iVideo = 0; iVideo < aeVideo.length; iVideo++) {
+            var eVideo = aeVideo[iVideo];
+            var parmsVideo = Component.getComponentParms(eVideo);
+
+            var eCanvas = document.createElement("canvas");
+            if (eCanvas === undefined || !eCanvas.getContext) {
+                eVideo.innerHTML = "<br/>Missing &lt;canvas&gt; support. Please try a newer web browser.";
+                return;
+            }
+
+            eCanvas.setAttribute("class", "pcjs-canvas");
+            eCanvas.setAttribute("width", parmsVideo['screenWidth']);
+            eCanvas.setAttribute("height", parmsVideo['screenHeight']);
+            eCanvas.style.backgroundColor = parmsVideo['screenColor'];
+
+            /*
+             * The "contenteditable" attribute on a canvas element NOTICEABLY slows down canvas drawing on
+             * Safari as soon as you give the canvas focus (ie, click away from the canvas, and drawing speeds
+             * up; click on the canvas, and drawing slows down).  So the "transparent textarea hack" that we
+             * once employed as only a work-around for Android devices is now our default.
+             *
+             *      eCanvas.setAttribute("contenteditable", "true");
+             *
+             * HACK: A canvas style of "auto" provides for excellent responsive canvas scaling in EVERY browser
+             * except IE9/IE10, so I recalculate the appropriate CSS height every time the parent DIV is resized;
+             * IE11 works without this hack, so we take advantage of the fact that IE11 doesn't identify as "MSIE".
+             *
+             * The other reason it's good to keep this particular hack limited to IE9/IE10 is that most other
+             * browsers don't actually support an 'onresize' handler on anything but the window object.
+             */
+            eCanvas.style.height = "auto";
+            if (Web.getUserAgent().indexOf("MSIE") >= 0) {
+                eVideo.onresize = function(eParent, eChild, cx, cy) {
+                    return function onResizeVideo() {
+                        eChild.style.height = (((eParent.clientWidth * cy) / cx) | 0) + "px";
+                    };
+                }(eVideo, eCanvas, parmsVideo['screenWidth'], parmsVideo['screenHeight']);
+                eVideo.onresize();
+            }
+            /*
+             * The following is a related hack that allows the user to force the screen to use a particular aspect
+             * ratio if an 'aspect' attribute or URL parameter is set.  Initially, it's just for testing purposes
+             * until we figure out a better UI.  And note that we use our Web.onPageEvent() helper function to make
+             * sure we don't trample any other 'onresize' handler(s) attached to the window object.
+             */
+            var aspect = +(parmsVideo['aspect'] || Web.getURLParm('aspect'));
+            /*
+             * No 'aspect' parameter yields NaN, which is falsey, and anything else must satisfy my arbitrary
+             * constraints of 0.3 <= aspect <= 3.33, to prevent any useless (or worse, browser-blowing) results.
+             */
+            if (aspect && aspect >= 0.3 && aspect <= 3.33) {
+                Web.onPageEvent('onresize', function(eParent, eChild, aspectRatio) {
+                    return function onResizeWindow() {
+                        /*
+                         * Since aspectRatio is the target width/height, we have:
+                         *
+                         *      eParent.clientWidth / eChild.style.height = aspectRatio
+                         *
+                         * which means that:
+                         *
+                         *      eChild.style.height = eParent.clientWidth / aspectRatio
+                         *
+                         * so for example, if aspectRatio is 16:9, or 1.78, and clientWidth = 640,
+                         * then the calculated height should approximately 360.
+                         */
+                        eChild.style.height = ((eParent.clientWidth / aspectRatio)|0) + "px";
+                    };
+                }(eVideo, eCanvas, aspect));
+                window['onresize']();
+            }
+            eVideo.appendChild(eCanvas);
+
+            /*
+             * HACK: Android-based browsers, like the Silk (Amazon) browser and Chrome for Android, don't honor the
+             * "contenteditable" attribute; that is, when the canvas receives focus, they don't activate the on-screen
+             * keyboard.  So my fallback is to create a transparent textarea on top of the canvas.
+             *
+             * The parent DIV must have a style of "position:relative" (alternatively, a class of "pcjs-container"),
+             * so that we can position the textarea using absolute coordinates.  Also, we don't want the textarea to be
+             * visible, but we must use "opacity:0" instead of "visibility:hidden", because the latter seems to prevent
+             * the element from receiving events.  These styling requirements are taken care of in components.css
+             * (see references to the "pcjs-video-object" class).
+             *
+             * UPDATE: Unfortunately, Android keyboards like to compose whole words before transmitting any of the
+             * intervening characters; our textarea's keyDown/keyUp event handlers DO receive intervening key events,
+             * but their keyCode property is ZERO.  Virtually the only usable key event we receive is the Enter key.
+             * Android users will have to use machines that include their own on-screen "soft keyboard", or use an
+             * external keyboard.
+             *
+             * The following attempt to use a password-enabled input field didn't work any better on Android.  You could
+             * clearly see the overlaid semi-transparent input field, but none of the input characters were passed along,
+             * with the exception of the "Go" (Enter) key.
+             *
+             *      var eInput = document.createElement("input");
+             *      eInput.setAttribute("type", "password");
+             *      eInput.setAttribute("style", "position:absolute; left:0; top:0; width:100%; height:100%; opacity:0.5");
+             *      eVideo.appendChild(eInput);
+             *
+             * See this Chromium issue for more information: https://code.google.com/p/chromium/issues/detail?id=118639
+             */
+            var eTextArea = document.createElement("textarea");
+
+            /*
+             * As noted in keyboard.js, the keyboard on an iOS device tends to pop up with the SHIFT key depressed,
+             * which is not the initial keyboard state that the Keyboard component expects, so hopefully turning off
+             * these "auto" attributes will help.
+             */
+            if (Web.isUserAgent("iOS")) {
+                eTextArea.setAttribute("autocapitalize", "off");
+                eTextArea.setAttribute("autocorrect", "off");
+                /*
+                 * One of the problems on iOS devices is that after a soft-key control is clicked, we need to give
+                 * focus back to the above textarea, usually by calling cmp.updateFocus(), but in doing so, iOS may
+                 * also "zoom" the page rather jarringly.  While it's a simple matter to completely disable zooming,
+                 * by fiddling with the page's viewport, that prevents the user from intentionally zooming.  A bit of
+                 * Googling reveals that another way to prevent those jarring unintentional zooms is to simply set the
+                 * font-size of the text control to 16px.  So that's what we do.
+                 */
+                eTextArea.style.fontSize = "16px";
+            }
+            eVideo.appendChild(eTextArea);
+
+            /*
+             * Now we can create the Video object, record it, and wire it up to the associated document elements.
+             */
+            var eContext = eCanvas.getContext("2d");
+            var video = new Video(parmsVideo, eCanvas, eContext, eTextArea /* || eInput */, eVideo);
+
+            /*
+             * Bind any video-specific controls (eg, the Refresh button). There are no essential controls, however;
+             * even the "Refresh" button is just a diagnostic tool, to ensure that the screen contents are up-to-date.
+             */
+            Component.bindComponentControls(video, eVideo, PCX86.APPCLASS);
+        }
+    }
+}
+
+Video.TRAPALL = true;           // monitor all I/O by default (not just deltas)
+
+/*
+ * Supported Modes
+ *
+ * Although this component is designed to be a video hardware emulation, not a BIOS simulation, we DO
+ * look for changes to the hardware state that correspond to standard BIOS mode settings, so our internal
+ * mode setting will normally match the current BIOS mode setting; however, this a debugging convenience,
+ * not an attempt to monitor or emulate the BIOS.
+ *
+ * We do have some BIOS awareness (eg, when loading ROM-based fonts, and some special code to ensure all
+ * the BIOS diagnostics pass), but for the most part, we treat the BIOS like any other application code.
+ *
+ * As we expand support to include more programmable cards like the EGA, it becomes quite easy for the card
+ * to enter a "mode" that has no BIOS counterpart (eg, non-standard combinations of video buffer address,
+ * memory access modes, fonts, display regions, etc).  Our hardware emulation routines will cope with those
+ * situations as best they can (and when they don't, it should be considered a bug if some application is
+ * broken as a result), but realistically, our hardware emulation is never likely to be 100% accurate.
+ */
+Video.MODE = {
+    CGA_40X25_BW:       0,
+    CGA_40X25:          1,
+    CGA_80X25_BW:       2,
+    CGA_80X25:          3,
+    CGA_320X200:        4,
+    CGA_320X200_BW:     5,
+    CGA_640X200:        6,
+    MDA_80X25:          7,
+    EGA_320X200:        0x0D,   // mapped at A000:0000, color, 4bpp, planar
+    EGA_640X200:        0x0E,   // mapped at A000:0000, color, 4bpp, planar
+    EGA_640X350_MONO:   0x0F,   // mapped at A000:0000, mono,  2bpp, planar
+    EGA_640X350:        0x10,   // mapped at A000:0000, color, 4bpp, planar
+    VGA_640X480_MONO:   0x11,   // mapped at A000:0000, mono,  2bpp, planar
+    VGA_640X480:        0x12,   // mapped at A000:0000, color, 4bpp, planar
+    VGA_320X200:        0x13,   // mapped at A000:0000, color, 8bpp, linear
+    /*
+     * The remaining mode identifiers are for internal use only; there is no correlation with any
+     * publicly defined BIOS modes, and overlap with any third-party mode numbers is purely coincidental.
+     */
+    VGA_320X240:        0x14,   // mapped at A000:0000, color, 8bpp, planar ("Mode X")
+    VGA_320X400:        0x15,   // mapped at A000:0000, color, 8bpp, planar
+    /*
+     * Here's where we might assign additional identifiers to certain unique combinations, like the
+     * fTextGraphicsHybrid 320x400 mode that Windows 95 uses (ie, when the buffer is mapped to B800:0000
+     * instead of A000:0000 and is configured for text mode access, but graphics are still being displayed
+     * from the second half of video memory).
+     */
+    UNKNOWN:            0xFF
+};
+
+/*
+ * Supported Fonts
+ *
+ * Once we've finished loading the standard 8K font file, aFonts[] should contain one or more of the
+ * entries listed below.  For the standard MDA/CGA font ROM, the first (MDA) font resides in the first 4Kb,
+ * and the second and third (CGA) fonts reside in the two 2K halves of the second 4Kb.
+ *
+ * It may seem odd that the cell size for FONT_CGAD is *larger* than the cell size for FONT_CGA,
+ * since 40-column mode is actually lower resolution, but since we don't shrink the screen canvas when we
+ * shrink the mode, the characters must be drawn larger, and they look better if we don't have to scale them.
+ *
+ * From the IBM EGA Manual (p.5):
+ *
+ *     "In alphanumeric modes, characters are formed from one of two ROM (Read Only Memory) character
+ *      generators on the adapter. One character generator defines 7x9 characters in a 9x14 character box.
+ *      For Enhanced Color Display support, the 9x14 character set is modified to provide an 8x14 character set.
+ *      The second character generator defines 7x7 characters in an 8x8 character box. These generators contain
+ *      dot patterns for 256 different characters. The character sets are identical to those provided by the
+ *      IBM Monochrome Display Adapter and the IBM Color/Graphics Monitor Adapter."
+ */
+Video.FONT = {
+    MDA:    1,          // 9x14 monochrome font
+    MDAD:   2,          // 18x28 monochrome font (this is the 9x14 font doubled)
+    CGA:    3,          // 8x8 color font
+    CGAD:   6,          // 16x16 color font (this is the 8x8 CGA font doubled)
+    EGA:    5,          // 8x14 color font
+    EGAD:   10,         // 16x28 color font (this is the 8x14 EGA font doubled)
+    VGA:    7,          // 8x16 color font
+    VGAD:   14          // 16x32 color font (this is the 8x16 VGA font doubled)
+};
+
+/*
+ * Supported Cards
+ *
+ * Note that we choose card IDs that match the default font ID for each card as well, for convenience.
+ */
+Video.CARD = {
+    MDA: Video.FONT.MDA,
+    CGA: Video.FONT.CGA,
+    EGA: Video.FONT.EGA,
+    VGA: Video.FONT.VGA
+};
+
+/*
+ * Supported Models
+ *
+ * Each model refers to an array where [0] is the card ID, and [1] is the default mode.
+ */
+Video.MODEL = {
+    "mda": [Video.CARD.MDA, Video.MODE.MDA_80X25],
+    "cga": [Video.CARD.CGA, Video.MODE.CGA_80X25],
+    "ega": [Video.CARD.EGA, Video.MODE.CGA_80X25],
+    "vga": [Video.CARD.VGA, Video.MODE.CGA_80X25]
+};
+
+/*
+ * Supported Monitors
+ *
+ * The MDA monitor displays 350 lines of vertical resolution, 720 lines of horizontal resolution, and refreshes
+ * at ~50Hz.  The CGA monitor displays 200 lines vertically, 640 horizontally, and refreshes at ~60Hz.
+ *
+ * Based on actual MDA timings (see http://diylab.atwebpages.com/pressureDev.htm), the total horizontal
+ * period (drawing a line and retracing) is ~54.25uSec (1000000uSec / 18432) and the horizontal retrace interval
+ * is about 15% of that, or ~8.14uSec.  Vertical sync occurs once every 370 horizontal periods.  Of those 370,
+ * only 354 represent actively drawn lines (and of those, only 350 are visible); the remaining 16 horizontal
+ * periods, or 4% of the 370 total, represent the vertical retrace interval.
+ *
+ * I don't have similar numbers for the CGA or EGA, so for now, I assume similar percentages; ie, 15% of
+ * the horizontal period will represent horizontal retrace, and 4% of the vertical pixel maximum (262) will
+ * represent vertical retrace.  However, 24% of the CGA's 262 vertical maximum represents non-visible lines,
+ * whereas only 5% of the MDA's 370 maximum represents non-visible lines; is there really that much "overscan"
+ * on the CGA?
+ *
+ * For each monitor type, there's a Video.monitorSpecs object that describes the horizontal and vertical
+ * timings, along with my assumptions about the percentage of time that drawing is "active" within those periods,
+ * and then based on the selected monitor type, I compute the number of CPU cycles that each period lasts,
+ * as well as the number of CPU cycles that drawing lasts within each period, so that the horizontal and vertical
+ * retrace status flags can be quickly calculated.
+ *
+ * For reference, here are some important numbers to know (from https://github.com/reenigne/reenigne/blob/master/8088/cga/register_values.txt):
+ *
+ *              CGA          MDA
+ *  Pixel clock 14.318 MHz   16.257 MHz (aka "maximum video bandwidth", as IBM Tech Refs sometimes call it)
+ *  Horizontal  15.700 KHz   18.432 KHz (aka "horizontal drive", as IBM Tech Refs sometimes call it)
+ *  Vertical    59.923 Hz    49.816 Hz
+ *  Usage       53.69%       77.22%
+ *  H pix       912 = 114*8  882 = 98*9
+ *  V pix       262          370
+ *  Dots        238944       326340
+ */
+
+/**
+ * @class MonitorSpecs
+ * @property {number} nHorzPeriodsPerSec
+ * @property {number} nHorzPeriodsPerFrame
+ * @property {number} percentHorzActive
+ * @property {number} percentVertActive
+ *
+ * From these monitor specs, we calculate the following values for a given Card:
+ *
+ *      nCyclesPerSecond = cpu.getCyclesPerSecond();      // eg, 4772727
+ *      nCyclesHorzPeriod = (nCyclesPerSecond / monitorSpecs.nHorzPeriodsPerSec) | 0;
+ *      nCyclesHorzActive = (nCyclesHorzPeriod * monitorSpecs.percentHorzActive / 100) | 0;
+ *      nCyclesVertPeriod = nCyclesHorzPeriod * monitorSpecs.nHorzPeriodsPerFrame;
+ *      nCyclesVertActive = (nCyclesVertPeriod * monitorSpecs.percentVertActive / 100) | 0;
+ */
+
+/**
+ * @type {Object}
+ */
+Video.monitorSpecs = {};
+
+/**
+ * NOTE: Based on trial-and-error, 208 is the magic number of horizontal syncs per vertical sync that
+ * yielded the necessary number of "horizontal enables" (200 or 0xC8) in the EGA ROM BIOS at C000:03D0.
+ *
+ * @type {{MonitorSpecs}}
+ */
+Video.monitorSpecs[ChipSet.MONITOR.COLOR] = {
+    nHorzPeriodsPerSec: 15700,
+    nHorzPeriodsPerFrame: 208,
+    percentHorzActive: 85,
+    percentVertActive: 96
+};
+
+/**
+ * NOTE: Based on trial-and-error, 364 is the magic number of horizontal syncs per vertical sync that
+ * yielded the necessary number of "horizontal enables" (350 or 0x15E) in the EGA ROM BIOS at C000:03D0.
+ *
+ * @type {{MonitorSpecs}}
+ */
+Video.monitorSpecs[ChipSet.MONITOR.MONO] = {
+    nHorzPeriodsPerSec: 18432,
+    nHorzPeriodsPerFrame: 364,
+    percentHorzActive: 85,
+    percentVertActive: 96
+};
+
+/**
+ * @type {{MonitorSpecs}}
+ */
+Video.monitorSpecs[ChipSet.MONITOR.EGACOLOR] = {
+    nHorzPeriodsPerSec: 21850,
+    nHorzPeriodsPerFrame: 364,
+    percentHorzActive: 85,
+    percentVertActive: 96
+};
+
+/**
+ * NOTE: As above, the following values are based purely on trial-and-error, to yield results that fall
+ * squarely within the bounds of the IBM VGA ROM timing requirements; see the IBM VGA ROM code at C000:024A.
+ *
+ * @type {{MonitorSpecs}}
+ */
+Video.monitorSpecs[ChipSet.MONITOR.VGACOLOR] = {
+    nHorzPeriodsPerSec: 16700,
+    nHorzPeriodsPerFrame: 480,
+    percentHorzActive: 85,
+    percentVertActive: 83
+};
+
+/*
+ * EGA Miscellaneous ports and SW1-Sw4
+ *
+ * The Card.MISC.CLOCK_SELECT bits determine which of the EGA board's 4 configuration switches are
+ * returned via Card.STATUS0.SWSENSE (when SWSENSE is zero, the switch is closed):
+ *
+ *      0xC: return SW1
+ *      0x8: return SW2
+ *      0x4: return SW3
+ *      0x0: return SW4
+ *
+ * These 4 bits are also copied to the byte at 40:88h by the EGA BIOS, where bit 0 is SW1, bit 1 is SW2,
+ * bit 2 is SW3 and bit 3 is SW4.  Our switch settings come from bEGASwitches, which in turn comes from
+ * sSwitches, which in turn comes from the "switches" property passed to the Video component, if any.
+ *
+ * As usual, the switch settings are reversed in both direction and sense from the switch settings; the
+ * good news, however, is that we can use the parseSwitches() method in the ChipSet component to parse them.
+ *
+ * The set of valid EGA switch values, after conversion, is stored in the table below.  For each value,
+ * there is an array that defines the corresponding monitor type(s) for the EGA adapter and any secondary
+ * adapter.  The third value is a boolean indicating whether the EGA is the primary adapter.
+ */
+Video.aEGAMonitorSwitches = {
+    0x06: [ChipSet.MONITOR.TV,           ChipSet.MONITOR.MONO,  true],  // "1001"
+    0x07: [ChipSet.MONITOR.COLOR,        ChipSet.MONITOR.MONO,  true],  // "0001"
+    0x08: [ChipSet.MONITOR.EGAEMULATION, ChipSet.MONITOR.MONO,  true],  // "1110"
+    0x09: [ChipSet.MONITOR.EGACOLOR,     ChipSet.MONITOR.MONO,  true],  // "0110" [our default; see bEGASwitches below]
+    0x0a: [ChipSet.MONITOR.MONO,         ChipSet.MONITOR.TV,    true],  // "1010"
+    0x0b: [ChipSet.MONITOR.MONO,         ChipSet.MONITOR.COLOR, true],  // "0010"
+    0x00: [ChipSet.MONITOR.TV,           ChipSet.MONITOR.MONO,  false], // "1111"
+    0x01: [ChipSet.MONITOR.COLOR,        ChipSet.MONITOR.MONO,  false], // "0111"
+    0x02: [ChipSet.MONITOR.EGAEMULATION, ChipSet.MONITOR.MONO,  false], // "1011"
+    0x03: [ChipSet.MONITOR.EGACOLOR,     ChipSet.MONITOR.MONO,  false], // "0011"
+    0x04: [ChipSet.MONITOR.MONO,         ChipSet.MONITOR.TV,    false], // "1101"
+    0x05: [ChipSet.MONITOR.MONO,         ChipSet.MONITOR.COLOR, false]  // "0101"
+};
+
+/**
+ * @class Font
+ * @property {number} cxCell
+ * @property {number} cyCell
+ * @property {Array} aCSSColors
+ * @property {Array} aRGBColors
+ * @property {Array} aColorMap
+ * @property {Array} aCanvas
+ */
+
+/*
+ * For each video mode, we need to know the following pieces of information:
+ *
+ *      0: # of columns (nCols)
+ *      1: # of rows (nRows)
+ *      2: # cells per word (nCellsPerWord: # of characters or pixels per word)
+ *      3: # bytes of visible screen padding, if any (used for CGA graphics modes only)
+ *      4: font ID (nFont: undefined if graphics mode)
+ *
+ * For MDA and CGA modes, a "word" of memory is 16 bits of CPU-addressable data, so by calculating
+ * ([0] * [1]) / [2], we obtain the number of words that mode actively displays; for example, the
+ * amount of visible memory used by mode 0x04 is (320 * 200) / 4, or 16000.
+ *
+ * However, for EGA and VGA graphics modes, a "word" of memory is a single element in the video buffer
+ * containing 32 bits of pixel data.
+ *
+ * The MODES.CGA_40X25 modes specify FONT_CGA instead of FONT_CGAD because we don't automatically
+ * load the FONT_CGAD unless the screen is large enough to accommodate it (see the fDoubleFont calculation).
+ *
+ * To compensate, we have code in setDimensions() that automatically switches to FONT_CGAD if it's loaded AND
+ * the cell size warrants the larger font.  We could hard-code FONT_CGAD here, but then we'd always load it,
+ * and it might not always be the best fit.
+ */
+Video.aModeParms = [];                                                                              // Mode
+Video.aModeParms[Video.MODE.CGA_40X25]          = [ 40,  25,  1,   0, Video.FONT.CGA];              // 0x01
+Video.aModeParms[Video.MODE.CGA_80X25]          = [ 80,  25,  1,   0, Video.FONT.CGA];              // 0x03
+Video.aModeParms[Video.MODE.CGA_320X200]        = [320, 200,  8, 192];                              // 0x04
+Video.aModeParms[Video.MODE.CGA_640X200]        = [640, 200, 16, 192];                              // 0x06
+Video.aModeParms[Video.MODE.MDA_80X25]          = [ 80,  25,  1,   0, Video.FONT.MDA];              // 0x07
+Video.aModeParms[Video.MODE.EGA_320X200]        = [320, 200,  8];                                   // 0x0D
+Video.aModeParms[Video.MODE.EGA_640X200]        = [640, 200,  8];                                   // 0x0E
+Video.aModeParms[Video.MODE.EGA_640X350_MONO]   = [640, 350,  8];                                   // 0x0F
+Video.aModeParms[Video.MODE.EGA_640X350]        = [640, 350,  8];                                   // 0x10
+Video.aModeParms[Video.MODE.VGA_640X480_MONO]   = [640, 480,  8];                                   // 0x11
+Video.aModeParms[Video.MODE.VGA_640X480]        = [640, 480,  8];                                   // 0x12
+Video.aModeParms[Video.MODE.VGA_320X200]        = [320, 200,  1];                                   // 0x13
+Video.aModeParms[Video.MODE.VGA_320X240]        = [320, 240,  4];                                   // 0x14
+Video.aModeParms[Video.MODE.VGA_320X400]        = [320, 400,  4];                                   // 0x15
+
+Video.aModeParms[Video.MODE.CGA_40X25_BW]       = Video.aModeParms[Video.MODE.CGA_40X25];           // 0x00
+Video.aModeParms[Video.MODE.CGA_80X25_BW]       = Video.aModeParms[Video.MODE.CGA_80X25];           // 0x02
+Video.aModeParms[Video.MODE.CGA_320X200_BW]     = Video.aModeParms[Video.MODE.CGA_320X200];         // 0x05
+
+/*
+ * MDA attribute byte definitions
+ *
+ * For MDA, only the following group of ATTR definitions are supported; any FGND/BGND value combinations
+ * outside this group will be treated as "normal" (ATTR_FGND_WHITE | ATTR_BGND_BLACK).
+ *
+ * NOTE: Assuming MDA.MODE.BLINK_ENABLE is set (which the ROM BIOS sets by default), ATTR_BGND_BLINK will
+ * cause the *foreground* element of the cell to blink, even though it is part of the *background* attribute bits.
+ *
+ * Regarding blink rate, characters are supposed to blink every 16 vertical frames, which amounts to .26667 blinks
+ * per second, assuming a 60Hz vertical refresh rate.  So roughly every 267ms, we need to take care of any blinking
+ * characters.  updateScreen() maintains a global count (cBlinkVisible) of blinking characters, to simplify the
+ * decision of when to redraw the screen.
+ */
+Video.ATTRS = {};
+Video.ATTRS.FGND_BLACK  = 0x00;
+Video.ATTRS.FGND_ULINE  = 0x01;
+Video.ATTRS.FGND_WHITE  = 0x07;
+Video.ATTRS.FGND_BRIGHT = 0x08;
+Video.ATTRS.BGND_BLACK  = 0x00;
+Video.ATTRS.BGND_WHITE  = 0x70;
+Video.ATTRS.BGND_BLINK  = 0x80;
+Video.ATTRS.BGND_BRIGHT = 0x80;
+Video.ATTRS.DRAW_FGND   = 0x100;        // this is an internal attribute bit, indicating the foreground should be drawn
+Video.ATTRS.DRAW_CURSOR = 0x200;        // this is an internal attribute bit, indicating when the cursor should be drawn
+
+/*
+ * Here's a "cheat sheet" for attribute byte combinations that the IBM MDA could have supported.  The original (Aug 1981)
+ * IBM Tech Ref is very terse and implies that only those marked with * are actually supported.
+ *
+ *     *0x00: non-display                       ATTR_FGND_BLACK |                    ATTR_BGND_BLACK
+ *     *0x01: underline                         ATTR_FGND_ULINE |                    ATTR_BGND_BLACK
+ *     *0x07: normal (white on black)           ATTR_FGND_WHITE |                    ATTR_BGND_BLACK
+ *    **0x09: bright underline                  ATTR_FGND_ULINE | ATTR_FGND_BRIGHT | ATTR_BGND_BLACK
+ *    **0x0F: bold (bright white on black)      ATTR_FGND_WHITE | ATTR_FGND_BRIGHT | ATTR_BGND_BLACK
+ *     *0x70: reverse (black on white)          ATTR_FGND_BLACK |                  | ATTR_BGND_WHITE
+ *      0x81: blinking underline                ATTR_FGND_ULINE |                  | ATTR_BGND_BLINK (or dim background if blink disabled)
+ *    **0x87: blinking normal                   ATTR_FGND_WHITE |                  | ATTR_BGND_BLINK (or dim background if blink disabled)
+ *      0x89: blinking bright underline         ATTR_FGND_ULINE | ATTR_FGND_BRIGHT | ATTR_BGND_BLINK (or dim background if blink disabled)
+ *    **0x8F: blinking bold                     ATTR_FGND_WHITE | ATTR_FGND_BRIGHT | ATTR_BGND_BLINK (or dim background if blink disabled)
+ *    **0xF0: blinking reverse                  ATTR_FGND_WHITE | ATTR_FGND_BRIGHT | ATTR_BGND_BLINK (or bright background if blink disabled)
+ *
+ * Unsupported attributes reportedly display as "normal" (ATTR_FGND_WHITE | ATTR_BGND_BLACK).  However, precisely which
+ * attributes are unsupported on the MDA varies depending on the source.  Some sources (eg, the IBM Tech Ref) imply that
+ * only those marked by * are supported, while others (eg, some--but not all--Peter Norton guides) include those marked
+ * by **, and still others include ALL the combinations listed above.
+ *
+ * Furthermore, according to http://www.seasip.info/VintagePC/mda.html:
+ *
+ *      Attributes 0x00, 0x08, 0x80 and 0x88 display as black space;
+ *      Attribute 0x78 displays as dark green on green; depending on the monitor, there may be a green "halo" where the dark and bright bits meet;
+ *      Attribute 0xF0 displays as a blinking version of 0x70 if blink enabled, and black on bright green otherwise;
+ *      Attribute 0xF8 displays as a blinking version of 0x78 if blink enabled, and as dark green on bright green otherwise.
+ *
+ * However, I'm rather skeptical about supporting 0x78 and 0xF8, until I see some evidence that "bright black" actually
+ * produced dark green on IBM equipment; it also doesn't sound like a combination many people would have used.  I'll probably
+ * treat all of 0x08, 0x80 and 0x88 the same as 0x00, only because it seems logical (they're all "black on black" combinations
+ * with only BRIGHT and/or BLINK bits set). Beyond that, I'll likely treat any other combination not listed in the above cheat
+ * sheet as "normal".
+ *
+ * All the discrepancies/disagreements I've found are probably due in part to the proliferation of IBM and non-IBM MDA
+ * cards, combined with IBM and non-IBM monochrome monitors, and people assuming that their non-IBM card and/or monitor
+ * behaved exactly like the original IBM equipment, which probably wasn't true in all cases.
+ *
+ * I would like to limit my MDA display support to EXACTLY everything that the IBM MDA supported and nothing more, but
+ * since there will be combinations that will logically "fall out" unless I specifically exclude them, it's very likely
+ * this implementation will end up being a superset.
+ */
+
+/*
+ * CGA attribute byte definitions; these simply extend the set of MDA attributes, with the exception of ATTR_FNGD_ULINE,
+ * which the CGA can treat only as ATTR_FGND_BLUE.
+ */
+Video.ATTRS.FGND_BLUE       = 0x01;
+Video.ATTRS.FGND_GREEN      = 0x02;
+Video.ATTRS.FGND_CYAN       = 0x03;
+Video.ATTRS.FGND_RED        = 0x04;
+Video.ATTRS.FGND_MAGENTA    = 0x05;
+Video.ATTRS.FGND_BROWN      = 0x06;
+
+Video.ATTRS.BGND_BLUE       = 0x10;
+Video.ATTRS.BGND_GREEN      = 0x20;
+Video.ATTRS.BGND_CYAN       = 0x30;
+Video.ATTRS.BGND_RED        = 0x40;
+Video.ATTRS.BGND_MAGENTA    = 0x50;
+Video.ATTRS.BGND_BROWN      = 0x60;
+
+/*
+ * For the MDA, the number of unique "colors" is 5, based on the following supported FGND attribute values:
+ *
+ *      0x0: black font (attribute value 0x8 is mapped to 0x0)
+ *      0x1: green font with underline
+ *      0x7: green font without underline (attribute values 0x2-0x6 are mapped to 0x7)
+ *      0x9: bright green font with underline
+ *      0xf: bright green font without underline (attribute values 0xa-0xe are mapped to 0xf)
+ *
+ * I'm still not sure about 0x8 (dark green?); for now, I'm mapping it to 0x0, but it may become a 6th supported color.
+ *
+ * MDA attributes form an index into aMDAColorMap, which in turn provides an index (0-4) into aMDAColors.
+ */
+Video.aMDAColors = [
+    [0x00, 0x00, 0x00, 0xff],
+    [0x7f, 0xc0, 0x7f, 0xff],
+    [0x7f, 0xc0, 0x7f, 0xff],
+    [0x7f, 0xff, 0x7f, 0xff],
+    [0x7f, 0xff, 0x7f, 0xff]
+];
+Video.aMDAColorMap = [0x0, 0x1, 0x2, 0x2, 0x2, 0x2, 0x2, 0x2, 0x0, 0x3, 0x4, 0x4, 0x4, 0x4, 0x4, 0x4];
+
+Video.aCGAColors = [
+    [0x00, 0x00, 0x00, 0xff],   // 0x00: ATTR_FGND_BLACK
+    [0x00, 0x00, 0xaa, 0xff],   // 0x01: ATTR_FGND_BLUE
+    [0x00, 0xaa, 0x00, 0xff],   // 0x02: ATTR_FGND_GREEN
+    [0x00, 0xaa, 0xaa, 0xff],   // 0x03: ATTR_FGND_CYAN
+    [0xaa, 0x00, 0x00, 0xff],   // 0x04: ATTR_FGND_RED
+    [0xaa, 0x00, 0xaa, 0xff],   // 0x05: ATTR_FGND_MAGENTA
+    [0xaa, 0x55, 0x00, 0xff],   // 0x06: ATTR_FGND_BROWN
+    [0xaa, 0xaa, 0xaa, 0xff],   // 0x07: ATTR_FGND_WHITE                      (aka light gray)
+    [0x55, 0x55, 0x55, 0xff],   // 0x08: ATTR_FGND_BLACK   | ATTR_FGND_BRIGHT (aka gray)
+    [0x55, 0x55, 0xff, 0xff],   // 0x09: ATTR_FGND_BLUE    | ATTR_FGND_BRIGHT
+    [0x55, 0xff, 0x55, 0xff],   // 0x0A: ATTR_FGND_GREEN   | ATTR_FGND_BRIGHT
+    [0x55, 0xff, 0xff, 0xff],   // 0x0B: ATTR_FGND_CYAN    | ATTR_FGND_BRIGHT
+    [0xff, 0x55, 0x55, 0xff],   // 0x0C: ATTR_FGND_RED     | ATTR_FGND_BRIGHT
+    [0xff, 0x55, 0xff, 0xff],   // 0x0D: ATTR_FGND_MAGENTA | ATTR_FGND_BRIGHT
+    [0xff, 0xff, 0x55, 0xff],   // 0x0E: ATTR_FGND_BROWN   | ATTR_FGND_BRIGHT (aka yellow)
+    [0xff, 0xff, 0xff, 0xff]    // 0x0F: ATTR_FGND_WHITE   | ATTR_FGND_BRIGHT (aka white)
+];
+
+Video.aCGAColorSet1 = [Video.ATTRS.FGND_GREEN, Video.ATTRS.FGND_RED,     Video.ATTRS.FGND_BROWN];
+Video.aCGAColorSet2 = [Video.ATTRS.FGND_CYAN,  Video.ATTRS.FGND_MAGENTA, Video.ATTRS.FGND_WHITE];
+
+/*
+ * Here is the EGA BIOS default ATC palette register set for color text modes, from which getCardColors()
+ * builds a default RGB array, similar to aCGAColors above.
+ */
+Video.aEGAPalDef = [0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x14, 0x07, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F];
+
+Video.aEGAByteToDW = [
+      0x00000000,   0x000000ff,   0x0000ff00,   0x0000ffff,
+      0x00ff0000,   0x00ff00ff,   0x00ffff00,   0x00ffffff,
+      0xff000000|0, 0xff0000ff|0, 0xff00ff00|0, 0xff00ffff|0,
+      0xffff0000|0, 0xffff00ff|0, 0xffffff00|0, 0xffffffff|0
+];
+
+Video.aEGADWToByte = [];
+Video.aEGADWToByte[0x00000000]   = 0x0;
+Video.aEGADWToByte[0x00000080]   = 0x1;
+Video.aEGADWToByte[0x00008000]   = 0x2;
+Video.aEGADWToByte[0x00008080]   = 0x3;
+Video.aEGADWToByte[0x00800000]   = 0x4;
+Video.aEGADWToByte[0x00800080]   = 0x5;
+Video.aEGADWToByte[0x00808000]   = 0x6;
+Video.aEGADWToByte[0x00808080]   = 0x7;
+Video.aEGADWToByte[0x80000000|0] = 0x8;
+Video.aEGADWToByte[0x80000080|0] = 0x9;
+Video.aEGADWToByte[0x80008000|0] = 0xa;
+Video.aEGADWToByte[0x80008080|0] = 0xb;
+Video.aEGADWToByte[0x80800000|0] = 0xc;
+Video.aEGADWToByte[0x80800080|0] = 0xd;
+Video.aEGADWToByte[0x80808000|0] = 0xe;
+Video.aEGADWToByte[0x80808080|0] = 0xf;
+
+/*
+ * Card Specifications
+ *
+ * We support dynamically switching between MDA and CGA cards by simply flipping switches on
+ * the virtual SW1 switch block and resetting the machine.  However, I'm not sure I'll support
+ * dynamically switching the EGA card the same way; there's certainly no UI for it at this point.
+ *
+ * For each supported card, there is a cardSpec array that the Card class uses to initialize the
+ * card's defaults:
+ *
+ *      [0]: card descriptor
+ *      [1]: default CRTC port address
+ *      [2]: default video buffer address
+ *      [3]: default video buffer size
+ *      [4]: total on-board memory (if no "memory" parm was specified)
+ *      [5]: default monitor type
+ *
+ * If total on-board memory is zero, then addMemory() will simply add the specified video buffer
+ * to the address space; otherwise, we will allocate an internal buffer (adwMemory) and tell addMemory()
+ * to map it to the video buffer address.  The latter approach gives us total control over the buffer;
+ * refer to getMemoryAccess().
+ *
+ * TODO: Consider allocating our own buffer for all video cards, not just EGA/VGA.  For MDA/CGA, I'm not
+ * sure it would offer any benefits, other than allowing our internal update functions, like updateScreen(),
+ * to access the buffer directly, instead of going through the Bus memory interface.
+ */
+Video.cardSpecs = [];
+Video.cardSpecs[Video.CARD.MDA] = ["MDA", Card.MDA.CRTC.INDX.PORT, 0xB0000, 0x01000, 0, ChipSet.MONITOR.MONO];
+Video.cardSpecs[Video.CARD.CGA] = ["CGA", Card.CGA.CRTC.INDX.PORT, 0xB8000, 0x04000, 0, ChipSet.MONITOR.COLOR];
+Video.cardSpecs[Video.CARD.EGA] = ["EGA", Card.CGA.CRTC.INDX.PORT, 0xB8000, 0x04000, 0x10000, ChipSet.MONITOR.EGACOLOR];
+Video.cardSpecs[Video.CARD.VGA] = ["VGA", Card.CGA.CRTC.INDX.PORT, 0xB8000, 0x04000, 0x40000, ChipSet.MONITOR.VGACOLOR];
+
+/*
+ * Values for nTouchConfig; a value will be selected based on the sTouchScreen configuration parameter.
+ */
+Video.TOUCH = {
+    NONE:       0,
+    KEYGRID:    1,
+    MOUSE:      2
+};
+
+/*
+ * Port input/output notification tables
+ *
+ * TODO: At one point, I'd added some "duplicate" entries for the MDA because, according to docs I'd read,
+ * MDA ports are decoded at multiple addresses.  However, if this is important, then it should be verified
+ * and implemented consistently (eg, for CGA as well).  For now, I'm decoding only the standard port addresses.
+ *
+ * For example, 0x3B5 is apparently also decoded at 0x3B1, 0x3B3, and 0x3B7, while 0x3B4 is also decoded at
+ * 0x3B0, 0x3B2, and 0x3B6.
+ */
+Video.aMDAPortInput = {
+    0x3B4: Video.prototype.inMDAIndx,           // technically, not actually readable, but I want the Debugger to be able to read this
+    0x3B5: Video.prototype.inMDAData,           // technically, the only CRTC Data registers that are readable are R14-R17
+    0x3B8: Video.prototype.inMDAMode,           // technically, not actually readable, but I want the Debugger to be able to read this
+    0x3BA: Video.prototype.inMDAStatus
+};
+
+Video.aMDAPortOutput = {
+    0x3B4: Video.prototype.outMDAIndx,
+    0x3B5: Video.prototype.outMDAData,
+    0x3B8: Video.prototype.outMDAMode
+};
+
+Video.aCGAPortInput = {
+    0x3D4: Video.prototype.inCGAIndx,           // technically, not actually readable, but I want the Debugger to be able to read this
+    0x3D5: Video.prototype.inCGAData,           // technically, the only CRTC Data registers that are readable are R14-R17
+    0x3D8: Video.prototype.inCGAMode,           // technically, not actually readable, but I want the Debugger to be able to read this
+    0x3D9: Video.prototype.inCGAColor,          // technically, not actually readable, but I want the Debugger to be able to read this
+    0x3DA: Video.prototype.inCGAStatus
+};
+
+Video.aCGAPortOutput = {
+    0x3D4: Video.prototype.outCGAIndx,
+    0x3D5: Video.prototype.outCGAData,
+    0x3D8: Video.prototype.outCGAMode,
+    0x3D9: Video.prototype.outCGAColor
+};
+
+Video.aEGAPortInput = {
+    0x3C0: Video.prototype.inATCIndx,           // technically, only readable on a VGA, but I want the Debugger to be able to read this, too
+    0x3C1: Video.prototype.inATCData,           // technically, only readable on a VGA, but I want the Debugger to be able to read this, too
+    0x3C2: Video.prototype.inStatus0,
+    0x3C4: Video.prototype.inSEQIndx,           // technically, only readable on a VGA, but I want the Debugger to be able to read this, too
+    0x3C5: Video.prototype.inSEQData,           // technically, only readable on a VGA, but I want the Debugger to be able to read this, too
+    0x3CE: Video.prototype.inGRCIndx,           // technically, only readable on a VGA, but I want the Debugger to be able to read this, too
+    0x3CF: Video.prototype.inGRCData            // technically, only readable on a VGA, but I want the Debugger to be able to read this, too
+};
+
+/*
+ * WARNING: Unlike the EGA, a standard VGA does not support writes to 0x3C1, but it's easier for me to leave that
+ * ability in place, treating the VGA as a superset of the EGA as much as possible; will any code break because word
+ * OUTs to port 0x3C0 (and/or byte OUTs to port 0x3C1) actually work?  Possibly, but highly unlikely.
+ */
+Video.aEGAPortOutput = {
+    0x3BA: Video.prototype.outFeat,
+    0x3C0: Video.prototype.outATC,
+    0x3C1: Video.prototype.outATC,              // the EGA BIOS writes to this port (see C000:0416), implying that 0x3C0 and 0x3C1 both decode the same register
+    0x3C2: Video.prototype.outMisc,             // FYI, since this overlaps with STATUS0.PORT, there's currently no way for the Debugger to read the Misc register
+    0x3C4: Video.prototype.outSEQIndx,
+    0x3C5: Video.prototype.outSEQData,
+    0x3CA: Video.prototype.outGRCPos2,
+    0x3CC: Video.prototype.outGRCPos1,
+    0x3CE: Video.prototype.outGRCIndx,
+    0x3CF: Video.prototype.outGRCData,
+    0x3DA: Video.prototype.outFeat
+};
+
+Video.aVGAPortInput = {
+    0x3C3: Video.prototype.inVGAEnable,
+    0x3C6: Video.prototype.inDACMask,
+    0x3C7: Video.prototype.inDACState,
+    0x3C9: Video.prototype.inDACData,
+    0x3CA: Video.prototype.inVGAFeat,
+    0x3CC: Video.prototype.inVGAMisc
+};
+
+Video.aVGAPortOutput = {
+    0x3C3: Video.prototype.outVGAEnable,
+    0x3C6: Video.prototype.outDACMask,
+    0x3C7: Video.prototype.outDACRead,
+    0x3C8: Video.prototype.outDACWrite,
+    0x3C9: Video.prototype.outDACData
+};
+
+/*
+ * Initialize every Video module on the page.
+ */
+Web.onInit(Video.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/parallel.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * class ParallelPort
+ * property {number} iAdapter
+ * property {number} portBase
+ * property {number} nIRQ
+ * property {Object} controlIOBuffer is a DOM element bound to the port (for rudimentary output; see transmitByte())
+ *
+ * NOTE: This class declaration started as a way of informing the code inspector of the controlIOBuffer property,
+ * which remained undefined until a setBinding() call set it later, but I've since decided that explicitly
+ * initializing such properties in the constructor is a better way to go -- even though it's more code -- because
+ * JavaScript compilers are supposed to be happier when the underlying object structures aren't constantly changing.
+ *
+ * Besides, I'm not sure I want to get into documenting every property this way, for this or any/every other class,
+ * let alone getting into which ones should be considered private or protected, because PCjs isn't really a library
+ * for third-party apps.
+ */
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class ParallelPort extends Component {
+    /**
+     * ParallelPort(parmsParallel)
+     *
+     * The ParallelPort component has the following component-specific (parmsParallel) properties:
+     *
+     *      adapter: 1 (port 0x3BC), 2 (port 0x378), or 3 (port 0x278); 0 if not defined
+     *
+     *      binding: name of a control (based on its "binding" attribute) to bind to this port's I/O
+     *
+     * In the future, we may support 'port' and 'irq' properties that allow the machine to define a
+     * non-standard parallel port configuration, instead of only our pre-defined 'adapter' configurations.
+     *
+     * NOTE: Since the XSL file defines 'adapter' as a number, not a string, there's no need to use
+     * parseInt(), and as an added benefit, we don't need to worry about whether a hex or decimal format
+     * was used.
+     *
+     * DOS typically names the Primary adapter "LPT1" and the Secondary adapter "LPT2", but I prefer
+     * to stick to adapter numbers, since not all operating systems follow those naming conventions.
+     *
+     * @this {ParallelPort}
+     * @param {Object} parmsParallel
+     */
+    constructor(parmsParallel)
+    {
+        super("ParallelPort", parmsParallel, Messages.PARALLEL);
+
+        this.iAdapter = parmsParallel['adapter'];
+
+        switch (this.iAdapter) {
+        case 1:
+            this.portBase = 0x3BC;
+            this.nIRQ = ChipSet.IRQ.LPT1;
+            break;
+        case 2:
+            this.portBase = 0x378;
+            this.nIRQ = ChipSet.IRQ.LPT1;
+            break;
+        case 3:
+            this.portBase = 0x278;
+            this.nIRQ = ChipSet.IRQ.LPT2;
+            break;
+        default:
+            Component.warning("Unrecognized parallel adapter #" + this.iAdapter);
+            return;
+        }
+        /**
+         * consoleOutput becomes a string that records parallel port output if the 'binding' property is set to the
+         * reserved name "console".  Nothing is written to the console, however, until a linefeed (0x0A) is output
+         * or the string length reaches a threshold (currently, 1024 characters).
+         *
+         * @type {string|null}
+         */
+        this.consoleOutput = null;
+
+        /**
+         * controlIOBuffer is a DOM element bound to the port (currently used for output only; see transmitByte()).
+         *
+         * @type {Object}
+         */
+        this.controlIOBuffer = null;
+
+        var sBinding = parmsParallel['binding'];
+        if (sBinding == "console") {
+            this.consoleOutput = "";
+        } else {
+            /*
+             * NOTE: If sBinding is not the name of a valid Control Panel DOM element, this call does nothing.
+             */
+            Component.bindExternalControl(this, sBinding, ParallelPort.sIOBuffer);
+        }
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * @this {ParallelPort}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "buffer")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        switch (sBinding) {
+        case ParallelPort.sIOBuffer:
+            this.bindings[sBinding] = this.controlIOBuffer = control;
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {ParallelPort}
+     * @param {Computer} cmp
+     * @param {Bus} bus
+     * @param {X86CPU} cpu
+     * @param {DebuggerX86} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+        this.chipset = cmp.getMachineComponent("ChipSet");
+        bus.addPortInputTable(this, ParallelPort.aPortInput, this.portBase);
+        bus.addPortOutputTable(this, ParallelPort.aPortOutput, this.portBase);
+        this.setReady();
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {ParallelPort}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            if (!data || !this.restore) {
+                this.reset();
+            } else {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {ParallelPort}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * reset()
+     *
+     * @this {ParallelPort}
+     */
+    reset()
+    {
+        this.initState();
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the ParallelPort component.
+     *
+     * @this {ParallelPort}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, this.saveRegisters());
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the ParallelPort component.
+     *
+     * @this {ParallelPort}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        return this.initState(data[0]);
+    }
+
+    /**
+     * initState(data)
+     *
+     * @this {ParallelPort}
+     * @param {Array} [data]
+     * @return {boolean} true if successful, false if failure
+     */
+    initState(data)
+    {
+        var i = 0;
+        if (data === undefined) {
+            data = [0, 0, 0];
+        }
+        this.bData = data[i++];
+        this.bStatus = data[i++];
+        this.bControl = data[i];
+        return true;
+    }
+
+    /**
+     * saveRegisters()
+     *
+     * @this {ParallelPort}
+     * @return {Array}
+     */
+    saveRegisters()
+    {
+        var i = 0;
+        var data = [];
+        data[i++] = this.bData;
+        data[i++] = this.bStatus;
+        data[i]   = this.bControl;
+        return data;
+    }
+
+    /**
+     * inData(port, addrFrom)
+     *
+     * @this {ParallelPort}
+     * @param {number} port (0x3BC, 0x378, or 0x278)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inData(port, addrFrom)
+    {
+        var b = this.bData;
+        this.printMessageIO(port, null, addrFrom, "DATA", b);
+        return b;
+    }
+
+    /**
+     * inStatus(port, addrFrom)
+     *
+     * @this {ParallelPort}
+     * @param {number} port (0x3BD, 0x379, or 0x279)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inStatus(port, addrFrom)
+    {
+        var b = this.bStatus;
+        this.printMessageIO(port, null, addrFrom, "STAT", b);
+        return b;
+    }
+
+    /**
+     * inControl(port, addrFrom)
+     *
+     * @this {ParallelPort}
+     * @param {number} port (0x3BE, 0x37A, or 0x27A)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inControl(port, addrFrom)
+    {
+        var b = this.bControl;
+        this.printMessageIO(port, null, addrFrom, "CTRL", b);
+        return b;
+    }
+
+    /**
+     * outData(port, bOut, addrFrom)
+     *
+     * @this {ParallelPort}
+     * @param {number} port (0x3BC, 0x378, or 0x278)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outData(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "DATA");
+        this.bData = bOut;
+        this.bStatus |= ParallelPort.STATUS.NOTREADY;
+        if (this.transmitByte(bOut)) {
+            this.bStatus &= ~ParallelPort.STATUS.NOTREADY;
+        }
+        this.updateIRR();
+    }
+
+    /**
+     * outControl(port, bOut, addrFrom)
+     *
+     * @this {ParallelPort}
+     * @param {number} port (0x3BE, 0x37A, or 0x27A)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outControl(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "CTRL");
+        this.bControl = bOut;
+        this.updateIRR();
+    }
+
+    /**
+     * updateIRR()
+     *
+     * @this {ParallelPort}
+     */
+    updateIRR()
+    {
+        if (this.chipset && this.nIRQ) {
+            if ((this.bControl & ParallelPort.CONTROL.IRQ_ENABLE) && !(this.bStatus & ParallelPort.STATUS.NOTREADY)) {
+                this.chipset.setIRR(this.nIRQ);
+            } else {
+                this.chipset.clearIRR(this.nIRQ);
+            }
+        }
+    }
+
+    /**
+     * transmitByte(b)
+     *
+     * @this {ParallelPort}
+     * @param {number} b
+     * @return {boolean} true if transmitted, false if not
+     */
+    transmitByte(b)
+    {
+        var fTransmitted = false;
+
+        this.printMessage("transmitByte(" + Str.toHexByte(b) + ")");
+
+        if (this.controlIOBuffer) {
+            if (b == 0x08) {
+                this.controlIOBuffer.value = this.controlIOBuffer.value.slice(0, -1);
+            }
+            else {
+                this.controlIOBuffer.value += String.fromCharCode(b);
+                this.controlIOBuffer.scrollTop = this.controlIOBuffer.scrollHeight;
+            }
+            fTransmitted = true;
+        }
+        if (this.consoleOutput != null) {
+            if (b == 0x0A || this.consoleOutput.length >= 1024) {
+                this.println(this.consoleOutput);
+                this.consoleOutput = "";
+            }
+            if (b != 0x0A) {
+                this.consoleOutput += String.fromCharCode(b);
+            }
+            fTransmitted = true;
+        }
+
+        return fTransmitted;
+    }
+
+    /**
+     * ParallelPort.init()
+     *
+     * This function operates on every HTML element of class "parallel", extracting the
+     * JSON-encoded parameters for the ParallelPort constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a ParallelPort component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeParallel = Component.getElementsByClass(document, PCX86.APPCLASS, "parallel");
+        for (var iParallel = 0; iParallel < aeParallel.length; iParallel++) {
+            var eParallel = aeParallel[iParallel];
+            var parmsParallel = Component.getComponentParms(eParallel);
+            var parallel = new ParallelPort(parmsParallel);
+            Component.bindComponentControls(parallel, eParallel, PCX86.APPCLASS);
+        }
+    }
+}
+
+/*
+ * Internal name used for the I/O buffer control, if any, that we bind to the ParallelPort.
+ *
+ * Alternatively, if ParallelPort wants to use another component's control (eg, the Panel's
+ * "print" control), it can specify the name of that control with the 'binding' property.
+ *
+ * For that binding to succeed, we also need to know the target component; for now, that's
+ * been hard-coded to "Panel", in part because that's one of the few components we can rely
+ * upon initializing before we do, but it would be a simple matter to include a component type
+ * or ID as part of the 'binding' property as well, if we need more flexibility later.
+ */
+ParallelPort.sIOBuffer = "buffer";
+
+/*
+ * The "Data Register" is an input/output register at offset 0 from portBase.  The bit-to-pin mappings are:
+ *
+ *      Bit     Pin
+ *      ---     ---
+ *       0       2              // 0x01 (DATA 1)
+ *       1       3              // 0x02 (DATA 2)
+ *       2       4              // 0x04 (DATA 3)
+ *       3       5              // 0x08 (DATA 4)
+ *       4       6              // 0x10 (DATA 5)
+ *       5       7              // 0x20 (DATA 6)
+ *       6       8              // 0x40 (DATA 7)
+ *       7       9              // 0x80 (DATA 8)
+ */
+ParallelPort.DATA = {           // (read/write)
+    REG:        0
+};
+
+/*
+ * The "Status Register" is an input register at offset 1 from portBase.  The bit-to-pin mappings are:
+ *
+ *      Bit     Pin
+ *      ---     ---
+ *       0       -              // 0x01
+ *       1       -              // 0x02
+ *       2       -              // 0x04
+ *       3       15             // 0x08 (not used)
+ *       4       13             // 0x10 (printer is in the selected state)
+ *       5       12             // 0x20 (out of paper)
+ *       6       10             // 0x40 (printer not yet ready to accept another character)
+ *       7       11             // 0x80 (printer cannot receive data; eg, printer off-line, or print operation in progress)
+ */
+ParallelPort.STATUS = {         // (read)
+    REG:        1,
+    NOTREADY:   0x40            // when this bit goes clear, interrupt requested
+};
+
+/*
+ * The "Control Register" is an input/output register at offset 2 from portBase.  The bit-to-pin mappings are:
+ *
+ *      Bit     Pin
+ *      ---     ---
+ *       0       !1             // 0x01 (read input data)
+ *       1      !14             // 0x02 (automatically feed paper one line)
+ *       2       16             // 0x04
+ *       3      !17             // 0x08
+ *
+ * Additionally, bit 4 is the IRQ ENABLE bit, which allows interrupts when pin 10 transitions high to low.
+ */
+ParallelPort.CONTROL = {        // (read/write)
+    REG:        2,
+    IRQ_ENABLE: 0x10            // set to enable interrupts
+};
+
+/*
+ * Port input notification table
+ */
+ParallelPort.aPortInput = {
+    0x0: ParallelPort.prototype.inData,
+    0x1: ParallelPort.prototype.inStatus,
+    0x2: ParallelPort.prototype.inControl
+};
+
+/*
+ * Port output notification table
+ */
+ParallelPort.aPortOutput = {
+    0x0: ParallelPort.prototype.outData,
+    0x2: ParallelPort.prototype.outControl
+};
+
+/*
+ * Initialize every ParallelPort module on the page.
+ */
+Web.onInit(ParallelPort.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/serial.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * class SerialPort
+ * property {number} iAdapter
+ * property {number} portBase
+ * property {number} nIRQ
+ * property {Object} controlIOBuffer is a DOM element bound to the port (for rudimentary output; see transmitByte())
+ *
+ * NOTE: This class declaration started as a way of informing the code inspector of the controlIOBuffer property,
+ * which remained undefined until a setBinding() call set it later, but I've since decided that explicitly
+ * initializing such properties in the constructor is a better way to go -- even though it's more code -- because
+ * JavaScript compilers are supposed to be happier when the underlying object structures aren't constantly changing.
+ *
+ * Besides, I'm not sure I want to get into documenting every property this way, for this or any/every other class,
+ * let alone getting into which ones should be considered private or protected, because PCjs isn't really a library
+ * for third-party apps.
+ */
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class SerialPort extends Component {
+    /**
+     * SerialPort(parmsSerial)
+     *
+     * The SerialPort component has the following component-specific (parmsSerial) properties:
+     *
+     *      adapter: 1 (port 0x3F8) or 2 (port 0x2F8); 0 if not defined
+     *
+     *      binding: name of a control (based on its "binding" attribute) to bind to this port's I/O
+     *
+     *      tabSize: set to a non-zero number to convert tabs to spaces (applies only to output to
+     *      the above binding); default is 0 (no conversion)
+     *
+     * In the future, we may support 'port' and 'irq' properties that allow the machine to define a
+     * non-standard serial port configuration, instead of only our pre-defined 'adapter' configurations.
+     *
+     * NOTE: Since the XSL file defines 'adapter' as a number, not a string, there's no need to use
+     * parseInt(), and as an added benefit, we don't need to worry about whether a hex or decimal format
+     * was used.
+     *
+     * This hard-coded approach mimics the original IBM PC Asynchronous Adapter configuration, which
+     * contained a pair of "shunt modules" that allowed the user to select a port address of either
+     * 0x3F8 ("Primary") or 0x2F8 ("Secondary").
+     *
+     * DOS typically names the Primary adapter "COM1" and the Secondary adapter "COM2", but I prefer
+     * to stick to adapter numbers, since not all operating systems follow those naming conventions.
+     *
+     * @this {SerialPort}
+     * @param {Object} parmsSerial
+     */
+    constructor(parmsSerial)
+    {
+        super("SerialPort", parmsSerial, Messages.SERIAL);
+
+        this.iAdapter = parmsSerial['adapter'];
+
+        switch (this.iAdapter) {
+        case 1:
+            this.portBase = 0x3F8;
+            this.nIRQ = ChipSet.IRQ.COM1;
+            break;
+        case 2:
+            this.portBase = 0x2F8;
+            this.nIRQ = ChipSet.IRQ.COM2;
+            break;
+        default:
+            Component.warning("Unrecognized serial adapter #" + this.iAdapter);
+            return;
+        }
+        /**
+         * consoleOutput becomes a string that records serial port output if the 'binding' property is set to the
+         * reserved name "console".  Nothing is written to the console, however, until a linefeed (0x0A) is output
+         * or the string length reaches a threshold (currently, 1024 characters).
+         *
+         * @type {string|null}
+         */
+        this.consoleOutput = null;
+
+        /**
+         * controlIOBuffer is a DOM element bound to the port (currently used for output only; see transmitByte()).
+         *
+         * Example: CTTY COM2
+         *
+         * The CTTY DOS command redirects all CON I/O to the specified serial port (eg, COM2), which it assumes is
+         * connected to a serial terminal, and therefore anything it *transmits* via COM2 will be displayed by the
+         * terminal.  It further assumes that anything typed on such a terminal is NOT displayed, so as DOS *receives*
+         * serial input, DOS *transmits* the appropriate characters back to the terminal via COM2.
+         *
+         * As a result, controlIOBuffer only needs to be updated by the transmitByte() function.
+         *
+         * @type {Object}
+         */
+        this.controlIOBuffer = null;
+
+        /*
+         * If controlIOBuffer is being used AND 'tabSize' is set, then we make an attempt to monitor the characters
+         * being echoed via transmitByte(), maintain a logical column position, and convert any tabs into the appropriate
+         * number of spaces.
+         *
+         * charBOL, if nonzero, is a character to automatically output at the beginning of every line.  This probably
+         * isn't generally useful; I use it internally to preformat serial output.
+         */
+        this.tabSize = parmsSerial['tabSize'];
+        this.charBOL = parmsSerial['charBOL'];
+        this.iLogicalCol = 0;
+
+        this.bMSRInit = SerialPort.MSR.CTS | SerialPort.MSR.DSR;
+        this.fNullModem = true;
+
+        var sBinding = parmsSerial['binding'];
+        if (sBinding == "console") {
+            this.consoleOutput = "";
+        } else {
+            /*
+             * NOTE: If sBinding is not the name of a valid Control Panel DOM element, this call does nothing.
+             */
+            Component.bindExternalControl(this, sBinding, SerialPort.sIOBuffer);
+        }
+
+        /*
+         * No connection until initConnection() is called.
+         */
+        this.sDataReceived = "";
+        this.connection = this.sendData = this.updateStatus = null;
+
+        /*
+         * Export all functions required by initConnection().
+         */
+        this['exports'] = {
+            'connect': this.initConnection,
+            'receiveData': this.receiveData,
+            'receiveStatus': this.receiveStatus
+        };
+    }
+
+    /**
+     * attachMouse(id, mouse, fnUpdate)
+     *
+     * @this {SerialPort}
+     * @param {string} id
+     * @param {Mouse} mouse
+     * @param {function(number)} fnUpdate
+     * @return {Component|null}
+     */
+    attachMouse(id, mouse, fnUpdate)
+    {
+        var component = null;
+        if (id == this.idComponent && !this.connection) {
+            this.connection = mouse;
+            this.updateStatus = fnUpdate;
+            this.fNullModem = false;
+            component = this;
+        }
+        return component;
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * @this {SerialPort}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "buffer")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        var serial = this;
+
+        switch (sBinding) {
+        case SerialPort.sIOBuffer:
+            this.bindings[sBinding] = this.controlIOBuffer = control;
+
+            /*
+             * By establishing an onkeypress handler here, we make it possible for DOS commands like
+             * "CTTY COM1" to more or less work (use "CTTY CON" to restore control to the DOS console).
+             */
+            control.onkeydown = function onKeyDown(event) {
+                /*
+                 * This is required in addition to onkeypress, because it's the only way to prevent
+                 * BACKSPACE (keyCode 8) from being interpreted by the browser as a "Back" operation;
+                 * moreover, not all browsers generate an onkeypress notification for BACKSPACE.
+                 *
+                 * A related problem exists for Ctrl-key combinations in most Windows-based browsers
+                 * (eg, IE, Edge, Chrome for Windows, etc), because keys like Ctrl-C and Ctrl-S have
+                 * special meanings (eg, Copy, Save).  To the extent the browser will allow it, we
+                 * attempt to disable that default behavior when this control receives an onkeydown
+                 * event for one of those keys (probably the only event the browser generates for them).
+                 */
+                event = event || window.event;
+                var keyCode = event.keyCode;
+                if (keyCode === 0x08 || event.ctrlKey && keyCode >= 0x41 && keyCode <= 0x5A) {
+                    if (event.preventDefault) event.preventDefault();
+                    if (keyCode > 0x40) keyCode -= 0x40;
+                    serial.receiveData(keyCode);
+                }
+                return true;
+            };
+
+            control.onkeypress = function onKeyPress(event) {
+                /*
+                 * Browser-independent keyCode extraction; refer to onKeyPress() and the other key event
+                 * handlers in keyboard.js.
+                 */
+                event = event || window.event;
+                var keyCode = event.which || event.keyCode;
+                serial.receiveData(keyCode);
+                /*
+                 * Since we're going to remove the "readonly" attribute from the <textarea> control
+                 * (so that the soft keyboard activates on iOS), instead of calling preventDefault() for
+                 * selected keys (eg, the SPACE key, whose default behavior is to scroll the page), we must
+                 * now call it for *all* keys, so that the keyCode isn't added to the control immediately,
+                 * on top of whatever the machine is echoing back, resulting in double characters.
+                 */
+                if (event.preventDefault) event.preventDefault();
+                return true;
+            };
+
+            /*
+             * Now that we've added an onkeypress handler that calls preventDefault() for ALL keys, the control
+             * itself no longer needs the "readonly" attribute; we primarily need to remove it for iOS browsers,
+             * so that the soft keyboard will activate, but it shouldn't hurt to remove the attribute for all browsers.
+             */
+            control.removeAttribute("readonly");
+
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {SerialPort}
+     * @param {Computer} cmp
+     * @param {Bus} bus
+     * @param {X86CPU} cpu
+     * @param {DebuggerX86} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cmp = cmp;
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+
+        this.chipset = cmp.getMachineComponent("ChipSet");
+
+        bus.addPortInputTable(this, SerialPort.aPortInput, this.portBase);
+        bus.addPortOutputTable(this, SerialPort.aPortOutput, this.portBase);
+
+        this.setReady();
+    }
+
+    /**
+     * initConnection(fNullModem)
+     *
+     * If a machine 'connection' parameter exists of the form "{sourcePort}->{targetMachine}.{targetPort}",
+     * and "{sourcePort}" matches our idComponent, then look for a component with id "{targetMachine}.{targetPort}".
+     *
+     * If the target component is found, then verify that it has exported functions with the following names:
+     *
+     *      receiveData(data): called when we have data to transmit; aliased internally to sendData(data)
+     *      receiveStatus(pins): called when our control signals have changed; aliased internally to updateStatus(pins)
+     *
+     * For now, we're not going to worry about communication in the other direction, because when the target component
+     * performs its own initConnection(), it will find our receiveData() and receiveStatus() functions, at which point
+     * communication in both directions should be established, and the circle of life complete.
+     *
+     * For added robustness, if the target machine initializes much more slowly than we do, and our connection attempt
+     * fails, that's OK, because when it finally initializes, its initConnection() will call our initConnection();
+     * if we've already initialized, no harm done.
+     *
+     * @this {SerialPort}
+     * @param {boolean} [fNullModem] (caller's null-modem setting, to ensure our settings are in agreement)
+     */
+    initConnection(fNullModem)
+    {
+        if (!this.connection) {
+            var sConnection = this.cmp.getMachineParm("connection");
+            if (sConnection) {
+                var asParts = sConnection.split('->');
+                if (asParts.length == 2) {
+                    var sSourceID = Str.trim(asParts[0]);
+                    if (sSourceID != this.idComponent) return;  // this connection string is intended for another instance
+                    var sTargetID = Str.trim(asParts[1]);
+                    this.connection = Component.getComponentByID(sTargetID);
+                    if (this.connection) {
+                        var exports = this.connection['exports'];
+                        if (exports) {
+                            var fnConnect = exports['connect'];
+                            if (fnConnect) fnConnect.call(this.connection, this.fNullModem);
+                            this.sendData = exports['receiveData'];
+                            if (this.sendData) {
+                                this.fNullModem = fNullModem;
+                                this.updateStatus = exports['receiveStatus'];
+                                this.status("Connected " + this.idMachine + '.' + sSourceID + " to " + sTargetID);
+                                return;
+                            }
+                        }
+                    }
+                }
+                /*
+                 * Changed from notice() to status() because sometimes a connection fails simply because one of us is a laggard.
+                 */
+                this.status("Unable to establish connection: " + sConnection);
+            }
+        }
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {SerialPort}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+
+            /*
+             * This is as late as we can currently wait to make our first inter-machine connection attempt;
+             * even so, the target machine's initialization process may still be ongoing, so any connection
+             * may be not fully resolved until the target machine performs its own initConnection(), which will
+             * in turn invoke our initConnection() again.
+             */
+            this.initConnection(this.fNullModem);
+
+            if (!data || !this.restore) {
+                this.reset();
+            } else {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {SerialPort}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * reset()
+     *
+     * @this {SerialPort}
+     */
+    reset()
+    {
+        this.initState();
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the SerialPort component.
+     *
+     * @this {SerialPort}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, this.saveRegisters());
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the SerialPort component.
+     *
+     * @this {SerialPort}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        return this.initState(data[0]);
+    }
+
+    /**
+     * initState(data)
+     *
+     * @this {SerialPort}
+     * @param {Array} [data]
+     * @return {boolean} true if successful, false if failure
+     */
+    initState(data)
+    {
+        /*
+         * The NS8250A spec doesn't explicitly say what the RBR and THR are initialized to on a reset,
+         * but I think we can safely assume zeros.  Similarly, we reset the baud rate Divisor Latch (wDL)
+         * to an arbitrary but consistent default (DL_DEFAULT).
+         */
+        var i = 0;
+        if (data === undefined) {
+            data = [
+                0,                                          // RBR
+                0,                                          // THR
+                SerialPort.DL_DEFAULT,                      // DL
+                0,                                          // IER
+                SerialPort.IIR.NO_INT,                      // IIR
+                0,                                          // LCR
+                0,                                          // MCR
+                SerialPort.LSR.THRE | SerialPort.LSR.TSRE,  // LSR
+                this.bMSRInit,                              // MSR
+                []
+            ];
+        }
+        this.bRBR = data[i++];
+        this.bTHR = data[i++];
+        this.wDL =  data[i++];
+        this.bIER = data[i++];
+        this.bIIR = data[i++];
+        this.bLCR = data[i++];
+        this.bMCR = data[i++];
+        this.bLSR = data[i++];
+        this.bMSR = data[i++];
+        this.abReceive = data[i];
+        return true;
+    }
+
+    /**
+     * saveRegisters()
+     *
+     * @this {SerialPort}
+     * @return {Array}
+     */
+    saveRegisters()
+    {
+        var i = 0;
+        var data = [];
+        data[i++] = this.bRBR;
+        data[i++] = this.bTHR;
+        data[i++] = this.wDL;
+        data[i++] = this.bIER;
+        data[i++] = this.bIIR;
+        data[i++] = this.bLCR;
+        data[i++] = this.bMCR;
+        data[i++] = this.bLSR;
+        data[i++] = this.bMSR;
+        data[i] = this.abReceive;
+        return data;
+    }
+
+    /**
+     * receiveData(data)
+     *
+     * This replaces the old sendRBR() function, which expected an Array of bytes.  We still support that,
+     * but in order to support connections with other SerialPort components (ie, the PC8080 SerialPort), we
+     * have added support for numbers and strings as well.
+     *
+     * @this {SerialPort}
+     * @param {number|string|Array} data
+     * @return {boolean} true if received, false if not
+     */
+    receiveData(data)
+    {
+        if (typeof data == "number") {
+            this.abReceive.push(data);
+        }
+        else if (typeof data == "string") {
+            for (var i = 0; i < data.length; i++) {
+                this.abReceive.push(data.charCodeAt(i));
+            }
+        }
+        else {
+            this.abReceive = this.abReceive.concat(data);
+        }
+        this.advanceRBR();
+        return true;                // for now, return true regardless, since we're buffering everything anyway
+    }
+
+    /**
+     * receiveStatus(pins)
+     *
+     * NOTE: Prior to the addition of this interface, the CTS and DSR bits were initialized set and remained set for the life
+     * of the machine.  It is entirely appropriate that this is the only way those bits can be changed, because they represent
+     * external control signals.
+     *
+     * @this {SerialPort}
+     * @param {number} pins
+     */
+    receiveStatus(pins)
+    {
+        var bMSROld = this.bMSR;
+        this.bMSR &= ~(SerialPort.MSR.CTS | SerialPort.MSR.DSR);
+        if (pins & RS232.CTS.MASK) {
+            this.bMSR |= SerialPort.MSR.CTS | SerialPort.MSR.DCTS;
+        }
+        if (pins & RS232.DSR.MASK) {
+            this.bMSR |= SerialPort.MSR.DSR | SerialPort.MSR.DDSR;
+        }
+        if (bMSROld != this.bMSR) this.updateIRR();
+    }
+
+    /**
+     * advanceRBR()
+     *
+     * @this {SerialPort}
+     */
+    advanceRBR()
+    {
+        if (this.abReceive.length > 0 && !(this.bLSR & SerialPort.LSR.DR)) {
+            this.bRBR = this.abReceive.shift();
+            this.bLSR |= SerialPort.LSR.DR;
+        }
+        this.updateIRR();
+    }
+
+    /**
+     * inRBR(port, addrFrom)
+     *
+     * @this {SerialPort}
+     * @param {number} port (eg, 0x3F8 or 0x2F8)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inRBR(port, addrFrom)
+    {
+        var b = ((this.bLCR & SerialPort.LCR.DLAB) ? (this.wDL & 0xff) : this.bRBR);
+        this.printMessageIO(port, null, addrFrom, (this.bLCR & SerialPort.LCR.DLAB) ? "DLL" : "RBR", b);
+        this.bLSR &= ~SerialPort.LSR.DR;
+        this.advanceRBR();
+        return b;
+    }
+
+    /**
+     * inIER(port, addrFrom)
+     *
+     * @this {SerialPort}
+     * @param {number} port (eg, 0x3F9 or 0x2F9)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inIER(port, addrFrom)
+    {
+        var b = ((this.bLCR & SerialPort.LCR.DLAB) ? (this.wDL >> 8) : this.bIER);
+        this.printMessageIO(port, null, addrFrom, (this.bLCR & SerialPort.LCR.DLAB) ? "DLM" : "IER", b);
+        return b;
+    }
+
+    /**
+     * inIIR(port, addrFrom)
+     *
+     * @this {SerialPort}
+     * @param {number} port (eg, 0x3FA or 0x2FA)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inIIR(port, addrFrom)
+    {
+        var b = this.bIIR;
+        this.printMessageIO(port, null, addrFrom, "IIR", b);
+        return b;
+    }
+
+    /**
+     * inLCR(port, addrFrom)
+     *
+     * @this {SerialPort}
+     * @param {number} port (eg, 0x3FB or 0x2FB)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inLCR(port, addrFrom)
+    {
+        var b = this.bLCR;
+        this.printMessageIO(port, null, addrFrom, "LCR", b);
+        return b;
+    }
+
+    /**
+     * inMCR(port, addrFrom)
+     *
+     * @this {SerialPort}
+     * @param {number} port (eg, 0x3FC or 0x2FC)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inMCR(port, addrFrom)
+    {
+        var b = this.bMCR;
+        this.printMessageIO(port, null, addrFrom, "MCR", b);
+        return b;
+    }
+
+    /**
+     * inLSR(port, addrFrom)
+     *
+     * @this {SerialPort}
+     * @param {number} port (eg, 0x3FD or 0x2FD)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inLSR(port, addrFrom)
+    {
+        var b = this.bLSR;
+        this.printMessageIO(port, null, addrFrom, "LSR", b);
+        return b;
+    }
+
+    /**
+     * inMSR(port, addrFrom)
+     *
+     * @this {SerialPort}
+     * @param {number} port (eg, 0x3FE or 0x2FE)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inMSR(port, addrFrom)
+    {
+        var b = this.bMSR;
+        this.bMSR &= ~(SerialPort.MSR.DCTS | SerialPort.MSR.DDSR);
+        this.printMessageIO(port, null, addrFrom, "MSR", b);
+        return b;
+    }
+
+    /**
+     * outTHR(port, bOut, addrFrom)
+     *
+     * @this {SerialPort}
+     * @param {number} port (eg, 0x3F8 or 0x2F8)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outTHR(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, (this.bLCR & SerialPort.LCR.DLAB) ? "DLL" : "THR");
+        if (this.bLCR & SerialPort.LCR.DLAB) {
+            this.wDL = (this.wDL & ~0xff) | bOut;
+        } else {
+            this.bTHR = bOut;
+            this.bLSR &= ~(SerialPort.LSR.THRE | SerialPort.LSR.TSRE);
+            if (this.transmitByte(bOut)) {
+                this.bLSR |= (SerialPort.LSR.THRE | SerialPort.LSR.TSRE);
+                /*
+                 * QUESTION: Does this mean we should also flush/zero bTHR?
+                 */
+            }
+        }
+    }
+
+    /**
+     * outIER(port, bOut, addrFrom)
+     *
+     * @this {SerialPort}
+     * @param {number} port (eg, 0x3F9 or 0x2F9)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outIER(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, (this.bLCR & SerialPort.LCR.DLAB) ? "DLM" : "IER");
+        if (this.bLCR & SerialPort.LCR.DLAB) {
+            this.wDL = (this.wDL & 0xff) | (bOut << 8);
+        } else {
+            this.bIER = bOut;
+        }
+    }
+
+    /**
+     * outLCR(port, bOut, addrFrom)
+     *
+     * @this {SerialPort}
+     * @param {number} port (eg, 0x3FB or 0x2FB)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outLCR(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "LCR");
+        this.bLCR = bOut;
+    }
+
+    /**
+     * outMCR(port, bOut, addrFrom)
+     *
+     * @this {SerialPort}
+     * @param {number} port (eg, 0x3FC or 0x2FC)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outMCR(port, bOut, addrFrom)
+    {
+        var delta = (bOut ^ this.bMCR);
+        this.printMessageIO(port, bOut, addrFrom, "MCR");
+        this.bMCR = bOut;
+        /*
+         * Whenever DTR or RTS changes, we also need to notify any connected machine or mouse, via updateStatus().
+         */
+        if (delta & (SerialPort.MCR.DTR | SerialPort.MCR.RTS)) {
+            if (this.updateStatus) {
+                var pins = 0;
+                if (this.fNullModem) {
+                    pins |= (bOut & SerialPort.MCR.RTS)? RS232.CTS.MASK : 0;
+                    pins |= (bOut & SerialPort.MCR.DTR)? (RS232.DSR.MASK | RS232.CD.MASK): 0;
+                } else {
+                    pins |= (bOut & SerialPort.MCR.RTS)? RS232.RTS.MASK : 0;
+                    pins |= (bOut & SerialPort.MCR.DTR)? RS232.DTR.MASK : 0;
+                }
+                this.updateStatus.call(this.connection, pins);
+            }
+        }
+    }
+
+    /**
+     * updateIRR()
+     *
+     * @this {SerialPort}
+     */
+    updateIRR()
+    {
+        var bIIR = -1;
+        if ((this.bLSR & SerialPort.LSR.DR) && (this.bIER & SerialPort.IER.RBR_AVAIL)) {
+            bIIR = SerialPort.IIR.INT_RBR;
+        }
+        else if ((this.bMSR & (SerialPort.MSR.DCTS | SerialPort.MSR.DDSR)) && (this.bIER & SerialPort.IER.MSR_DELTA)) {
+            bIIR = SerialPort.IIR.INT_MSR;
+        }
+        if (bIIR >= 0) {
+            this.bIIR &= ~(SerialPort.IIR.NO_INT | SerialPort.IIR.INT_BITS);
+            this.bIIR |= bIIR;
+            /*
+             * TODO: Remove this arbitrary 100-instruction delay once we've added support for baud rate throttling
+             * (see TODO above regarding baud rate).
+             */
+            if (this.chipset && this.nIRQ) this.chipset.setIRR(this.nIRQ, 100);
+        } else {
+            this.bIIR |= SerialPort.IIR.NO_INT;
+            if (this.chipset && this.nIRQ) this.chipset.clearIRR(this.nIRQ);
+        }
+    }
+
+    /**
+     * transmitByte(b)
+     *
+     * @this {SerialPort}
+     * @param {number} b
+     * @return {boolean} true if transmitted, false if not
+     */
+    transmitByte(b)
+    {
+        var fTransmitted = false;
+
+        this.printMessage("transmitByte(" + Str.toHexByte(b) + ")");
+
+        if (this.sendData) {
+            if (this.sendData.call(this.connection, b)) {
+                fTransmitted = true;
+            }
+        }
+
+        if (this.controlIOBuffer) {
+            if (b == 0x0D) {
+                this.iLogicalCol = 0;
+            }
+            else if (b == 0x08) {
+                this.controlIOBuffer.value = this.controlIOBuffer.value.slice(0, -1);
+                /*
+                 * TODO: Back up the correct number of columns if the character erased was a tab.
+                 */
+                if (this.iLogicalCol > 0) this.iLogicalCol--;
+            }
+            else {
+                var s = Str.toASCIICode(b); // formerly: String.fromCharCode(b);
+                var nChars = s.length;      // formerly: (b >= 0x20? 1 : 0);
+                if (b < 0x20 && nChars == 1) nChars = 0;
+                if (b == 0x09) {
+                    var tabSize = this.tabSize || 8;
+                    nChars = tabSize - (this.iLogicalCol % tabSize);
+                    if (this.tabSize) s = Str.pad("", nChars);
+                }
+                if (this.charBOL && !this.iLogicalCol && nChars) s = String.fromCharCode(this.charBOL) + s;
+                this.controlIOBuffer.value += s;
+                this.controlIOBuffer.scrollTop = this.controlIOBuffer.scrollHeight;
+                this.iLogicalCol += nChars;
+            }
+            fTransmitted = true;
+        }
+        else if (this.consoleOutput != null) {
+            if (b == 0x0A || this.consoleOutput.length >= 1024) {
+                this.println(this.consoleOutput);
+                this.consoleOutput = "";
+            }
+            if (b != 0x0A) {
+                this.consoleOutput += String.fromCharCode(b);
+            }
+            fTransmitted = true;
+        }
+
+        return fTransmitted;
+    }
+
+    /**
+     * SerialPort.init()
+     *
+     * This function operates on every HTML element of class "serial", extracting the
+     * JSON-encoded parameters for the SerialPort constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a SerialPort component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeSerial = Component.getElementsByClass(document, PCX86.APPCLASS, "serial");
+        for (var iSerial = 0; iSerial < aeSerial.length; iSerial++) {
+            var eSerial = aeSerial[iSerial];
+            var parmsSerial = Component.getComponentParms(eSerial);
+            var serial = new SerialPort(parmsSerial);
+            Component.bindComponentControls(serial, eSerial, PCX86.APPCLASS);
+        }
+    }
+}
+
+/*
+ * Internal name used for the I/O buffer control, if any, that we bind to the SerialPort.
+ *
+ * Alternatively, if SerialPort wants to use another component's control (eg, the Panel's
+ * "print" control), it can specify the name of that control with the 'binding' property.
+ *
+ * For that binding to succeed, we also need to know the target component; for now, that's
+ * been hard-coded to "Panel", in part because that's one of the few components we can rely
+ * upon initializing before we do, but it would be a simple matter to include a component type
+ * or ID as part of the 'binding' property as well, if we need more flexibility later.
+ */
+SerialPort.sIOBuffer = "buffer";
+
+/*
+ * 8250 I/O register offsets (add these to a I/O base address to obtain an I/O port address)
+ *
+ * NOTE: DLL.REG and DLM.REG form a 16-bit divisor into a clock input frequency of 1.8432Mhz.  The following
+ * values should be used for the corresponding baud rates.  Rates above 9600 are discouraged by the IBM Tech Ref,
+ * but rates as high as 128000 are listed on the NS8250A data sheet.
+ *
+ *      Divisor     Rate        Percent Error
+ *      0x0900      50
+ *      0x0600      75
+ *      0x0417      110         0.026%
+ *      0x0359      134.5       0.058%
+ *      0x0300      150
+ *      0x0180      300
+ *      0x00C0      600
+ *      0x0060      1200
+ *      0x0040      1800
+ *      0x003A      2000        0.69%
+ *      0x0030      2400
+ *      0x0020      3600
+ *      0x0018      4800
+ *      0x0010      7200
+ *      0x000C      9600
+ *      0x0006      19200
+ *      0x0003      38400
+ *      0x0002      56000       2.86%
+ *      0x0001      128000
+ */
+SerialPort.DLL = {REG: 0};              // Divisor Latch LSB (only when SerialPort.LCR.DLAB is set)
+SerialPort.THR = {REG: 0};              // Transmitter Holding Register (write)
+SerialPort.DL_DEFAULT       = 0x180;    // we select an arbitrary default Divisor Latch equivalent to 300 baud
+
+/*
+ * The divisor is stored in wDL.  If we take the frequency value 1843200 and divide it by wDL*128, we get the
+ * maximum number of bytes per second that the SerialPort interface should generate.  For example, if a baud
+ * rate of 1200 is being used, the divisor will be 0x60 (96), so we calculate 1843200/(96*128) = 150, which means
+ * there should be a 1000ms/150 or 6.667ms delay between bytes delivered.
+ *
+ * TODO: Enforce that delay.  However, the delay should be converted from real-world milliseconds to the
+ * appropriate number of CPU cycles we can pass to setBurstCycles().  This will also require the CPU to call
+ * us at the start of each burst, to see if advanceRBR() has more data to deliver.  For now, I'm throttling
+ * SerialPort interrupts by passing a hard-coded delay to setIRR().  The setIRR() delay does not ensure any
+ * particular baud rate, it simply gives the underlying Interrupt Service Routine (ISR) some breathing room.
+ *
+ * The Microsoft Windows 1.01 serial mouse driver ISR issues an EOI before it has safely exited, presumably
+ * relying on the fact that a 1200 baud serial device would not normally interrupt frequently enough to blow
+ * the stack.  However, in PCx86, all you have to do is enable Debugger messages on every serial interrupt
+ * and mouse event, eg:
+ *
+ *      m serial on;m pic on;m mouse on
+ *
+ * to slow the machine down to the point where serial mouse interrupts overwhelm the ISR.  The Debugger messages
+ * display the current stack pointer, which you can watch drop to zero and then wrap around, no doubt trampling
+ * lots of code and data along the way.
+ *
+ * This problem could also occur without being forced by the Debugger; eg, if your physical machine's mouse was
+ * configured for a high interrupt rate, and your browser generated mouse events at a comparable rate, then you
+ * could blow the simulation's stack.
+ */
+
+/*
+ * Receiver Buffer Register (RBR.REG, offset 0; eg, 0x3F8 or 0x2F8) on read, Transmitter Holding Register on write
+ */
+SerialPort.RBR = {REG: 0};              // (read)
+
+/*
+ * Interrupt Enable Register (IER.REG, offset 1; eg, 0x3F9 or 0x2F9)
+ */
+SerialPort.IER = {};
+SerialPort.IER.REG          = 1;        // Interrupt Enable Register
+SerialPort.IER.RBR_AVAIL    = 0x01;
+SerialPort.IER.THR_EMPTY    = 0x02;
+SerialPort.IER.LSR_DELTA    = 0x04;
+SerialPort.IER.MSR_DELTA    = 0x08;
+SerialPort.IER.UNUSED       = 0xF0;     // always zero
+
+SerialPort.DLM = {REG: 1};              // Divisor Latch MSB (only when SerialPort.LCR.DLAB is set)
+
+/*
+ * Interrupt ID Register (IIR.REG, offset 2; eg, 0x3FA or 0x2FA)
+ *
+ * All interrupt conditions cleared by reading the corresponding register (or, in the case of IRR_INT_THR, writing a new value to THR.REG)
+ */
+SerialPort.IIR = {};
+SerialPort.IIR.REG          = 2;        // Interrupt ID Register (read-only)
+SerialPort.IIR.NO_INT       = 0x01;
+SerialPort.IIR.INT_LSR      = 0x06;     // Line Status (highest priority: Overrun error, Parity error, Framing error, or Break Interrupt)
+SerialPort.IIR.INT_RBR      = 0x04;     // Receiver Data Available
+SerialPort.IIR.INT_THR      = 0x02;     // Transmitter Holding Register Empty
+SerialPort.IIR.INT_MSR      = 0x00;     // Modem Status Register (lowest priority: Clear To Send, Data Set Ready, Ring Indicator, or Data Carrier Detect)
+SerialPort.IIR.INT_BITS     = 0x06;
+SerialPort.IIR.UNUSED       = 0xF8;     // always zero (the ROM BIOS relies on these bits "floating to 1" when no SerialPort is present)
+
+/*
+ * Line Control Register (LCR.REG, offset 3; eg, 0x3FB or 0x2FB)
+ */
+SerialPort.LCR = {};
+SerialPort.LCR.REG          = 3;        // Line Control Register
+SerialPort.LCR.DATA_5BITS   = 0x00;
+SerialPort.LCR.DATA_6BITS   = 0x01;
+SerialPort.LCR.DATA_7BITS   = 0x02;
+SerialPort.LCR.DATA_8BITS   = 0x03;
+SerialPort.LCR.STOP_BITS    = 0x04;     // clear: 1 stop bit; set: 1.5 stop bits for LCR_DATA_5BITS, 2 stop bits for all other data lengths
+SerialPort.LCR.PARITY_BIT   = 0x08;     // if set, a parity bit is inserted/expected between the last data bit and the first stop bit; no parity bit if clear
+SerialPort.LCR.PARITY_EVEN  = 0x10;     // if set, even parity is selected (ie, the parity bit insures an even number of set bits); if clear, odd parity
+SerialPort.LCR.PARITY_STICK = 0x20;     // if set, parity bit is transmitted inverted; if clear, parity bit is transmitted normally
+SerialPort.LCR.BREAK        = 0x40;     // if set, serial output (SOUT) signal is forced to logical 0 for the duration
+SerialPort.LCR.DLAB         = 0x80;     // Divisor Latch Access Bit; if set, DLL.REG and DLM.REG can be read or written
+
+/*
+ * Modem Control Register (MCR.REG, offset 4; eg, 0x3FC or 0x2FC)
+ */
+SerialPort.MCR = {};
+SerialPort.MCR.REG          = 4;        // Modem Control Register
+SerialPort.MCR.DTR          = 0x01;     // when set, DTR goes high, indicating ready to establish link (looped back to DSR in loop-back mode)
+SerialPort.MCR.RTS          = 0x02;     // when set, RTS goes high, indicating ready to exchange data (looped back to CTS in loop-back mode)
+SerialPort.MCR.OUT1         = 0x04;     // when set, OUT1 goes high (looped back to RI in loop-back mode)
+SerialPort.MCR.OUT2         = 0x08;     // when set, OUT2 goes high (looped back to RLSD in loop-back mode)
+SerialPort.MCR.LOOPBACK     = 0x10;     // when set, enables loop-back mode
+SerialPort.MCR.UNUSED       = 0xE0;     // always zero
+
+/*
+ * Line Status Register (LSR.REG, offset 5; eg, 0x3FD or 0x2FD)
+ *
+ * NOTE: I've seen different specs for the LSR_TSRE.  I'm following the IBM Tech Ref's lead here, but the data sheet I have calls it TEMT
+ * instead of TSRE, and claims that it is set whenever BOTH the THR and TSR are empty, and clear whenever EITHER the THR or TSR contain data.
+ */
+SerialPort.LSR = {};
+SerialPort.LSR.REG          = 5;        // Line Status Register
+SerialPort.LSR.DR           = 0x01;     // Data Ready (set when new data in RBR.REG; cleared when RBR.REG read)
+SerialPort.LSR.OE           = 0x02;     // Overrun Error (set when new data arrives in RBR.REG before previous data read; cleared when LSR.REG read)
+SerialPort.LSR.PE           = 0x04;     // Parity Error (set when new data has incorrect parity; cleared when LSR.REG read)
+SerialPort.LSR.FE           = 0x08;     // Framing Error (set when new data has invalid stop bit; cleared when LSR.REG read)
+SerialPort.LSR.BI           = 0x10;     // Break Interrupt (set when new data exceeded normal transmission time; cleared LSR.REG when read)
+SerialPort.LSR.THRE         = 0x20;     // Transmitter Holding Register Empty (set when UART ready to accept new data; cleared when THR.REG written)
+SerialPort.LSR.TSRE         = 0x40;     // Transmitter Shift Register Empty (set when the TSR is empty; cleared when the THR is transferred to the TSR)
+SerialPort.LSR.UNUSED       = 0x80;     // always zero
+
+/*
+ * Modem Status Register (MSR.REG, offset 6; eg, 0x3FE or 0x2FE)
+ */
+SerialPort.MSR = {};
+SerialPort.MSR.REG          = 6;        // Modem Status Register
+SerialPort.MSR.DCTS         = 0x01;     // when set, CTS (Clear To Send) has changed since last read
+SerialPort.MSR.DDSR         = 0x02;     // when set, DSR (Data Set Ready) has changed since last read
+SerialPort.MSR.TERI         = 0x04;     // when set, TERI (Trailing Edge Ring Indicator) indicates RI has changed from 1 to 0
+SerialPort.MSR.DRLSD        = 0x08;     // when set, RLSD (Received Line Signal Detector) has changed
+SerialPort.MSR.CTS          = 0x10;     // when set, the modem or data set is ready to exchange data (complement of the Clear To Send input signal)
+SerialPort.MSR.DSR          = 0x20;     // when set, the modem or data set is ready to establish link (complement of the Data Set Ready input signal)
+SerialPort.MSR.RI           = 0x40;     // complement of the RI (Ring Indicator) input
+SerialPort.MSR.RLSD         = 0x80;     // complement of the RLSD (Received Line Signal Detect) input
+
+/*
+ * Scratch Register (SCR.REG, offset 7; eg, 0x3FF or 0x2FF)
+ */
+SerialPort.SCR = {REG: 7};
+
+/*
+ * Port input notification table
+ */
+SerialPort.aPortInput = {
+    0x0: SerialPort.prototype.inRBR,    // or DLL if DLAB set
+    0x1: SerialPort.prototype.inIER,    // or DLM if DLAB set
+    0x2: SerialPort.prototype.inIIR,
+    0x3: SerialPort.prototype.inLCR,
+    0x4: SerialPort.prototype.inMCR,
+    0x5: SerialPort.prototype.inLSR,
+    0x6: SerialPort.prototype.inMSR
+};
+
+/*
+ * Port output notification table
+ */
+SerialPort.aPortOutput = {
+    0x0: SerialPort.prototype.outTHR,   // or DLL if DLAB set
+    0x1: SerialPort.prototype.outIER,   // or DLM if DLAB set
+    0x3: SerialPort.prototype.outLCR,
+    0x4: SerialPort.prototype.outMCR
+};
+
+/*
+ * Initialize every SerialPort module on the page.
+ */
+Web.onInit(SerialPort.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/mouse.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class Mouse extends Component {
+    /**
+     * Mouse(parmsMouse)
+     *
+     * The Mouse component has the following component-specific (parmsMouse) properties:
+     *
+     *      serial: the ID of the corresponding serial component
+     *
+     * Since the first version of this component supports ONLY emulation of the original Microsoft
+     * serial mouse, a valid serial component ID is required.  It's possible that future versions
+     * of this component may support other types of simulated hardware (eg, the Microsoft InPort
+     * bus mouse adapter), or a virtual driver interface that would eliminate the need for any
+     * intermediate hardware simulation (at the expense of writing an intermediate software layer or
+     * virtual driver for each supported operating system).  However, those possibilities are extremely
+     * unlikely in the near term.
+     *
+     * If the 'serial' property is specified, then communication will be established with the
+     * SerialPort component, requesting access to the corresponding serial component ID.  If the
+     * SerialPort component is not installed and/or the specified serial component ID is not present,
+     * a configuration error will be reported.
+     *
+     * TODO: Just out of curiosity, verify that the Microsoft Bus Mouse used ports 0x23D and 0x23F,
+     * because I saw Windows v1.01 probing those ports immediately prior to probing COM2 (and then COM1)
+     * for a serial mouse.
+     *
+     * @this {Mouse}
+     * @param {Object} parmsMouse
+     */
+    constructor(parmsMouse)
+    {
+        super("Mouse", parmsMouse, Messages.MOUSE);
+
+        this.idAdapter = parmsMouse['serial'];
+        if (this.idAdapter) {
+            this.sAdapterType = "SerialPort";
+        }
+        this.setActive(false);
+        this.fCaptured = this.fLocked = false;
+
+        /*
+         * Initially, no video devices, and therefore no input devices, are attached.  initBus() will update aVideo,
+         * and powerUp() will update aInput.
+         */
+        this.aVideo = [];
+        this.aInput = [];
+        this.setReady();
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {Mouse}
+     * @param {Computer} cmp
+     * @param {Bus} bus
+     * @param {X86CPU} cpu
+     * @param {DebuggerX86} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cmp = cmp;
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+        /*
+         * Attach the Video component to the CPU, so that the CPU can periodically update
+         * the video display via updateVideo(), as cycles permit.
+         */
+        for (var video = null; (video = cmp.getMachineComponent("Video", video));) {
+            this.aVideo.push(video);
+        }
+    }
+
+    /**
+     * isActive()
+     *
+     * @this {Mouse}
+     * @return {boolean} true if active, false if not
+     */
+    isActive()
+    {
+        return this.fActive && (this.cpu? this.cpu.isRunning() : false);
+    }
+
+    /**
+     * setActive(fActive)
+     *
+     * @this {Mouse}
+     * @param {boolean} fActive is true if active, false if not
+     */
+    setActive(fActive)
+    {
+        this.fActive = fActive;
+        /*
+         * It's currently not possible to automatically lock the pointer outside the context of a user action
+         * (eg, a button or screen click), so this code is for naught.
+         *
+         *      if (this.aVideo.length) this.aVideo[0].notifyPointerActive(fActive);
+         *
+         * We now rely on similar code in clickMouse().
+         */
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {Mouse}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            if (!data || !this.restore) {
+                this.reset();
+            } else {
+                if (!this.restore(data)) return false;
+            }
+            if (this.sAdapterType && !this.componentAdapter) {
+                var componentAdapter = null;
+                while ((componentAdapter = this.cmp.getMachineComponent(this.sAdapterType, componentAdapter))) {
+                    if (componentAdapter.attachMouse) {
+                        this.componentAdapter = componentAdapter.attachMouse(this.idAdapter, this, this.receiveStatus);
+                        if (this.componentAdapter) {
+                            /*
+                             * It's possible that the SerialPort we've just attached to might want to bring us "up to speed"
+                             * on the adapter's state, which is why I envisioned a subsequent syncMouse() call.  And you would
+                             * want to do that as a separate call, not as part of attachMouse(), because componentAdapter
+                             * isn't set until attachMouse() returns.
+                             *
+                             * However, syncMouse() seems unnecessary, given that SerialPort initializes its MCR to an "inactive"
+                             * state, and even when restoring a previous state, if we've done our job properly, both SerialPort
+                             * and Mouse should be restored in sync, making any explicit attempt at sync'ing unnecessary (or so I hope).
+                             */
+                            // this.componentAdapter.syncMouse();
+                            break;
+                        }
+                    }
+                }
+                if (this.componentAdapter) {
+                    this.aInput = [];       // ensure the input device array is empty before (re)filling it
+                    for (var i = 0; i < this.aVideo.length; i++) {
+                        var input = this.aVideo[i].getInput(this);
+                        if (input) this.aInput.push(input);
+                    }
+                } else {
+                    Component.warning(this.id + ": " + this.sAdapterType + " " + this.idAdapter + " unavailable");
+                }
+            }
+            if (this.fActive) {
+                this.captureAll();
+            } else {
+                this.releaseAll();
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {Mouse}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * reset()
+     *
+     * @this {Mouse}
+     */
+    reset()
+    {
+        this.initState();
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the Mouse component.
+     *
+     * @this {Mouse}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, this.saveState());
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the Mouse component.
+     *
+     * @this {Mouse}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        return this.initState(data[0]);
+    }
+
+    /**
+     * initState(data)
+     *
+     * @this {Mouse}
+     * @param {Array} [data]
+     * @return {boolean} true if successful, false if failure
+     */
+    initState(data)
+    {
+        var i = 0;
+        if (data === undefined) data = [false, -1, -1, 0, 0, false, false, 0];
+        this.setActive(data[i++]);
+        this.xMouse = data[i++];
+        this.yMouse = data[i++];
+        this.xDelta = data[i++];
+        this.yDelta = data[i++];
+        this.fButton1 = data[i++];      // FYI, we consider button1 to be the LEFT button
+        this.fButton2 = data[i++];      // FYI, we consider button2 to be the RIGHT button
+        this.pins = data[i];
+        /*
+         * Convert old UART "MCR" data to new RS-232 "pins" data, in case we're loading an old state;
+         * detection and conversion relies on the fact that the MCR bits don't overlap with any RS-232 bits.
+         */
+        if (this.pins & (SerialPort.MCR.DTR | SerialPort.MCR.RTS)) {
+            this.pins = ((this.pins & SerialPort.MCR.DTR)? RS232.DTR.MASK : 0) | ((this.pins & SerialPort.MCR.RTS)? RS232.RTS.MASK : 0);
+        }
+        return true;
+    }
+
+    /**
+     * saveState()
+     *
+     * @this {Mouse}
+     * @return {Array}
+     */
+    saveState()
+    {
+        var i = 0;
+        var data = [];
+        data[i++] = this.fActive;
+        data[i++] = this.xMouse;
+        data[i++] = this.yMouse;
+        data[i++] = this.xDelta;
+        data[i++] = this.yDelta;
+        data[i++] = this.fButton1;
+        data[i++] = this.fButton2;
+        data[i] = this.pins;
+        return data;
+    }
+
+    /**
+     * notifyPointerLocked()
+     *
+     * @this {Mouse}
+     * @param {boolean} fLocked
+     */
+    notifyPointerLocked(fLocked)
+    {
+        this.fLocked = fLocked;
+    }
+
+    /**
+     * captureAll()
+     *
+     * @this {Mouse}
+     */
+    captureAll()
+    {
+        if (!this.fCaptured) {
+            for (var i = 0; i < this.aInput.length; i++) {
+                if (this.captureMouse(this.aInput[i])) this.fCaptured = true;
+            }
+        }
+    }
+
+    /**
+     * releaseAll()
+     *
+     * @this {Mouse}
+     */
+    releaseAll()
+    {
+        if (this.fCaptured) {
+            for (var i = 0; i < this.aInput.length; i++) {
+                if (this.releaseMouse(this.aInput[i])) this.fCaptured = false;
+            }
+        }
+    }
+
+    /**
+     * captureMouse(control)
+     *
+     * NOTE: addEventListener() wasn't supported in Internet Explorer until IE9, but that's OK, because
+     * IE9 is the oldest IE we support anyway (since versions prior to IE9 lack the necessary HTML5 support).
+     *
+     * @this {Mouse}
+     * @param {Object} control from the HTML DOM (eg, the control for the simulated screen)
+     * @return {boolean} true if event handlers were actually added, false if not
+     */
+    captureMouse(control)
+    {
+        if (control) {
+            var mouse = this;
+            control.addEventListener(
+                'mousemove',
+                function onMouseMove(event) {
+                    mouse.processMouseEvent(event);
+                },
+                false               // we'll specify false for the 'useCapture' parameter for now...
+            );
+            control.addEventListener(
+                'mousedown',
+                function onMouseDown(event) {
+                    mouse.processMouseEvent(event, true);
+                },
+                false               // we'll specify false for the 'useCapture' parameter for now...
+            );
+            control.addEventListener(
+                'mouseup',
+                function onMouseUp(event) {
+                    mouse.processMouseEvent(event, false);
+                },
+                false               // we'll specify false for the 'useCapture' parameter for now...
+            );
+            /*
+             * None of these tricks seemed to work for IE10, so I'm giving up hiding the browser's mouse pointer in IE for now.
+             *
+             *      control['style']['cursor'] = "url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAAZdEVYdFNvZnR3YXJlAFBhaW50Lk5FVCB2My41LjbQg61aAAAADUlEQVQYV2P4//8/IwAI/QL/+TZZdwAAAABJRU5ErkJggg=='), url('/versions/images/current/blank.cur'), none";
+             *
+             * Setting the cursor style to "none" may not be a standard, but it works in Safari, Firefox and Chrome, so that's pretty
+             * good for a non-standard!
+             *
+             * TODO: The reference to '/versions/images/current/blank.cur' is also problematic for anyone who might want
+             * to run this app from a different server, so think about that as well.
+             */
+            control['style']['cursor'] = "none";
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * releaseMouse(control)
+     *
+     * TODO: Use removeEventListener() to clean up our handlers; since I'm currently using anonymous functions,
+     * and since I'm not seeing any compelling reason to remove the handlers once they've been established, it's
+     * less code to leave them in place.
+     *
+     * @this {Mouse}
+     * @param {Object} control from the HTML DOM
+     * @return {boolean} true if event handlers were actually released, false if not
+     */
+    releaseMouse(control)
+    {
+        if (control) {
+            control['style']['cursor'] = "auto";
+        }
+        return false;
+    }
+
+    /**
+     * processMouseEvent(event, fDown)
+     *
+     * @this {Mouse}
+     * @param {Object} event object from a 'mousemove', 'mousedown' or 'mouseup' event (specifically, a MouseEvent object)
+     * @param {boolean} [fDown] (undefined if neither a down nor up event)
+     */
+    processMouseEvent(event, fDown)
+    {
+        if (fDown !== undefined) {
+            if (this.fLocked === false) {
+                /*
+                 * If there's no support for automatic pointer locking in the Video component, then notifyPointerActive()
+                 * will return false, and we will set fLocked to null, ensuring that we never attempt this again.
+                 */
+                if (!this.aVideo.length || !this.aVideo[0].notifyPointerActive(true)) {
+                    this.fLocked = null;
+                }
+            }
+            this.clickMouse(event.button, fDown);
+        } else {
+            /*
+             * MouseEvent objects contain, among other things, the following properties:
+             *
+             *      clientX
+             *      clientY
+             *
+             * I've selected the above properties because they're widely supported, not because I need
+             * client-area coordinates.  In fact, layerX and layerY are probably closer to what I really want,
+             * but I don't think they're available in all browsers.  screenX and screenY would work as well.
+             *
+             * This is because all we care about are deltas.  We record clientX and clientY (as xMouse and yMouse)
+             * merely to calculate xDelta and yDelta.
+             */
+            var xDelta, yDelta;
+            if (this.xMouse < 0 || this.yMouse < 0) {
+                this.xMouse = event.clientX;
+                this.yMouse = event.clientY;
+            }
+            if (this.fLocked) {
+                xDelta = event['movementX'] || event['mozMovementX'] || event['webkitMovementX'] || 0;
+                yDelta = event['movementY'] || event['mozMovementY'] || event['webkitMovementY'] || 0;
+            } else {
+                xDelta = event.clientX - this.xMouse;
+                yDelta = event.clientY - this.yMouse;
+            }
+            this.xMouse = event.clientX;
+            this.yMouse = event.clientY;
+            this.moveMouse(xDelta, yDelta, this.xMouse, this.yMouse);
+        }
+    }
+
+    /**
+     * clickMouse(iButton, fDown)
+     *
+     * @this {Mouse}
+     * @param {number} iButton is Mouse.BUTTON.LEFT (0) for fButton1, Mouse.BUTTON.RIGHT (2) for fButton2
+     * @param {boolean} fDown
+     */
+    clickMouse(iButton, fDown)
+    {
+        if (this.isActive()) {
+            var sDiag = DEBUGGER? ("mouse button" + iButton + ' ' + (fDown? "dn" : "up")) : null;
+            switch (iButton) {
+            case Mouse.BUTTON.LEFT:
+                if (this.fButton1 != fDown) {
+                    this.fButton1 = fDown;
+                    this.sendPacket(sDiag);
+                    return;
+                }
+                break;
+            case Mouse.BUTTON.RIGHT:
+                if (this.fButton2 != fDown) {
+                    this.fButton2 = fDown;
+                    this.sendPacket(sDiag);
+                    return;
+                }
+                break;
+            default:
+                break;
+            }
+            this.printMessage(sDiag + ": ignored");
+        }
+    }
+
+    /**
+     * moveMouse(xDelta, yDelta, xDiag, yDiag)
+     *
+     * @this {Mouse}
+     * @param {number} xDelta
+     * @param {number} yDelta
+     * @param {number} [xDiag]
+     * @param {number} [yDiag]
+     */
+    moveMouse(xDelta, yDelta, xDiag, yDiag)
+    {
+        if (this.isActive()) {
+            if (xDelta || yDelta) {
+                /*
+                 * As sendPacket() indicates, any x and y coordinates we supply are for diagnostic purposes only.
+                 * sendPacket() only cares about the xDelta and yDelta properties we provide above, which it then zeroes
+                 * on completion.
+                 */
+                this.xDelta = xDelta;
+                this.yDelta = yDelta;
+                this.sendPacket(null, xDiag, yDiag);
+            }
+        }
+    }
+
+    /**
+     * sendPacket(sDiag, xDiag, yDiag)
+     *
+     * If we're called, something changed.
+     *
+     * Let's review the 3-byte packet format:
+     *
+     *              D7  D6  D5  D4  D3  D2  D1  D0
+     *      Byte 1  X   1   LB  RB  Y7  Y6  X7  X6
+     *      Byte 2  X   0   X5  X4  X3  X2  X1  X0
+     *      Byte 3  X   0   Y5  Y4  Y3  Y2  Y1  Y0
+     *
+     * @this {Mouse}
+     * @param {string|null} [sDiag] diagnostic message
+     * @param {number} [xDiag] original x-coordinate (optional; for diagnostic use only)
+     * @param {number} [yDiag] original y-coordinate (optional; for diagnostic use only)
+     */
+    sendPacket(sDiag, xDiag, yDiag)
+    {
+        var b1 = 0x40 | (this.fButton1? 0x20 : 0) | (this.fButton2? 0x10 : 0) | ((this.yDelta & 0xC0) >> 4) | ((this.xDelta & 0xC0) >> 6);
+        var b2 = this.xDelta & 0x3F;
+        var b3 = this.yDelta & 0x3F;
+        if (this.messageEnabled(Messages.SERIAL)) {
+            this.printMessage((sDiag? (sDiag + ": ") : "") + (yDiag !== undefined? ("mouse (" + xDiag + "," + yDiag + "): ") : "") + "serial packet [" + Str.toHexByte(b1) + "," + Str.toHexByte(b2) + "," + Str.toHexByte(b3) + "]", 0, true);
+        }
+        this.componentAdapter.receiveData([b1, b2, b3]);
+        this.xDelta = this.yDelta = 0;
+    }
+
+    /**
+     * receiveStatus(pins)
+     *
+     * The SerialPort notifies us whenever SerialPort.MCR.DTR or SerialPort.MCR.RTS changes.
+     *
+     * During normal serial mouse operation, both RTS and DTR must be "positive".
+     *
+     * Setting RTS "negative" for 100ms resets the mouse.  Toggling DTR requests an identification byte (ID_SERIAL).
+     *
+     * NOTES: The above 3rd-party information notwithstanding, I've observed that Windows v1.01 initially writes 0x01
+     * to the MCR (DTR on, RTS off), spins in a loop that reads the RBR (probably to avoid a bogus identification byte
+     * sitting in the RBR), and then writes 0x0B to the MCR (DTR on, RTS on).  This last step is consistent with making
+     * the mouse "active", but it is NOT consistent with "toggling DTR", so I conclude that a reset is ALSO sufficient
+     * for sending the identification byte.  Right or wrong, this gets the ball rolling for Windows v1.01.
+     *
+     * @this {Mouse}
+     * @param {number} pins
+     */
+    receiveStatus(pins)
+    {
+        var fActive = ((pins & (RS232.DTR.MASK | RS232.RTS.MASK)) == (RS232.DTR.MASK | RS232.RTS.MASK));
+        if (fActive) {
+            if (!this.fActive) {
+                var fIdentify = false;
+                if (!(this.pins & RS232.RTS.MASK)) {
+                    this.reset();
+                    this.printMessage("serial mouse reset");
+                    fIdentify = true;
+                }
+                if (!(this.pins & RS232.DTR.MASK)) {
+                    this.printMessage("serial mouse ID requested");
+                    fIdentify = true;
+                }
+                if (fIdentify) {
+                    /*
+                     * HEADS UP: Everything I'd read about the (original) Microsoft Serial Mouse "reset" protocol says
+                     * that the device sends a single byte (0x4D aka 'M').  It's not surprising to think that newer mice
+                     * might send additional bytes, but you would think that newer mouse drivers (eg, MOUSE.COM v8.20)
+                     * would always be able to deal with mice that sent only one byte.
+                     *
+                     * You would be wrong.  On an INT 0x33 reset, the v8.20 driver looks for an 'M', then it waits for
+                     * another byte (0x42 aka 'B').  If it doesn't receive a 'B', it will accept another 'M'.  But if it
+                     * receives something else (or nothing at all), it will spend a long time waiting for it, and then
+                     * return an error.
+                     *
+                     * It's entirely possible that I've done something wrong and inadvertently "tricked" MOUSE.COM into
+                     * using the wrong detection logic.  But given the other problems I've seen in MOUSE.COM v8.20, including
+                     * its failure to properly terminate-and-stay-resident when its initial INT 0x33 reset returns an error,
+                     * I'm not in the mood to give it the benefit of the doubt.
+                     *
+                     * So, anyway, I solve the terminate-and-stay-resident bug in MOUSE.COM v8.20 by feeding it *two* ID_SERIAL
+                     * bytes on a reset.  This doesn't seem to adversely affect serial mouse emulation for Windows 1.01, so
+                     * I'm calling this good enough for now.
+                     */
+                    this.componentAdapter.receiveData([Mouse.ID_SERIAL, Mouse.ID_SERIAL]);
+                    this.printMessage("serial mouse ID sent");
+                }
+                this.captureAll();
+                this.setActive(fActive);
+            }
+        } else {
+            if (this.fActive) {
+                /*
+                 * Although this would seem nice (ie, for the Windows v1.01 mouse driver to turn RTS off when its mouse
+                 * driver shuts down and Windows exits, since it DID turn RTS on), that doesn't appear to actually happen.
+                 * At the very least, Windows will have (re)masked the serial port's IRQ, so what does it matter?  Not much,
+                 * I just would have preferred that fActive properly reflect whether we should continue dispatching mouse
+                 * events, displaying MOUSE messages, etc.
+                 *
+                 * We could ask the ChipSet component to notify the SerialPort component whenever its IRQ is masked/unmasked,
+                 * and then have the SerialPort pass that notification on to us, but I'm assuming that in the real world,
+                 * a mouse device that's still powered may still send event data to the serial port, and if there was software
+                 * polling the serial port, it might expect to see that data.  Unlikely, but not impossible.
+                 */
+                this.printMessage("serial mouse inactive");
+                this.releaseAll();
+                this.setActive(fActive);
+            }
+        }
+        this.pins = pins;
+    }
+
+    /**
+     * Mouse.init()
+     *
+     * This function operates on every HTML element of class "mouse", extracting the
+     * JSON-encoded parameters for the Mouse constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a Mouse component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeMouse = Component.getElementsByClass(document, PCX86.APPCLASS, "mouse");
+        for (var iMouse = 0; iMouse < aeMouse.length; iMouse++) {
+            var eMouse = aeMouse[iMouse];
+            var parmsMouse = Component.getComponentParms(eMouse);
+            var mouse = new Mouse(parmsMouse);
+            Component.bindComponentControls(mouse, eMouse, PCX86.APPCLASS);
+        }
+    }
+}
+
+/*
+ * From http://paulbourke.net/dataformats/serialmouse:
+ *
+ *      The old MicroSoft serial mouse, while no longer in general use, can be employed to provide a low cost input device,
+ *      for example, coupling the internal mechanism to other moving objects. The serial protocol for the mouse is:
+ *
+ *          1200 baud, 7 bit, 1 stop bit, no parity.
+ *
+ *      The pinout of the connector follows the standard serial interface, as shown below:
+ *
+ *          Pin     Abbr    Description
+ *          1       DCD     Data Carrier Detect
+ *          2       RD      Receive Data            [serial data from mouse to host]
+ *          3       TD      Transmit Data
+ *          4       DTR     Data Terminal Ready     [used to provide positive voltage to mouse, plus reset/detection]
+ *          5       SG      Signal Ground
+ *          6       DSR     Data Set Ready
+ *          7       RTS     Request To Send         [used to provide positive voltage to mouse]
+ *          8       CTS     Clear To Send
+ *          9       RI      Ring
+ *
+ *      Every time the mouse changes state (moved or button pressed) a three byte "packet" is sent to the serial interface.
+ *      For reasons known only to the engineers, the data is arranged as follows, most notably the two high order bits for the
+ *      x and y coordinates share the first byte with the button status.
+ *
+ *                      D6  D5  D4  D3  D2  D1  D0
+ *          1st byte    1   LB  RB  Y7  Y6  X7  X6
+ *          2nd byte    0   X5  X4  X3  X2  X1  X0
+ *          3rd byte    0   Y5  Y4  Y3  Y2  Y1  Y0
+ *
+ *      where:
+ *
+ *          LB is the state of the left button, 1 = pressed, 0 = released.
+ *          RB is the state of the right button, 1 = pressed, 0 = released
+ *          X0-7 is movement of the mouse in the X direction since the last packet. Positive movement is toward the right.
+ *          Y0-7 is movement of the mouse in the Y direction since the last packet. Positive movement is back, toward the user.
+ *
+ * From http://www.kryslix.com/nsfaq/Q.12.html:
+ *
+ *      The Microsoft serial mouse is the most popular 2-button mouse. It is supported by all major operating systems.
+ *      The maximum tracking rate for a Microsoft mouse is 40 reports/second * 127 counts per report, in other words, 5080 counts
+ *      per second. The most common range for mice is is 100 to 400 CPI (counts per inch) but can be up to 1000 CPI. A 100 CPI mouse
+ *      can discriminate motion up to 50.8 inches/second while a 400 CPI mouse can only discriminate motion up to 12.7 inches/second.
+ *
+ *          9-pin  25-pin    Line    Comments
+ *          shell  1         GND
+ *          3      2         TD      Serial data from host to mouse (only for power)
+ *          2      3         RD      Serial data from mouse to host
+ *          7      4         RTS     Positive voltage to mouse
+ *          8      5         CTS
+ *          6      6         DSR
+ *          5      7         SGND
+ *          4      20        DTR     Positive voltage to mouse and reset/detection
+ *
+ *      To function correctly, both the RTS and DTR lines must be positive. DTR/DSR and RTS/CTS must NOT be shorted.
+ *      RTS may be toggled negative for at least 100ms to reset the mouse. (After a cold boot, the RTS line is usually negative.
+ *      This provides an automatic toggle when RTS is brought positive). When DTR is toggled the mouse should send a single byte
+ *      (0x4D, ASCII 'M').
+ *
+ *      Serial data parameters: 1200bps, 7 data bits, 1 stop bit
+ *
+ *      Data is sent in 3 byte packets for each event (a button is pressed or released, or the mouse moves):
+ *
+ *                  D7  D6  D5  D4  D3  D2  D1  D0
+ *          Byte 1  X   1   LB  RB  Y7  Y6  X7  X6
+ *          Byte 2  X   0   X5  X4  X3  X2  X1  X0
+ *          Byte 3  X   0   Y5  Y4  Y3  Y2  Y1  Y0
+ *
+ *      LB is the state of the left button (1 means down).
+ *      RB is the state of the right button (1 means down).
+ *      X7-X0 movement in X direction since last packet (signed byte).
+ *      Y7-Y0 movement in Y direction since last packet (signed byte).
+ *      The high order bit of each byte (D7) is ignored. Bit D6 indicates the start of an event, which allows the software to
+ *      synchronize with the mouse.
+ */
+
+Mouse.ID_SERIAL = 0x4D;
+
+Mouse.BUTTON = {
+    LEFT:   0,
+    RIGHT:  2
+};
+
+/*
+ * Initialize every Mouse module on the page.
+ */
+Web.onInit(Mouse.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/disk.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ *  The Disk component provides methods for:
+ *
+ *      1) creating an empty disk: create()
+ *      2) loading a disk image: load()
+ *      3) getting disk information: info()
+ *      4) seeking a disk sector: seek()
+ *      5) reading data from a sector: read()
+ *      6) writing data to a sector: write()
+ *      7) save disk deltas: save()
+ *      8) restore disk deltas: restore()
+ *      9) converting disk contents: toJSON()
+ *
+ *  More functionality may be factored out of the FDC and HDC components later and moved here, to
+ *  further reduce some of the duplication between them, but the above functionality is a good start.
+ */
+
+/*
+ * Client/Server Disk I/O
+ *
+ * To support large disks without consuming large amounts of client-side memory, and to push
+ * client-side disk changes back the server, we need a DiskIO API that can be used in place of
+ * the DiskDump API.
+ *
+ * Use of the DiskIO API and any associated disk images must be tightly coupled to per-user
+ * storage and specific machine configurations, to prevent the disk images from being corrupted
+ * by inconsistent I/O operations.  Our basic User API (userapi.js) already provides some
+ * per-user storage that we can use to get the design rolling.
+ *
+ * The DiskIO API must also provide the ability to create new (empty) hard disk images in per-user
+ * storage and automatically associate them with the machine configurations that requested them.
+ */
+
+/*
+ * Principles
+ *
+ * Originally, when the Disk class was given a disk image to load and mount, it would request the
+ * ENTIRE disk image from the DiskDump module.  That works well for small (floppy) disk images, but
+ * for larger disks -- let's just say anything stored on the server as an "img" file -- we'd prefer
+ * to interact with that disk using "On-Demand I/O".  Any "img" file on the same server as the PCjs
+ * application should be a candidate for on-demand access.
+ *
+ * On-Demand I/O means that nothing is initially transferred from the server.  As sectors are
+ * requested by the PCx86 machine, PCx86 requests them from the server, and maintains an MRU cache
+ * of sectors, periodically discarding the least-used clean sectors above a certain memory limit.
+ * Dirty sectors (ie, those that the PCx86 machine has written to) must be periodically sent
+ * back to the server and then marked as clean, so that they can be discarded like any other
+ * sector.
+ *
+ * We also support "local" init-only disk images, which means that dirty sectors are never sent
+ * back to the server and are instead retained by the client for the lifetime of the app; such
+ * images are "read-only" as far as the server is concerned, but "read-write" as far as the client
+ * is concerned.  Reloading/restarting an app with an "local" disk will return the disk to its
+ * initial state.
+ *
+ * Practice
+ * ---
+ * Let's first look at what we *already* do for the HDC component:
+ *
+ *  1) Creating new (empty) disk images
+ *  2) Pre-loading pre-built JSON-encoded disk images (converting them to JSON on the fly as needed)
+ *
+ * An example of #1 is in /devices/pc/machine/5160/cga/256kb/demo/machine.xml:
+ *
+ *      <hdc id="hdcXT" drives='[{name:"10Mb Hard Drive",type:3}]'/>
+ *
+ * and an example of #2 is in /disks/pc/fixed/win101.xml:
+ *
+ *      <hdc id="hdcXT" drives='[{name:"10Mb Hard Drive",path:"/disks/pc/fixed/win101/10mb.json",type:3}]'/>
+ *
+ * The HDC component expects an array of drive entries.  Array position determines drive numbering
+ * (the first entry is drive 0, the second is drive 1, etc), and each entry contains the following
+ * properties:
+ *
+ *      'name': user-friendly name for the disk, if any
+ *      'path': URL of the disk image, if any
+ *      'type': a drive type
+ *
+ * Of those properties, only 'type' is required, which provides an index into an HDC "Drive Type"
+ * table that determines disk geometry and therefore disk size.  As we add support for larger disks and
+ * newer disk controllers, the 'type' parameter will be superseded by either a user-defined 'geometry'
+ * parameter that will define number of heads, cylinders, tracks, sectors per track, and (max) bytes per
+ * sector, or perhaps a generic 'size' parameter that leaves geometry choices to the HDC component,
+ * which will then pass those decisions on to the Disk component.
+ *
+ * We will enable on-demand I/O for a disk image with a new 'mode' parameter that looks like:
+ *
+ *      'mode': one of "local", "preload", "demandrw", "demandro"
+ *
+ * "preload" means the disk image will be completely preloaded, exactly as before; "demandrw" enables
+ * full on-demand I/O support; and "demandro" enables on-demand I/O for reads only (all writes are retained
+ * and never written back to the server).
+ *
+ * "ro" will be the fallback for "rw" unless TWO other important criteria are met: 1) the user has a
+ * private user key, and therefore per-user storage; and 2) the disk image 'path' contains an asterisk (*)
+ * that the server can internally remap to a directory in the user's storage; eg:
+ *
+ *      'path': <asterisk>/10mb.img (path components following the asterisk are optional)
+ *
+ * If the disk image does not already exist, it will be created (but not formatted).
+ *
+ * This preserves the promise that EVERYTHING a user does within a PCx86 machine is private (ie, not
+ * visible to any other PCjs users).  I don't want to be in the business of saving any user machine
+ * states or disk changes, but at least those operations are limited to users who have asked for (and
+ * received) a private user key.
+ *
+ * Another important consideration at this stage is dealing with multiple machines writing to the same
+ * disk image; even though we're limiting the "demandrw" mode to per-user images, a single user may still
+ * inadvertently start up multiple machines that refer to the same disk image.
+ *
+ * So, every PCx86 machine needs to generate a unique token and include that token with every Disk I/O API
+ * operation, so that the server can revoke a previous machine's "rw" access to a disk image when a new
+ * machine requests "rw" access to the same disk image.
+ *
+ * From the client's perspective, revocation can be quietly dealt with by reverting to "demandro" mode;
+ * that client becomes stuck with all their dirty sectors until they can reclaim "rw" access, which should
+ * only happen if no intervening writes to the disk image on the server have occurred (if I bother allowing
+ * reclamation at all).
+ *
+ * The real challenge here is avoiding revocation of a machine that still has critical changes to commit,
+ * but since we can't even solve the problem of a user closing their browser at an inopportune time
+ * and potentially leaving a disk image in an inconsistent state, premature revocation is the least of
+ * our problems.  Since a real hard drive could suffer the same fate if the machine's power was turned off
+ * at the wrong time, you could say that we're simply providing a faithful simulation of reality.
+ */
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class Disk extends Component {
+    /**
+     * Disk(controller, drive, mode)
+     *
+     * Disk contents are stored as an array (aDiskData) of cylinders, each of which is an array of
+     * heads, each of which is an array of sector objects; the latter contain sector numbers and
+     * sector data, where sector data is an array of dwords.  The format does not impose any
+     * limitations on number of cylinders, number of heads, sectors per track, or bytes per sector.
+     *
+     * WARNING: All accesses to disk sector properties must be via their string names, not their
+     * "dot" names, otherwise code will break after it's been processed by the Closure Compiler,
+     * and any dumped disks may be unmountable.  This is a side-effect of how we mount and dump
+     * disk images (ie, as JSON-encoded streams).
+     *
+     * This means, for example, that all references to "track[iSector].data" must actually appear as
+     * "track[iSector]['data']".
+     *
+     * @this {Disk}
+     * @param {HDC|FDC} controller
+     * @param {Object} drive
+     * @param {string} mode
+     */
+    constructor(controller, drive, mode)
+    {
+        super("Disk", {'id': controller.idMachine + ".disk" + Str.toHex(++Disk.nDisks, 4)}, Messages.DISK);
+
+        this.controller = controller;
+
+        /*
+         * Route all non-Debugger messages (eg, notice() and println() calls) through
+         * this.controller (eg, controller.notice() and controller.println()), because
+         * the Computer component is unaware of any Disk objects and therefore will not
+         * set up the usual overrides when a Control Panel is installed.
+         */
+        this.notice = controller.notice;
+        this.println = controller.println;
+
+        this.cmp = controller.cmp;
+        this.dbg = controller.dbg;
+        this.drive = drive;
+
+        /*
+         * We pull out a number of drive properties that we may or may not need as defaults
+         */
+        this.sDiskName = drive.name;
+        this.fRemovable = drive.fRemovable;
+        this.fOnDemand = this.fRemote = false;
+
+        /*
+         * Initialize the disk contents
+         */
+        this.create(mode, drive.nCylinders, drive.nHeads, drive.nSectors, drive.cbSector);
+
+        /*
+         * The following dirty sector and timer properties are used only with fOnDemand disks,
+         * assuming fRemote was successfully set.
+         */
+        this.aDirtySectors = [];
+        this.aDirtyTimestamps = [];         // this array is parallel to aDirtySectors
+        this.timerWrite = null;             // REMOTE_WRITE_DELAY timer in effect, if any
+        this.msTimerWrite = 0;              // the time that the write timer, if any, is set to fire
+        this.fWriteInProgress = false;
+
+        this.setReady();
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * We have no real interest in this notification, other than to obtain a reference to the Debugger
+     * for every disk loaded BEFORE the initBus() phase; any disk loaded AFTER that point will get its Debugger
+     * reference, if any, from the disk controller passed to the Disk() constructor.
+     *
+     * @this {Disk}
+     * @param {Computer} cmp
+     * @param {Bus} bus
+     * @param {X86CPU} cpu
+     * @param {DebuggerX86} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.dbg = dbg;
+    }
+
+    /**
+     * isRemote()
+     *
+     * @this {Disk}
+     * @return {boolean} true if remote disk, false if not
+     */
+    isRemote()
+    {
+        /*
+         * Ironically, we can't rely on fRemote, because that is cleared and set across disconnect and
+         * reconnect operations.  fOnDemand is the next best thing.
+         */
+        return this.fOnDemand;
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * As with powerDown(), our sole concern here is for REMOTE disks: if a powerDown() call disconnected an
+     * "on-demand" disk, we need to get reconnected.  Calling our own load() function should get the job done.
+     *
+     * The HDC component could have triggered this as well, but its powerUp() function only calls autoMount()
+     * in case of page (ie, application) reload, which is fine for local disks but insufficient for remote disks,
+     * which have a server connection that must be re-established.
+     *
+     * @this {Disk}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            if (this.fOnDemand && !this.fRemote) {
+                this.setReady(false);
+                this.load(this.sDiskName, this.sDiskPath, null, this.donePowerUp, this);
+            }
+        }
+        return true;
+    }
+
+    /**
+     * donePowerUp(drive, disk, sDiskName, sDiskPath)
+     *
+     * This is a callback issued by the Disk component once the load() from powerUp() has finished.
+     *
+     * @this {Disk}
+     * @param {Object} drive
+     * @param {Disk} disk is set if the disk was successfully mounted, null if not
+     * @param {string} sDiskName
+     * @param {string} sDiskPath
+     */
+    donePowerUp(drive, disk, sDiskName, sDiskPath)
+    {
+        this.setReady(true);
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * Our sole concern here is for REMOTE disks, making sure any unwritten changes get flushed to
+     * the server during a shutdown.  No local state is ever returned, so fSave is ignored.
+     *
+     * Local disks are managed by the controller (ie, FDC or HDC) that mounted them; the controller's
+     * powerDown() handler will take care of calling save() as needed.
+     *
+     * TODO: Consider taking responsibility for saving the state of local disks as well; the only reason
+     * the controllers still take care of them is historical, because this component originally didn't
+     * exist, and even after it was created, it didn't originally receive powerDown() notifications.
+     *
+     * @this {Disk}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean}
+     */
+    powerDown(fSave, fShutdown)
+    {
+        /*
+         * If we're connected to a remote disk, take this opportunity to flush any remaining unwritten
+         * changes and then close the connection.
+         */
+        if (this.fRemote) {
+            var response;
+            var nErrorCode = 0;
+            if (this.fWriteInProgress) {
+                /*
+                 * TODO: Verify that the Computer's powerOff() handler will actually honor a false return value.
+                 */
+                if (!Component.confirmUser("Disk writes are still in progress, shut down anyway?")) {
+                    return false;
+                }
+            }
+            while ((response = this.findDirtySectors(false))) {
+                if ((nErrorCode = response[0])) {
+                    this.notice('Unable to save "' + this.sDiskName + '" (error ' + nErrorCode + ')');
+                    break;
+                }
+            }
+            if (fShutdown) {
+                this.disconnectRemoteDisk();
+            }
+            /*
+             * I only report that changes to the disk have been "saved" if fSave is true, to avoid confusing
+             * users who might not understand the difference between discarding local changes (which should restore
+             * all diskettes to their original state) and discarding remote changes (which could leave the remote disk
+             * in a bad state).
+             */
+            if (!nErrorCode && fSave) this.notice(this.sDiskName + " saved");
+        }
+        return true;
+    }
+
+    /**
+     * create()
+     *
+     * @this {Disk}
+     * @param {string} mode
+     * @param {number} nCylinders
+     * @param {number} nHeads
+     * @param {number} nSectors (per track)
+     * @param {number} cbSector
+     *
+     * Initializes the disk contents according to the current drive mode and parameters.
+     */
+    create(mode, nCylinders, nHeads, nSectors, cbSector)
+    {
+        this.mode = mode;
+        this.nCylinders = nCylinders;
+        this.nHeads = nHeads;
+        this.nSectors = nSectors;
+        this.cbSector = cbSector;
+        this.aDiskData = [];
+        /*
+         * If the drive is using PRELOAD mode, then it will use the load()/mount() process to initialize the disk contents;
+         * it wouldn't hurt to let create() do its thing, too, but it's a waste of time.
+         */
+        if (this.mode != DiskAPI.MODE.PRELOAD) {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage("blank disk for \"" + this.sDiskName + "\": " + this.nCylinders + " cylinders, " + this.nHeads + " head(s)");
+            }
+            var aCylinders = new Array(this.nCylinders);
+            for (var iCylinder = 0; iCylinder < aCylinders.length; iCylinder++) {
+                var aHeads = new Array(this.nHeads);
+                for (var iHead = 0; iHead < aHeads.length; iHead++) {
+                    var aSectors = new Array(this.nSectors);
+                    for (var iSector = 1; iSector <= aSectors.length; iSector++) {
+                        /*
+                         * Now that our read() and write() functions can deal with unallocated data
+                         * arrays, and can read/write the specified pattern on-the-fly, we no longer need
+                         * to pre-allocate and pre-initialize the 'data' array.
+                         *
+                         * For "local" disks, we can assume a 'pattern' of 0, but for "demandrw" and "demandro"
+                         * disks, 'pattern' is set to null, as yet another indication that I/O is required to load
+                         * the sector from the server (or to write it back to the server).
+                         */
+                        aSectors[iSector - 1] = this.initSector(null, iCylinder, iHead, iSector, this.cbSector, (this.mode == DiskAPI.MODE.LOCAL? 0 : null));
+                    }
+                    aHeads[iHead] = aSectors;
+                }
+                aCylinders[iCylinder] = aHeads;
+            }
+            this.aDiskData = aCylinders;
+        }
+        this.dwChecksum = null;
+    }
+
+    /**
+     * load(sDiskName, sDiskPath, file, fnNotify)
+     *
+     * TODO: Figure out how we can strongly type fnNotify, because the Closure Compiler has issues with:
+     *
+     *      param {function(Component,Object,Disk,string,string)} fnNotify
+     *
+     * for:
+     *
+     *     this.fnNotify.call(this.controller, this.drive, disk, this.sDiskName, this.sDiskPath);
+     *
+     * Also, while we're at it, learn if there are ways to:
+     *
+     *      1) declare a function taking NO parameters (ie, generate a warning if any parameters are specified)
+     *      2) declare a type for a function's return value
+     *
+     * @this {Disk}
+     * @param {string} sDiskName
+     * @param {string} sDiskPath
+     * @param {File} [file] is set if there's an associated File object
+     * @param {function(...)} [fnNotify]
+     * @param {Component} [controller]
+     * @return {boolean} true if load completed (successfully or not), false if queued
+     */
+    load(sDiskName, sDiskPath, file, fnNotify, controller)
+    {
+        var sDiskURL = sDiskPath;
+
+        /*
+         * We could use this.log() as well, but it wouldn't display which component initiated the load.
+         */
+        if (DEBUG) {
+            var sMessage = 'load("' + sDiskName + '","' + sDiskPath + '")';
+            this.controller.log(sMessage);
+            this.printMessage(sMessage);
+        }
+
+        if (this.fnNotify) {
+            if (DEBUG) this.controller.log('too many load requests for "' + sDiskName + '" (' + sDiskPath + ')');
+            return true;
+        }
+
+        this.sDiskName = sDiskName;
+        this.sDiskPath = sDiskPath;
+        this.sDiskFile = Str.getBaseName(sDiskPath);
+
+        var disk = this;
+        this.fnNotify = fnNotify;
+        this.controllerNotify = controller || this.controller;
+
+        if (file) {
+            var reader = new FileReader();
+            reader.onload = function() {
+                disk.build(reader.result, true);
+            };
+            reader.readAsArrayBuffer(file);
+            return true;
+        }
+
+        /*
+         * If there's an occurrence of API_ENDPOINT anywhere in the path, we assume we can use it as-is;
+         * ie, that the user has already formed a URL of the type we use ourselves for unconverted disk images.
+         */
+        if (sDiskPath.indexOf(DumpAPI.ENDPOINT) < 0) {
+            /*
+             * If the selected disk image has a "json" extension, then we assume it's a pre-converted
+             * JSON-encoded disk image, so we load it as-is; otherwise, we ask our server-side disk image
+             * converter to return the corresponding JSON-encoded data.
+             */
+            var sDiskExt = Str.getExtension(sDiskPath);
+            if (sDiskExt == DumpAPI.FORMAT.JSON || sDiskExt == DumpAPI.FORMAT.JSON_GZ) {
+                sDiskURL = encodeURI(sDiskPath);
+            } else {
+                if (this.mode == DiskAPI.MODE.DEMANDRW || this.mode == DiskAPI.MODE.DEMANDRO) {
+                    sDiskURL = this.connectRemoteDisk(sDiskPath);
+                    this.fOnDemand = true;
+                } else {
+                    var sDiskParm = DumpAPI.QUERY.PATH;
+                    var sSizeParm = '&' + DumpAPI.QUERY.MBHD + "=10";
+                    /*
+                     * 'mbhd' is a new parm added for hard drive support.  In the case of 'file' or 'dir' requests,
+                     * 'mbhd' informs DumpAPI.ENDPOINT that it should create a hard disk image, and one not larger than
+                     * the specified size (eg, 10mb).  In fact, until DumpAPI.ENDPOINT is changed to create custom hard
+                     * disk BPBs, you'll always get a standard PC XT 10mb disk image, so if the 'file' or 'dir' contains
+                     * more than 10mb of data, the request will fail.  Ultimately, I want to honor the controller's
+                     * driveConfig 'size' parm, or to match the capacity required by the driveConfig 'type' parameter.
+                     *
+                     * If a 'disk' is specified, we pass mbhd=0, because the actual size will depend on the image.
+                     * However, I don't currently have any "dsk" or "img" files containing hard disk images; those formats
+                     * were really intended for floppy disk images.  If I never create any hard disk image files, then
+                     * we can simply eliminate sSizeParm in the 'disk' case.
+                     *
+                     * Added more extensions to the list of paths-treated-as-disk-images, so that URLs to files located here:
+                     *
+                     *      ftp://ftp.oldskool.org/pub/TOPBENCH/dskimage/
+                     *
+                     * can be used as-is.  TODO: There's a TODO in netlib.getFile() regarding remote support that needs
+                     * to be resolved first; DiskDump relies on that function for its remote requests, and it currently
+                     * supports only HTTP.
+                     */
+                    if (!sDiskPath.indexOf("http:") || !sDiskPath.indexOf("ftp:") || ["dsk", "ima", "img", "360", "720", "12", "144"].indexOf(sDiskExt) >= 0) {
+                        sDiskParm = DumpAPI.QUERY.DISK;
+                        sSizeParm = '&' + DumpAPI.QUERY.MBHD + "=0";
+                    } else if (Str.endsWith(sDiskPath, '/')) {
+                        sDiskParm = DumpAPI.QUERY.DIR;
+                    }
+                    sDiskURL = Web.getHost() + DumpAPI.ENDPOINT + '?' + sDiskParm + '=' + encodeURIComponent(sDiskPath) + (this.fRemovable ? "" : sSizeParm) + "&" + DumpAPI.QUERY.FORMAT + "=" + DumpAPI.FORMAT.JSON;
+                }
+            }
+        }
+        return !!Web.getResource(sDiskURL, null, true, function loadDone(sURL, sResponse, nErrorCode) {
+            disk.doneLoad(sURL, sResponse, nErrorCode);
+        });
+    }
+
+    /**
+     * build(buffer, fModified)
+     *
+     * Builds a disk image from an ArrayBuffer (eg, from a FileReader object), rather than from JSON-encoded data.
+     *
+     * @this {Disk}
+     * @param {?} buffer (we KNOW this is an ArrayBuffer, but we can't seem to convince the Closure Compiler)
+     * @param {boolean} [fModified] is true if we should mark the entire disk modified (to ensure that we save/restore it)
+     */
+    build(buffer, fModified)
+    {
+        var disk;
+        var cbDiskData = buffer? buffer.byteLength : 0;
+        var diskFormat = DiskAPI.GEOMETRIES[cbDiskData];
+
+        if (diskFormat) {
+            this.nCylinders = diskFormat[0];
+            this.nHeads = diskFormat[1];
+            this.nSectors = diskFormat[2];
+            this.cbSector = (diskFormat[3] || 512);
+
+            var cdw = this.cbSector >> 2, dwPattern = 0, dwChecksum = 0;
+            var ib = 0;
+            var dv = new DataView(buffer, 0, cbDiskData);
+
+            this.aDiskData = new Array(this.nCylinders);
+            for (var iCylinder = 0; iCylinder < this.aDiskData.length; iCylinder++) {
+                var cylinder = this.aDiskData[iCylinder] = new Array(this.nHeads);
+                for (var iHead = 0; iHead < cylinder.length; iHead++) {
+                    var head = cylinder[iHead] = new Array(this.nSectors);
+                    for (var iSector = 0; iSector < head.length; iSector++) {
+                        var sector = this.initSector(null, iCylinder, iHead, iSector + 1, this.cbSector, dwPattern);
+                        var adw = sector['data'];
+                        for (var idw = 0; idw < cdw; idw++, ib += 4) {
+                            var dw = adw[idw] = dv.getInt32(ib, true);
+                            dwChecksum = (dwChecksum + dw) & (0xffffffff|0);
+                        }
+                        if (fModified) sector.cModify = cdw;
+                        head[iSector] = sector;
+                    }
+                }
+            }
+            this.dwChecksum = dwChecksum;
+            disk = this;
+        } else {
+            this.notice("Unrecognized disk format (" + cbDiskData + " bytes)");
+        }
+
+        if (this.fnNotify) {
+            this.fnNotify.call(this.controller, this.drive, disk, this.sDiskName, this.sDiskPath);
+            this.fnNotify = null;
+        }
+    }
+
+    /**
+     * doneLoad(sURL, sDiskData, nErrorCode)
+     *
+     * This function was originally called mount().  If the mount is successful, we pass the Disk object to the
+     * caller's fnNotify handler; otherwise, we pass null.
+     *
+     * @this {Disk}
+     * @param {string} sURL
+     * @param {string} sDiskData
+     * @param {number} nErrorCode (response from server if anything other than 200)
+     */
+    doneLoad(sURL, sDiskData, nErrorCode)
+    {
+        var disk = null;
+        this.fWriteProtected = false;
+        var fPrintOnly = !!(nErrorCode < 0 && this.cmp && !this.cmp.flags.powered);
+
+        if (this.fOnDemand) {
+            if (!nErrorCode) {
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage('doneLoad("' + this.sDiskPath + '")');
+                }
+                this.fRemote = true;
+                if (BACKTRACK || SYMBOLS) this.buildFileTable();
+                disk = this;
+            } else {
+                this.notice('Unable to connect to disk "' + this.sDiskPath + '" (error ' + nErrorCode + ': ' + sDiskData + ')', fPrintOnly);
+            }
+        }
+        else if (nErrorCode) {
+            /*
+             * This can happen for innocuous reasons, such as the user switching away too quickly, forcing
+             * the request to be cancelled.  And unfortunately, the browser cancels XMLHttpRequest requests
+             * BEFORE it notifies any page event handlers, so if the Computer's being powered down, we won't know
+             * that yet.  For now, we rely on the lack of a specific error (nErrorCode < 0), and suppress the
+             * notify() alert if there's no specific error AND the computer is not powered up yet.
+             */
+            this.notice("Unable to load disk \"" + this.sDiskName + "\" (error " + nErrorCode + ": " + sURL + ")", fPrintOnly);
+        } else {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage('doneLoad("' + this.sDiskPath + '")');
+            }
+
+            Component.addMachineResource(this.controller.idMachine, sURL, sDiskData);
+
+            try {
+                /*
+                 * The following code was a hack to turn on write-protection for a disk image if there was
+                 * an initial comment line containing the string "write-protected".  However, since comments
+                 * are technically not allowed in JSON, I needed an alternative solution.  So, if the basename
+                 * contains the suffix "-readonly", then I'll turn on write-protection for that disk as well.
+                 *
+                 * TODO: Provide some UI for turning write-protection on/off for disks at will, and provide
+                 * an XML-based solution (ie, a per-disk XML configuration option) for controlling it as well.
+                 */
+                var sBaseName = Str.getBaseName(this.sDiskFile, true).toLowerCase();
+                if (sBaseName.indexOf("-readonly") > 0) {
+                    this.fWriteProtected = true;
+                } else {
+                    var iEOL = sDiskData.indexOf("\n");
+                    if (iEOL > 0 && iEOL < 1024) {
+                        var sConfig = sDiskData.substring(0, iEOL);
+                        if (sConfig.indexOf("write-protected") > 0) {
+                            this.fWriteProtected = true;
+                        }
+                    }
+                }
+                /*
+                 * The most likely source of any exception will be here, where we're parsing the disk data.
+                 */
+                var aDiskData;
+                if (sDiskData.substr(0, 1) == "<") {        // if the "data" begins with a "<"...
+                    /*
+                     * Early server configs reported an error (via the nErrorCode parameter) if a disk URL was invalid,
+                     * but more recent server configs now display a somewhat friendlier HTML error page.  The downside,
+                     * however, is that the original error has been buried, and we've received "data" that isn't actually
+                     * disk data.
+                     *
+                     * So, if the data we've received appears to be "HTML-like", all we can really do is assume that the
+                     * disk image is missing.  And so we pretend we received an error message to that effect.
+                     */
+                    aDiskData = ["Missing disk image: " + this.sDiskName];
+                } else {
+                    /*
+                     * TODO: IE9 is rather unfriendly and restrictive with regard to how much data it's willing to
+                     * eval().  In particular, the 10Mb disk image we use for the Windows 1.01 demo config fails in
+                     * IE9 with an "Out of memory" exception.  One work-around would be to chop the data into chunks
+                     * (perhaps one track per chunk, using regular expressions) and then manually re-assemble it.
+                     *
+                     * However, it turns out that using JSON.parse(sDiskData) instead of eval("(" + sDiskData + ")")
+                     * is a much easier fix. The only drawback is that we must first quote any unquoted property names
+                     * and remove any comments, because while eval() was cool with them, JSON.parse() is more particular;
+                     * the following RegExp replacements take care of those requirements.
+                     *
+                     * The use of hex values is something else that eval() was OK with, but JSON.parse() is not, and
+                     * while I've stopped using hex values in DumpAPI responses (at least when "format=json" is specified),
+                     * I can't guarantee they won't show up in "legacy" images, and there's no simple RegExp replacement
+                     * for transforming hex values into decimal values, so I cop out and fall back to eval() if I detect
+                     * any hex prefixes ("0x") in the sequence.  Ditto for error messages, which appear like so:
+                     *
+                     *      ["unrecognized disk path: test.img"]
+                     */
+                    if (sDiskData.indexOf("0x") < 0 && sDiskData.substr(0, 2) != "[\"") {
+                        aDiskData = JSON.parse(sDiskData.replace(/([a-z]+):/gm, "\"$1\":").replace(/\/\/[^\n]*/gm, ""));
+                    } else {
+                        aDiskData = eval("(" + sDiskData + ")");
+                    }
+                }
+
+                if (!aDiskData.length) {
+                    Component.error("Empty disk image: " + this.sDiskName);
+                }
+                else if (aDiskData.length == 1) {
+                    Component.error(aDiskData[0]);
+                }
+                /*
+                 * aDiskData is an array of cylinders, each of which is an array of heads, each of which
+                 * is an array of sector objects.  The format does not impose any limitations on number of
+                 * cylinders, number of heads, or number of bytes in any of the sector object byte-arrays.
+                 *
+                 * WARNING: All accesses to sector object properties must be via their string names, not their
+                 * "dot" names, otherwise code will break after it's been processed by the Closure Compiler.
+                 *
+                 * Sector object properties include:
+                 *
+                 *      'sector'    the sector number (1-based, not required to be sequential)
+                 *      'length'    the byte-length (ie, formatted length) of the sector
+                 *      'data'      the dword-array containing the sector data
+                 *      'pattern'   if the dword-array length is less than 'length'/4, this value must be used
+                 *                  to pad out the sector; if no 'pattern' is specified, it's assumed to be zero
+                 *
+                 * We still support the older JSON encoding, where sector data was encoded as an array of 'bytes'
+                 * rather than a dword 'data' array.  However, our support is strictly limited to an on-the-fly
+                 * conversion to a forward-compatible 'data' array.
+                 */
+                else {
+                    if (DEBUG && this.messageEnabled(Messages.DISK | Messages.DATA)) {
+                        var sCylinders = aDiskData.length + " track" + (aDiskData.length > 1 ? "s" : "");
+                        var nHeads = aDiskData[0].length;
+                        var sHeads = nHeads + " head" + (nHeads > 1 ? "s" : "");
+                        var nSectorsPerTrack = aDiskData[0][0].length;
+                        var sSectorsPerTrack = nSectorsPerTrack + " sector" + (nSectorsPerTrack > 1 ? "s" : "") + "/track";
+                        this.printMessage(sCylinders + ", " + sHeads + ", " + sSectorsPerTrack);
+                    }
+                    /*
+                     * Before the image is usable, we must "normalize" all the sectors.  In the past, this meant
+                     * "inflating" them all.  However, that's no longer strictly necessary.  Mainly, it just means
+                     * setting 'length', 'data', and 'pattern' properties, so that all the sectors are well-defined.
+                     * This includes detecting sector data in older formats (eg, the old array of 'bytes' instead
+                     * of the new 'data' array of dwords) and converting them on-the-fly to the current format.
+                     */
+                    this.nCylinders = aDiskData.length;
+                    this.nHeads = aDiskData[0].length;
+                    this.nSectors = aDiskData[0][0].length;
+                    var sector = aDiskData[0][0][0];
+                    this.cbSector = (sector && sector['length']) || 512;
+
+                    var dwChecksum = 0;
+                    for (var iCylinder = 0; iCylinder < this.nCylinders; iCylinder++) {
+                        for (var iHead = 0; iHead < this.nHeads; iHead++) {
+                            for (var iSector = 0; iSector < this.nSectors; iSector++) {
+                                sector = aDiskData[iCylinder][iHead][iSector];
+                                if (!sector) continue;          // non-standard (eg, XDF) disk images may have "unused" (null) sectors
+                                var length = sector['length'];
+                                if (length === undefined) {     // provide backward-compatibility with older JSON...
+                                    length = sector['length'] = 512;
+                                }
+                                length >>= 2;                   // convert length from a byte-length to a dword-length
+                                var dwPattern = sector['pattern'];
+                                if (dwPattern === undefined) {
+                                    dwPattern = sector['pattern'] = 0;
+                                }
+                                var adw = sector['data'];
+                                if (adw === undefined) {
+                                    var ab = sector['bytes'];
+                                    if (ab === undefined || !ab.length) {
+                                        /*
+                                         * If there is neither a 'bytes' nor 'data' array, then our job is simple:
+                                         * create an empty 'data' array; it will be filled in with the dword pattern
+                                         * as needed later.
+                                         *
+                                         * The only wrinkle is if there *is* a 'bytes' array but it's empty, in which
+                                         * case we must assume that the pattern was a byte pattern, so convert it to a
+                                         * dword pattern.
+                                         */
+                                        sector['data'] = adw = [];
+                                        if (ab) {
+
+                                            sector['pattern'] = (dwPattern | (dwPattern << 8) | (dwPattern << 16) | (dwPattern << 24));
+                                        }
+                                    }
+                                    else {
+                                        /*
+                                         * To keep the conversion code simple, we'll do any necessary pattern-filling first,
+                                         * to fully "inflate" the sector, eliminating the possibility of partial dwords and
+                                         * saving any code downstream from dealing with byte-size patterns.
+                                         */
+                                        var cb = length << 2;
+
+                                        for (var ib = ab.length; ib < cb; ib++) {
+                                            ab[ib] = dwPattern;         // the pattern for byte-arrays was only a byte
+                                        }
+                                        this.fill(sector, ab, 0);
+                                    }
+                                    delete sector['bytes'];
+                                }
+                                this.initSector(sector, iCylinder, iHead);
+                                /*
+                                 * For the disk as a whole, we maintain a checksum of the original unmodified data:
+                                 *
+                                 *      dwChecksum: summation of all dwords in all non-empty sectors
+                                 *
+                                 * Pattern-filling of sectors is deferred until absolutely necessary (eg, when a sector is
+                                 * being written).  So all we need to do at this point is checksum all the initial sector data.
+                                 */
+                                for (var idw = 0; idw < adw.length; idw++) {
+                                    dwChecksum = (dwChecksum + adw[idw]) & (0xffffffff|0);
+                                }
+                            }
+                        }
+                    }
+                    this.aDiskData = aDiskData;
+                    this.dwChecksum = dwChecksum;
+                    if (BACKTRACK || SYMBOLS) this.buildFileTable();
+                    disk = this;
+                }
+            } catch (e) {
+                Component.error("Disk image error (" + sURL + "): " + e.message);
+            }
+        }
+
+        if (this.fnNotify) {
+            this.fnNotify.call(this.controllerNotify, this.drive, disk, this.sDiskName, this.sDiskPath);
+            this.fnNotify = null;
+        }
+    }
+
+    /**
+     * buildFileTable()
+     *
+     * This function builds (or rebuilds) a complete file table from the (first) FAT volume found on the current
+     * disk, and then updates all the sector objects to point back to the corresponding file.  Used for BACKTRACK
+     * and SYMBOLS support.  Because this is an expensive operation, in terms of both time and memory, it should
+     * only be called when a disk is mounted or has been modified (eg, by applying deltas from a saved machine state).
+     *
+     * More recently, the FileInfo objects in the table have been enhanced to include debugging information if
+     * the file is an EXE or DLL, which we determine merely by checking the file extension.
+     *
+     * Note that while most of the methods in this module use CHS-style parameters, because our primary clients
+     * are old disk controllers that deal exclusively with cylinder/head/sector values, here we use 0-based
+     * "logical" sector numbers for volume-relative block addresses (aka LBAs or Logical Block Addresses), and
+     * 0-based "physical" sector numbers for disk-relative block addresses (aka PBAs or Physical Block Addresses).
+     *
+     * Also, our use of the term LBA differs from that of more modern disk controllers; in the pre-modern world
+     * of PCx86, what we call PBA numbers are what those controllers would later call LBA numbers.
+     *
+     * @this {Disk}
+     * @return {Array.<FileInfo>|undefined}
+     */
+    buildFileTable()
+    {
+        if (BACKTRACK || SYMBOLS) {
+
+            var i, off, dir = {}, iSector;
+
+            if (this.aFileTable && this.aFileTable.length) {
+                /*
+                 * In order for buildFileTable() to rebuild an existing table (eg, after deltas have been
+                 * applied), we need to zap any and all existing file table references in the sector data.
+                 */
+                var aDiskData = this.aDiskData;
+                for (var iCylinder = 0; iCylinder < aDiskData.length; iCylinder++) {
+                    for (var iHead = 0; iHead < aDiskData[iCylinder].length; iHead++) {
+                        for (iSector = 0; iSector < aDiskData[iCylinder][iHead].length; iSector++) {
+                            var sector = aDiskData[iCylinder][iHead][iSector];
+                            if (sector) {
+                                delete sector['file'];
+                                delete sector.offFile;
+                            }
+                        }
+                    }
+                }
+            }
+
+            this.aFileTable = [];
+
+            dir.pbaVolume = dir.lbaTotal = 0;
+
+            var cbDisk = this.nCylinders * this.nHeads * this.nSectors * this.cbSector;
+
+            /*
+             * At this point, if this is a remote disk, you may see some warning messages in your browser's console,
+             * like this message from Chrome:
+             *
+             *      "Synchronous XMLHttpRequest on the main thread is deprecated because of its detrimental effects
+             *      to the end user's experience. For more help, check http://xhr.spec.whatwg.org/."
+             *
+             * This is because I was lazy and made the buildFileTable() worker function getSector() use the synchronous
+             * form of seek().  For development purposes, that was fine, but...  TODO: Eventually change buildFileTable()
+             * to use async I/O.
+             */
+            if (this.fRemote) this.log("ignore any synchronous XMLHttpRequest warnings here (for now)");
+
+            var sectorBoot = this.getSector(0);
+            if (!sectorBoot) {
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage("buildFileTable(): unable to read boot sector");
+                }
+                return;
+            }
+
+            dir.cbSector = this.getSectorData(sectorBoot, DiskAPI.BPB.SECTOR_BYTES, 2);
+
+            var fValid = true;
+            if (dir.cbSector != this.cbSector) {
+                /*
+                 * When the first sector doesn't appear to contain a valid BPB, the most likely explanations are:
+                 *
+                 *      1. The image is from a diskette formatted by DOS 1.xx, which didn't use BPBs
+                 *      2. The image is a fixed (partitioned) disk and the first sector is actually an MBR
+                 *      3. The image is from a diskette that used a non-standard sector size (ie, not 512)
+                 *
+                 * To start, if this is an 160Kb disk (circa DOS 1.00) or a 320Kb disk (circa DOS 1.10), then we'll
+                 * assume it's a 12-bit FAT, set assorted BPB values accordingly, and see if our assumption holds up.
+                 */
+                fValid = false;
+                dir.lbaFAT = 1;
+                dir.nFATBits = 12;
+                dir.lbaRoot = dir.lbaFAT + 2;   // both 160Kb and 320Kb disks contained 2 FATs, each containing 1 sector
+                dir.nClusterSecs = 1;
+                dir.cbSector = this.cbSector;
+
+                if (cbDisk == 160 * 1024 && this.getClusterEntry(dir, 0, 0) == DiskAPI.FAT.MEDIA_160KB) {
+                    dir.lbaTotal = 320;
+                    dir.nEntries = 64;
+                    fValid = true;
+                }
+                else if (cbDisk == 320 * 1024 && this.getClusterEntry(dir, 0, 0) == DiskAPI.FAT.MEDIA_320KB) {
+                    dir.lbaTotal = 640;
+                    dir.nEntries = 112;
+
+                    dir.nClusterSecs++;         // 320Kb disks use 2 sectors/cluster
+                    fValid = true;
+                }
+                else {
+                    /*
+                     * So, this is either a fixed (partitioned) disk, or a disk using a non-standard sector size; let's assume
+                     * the former and check for an MBR.  For now, we're only going to process the first active partition we find.
+                     */
+                    off = DiskAPI.MBR.PARTITIONS.OFFSET;
+                    for (i = 0; i < 4; i++) {
+                        var bStatus = this.getSectorData(sectorBoot, off + DiskAPI.MBR.PARTITIONS.ENTRY.STATUS, 1);
+                        if (bStatus == DiskAPI.MBR.PARTITIONS.STATUS.ACTIVE) {
+                            dir.pbaVolume = this.getSectorData(sectorBoot, off + DiskAPI.MBR.PARTITIONS.ENTRY.LBA_FIRST, 4);
+                            sectorBoot = this.getSector(dir.pbaVolume);
+                            if (sectorBoot) fValid = true;
+                            break;
+                        }
+                        off += DiskAPI.MBR.PARTITIONS.ENTRY.LENGTH;
+                    }
+                }
+                if (!fValid) {
+                    if (DEBUG && this.messageEnabled()) {
+                        this.printMessage("buildFileTable(): unrecognized " + cbDisk + "-byte disk image with " + this.cbSector + "-byte sectors");
+                    }
+                    return;
+                }
+            }
+
+            if (!dir.lbaTotal) {
+                dir.lbaTotal = this.getSectorData(sectorBoot, DiskAPI.BPB.TOTAL_SECS, 2) || this.getSectorData(sectorBoot, DiskAPI.BPB.LARGE_SECS, 4);
+                dir.lbaFAT = this.getSectorData(sectorBoot, DiskAPI.BPB.RESERVED_SECS, 2);
+                dir.lbaRoot = dir.lbaFAT + this.getSectorData(sectorBoot, DiskAPI.BPB.FAT_SECS, 2) * this.getSectorData(sectorBoot, DiskAPI.BPB.TOTAL_FATS, 1);
+                dir.nEntries = this.getSectorData(sectorBoot, DiskAPI.BPB.ROOT_DIRENTS, 2);
+                dir.nClusterSecs = this.getSectorData(sectorBoot, DiskAPI.BPB.CLUSTER_SECS, 1);
+            }
+
+            dir.lbaData = dir.lbaRoot + (((dir.nEntries * DiskAPI.DIRENT.LENGTH + (dir.cbSector - 1)) / dir.cbSector) | 0);
+            dir.nClusters = (((dir.lbaTotal - dir.lbaData) / dir.nClusterSecs) | 0);
+
+            /*
+             * In all FATs, the first valid cluster number is 2, as 0 is used to indicate a free cluster and 1 is reserved.
+             *
+             * In a 12-bit FAT chain, the largest valid cluster number (iClusterMax) is 0xFF6; 0xFF7 is reserved for marking
+             * bad clusters and should NEVER appear in a cluster chain, and 0xFF8-0xFFF are used to indicate the end of a chain.
+             * Reports that cluster numbers 0xFF0-0xFF6 are "reserved" (eg, http://support.microsoft.com/KB/65541) should be
+             * ignored; those numbers may have been considered "reserved" at some early point in FAT's history, but no longer.
+             *
+             * Since 12 bits yield 4096 possible values, and since 11 of the values (0, 1, and 0xFF7-0xFFF) cannot be used to
+             * refer to an actual cluster, that leaves a theoretical maximum of 4085 clusters for a 12-bit FAT.  However, for
+             * reasons that only a small (and shrinking -- RIP AAR) number of people know, the actual cut-off is 4084.
+             *
+             * So, a FAT volume with 4084 or fewer clusters uses a 12-bit FAT, a FAT volume with 4085 to 65524 clusters uses
+             * a 16-bit FAT, and a FAT volume with more than 65524 clusters uses a 32-bit FAT.
+             *
+             * TODO: Eventually add support for FAT32.
+             */
+            dir.nFATBits = (dir.nClusters <= DiskAPI.FAT12.MAX_CLUSTERS? 12 : 16);
+            dir.iClusterMax = (dir.nFATBits == 12? DiskAPI.FAT12.CLUSNUM_MAX : DiskAPI.FAT16.CLUSNUM_MAX);
+
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage("buildFileTable()\n\tlbaFAT: " + dir.lbaFAT + "\n\tlbaRoot: " + dir.lbaRoot + "\n\tlbaData: " + dir.lbaData + "\n\tlbaTotal: " + dir.lbaTotal + "\n\tnClusterSecs: " + dir.nClusterSecs + "\n\tnClusters: " + dir.nClusters);
+            }
+
+            /*
+             * The following assertion is here only to catch anomalies; it is NOT a requirement that the number of data sectors
+             * be a perfect multiple of nClusterSecs, but if it ever happens, it's worth verifying we didn't miscalculate something.
+             */
+            i = (dir.lbaTotal - dir.lbaData) % dir.nClusterSecs;
+            if (i) {
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage("buildFileTable(): " + cbDisk + "-byte disk image wasting " + i + " sectors");
+                }
+            }
+
+            /*
+             * Similarly, it is NOT a requirement that the size of all root directory entries be a perfect multiple of the sector
+             * size (cbSector), but it may indicate a problem if it's not.  Note that when it comes time to read the root directory,
+             * we treat it exactly like any other directory; that is, we ignore the nEntries value and scan the entire contents of
+             * every sector allocated to the directory.  TODO: Determine whether DOS reads all root sector contents or only nEntries
+             * (ie, create a test volume where nEntries * 32 is NOT a multiple of cbSector and watch what happens).
+             */
+
+
+            var apba = [];
+            for (var lba = dir.lbaRoot; lba < dir.lbaData; lba++) apba.push(dir.pbaVolume + lba);
+            this.getDir(dir, this.sDiskFile, "", apba);
+
+            /*
+             * Create the sector-to-file mappings now.
+             */
+            for (i = 0; i < this.aFileTable.length; i++) {
+                var file = this.aFileTable[i];
+                off = 0;
+                for (iSector = 0; iSector < file.apba.length; iSector++) {
+                    this.updateSector(file, file.apba[iSector], off);
+                    off += this.cbSector;
+                }
+                file.loadSymbols();
+            }
+        }
+        return this.aFileTable;
+    }
+
+    /**
+     * getModuleInfo(sModule, nSegment)
+     *
+     * If the given module and segment number is found, we return an Array of symbol offsets, indexed by symbol name.
+     *
+     * @this {Disk}
+     * @param {string} sModule
+     * @param {number} nSegment
+     * @return {Object}
+     */
+    getModuleInfo(sModule, nSegment)
+    {
+        var aSymbols = {};
+        if (SYMBOLS && this.aFileTable) {
+            for (var iFile = 0; iFile < this.aFileTable.length; iFile++) {
+                var file = this.aFileTable[iFile];
+                if (file.sModule != sModule) continue;
+                var segment = file.aSegments[nSegment];
+                if (!segment) continue;
+                for (var iOrdinal in segment.aEntries) {
+                    var entry = segment.aEntries[iOrdinal];
+                    /*
+                     * entry[1] is the symbol name, which becomes the index, and entry[0] is the offset.
+                     */
+                    aSymbols[entry[1]] = entry[0];
+                }
+                break;
+            }
+        }
+        return aSymbols;
+    }
+
+    /**
+     * getSymbolInfo(sSymbol)
+     *
+     * For all whole or partial symbol matches, return them in an Array of entries:
+     *
+     *      [symbol, file name, segment number, segment offset, segment size].
+     *
+     * TODO: This function has many limitations (ie, slow, case-sensitive), but it gets the job done for now.
+     *
+     * @this {Disk}
+     * @param {string} sSymbol
+     * @return {Array}
+     */
+    getSymbolInfo(sSymbol)
+    {
+        var aInfo = [];
+        if (SYMBOLS && this.aFileTable) {
+            var sSymbolUpper = sSymbol.toUpperCase();
+            for (var iFile = 0; iFile < this.aFileTable.length; iFile++) {
+                var file = this.aFileTable[iFile];
+                for (var iSegment in file.aSegments) {
+                    var segment = file.aSegments[iSegment];
+                    for (var iOrdinal in segment.aEntries) {
+                        var entry = segment.aEntries[iOrdinal];
+                        if (entry[1] && entry[1].indexOf(sSymbolUpper) >= 0) {
+                            aInfo.push([entry[1], file.sName, iSegment, entry[0], segment.offEnd - segment.offStart]);
+                        }
+                    }
+                }
+            }
+        }
+        return aInfo;
+    }
+
+    /**
+     * getDir(dir, sDisk, sDir, apba)
+     *
+     * @this {Disk}
+     * @param {Object} dir
+     * @param {string} sDisk
+     * @param {string} sDir
+     * @param {Array.<number>} apba
+     */
+    getDir(dir, sDisk, sDir, apba)
+    {
+        var file;
+        var iStart = this.aFileTable.length;
+        var nEntriesPerSector = (dir.cbSector / DiskAPI.DIRENT.LENGTH) | 0;
+
+        dir.sDir = sDir + "\\";
+
+        if (DEBUG && this.messageEnabled()) this.printMessage('getDir("' + sDisk + '","' + dir.sDir + '")');
+
+        for (var iSector = 0; iSector < apba.length; iSector++) {
+            var pba = apba[iSector];
+            for (var iEntry = 0; iEntry < nEntriesPerSector; iEntry++) {
+                if (!this.getDirEntry(dir, pba, iEntry)) {
+                    iSector = apba.length;
+                    break;
+                }
+                if (dir.sName == null || dir.sName == "." || dir.sName == "..") continue;
+                var sPath = dir.sDir + dir.sName;
+                if (DEBUG && this.messageEnabled(Messages.DISK | Messages.DATA)) {
+                    this.printMessage('"' + sPath + '" size=' + dir.cbSize + ' cluster=' + dir.iCluster + ' sectors=' + JSON.stringify(dir.apba));
+                    if (dir.apba.length) this.printMessage(this.dumpSector(this.getSector(dir.apba[0]), dir.apba[0], sPath));
+                }
+                file = new FileInfo(this, sPath, dir.sName, dir.bAttr, dir.cbSize, dir.apba);
+                this.aFileTable.push(file);
+            }
+        }
+
+        var iEnd = this.aFileTable.length;
+
+        for (var i = iStart; i < iEnd; i++) {
+            file = this.aFileTable[i];
+            if (file.bAttr & DiskAPI.ATTR.SUBDIR && file.apba.length) this.getDir(dir, sDisk, sDir + "\\" + file.sName, file.apba);
+        }
+    }
+
+    /**
+     * getDirEntry(dir, pba, i)
+     *
+     * This sets the following properties on the 'dir' object:
+     *
+     *      sName (null if invalid/deleted entry)
+     *      bAttr
+     *      cbSize
+     *      iCluster
+     *      apba (ie, array of physical block addresses)
+     *
+     * On return, it's the caller's responsibility to copy out any data into a new object
+     * if it wants to preserve any of the above information.
+     *
+     * This function also caches the following properties in the 'dir' object:
+     *
+     *      pbaDirCache (of the last directory sector read, if any)
+     *      sectorDirCache (of the last directory sector read, if any)
+     *
+     * Also, the caller must also set the following 'dir' helper properties, so that clusters
+     * can be located and converted to sectors (see convertClusterToSectors):
+     *
+     *      lbaFAT
+     *      lbaData
+     *      cbSector
+     *      iClusterMax
+     *      nClusterSecs
+     *      nFATBits
+     *
+     * @this {Disk}
+     * @param {Object} dir (to be filled in)
+     * @param {number} pba (a sector of the directory)
+     * @param {number} i (an entry in the directory sector, 0-based)
+     * @returns {boolean} true if entry was returned (even if invalid/deleted), false if no more entries
+     */
+    getDirEntry(dir, pba, i)
+    {
+        if (!dir.sectorDirCache || !dir.pbaDirCache || dir.pbaDirCache != pba) {
+            dir.pbaDirCache = pba;
+            dir.sectorDirCache = this.getSector(dir.pbaDirCache);
+            if (DEBUG && this.messageEnabled(Messages.DISK | Messages.DATA)) {
+                this.printMessage(this.dumpSector(dir.sectorDirCache, dir.pbaDirCache, dir.sDir));
+            }
+        }
+        if (dir.sectorDirCache) {
+            var off = i * DiskAPI.DIRENT.LENGTH;
+            var b = this.getSectorData(dir.sectorDirCache, off, 1);
+            if (b == DiskAPI.DIRENT.UNUSED) {
+                return false;
+            }
+            if (b == DiskAPI.DIRENT.INVALID) {
+                dir.sName = null;
+                return true;
+            }
+            dir.sName = Str.trim(this.getSectorString(dir.sectorDirCache, off + DiskAPI.DIRENT.NAME, 8));
+            var s = Str.trim(this.getSectorString(dir.sectorDirCache, off + DiskAPI.DIRENT.EXT, 3));
+            if (s.length) dir.sName += '.' + s;
+            dir.bAttr = this.getSectorData(dir.sectorDirCache, off + DiskAPI.DIRENT.ATTR, 1);
+            dir.cbSize = this.getSectorData(dir.sectorDirCache, off + DiskAPI.DIRENT.SIZE, 2);
+            dir.iCluster = this.getSectorData(dir.sectorDirCache, off + DiskAPI.DIRENT.CLUSTER, 2);
+            dir.apba = this.convertClusterToSectors(dir);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * convertClusterToSectors(dir)
+     *
+     * @this {Disk}
+     * @param {Object} dir
+     * @return {Array.<number>} of PBAs (physical block addresses)
+     */
+    convertClusterToSectors(dir)
+    {
+        var apba = [];
+        var iCluster = dir.iCluster;
+        if (iCluster) {
+            do {
+                if (iCluster < DiskAPI.FAT12.CLUSNUM_MIN) {
+
+                    break;
+                }
+                var lba = dir.lbaData + ((iCluster - DiskAPI.FAT12.CLUSNUM_MIN) * dir.nClusterSecs);
+                for (var i = 0; i < dir.nClusterSecs; i++) {
+                    apba.push(dir.pbaVolume + lba++);
+                }
+                iCluster = this.getClusterEntry(dir, iCluster, 0) | this.getClusterEntry(dir, iCluster, 1);
+            } while (iCluster <= dir.iClusterMax);
+
+        }
+        return apba;
+    }
+
+    /**
+     * getClusterEntry(dir, iCluster, iByte)
+     *
+     * @this {Disk}
+     * @param {Object} dir
+     * @param {number} iCluster
+     * @param {number} iByte (0 for low byte of cluster entry, 1 for high byte)
+     * @return {number}
+     */
+    getClusterEntry(dir, iCluster, iByte)
+    {
+        var w = 0;
+        var cbitsSector = dir.cbSector * 8;
+        var offBits = dir.nFATBits * iCluster + (iByte? 8 : 0);
+        var iSector = (offBits / cbitsSector) | 0;
+        if (!dir.sectorFATCache || !dir.lbaFATCache || dir.lbaFATCache != dir.lbaFAT + iSector) {
+            dir.lbaFATCache = dir.lbaFAT + iSector;
+            dir.sectorFATCache = this.getSector(dir.pbaVolume + dir.lbaFATCache);
+        }
+        if (dir.sectorFATCache) {
+            offBits = (offBits % cbitsSector) | 0;
+            var off = (offBits >> 3);
+            w = this.getSectorData(dir.sectorFATCache, off, 1);
+            if (!iByte) {
+                if (offBits & 0x7) w >>= 4;
+            } else {
+                if (dir.nFATBits == 16) {
+                    w <<= 8;
+                } else {
+
+                    if (offBits & 0x7) {
+                        w <<= 4;
+                    } else {
+                        w = (w & 0xf) << 8;
+                    }
+                }
+            }
+        }
+        return w;
+    }
+
+    /**
+     * getSector(pba)
+     *
+     * @this {Disk}
+     * @param {number} pba (physical block address)
+     * @return {Object|null} sector
+     */
+    getSector(pba)
+    {
+        var nSectorsPerCylinder = this.nHeads * this.nSectors;
+        var iCylinder = (pba / nSectorsPerCylinder) | 0;
+        if (iCylinder < this.nCylinders) {
+            var nSectorsRemaining = (pba % nSectorsPerCylinder);
+            var iHead = (nSectorsRemaining / this.nSectors) | 0;
+            /*
+             * PBA numbers are 0-based, but the sector numbers in CHS addressing are 1-based, so add one to iSector
+             */
+            var iSector = (nSectorsRemaining % this.nSectors) + 1;
+            return this.seek(iCylinder, iHead, iSector);
+        }
+        return null;
+    }
+
+    /**
+     * getSectorData(sector, off, len)
+     *
+     * WARNING: This function is restricted to reading data contained ENTIRELY within the specified sector.
+     *
+     * NOTE: Yes, this function is not the most efficient way to read a byte/word/dword value from within a sector,
+     * but given the different states a sector may be in, it's certainly the simplest and safest, and since this is
+     * only used by buildFileTable() and its progeny, it's not clear that we need to be superfast anyway.
+     *
+     * @this {Disk}
+     * @param {Object} sector
+     * @param {number} off (byte offset)
+     * @param {number} len (1 to 4 bytes)
+     * @return {number}
+     */
+    getSectorData(sector, off, len)
+    {
+        var dw = 0;
+        var nShift = 0;
+
+        while (len--) {
+
+            var b = this.read(sector, off++);
+
+            if (b < 0) break;
+            dw |= (b << nShift);
+            nShift += 8;
+        }
+        return dw;
+    }
+
+    /**
+     * getSectorString(sector, off, len)
+     *
+     * WARNING: This function is restricted to reading a string contained ENTIRELY within the specified sector.
+     *
+     * @this {Disk}
+     * @param {Object} sector
+     * @param {number} off (byte offset)
+     * @param {number} len (use -1 to read a null-terminated string)
+     * @return {string}
+     */
+    getSectorString(sector, off, len)
+    {
+        var s = "";
+        while (len--) {
+            var b = this.read(sector, off++);
+            if (b <= 0) break;
+            s += String.fromCharCode(b);
+        }
+        return s;
+    }
+
+    /**
+     * updateSector(file, pba, off)
+     *
+     * Like getSector(), this must convert a PBA into CHS values; consider factoring that conversion code out.
+     *
+     * @this {Disk}
+     * @param {FileInfo} file
+     * @param {number} pba (physical block address from the file's apba)
+     * @param {number} off (file offset corresponding to the given pba of the given file)
+     * @return {boolean} true if successfully updated, false if not
+     */
+    updateSector(file, pba, off)
+    {
+        var nSectorsPerCylinder = this.nHeads * this.nSectors;
+        var iCylinder = (pba / nSectorsPerCylinder) | 0;
+        var nSectorsRemaining = (pba % nSectorsPerCylinder);
+        var iHead = (nSectorsRemaining / this.nSectors) | 0;
+        var iSector = (nSectorsRemaining % this.nSectors);
+        var cylinder, head, sector;
+        if ((cylinder = this.aDiskData[iCylinder]) && (head = cylinder[iHead]) && (sector = head[iSector])) {
+
+            if (sector['file']) {
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage('"' + sector['file'].sPath + '" cross-linked at offset ' + sector['file'].offFile + ' with "' + file.sPath + '" at offset ' + off);
+                }
+                return false;
+            }
+            sector['file'] = file;
+            sector.offFile = off;
+            return true;
+        }
+        if (DEBUG && this.messageEnabled()) this.printMessage("unable to map PBA " + pba + " to CHS");
+        return false;
+    }
+
+    /**
+     * initSector(sector, iCylinder, iHead, iSector, cbSector, dwPattern)
+     *
+     * Ensures every sector has ALL the properties of a proper Sector object; ie:
+     *
+     *      'sector':   sector number
+     *      'length':   size of the sector, in bytes
+     *      'data':     array of dwords
+     *      'pattern':  dword pattern to use for empty or partial sectors (null for unread remote sectors)
+     *
+     * In addition, we will maintain the following information on a per-sector basis,
+     * as sectors are modified:
+     *
+     *      iModify:    index of first modified dword in sector
+     *      cModify:    number of modified dwords in sector
+     *      fDirty:     true if sector is dirty, false if clean (or cleaning in progress)
+     *
+     * @this {Disk}
+     * @param {Object} sector
+     * @param {number} iCylinder
+     * @param {number} iHead
+     * @param {number} [iSector]
+     * @param {number} [cbSector]
+     * @param {number|null} [dwPattern]
+     * @return {Object}
+     */
+    initSector(sector, iCylinder, iHead, iSector, cbSector, dwPattern)
+    {
+        if (!sector) {
+            sector = {'sector': iSector, 'length': cbSector, 'data': [], 'pattern': dwPattern};
+        }
+        sector.iCylinder = iCylinder;
+        sector.iHead = iHead;
+        sector.iModify = sector.cModify = 0;
+        sector.fDirty = false;
+        return sector;
+    }
+
+    /**
+     * connectRemoteDisk(sDiskPath)
+     *
+     * Unlike disconnect(), we don't issue the connect request ourselves; instead, we piggyback on the existing
+     * preload code in load() to establish the connection.  That, in turn, will trigger a call to mount(), which
+     * will check fOnDemand and set fRemote if the connection was successful.
+     *
+     * @this {Disk}
+     * @param {string} sDiskPath
+     * @return {string} is the URL connection string required to connect to sDiskPath
+     */
+    connectRemoteDisk(sDiskPath)
+    {
+        var sParms = DiskAPI.QUERY.ACTION + '=' + DiskAPI.ACTION.OPEN;
+        sParms += '&' + DiskAPI.QUERY.VOLUME + '=' + sDiskPath;
+        sParms += '&' + DiskAPI.QUERY.MODE + '=' + this.mode;
+        sParms += '&' + DiskAPI.QUERY.CHS + '=' + this.nCylinders + ':' + this.nHeads + ':' + this.nSectors + ':' + this.cbSector;
+        sParms += '&' + DiskAPI.QUERY.MACHINE + '=' + this.controller.getMachineID();
+        sParms += '&' + DiskAPI.QUERY.USER + '=' + this.controller.getUserID();
+        return Web.getHost() + DiskAPI.ENDPOINT + '?' + sParms;
+    }
+
+    /**
+     * readRemoteSectors(iCylinder, iHead, iSector, nSectors, fAsync, done)
+     *
+     * @this {Disk}
+     * @param {number} iCylinder
+     * @param {number} iHead
+     * @param {number} iSector
+     * @param {number} nSectors (to read)
+     * @param {boolean} fAsync
+     * @param {function(number,boolean)} [done]
+     */
+    readRemoteSectors(iCylinder, iHead, iSector, nSectors, fAsync, done)
+    {
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("readRemoteSectors(CHS=" + iCylinder + ':' + iHead + ':' + iSector + ",N=" + nSectors + ")");
+        }
+
+        if (this.fRemote) {
+            var sParms = DiskAPI.QUERY.ACTION + '=' + DiskAPI.ACTION.READ;
+            sParms += '&' + DiskAPI.QUERY.VOLUME + '=' + this.sDiskPath;
+            sParms += '&' + DiskAPI.QUERY.CHS + '=' + this.nCylinders + ':' + this.nHeads + ':' + this.nSectors + ':' + this.cbSector;
+            sParms += '&' + DiskAPI.QUERY.ADDR + '=' + iCylinder + ':' + iHead + ':' + iSector + ':' + nSectors;
+            sParms += '&' + DiskAPI.QUERY.MACHINE + '=' + this.controller.getMachineID();
+            sParms += '&' + DiskAPI.QUERY.USER + '=' + this.controller.getUserID();
+            var disk = this;
+            var sDiskURL = Web.getHost() + DiskAPI.ENDPOINT + '?' + sParms;
+            Web.getResource(sDiskURL, null, fAsync, function(sURL, sResponse, nErrorCode) {
+                disk.doneReadRemoteSectors(sURL, sResponse, nErrorCode, [iCylinder, iHead, iSector, nSectors, fAsync, done]);
+            });
+            return;
+        }
+        if (done) done(-1, false);
+    }
+
+    /**
+     * doneReadRemoteSectors(sURLName, sURLData, nErrorCode, aRequest)
+     *
+     * @this {Disk}
+     * @param {string} sURLName
+     * @param {string} sURLData
+     * @param {number} nErrorCode
+     * @param {Array} aRequest ([iCylinder, iHead, iSector, nSectors, fAsync, done])
+     */
+    doneReadRemoteSectors(sURLName, sURLData, nErrorCode, aRequest)
+    {
+        var fAsync = false;
+
+        var iCylinder = aRequest[0];
+        var iHead = aRequest[1];
+        var iSector = aRequest[2];
+        var nSectors = aRequest[3];
+
+        if (!nErrorCode) {
+            var abData = JSON.parse(sURLData);
+            var offData = 0;
+            while (nSectors--) {
+                /*
+                 * We call seek with fWrite == true to prevent seek() from triggering another call
+                 * to readRemoteSectors() and endlessly recursing.  That also forces seek() to:
+                 *
+                 *  1) zero the sector's 'pattern'
+                 *  2) disable warning about reading an uninitialized sector
+                 *
+                 * We KNOW this is an uninitialized sector, because we're about to initialize it.
+                 */
+                var sector = this.seek(iCylinder, iHead, iSector, true);
+                if (!sector) {
+                    if (DEBUG && this.messageEnabled()) {
+                        this.printMessage("doneReadRemoteSectors(): seek(CHS=" + iCylinder + ':' + iHead + ':' + iSector + ") failed");
+                    }
+                    break;
+                }
+                this.fill(sector, abData, offData);
+                offData += sector['length'];
+                /*
+                 * We happen to know that when seek() calls readRemoteSectors(), it limits the number of sectors
+                 * to the current track, so the only variable we need to advance is iSector.
+                 */
+                iSector++;
+            }
+            fAsync = aRequest[4];
+        } else {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage("doneReadRemoteSectors(CHS=" + iCylinder + ':' + iHead + ':' + iSector + ",N=" + nSectors + ") returned error " + nErrorCode);
+            }
+        }
+        var done = aRequest[5];
+        if (done) done(nErrorCode, fAsync);
+    }
+
+    /**
+     * writeRemoteSectors(iCylinder, iHead, iSector, nSectors, abSectors, fAsync)
+     *
+     * Writes to a remote disk are performed on a timer-driven basis.  When a sector is modified for the first time,
+     * a reference to that sector is "pushed" onto (ie, appended to the end of) aDirtySectors, and if aDirtySectors was
+     * originally empty, then a REMOTE_WRITE_DELAY timer is set.
+     *
+     * When the timer fires, the first batch of contiguous sectors is sent off the server, and when the server responds
+     * (ie, when cleanDirtySectors() is called), if the response indicates success, every sector that was sent is marked
+     * clean -- unless one or more writes to the sector occurred in the meantime, which we track through a per-sector
+     * fDirty flag.
+     *
+     * @this {Disk}
+     * @param {number} iCylinder
+     * @param {number} iHead
+     * @param {number} iSector
+     * @param {number} nSectors (to write)
+     * @param {Array.<number>} abSectors
+     * @param {boolean} fAsync
+     * @return {boolean|Array}
+     */
+    writeRemoteSectors(iCylinder, iHead, iSector, nSectors, abSectors, fAsync)
+    {
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("writeRemoteSectors(CHS=" + iCylinder + ':' + iHead + ':' + iSector + ",N=" + nSectors + ")");
+        }
+
+        if (this.fRemote) {
+            var dataPost = {};
+            this.fWriteInProgress = true;
+            dataPost[DiskAPI.QUERY.ACTION] = DiskAPI.ACTION.WRITE;
+            dataPost[DiskAPI.QUERY.VOLUME] = this.sDiskPath;
+            dataPost[DiskAPI.QUERY.CHS] = this.nCylinders + ':' + this.nHeads + ':' + this.nSectors + ':' + this.cbSector;
+            dataPost[DiskAPI.QUERY.ADDR] = iCylinder + ':' + iHead + ':' + iSector + ':' + nSectors;
+            dataPost[DiskAPI.QUERY.MACHINE] = this.controller.getMachineID();
+            dataPost[DiskAPI.QUERY.USER] = this.controller.getUserID();
+            dataPost[DiskAPI.QUERY.DATA] = JSON.stringify(abSectors);
+            var disk = this;
+            var sDiskURL = Web.getHost() + DiskAPI.ENDPOINT;
+            Web.getResource(sDiskURL, dataPost, fAsync, function(sURL, sResponse, nErrorCode) {
+                disk.doneWriteRemoteSectors(sURL, sResponse, nErrorCode, [iCylinder, iHead, iSector, nSectors, fAsync]);
+            });
+        }
+        return false;
+    }
+
+    /**
+     * doneWriteRemoteSectors(sURLName, sURLData, nErrorCode, aRequest)
+     *
+     * @this {Disk}
+     * @param {string} sURLName
+     * @param {string} sURLData
+     * @param {number} nErrorCode
+     * @param {Array} aRequest ([iCylinder, iHead, iSector, nSectors, fAsync])
+     */
+    doneWriteRemoteSectors(sURLName, sURLData, nErrorCode, aRequest)
+    {
+        var iCylinder = aRequest[0];
+        var iHead = aRequest[1];
+        var iSector = aRequest[2];
+        var nSectors = aRequest[3];
+        var fAsync = aRequest[4];
+        this.fWriteInProgress = false;
+
+        if (iCylinder >= 0 && iCylinder < this.aDiskData.length && iHead >= 0 && iHead < this.aDiskData[iCylinder].length) {
+            for (var i = iSector - 1; nSectors-- > 0 && i >= 0 && i < this.aDiskData[iCylinder][iHead].length; i++) {
+                var sector = this.aDiskData[iCylinder][iHead][i];
+
+                if (!nErrorCode) {
+                    if (!sector.fDirty) {
+                        sector.iModify = sector.cModify = 0;
+                    }
+                } else {
+                    if (DEBUG && this.messageEnabled()) {
+                        this.printMessage("doneWriteRemoteSectors(CHS=" + iCylinder + ':' + iHead + ':' + sector['sector'] + ") returned error " + nErrorCode);
+                    }
+                    this.queueDirtySector(sector, false);
+                }
+            }
+        }
+        if (fAsync) this.updateWriteTimer();
+    }
+
+    /**
+     * disconnectRemoteDisk()
+     *
+     * This is called by our powerDown() notification handler.  If fRemote is true, we issue the disconnect
+     * request and then immediately set fRemote to false; we don't wait for (or test) the response.
+     *
+     * @this {Disk}
+     */
+    disconnectRemoteDisk()
+    {
+        if (this.fRemote) {
+            var sParms = DiskAPI.QUERY.ACTION + '=' + DiskAPI.ACTION.CLOSE;
+            sParms += '&' + DiskAPI.QUERY.VOLUME + '=' + this.sDiskPath;
+            sParms += '&' + DiskAPI.QUERY.MACHINE + '=' + this.controller.getMachineID();
+            sParms += '&' + DiskAPI.QUERY.USER + '=' + this.controller.getUserID();
+            var sDiskURL = Web.getHost() + DiskAPI.ENDPOINT + '?' + sParms;
+            Web.getResource(sDiskURL, null, true);
+            this.fRemote = false;
+        }
+    }
+
+    /**
+     * queueDirtySector(sector, fAsync)
+     *
+     * Mark the specified sector as dirty, add it to the queue (aDirtySectors) if not already added,
+     * and establish a timeout handler (findDirtySectors) if not already established.
+     *
+     * A freshly dirtied sector should sit in the queue for a short period of time (eg, 2 seconds)
+     * before we attempt to write it; that is, a REMOTE_WRITE_DELAY timer should start ticking again
+     * for any sector that is rewritten.  However, there will be exceptions; for example, when a sector
+     * is finally written, we want to take advantage of the write request to write any additional dirty
+     * sectors that follow it, even if those additional sectors were written less than 2 seconds ago.
+     *
+     * @this {Disk}
+     * @param {Object} sector
+     * @param {boolean} fAsync (true to update write timer, false to not)
+     * @return {boolean} true if write timer set, false if not
+     */
+    queueDirtySector(sector, fAsync)
+    {
+        sector.fDirty = true;
+
+        var j = this.aDirtySectors.indexOf(sector);
+        if (j >= 0) {
+            this.aDirtySectors.splice(j, 1);
+            this.aDirtyTimestamps.splice(j, 1);
+        }
+        this.aDirtySectors.push(sector);
+        this.aDirtyTimestamps.push(Usr.getTime());
+
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("queueDirtySector(CHS=" + sector.iCylinder + ':' + sector.iHead + ':' + sector['sector'] + "): " + this.aDirtySectors.length + " dirty");
+        }
+
+        return fAsync && this.updateWriteTimer();
+    }
+
+    /**
+     * updateWriteTimer()
+     *
+     * If a timer is already active, make sure it's still valid (ie, the time the timer is scheduled to fire is
+     * >= the timestamp of the next dirty sector + REMOTE_WRITE_DELAY); if not, cancel the timer and start a new one.
+     *
+     * @this {Disk}
+     * @return {boolean} true if write timer set, false if not
+     */
+    updateWriteTimer()
+    {
+        if (this.aDirtySectors.length) {
+            var msWrite = this.aDirtyTimestamps[0] + Disk.REMOTE_WRITE_DELAY;
+            if (this.timerWrite) {
+                if (this.msTimerWrite < msWrite) {
+                    clearTimeout(this.timerWrite);
+                    this.timerWrite = null;
+                }
+            }
+            if (!this.timerWrite) {
+                var obj = this;
+                var msNow = Usr.getTime();
+                var msDelay = msWrite - msNow;
+                if (msDelay < 0) msDelay = 0;
+                if (msDelay > Disk.REMOTE_WRITE_DELAY) msDelay = Disk.REMOTE_WRITE_DELAY;
+                this.timerWrite = setTimeout(function() {
+                    obj.findDirtySectors(true);
+                }, msDelay);
+                this.msTimerWrite = msNow + msDelay;
+            }
+        } else {
+            if (this.timerWrite) {
+                clearTimeout(this.timerWrite);
+                this.timerWrite = null;
+            }
+        }
+        return this.timerWrite !== null;
+    }
+
+    /**
+     * findDirtySectors(fAsync)
+     *
+     * Starting with the oldest dirty sector in the queue (aDirtySectors), determine the longest contiguous stretch of
+     * dirty sectors (currently limited to the same track), mark them all as not dirty, and then call writeRemoteSectors().
+     *
+     * @this {Disk}
+     * @param {boolean} fAsync is true if this function is being called asynchronously, false otherwise
+     * @return {boolean|Array} false if no dirty sectors, otherwise true (or a response array if not fAsync)
+     */
+    findDirtySectors(fAsync)
+    {
+        if (fAsync) {
+            this.timerWrite = null;
+        }
+        var sector = this.aDirtySectors[0];
+        if (sector) {
+            var iCylinder = sector.iCylinder;
+            var iHead = sector.iHead;
+            var iSector = sector['sector'];
+            var nSectors = 0;
+            var abSectors = [];
+            for (var i = iSector - 1; i < this.aDiskData[iCylinder][iHead].length; i++) {
+                var sectorNext = this.aDiskData[iCylinder][iHead][i];
+                if (!sectorNext.fDirty) break;
+                var j = this.aDirtySectors.indexOf(sectorNext);
+
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage("findDirtySectors(CHS=" + iCylinder + ':' + iHead + ':' + sectorNext['sector'] + ")");
+                }
+                this.aDirtySectors.splice(j, 1);
+                this.aDirtyTimestamps.splice(j, 1);
+                abSectors = abSectors.concat(this.toBytes(sectorNext));
+                sectorNext.fDirty = false;
+                nSectors++;
+            }
+
+            var response = this.writeRemoteSectors(iCylinder, iHead, iSector, nSectors, abSectors, fAsync);
+            return fAsync || response;
+        }
+        return false;
+    }
+
+    /**
+     * info()
+     *
+     * @this {Disk}
+     * @return {Array} containing: [nCylinders, nHeads, nSectorsPerTrack, nBytesPerSector]
+     */
+    info()
+    {
+        if (!this.aDiskData.length) {
+            return [0, 0, 0, 0];
+        }
+        return [this.aDiskData.length, this.aDiskData[0].length, this.aDiskData[0][0].length, this.aDiskData[0][0][0]['length']];
+    }
+
+    /**
+     * seek(iCylinder, iHead, iSector, fWrite, done)
+     *
+     * TODO: There's some dodgy code in seek() that allows floppy images to be dynamically
+     * reconfigured with more heads and/or sectors/track, and it does so by peeking at more drive
+     * properties.  That code used to be in the FDC component, where it was perfectly reasonable
+     * to access those properties.  We need a cleaner interface back to the drive, similar to the
+     * info() interface we provide to the controller.
+     *
+     * Whether or not the "dynamic reconfiguration" feature itself is perfectly reasonable is,
+     * of course, a separate question.
+     *
+     * @this {Disk}
+     * @param {number} iCylinder
+     * @param {number} iHead
+     * @param {number} iSector
+     * @param {boolean} [fWrite]
+     * @param {function(Object,boolean)} [done]
+     * @return {Object|null} is the requested sector, or null if not found (or not available yet)
+     */
+    seek(iCylinder, iHead, iSector, fWrite, done)
+    {
+        var sector = null;
+        var drive = this.drive;
+        var cylinder = this.aDiskData[iCylinder];
+        if (cylinder) {
+            var i;
+            var track = cylinder[iHead];
+            /*
+             * The following code allows a single-sided diskette image to be reformatted (ie, "expanded")
+             * as a double-sided image, provided the drive has more than one head (see drive.nHeads).
+             */
+            if (!track && drive.bFormatting && iHead < drive.nHeads) {
+                track = cylinder[iHead] = new Array(drive.bSectorEnd);
+                for (i = 0; i < track.length; i++) {
+                    track[i] = this.initSector(null, iCylinder, iHead, i + 1, drive.nBytes, 0);
+                }
+            }
+            if (track) {
+                for (i = 0; i < track.length; i++) {
+                    if (track[i] && track[i]['sector'] == iSector) {
+                        /*
+                         * If the sector's pattern is null, then this sector's true contents have not yet
+                         * been fetched from the server.
+                         */
+                        sector = track[i];
+                        if (sector['pattern'] === null) {
+                            if (fWrite) {
+                                /*
+                                 * Optimization: if the caller has explicitly told us that they're about to WRITE to the
+                                 * sector, then we shouldn't need to read it from the server; assume a zero pattern and return.
+                                 */
+                                sector['pattern'] = 0;
+                            } else {
+                                var nSectors = 1;
+                                /*
+                                 * We know we need to read at least 1 sector, but let's count the number of trailing sectors
+                                 * on the same track that may also be required.
+                                 */
+                                while (++i < track.length) {
+                                    if (track[i]['pattern'] === null) nSectors++;
+                                }
+                                this.readRemoteSectors(iCylinder, iHead, iSector, nSectors, done != null, function onReadRemoteComplete(err, fAsync) {
+                                    if (err) sector = null;
+                                    if (done) { //noinspection JSReferencingMutableVariableFromClosure
+                                        done(sector, fAsync);
+                                    }
+                                });
+                                return done? null : sector;
+                            }
+                        }
+                        break;
+                    }
+                }
+                /*
+                 * The following code allows an 8-sector track to be reformatted (ie, "expanded") as a 9-sector track.
+                 */
+                if (!sector && drive.bFormatting && drive.bSector == 9) {
+                    sector = track[i] = this.initSector(null, iCylinder, iHead, drive.bSector, drive.nBytes, 0);
+                }
+            }
+        }
+        if (done) done(sector, false);
+        return sector;
+    }
+
+    /**
+     * fill(sector, ab, off)
+     *
+     * @this {Disk}
+     * @param {Object} sector
+     * @param {*} ab (technically, this should be typed as Array.<number> but I'm having trouble coercing JSON.parse() to that)
+     * @param {number} off
+     */
+    fill(sector, ab, off)
+    {
+        var cdw = sector['length'] >> 2;
+        var adw = new Array(cdw);
+        for (var idw = 0; idw < cdw; idw++) {
+            adw[idw] = ab[off] | (ab[off + 1] << 8) | (ab[off + 2] << 16) | (ab[off + 3] << 24);
+            off += 4;
+        }
+        sector['data'] = adw;
+        /*
+         * TODO: Consider taking this opportunity to shrink 'data' down by the number of dwords at the end of the buffer that
+         * contain the same pattern, and setting 'pattern' accordingly.
+         */
+    }
+
+    /**
+     * toBytes(sector)
+     *
+     * @this {Disk}
+     * @param {Object} sector
+     * @return {Array.<number>} is an array of bytes
+     */
+    toBytes(sector)
+    {
+        var cb = sector['length'];
+        var ab = new Array(cb);
+        var ib = 0;
+        var cdw = cb >> 2;
+        var adw = sector['data'];
+        var dwPattern = sector['pattern'];
+        for (var idw = 0; idw < cdw; idw++) {
+            var dw = (idw < adw.length? adw[idw] : dwPattern);
+            ab[ib++] = dw & 0xff;
+            ab[ib++] = (dw >> 8) & 0xff;
+            ab[ib++] = (dw >> 16) & 0xff;
+            ab[ib++] = (dw >> 24) & 0xff;
+        }
+        return ab;
+    }
+
+    /**
+     * read(sector, ibSector, fCompare)
+     *
+     * @this {Disk}
+     * @param {Object} sector (returned from a previous seek)
+     * @param {number} ibSector a byte index within the given sector
+     * @param {boolean} [fCompare] is true if this write-compare read
+     * @return {number} the specified (unsigned) byte, or -1 if no more data in the sector
+     */
+    read(sector, ibSector, fCompare)
+    {
+        var b = -1;
+        if (sector) {
+            if (DEBUG && !ibSector && !fCompare && this.messageEnabled()) {
+                this.printMessage('read("' + this.sDiskFile + '",CHS=' + sector.iCylinder + ':' + sector.iHead + ':' + sector['sector'] + ')');
+            }
+            if (ibSector < sector['length']) {
+                var adw = sector['data'];
+                var idw = ibSector >> 2;
+                var dw = (idw < adw.length ? adw[idw] : sector['pattern']);
+                b = ((dw >> ((ibSector & 0x3) << 3)) & 0xff);
+            }
+        }
+        return b;
+    }
+
+    /**
+     * write(sector, ibSector, b)
+     *
+     * @this {Disk}
+     * @param {Object} sector (returned from a previous seek)
+     * @param {number} ibSector a byte index within the given sector
+     * @param {number} b the byte value to write
+     * @return {boolean|null} true if write successful, false if write-protected, null if out of bounds
+     */
+    write(sector, ibSector, b)
+    {
+        if (this.fWriteProtected)
+            return false;
+
+        if (DEBUG && !ibSector && this.messageEnabled()) {
+            this.printMessage('write("' + this.sDiskFile + '",CHS=' + sector.iCylinder + ':' + sector.iHead + ':' + sector['sector'] + ')');
+        }
+
+        if (ibSector < sector['length']) {
+            if (b != this.read(sector, ibSector, true)) {
+                var adw = sector['data'];
+                var dwPattern = sector['pattern'];
+                var idw = ibSector >> 2;
+                var nShift = (ibSector & 0x3) << 3;
+
+                /*
+                 * Ensure every byte up to the specified byte is properly initialized.
+                 */
+                for (var i = adw.length; i <= idw; i++) adw[i] = dwPattern;
+
+                if (!sector.cModify) {
+                    sector.iModify = idw;
+                    sector.cModify = 1;
+                } else if (idw < sector.iModify) {
+                    sector.cModify += sector.iModify - idw;
+                    sector.iModify = idw;
+                } else if (idw >= sector.iModify + sector.cModify) {
+                    sector.cModify += idw - (sector.iModify + sector.cModify) + 1;
+                }
+                adw[idw] = (adw[idw] & ~(0xff << nShift)) | (b << nShift);
+
+                if (this.fRemote) this.queueDirtySector(sector, true);
+            }
+            return true;
+        }
+        return null;
+    }
+
+    /**
+     * encodeAsBase64()
+     *
+     * @this {Disk}
+     * @return {string}
+     */
+    encodeAsBase64()
+    {
+        /*
+         * Gross, but simple; more importantly, it works -- at least for disks of typical floppy magnitude.
+         */
+        var s = "", pba = 0, sector;
+        while ((sector = this.getSector(pba++))) {
+            for (var off = 0, len = sector['length']; off < len; off++) {
+                s += String.fromCharCode(this.getSectorData(sector, off, 1));
+            }
+        }
+        return btoa(s);
+    }
+
+    /**
+     * save()
+     *
+     * The first array entry contains some disk information:
+     *
+     *      [sDiskPath, dwChecksum, nCylinders, nHeads, nSectors, cbSector]
+     *
+     * Each subsequent entry in the returned array contains the following:
+     *
+     *      [iCylinder, iHead, iSector, iModify, [...]]
+     *
+     * where [...] is an array of modified dword(s) in the corresponding sector.
+     *
+     * @this {Disk}
+     * @return {Array} of modified sectors
+     */
+    save()
+    {
+        var i = 0;
+        var deltas = [];
+        deltas[i++] = [this.sDiskPath, this.dwChecksum, this.nCylinders, this.nHeads, this.nSectors, this.cbSector];
+        if (!this.fRemote && !this.fWriteProtected) {
+            var aDiskData = this.aDiskData;
+            for (var iCylinder = 0; iCylinder < aDiskData.length; iCylinder++) {
+                for (var iHead = 0; iHead < aDiskData[iCylinder].length; iHead++) {
+                    for (var iSector = 0; iSector < aDiskData[iCylinder][iHead].length; iSector++) {
+                        var sector = aDiskData[iCylinder][iHead][iSector];
+                        if (sector && sector.cModify) {
+                            var mods = [], n = 0;
+                            var iModify = sector.iModify, iModifyLimit = sector.iModify + sector.cModify;
+                            while (iModify < iModifyLimit) {
+                                mods[n++] = sector['data'][iModify++];
+                            }
+                            deltas[i++] = [iCylinder, iHead, iSector, sector.iModify, mods];
+                        }
+                    }
+                }
+            }
+        }
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage('save("' + this.sDiskName + '"): saved ' + (deltas.length - 1) + ' change(s)');
+        }
+        return deltas;
+    }
+
+    /**
+     * restore(deltas)
+     *
+     * The first array entry contains some disk information:
+     *
+     *      [sDiskPath, dwChecksum, nCylinders, nHeads, nSectors, cbSector]
+     *
+     * Each subsequent entry in the supplied array contains the following:
+     *
+     *      [iCylinder, iHead, iSector, iModify, [...]]
+     *
+     * where [...] is an array of modified dword(s) in the corresponding sector.
+     *
+     * @this {Disk}
+     * @param {Array} deltas
+     * @return {number} 0 if no changes applied, -1 if an error occurred, otherwise the number of sectors modified
+     */
+    restore(deltas)
+    {
+        /*
+         * If deltas is undefined, that's not necessarily an error;  the controller may simply be (re)initializing
+         * itself (although neither controller should be calling restore() under those conditions anymore).
+         */
+        var nChanges = 0;
+        var sReason = "unsupported restore format";
+        /*
+         * I originally added a check for aDiskData here on the assumption that if there was an error loading
+         * a disk image, we will have already notified the user, so any additional errors about differing checksums,
+         * failure to restore the disk state, etc, would just be annoying.  HOWEVER, HDC will create an empty disk
+         * image if its initialization code discovers that no disk was loaded earlier (see verifyDrive).  So while
+         * checking aDiskData is still a good idea, be aware that it won't necessarily avoid redundant error messages
+         * (at least in the case of HDC).
+         */
+        if (deltas && deltas.length > 0) {
+
+            var i = 0;
+            var aDiskInfo = deltas[i++];
+
+            if (aDiskInfo && aDiskInfo.length >= 2) {
+                /*
+                 * Before getting to the checksum, we have to deal with a new situation: restoring an uninitialized
+                 * disk image from a complete set of deltas.  And that is only possible if the disk was saved with the
+                 * original disk geometry.
+                 */
+                if (!this.aDiskData.length && aDiskInfo.length >= 6) {
+                    this.create(DiskAPI.MODE.LOCAL, aDiskInfo[2], aDiskInfo[3], aDiskInfo[4], aDiskInfo[5]);
+                    /*
+                     * TODO: Consider setting a flag here that we can check at the end of the restore() function
+                     * that indicates we should recalculate dwChecksum, because we currently have an inconsistency
+                     * between local disks that are mounted via build() and the same disks that are "remounted"
+                     * later by this code; the former has the correct checksum, while the latter has a null checksum.
+                     *
+                     * As you can see below, we currently deal with this by simply ignoring null checksums....
+                     */
+                }
+                /*
+                 * v1.01 failed to indicate an error if either one of these failure conditions occurred.  Although maybe
+                 * that's just as well, since v1.01 also failed to properly deal with situations where the user mounted
+                 * different diskette(s) prior to exiting (hopefully fixed in v1.02).
+                 *
+                 * UPDATE: We also check aDiskInfo[0] first, because if it's null, then presumably there was no previous
+                 * disk, and I'd like the addition of a disk to a machine to not be fatal to the restoration process.
+                 */
+                else if (aDiskInfo[0] != null) {
+                    if (aDiskInfo[1] != null && this.dwChecksum != null && aDiskInfo[1] != this.dwChecksum) {
+                        sReason = "original checksum (" + aDiskInfo[1] + ") differs from current checksum (" + this.dwChecksum + ")";
+                        nChanges = -2;
+                    }
+                    /*
+                     * Checksum is more important than disk path, and for now, I want the flexibility to move disk images.
+                     *
+                     *  else if (aDiskInfo[0] != this.sDiskPath) {
+                     *      sReason = "original path '" + aDiskInfo[0] + "' differs from current path '" + this.sDiskPath + "'";
+                     *      nChanges = -1;
+                     *  }
+                     */
+                }
+            }
+
+            if (!this.aDiskData.length) nChanges = -1;
+
+            while (i < deltas.length && nChanges >= 0) {
+                var m = 0;
+                var mod = deltas[i++];
+                var iCylinder = mod[m++];
+                var iHead = mod[m++];
+                var iSector = mod[m++];
+                /*
+                 * Note the buried test for write-protection.  Yes, an invariant condition should be tested
+                 * outside the loop, not inside, but (a) it's a trivial test, (b) the test should never fail
+                 * because save() should never generate any mods for a write-protected disk, and (c) it
+                 * centralizes all the failure conditions we're currently checking (which, admittedly, ain't much).
+                 */
+                if (iCylinder >= this.aDiskData.length || iHead >= this.aDiskData[iCylinder].length || iSector >= this.aDiskData[iCylinder][iHead].length) {
+                    sReason = "sector (CHS=" + iCylinder + ':' + iHead + ':' + iSector + ") out of range (" + nChanges + " changes applied)";
+                    nChanges = -1;
+                    break;
+                }
+                if (this.fWriteProtected) {
+                    sReason = "unable to modify write-protected disk";
+                    nChanges = -1;
+                    break;
+                }
+                var iModify = mod[m++];
+                var mods = mod[m++];
+                var iModifyLimit = iModify + mods.length;
+                var sector = this.aDiskData[iCylinder][iHead][iSector];
+                if (!sector) continue;
+                /*
+                 * Since write() now deals with empty/partial sectors, we no longer need to completely "inflate"
+                 * the sector prior to applying modifications.  So let's just make sure that the sector is "inflated"
+                 * up to iModify.
+                 */
+                var idw = sector['data'].length;
+                while (idw < iModify) {
+                    sector['data'][idw++] = sector['pattern'];
+                }
+                var n = 0;
+                sector.iModify = iModify;
+                sector.cModify = mods.length;
+                while (iModify < iModifyLimit) {
+                    sector['data'][iModify++] = mods[n++];
+                }
+                nChanges++;
+            }
+        }
+
+        if (nChanges < 0) {
+            /*
+             * We're suppressing checksum messages for the general public for now....
+             */
+            if (DEBUG || nChanges != -2) {
+                this.notice("Unable to restore disk '" + this.sDiskName + ": " + sReason);
+            }
+        } else {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage('restore("' + this.sDiskName + '"): restored ' + nChanges + ' change(s)');
+            }
+            /*
+             * Last but not least, rebuild the disk's file table if BACKTRACK or SYMBOLS support is enabled.
+             */
+            if (BACKTRACK || SYMBOLS) this.buildFileTable();
+        }
+        return nChanges;
+    }
+
+    /**
+     * toJSON()
+     *
+     * We perform some RegExp massaging on the JSON data to eliminate unnecessary properties
+     * (eg, 'length' values of 512, 'pattern' values of 0, since those are defaults).
+     *
+     * In addition, we first check every sector to see if it can be "deflated".  Sectors that were
+     * initially "deflated" should remain that way unless/until they were modified, so technically,
+     * we could call deflateSector() just for modified sectors, but this isn't a common operation,
+     * so it doesn't hurt to check every sector.
+     *
+     * @this {Disk}
+     * @return {string} containing the entire disk image as JSON-encoded data
+     */
+    toJSON()
+    {
+        var s, pba = 0, sector, sectorLast;
+
+        while ((sector = this.getSector(pba++))) {
+            this.deflateSector(sector);
+        }
+
+        s = JSON.stringify(this.aDiskData, function(key, value) {
+            /*
+             * If BACKTRACK support is enabled, we have to filter out any 'file' properties that may
+             * be attached to the sector objects, lest we risk blowing the stack due to circular references.
+             */
+            if (key == 'file') {
+                return undefined;
+            }
+            return value;
+        });
+
+        /*
+         * Eliminate unnecessary default properties (eg, 'length' values of 512, 'pattern' values of 0).
+         */
+        s = s.replace(/,"length":512/gm, "").replace(/,"pattern":0/gm, "");
+
+        /*
+         * I don't really want to strip quotes from disk image property names, since I would have to put them
+         * back again during mount() -- or whenever JSON.parse() is used instead of eval().  But I still remove
+         * them temporarily, so that any remaining property names (eg, "iModify", "cModify", "fDirty") can
+         * easily be stripped out, by virtue of their being the only quoted properties left.  We then "requote"
+         * all the property names that remain.
+         */
+        s = s.replace(/"(sector|length|data|pattern)":/gm, "$1:");
+
+        /*
+         * The next line will remove any other numeric or boolean properties that were added at runtime, although
+         * they may have completely different ("minified") names if the code has been compiled.
+         */
+        s = s.replace(/,"[^"]*":([0-9]+|true|false)/gm, "");
+        s = s.replace(/(sector|length|data|pattern):/gm, "\"$1\":");
+
+        /*
+         * Last but not least, insert line breaks after every object definition, to ease the pain on text editors.
+         */
+        s = s.replace(/([\]}]),/gm, "$1,\n");
+        return s;
+    }
+
+    /**
+     * deflateSector(sector)
+     *
+     * This is just the first revision: it currently looks only at fully inflated sectors.
+     *
+     * @this {Disk}
+     * @param {Object} sector
+     */
+    deflateSector(sector)
+    {
+        var adw = sector['data'];
+        var cdw = adw.length;
+        if ((cdw << 2) == sector['length']) {
+            var idw = cdw - 1;
+            var dwPattern = adw[idw], cDupes = 0;
+            while (idw--) {
+                if (adw[idw] !== dwPattern) break;
+                cDupes++;
+            }
+            if (cDupes++) {
+                adw.length = cdw - cDupes;
+                sector['pattern'] = dwPattern;
+            }
+        }
+    }
+
+    /**
+     * dumpSector(sector, pba, sDesc)
+     *
+     * @this {Disk}
+     * @param {Object} sector (returned from a previous seek)
+     * @param {number} [pba]
+     * @param {string} [sDesc]
+     * @return {string}
+     */
+    dumpSector(sector, pba, sDesc)
+    {
+        var sDump = "";
+        if (DEBUG && sector) {
+            if (pba != null) sDump += "sector " + pba + (sDesc? (" for " + sDesc) : "") + ':';
+            var sBytes = "", sChars = "";
+            var cbSector = sector['length'];
+            var cdwData = sector['data'].length;
+            var dw = 0;
+            for (var i = 0; i < cbSector; i++) {
+                if ((i % 16) === 0) {
+                    if (sDump) sDump += sBytes + ' ' + sChars + '\n';
+                    sDump += Str.toHex(i, 4) + ": ";
+                    sBytes = sChars = "";
+                }
+                if ((i % 4) === 0) {
+                    var idw = i >> 2;
+                    dw = (idw < cdwData? sector['data'][idw] : sector['pattern']);
+                }
+                var b = dw & 0xff;
+                dw >>>= 8;
+                sBytes += Str.toHex(b, 2) + (i % 16 == 7? "-" : " ");
+                sChars += (b >= 32 && b < 128? String.fromCharCode(b) : ".");
+            }
+            if (sBytes) sDump += sBytes + ' ' + sChars;
+        }
+        return sDump;
+    }
+}
+
+/**
+ * The default number of milliseconds to wait before writing a dirty sector back to a remote disk image
+ *
+ * @const {number}
+ */
+Disk.REMOTE_WRITE_DELAY = 2000;         // 2-second delay
+
+/*
+ * A global disk count, used to form unique Disk component IDs (totally optional; for debugging purposes only)
+ */
+Disk.nDisks = 0;
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class FileInfo {
+    /**
+     * FileInfo(disk, sPath, sName, bAttr, cbSize, apba)
+     *
+     * To the basic file information below, loadSymbols() may also add:
+     *
+     *      sModule
+     *      sDescription
+     *      aSegments[]
+     *
+     * which is indexed by 1-based segment numbers, where each aSegments[] element is an object
+     * containing:
+     *
+     *      offStart (file-relative offset of start of segment data)
+     *      offEnd (file-relative offset of end of segment data)
+     *      aEntries[]
+     *
+     * where aEntries is an array indexed by 1-based ordinals, where each aEntries[] element contains:
+     *
+     *      [offset, symbol]
+     *
+     * where offset is relative to the segment's offStart value, and symbol is a string describing the
+     * entry.
+     *
+     * NOTE: Although aEntries arrays are similar to the Debugger's aOffsets arrays, they are not
+     * interchangeable data structures, because ours is ordered by ordinal, whereas aOffsets is
+     * ordered by offset.  We provide an interface, getModuleInfo(), to the Debugger that converts
+     * our data into an intermediate array, aSymbols, which the Debugger then uses to build aOffsets.
+     * It would be nice to avoid building that intermediate representation, but it's a side-effect of
+     * the Debugger's earlier support for JSON-encoded MAP files.
+     *
+     * There will always be an offset at index 0 of an aEntries[] element, but some error or incomplete
+     * symbolic information could result in a missing symbol at index 1, because symbol name processing is
+     * separate from entry table processing.
+     *
+     * @param {Disk} disk
+     * @param {string} sPath
+     * @param {string} sName
+     * @param {number} bAttr
+     * @param {number} cbSize
+     * @param {Array.<number>} apba
+     */
+    constructor(disk, sPath, sName, bAttr, cbSize, apba)
+    {
+        this.disk = disk;
+        this.sPath = sPath;
+        this.sName = sName;
+        this.bAttr = bAttr;
+        this.cbSize = cbSize;
+        this.apba = apba;
+    }
+
+    /**
+     * loadValue(offset, length)
+     *
+     * @this {FileInfo}
+     * @param {number} offset
+     * @param {number} [length] (1, 2 or 4 bytes; default is 2)
+     * @return {number|undefined}
+     */
+    loadValue(offset, length)
+    {
+        var l;
+        length = length || 2;
+        var iSector = offset >> 9;
+        var offSector = offset & 0x1ff;
+        var sector = this.disk.getSector(this.apba[iSector]);
+        if (sector) {
+            /*
+             * If the read is wholly contained within a sector, read it with one call.
+             */
+            if (offSector + length <= sector['length']) {
+                return this.disk.getSectorData(sector, offSector, length);
+            }
+            /*
+             * The spans a sector boundary, so we just call ourselves one byte at a time.
+             */
+            l = 0;
+            var shift = 0;
+            while (length--) {
+                l |= this.loadValue(offset++, 1) << shift;
+                shift += 8;
+            }
+        }
+        return l;
+    }
+
+    /**
+     * loadString(offset, length)
+     *
+     * @this {FileInfo}
+     * @param {number} offset
+     * @param {number} [length] (if omitted, then string must be zero-terminated)
+     * @return {string}
+     */
+    loadString(offset, length)
+    {
+        var s = "";
+        if (!length) length = -1;
+        while (length--) {
+            var b = this.loadValue(offset++, 1);
+            if (!b) break;
+            s += String.fromCharCode(b);
+        }
+        return s;
+    }
+
+    /**
+     * loadField(aField, offset)
+     *
+     * @this {FileInfo}
+     * @param {Array.<number>} aField
+     * @param {number} [offset] (0 if not specified)
+     * @return {number|undefined}
+     */
+    loadField(aField, offset)
+    {
+        return this.loadValue(aField[0] + (offset || 0), aField[1]);
+    }
+
+    /**
+     * loadSegmentTable(offEntries, nEntries, nSegOffShift)
+     *
+     * @this {FileInfo}
+     * @param {number} offEntries
+     * @param {number} nEntries
+     * @param {number} nSegOffShift
+     */
+    loadSegmentTable(offEntries, nEntries, nSegOffShift)
+    {
+        /*
+         * Read the Segment Table entries now.
+         */
+        var iSegment = 1;
+        this.aSegments = [];
+        this.aOrdinals = [];                // this is an optional array for quick ordinal-to-segment lookup
+
+        if (DEBUG && this.disk.messageEnabled(Messages.DISK | Messages.DATA)) {
+            this.disk.printMessage("loadSegmentTable(" + this.sPath + "," + Str.toHexLong(offEntries) + "," + Str.toHexWord(nEntries) + ")");
+        }
+
+        while (nEntries--) {
+            var offSegment = this.loadValue(offEntries) << nSegOffShift;
+            if (offSegment) {
+                var lenSegment = this.loadValue(offEntries + 2) || 0x10000;       // 0 means 64K
+
+                if (DEBUG && this.disk.messageEnabled(Messages.DISK | Messages.DATA)) {
+                    this.disk.printMessage("segment " + iSegment + ": offStart=" + Str.toHexLong(offSegment) + " offEnd=" + Str.toHexLong(offSegment + lenSegment));
+                }
+
+                this.aSegments[iSegment++] = {offStart: offSegment, offEnd: offSegment + lenSegment - 1, aEntries: []};
+            }
+            offEntries += 8;
+        }
+        /*
+         * Although not documented (at least not in any of the early Windows "New Executable" documents I've seen),
+         * the Entry Table may also contain entries whose bSegment field is 0xFE, which doesn't correspond to a valid
+         * segment number.  That pseudo-segment number appears to be reserved for constants.  Here are some examples
+         * from a 3.1-vintage KRNL386.EXE:
+         *
+         *      cannot find segment 254 (offset 0xF000) for symbol __ROMBIOS with ordinal 173
+         *      cannot find segment 254 (offset 0x0000) for symbol __0000H with ordinal 183
+         *      cannot find segment 254 (offset 0x0040) for symbol __0040H with ordinal 193
+         *      cannot find segment 254 (offset 0x0008) for symbol __AHINCR with ordinal 114
+         *      cannot find segment 254 (offset 0x0003) for symbol __AHSHIFT with ordinal 113
+         *      cannot find segment 254 (offset 0xA000) for symbol __A000H with ordinal 174
+         *      cannot find segment 254 (offset 0xB000) for symbol __B000H with ordinal 181
+         *      cannot find segment 254 (offset 0xC000) for symbol __C000H with ordinal 195
+         *      cannot find segment 254 (offset 0xB800) for symbol __B800H with ordinal 182
+         *      cannot find segment 254 (offset 0xD000) for symbol __D000H with ordinal 179
+         *      cannot find segment 254 (offset 0xE000) for symbol __E000H with ordinal 190
+         *      cannot find segment 254 (offset 0xF000) for symbol __F000H with ordinal 194
+         *      cannot find segment 254 (offset 0x0001) for symbol __WINFLAGS with ordinal 178
+         *
+         * The simplest way to handle those Entry Table entries is creating an additional (fake) aSegments table entry.
+         */
+        this.aSegments[0xFE] = {offStart: 0, offEnd: 0, aEntries: []};
+    }
+
+    /**
+     * loadEntryTable(offEntries, offEntriesEnd)
+     *
+     * @this {FileInfo}
+     * @param {number} offEntries
+     * @param {number} offEntriesEnd
+     */
+    loadEntryTable(offEntries, offEntriesEnd)
+    {
+        var iOrdinal = 1;
+
+        if (DEBUG && this.disk.messageEnabled(Messages.DISK | Messages.DATA)) {
+            this.disk.printMessage("loadEntryTable(" + Str.toHexLong(offEntries) + "," + Str.toHexLong(offEntriesEnd) + ")");
+        }
+
+        while (offEntries < offEntriesEnd) {
+
+            var w = this.loadValue(offEntries);
+            var bEntries = w & 0xff;
+            if (!bEntries) break;
+            var bSegment = w >> 8, iSegment;
+
+            if (DEBUG && this.disk.messageEnabled(Messages.DISK | Messages.DATA)) {
+                this.disk.printMessage("bundle for segment " + bSegment + ": " + bEntries + " entries @" + Str.toHex(offEntries));
+            }
+
+            offEntries += 2;
+
+            /*
+             * bSegment 0x00 means all the entries spanned by bEntries are unused, so move on.
+             */
+            if (!bSegment) {
+                iOrdinal += bEntries;
+                continue;
+            }
+            while (bEntries--) {
+                /*
+                 * bSegment 0x01-0xFE means the next 3 bytes describe a fixed segment entry; the next
+                 * byte contains flags indicating exported (0x1) and/or global/shared (0x2) data, and the
+                 * next word is the offset within the segment.
+                 */
+                var offEntry;
+                var offDebug = offEntries;
+                var bFlags = this.loadValue(offEntries, 1);
+
+                if (bSegment <= 0xFE) {
+                    iSegment = bSegment;
+                    offEntry = this.loadValue(offEntries + 1);
+                    offEntries += 3;
+                } else {
+                    /*
+                     * bSegment 0xFF means a movable segment entry, which is 6 bytes long: flags byte (which
+                     * we've already read), an INT 0x3F (0xCD,0x3F), a 1-byte segment number, and a 2-byte offset.
+                     */
+                    iSegment = this.loadValue(offEntries + 3, 1);
+                    offEntry = this.loadValue(offEntries + 4);
+                    offEntries += 6;
+                }
+                if (!this.aSegments[iSegment]) {
+                    if (DEBUG && this.disk.messageEnabled(Messages.DISK | Messages.DATA)) {
+                        this.disk.printMessage("invalid segment: " + iSegment);
+                    }
+                } else {
+                    this.aSegments[iSegment].aEntries[iOrdinal] = [offEntry];
+                    if (DEBUG && this.disk.messageEnabled(Messages.DISK | Messages.DATA)) {
+                        this.disk.printMessage("ordinal " + iOrdinal + ": segment=" + iSegment + " offset=" + Str.toHexLong(offEntry) + " @" + Str.toHex(offDebug));
+                    }
+                }
+                this.aOrdinals[iOrdinal] = [iSegment, offEntry];
+                iOrdinal++;
+            }
+        }
+    }
+
+    /**
+     * loadNameTable(aField, offset)
+     *
+     * NOTE: If offset is omitted, we assume we're reading the Resident Name Table, and therefore
+     * the first name is the module name; otherwise, we assume it is the Non-Resident Name Table, and
+     * that the first name is the module description.
+     *
+     * @this {FileInfo}
+     * @param {number} offEntries
+     * @param {number} [offEntriesEnd] (if omitted, then the table must be null-terminated)
+     */
+    loadNameTable(offEntries, offEntriesEnd)
+    {
+        var cNames = 0;
+
+        if (DEBUG && this.disk.messageEnabled(Messages.DISK | Messages.DATA)) {
+            this.disk.printMessage("loadNameTable(" + Str.toHexLong(offEntries) + (offEntriesEnd? ("," + Str.toHexLong(offEntriesEnd)) : "") + ")");
+        }
+
+        while (!offEntriesEnd || offEntries < offEntriesEnd) {
+
+            var offDebug = offEntries;
+            var bLength = this.loadValue(offEntries, 1);
+            if (!bLength) break;
+
+            var sSymbol = this.loadString(offEntries + 1, bLength);
+            if (!sSymbol) break;                    // an error must have occurred (this is not a natural way to end)
+            offEntries += 1 + bLength;
+
+            if (!cNames) {
+                if (!offEntriesEnd) {
+                    this.sModule = sSymbol;
+                } else {
+                    this.sDescription = sSymbol;
+                }
+            }
+            else {
+                var iOrdinal = this.loadValue(offEntries);
+                var tuple = this.aOrdinals[iOrdinal];
+                if (tuple) {
+                    var iSegment = tuple[0];        // tuple[0] is the segment number and tuple[1] is the corresponding offEntry
+                    if (this.aSegments[iSegment]) {
+                        var aEntries = this.aSegments[iSegment].aEntries[iOrdinal];
+
+                        aEntries.push(sSymbol);
+                        if (DEBUG && this.disk.messageEnabled(Messages.DISK | Messages.DATA)) {
+                            this.disk.printMessage("segment " + iSegment + " offset " + Str.toHexWord(aEntries[0]) + " ordinal " + iOrdinal + ": " + sSymbol + " @" + Str.toHex(offDebug));
+                        }
+                    } else {
+                        if (DEBUG && this.disk.messageEnabled(Messages.DISK | Messages.DATA)) {
+                            this.disk.printMessage(this.sPath + ": cannot find segment " + iSegment + " (offset " + Str.toHexWord(tuple[1]) + ") for symbol " + sSymbol + " with ordinal " + iOrdinal + " @" + Str.toHex(offDebug));
+                        }
+                    }
+                } else {
+                    if (DEBUG && this.disk.messageEnabled(Messages.DISK | Messages.DATA)) {
+                        this.disk.printMessage(this.sPath + ": cannot find ordinal " + iOrdinal + " for symbol " + sSymbol + " @" + Str.toHex(offDebug));
+                    }
+                }
+            }
+            offEntries += 2;
+            cNames++;
+        }
+    }
+
+    /**
+     * loadSymbols()
+     *
+     * For files with NE headers, extract all available symbolic information from the file.
+     *
+     * @this {FileInfo}
+     */
+    loadSymbols()
+    {
+        if (!Str.endsWith(this.sName, ".EXE") && !Str.endsWith(this.sName, ".DLL") && !Str.endsWith(this.sName, ".DRV")) {
+            return;
+        }
+
+        if (this.loadField(FileInfo.OE.oeSignature) != FileInfo.OE.SIG) {
+            return;
+        }
+
+        if (this.loadField(FileInfo.OE.oeRelocOffset) != FileInfo.OE.NE_SIG) {
+            return;
+        }
+
+        var offNEHeader = this.loadField(FileInfo.OE.oeNEHeader);
+        if (this.loadField(FileInfo.NE.neSignature, offNEHeader) != FileInfo.NE.SIG) {
+            return;
+        }
+
+        var nEntries = this.loadField(FileInfo.NE.neSTEntries, offNEHeader);
+        var offEntries = this.loadField(FileInfo.NE.neSTOffset, offNEHeader);
+        var nSegOffShift = this.loadField(FileInfo.NE.neSegOffShift, offNEHeader);
+
+        if (offEntries && nEntries) {
+            this.loadSegmentTable(offEntries + offNEHeader, nEntries, nSegOffShift || 0);
+        }
+
+        offEntries = this.loadField(FileInfo.NE.neETOffset, offNEHeader);
+        var cbEntries = this.loadField(FileInfo.NE.neETSize, offNEHeader);
+        if (offEntries && cbEntries) {
+            this.loadEntryTable(offEntries += offNEHeader, offEntries + cbEntries);
+        }
+
+        /*
+         * Time to walk the Resident Name Table and update the corresponding ordinals.
+         */
+        offEntries = this.loadField(FileInfo.NE.neRNTOffset, offNEHeader);
+        if (offEntries) {
+            this.loadNameTable(offEntries + offNEHeader);
+        }
+
+        /*
+         * Ditto for the Non-Resident Name Table, which for some reason, uses a file-relative offset rather than
+         * an NE header-relative offset, and which is both sized AND null-terminated; we check both terminating
+         * conditions to be safe.
+         */
+        offEntries = this.loadField(FileInfo.NE.neNRNTOffset, offNEHeader);
+        cbEntries = this.loadField(FileInfo.NE.neNRNTSize, offNEHeader);
+        if (offEntries && cbEntries) {
+            this.loadNameTable(offEntries, offEntries + cbEntries);
+        }
+    }
+
+    /**
+     * getSymbol(off, fNearest)
+     *
+     * @this {FileInfo}
+     * @param {number} off (offset relative to start of file)
+     * @param {boolean} [fNearest] (true to return nearest symbol if a segment with symbols is found)
+     * @return {string} symbol corresponding to file offset (of the file name + offset if no symbol found)
+     */
+    getSymbol(off, fNearest)
+    {
+        var sSymbol = null;
+        if (this.aSegments) {
+            for (var iSegment in this.aSegments) {
+                var segment = this.aSegments[iSegment];
+                if (off >= segment.offStart && off <= segment.offEnd) {
+                    /*
+                     * This is the one and only segment we need to check, so we can make off segment-relative now.
+                     */
+                    off -= segment.offStart;
+                    /*
+                     * To support fNearest, save the entry where (off - entry[0]) yields the smallest positive result.
+                     */
+                    var cbNearest = off, entryNearest;
+                    for (var iOrdinal in segment.aEntries) {
+                        var entry = segment.aEntries[iOrdinal];
+                        var cb = off - entry[0];
+                        if (!cb) {
+                            sSymbol = this.sModule + '!' + entry[1];
+                            break;
+                        }
+                        if (fNearest && cb > 0 && cb < cbNearest) {
+                            entryNearest = entry;
+                            cbNearest = cb;
+                        }
+                    }
+                    if (!sSymbol && entryNearest) {
+                        sSymbol = this.sModule + '!' + entryNearest[1] + "+" + Str.toHexWord(cbNearest);
+                    }
+                    break;
+                }
+            }
+        }
+        return sSymbol || this.sName + '+' + Str.toHexLong(off);
+    }
+}
+
+/*
+ * Original (aka "Old") Executable MS-DOS File Format
+ *
+ * Relocation entries are pairs of 16-bit words:
+ *
+ *      wOffset
+ *      wSegment
+ *
+ * I've noticed that a "PKLITE" EXE may have a oeRelocOffset of 0x52, where the word at 0x001C is 0x210F and the
+ * bytes from 0x001E through 0x0051 are:
+ *
+ *      "PKLITE Copr. 1990-92 PKWARE Inc. All Rights Reserved"
+ *
+ * Other EXEs have a oeRelocOffset of 0x1E, which begs the question: what is the word at 0x001C typically used for?
+ *
+ * It was not uncommon for there to be wasted space in the header; even an EXE with, say, 20 (0x14) entries would
+ * likely have a wHeaderParas value of 0x20, which is 512 (0x200) bytes.  The desire, no doubt, was to align the
+ * start of the EXE segment(s) to a traditional sector boundary.
+ */
+FileInfo.OE = {
+    SIG:            0x5A4D,
+    oeSignature:    [0x0000, 2],        // "MZ" (0x4D,0x5A)
+    oeLastBytes:    [0x0002, 2],        // 0-511 (0 means the entire last block is used)
+    oeBlocks:       [0x0004, 2],        // number of blocks in the file
+    oeRelocEntries: [0x0006, 2],        // number of relocation entries in the header
+    oeHeaderParas:  [0x0008, 2],        // number of (16-byte) paragraphs in the header
+    oeExtraParas:   [0x000A, 2],        // minimum number of additional paragraphs required at load-time
+    oeMaxParas:     [0x000C, 2],        // maximum number of additional paragraphs required at load-time
+    oeSSRel:        [0x000E, 2],        // relative value of SS
+    oeSPInit:       [0x0010, 2],        // initial value of SP
+    oeChecksum:     [0x0012, 2],        // checksum if non-zero (sum of all words, including this, should be zero)
+    oeIPInit:       [0x0014, 2],        // initial value of IP
+    oeCSRel:        [0x0016, 2],        // relative value of CS
+    oeRelocOffset:  [0x0018, 2],        // offset of first relocation item
+    oeOverlay:      [0x001A, 2],        // overlay number (normally zero, implying main program)
+    /*
+     * The following fields are accommodated by the NE format, but they were actually defined by "the DOS 4.0 group"
+     * as extensions to the OE format.
+     */
+    oeDOS40Bits:    [0x0020, 2],        // DOS 4.0 behavior bits
+    oeUnusedBits:   [0x0022, 2],        // unused behavior bits
+    /*
+     * If oeRelocOffset (0x0018) is 0x40, then the file is considered an NE (New Executable) MS-DOS file, and
+     * the offset of the NE header (from the start of the file) is a 32-bit value stored at 0x003C.  Note that early
+     * versions of Windows (aka "DOS 2.0 Windows") originally defined the NE header offset as a 16-bit value stored
+     * at 0x003E.  And before that, it may have been a 16-bit value stored at 0x0024, which would have been immediately
+     * after the "behavior bits" fields shown above).
+     */
+    oeNEHeader:     [0x003C, 4],        // offset from start of file to NE header
+    NE_SIG:         0x40
+};
+
+/*
+ * New Executable MS-DOS File Format
+ *
+ * Unless otherwise specified, all *Offset fields are relative to the start of the NE header, and all *Size fields
+ * are in bytes.
+ */
+FileInfo.NE = {
+    SIG:            0x454E,
+    neSignature:    [0x0000, 2],        // "NE" (0x4E,0x45)
+    neLinkerVer:    [0x0002, 2],        // (low byte is version, high byte is revision)
+    neETOffset:     [0x0004, 2],        // Entry Table offset
+    neETSize:       [0x0006, 2],        // Entry Table size
+    neChecksum:     [0x0008, 4],        // checksum (sum of all DWORDs in the file, excluding this one)
+    neFlags:        [0x000C, 2],
+    neDataSeg:      [0x000E, 2],
+    neHeapSize:     [0x0010, 2],
+    neStackSize:    [0x0012, 2],
+    neCSIP:         [0x0014, 4],
+    neSSSP:         [0x0018, 4],
+    neSTEntries:    [0x001C, 2],        // Segment Table entries
+    neMRTEntries:   [0x001E, 2],        // Module Reference Table entries
+    neNRNTSize:     [0x0020, 2],        // Non-Resident Name Table size
+    neSTOffset:     [0x0022, 2],        // Segment Table offset
+    neRTOffset:     [0x0024, 2],        // Resource Table offset
+    neRNTOffset:    [0x0026, 2],        // Resident Name Table offset
+    neMRTOffset:    [0x0028, 2],        // Module Reference Table offset
+    neINTOffset:    [0x002A, 2],        // Imported Names Table offset
+    neNRNTOffset:   [0x002C, 4],        // Non-Resident Name Table offset (relative to start of file)
+    neETMovable:    [0x0030, 2],        // number of movable entries in the Entry Table
+    neSegOffShift:  [0x0032, 2],        // logical sector alignment shift count, log(base 2) of the segment sector size (default 9)
+    /*
+     * Fields after this point are post "DOS 2.0 Windows"...
+     */
+    neRTEntries:    [0x0034, 2],        // Resource Table entries
+    neEXEType:      [0x0036, 1]         // executable type (0x02 for Windows)
+    /*
+     * 0x37 through 0x3F is reserved.
+     */
+};
+
+/**
+ * Every Sector object (once loaded, parsed, and "normalized") should have ALL of the following named properties:
+ *
+ *      'sector':   sector number
+ *      'length':   size of the sector, in bytes
+ *      'data':     array of dwords
+ *      'pattern':  dword pattern to use for empty or partial sectors (or null if sector still needs to be loaded)
+ *
+ * initSector() also sets the following properties, to help us quickly identify its location within aDiskData:
+ *
+ *      iCylinder
+ *      iHead
+ *
+ * In addition, we will maintain the following information on a per-sector basis, as sectors are modified:
+ *
+ *      iModify:    index of first modified dword in sector
+ *      cModify:    number of modified dwords in sector
+ *      fDirty:     true if sector is dirty, false if clean (or cleaning in progress)
+ *
+ * fDirty is used in conjunction with "demandrw" disks; it is set to true whenever the sector is modified, and is
+ * set to false whenever the sector has been sent to the server.  If the server write succeeds and fDirty is still
+ * false, then the sector modifications are removed (cModify is set to zero).  If the write succeeds but fDirty was
+ * set to true again in the meantime, then all the sector modifications (even those that were just written) remain
+ * in place (since we don't keep track of more than one modification range within a sector).  And if the write failed,
+ * then fDirty is set back to true and again all modifications remain in place; the best we can do is schedule another
+ * write attempt.
+ *
+ * TODO: Perhaps we should also maintain a failure count and stop trying to write sectors that reach a certain
+ * threshold.  Error-handling, as usual, is the thorniest problem.
+ *
+ * @typedef {{
+ *  sector:     number,
+ *  length:     number,
+ *  data:       Array.<number>,
+ *  pattern:    (number|null),
+ *  iCylinder:  number,
+ *  iHead:      number,
+ *  iModify:    number,
+ *  cModify:    number,
+ *  file:       FileInfo,
+ *  offFile:    number
+ * }}
+ */
+var SectorInfo;
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/fdc.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * FDC Terms (see FDC.TERMS)
+ *
+ *      C       Cylinder Number         the current or selected cylinder number
+ *
+ *      D       Data                    the data pattern to be written to a sector
+ *
+ *      DS      Drive Select            the selected driver number encoded the same as bits 0 and 1 of the Digital Output
+ *                                      Register (DOR); eg, DS0, DS1, DS2, or DS3
+ *
+ *      DTL     Data Length             when N is 00, DTL is the data length to be read from or written to a sector
+ *
+ *      EOT     End Of Track            the final sector number on a cylinder
+ *
+ *      GPL     Gap Length              the length of gap 3 (spacing between sectors excluding the VCO synchronous field)
+ *
+ *      H       Head Address            the head number, either 0 or 1, as specified in the ID field
+ *
+ *      HD      Head                    the selected head number, 0 or 1 (H = HD in all command words)
+ *
+ *      HLT     Head Load Time          the head load time in the selected drive (2 to 256 milliseconds in 2-millisecond
+ *                                      increments for the 1.2M-byte drive and 4 to 512 milliseconds in 4 millisecond increments
+ *                                      for the 320K-byte drive)
+ *
+ *      HUT     Head Unload Time        the head unload time after a read or write operation (0 to 240 milliseconds in
+ *                                      16-millisecond increments for the 1.2M-byte drive and 0 to 480 milliseconds in
+ *                                      32-millisecond increments for the 320K-byte drive)
+ *
+ *      MF      FM or MFM Mode          0 selects FM mode and 1 selects MFM (MFM is selected only if it is implemented)
+ *
+ *      MT      Multitrack              1 selects multitrack operation (both HD0 and HD1 will be read or written)
+ *
+ *      N       Number                  the number of data bytes written in a sector
+ *
+ *      NCN     New Cylinder Number     the new cylinder number for a SEEK operation
+ *
+ *      ND      Non-Data Mode           indicates an operation in the non-data mode
+ *
+ *      PCN     Present Cylinder Number the cylinder number at the completion of a SENSE INTERRUPT STATUS command
+ *                                      (present position of the head)
+ *
+ *      R       Record                  the sector number to be read or written
+ *
+ *      SC      Sectors Per Cylinder    the number of sectors per cylinder
+ *
+ *      SK      Skip                    this stands for skip deleted-data address mark
+ *
+ *      SRT     Stepping Rate           this 4 bit byte indicates the stepping rate for the diskette drive as follows:
+ *                                      1.2M-Byte Diskette Drive: 1111=1ms, 1110=2ms, 1101=3ms
+ *                                      320K-Byte Diskette Drive: 1111=2ms, 1110=4ms, 1101=6ms
+ *
+ *      STP     STP Scan Test           if STP is 1, the data in contiguous sectors is compared with the data sent
+ *                                      by the processor during a scan operation; if STP is 2, then alternate sections
+ *                                      are read and compared
+ */
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class FDC extends Component {
+    /**
+     * FDC(parmsFDC)
+     *
+     * The FDC component simulates a NEC µPD765A or Intel 8272A compatible floppy disk controller, and has one
+     * component-specific property:
+     *
+     *      autoMount: one or more JSON-encoded objects, each containing 'name' and 'path' properties
+     *
+     *      sortBy: "name" to sort disks by name, "path" to sort by path, or "none" to leave as-is (default is "name")
+     *
+     * Regarding early diskette drives: the IBM PC Model 5150 originally shipped with single-sided drives,
+     * and therefore supported only 160Kb diskettes.  That's the only diskette format PC-DOS 1.00 supported, too.
+     *
+     * At some point, 5150's started shipping with double-sided drives, but I'm not sure whether the ROMs changed;
+     * they probably did NOT change, because the original ROM BIOS already supported drives with multiple heads.
+     * However, what the ROM BIOS did NOT do was provide any indication of drive type, which as far as I can tell,
+     * meant you had to simply read/write/format tracks with the second head and check for errors.
+     *
+     * Presumably at the same time double-sided drives started shipping, PC-DOS 1.10 shipped, which added
+     * support for 320Kb diskettes.  And the FORMAT command changed as well, defaulting to a double-sided format
+     * operation UNLESS you specified "FORMAT /1".  If I run PC-DOS 1.10 and try to simulate a single-sided drive
+     * (by setting drive.nHeads = 1 in initDrive), FORMAT will balk with "Track 0 bad - disk unusable".  I have to
+     * wonder if everyone with single-sided drives who upgraded to PC-DOS 1.10 also got that error, forcing them
+     * to always specify "FORMAT /1", or if I'm doing something wrong wrt single-sided drive simulation.
+     *
+     * I've noticed that if I turn FDC messages on ("m fdc on"), and then run "FORMAT B:/1", the command still
+     * tries to format head 1/track 0, followed by head 0/track 0, and then the FDC is reset, and the format operation
+     * proceeds with only head 0 for all tracks 0 through 39.  FORMAT successfully creates a 160Kb single-sided diskette,
+     * but why it also tries to initially format track 0 using the second head remains a bit of a mystery.
+     *
+     * @this {FDC}
+     * @param {Object} parmsFDC
+     */
+    constructor(parmsFDC)
+    {
+        /*
+         * TODO: Indicate the type of diskette image being loaded (this might help folks understand what's going
+         * on when they try to load a diskette image that's larger than what the selected operating system supports).
+         */
+        super("FDC", parmsFDC, Messages.FDC);
+
+        this['dmaRead'] = FDC.prototype.doDMARead;
+        this['dmaWrite'] = FDC.prototype.doDMAWrite;
+        this['dmaFormat'] = FDC.prototype.doDMAFormat;
+
+        /*
+         * We record any 'autoMount' object now, but we no longer parse it until initBus(), because the Computer's
+         * getMachineParm() service may have an override for us.
+         */
+        this.configMount = this.parseConfig(parmsFDC['autoMount']);
+
+        /*
+         * This establishes "name" as the default; if we decide we'd prefer "none" to be the default (ie, the order
+         * to use when no sortBy value is specified), we can just drop the '|| "name"', because an undefined value is
+         * just as falsey as null.
+         *
+         * The code that actually performs the sorting (in setBinding()) first checks that sortBy is not falsey, and
+         * then assumes that the non-falsey value must be either "path" or "name", and since it explicitly checks for
+         * "path" first, any non-sensical value will be treated as "name" (which is fine, since that's our current default).
+         */
+        this.sortBy = parmsFDC['sortBy'] || "name";
+        if (this.sortBy == "none") this.sortBy = null;
+
+        /*
+         * The following array keeps track of every disk image we've ever mounted.  Each entry in the
+         * array is another array whose elements are:
+         *
+         *      [0]: name of disk
+         *      [1]: path of disk
+         *      [2]: array of deltas, uninitialized until the disk is unmounted and/or all state is saved
+         *
+         * See functions addDiskHistory() and updateDiskHistory().
+         */
+        this.aDiskHistory = [];
+
+        /*
+         * Support for local disk images is currently limited to desktop browsers with FileReader support;
+         * when this flag is set, setBinding() allows local disk bindings and informs initBus() to update the
+         * "listDisks" binding accordingly.
+         */
+        this.fLocalDisks = (!Web.isMobile() && window && 'FileReader' in window);
+
+        /*
+         * The remainder of FDC initialization now takes place in our initBus() handler, largely because we
+         * want initController() to have access to the ChipSet component, so that it can query switches and/or CMOS
+         * settings that determine the number of drives and their characteristics (eg, 40-track vs. 80-track),
+         * which it can then pass on to initDrive().
+         */
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * @this {FDC}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "listDisks")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        var fdc = this;
+
+        switch (sBinding) {
+
+        case "listDisks":
+            this.bindings[sBinding] = control;
+
+            /*
+             * Since binding is a one-time initialization operation, it's also the perfect time to
+             * perform whatever sorting (if any) is indicated by the FDC component's "sortBy" property.
+             *
+             * And since setBinding() is called before initBus(), that means any "special" disk entries
+             * will be added after the sorting, so we won't be "burying" those entries somewhere in the
+             * middle.
+             */
+            if (this.sortBy) {
+                var i, aOptions = [];
+                /*
+                 * NOTE: All this monkeying around with copying the elements from control.options to aOptions
+                 * and then back again is necessary because control.options isn't a *real* Array (at least not
+                 * in all browsers); consequently, it may have no sort() method.  It has a length property,
+                 * along with numeric properties 0 to length-1, but it's still probably just an Object, not
+                 * an Array.
+                 *
+                 * Also note that changing the order of the control's options would ordinarily mean that the
+                 * control's selectedIndex may now be incorrect, but in our case, it doesn't matter, because
+                 * we have a special function, displayDiskette(), that will be called at LEAST once during
+                 * initialization, ensuring that selectedIndex is set correctly.
+                 */
+                for (i = 0; i < control.options.length; i++)  {
+                    aOptions.push(control.options[i]);
+                }
+                aOptions.sort(function(a, b) {
+                    /*
+                     * I've switched to localeCompare() because it offers case-insensitivity by default;
+                     * I'm still a little concerned that we could somehow end up with list elements whose text
+                     * and/or value properties are undefined (because calling a method on an undefined variable
+                     * will throw an exception), but maybe I'm being overly paranoid....
+                     */
+                    if (fdc.sortBy != "path") {
+                        return a.text.localeCompare(b.text);
+                    } else {
+                        return a.value.localeCompare(b.value);
+                    }
+                });
+                for (i = 0; i < aOptions.length; i++)  {
+                    try {
+                        /*
+                         * TODO: Determine why this line blows up in IE8; are the properties of an options object not settable in IE8?
+                         */
+                        control.options[i] = aOptions[i];
+                    } catch(e) {
+                        break;
+                    }
+                }
+            }
+
+            control.onchange = function onChangeListDisks(event) {
+                var controlDesc = fdc.bindings["descDisk"];
+                var controlOption = control.options[control.selectedIndex];
+                if (controlDesc && controlOption) {
+                    var dataValue = {};
+                    var sValue = controlOption.getAttribute("data-value");
+                    if (sValue) {
+                        try {
+                            dataValue = eval("(" + sValue + ")");
+                        } catch (e) {
+                            Component.error("FDC option error: " + e.message);
+                        }
+                    }
+                    var sHTML = dataValue['desc'];
+                    if (sHTML === undefined) sHTML = "";
+                    var sHRef = dataValue['href'];
+                    if (sHRef !== undefined) sHTML = "<a href=\"" + sHRef + "\" target=\"_blank\">" + sHTML + "</a>";
+                    controlDesc.innerHTML = sHTML;
+                }
+            };
+            return true;
+
+        case "descDisk":
+        case "listDrives":
+            this.bindings[sBinding] = control;
+            /*
+             * I tried going with onclick instead of onchange, so that if you wanted to confirm what's
+             * loaded in a particular drive, you could click the drive control without having to change it.
+             * However, that doesn't seem to work for all browsers, so I've reverted to onchange.
+             */
+            control.onchange = function onChangeListDrives(event) {
+                var iDrive = Str.parseInt(control.value, 10);
+                if (iDrive != null) fdc.displayDiskette(iDrive);
+            };
+            return true;
+
+        case "loadDisk":
+            this.bindings[sBinding] = control;
+
+            control.onclick = function onClickLoadDrive(event) {
+                var controlDisks = fdc.bindings["listDisks"];
+                if (controlDisks) {
+                    var sDisketteName = controlDisks.options[controlDisks.selectedIndex].text;
+                    var sDiskettePath = controlDisks.value;
+                    fdc.loadSelectedDrive(sDisketteName, sDiskettePath);
+                }
+            };
+            return true;
+
+        case "saveDisk":
+            /*
+             * Yes, technically, this feature does not require "Local disk support" (which is really a reference
+             * to FileReader support), but since fLocalDisks is also false for all mobile devices, and since there
+             * is an "orthogonality" to disabling both features in tandem, let's just let it slide, OK?
+             */
+            if (!this.fLocalDisks) {
+                if (DEBUG) this.log("Local disk support not available");
+                /*
+                 * We could also simply hide the control; eg:
+                 *
+                 *      control.style.display = "none";
+                 *
+                 * but removing the control altogether seems better.
+                 */
+                control.parentNode.removeChild(/** @type {Node} */ (control));
+                return false;
+            }
+
+            this.bindings[sBinding] = control;
+
+            control.onclick = function onClickSaveDrive(event) {
+                var controlDrives = fdc.bindings["listDrives"];
+                if (controlDrives && controlDrives.options && fdc.aDrives) {
+                    var iDriveSelected = Str.parseInt(controlDrives.value, 10) || 0;
+                    var drive = fdc.aDrives[iDriveSelected];
+                    if (drive) {
+                        /*
+                         * Note the similarity (and hence factoring opportunity) between this code and the HDC's
+                         * "saveHD*" binding.
+                         */
+                        var disk = drive.disk;
+                        if (disk) {
+                            if (DEBUG) fdc.println("saving diskette " + disk.sDiskPath + "...");
+                            var sAlert = Web.downloadFile(disk.encodeAsBase64(), "octet-stream", true, disk.sDiskFile.replace(".json", ".img"));
+                            Component.alertUser(sAlert);
+                        } else {
+                            fdc.notice("No diskette loaded in drive.");
+                        }
+                    } else {
+                        fdc.notice("No diskette drive selected.");
+                    }
+                }
+            };
+            return true;
+
+        case "mountDisk":
+            if (!this.fLocalDisks) {
+                if (DEBUG) this.log("Local disk support not available");
+                /*
+                 * We could also simply hide the control; eg:
+                 *
+                 *      control.style.display = "none";
+                 *
+                 * but removing the control altogether seems better.
+                 */
+                control.parentNode.removeChild(/** @type {Node} */ (control));
+                return false;
+            }
+
+            this.bindings[sBinding] = control;
+
+            /*
+             * Enable "Mount" button only if a file is actually selected
+             */
+            control.addEventListener('change', function() {
+                var fieldset = control.children[0];
+                var files = fieldset.children[0].files;
+                var submit = fieldset.children[1];
+                submit.disabled = !files.length;
+            });
+
+            control.onsubmit = function(event) {
+                var file = event.currentTarget[1].files[0];
+                if (file) {
+                    var sDiskettePath = file.name;
+                    var sDisketteName = Str.getBaseName(sDiskettePath, true);
+                    fdc.loadSelectedDrive(sDisketteName, sDiskettePath, file);
+                }
+                /*
+                 * Prevent reloading of web page after form submission
+                 */
+                return false;
+            };
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {FDC}
+     * @param {Computer} cmp
+     * @param {Bus} bus
+     * @param {X86CPU} cpu
+     * @param {DebuggerX86} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+        this.cmp = cmp;
+
+        this.chipset = cmp.getMachineComponent("ChipSet");
+        this.parseConfig(this.cmp.getMachineParm('autoMount'), this.configMount);
+
+        /*
+         * If we didn't need auto-mount support, we could defer controller initialization until we received a powerUp() notification,
+         * at which point reset() would call initController(), or restore() would restore the controller; in that case, all we'd need
+         * to do here is call setReady().
+         */
+        this.initController();
+
+        bus.addPortInputTable(this, FDC.aPortInput);
+        bus.addPortOutputTable(this, FDC.aPortOutput);
+
+        this.addDiskette("None", "", true);
+        if (this.fLocalDisks) this.addDiskette("Local Disk", "?");
+        this.addDiskette("Remote Disk", "??");
+
+        if (!this.autoMount()) this.setReady();
+    }
+
+    /**
+     * parseConfig(config, configMerge)
+     *
+     * @this {FDC}
+     * @param {Object|string|undefined} config
+     * @param {Object} [configMerge]
+     * @return {Object}
+     */
+    parseConfig(config, configMerge)
+    {
+        if (config) {
+            if (typeof config == "string") {
+                try {
+                    /*
+                     * We must take care when parsing user-supplied JSON-encoded diskette data.
+                     */
+                    config = /** @type {Object} */ (eval("(" + config + ")"));
+                } catch (e) {
+                    Component.error("FDC auto-mount error: " + e.message + " (" + config + ")");
+                    config = {};
+                }
+            }
+        } else {
+            config = {};
+        }
+        for (var sDrive in config) {
+            if (configMerge) configMerge[sDrive] = config[sDrive];
+        }
+        return config;
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {FDC}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            if (!data) {
+                this.reset();
+                if (this.cmp.fReload) {
+                    /*
+                     * If the computer's fReload flag is set, we're required to toss all currently
+                     * loaded disks and remount all disks specified in the auto-mount configuration.
+                     */
+                    this.unloadAllDrives(true);
+                    this.autoMount(true);
+                }
+            } else {
+                if (!this.restore(data)) return false;
+            }
+            /*
+             * Populate the HTML controls to match the actual (well, um, specified) number of floppy drives.
+             */
+            var controlDrives;
+            if ((controlDrives = this.bindings['listDrives'])) {
+                while (controlDrives.firstChild) {
+                    controlDrives.removeChild(controlDrives.firstChild);
+                }
+                controlDrives.value = "";
+                for (var iDrive = 0; iDrive < this.nDrives; iDrive++) {
+                    var controlOption = document.createElement("option");
+                    controlOption.value = iDrive;
+                    /*
+                     * TODO: This conversion of drive number to drive letter, starting with A:, is very simplistic
+                     * and will NOT match the drive mappings that DOS ultimately uses.  We'll need to spiff this up at
+                     * some point.
+                     */
+                    controlOption.text = String.fromCharCode(0x41 + iDrive) + ":";
+                    controlDrives.appendChild(controlOption);
+                }
+                if (this.nDrives > 0) {
+                    controlDrives.value = "0";
+                    this.displayDiskette(0);
+                }
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {FDC}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * reset()
+     *
+     * NOTE: initController() establishes the maximum possible number of drives, but it's not until
+     * we interrogate the current SW1 settings that we will have an ACTUAL number of drives (nDrives),
+     * at which point we can also update the contents of the "listDrives" HTML control, if any.
+     *
+     * @this {FDC}
+     */
+    reset()
+    {
+        /*
+         * NOTE: The controller is also initialized by the constructor, to assist with auto-mount support,
+         * so think about whether we can skip powerUp initialization.
+         */
+        this.initController();
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the FDC component.
+     *
+     * @this {FDC}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, this.saveController());
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the FDC component.
+     *
+     * @this {FDC}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        return this.initController(data[0]);
+    }
+
+    /**
+     * initController(data)
+     *
+     * @this {FDC}
+     * @param {Array} [data]
+     * @return {boolean} true if successful, false if failure
+     */
+    initController(data)
+    {
+        var i = 0, iDrive;
+        var fSuccess = true;
+
+        if (!data) {
+            data = [0, 0, FDC.REG_STATUS.RQM, new Array(9), 0, 0, 0, []];
+        }
+
+        /*
+         * Selected drive (from regOutput), which can only be selected if its motor is on (see regOutput).
+         */
+        this.iDrive = data[i++];
+        i++;                        // unused slot (if reused, bias by +4, since it was formerly a unit #)
+
+        /*
+         * Defaults to FDC.REG_STATUS.RQM set (ready for command) and FDC.REG_STATUS.READ_DATA clear (data direction
+         * is from processor to the FDC Data Register).
+         */
+        this.regStatus = data[i++];
+
+        /*
+         * There can be up to 9 command bytes, and 7 result bytes, so 9 data registers are sufficient for communicating
+         * in both directions (hence, the new Array(9) default above).
+         */
+        this.regDataArray = data[i++];
+
+        /*
+         * Determines the next data byte to be received.
+         */
+        this.regDataIndex = data[i++];
+
+        /*
+         * Determines the next data byte to be sent (internally, we use regDataIndex to read data bytes, up to this total).
+         */
+        this.regDataTotal = data[i++];
+        this.regOutput = data[i++];
+        var dataDrives = data[i++];
+
+        /*
+         * Initialize the disk history (if available) before initializing the drives, so that any disk deltas can be
+         * applied to disk images that are already loaded.
+         */
+        var aDiskHistory = data[i++];
+        if (aDiskHistory != null) this.aDiskHistory = aDiskHistory;
+
+        if (this.aDrives === undefined) {
+            this.nDrives = 4;                       // default to the maximum number of drives
+            if (this.chipset) this.nDrives = this.chipset.getDIPFloppyDrives();
+            /*
+             * I would prefer to allocate only nDrives, but as discussed in the handling of the FDC.REG_DATA.CMD.SENSE_INT
+             * command, we're faced with situations where the controller must respond to any drive in the range 0-3, regardless
+             * how many drives are actually installed.  We still rely upon nDrives to determine the number of drives displayed
+             * to the user, however.
+             */
+            this.aDrives = new Array(4);
+        }
+
+        for (iDrive = 0; iDrive < this.aDrives.length; iDrive++) {
+            var drive = this.aDrives[iDrive];
+            if (drive === undefined) {
+                /*
+                 * The first time each drive is initialized, we query its capacity (based on switches or CMOS) and set
+                 * the drive's physical limits accordingly (ie, max tracks, max heads, and max sectors/track).
+                 */
+                drive = this.aDrives[iDrive] = {};
+                var nKb = (this.chipset? this.chipset.getDIPFloppyDriveSize(iDrive) : 0);
+                switch(nKb) {
+                case 160:
+                case 180:
+                    drive.nHeads = 1;       // required for single-sided drives only (all others default to double-sided)
+                    /* falls through */
+                case 320:
+                case 360:
+                    /* falls through */
+                default:                    // drives that don't have a recognized capacity default to 360
+                    drive.nCylinders = 40;
+                    drive.nSectors = 9;     // drives capable of writing 8 sectors/track can also write 9 sectors/track
+                    break;
+                case 720:
+                    drive.nCylinders = 80;
+                    drive.nSectors = 9;
+                    break;
+                case 1200:
+                    drive.nCylinders = 80;
+                    drive.nSectors = 15;
+                    break;
+                case 1440:
+                    drive.nCylinders = 80;
+                    drive.nSectors = 18;
+                    break;
+                }
+            }
+            if (!this.initDrive(drive, iDrive, dataDrives[iDrive])) {
+                fSuccess = false;
+            }
+        }
+
+        /*
+         * regInput and regControl (port 0x3F7) were not present on controllers prior to MODEL_5170, which is why
+         * we don't include initializers for them in the default data array; we could eliminate them on older models,
+         * but we don't have access to the model info right now, and there's no real cost to always including them
+         * in the FDC state.
+         *
+         * The bigger compatibility question is whether to always include hooks for them (see aPortInput and aPortOutput).
+         */
+        this.regInput = data[i++] || 0;                             // TODO: Determine if we should default to FDC.REG_INPUT.DISK_CHANGE instead of 0
+        this.regControl = data[i] || FDC.REG_CONTROL.RATE500K;      // default to maximum data rate
+
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("FDC initialized for " + this.aDrives.length + " drive(s)");
+        }
+        return fSuccess;
+    }
+
+    /**
+     * saveController()
+     *
+     * @this {FDC}
+     * @return {Array}
+     */
+    saveController()
+    {
+        var i = 0;
+        var data = [];
+        data[i++] = this.iDrive;
+        data[i++] = 0;
+        data[i++] = this.regStatus;
+        data[i++] = this.regDataArray;
+        data[i++] = this.regDataIndex;
+        data[i++] = this.regDataTotal;
+        data[i++] = this.regOutput;
+        data[i++] = this.saveDrives();
+        data[i++] = this.saveDeltas();
+        data[i++] = this.regInput;
+        data[i] = this.regControl;
+        return data;
+    }
+
+    /**
+     * initDrive(drive, iDrive, data)
+     *
+     * TODO: Consider a separate Drive class that both FDC and HDC can use, since there's a lot of commonality
+     * between the drive objects created by both controllers.  This will clean up overall drive management and allow
+     * us to factor out some common Drive methods (eg, advanceSector()).
+     *
+     * @this {FDC}
+     * @param {Object} drive
+     * @param {number} iDrive
+     * @param {Array|undefined} data
+     * @return {boolean} true if successful, false if failure
+     */
+    initDrive(drive, iDrive, data)
+    {
+        var i = 0;
+        var fSuccess = true;
+
+        drive.iDrive = iDrive;
+        drive.fBusy = drive.fLocal = false;
+
+        if (data === undefined) {
+            /*
+             * We set a default of two heads (MODEL_5150 PCs originally shipped with single-sided drives,
+             * but the ROM BIOS appears to have always supported both drive types).
+             */
+            data = [FDC.REG_DATA.RES.RESET, true, 0, 2, 0];
+        }
+
+        if (typeof data[1] == "boolean") {
+            /*
+             * Note that when no data is provided (eg, when the controller is being reinitialized), we now take
+             * care to preserve any drive defaults that initController() already obtained for us, falling back to
+             * bare minimums only when all else fails.
+             */
+            data[1] = [
+                FDC.DEFAULT_DRIVE_NAME, // a[0]
+                drive.nCylinders || 40, // a[1]
+                drive.nHeads || data[3],// a[2]
+                drive.nSectors || 9,    // a[3]
+                drive.cbSector || 512,  // a[4]
+                data[1],                // a[5]
+                drive.nDiskCylinders,   // a[6]
+                drive.nDiskHeads,       // a[7]
+                drive.nDiskSectors      // a[8]
+            ];
+        }
+
+        /*
+         * resCode used to be an FDC global, but in order to insulate FDC state from the operation of various functions
+         * that operate on drive objects (eg, readData and writeData), I've made it a per-drive variable.  This choice,
+         * similar to my choice for handling PCN, may be contrary to how the actual hardware works, but I prefer this
+         * approach, as long as it doesn't expose any incompatibilities that any software actually cares about.
+         */
+        drive.resCode = data[i++];
+
+        /*
+         * Some additional drive properties/defaults that are largely for the Disk component's benefit.
+         */
+        var a = data[i++];
+        drive.name = a[0];
+        drive.nCylinders = a[1];          // cylinders
+        drive.nHeads = a[2];              // heads/cylinders
+        drive.nSectors = a[3];            // sectors/track
+        drive.cbSector = a[4];            // bytes/sector
+        drive.fRemovable = a[5];
+        /*
+         * If we have current media parameters, restore them; otherwise, default to the drive's physical parameters.
+         */
+        if (drive.nDiskCylinders = a[6]) {
+            drive.nDiskHeads = a[7];
+            drive.nDiskSectors = a[8];
+        } else {
+            drive.nDiskCylinders = drive.nCylinders;
+            drive.nDiskHeads = drive.nHeads;
+            drive.nDiskSectors = drive.nSectors;
+        }
+
+        /*
+         * The next group of properties are set by various FDC command sequences.
+         *
+         * We initialize this.iDrive (above) and drive.bHead and drive.bCylinder (below) to zero, but leave the rest undefined,
+         * awaiting their first FDC command.  We do this because the initial SENSE_INT command returns a PCN, which will also
+         * be undefined unless we have at least zeroed both the current drive and the "present" cylinder on that drive.
+         *
+         * Alternatively, I could make PCN a global FDC variable.  That may be closer to how the actual hardware operates,
+         * but I'm using per-drive variables so that the FDC component can be a good client to both the CPU and other components.
+         *
+         * COMPATIBILITY ALERT: The MODEL_5170 BIOS ("DSKETTE_SETUP") attempts to discern the drive type (double-density vs.
+         * high-capacity) by "slapping" the heads around -- "litrally" (it uses a constant named "TRK_SLAP" equal to 48).
+         * After seeking to "TRK_SLAP", the BIOS performs a series of seeks, looking for the precise point where the heads
+         * return to track 0.
+         *
+         * Here's how it works: the BIOS seeks to track 48 (which is fine on an 80-track 1.2Mb high-capacity drive, but 9 tracks
+         * too far on a 40-track 360Kb double-density drive), then seeks to track 10, and then seeks in single-track increments
+         * up to 10 more times until the SENSE_DRIVE command returns ST3 with the TRACK0 bit set.
+         *
+         * This implies that SEEK isn't really seeking to a specified cylinder, but rather it is calculating a delta from
+         * the previous cylinder to the specified cylinder, and stepping over that number of tracks.  Which means that SEEK
+         * is updating a "logical" cylinder number, not the "physical" (actual) cylinder number.  Presumably a RECALIBRATE
+         * command will bring the logical and physical values into sync, but once an out-of-bounds cylinder is requested, they
+         * will be out of sync.
+         *
+         * To simulate this, bCylinder is now treated as the "physical" cylinder (since that's how it's ALWAYS been used here),
+         * and bCylinderSeek will now track (pun intended) the "logical" cylinder that's programmed via SEEK commands.
+         */
+        drive.bHead = data[i++];
+        drive.bCylinderSeek = data[i++];        // the data[] slot where we used to store drive.nHeads (or -1)
+        drive.bCylinder = data[i++];
+        if (drive.bCylinderSeek >= 100) {       // verify that the saved bCylinderSeek is valid, otherwise sync it with bCylinder
+            drive.bCylinderSeek -= 100;
+        } else {
+            drive.bCylinderSeek -= drive.bCylinder;
+        }
+        drive.bSector = data[i++];
+        drive.bSectorEnd = data[i++];           // aka EOT
+        drive.nBytes = data[i++];
+
+        /*
+         * We no longer reinitialize drive.disk, in order to retain previously mounted diskette across resets.
+         */
+
+        /*
+         * The next group of properties are managed by worker functions (eg, doRead()) to maintain state across DMA requests.
+         */
+        drive.ibSector = data[i++];             // location of the next byte to be accessed in the current sector
+        drive.sector = null;
+
+        if (!drive.disk) {
+            drive.sDiskettePath = "";           // ensure this is initialized to a default that displayDiskette() can deal with
+        }
+
+        var deltas = data[i++];
+        if (deltas == 102) deltas = false;      // v1.02 backward-compatibility
+
+        if (typeof deltas == "boolean") {
+            var fLocal = deltas;
+            var sDisketteName = data[i++];
+            var sDiskettePath = data[i];
+            /*
+             * If we're restoring a local disk image, then the entire disk contents should be captured in aDiskHistory,
+             * so all we have to do is mount a blank diskette and let disk.restore() do the rest; ie, there's nothing to
+             * "load" (it's a purely synchronous operation).
+             *
+             * Otherwise, we must call loadDrive(); in the common case, loadDrive() will have already "auto-mounted"
+             * the diskette, so it will return true, and then we restore any deltas to the current image.
+             *
+             * However, if loadDrive() returns false, then it has initiated the load for a *different* disk image,
+             * so we must mark ourselves as "not ready" again, and add another "wait for ready" test in Computer before
+             * finally powering the CPU.
+             */
+            if (fLocal) {
+                this.mountDrive(iDrive, sDisketteName, sDiskettePath);
+            }
+            else if (this.loadDrive(iDrive, sDisketteName, sDiskettePath, true)) {
+                if (drive.disk) {
+                    if (sDiskettePath) {
+                        this.addDiskHistory(sDisketteName, sDiskettePath, drive.disk);
+                    } else {
+                        if (MAXDEBUG) Component.warning("Disk '" + (drive.disk.sDiskName || sDisketteName) + "' not recorded properly in drive " + iDrive);
+                    }
+                }
+            } else {
+                this.setReady(false);
+            }
+        } else if (deltas !== undefined) {
+            /*
+             * If there's any data at all (ie, if this is a restore and not a reset), then it must be in the
+             * pre-v1.02 save/restore format, so we'll restore as best we can, but be aware that if disk.restore()
+             * notices that the currently mounted disk image differs from the disk image that these deltas belong to,
+             * it will return false, and the restore operation will be aborted.
+             */
+            if (drive.disk && drive.disk.restore(deltas) < 0) {
+                fSuccess = false;
+            }
+        }
+
+        /*
+         * TODO: If loadDrive() returned true, then this can happen immediately.  Otherwise, loadDrive()
+         * will have merely "queued up" the load request and drive.disk won't be ready yet, so figure out how/when
+         * we can properly restore drive.sector in that case.
+         */
+        if (fSuccess && drive.disk && drive.ibSector !== undefined) {
+            drive.sector = drive.disk.seek(drive.bCylinder, drive.bHead, drive.bSector);
+        }
+        return fSuccess;
+    }
+
+    /**
+     * saveDrives()
+     *
+     * @this {FDC}
+     * @return {Array}
+     */
+    saveDrives()
+    {
+        var i = 0;
+        var data = [];
+        for (var iDrive = 0; iDrive < this.aDrives.length; iDrive++) {
+            data[i++] = this.saveDrive(this.aDrives[iDrive]);
+        }
+        return data;
+    }
+
+    /**
+     * saveDrive(drive)
+     *
+     * @this {FDC}
+     * @param {Object} drive
+     * @return {Array}
+     */
+    saveDrive(drive)
+    {
+        var i = 0;
+        var data = [];
+        data[i++] = drive.resCode;
+        data[i++] = [drive.name, drive.nCylinders, drive.nHeads, drive.nSectors, drive.cbSector, drive.fRemovable, drive.nDiskCylinders, drive.nDiskHeads, drive.nDiskSectors];
+        data[i++] = drive.bHead;
+        /*
+         * We used to store drive.nHeads in the next slot, but now we store bCylinderSeek,
+         * and we bias it by +100 so that initDrive() can distinguish it from older values.
+         */
+        data[i++] = drive.bCylinderSeek + 100;
+        data[i++] = drive.bCylinder;
+        data[i++] = drive.bSector;
+        data[i++] = drive.bSectorEnd;
+        data[i++] = drive.nBytes;
+        data[i++] = drive.ibSector;
+        /*
+         * Now we deviate from the 1.01a save format: instead of next storing all the deltas for the
+         * currently mounted disk (if any), we store only the name and path of the currently mounted disk
+         * (if any).  Deltas for ALL disks, both currently mounted and previously mounted, are stored later.
+         *
+         *      data[i++] = drive.disk? drive.disk.save() : null;
+         *
+         * To indicate this deviation, we store neither a null nor a delta array, but a boolean (fLocal);
+         * if that boolean is not present, then the restore code will know it's dealing with a pre-v1.02 state.
+         */
+        data[i++] = drive.fLocal;
+        data[i++] = drive.sDisketteName;
+        data[i] = drive.sDiskettePath;
+        if (DEBUG && !drive.sDiskettePath && drive.disk && drive.disk.sDiskPath) {
+            Component.warning("Disk '" + drive.disk.sDiskName + "' not saved properly in drive " + drive.iDrive);
+        }
+        return data;
+    }
+
+    /**
+     * saveDeltas()
+     *
+     * This returns an array of entries, one for each disk image we've ever mounted, including any deltas; ie:
+     *
+     *      [name, path, deltas]
+     *
+     * aDiskHistory contains exactly that, except that deltas may not be up-to-date for any currently mounted
+     * disk image(s), so we call updateHistory() for all those disks, and then aDiskHistory is ready to be saved.
+     *
+     * @this {FDC}
+     * @return {Array}
+     */
+    saveDeltas()
+    {
+        for (var iDrive = 0; iDrive < this.aDrives.length; iDrive++) {
+            var drive = this.aDrives[iDrive];
+            if (drive.disk) {
+                this.updateDiskHistory(drive.sDisketteName, drive.sDiskettePath, drive.disk);
+            }
+        }
+        return this.aDiskHistory;
+    }
+
+    /**
+     * copyDrive(iDrive)
+     *
+     * @this {FDC}
+     * @param {number} iDrive
+     * @return {Object|undefined} drive (which may be undefined if the requested drive does not exist)
+     */
+    copyDrive(iDrive)
+    {
+        var driveNew;
+        var driveOld = this.aDrives[iDrive];
+        if (driveOld !== undefined) {
+            driveNew = {};
+            for (var p in driveOld) {
+                driveNew[p] = driveOld[p];
+            }
+        }
+        return driveNew;
+    }
+
+    /**
+     * seekDrive(drive, iSector, nSectors)
+     *
+     * The FDC doesn't need this function, since all FDC requests from the CPU are handled by doCmd().  This function
+     * is used by other components (eg, Debugger) to mimic an FDC request, using a drive object obtained from copyDrive(),
+     * to avoid disturbing the internal state of the FDC's drive objects.
+     *
+     * Also note that in an actual FDC request, drive.nBytes is initialized to the size of a single sector; the extent
+     * of the entire transfer is actually determined by a count that has been pre-loaded into the DMA controller.  The FDC
+     * isn't even aware of the extent of the transfer, so in the case of a read request, all readData() can do is return
+     * bytes until the current track (or, in the case of a multi-track request, the current cylinder) has been exhausted.
+     *
+     * Since seekDrive() is for use with non-DMA requests, we use nBytes to specify the length of the entire transfer.
+     *
+     * @this {FDC}
+     * @param {Object} drive
+     * @param {number} iSector (a "logical" sector number, relative to the entire disk, NOT a physical sector number)
+     * @param {number} nSectors
+     * @return {boolean} true if successful, false if invalid position request
+     */
+    seekDrive(drive, iSector, nSectors)
+    {
+        if (drive.disk) {
+            var aDiskInfo = drive.disk.info();
+            var nCylinders = aDiskInfo[0];
+            var nHeads = aDiskInfo[1];
+            var nSectorsPerTrack = aDiskInfo[2];
+            var nSectorsPerCylinder = nHeads * nSectorsPerTrack;
+            var nSectorsPerDisk = nCylinders * nSectorsPerCylinder;
+            if (iSector + nSectors <= nSectorsPerDisk) {
+                drive.bCylinder = Math.floor(iSector / nSectorsPerCylinder);
+                iSector %= nSectorsPerCylinder;
+                drive.bHead = Math.floor(iSector / nSectorsPerTrack);
+                drive.bSector = (iSector % nSectorsPerTrack) + 1;
+                drive.nBytes = nSectors * aDiskInfo[3];
+                /*
+                 * NOTE: We don't set bSectorEnd, as an FDC command would, but it's irrelevant, because we don't actually
+                 * do anything with bSectorEnd at this point.  Perhaps someday, when we faithfully honor/restrict requests
+                 * to a single track (or a single cylinder, in the case of multi-track requests).
+                 */
+                drive.resCode = FDC.REG_DATA.RES.NONE;
+                /*
+                 * At this point, we've finished simulating what an FDC.REG_DATA.CMD.READ_DATA command would have performed,
+                 * up through doRead().  Now it's the caller responsibility to call readData(), just like the DMA Controller would.
+                 */
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * autoMount(fRemount)
+     *
+     * @this {FDC}
+     * @param {boolean} [fRemount] is true if we're remounting all auto-mounted diskettes
+     * @return {boolean} true if one or more diskette images are being auto-mounted, false if none
+     */
+    autoMount(fRemount)
+    {
+        if (!fRemount) this.cAutoMount = 0;
+        for (var sDrive in this.configMount) {
+            var configDrive = this.configMount[sDrive];
+            var sDiskettePath = configDrive['path'] || "";
+            if (sDiskettePath) {
+                /*
+                 * WARNING: This conversion of drive letter to drive number, starting with A:, is very simplistic
+                 * and is not guaranteed to match the drive mapping that DOS ultimately uses.
+                 */
+                var iDrive = sDrive.charCodeAt(0) - 0x41;
+                if (iDrive >= 0 && iDrive < this.aDrives.length) {
+                    var sDisketteName = configDrive['name'] || this.findDiskette(sDiskettePath) || "Unknown";
+                    if (!this.loadDrive(iDrive, sDisketteName, sDiskettePath, true) && fRemount) {
+                        this.setReady(false);
+                    }
+                    continue;
+                }
+                this.notice("Incorrect auto-mount settings for drive " + sDrive + " (" + JSON.stringify(configDrive) + ")");
+            }
+        }
+        return !!this.cAutoMount;
+    }
+
+    /**
+     * loadSelectedDrive(sDisketteName, sDiskettePath, file)
+     *
+     * @this {FDC}
+     * @param {string} sDisketteName
+     * @param {string} sDiskettePath
+     * @param {File} [file] is set if there's an associated File object
+     */
+    loadSelectedDrive(sDisketteName, sDiskettePath, file)
+    {
+        var iDrive;
+        var controlDrives = this.bindings["listDrives"];
+        if (controlDrives && !isNaN(iDrive = Str.parseInt(controlDrives.value, 10)) && iDrive >= 0 && iDrive < this.aDrives.length) {
+
+            if (!sDiskettePath) {
+                this.unloadDrive(iDrive);
+                return;
+            }
+
+            if (sDiskettePath == "?") {
+                this.notice('Use "Choose File" and "Mount" to select and load a local disk.');
+                return;
+            }
+
+            /*
+             * If the special path of "??" is selected, then we want to prompt the user for a URL.  Oh, and
+             * make sure we pass an empty string as the 2nd parameter to prompt(), so that IE won't display
+             * "undefined" -- because after all, undefined and "undefined" are EXACTLY the same thing, right?
+             *
+             * TODO: This is literally all I've done to support remote disk images. There's probably more
+             * I should do, like dynamically updating "listDisks" to include new entries, and adding new entries
+             * to the save/restore data.
+             */
+            if (sDiskettePath == "??") {
+                sDiskettePath = window.prompt("Enter the URL of a remote disk image.", "") || "";
+                if (!sDiskettePath) return;
+                sDisketteName = Str.getBaseName(sDiskettePath);
+                if (DEBUG) this.println("Attempting to load " + sDiskettePath + " as \"" + sDisketteName + "\"");
+            }
+
+            if (DEBUG) this.println("loading disk " + sDiskettePath + "...");
+
+            while (this.loadDrive(iDrive, sDisketteName, sDiskettePath, false, file) < 0) {
+                if (!window.confirm("Click OK to reload the original disk.\n(WARNING: All disk changes will be discarded)")) {
+                    return;
+                }
+                /*
+                 * So here's the story: loadDrive() returned true, which it does ONLY if the specified disk is already
+                 * mounted, AND the user clicked OK to reload the original disk image.  So we must toss any history we have
+                 * for the disk, unload it, and then loop back around to loadDrive().
+                 *
+                 * loadDrive() should NEVER return true the second time, since no disk is loaded. In other words,
+                 * this isn't really a loop so much as a one-time retry operation.
+                 */
+                this.removeDiskHistory(sDisketteName, sDiskettePath);
+                this.unloadDrive(iDrive, false, true);
+            }
+            return;
+        }
+        this.notice("Unable to load the selected drive");
+    }
+
+    /**
+     * mountDrive(iDrive, sDisketteName, sDiskettePath)
+     *
+     * @this {FDC}
+     * @param {number} iDrive
+     * @param {string} sDisketteName
+     * @param {string} sDiskettePath
+     */
+    mountDrive(iDrive, sDisketteName, sDiskettePath)
+    {
+        var drive = this.aDrives[iDrive];
+        this.unloadDrive(iDrive, true, true);
+        drive.fLocal = true;
+        var disk = new Disk(this, drive, DiskAPI.MODE.PRELOAD);
+        this.doneLoadDrive(drive, disk, sDisketteName, sDiskettePath, true);
+    }
+
+    /**
+     * loadDrive(iDrive, sDisketteName, sDiskettePath, fAutoMount, file)
+     *
+     * NOTE: If sDiskettePath is already loaded in the drive, nothing needs to be done.
+     *
+     * @this {FDC}
+     * @param {number} iDrive
+     * @param {string} sDisketteName
+     * @param {string} sDiskettePath
+     * @param {boolean} [fAutoMount]
+     * @param {File} [file] is set if there's an associated File object
+     * @return {number} 1 if diskette loaded, 0 if queued up (or busy), -1 if already loaded
+     */
+    loadDrive(iDrive, sDisketteName, sDiskettePath, fAutoMount, file)
+    {
+        var drive = this.aDrives[iDrive];
+        if (sDiskettePath) {
+            /*
+             * TODO: This code contains two hacks that should eventually be eliminated: first, machines
+             * with saved states may attempt to load disks using old paths, so we replace the old path
+             * with the new, and second, they be using lower-case disk image names, whereas we now use
+             * UPPER-CASE names for disk images, so we lower-case both before comparing.  The only problem
+             * with removing these hacks is that we can never be sure when all saved states in the wild
+             * have been updated....
+             */
+            sDiskettePath = sDiskettePath.replace("/disks/pc/", "/disks/pcx86/");
+            if (drive.sDiskettePath.toLowerCase() != sDiskettePath.toLowerCase()) {
+                this.unloadDrive(iDrive, fAutoMount, true);
+                if (drive.fBusy) {
+                    this.notice("Drive " + iDrive + " busy");
+                    return 0;
+                }
+                drive.fBusy = true;
+                if (fAutoMount) {
+                    drive.fAutoMount = true;
+                    this.cAutoMount++;
+                    if (this.messageEnabled()) this.printMessage("loading diskette '" + sDisketteName + "'");
+                }
+                drive.fLocal = !!file;
+                var disk = new Disk(this, drive, DiskAPI.MODE.PRELOAD);
+                if (!disk.load(sDisketteName, sDiskettePath, file, this.doneLoadDrive)) {
+                    return 0;
+                }
+                return 1;
+            }
+        }
+        return -1;
+    }
+
+    /**
+     * doneLoadDrive(drive, disk, sDisketteName, sDiskettePath, fAutoMount)
+     *
+     * @this {FDC}
+     * @param {Object} drive
+     * @param {Disk} disk is set if the disk was successfully loaded, null if not
+     * @param {string} sDisketteName
+     * @param {string} sDiskettePath
+     * @param {boolean} [fAutoMount]
+     */
+    doneLoadDrive(drive, disk, sDisketteName, sDiskettePath, fAutoMount)
+    {
+        var aDiskInfo;
+
+        drive.fBusy = false;
+
+        if (disk) {
+            /*
+             * We shouldn't mount the diskette unless the drive is able to handle it; for example, FD360 (40-track)
+             * drives cannot read FD1200 (80-track) diskettes.  However, I no longer require that the diskette's
+             * sectors/track fall within the drive's standard maximum, because XDF diskettes use 19 physical sectors/track
+             * on the first cylinder (1 more than the typical 18 sectors/track found on 1.44Mb diskettes) but declare
+             * a larger logical size (23 512-byte sectors/track) to reflect the actual capacity of XDF tracks beyond the
+             * first cylinder (ie, one 8Kb sector, one 2Kb sector, one 1Kb sector, and one 512-byte sector).
+             */
+            aDiskInfo = disk.info();
+            if (disk && aDiskInfo[0] > drive.nCylinders || aDiskInfo[1] > drive.nHeads /* || aDiskInfo[2] > drive.nSectors */) {
+                this.notice("Diskette \"" + sDisketteName + "\" too large for drive " + String.fromCharCode(0x41 + drive.iDrive));
+                disk = null;
+            }
+        }
+
+        if (disk) {
+            drive.disk = disk;
+            drive.sDisketteName = sDisketteName;
+            drive.sDiskettePath = sDiskettePath;
+
+            /*
+             * Adding local disk image names to the disk list seems like a nice idea, but it's too confusing,
+             * because then it looks like the "Mount" button should be able to (re)load them, and that can NEVER
+             * happen, for security reasons; local disk images can ONLY be loaded via the "Mount" button after
+             * the user has selected them via the "Choose File" button.
+             *
+             *      this.addDiskette(sDisketteName, sDiskettePath);
+             *
+             * So we're going to take a different approach: when displayDiskette() is asked to display the name
+             * of a local disk image, it will map all such disks to "Local Disk", and any attempt to "Mount" such
+             * a disk, will essentially result in a "Disk not found" error.
+             */
+
+            this.addDiskHistory(sDisketteName, sDiskettePath, disk);
+
+            /*
+             * For a local disk (ie, one loaded via mountDrive()), the disk.restore() performed by addDiskHistory()
+             * may have altered the disk geometry, so refresh the disk info.
+             */
+            aDiskInfo = disk.info();
+
+            /*
+             * Clearly, a successful mount implies a disk change, and I suppose that, technically, an *unsuccessful*
+             * mount should imply the same, but what would the real-world analog be?  Inserting a piece of cardboard
+             * instead of an actual diskette?  In any case, if we can do the user a favor by pretending (as far as the
+             * disk change line is concerned) that an unsuccessful mount never happened, let's do it.
+             *
+             * Successful unmounts are a different story, however; those *do* trigger a change. See unloadDrive().
+             */
+            this.regInput |= FDC.REG_INPUT.DISK_CHANGE;
+
+            /*
+             * With the addition of notify(), users are now "alerted" whenever a diskette has finished loading;
+             * notify() is selective about its output, using print() if a print window is open, alert() otherwise.
+             *
+             * WARNING: This conversion of drive number to drive letter, starting with A:, is very simplistic
+             * and will not match the drive mappings that DOS ultimately uses (ie, for drives beyond B:).
+             */
+            this.notice("Mounted diskette \"" + sDisketteName + "\" in drive " + String.fromCharCode(0x41 + drive.iDrive), drive.fAutoMount || fAutoMount);
+
+            /*
+             * Update the drive's current media parameters to match the disk's.
+             */
+            drive.nDiskCylinders = aDiskInfo[0];
+            drive.nDiskHeads = aDiskInfo[1];
+            drive.nDiskSectors = aDiskInfo[2];
+
+            /*
+             * Since you usually want the Computer to have focus again after loading a new diskette, let's try automatically
+             * updating the focus after a successful load.
+             */
+            if (this.cmp) this.cmp.updateFocus();
+        }
+        else {
+            drive.fLocal = false;
+        }
+
+        if (drive.fAutoMount) {
+            drive.fAutoMount = false;
+            if (!--this.cAutoMount) this.setReady();
+        }
+
+        this.displayDiskette(drive.iDrive);
+    }
+
+    /**
+     * addDiskette(sName, sPath, fTop)
+     *
+     * @this {FDC}
+     * @param {string} sName
+     * @param {string} sPath
+     * @param {boolean} [fTop] (default is bottom)
+     */
+    addDiskette(sName, sPath, fTop)
+    {
+        var controlDisks = this.bindings["listDisks"];
+        if (controlDisks && controlDisks.options) {
+            for (var i = 0; i < controlDisks.options.length; i++) {
+                if (controlDisks.options[i].value == sPath) return;
+            }
+            var controlOption = document.createElement("option");
+            controlOption.text = sName;
+            controlOption.value = sPath;
+            if (fTop && controlDisks.childNodes[0]) {
+                controlDisks.insertBefore(controlOption, controlDisks.childNodes[0]);
+            } else {
+                controlDisks.appendChild(controlOption);
+            }
+        }
+    }
+
+    /**
+     * findDiskette(sPath)
+     *
+     * This is used to deal with mount requests (eg, autoMount) that supply a path without a name;
+     * if we can find the path in the "listDisks" control, then we return the associated disk name.
+     *
+     * @this {FDC}
+     * @param {string} sPath
+     * @return {string|null}
+     */
+    findDiskette(sPath)
+    {
+        var controlDisks = this.bindings["listDisks"];
+        if (controlDisks && controlDisks.options) {
+            for (var i = 0; i < controlDisks.options.length; i++) {
+                var control = controlDisks.options[i];
+                if (control.value == sPath) return control.text;
+            }
+        }
+        return Str.getBaseName(sPath, true);
+    }
+
+    /**
+     * displayDiskette(iDrive, fUpdateDrive)
+     *
+     * @this {FDC}
+     * @param {number} iDrive (unvalidated)
+     * @param {boolean} [fUpdateDrive] is true to update the drive list to match the specified drive (eg, the auto-mount case)
+     */
+    displayDiskette(iDrive, fUpdateDrive)
+    {
+        /*
+         * First things first: validate iDrive.
+         */
+        if (iDrive >= 0 && iDrive < this.aDrives.length) {
+            var drive = this.aDrives[iDrive];
+            var controlDisks = this.bindings["listDisks"];
+            var controlDrives = this.bindings["listDrives"];
+            /*
+             * Next, make sure controls for both drives and disks exist.
+             */
+            if (controlDisks && controlDrives && controlDisks.options && controlDrives.options) {
+                /*
+                 * Next, make sure the drive whose disk we're updating is the currently selected drive.
+                 */
+                var i;
+                var iDriveSelected = Str.parseInt(controlDrives.value, 10);
+                var sTargetPath = (drive.fLocal? "?" : drive.sDiskettePath);
+                if (!isNaN(iDriveSelected) && iDriveSelected == iDrive) {
+                    for (i = 0; i < controlDisks.options.length; i++) {
+                        if (controlDisks.options[i].value == sTargetPath) {
+                            if (controlDisks.selectedIndex != i) {
+                                controlDisks.selectedIndex = i;
+                            }
+                            break;
+                        }
+                    }
+                    if (i == controlDisks.options.length) controlDisks.selectedIndex = 0;
+                }
+                if (fUpdateDrive) {
+                    for (i = 0; i < controlDrives.options.length; i++) {
+                        if (Str.parseInt(controlDrives.options[i].value, 10) == drive.iDrive) {
+                            if (controlDrives.selectedIndex != i) {
+                                controlDrives.selectedIndex = i;
+                            }
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    /**
+     * unloadDrive(iDrive, fAutoUnload, fQuiet)
+     *
+     * @this {FDC}
+     * @param {number} iDrive (pre-validated)
+     * @param {boolean} [fAutoUnload] is true if this unload is being forced as part of an automount and/or restored mount
+     * @param {boolean} [fQuiet]
+     */
+    unloadDrive(iDrive, fAutoUnload, fQuiet)
+    {
+        var drive = this.aDrives[iDrive];
+        if (drive.disk) {
+            /*
+             * Before we toss the disk's information, capture any deltas that may have occurred.
+             */
+            this.updateDiskHistory(drive.sDisketteName, drive.sDiskettePath, drive.disk);
+            drive.sDisketteName = "";
+            drive.sDiskettePath = "";
+            drive.disk = null;
+            drive.fLocal = false;
+
+            this.regInput |= FDC.REG_INPUT.DISK_CHANGE;
+
+            /*
+             * WARNING: This conversion of drive number to drive letter, starting with A:, is very simplistic
+             * and is not guaranteed to match the drive mapping that DOS ultimately uses.
+             */
+            if (!fQuiet) {
+                this.notice("Drive " + String.fromCharCode(0x41 + iDrive) + " unloaded", fAutoUnload);
+            }
+            /*
+             * Try to avoid any unnecessary hysteresis regarding the diskette display if this unload is merely
+             * a prelude to another load.
+             */
+            if (!fAutoUnload && !fQuiet) {
+                this.displayDiskette(iDrive);
+            }
+        }
+    }
+
+    /**
+     * unloadAllDrives(fDiscard)
+     *
+     * @this {FDC}
+     * @param {boolean} fDiscard to discard all disk history before unloading
+     */
+    unloadAllDrives(fDiscard)
+    {
+        if (fDiscard) {
+            this.aDiskHistory = [];
+        }
+        for (var iDrive = 0; iDrive < this.aDrives.length; iDrive++) {
+            this.unloadDrive(iDrive, true);
+        }
+    }
+
+    /**
+     * addDiskHistory(sDisketteName, sDiskettePath, disk)
+     *
+     * @this {FDC}
+     * @param {string} sDisketteName
+     * @param {string} sDiskettePath
+     * @param {Disk} disk containing corresponding disk image
+     */
+    addDiskHistory(sDisketteName, sDiskettePath, disk)
+    {
+        var i;
+
+        for (i = 0; i < this.aDiskHistory.length; i++) {
+            if (this.aDiskHistory[i][1] == sDiskettePath) {
+                var nChanges = disk.restore(this.aDiskHistory[i][2]);
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage("disk '" + sDisketteName + "' restored from history (" + nChanges + " changes)");
+                }
+                return;
+            }
+        }
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("disk '" + sDisketteName + "' added to history (nothing to restore)");
+        }
+        this.aDiskHistory[i] = [sDisketteName, sDiskettePath, []];
+    }
+
+    /**
+     * removeDiskHistory(sDisketteName, sDiskettePath)
+     *
+     * @this {FDC}
+     * @param {string} sDisketteName
+     * @param {string} sDiskettePath
+     */
+    removeDiskHistory(sDisketteName, sDiskettePath)
+    {
+        var i;
+        for (i = 0; i < this.aDiskHistory.length; i++) {
+            if (this.aDiskHistory[i][1] == sDiskettePath) {
+                this.aDiskHistory.splice(i, 1);
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage("disk '" + sDisketteName + "' removed from history");
+                }
+                return;
+            }
+        }
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("unable to remove disk '" + sDisketteName + "' from history (" + sDiskettePath + ")");
+        }
+    }
+
+    /**
+     * updateDiskHistory(sDisketteName, sDiskettePath, disk)
+     *
+     * @this {FDC}
+     * @param {string} sDisketteName
+     * @param {string} sDiskettePath
+     * @param {Disk} disk containing corresponding disk image, with possible deltas
+     */
+    updateDiskHistory(sDisketteName, sDiskettePath, disk)
+    {
+        var i;
+        for (i = 0; i < this.aDiskHistory.length; i++) {
+            if (this.aDiskHistory[i][1] == sDiskettePath) {
+                this.aDiskHistory[i][2] = disk.save();
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage("disk '" + sDisketteName + "' updated in history");
+                }
+                return;
+            }
+        }
+        /*
+         * I used to report this as an error (at least in the DEBUG release), but it's no longer really
+         * an error, because if we're trying to re-mount a clean copy of a disk, we toss its history, then
+         * unload, and then reload/remount.  And since unloadDrive's normal behavior is to call updateDiskHistory()
+         * before unloading, the fact that the disk is no longer listed here can't be treated as an error.
+         */
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("unable to update disk '" + sDisketteName + "' in history (" + sDiskettePath + ")");
+        }
+    }
+
+    /**
+     * outFDCOutput(port, bOut, addrFrom)
+     *
+     * @this {FDC}
+     * @param {number} port (0x3F2, output only)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outFDCOutput(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "OUTPUT");
+        if (!(bOut & FDC.REG_OUTPUT.ENABLE)) {
+            this.initController();
+            /*
+             * initController() resets, among other things, the selected drive (this.iDrive), so if we were
+             * still updating this.iDrive below based on the "drive select" bits in regOutput, we would want
+             * to make sure those bits now match what initController() set.  But since we no longer do that
+             * (see below), this is no longer needed either.
+             *
+             *      bOut = (bOut & ~FDC.REG_OUTPUT.DS) | this.iDrive;
+             */
+        }
+        else if (!(this.regOutput & FDC.REG_OUTPUT.ENABLE)) {
+            /*
+             * When FDC.REG_OUTPUT.ENABLE transitions from 0 to 1, generate an interrupt.
+             */
+            if (this.regOutput & FDC.REG_OUTPUT.INT_ENABLE) {
+                if (this.chipset) this.chipset.setIRR(ChipSet.IRQ.FDC);
+            }
+        }
+        /*
+         * This no longer updates the internally selected drive (this.iDrive) based on regOutput, because (a) there seems
+         * to be no point, as all drive-related commands include their own "drive select" bits, and (b) it breaks the
+         * MODEL_5170 boot code.  Here's why:
+         *
+         * Unlike previous models, the MODEL_5170 BIOS probes all installed diskette drives to determine drive type;
+         * ie, FD360 (40-track) or FD1200 (80-track).  So if there are two drives, the last selected drive will be drive 1.
+         * Immediately before booting, the BIOS issues an INT 0x13/AH=0 reset, which writes regOutput two times: first
+         * with FDC.REG_OUTPUT.ENABLE clear, and then with it set.  However, both times, it ALSO loads the last selected
+         * drive number into regOutput's "drive select" bits.
+         *
+         * If we switched our selected drive to match regOutput, then the ST0 value we returned on an SENSE_INT command
+         * following the regOutput reset operation would indicate drive 1 instead of drive 0.  But the BIOS requires
+         * the ST0 result from the SENSE_INT command ALWAYS be 0xC0 (not 0xC1), so the controller must not be propagating
+         * regOutput's "drive select" bits in the way I originally assumed.
+         *
+         *      var iDrive = bOut & FDC.REG_OUTPUT.DS;
+         *      if (bOut & (FDC.REG_OUTPUT.MOTOR_D0 << iDrive)) this.iDrive = iDrive;
+         */
+        this.regOutput = bOut;
+    }
+
+    /**
+     * inFDCDiagnostic(port, addrFrom)
+     *
+     * It turns out that any 5170 configuration without an HDC component that attempts to use either the REV2 or REV3
+     * PC AT ROM BIOS will fail with error "601-Diskette Error", unless we also provide this "D/S/P DIAGNOSTIC REGISTER".
+     * The original 5170 REV1 BIOS didn't have this requirement.
+     *
+     * I'm unable to find any documentation on this so-called "D/S/P DIAGNOSTIC REGISTER" (port 0x3F1) or the "D/S/P CARD"
+     * to which the ROM BIOS refers.  But it seems clear that if we don't provide the expected response from the DIAGNOSTIC
+     * REGISTER, and there's no HDC to respond to the MULTIPLE DATA RATE CAPABLE test that follows, then an error is
+     * inevitable.  Clearly, there is a very intimate relationship between the FDC and HDC portions of this card.
+     *
+     * Here's the relevant code from the REV3 PC AT ROM BIOS (TEST2.ASM):
+     *
+     *      ;-----  CHECK FOR MULTIPLE DATA RATE CAPABILITY
+     *
+     *      J_OK:
+     *              MOV     DX,03F1H                ; D/S/P DIAGNOSTIC REGISTER
+     *              IN      AL,DX                   ; READ D/S/P TYPE CODE
+     *              AND     AL,11111000B            ; KEEP ONLY UNIQUE CODE FOR D/S/P
+     *              CMP     AL,01010000B            ; D/S/P CARD - MULTIPLE DATA RATE?
+     *              JZ      J_OK3                   ; IF SO JUMP
+     *
+     *              MOV     DX,05F7H                ; FIXED DISK DIAGNOSTIC REGISTER
+     *              IN      AL,DX                   ; READ FIXED DISK TYPE CODE
+     *              AND     AL,11110000B            ; KEEP ONLY UNIQUE CODE FOR F/D
+     *              CMP     AL,10100000B            ; FIXED DISK ADAPTER ?
+     *              JZ      J_FAIL                  ; MUST BE COMBO ELSE ERROR
+     *
+     *              MOV     BL,0FH                  ; OUTER LOOP COUNT WAIT FOR BUSY OFF
+     *              SUB     CX,CX
+     *              MOV     DX,01F7H                ; HARD FILE STATUS PORT
+     *      J_OK1:
+     *              IN      AL,DX                   ; GET THE STATUS
+     *              TEST    AL,080H                 ; IS THE CONTROLLER BUSY?
+     *              JZ      J_OK2                   ; CONTINUE IF NOT
+     *              LOOP    J_OK1                   ; TRY AGAIN
+     *              DEC     BL                      ; DECREMENT OUTER LOOP
+     *              JNZ     J_OK1                   ; TRY AGAIN IF NOT ZERO
+     *              AND     AL,0CH                  ; BITS 2 & 3 = 0 IF MULTI DATA CAPABLE
+     *              JZ      J_OK3                   ; GO IF YES
+     *              JMP     SHORT J_FAIL            ; NO MULTIPLE DATA RATE CAPABILITY
+     *      J_OK2:
+     *              MOV     DX,1F4H                 ; VERIFY MULTIPLE DATA RATE CAPABLE
+     *              MOV     AL,055H                 ; WRITE TO THE CYLINDER BYTE
+     *              OUT     DX,AL
+     *              JMP     $+2                     ; I/O DELAY
+     *              IN      AL,DX                   ; CHECK DATA WRITTEN = DATA READ
+     *              CMP     AL,055H
+     *              JNZ     J_FAIL                  ; GO IF NOT
+     *              MOV     AL,0AAH                 ; WRITE ANOTHER PATTERN
+     *              OUT     DX,AL
+     *              JMP     $+2                     ; I/O DELAY
+     *              IN      AL,DX
+     *              CMP     AL,0AAH                 ; IS DATA PATTERN THE SAME?
+     *              JZ      J_OK3                   ; GO IF SO
+     *
+     *      J_FAIL:
+     *              OR      @MFG_ERR_FLAG+1,DSK_FAIL;       <><><><><><><><><><><><><>
+     *                                              ;       <><> DISKETTE FAILED  <><>
+     *              MOV     SI,OFFSET E601          ; GET ADDRESS OF MESSAGE
+     *              CALL    E_MSG                   ; GO PRINT ERROR MESSAGE
+     *              JMP     SHORT F15C              ; SKIP SETUP IF ERROR
+     *
+     *      J_OK3:
+     *              OR      @LASTRATE,DUAL          ; TURN ON DSP/COMBO FLAG
+     *
+     * @this {FDC}
+     * @param {number} port (0x3F1, input only)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inFDCDiagnostic(port, addrFrom)
+    {
+        var b = 0x50;       // we simply return the expected pattern (01010000B); see code excerpt above
+        this.printMessageIO(port, null, addrFrom, "DIAG", b);
+        return b;
+    }
+
+    /**
+     * inFDCStatus(port, addrFrom)
+     *
+     * @this {FDC}
+     * @param {number} port (0x3F4, input only)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inFDCStatus(port, addrFrom)
+    {
+        this.printMessageIO(port, null, addrFrom, "STATUS", this.regStatus);
+        return this.regStatus;
+    }
+
+    /**
+     * inFDCData(port, addrFrom)
+     *
+     * @this {FDC}
+     * @param {number} port (0x3F5, input/output)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inFDCData(port, addrFrom)
+    {
+        var bIn = 0;
+        if (this.regDataIndex < this.regDataTotal) {
+            bIn = this.regDataArray[this.regDataIndex];
+        }
+        /*
+         * As per the discussion in doCmd(), once the first byte of the Result Phase has been read, the interrupt must be cleared.
+         */
+        if (this.regOutput & FDC.REG_OUTPUT.INT_ENABLE) {
+            if (this.chipset) this.chipset.clearIRR(ChipSet.IRQ.FDC);
+        }
+        if (this.messageEnabled()) {
+            this.printMessageIO(port, null, addrFrom, "DATA[" + this.regDataIndex + "]", bIn);
+        }
+        if (++this.regDataIndex >= this.regDataTotal) {
+            this.regStatus &= ~(FDC.REG_STATUS.READ_DATA | FDC.REG_STATUS.BUSY);
+            this.regDataIndex = this.regDataTotal = 0;
+        }
+        return bIn;
+    }
+
+    /**
+     * outFDCData(port, bOut, addrFrom)
+     *
+     * @this {FDC}
+     * @param {number} port (0x3F5, input/output)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outFDCData(port, bOut, addrFrom)
+    {
+        if (this.messageEnabled()) {
+            this.printMessageIO(port, bOut, addrFrom, "DATA[" + this.regDataTotal + "]");
+        }
+
+        if (this.regDataTotal < this.regDataArray.length) {
+            this.regDataArray[this.regDataTotal++] = bOut;
+        }
+        var bCmd = this.regDataArray[0];
+        var bCmdMasked = bCmd & FDC.REG_DATA.CMD.MASK;
+        if (FDC.aCmdInfo[bCmdMasked] !== undefined) {
+            if (this.regDataTotal >= FDC.aCmdInfo[bCmdMasked].cbReq) {
+                this.doCmd();
+            }
+            return;
+        }
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("unsupported FDC command: " + Str.toHexByte(bCmd));
+            if (MAXDEBUG) this.dbg.stopCPU();
+        }
+    }
+
+    /**
+     * inFDCInput(port, addrFrom)
+     *
+     * @this {FDC}
+     * @param {number} port (0x3F7, input only, MODEL_5170 only)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inFDCInput(port, addrFrom)
+    {
+        var bIn = this.regInput;
+        /*
+         * TODO: Determine when the DISK_CHANGE bit is *really* cleared (this is just a guess)
+         */
+        this.regInput &= ~FDC.REG_INPUT.DISK_CHANGE;
+        this.printMessageIO(port, null, addrFrom, "INPUT", bIn);
+        return bIn;
+    }
+
+    /**
+     * outFDCControl(port, bOut, addrFrom)
+     *
+     * @this {FDC}
+     * @param {number} port (0x3F7, output only, MODEL_5170 only)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     */
+    outFDCControl(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "CONTROL");
+        this.regControl  = bOut;
+    }
+
+    /**
+     * doCmd()
+     *
+     * @this {FDC}
+     */
+    doCmd()
+    {
+        var fIRQ = false;
+        this.regDataIndex = 0;
+        var bCmd = this.popCmd();
+        var drive, bDrive, bHead, c, h, r, n;
+
+        /*
+         * NOTE: We currently ignore the FDC.REG_DATA.CMD.SK, FDC.REG_DATA.CMD.MF and FDC.REG_DATA.CMD.MT bits of every command.
+         * The only command bit of possible interest down the road might be the FDC.REG_DATA.CMD.MT (Multi-Track); the rest relate
+         * to storage format details that we cannot emulate as long as our diskette images contain nothing more than sector
+         * data without any formatting data.
+         *
+         * Similarly, we ignore parameters like SRT, HUT, HLT and the like, since our "motors" don't require physical delays;
+         * however, if timing issues become compatibility issues, we'll have to revisit those delays.  In any case, the maximum
+         * speed of the simulation will still be limited by various spin-loops in the ROM BIOS that wait prescribed times, so even
+         * with infinitely fast hardware, the simulation will never run as fast as it theoretically could, unless we opt to identify
+         * those spin-loops and either patch them or skip over them.
+         */
+        var bCmdMasked = bCmd & FDC.REG_DATA.CMD.MASK;
+
+        switch (bCmdMasked) {
+        case FDC.REG_DATA.CMD.SPECIFY:                      // 0x03
+            this.popSRT();                                  // SRT and HUT (encodings?)
+            this.popHLT();                                  // HLT and ND (encodings?)
+            this.beginResult();
+            /*
+             * No results are provided by this command, and fIRQ should remain false
+             */
+            break;
+
+        case FDC.REG_DATA.CMD.SENSE_DRIVE:                  // 0x04
+            bDrive = this.popCmd(FDC.TERMS.DS);
+            bHead = (bDrive >> 2) & 0x1;
+            this.iDrive = (bDrive & 0x3);
+            drive = this.aDrives[this.iDrive];
+            this.beginResult();
+            this.pushST3(drive);
+            break;
+
+        case FDC.REG_DATA.CMD.WRITE_DATA:                   // 0x05
+        case FDC.REG_DATA.CMD.READ_DATA:                    // 0x06
+            bDrive = this.popCmd(FDC.TERMS.DS);             // Drive Select
+            bHead = (bDrive >> 2) & 0x1;                    // isolate HD (Head Select) bits
+            this.iDrive = (bDrive & 0x3);                   // isolate DS (Drive Select, aka Unit Select) bits
+            drive = this.aDrives[this.iDrive];
+            drive.bHead = bHead;
+            c = drive.bCylinder = this.popCmd(FDC.TERMS.C); // C
+            h = this.popCmd(FDC.TERMS.H);                   // H
+            /*
+             * Controller docs say that H should always match HD, so I assert that, but what if someone
+             * made a mistake and didn't program them identically -- what would happen?  Which should we honor?
+             */
+
+            r = drive.bSector = this.popCmd(FDC.TERMS.R);   // R
+            n = this.popCmd(FDC.TERMS.N);                   // N
+            drive.nBytes = 128 << n;                        // 0 => 128, 1 => 256, 2 => 512, 3 => 1024
+            drive.bSectorEnd = this.popCmd(FDC.TERMS.EOT);  // EOT (final sector number on a cylinder)
+            this.popCmd(FDC.TERMS.GPL);                     // GPL (spacing between sectors, excluding VCO Sync Field; 3)
+            this.popCmd(FDC.TERMS.DTL);                     // DTL (when N is 0, DTL stands for the data length to read out or write into the sector)
+            if (bCmdMasked == FDC.REG_DATA.CMD.READ_DATA)
+                this.doRead(drive);
+            else
+                this.doWrite(drive);
+            this.pushResults(drive, bCmd, bHead, c, h, r, n);
+            fIRQ = true;
+            break;
+
+        case FDC.REG_DATA.CMD.RECALIBRATE:                  // 0x07
+            bDrive = this.popCmd(FDC.TERMS.DS);
+            this.iDrive = (bDrive & 0x3);
+            drive = this.aDrives[this.iDrive];
+            drive.bCylinder = drive.bCylinderSeek = 0;
+            drive.resCode = FDC.REG_DATA.RES.SEEK_END | FDC.REG_DATA.RES.TRACK0;
+            this.beginResult();                             // no results provided; this command is typically followed by FDC.REG_DATA.CMD.SENSE_INT
+            fIRQ = true;
+            break;
+
+        case FDC.REG_DATA.CMD.SENSE_INT:                    // 0x08
+            drive = this.aDrives[this.iDrive];
+            drive.bHead = 0;                                // this command is documented as ALWAYS returning a head address of 0 in ST0; see pushST0()
+            this.beginResult();
+            this.pushST0(drive);
+            this.pushResult(drive.bCylinder, FDC.TERMS.PCN);
+            /*
+             * For some strange reason, the "DISK_RESET" function in the MODEL_5170_REV3 BIOS resets the
+             * adapter and then issues FOUR -- that's right, not ONE but FOUR -- SENSE INTERRUPT STATUS commands
+             * in a row, and expects ST0 to contain a different drive number after each command (first 0, then 1,
+             * then 2, and finally 3).  What makes this doubly weird is SENSE INTERRUPT STATUS (unlike SENSE
+             * DRIVE STATUS) is a drive-agnostic command.
+             *
+             * Didn't the original PC AT "HFCOMBO" controller limit support to TWO diskette drives max?
+             * And even if the PC AT supported other FDC controllers that DID support up to FOUR diskette drives,
+             * why should "DISK_RESET" hard-code a 4-drive loop?
+             *
+             * Well, whatever.  All this head-scratching doesn't change the fact that I apparently have to
+             * "auto-increment" the internal drive number (this.iDrive) after each SENSE INTERRUPT STATUS command.
+             */
+            this.iDrive = (this.iDrive + 1) & 0x3;
+            /*
+             * No interrupt is generated by this command, so fIRQ should remain false.
+             */
+            break;
+
+        case FDC.REG_DATA.CMD.READ_ID:                      // 0x0A
+            /*
+             * This command is used by "SETUP_DBL" in the MODEL_5170_REV3 BIOS to determine if a double-density
+             * (40-track) diskette has been inserted in a high-density (80-track) drive; ie, whether "double stepping"
+             * is required, since only 40 of the 80 possible "steps" are valid for a double-density diskette.
+             *
+             * To start, we'll focus on making this work in the normal case (80-track diskette in 80-track drive).
+             */
+            bDrive = this.popCmd(FDC.TERMS.DS);
+            bHead = (bDrive >> 2) & 0x1;
+            this.iDrive = (bDrive & 0x3);
+            drive = this.aDrives[this.iDrive];
+            c = drive.bCylinder;
+            h = drive.bHead = bHead;
+            r = drive.bSector = 1;
+            n = 0;
+            drive.resCode = FDC.REG_DATA.RES.NONE;
+            if (drive.disk && (drive.sector = drive.disk.seek(drive.bCylinder, drive.bHead, drive.bSector))) {
+                n = (drive.sector['length'] >> 8);
+            } else {
+                /*
+                 * TODO: Determine the appropriate response code(s) for the possible errors that can occur here.
+                 */
+                drive.resCode = FDC.REG_DATA.RES.NOT_READY | FDC.REG_DATA.RES.INCOMPLETE;
+            }
+            this.pushResults(drive, bCmd, bHead, c, h, r, n);
+            fIRQ = true;
+            break;
+
+        case FDC.REG_DATA.CMD.FORMAT_TRACK:                 // 0x0D
+            bDrive = this.popCmd(FDC.TERMS.DS);
+            bHead = (bDrive >> 2) & 0x1;
+            this.iDrive = (bDrive & 0x3);
+            drive = this.aDrives[this.iDrive];
+            c = drive.bCylinder;
+            h = drive.bHead = bHead;
+            r = 1;
+            n = this.popCmd(FDC.TERMS.N);                   // N
+            drive.nBytes = 128 << n;                        // 0 => 128, 1 => 256, 2 => 512, 3 => 1024 (bytes/sector)
+            drive.bSectorEnd = this.popCmd(FDC.TERMS.SC);   // SC (sectors/track)
+            this.popCmd(FDC.TERMS.GPL);                     // GPL (spacing between sectors, excluding VCO Sync Field; 3)
+            drive.bFiller = this.popCmd(FDC.TERMS.D);       // D (filler byte)
+            this.doFormat(drive);
+            this.pushResults(drive, bCmd, bHead, c, h, r, n);
+            fIRQ = true;
+            break;
+
+        case FDC.REG_DATA.CMD.SEEK:                         // 0x0F
+            bDrive = this.popCmd(FDC.TERMS.DS);
+            bHead = (bDrive >> 2) & 0x1;
+            this.iDrive = (bDrive & 0x3);
+            drive = this.aDrives[this.iDrive];
+            drive.bHead = bHead;
+            /*
+             * As discussed in initDrive(), we can no longer simply set bCylinder to the specified NCN;
+             * instead, we must calculate the delta between bCylinderSeek and the NCN, and adjust bCylinder
+             * by that amount.  Then we simply move the NCN into bCylinderSeek without any range checking.
+             *
+             * Since bCylinder is now expressly defined as the "physical" cylinder number, it must never
+             * be allowed to exceed the physical boundaries of the drive (ie, never lower than 0, and never
+             * greater than or equal to nCylinders).
+             */
+            c = this.popCmd(FDC.TERMS.NCN);
+            drive.bCylinder += c - drive.bCylinderSeek;
+            if (drive.bCylinder < 0) drive.bCylinder = 0;
+            if (drive.bCylinder >= drive.nCylinders) drive.bCylinder = drive.nCylinders - 1;
+            drive.bCylinderSeek = c;
+            drive.resCode = FDC.REG_DATA.RES.SEEK_END;
+            /*
+             * TODO: To properly support ALL the ST3 result bits (not just TRACK0), we need a resCode
+             * update() function that all FDC commands can use.  This code is merely sufficient to get us
+             * through the "DSKETTE_SETUP" gauntlet in the MODEL_5170 BIOS.
+             */
+            if (!drive.bCylinder) {
+                drive.resCode |= FDC.REG_DATA.RES.TRACK0;
+            }
+            this.beginResult();                             // like FDC.REG_DATA.CMD.RECALIBRATE, no results are provided
+            fIRQ = true;
+            break;
+
+        default:
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage("unsupported FDC operation: " + Str.toHexByte(bCmd));
+                if (MAXDEBUG) this.dbg.stopCPU();
+            }
+            break;
+        }
+
+        if (this.regDataTotal > 0) {
+            this.regStatus |= (FDC.REG_STATUS.READ_DATA | FDC.REG_STATUS.BUSY);
+        }
+
+        /*
+         * After the Execution Phase (eg, DMA Terminal Count has occurred, or the EOT sector has been read/written),
+         * an interrupt is supposed to occur, signaling the beginning of the Result Phase.  Once the first byte of the
+         * result has been read, the interrupt is cleared (see inFDCData).
+         *
+         * TODO: Technically, interrupt request status should be cleared by the FDC.REG_DATA.CMD.SENSE_INT command; in fact,
+         * if that command is issued and no interrupt was pending, then FDC.REG_DATA.RES.INVALID should be returned (via ST0).
+         */
+        if (this.regOutput & FDC.REG_OUTPUT.INT_ENABLE) {
+            if (drive && !(drive.resCode & FDC.REG_DATA.RES.NOT_READY) && fIRQ) {
+                if (this.chipset) this.chipset.setIRR(ChipSet.IRQ.FDC);
+            }
+        }
+    }
+
+    /**
+     * pushResults(drive, bCmd, bHead, c, h, r, n)
+     *
+     * @param {Object} drive
+     * @param {number} bCmd
+     * @param {number} bHead
+     * @param {number} c
+     * @param {number} h
+     * @param {number} r
+     * @param {number} n
+     */
+    pushResults(drive, bCmd, bHead, c, h, r, n)
+    {
+        this.beginResult();
+        this.pushST0(drive);
+        this.pushST1(drive);
+        this.pushST2(drive);
+        /*
+         * NOTE: I used to set the following C/H/R/N results using the values that advanceSector() had "advanced"
+         * them to, which seemed logical but was technically incorrect.  For non-multi-track reads, they should match
+         * the programmed C/H/R/N values, except when EOT has been reached, in which case C = C + 1 and R = 1.
+         *
+         * For multi-track, the LSB of H should be complemented whenever EOT has been reached, which I "informally"
+         * detect by testing if the drive's current bCylinder and/or bHead positions advanced to a new cylinder or head,
+         * and apparently, C should never be advanced if H was initially 0.
+         *
+         * I don't do strict EOT comparisons here or elsewhere, because it allows the controller to work with a wider
+         * range of disks (eg, "fake" XDF disk images that contain 23 512-byte sectors/track).
+         */
+        var i = 0;
+        if (c != drive.bCylinder || h != drive.bHead) {
+            i = r = 1;
+        }
+        if (bCmd & FDC.REG_DATA.CMD.MT) {
+            h ^= i;
+            if (!bHead) i = 0;
+        }
+        c += i;
+        this.pushResult(c, FDC.TERMS.C);                // formerly drive.bCylinder
+        this.pushResult(h, FDC.TERMS.H);                // formerly drive.bHead
+        this.pushResult(r, FDC.TERMS.R);                // formerly drive.bSector
+        this.pushResult(n, FDC.TERMS.N);
+    }
+
+    /**
+     * popCmd(name)
+     *
+     * @this {FDC}
+     * @param {string|undefined} [name]
+     * @return {number}
+     */
+    popCmd(name)
+    {
+
+        var bCmd = this.regDataArray[this.regDataIndex];
+        if (DEBUG && this.messageEnabled(Messages.PORT | Messages.FDC)) {
+            var bCmdMasked = bCmd & FDC.REG_DATA.CMD.MASK;
+            if (!name && !this.regDataIndex && FDC.aCmdInfo[bCmdMasked]) name = FDC.aCmdInfo[bCmdMasked].name;
+            this.printMessage(this.idComponent + ".popCmd(" + (name || this.regDataIndex) + "): " + Str.toHexByte(bCmd), true);
+        }
+        this.regDataIndex++;
+        return bCmd;
+    }
+
+    /**
+     * popHLT()
+     *
+     * NOTE: This byte is actually a combination of HLT (Head Load Time) and ND (Non-DMA Mode)
+     *
+     * @this {FDC}
+     */
+    popHLT()
+    {
+        this.popCmd(FDC.TERMS.HLT);
+     // this.nHLT = this.popCmd(FDC.TERMS.HLT);
+    }
+
+    /**
+     * popSRT()
+     *
+     * NOTE: This byte is actually a combination of SRT (Step Rate Time) and HUT (Head Unload Time)
+     *
+     * @this {FDC}
+     */
+    popSRT()
+    {
+        this.popCmd(FDC.TERMS.SRT);
+     // this.nSRT = this.popCmd(FDC.TERMS.SRT);
+    }
+
+    /**
+     * beginResult()
+     *
+     * @this {FDC}
+     */
+    beginResult()
+    {
+        this.regDataIndex = this.regDataTotal = 0;
+    }
+
+    /**
+     * pushResult(bResult, name)
+     *
+     * @this {FDC}
+     * @param {number} bResult
+     * @param {string|undefined} [name]
+     */
+    pushResult(bResult, name)
+    {
+        if (DEBUG && this.messageEnabled(Messages.PORT | Messages.FDC)) {
+            this.printMessage(this.idComponent + ".pushResult(" + (name || this.regDataTotal) + "): " + Str.toHexByte(bResult), true);
+        }
+
+        this.regDataArray[this.regDataTotal++] = bResult;
+    }
+
+    /**
+     * pushST0(drive)
+     *
+     * @this {FDC}
+     * @param {Object} drive
+     */
+    pushST0(drive)
+    {
+        this.pushResult(drive.iDrive | (drive.bHead << 2) | (drive.resCode & FDC.REG_DATA.RES.ST0), FDC.TERMS.ST0);
+    }
+
+    /**
+     * pushST1(drive)
+     *
+     * @this {FDC}
+     * @param {Object} drive
+     */
+    pushST1(drive)
+    {
+        this.pushResult((drive.resCode & FDC.REG_DATA.RES.ST1) >>> 8, FDC.TERMS.ST1);
+    }
+
+    /**
+     * pushST2(drive)
+     *
+     * @this {FDC}
+     * @param {Object} drive
+     */
+    pushST2(drive)
+    {
+        this.pushResult((drive.resCode & FDC.REG_DATA.RES.ST2) >>> 16, FDC.TERMS.ST2);
+    }
+
+    /**
+     * pushST3(drive)
+     *
+     * @this {FDC}
+     * @param {Object} drive
+     */
+    pushST3(drive)
+    {
+        this.pushResult((drive.resCode & FDC.REG_DATA.RES.ST3) >>> 24, FDC.TERMS.ST3);
+    }
+
+    /**
+     * doDMARead(drive, b, done)
+     *
+     * @this {FDC}
+     * @param {Object} drive
+     * @param {number} b
+     * @param {function(number,boolean)} done
+     */
+    doDMARead(drive, b, done)
+    {
+        if (b === undefined || b < 0) {
+            this.readData(drive, done);
+            return;
+        }
+        /*
+         * The DMA controller should be ASKING for data, not GIVING us data; this suggests an internal DMA miscommunication
+         */
+        if (DEBUG) this.printMessage(this.idComponent + ".doDMARead(): invalid DMA acknowledgement");
+        done(-1, false);
+    }
+
+    /**
+     * doDMAWrite(drive, b)
+     *
+     * @this {FDC}
+     * @param {Object} drive
+     * @param {number} b
+     * @return {number}
+     */
+    doDMAWrite(drive, b)
+    {
+        if (b !== undefined && b >= 0)
+            return this.writeData(drive, b);
+        /*
+         * The DMA controller should be GIVING us data, not ASKING for data; this suggests an internal DMA miscommunication
+         */
+        if (DEBUG) this.printMessage(this.idComponent + ".doDMAWrite(): invalid DMA acknowledgement");
+        return -1;
+    }
+
+    /**
+     * doDMAFormat(drive, b)
+     *
+     * @this {FDC}
+     * @param {Object} drive
+     * @param {number} b
+     * @returns {number}
+     */
+    doDMAFormat(drive, b)
+    {
+        if (b !== undefined && b >= 0)
+            return this.writeFormat(drive, b);
+        /*
+         * The DMA controller should be GIVING us data, not ASKING for data; this suggests an internal DMA miscommunication
+         */
+        if (DEBUG) this.printMessage(this.idComponent + ".doDMAFormat(): invalid DMA acknowledgement");
+        return -1;
+    }
+
+    /**
+     * doRead(drive)
+     *
+     * @this {FDC}
+     * @param {Object} drive
+     */
+    doRead(drive)
+    {
+        /*
+         * With only NOT_READY and INCOMPLETE set, an empty drive causes DOS to report "General Failure";
+         * with the addition of NO_DATA, DOS reports "Sector not found".  The traditional "Drive not ready"
+         * error message is not triggered by anything we return here, but simply by BIOS commands timing out.
+         */
+        drive.resCode = FDC.REG_DATA.RES.NOT_READY | FDC.REG_DATA.RES.INCOMPLETE;
+
+        if (drive.disk) {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage(this.idComponent + ".doRead(CHS=" + drive.bCylinder + ':' + drive.bHead + ':' + drive.bSector + ",PBA=" + (drive.bCylinder * (drive.disk.nHeads * drive.disk.nSectors) + drive.bHead * drive.disk.nSectors + drive.bSector-1) + ')');
+            }
+            drive.sector = null;
+            drive.resCode = FDC.REG_DATA.RES.NONE;
+            if (this.chipset) {
+                this.chipset.connectDMA(ChipSet.DMA_FDC, this, 'dmaRead', drive);
+                this.chipset.requestDMA(ChipSet.DMA_FDC);
+            }
+        }
+    }
+
+    /**
+     * doWrite(drive)
+     *
+     * @this {FDC}
+     * @param {Object} drive
+     */
+    doWrite(drive)
+    {
+        drive.resCode = FDC.REG_DATA.RES.NOT_READY | FDC.REG_DATA.RES.INCOMPLETE;
+
+        if (drive.disk) {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage(this.idComponent + ".doWrite(CHS=" + drive.bCylinder + ':' + drive.bHead + ':' + drive.bSector + ",PBA=" + (drive.bCylinder * (drive.disk.nHeads * drive.disk.nSectors) + drive.bHead * drive.disk.nSectors + drive.bSector-1) + ')');
+            }
+            if (drive.disk.fWriteProtected) {
+                drive.resCode = FDC.REG_DATA.RES.NOT_WRITABLE | FDC.REG_DATA.RES.INCOMPLETE;
+                return;
+            }
+            drive.sector = null;
+            drive.resCode = FDC.REG_DATA.RES.NONE;
+            if (this.chipset) {
+                this.chipset.connectDMA(ChipSet.DMA_FDC, this, 'dmaWrite', drive);
+                this.chipset.requestDMA(ChipSet.DMA_FDC);
+            }
+        }
+    }
+
+    /**
+     * doFormat(drive)
+     *
+     * drive is initialized by doCmd() to the following extent:
+     *
+     *      drive.bHead (ignored)
+     *      drive.nBytes (bytes/sector)
+     *      drive.bSectorEnd (sectors/track)
+     *      drive.bFiller (fill byte)
+     *
+     * and we expect the DMA controller to provide C, H, R and N (ie, 4 bytes) for each sector to be formatted.
+     *
+     * @this {FDC}
+     * @param {Object} drive
+     */
+    doFormat(drive)
+    {
+        drive.resCode = FDC.REG_DATA.RES.NOT_READY | FDC.REG_DATA.RES.INCOMPLETE;
+
+        if (drive.disk) {
+            drive.sector = null;
+            drive.resCode = FDC.REG_DATA.RES.NONE;
+            if (this.chipset) {
+                drive.cbFormat = 0;
+                drive.abFormat = new Array(4);
+                drive.bFormatting = true;
+                drive.cSectorsFormatted = 0;
+                this.chipset.connectDMA(ChipSet.DMA_FDC, this, 'dmaFormat', drive);
+                this.chipset.requestDMA(ChipSet.DMA_FDC);
+                drive.bFormatting = false;
+            }
+        }
+    }
+
+    /**
+     * readData(drive, done)
+     *
+     * The following drive properties must have been setup prior to our first call:
+     *
+     *      drive.bHead
+     *      drive.bCylinder
+     *      drive.bSector
+     *      drive.sector (initialized to null)
+     *
+     * On the first readData() request, since drive.sector will be null, we ask the Disk object to look
+     * up the first sector of the request.  We then ask the Disk for bytes from that sector until the sector
+     * is exhausted, and then we look up the next sector and continue the process.
+     *
+     * NOTE: Since the FDC isn't aware of the extent of the transfer, all readData() can do is return bytes
+     * until the current track (or, in the case of a multi-track request, the current cylinder) has been exhausted.
+     *
+     * TODO: Research the requirements, if any, for multi-track I/O and determine what else needs to be done.
+     *
+     * @this {FDC}
+     * @param {Object} drive
+     * @param {function(number,boolean,Object,number)} done (number is next available byte from drive, or -1 if no more bytes available)
+     */
+    readData(drive, done)
+    {
+        var b = -1;
+        var obj = null, off = 0;    // these variables are purely for BACKTRACK purposes
+
+        if (!drive.resCode && drive.disk) {
+            do {
+                if (drive.sector) {
+                    off = drive.ibSector;
+                    if ((b = drive.disk.read(drive.sector, drive.ibSector++)) >= 0) {
+                        obj = drive.sector;
+                        break;
+                    }
+                }
+                /*
+                 * Locate the next sector, and then try reading again.
+                 */
+                drive.sector = drive.disk.seek(drive.bCylinder, drive.bHead, drive.bSector);
+                if (!drive.sector) {
+                    drive.resCode = FDC.REG_DATA.RES.NO_DATA | FDC.REG_DATA.RES.INCOMPLETE;
+                    break;
+                }
+                drive.ibSector = 0;
+                /*
+                 * We "pre-advance" bSector et al now, instead of waiting to advance it right before the seek().
+                 * This allows the initial call to readData() to perform a seek without triggering an unwanted advance.
+                 */
+                this.advanceSector(drive);
+            } while (true);
+        }
+        done(b, false, obj, off);
+    }
+
+    /**
+     * writeData(drive, b)
+     *
+     * The following drive properties must have been setup prior to our first call:
+     *
+     *      drive.bHead
+     *      drive.bCylinder
+     *      drive.bSector
+     *      drive.sector (initialized to null)
+     *
+     * On the first writeData() request, since drive.sector will be null, we ask the Disk object to look
+     * up the first sector of the request.  We then send the Disk bytes for that sector until the sector
+     * is full, and then we look up the next sector and continue the process.
+     *
+     * NOTE: Since the FDC isn't aware of the extent of the transfer, all writeData() can do is accept bytes
+     * until the current track (or, in the case of a multi-track request, the current cylinder) has been exhausted.
+     *
+     * TODO: Research the requirements, if any, for multi-track I/O and determine what else needs to be done.
+     *
+     * @this {FDC}
+     * @param {Object} drive
+     * @param {number} b containing next byte to write
+     * @return {number} (b unchanged; return -1 if command should be terminated)
+     */
+    writeData(drive, b)
+    {
+        if (drive.resCode || !drive.disk) return -1;
+        do {
+            if (drive.sector) {
+                if (drive.disk.write(drive.sector, drive.ibSector++, b))
+                    break;
+            }
+            /*
+             * Locate the next sector, and then try writing again.
+             */
+            drive.sector = drive.disk.seek(drive.bCylinder, drive.bHead, drive.bSector);
+            if (!drive.sector) {
+                /*
+                 * TODO: Determine whether this should be FDC.REG_DATA.RES.CRC_ERROR or FDC.REG_DATA.RES.DATA_FIELD
+                 */
+                drive.resCode = FDC.REG_DATA.RES.CRC_ERROR | FDC.REG_DATA.RES.INCOMPLETE;
+                b = -1;
+                break;
+            }
+            drive.ibSector = 0;
+            /*
+             * We "pre-advance" bSector et al now, instead of waiting to advance it right before the seek().
+             * This allows the initial call to writeData() to perform a seek without triggering an unwanted advance.
+             */
+            this.advanceSector(drive);
+        } while (true);
+        return b;
+    }
+
+    /**
+     * advanceSector(drive)
+     *
+     * This increments the sector number; when the sector number reaches drive.nDiskSectors on the current track, we
+     * increment drive.bHead and reset drive.bSector, and when drive.bHead reaches drive.nDiskHeads, we reset drive.bHead
+     * and increment drive.bCylinder.
+     *
+     * @this {FDC}
+     * @param {Object} drive
+     */
+    advanceSector(drive)
+    {
+
+        drive.bSector++;
+        var bSectorStart = 1;
+        if (drive.bSector >= drive.nDiskSectors + bSectorStart) {
+            drive.bSector = bSectorStart;
+            drive.bHead++;
+            if (drive.bHead >= drive.nDiskHeads) {
+                drive.bHead = 0;
+                drive.bCylinder++;
+            }
+        }
+    }
+
+    /**
+     * writeFormat(drive, b)
+     *
+     * @this {FDC}
+     * @param {Object} drive
+     * @param {number} b containing a format command byte
+     * @return {number} (b if successful, -1 if command should be terminated)
+     */
+    writeFormat(drive, b)
+    {
+        if (drive.resCode) return -1;
+        drive.abFormat[drive.cbFormat++] = b;
+        if (drive.cbFormat == drive.abFormat.length) {
+            drive.bCylinder = drive.abFormat[0];    // C
+            drive.bHead = drive.abFormat[1];        // H
+            drive.bSector = drive.abFormat[2];      // R
+            drive.nBytes = 128 << drive.abFormat[3];// N (0 => 128, 1 => 256, 2 => 512, 3 => 1024)
+            drive.cbFormat = 0;
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage(this.idComponent + ".writeFormat(head=" + Str.toHexByte(drive.bHead) + ",cyl=" + Str.toHexByte(drive.bCylinder) + ",sec=" + Str.toHexByte(drive.bSector) + ",len=" + Str.toHexWord(drive.nBytes) + ")");
+            }
+            for (var i = 0; i < drive.nBytes; i++) {
+                if (this.writeData(drive, drive.bFiller) < 0) {
+                    return -1;
+                }
+            }
+            drive.cSectorsFormatted++;
+        }
+        if (drive.cSectorsFormatted >= drive.bSectorEnd) b = -1;
+        return b;
+    }
+
+    /**
+     * FDC.init()
+     *
+     * This function operates on every HTML element of class "fdc", extracting the
+     * JSON-encoded parameters for the FDC constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a FDC component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeFDC = Component.getElementsByClass(document, PCX86.APPCLASS, "fdc");
+        for (var iFDC = 0; iFDC < aeFDC.length; iFDC++) {
+            var eFDC = aeFDC[iFDC];
+            var parmsFDC = Component.getComponentParms(eFDC);
+            var fdc = new FDC(parmsFDC);
+            Component.bindComponentControls(fdc, eFDC, PCX86.APPCLASS);
+        }
+    }
+}
+
+FDC.DEFAULT_DRIVE_NAME = "Floppy Drive";
+
+if (DEBUG) {
+    FDC.TERMS = {
+        C:   "C",       // Cylinder Number
+        D:   "D",       // Data (eg, pattern to be written to a sector)
+        H:   "H",       // Head Address
+        R:   "R",       // Record (ie, sector number to be read or written)
+        N:   "N",       // Number (ie, number of data bytes to write)
+        DS:  "DS",      // Drive Select
+        SC:  "SC",      // Sectors per Cylinder
+        DTL: "DTL",     // Data Length
+        EOT: "EOT",     // End of Track
+        GPL: "GPL",     // Gap Length
+        HLT: "HLT",     // Head Load Time
+        NCN: "NCN",     // New Cylinder Number
+        PCN: "PCN",     // Present Cylinder Number
+        SRT: "SRT",     // Stepping Rate
+        ST0: "ST0",     // Status Register 0
+        ST1: "ST1",     // Status Register 1
+        ST2: "ST2",     // Status Register 2
+        ST3: "ST3"      // Status Register 3
+    };
+} else {
+    FDC.TERMS = {};
+}
+
+/*
+ * FDC Digital Output Register (DOR) (0x3F2, write-only)
+ *
+ * NOTE: Reportedly, a drive's MOTOR had to be ON before the drive could be selected; however, outFDCOutput() no
+ * longer verifies that.  Also, motor start time for original drives was 500ms, but we make no attempt to simulate that.
+ *
+ * On the MODEL_5170 "PC AT Fixed Disk and Diskette Drive Adapter", this port is called the Digital Output Register
+ * or DOR.  It uses the same bit definitions as the original FDC Output Register, except that only two diskette drives
+ * are supported, hence bit 1 is always 0 (ie, FDC.REG_OUTPUT.DS2 and FDC.REG_OUTPUT.DS3 are not supported) and bits
+ * 6 and 7 are unused (FDC.REG_OUTPUT.MOTOR_D2 and FDC.REG_OUTPUT.MOTOR_D3 are not supported).
+ */
+FDC.REG_OUTPUT = {
+    PORT:      0x3F2,
+    DS:         0x03,   // drive select bits
+    DS0:        0x00,
+    DS1:        0x01,
+    DS2:        0x02,   // reserved on the MODEL_5170
+    DS3:        0x03,   // reserved on the MODEL_5170
+    ENABLE:     0x04,   // clearing this bit resets the FDC
+    INT_ENABLE: 0x08,   // enables both FDC and DMA (Channel 2) interrupt requests (IRQ 6)
+    MOTOR_D0:   0x10,
+    MOTOR_D1:   0x20,
+    MOTOR_D2:   0x40,   // reserved on the MODEL_5170
+    MOTOR_D3:   0x80    // reserved on the MODEL_5170
+};
+
+/*
+ * FDC Main Status Register (0x3F4, read-only)
+ *
+ * On the MODEL_5170 "PC AT Fixed Disk and Diskette Drive Adapter", bits 2 and 3 are reserved, since that adapter
+ * supported a maximum of two diskette drives.
+ */
+FDC.REG_STATUS = {
+    PORT:      0x3F4,
+    BUSY_A:     0x01,
+    BUSY_B:     0x02,
+    BUSY_C:     0x04,   // reserved on the MODEL_5170
+    BUSY_D:     0x08,   // reserved on the MODEL_5170
+    BUSY:       0x10,   // a read or write command is in progress
+    NON_DMA:    0x20,   // FDC is in non-DMA mode
+    READ_DATA:  0x40,   // transfer is from FDC Data Register to processor (if clear, then transfer is from processor to the FDC Data Register)
+    RQM:        0x80    // indicates FDC Data Register is ready to send or receive data to or from the processor (Request for Master)
+};
+
+/*
+ * FDC Data Register (0x3F5, read-write)
+ */
+FDC.REG_DATA = {
+    PORT:      0x3F5,
+    /*
+     * FDC Commands
+     *
+     * NOTE: FDC command bytes need to be masked with FDC.REG_DATA.CMD.MASK before comparing to the values below, since a
+     * number of commands use the following additional bits as follows:
+     *
+     *      SK (0x20): Skip Deleted Data Address Mark
+     *      MF (0x40): Modified Frequency Modulation (as opposed to FM or Frequency Modulation)
+     *      MT (0x80): multi-track operation (ie, data processed under both head 0 and head 1)
+     *
+     * We don't support MT (Multi-Track) operations at this time, and the MF and SK designations cannot be supported as long
+     * as our diskette images contain only the original data bytes without any formatting information.
+     */
+    CMD: {
+        READ_TRACK:     0x02,
+        SPECIFY:        0x03,
+        SENSE_DRIVE:    0x04,
+        WRITE_DATA:     0x05,
+        READ_DATA:      0x06,
+        RECALIBRATE:    0x07,
+        SENSE_INT:      0x08,       // this command is used to clear the FDC interrupt following the clearing/setting of FDC.REG_OUTPUT.ENABLE
+        WRITE_DEL_DATA: 0x09,
+        READ_ID:        0x0A,
+        READ_DEL_DATA:  0x0C,
+        FORMAT_TRACK:   0x0D,
+        SEEK:           0x0F,
+        SCAN_EQUAL:     0x11,
+        SCAN_LO_EQUAL:  0x19,
+        SCAN_HI_EQUAL:  0x1D,
+        MASK:           0x1F,
+        SK:             0x20,       // SK (Skip Deleted Data Address Mark)
+        MF:             0x40,       // MF (Modified Frequency Modulation)
+        MT:             0x80        // MT (Multi-Track; ie, data under both heads will be processed)
+    },
+    /*
+     * FDC status/error results, generally assigned according to the corresponding ST0, ST1, ST2 or ST3 status bit.
+     *
+     * TODO: Determine when EQUIP_CHECK is *really* set; also, "77 step pulses" sounds suspiciously like a typo (it's not 79?)
+     */
+    RES: {
+        NONE:           0x00000000, // ST0 (IC): Normal termination of command (NT)
+        NOT_READY:      0x00000008, // ST0 (NR): When the FDD is in the not-ready state and a read or write command is issued, this flag is set; if a read or write command is issued to side 1 of a single sided drive, then this flag is set
+        EQUIP_CHECK:    0x00000010, // ST0 (EC): If a fault signal is received from the FDD, or if the track 0 signal fails to occur after 77 step pulses (recalibrate command), then this flag is set
+        SEEK_END:       0x00000020, // ST0 (SE): When the FDC completes the Seek command, this flag is set to 1 (high)
+        INCOMPLETE:     0x00000040, // ST0 (IC): Abnormal termination of command (AT); execution of command was started, but was not successfully completed
+        RESET:          0x000000C0, // ST0 (IC): Abnormal termination because during command execution the ready signal from the drive changed state
+        INVALID:        0x00000080, // ST0 (IC): Invalid command issue (IC); command which was issued was never started
+        ST0:            0x000000FF,
+        NO_ID_MARK:     0x00000100, // ST1 (MA): If the FDC cannot detect the ID Address Mark, this flag is set; at the same time, the MD (Missing Address Mark in Data Field) of Status Register 2 is set
+        NOT_WRITABLE:   0x00000200, // ST1 (NW): During Execution of a Write Data, Write Deleted Data, or Format a Cylinder command, if the FDC detects a write protect signal from the FDD, then this flag is set
+        NO_DATA:        0x00000400, // ST1 (ND): FDC cannot find specified sector (or specified ID if READ_ID command)
+        DMA_OVERRUN:    0x00001000, // ST1 (OR): If the FDC is not serviced by the main systems during data transfers within a certain time interval, this flag is set
+        CRC_ERROR:      0x00002000, // ST1 (DE): When the FDC detects a CRC error in either the ID field or the data field, this flag is set
+        END_OF_CYL:     0x00008000, // ST1 (EN): When the FDC tries to access a sector beyond the final sector of a cylinder, this flag is set
+        ST1:            0x0000FF00,
+        NO_DATA_MARK:   0x00010000, // ST2 (MD): When data is read from the medium, if the FDC cannot find a Data Address Mark or Deleted Data Address Mark, then this flag is set
+        BAD_CYL:        0x00020000, // ST2 (BC): This bit is related to the ND bit, and when the contents of C on the medium are different from that stored in the ID Register, and the content of C is FF, then this flag is set
+        SCAN_FAILED:    0x00040000, // ST2 (SN): During execution of the Scan command, if the FDC cannot find a sector on the cylinder which meets the condition, then this flag is set
+        SCAN_EQUAL:     0x00080000, // ST2 (SH): During execution of the Scan command, if the condition of "equal" is satisfied, this flag is set
+        WRONG_CYL:      0x00100000, // ST2 (WC): This bit is related to the ND bit, and when the contents of C on the medium are different from that stored in the ID Register, this flag is set
+        DATA_FIELD:     0x00200000, // ST2 (DD): If the FDC detects a CRC error in the data, then this flag is set
+        STRL_MARK:      0x00400000, // ST2 (CM): During execution of the Read Data or Scan command, if the FDC encounters a sector which contains a Deleted Data Address Mark, this flag is set
+        ST2:            0x00FF0000,
+        DRIVE:          0x03000000, // ST3 (Ux): Status of the "Drive Select" signals from the diskette drive
+        HEAD:           0x04000000, // ST3 (HD): Status of the "Side Select" signal from the diskette drive
+        TWOSIDE:        0x08000000, // ST3 (TS): Status of the "Two Side" signal from the diskette drive
+        TRACK0:         0x10000000, // ST3 (T0): Status of the "Track 0" signal from the diskette drive
+        READY:          0x20000000, // ST3 (RY): Status of the "Ready" signal from the diskette drive
+        WRITEPROT:      0x40000000, // ST3 (WP): Status of the "Write Protect" signal from the diskette drive
+        FAULT:          0x80000000|0, // ST3 (FT): Status of the "Fault" signal from the diskette drive
+        ST3:            0xFF000000|0
+    }
+};
+
+/*
+ * FDC "Fixed Disk" Register (0x3F6, write-only)
+ *
+ * Since this register's functions are all specific to the Hard Drive Controller, see the HDC component for details.
+ * The fact that this HDC register is in the middle of the FDC I/O port range is an oddity of the "HFCOMBO" controller.
+ */
+
+/*
+ * FDC Digital Input Register (0x3F7, read-only, MODEL_5170 only)
+ *
+ * Bit 7 indicates a diskette change (the MODEL_5170 introduced change-line support).  Bits 0-6 are for the selected
+ * hard drive, so this port must be shared with the HDC; bits 0-6 are valid for 50 microseconds after a write to the
+ * Drive Head Register.
+ */
+FDC.REG_INPUT = {
+    PORT:      0x3F7,
+    DS0:        0x01,   // Drive Select 0
+    DS1:        0x02,   // Drive Select 1
+    HS0:        0x04,   // Head Select 0
+    HS1:        0x08,   // Head Select 1
+    HS2:        0x10,   // Head Select 2
+    HS3:        0x20,   // Head Select 3
+    WRITE_GATE: 0x40,   // Write Gate
+    DISK_CHANGE:0x80    // Diskette Change
+};
+
+/*
+ * FDC Diskette Control Register (0x3F7, write-only, MODEL_5170 only)
+ *
+ * Only bits 0-1 are used; bits 2-7 are reserved.
+ */
+FDC.REG_CONTROL = {
+    PORT:      0x3F7,
+    RATE500K:   0x00,   // 500,000 bps
+    RATE300K:   0x02,   // 300,000 bps
+    RATE250K:   0x01,   // 250,000 bps
+    RATEUNUSED: 0x03
+};
+
+/*
+ * FDC Command Sequences
+ *
+ * For each command, cbReq indicates the total number of bytes in the command request sequence,
+ * including the first (command) byte; cbRes indicates total number of bytes in the response sequence.
+ */
+if (DEBUG) {
+    FDC.CMDS = {
+        SPECIFY:      "SPECIFY",
+        SENSE_DRIVE:  "SENSE DRIVE",
+        WRITE_DATA:   "WRITE DATA",
+        READ_DATA:    "READ DATA",
+        RECALIBRATE:  "RECALIBRATE",
+        SENSE_INT:    "SENSE INTERRUPT",
+        READ_ID:      "READ ID",
+        FORMAT:       "FORMAT",
+        SEEK:         "SEEK"
+    };
+} else {
+    FDC.CMDS = {};
+}
+
+FDC.aCmdInfo = {
+    0x03: {cbReq: 3, cbRes: 0, name: FDC.CMDS.SPECIFY},
+    0x04: {cbReq: 2, cbRes: 1, name: FDC.CMDS.SENSE_DRIVE},
+    0x05: {cbReq: 9, cbRes: 7, name: FDC.CMDS.WRITE_DATA},
+    0x06: {cbReq: 9, cbRes: 7, name: FDC.CMDS.READ_DATA},
+    0x07: {cbReq: 2, cbRes: 0, name: FDC.CMDS.RECALIBRATE},
+    0x08: {cbReq: 1, cbRes: 2, name: FDC.CMDS.SENSE_INT},
+    0x0A: {cbReq: 2, cbRes: 7, name: FDC.CMDS.READ_ID},
+    0x0D: {cbReq: 6, cbRes: 7, name: FDC.CMDS.FORMAT},
+    0x0F: {cbReq: 3, cbRes: 0, name: FDC.CMDS.SEEK}
+};
+
+/*
+ * Port input notification table
+ *
+ * TODO: Even though port 0x3F7 was not present on controllers prior to MODEL_5170, I'm taking the easy
+ * way out and always emulating it.  So, consider an FDC parameter to disable that feature for stricter compatibility.
+ */
+FDC.aPortInput = {
+    0x3F1: FDC.prototype.inFDCDiagnostic,
+    0x3F4: FDC.prototype.inFDCStatus,
+    0x3F5: FDC.prototype.inFDCData,
+    0x3F7: FDC.prototype.inFDCInput
+};
+
+/*
+ * Port output notification table
+ *
+ * TODO: Even though port 0x3F7 was not present on controllers prior to MODEL_5170, I'm taking the easy
+ * way out and always emulating it.  So, consider an FDC parameter to disable that feature for stricter compatibility.
+ */
+FDC.aPortOutput = {
+    0x3F2: FDC.prototype.outFDCOutput,
+    0x3F5: FDC.prototype.outFDCData,
+    0x3F7: FDC.prototype.outFDCControl
+};
+
+/*
+ * Initialize every Floppy Drive Controller (FDC) module on the page.
+ */
+Web.onInit(FDC.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/hdc.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class HDC extends Component {
+    /**
+     * HDC(parmsHDC)
+     *
+     * The HDC component simulates an STC-506/412 interface to an IBM-compatible fixed disk drive. The first
+     * such drive was a 10Mb 5.25-inch drive containing two platters and 4 heads. Data spanned 306 cylinders
+     * for a total of 1224 tracks, with 17 sectors/track and 512 bytes/sector.  Support has since been expanded
+     * to include the original PC AT Western Digital controller.
+     *
+     * HDC supports the following component-specific properties:
+     *
+     *      drives: an array of driveConfig objects, each containing 'name', 'path', 'size' and 'type' properties
+     *      type:   either 'xt' (for the PC XT Xebec controller) or 'at' (for the PC AT Western Digital controller)
+     *
+     * The 'type' parameter defaults to 'xt'.  All ports for the PC XT controller are referred to as XTC ports,
+     * and similarly, all PC AT controller ports are referred to as ATC ports.
+     *
+     * If 'path' is empty, a scratch disk image is created; otherwise, we make a note of the path, but we will NOT
+     * pre-load it like we do for floppy disk images.
+     *
+     * My current plan is to read all disk data on-demand, keeping a cache of what we've read, and possibly adding
+     * some read-ahead as well. Any portions of the disk image that are written before being read will never be read.
+     *
+     * TRIVIA: On p.1-179 of the PC XT Technical Reference Manual (revised APR83), it reads:
+     *
+     *      "WARNING: The last cylinder on the fixed disk drive is reserved for diagnostic use.
+     *      Diagnostic write tests will destroy any data on this cylinder."
+     *
+     * Does FDISK insure that the last cylinder is reserved?  I'm sure we'll eventually find out.
+     *
+     * @this {HDC}
+     * @param {Object} parmsHDC
+     */
+    constructor(parmsHDC)
+    {
+        super("HDC", parmsHDC, Messages.HDC);
+
+        this['dmaRead'] = HDC.prototype.doDMARead;
+        this['dmaWrite'] = HDC.prototype.doDMAWrite;
+        this['dmaWriteBuffer'] = HDC.prototype.doDMAWriteBuffer;
+        this['dmaWriteFormat'] = HDC.prototype.doDMAWriteFormat;
+
+        this.aDriveConfigs = [];
+
+        /*
+         * We used to eval() sDriveConfigs immediately, but now we wait until initBus()
+         * is called, so that we can check for any machine overrides.
+         */
+        this.sDriveConfigs = parmsHDC['drives'];
+
+        /*
+         * Set fATC (AT Controller flag) according to the 'type' parameter.  This in turn determines other
+         * defaults.  For example, the default XT drive type is 3 (for a 10Mb disk drive), whereas the default
+         * AT drive type is 2 (for a 20Mb disk drive).
+         */
+        this.fATC = (parmsHDC['type'] == "at");
+
+        /*
+         * The remainder of HDC initialization now takes place in our initBus() handler.
+         */
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * @this {HDC}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "listDisks")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        var hdc = this;
+
+        switch (sBinding) {
+
+        case "saveHD0":
+        case "saveHD1":
+            this.bindings[sBinding] = control;
+            control.onclick = function(iDrive) {
+                return function onClickSaveDrive(event) {
+                    var drive = hdc.aDrives && hdc.aDrives[iDrive];
+                    if (drive && drive.disk) {
+                        /*
+                         * Note the similarity (and hence factoring opportunity) between this code and the FDC's
+                         * "saveDisk" binding.
+                         *
+                         * One important difference between the FDC and the HDC is that an FDC may or may not contain
+                         * a disk, whereas an HDC always contains a disk.  However, the contents of an HDC's disk may
+                         * never have been initialized with the contents of an external disk image, and therefore the
+                         * disk's sDiskFile/sDiskPath properties may be undefined.  sDiskName should always be defined
+                         * though, defaulting to the name of the drive (eg, "10Mb Hard Disk").
+                         */
+                        var disk = drive.disk;
+                        var sDiskName = disk.sDiskFile || disk.sDiskName;
+                        var i = sDiskName.lastIndexOf('.');
+                        if (i >= 0) sDiskName = sDiskName.substr(0, i);
+                        sDiskName += ".img";
+                        if (DEBUG) hdc.println("saving disk " + sDiskName + "...");
+                        var sAlert = Web.downloadFile(disk.encodeAsBase64(), "octet-stream", true, sDiskName);
+                        Component.alertUser(sAlert);
+                    } else {
+                        hdc.notice("Hard drive " + iDrive + " is not available.");
+                    }
+                };
+            }(+sBinding.slice(-1));
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {HDC}
+     * @param {Computer} cmp
+     * @param {Bus} bus
+     * @param {X86CPU} cpu
+     * @param {DebuggerX86} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+        this.cmp = cmp;
+
+        var aDriveConfigs = cmp.getMachineParm('drives');
+        if (aDriveConfigs) {
+            this.aDriveConfigs = aDriveConfigs;
+        }
+        else if (this.sDriveConfigs) {
+            try {
+                /*
+                 * We must take care when parsing user-supplied JSON-encoded drive data.
+                 */
+                this.aDriveConfigs = eval("(" + this.sDriveConfigs + ")");
+                /*
+                 * Nothing more to do with aDriveConfigs now. initController() and autoMount() (if there are
+                 * any disk image "path" properties to process) will take care of the rest.
+                 */
+            } catch (e) {
+                Component.error("HDC drive configuration error: " + e.message + " (" + this.sDriveConfigs + ")");
+            }
+        }
+
+        /*
+         * We need access to the ChipSet component, because we need to communicate with
+         * the PIC and DMA controller.
+         */
+        this.chipset = cmp.getMachineComponent("ChipSet");
+
+        this.iDriveTable = 0;
+        this.iDriveTypeDefault = 3;
+
+        bus.addPortInputTable(this, this.fATC? HDC.aATCPortInput : HDC.aXTCPortInput);
+        bus.addPortOutputTable(this, this.fATC? HDC.aATCPortOutput : HDC.aXTCPortOutput);
+
+        if (this.fATC) {
+            this.iDriveTable++;
+            if (this.chipset && this.chipset.model == ChipSet.MODEL_COMPAQ_DESKPRO386) this.iDriveTable++;
+            this.iDriveTypeDefault = 2;
+            bus.addPortInputWidth(HDC.ATC.DATA.PORT, 2);
+            bus.addPortOutputWidth(HDC.ATC.DATA.PORT, 2);
+        }
+
+        cpu.addIntNotify(Interrupts.DISK, this.intBIOSDisk.bind(this));
+        cpu.addIntNotify(Interrupts.ALT_DISK, this.intBIOSDiskette.bind(this));
+
+        /*
+         * The following code used to be performed in the HDC constructor, but now we need to wait for information
+         * about the Computer to be available (eg, getMachineID() and getUserID()) before we start loading and/or
+         * connecting to disk images.
+         *
+         * If we didn't need auto-mount support, we could defer controller initialization until we received a powerUp()
+         * notification, at which point reset() would call initController(), or restore() would restore the controller;
+         * in that case, all we'd need to do here is call setReady().
+         */
+        this.reset();
+
+        if (!this.autoMount()) this.setReady();
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {HDC}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            if (!data) {
+                this.initController();
+                if (this.cmp.fReload) {
+                    /*
+                     * If the computer's fReload flag is set, we're required to toss all currently
+                     * loaded disks and remount all disks specified in the auto-mount configuration.
+                     */
+                    this.autoMount(true);
+                }
+            } else {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {HDC}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean}
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * getMachineID()
+     *
+     * @return {string}
+     */
+    getMachineID()
+    {
+        return this.cmp? this.cmp.getMachineID() : "";
+    }
+
+    /**
+     * getUserID()
+     *
+     * @return {string}
+     */
+    getUserID()
+    {
+        return this.cmp? this.cmp.getUserID() : "";
+    }
+
+    /**
+     * reset()
+     *
+     * @this {HDC}
+     */
+    reset()
+    {
+        /*
+         * TODO: The controller is also initialized by the constructor, to assist with auto-mount support,
+         * so think about whether we can skip powerUp initialization.
+         */
+        this.initController(null, true);
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the HDC component.
+     *
+     * @this {HDC}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, this.saveController());
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the HDC component.
+     *
+     * @this {HDC}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        return this.initController(data[0]);
+    }
+
+    /**
+     * initController(data, fHard)
+     *
+     * @this {HDC}
+     * @param {Array} [data]
+     * @param {boolean} [fHard] true if a machine reset (not just a controller reset)
+     * @return {boolean} true if successful, false if failure
+     */
+    initController(data, fHard)
+    {
+        var i = 0;
+        var fSuccess = true;
+
+        /*
+         * TODO: This is used to re-select the controller's active drive whenever the machine is restored, but alas,
+         * we currently only update it and save it for the ATC, not the XTC.
+         */
+        this.iDrive = -1;
+
+        /*
+         * At this point, it's worth calling into question my decision to NOT split the HDC component into separate XTC
+         * and ATC components, given all the differences, and given that I'm about to write some "if (ATC) else (XTC) ..."
+         * code.  And all I can say in my defense is, yes, it's definitely worth calling that into question.
+         *
+         * However, there's also some common code, mostly in the area of disk management rather than controller management,
+         * and if the components were split, then I'd have to create a third component for that common code (although again,
+         * disk management probably belongs in its own component anyway).
+         *
+         * However, let's not forget that since my overall plan is to have only one PCx86 "binary", everything's going to end
+         * up in the same bucket anyway, so let's not be too obsessive about organizational details.  As long as the number
+         * of these conditionals is small and they're not performance-critical, this seems much ado about nothing.
+         */
+        if (this.fATC) {
+            /*
+             * Since there's no way (and never will be a way) for an HDC to change its "personality" (from 'xt' to 'at'
+             * or vice versa), we're under no obligation to use the same number of registers, or save/restore format, etc,
+             * as the original XT controller.
+             */
+            if (data == null) data = [0, 0, 0, 0, 0, 0, 0, HDC.ATC.STATUS.READY, 0, [0, -1]];
+            this.regError   = data[i++];
+            this.regWPreC   = data[i++];
+            this.regSecCnt  = data[i++];
+            this.regSecNum  = data[i++];
+            this.regCylLo   = data[i++];
+            this.regCylHi   = data[i++];
+            this.regDrvHd   = data[i++];
+            this.regStatus  = data[i++];
+            this.regCommand = data[i++];
+            this.regFDR     = data[i++];
+            if (typeof this.regFDR == "object") {
+                var a = this.regFDR;
+                this.regFDR = a[0];
+                this.iDrive = a[1];
+            }
+            /*
+             * Additional state is maintained by the Drive object (eg, abSector, ibSector)
+             */
+        } else {
+            if (data == null) data = [0, HDC.XTC.STATUS.NONE, new Array(14), 0, 0];
+            this.regConfig    = data[i++];
+            this.regStatus    = data[i++];
+            this.regDataArray = data[i++];  // there can be up to 14 command bytes (6 for normal commands, plus 8 more for HDC.XTC.DATA.CMD.INIT_DRIVE)
+            this.regDataIndex = data[i++];  // used to control the next data byte to be received
+            this.regDataTotal = data[i++];  // used to control the next data byte to be sent (internally, we use regDataIndex to read data bytes, up to this total)
+            this.regReset     = data[i++];
+            this.regPulse     = data[i++];
+            this.regPattern   = data[i++];
+            /*
+             * Initialize iDriveAllowFail only if it's never been initialized, otherwise its entire purpose will be defeated.
+             * See the related HACK in intBIOSDisk() for more details.
+             */
+            var iDriveAllowFail = data[i++];
+            if (iDriveAllowFail !== undefined) {
+                this.iDriveAllowFail = iDriveAllowFail;
+            } else {
+                if (this.iDriveAllowFail === undefined) this.iDriveAllowFail = -1;
+            }
+        }
+
+        if (this.aDrives === undefined) {
+            this.aDrives = new Array(this.aDriveConfigs.length);
+        }
+
+        var dataDrives = data[i];
+        if (dataDrives === undefined) dataDrives = [];
+
+        for (var iDrive = 0; iDrive < this.aDrives.length; iDrive++) {
+            if (this.aDrives[iDrive] === undefined) {
+                this.aDrives[iDrive] = {};
+            }
+            var drive = this.aDrives[iDrive];
+            var driveConfig = this.aDriveConfigs[iDrive];
+            if (!this.initDrive(iDrive, drive, driveConfig, dataDrives[iDrive], fHard)) {
+                fSuccess = false;
+            }
+            /*
+             * XTC only: the original STC-506/412 controller had two pairs of DIP switches to indicate a drive
+             * type (0, 1, 2 or 3) for drives 0 and 1.  Those switch settings are recorded in regConfig, now that
+             * drive.type has been validated by initDrive().
+             */
+            if (this.regConfig != null && iDrive <= 1) {
+                this.regConfig |= (drive.type & 0x3) << ((1 - iDrive) << 1);
+            }
+        }
+
+        if (this.iDrive >= 0) {
+            this.drive = this.aDrives[this.iDrive];
+        }
+
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("HDC initialized for " + this.aDrives.length + " drive(s)");
+        }
+        return fSuccess;
+    }
+
+    /**
+     * saveController()
+     *
+     * @this {HDC}
+     * @return {Array}
+     */
+    saveController()
+    {
+        var i = 0;
+        var data = [];
+        if (this.fATC) {
+            data[i++] = this.regError;
+            data[i++] = this.regWPreC;
+            data[i++] = this.regSecCnt;
+            data[i++] = this.regSecNum;
+            data[i++] = this.regCylLo;
+            data[i++] = this.regCylHi;
+            data[i++] = this.regDrvHd;
+            data[i++] = this.regStatus;
+            data[i++] = this.regCommand;
+            data[i++] = [this.regFDR, this.iDrive];
+        } else {
+            data[i++] = this.regConfig;
+            data[i++] = this.regStatus;
+            data[i++] = this.regDataArray;
+            data[i++] = this.regDataIndex;
+            data[i++] = this.regDataTotal;
+            data[i++] = this.regReset;
+            data[i++] = this.regPulse;
+            data[i++] = this.regPattern;
+            data[i++] = this.iDriveAllowFail;
+        }
+        data[i] = this.saveDrives();
+        return data;
+    }
+
+    /**
+     * initDrive(iDrive, drive, driveConfig, data, fHard)
+     *
+     * TODO: Consider a separate Drive class that both FDC and HDC can use, since there's a lot of commonality
+     * between the drive objects created by both controllers.  This will clean up overall drive management and allow
+     * us to factor out some common Drive methods (eg, advanceSector()).
+     *
+     * @this {HDC}
+     * @param {number} iDrive
+     * @param {Object} drive
+     * @param {Object} driveConfig (contains one or more of the following properties: 'name', 'path', 'size', 'type')
+     * @param {Array} [data]
+     * @param {boolean} [fHard] true if a machine reset (not just a controller reset)
+     * @return {boolean} true if successful, false if failure
+     */
+    initDrive(iDrive, drive, driveConfig, data, fHard)
+    {
+        var i = 0;
+        var fSuccess = true;
+        if (data === undefined) data = [HDC.XTC.DATA.ERR.NONE, 0, false, new Array(8)];
+
+        drive.iDrive = iDrive;
+
+        /*
+         * errorCode could be an HDC global, but in order to insulate HDC state from the operation of various functions
+         * that operate on drive objects (eg, readData and writeData), I've made it a per-drive variable.  This choice may
+         * be contrary to how the actual hardware works, but I prefer this approach, as long as it doesn't expose any
+         * incompatibilities that any software actually cares about.
+         */
+        drive.errorCode = data[i++];
+        drive.senseCode = data[i++];
+        drive.fRemovable = data[i++];
+        drive.abDriveParms = data[i++];         // captures drive parameters programmed via HDC.XTC.DATA.CMD.INIT_DRIVE
+
+        /*
+         * TODO: Make abSector a DWORD array rather than a BYTE array (we could even allocate a Memory block for it);
+         * alternatively, eliminate the buffer entirely and re-establish a reference to the appropriate Disk sector object.
+         */
+        drive.abSector = data[i++];
+
+        /*
+         * The next group of properties are set by various HDC command sequences.
+         */
+        drive.bHead = data[i++];
+        drive.nHeads = data[i++];
+        drive.wCylinder = data[i++];
+        drive.bSector = data[i++];
+        drive.bSectorEnd = data[i++];           // aka EOT
+        drive.nBytes = data[i++];
+        drive.bSectorBias = (this.fATC? 0: 1);
+
+        drive.name = driveConfig['name'];
+        if (drive.name === undefined) drive.name = HDC.DEFAULT_DRIVE_NAME;
+        drive.path = driveConfig['path'];
+
+        /*
+         * If no 'mode' is specified, we fall back to the original behavior, which is to completely preload
+         * any specific disk image, or create an empty (purely local) disk image.
+         */
+        drive.mode = driveConfig['mode'] || (drive.path? DiskAPI.MODE.PRELOAD : DiskAPI.MODE.LOCAL);
+
+        /*
+         * On-demand I/O of raw disk images is supported only if there's a valid user ID; fall back to an empty
+         * local disk image if there's not.
+         */
+        if (drive.mode == DiskAPI.MODE.DEMANDRO || drive.mode == DiskAPI.MODE.DEMANDRW) {
+            if (!this.getUserID()) drive.mode = DiskAPI.MODE.LOCAL;
+        }
+
+        drive.type = driveConfig['type'];
+        if (drive.type === undefined || HDC.aDriveTypes[this.iDriveTable][drive.type] === undefined) drive.type = this.iDriveTypeDefault;
+
+        var driveType = HDC.aDriveTypes[this.iDriveTable][drive.type];
+        drive.nSectors = driveType[2] || 17;    // sectors/track
+        drive.cbSector = driveType[3] || 512;   // bytes/sector (default is 512 if unspecified in the table)
+
+        /*
+         * On a full machine reset, pass the current drive type to setCMOSDriveType() (a no-op on pre-CMOS machines)
+         */
+        if (fHard && this.chipset) {
+            this.chipset.setCMOSDriveType(iDrive, drive.type);
+        }
+
+        /*
+         * The next group of properties are set by user requests to load/unload disk images.
+         *
+         * We no longer reinitialize drive.disk, in order to retain previously mounted disk across resets.
+         */
+        if (drive.disk === undefined) {
+            drive.disk = null;
+            this.notice("Type " + drive.type + " \"" + drive.name + "\" is fixed disk " + iDrive, true);
+        }
+
+        /*
+         * With the advent of save/restore, we need to verify every drive at initialization, not just whenever
+         * drive characteristics are initialized.  Thus, if we've restored a sensible set of drive characteristics,
+         * then verifyDrive will create an empty disk if none has been provided, insuring we are ready for
+         * disk.restore().
+         */
+        this.verifyDrive(drive);
+
+        /*
+         * The next group of properties are managed by worker functions (eg, doRead()) to maintain state across DMA requests.
+         */
+        drive.ibSector = data[i++];             // location of the next byte to be accessed in the above sector
+        drive.sector = null;                    // initialized to null by worker, and then set to the next sector satisfying the request
+
+        if (drive.disk) {
+            var deltas = data[i];
+            if (deltas !== undefined && drive.disk.restore(deltas) < 0) {
+                fSuccess = false;
+            }
+            if (fSuccess && drive.ibSector !== undefined) {
+                drive.sector = drive.disk.seek(drive.wCylinder, drive.bHead, drive.bSector + drive.bSectorBias);
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * saveDrives()
+     *
+     * @this {HDC}
+     * @return {Array}
+     */
+    saveDrives()
+    {
+        var i = 0;
+        var data = [];
+        for (var iDrive = 0; iDrive < this.aDrives.length; iDrive++) {
+            data[i++] = this.saveDrive(this.aDrives[iDrive]);
+        }
+        return data;
+    }
+
+    /**
+     * saveDrive(drive)
+     *
+     * @this {HDC}
+     * @return {Array}
+     */
+    saveDrive(drive)
+    {
+        var i = 0;
+        var data = [];
+        data[i++] = drive.errorCode;
+        data[i++] = drive.senseCode;
+        data[i++] = drive.fRemovable;
+        data[i++] = drive.abDriveParms;
+        data[i++] = drive.abSector;
+        data[i++] = drive.bHead;
+        data[i++] = drive.nHeads;
+        data[i++] = drive.wCylinder;
+        data[i++] = drive.bSector;
+        data[i++] = drive.bSectorEnd;
+        data[i++] = drive.nBytes;
+        data[i++] = drive.ibSector;
+        data[i] = drive.disk? drive.disk.save() : null;
+        return data;
+    }
+
+    /**
+     * copyDrive(iDrive)
+     *
+     * @this {HDC}
+     * @param {number} iDrive
+     * @return {Object|undefined} (undefined if the requested drive does not exist)
+     */
+    copyDrive(iDrive)
+    {
+        var driveNew;
+        var driveOld = this.aDrives[iDrive];
+        if (driveOld !== undefined) {
+            driveNew = {};
+            for (var p in driveOld) {
+                driveNew[p] = driveOld[p];
+            }
+        }
+        return driveNew;
+    }
+
+    /**
+     * verifyDrive(drive, type)
+     *
+     * If no disk image is attached, create an empty disk with the specified drive characteristics.
+     * Normally, we'd rely on the drive characteristics programmed via the HDC.XTC.DATA.CMD.INIT_DRIVE
+     * command, but if an explicit drive type is specified, then we use the characteristics (geometry)
+     * associated with that type.
+     *
+     * @this {HDC}
+     * @param {Object} drive
+     * @param {number} [type] to create a disk of the specified type, if no disk exists yet
+     */
+    verifyDrive(drive, type)
+    {
+        if (drive) {
+            var nHeads = 0, nCylinders = 0;
+            if (type == null) {
+                /*
+                 * If the caller wants us to use the programmed drive parameters, we use those,
+                 * but if there aren't any drive parameters (yet), then use default parameters based
+                 * on drive.type.
+                 *
+                 * We used to do the last step ONLY if there was no drive.path -- otherwise, we'd waste
+                 * time creating an empty disk if autoMount() was going to load an image from drive.path;
+                 * but hopefully the Disk component is smarter now.
+                 */
+                nHeads = drive.abDriveParms[2];
+                if (nHeads) {
+                    nCylinders = (drive.abDriveParms[0] << 8) | drive.abDriveParms[1];
+                } else {
+                    type = drive.type;
+                }
+            }
+            if (type != null && !nHeads) {
+                nHeads = HDC.aDriveTypes[this.iDriveTable][type][1];
+                nCylinders = HDC.aDriveTypes[this.iDriveTable][type][0];
+            }
+            if (nHeads) {
+                /*
+                 * The assumption here is that if the 3rd drive parameter byte (abDriveParms[2]) has been set
+                 * (ie, if nHeads is valid) then the first two bytes (ie, the low and high cylinder byte values)
+                 * must have been set as well.
+                 *
+                 * Do these values agree with those for the given drive type?  Even if they don't, all we do is warn.
+                 */
+                var driveType = HDC.aDriveTypes[this.iDriveTable][drive.type];
+                if (driveType) {
+                    if (nCylinders != driveType[0] && nHeads != driveType[1]) {
+                        this.notice("Warning: drive parameters (" + nCylinders + "," + nHeads + ") do not match drive type " + drive.type + " (" + driveType[0] + "," + driveType[1] + ")");
+                    }
+                }
+                drive.nCylinders = nCylinders;
+                drive.nHeads = nHeads;
+                if (drive.disk == null) {
+                    drive.disk = new Disk(this, drive, drive.mode);
+                }
+            }
+        }
+    }
+
+    /**
+     * seekDrive(drive, iSector, nSectors)
+     *
+     * The HDC doesn't need this function, since all HDC requests from the CPU are handled by doXTCmd().  This function
+     * is used by other components (eg, Debugger) to mimic an HDC request, using a drive object obtained from copyDrive(),
+     * to avoid disturbing the internal state of the HDC's drive objects.
+     *
+     * Also note that in an actual HDC request, drive.nBytes is initialized to the size of a single sector; the extent
+     * of the entire transfer is actually determined by a count that has been pre-loaded into the DMA controller.  The HDC
+     * isn't aware of the extent of the transfer, so in the case of a read request, all readData() can do is return bytes
+     * until the current track (or, in the case of a multi-track request, the current cylinder) has been exhausted.
+     *
+     * Since seekDrive() is for use with non-DMA requests, we use nBytes to specify the length of the entire transfer.
+     *
+     * @this {HDC}
+     * @param {Object} drive
+     * @param {number} iSector (a "logical" sector number, relative to the entire disk, NOT a physical sector number)
+     * @param {number} nSectors
+     * @return {boolean} true if successful, false if invalid position request
+     */
+    seekDrive(drive, iSector, nSectors)
+    {
+        if (drive.disk) {
+            var aDiskInfo = drive.disk.info();
+            var nCylinders = aDiskInfo[0];
+            /*
+             * If nCylinders is zero, we probably have an empty disk image, awaiting initialization (see verifyDrive())
+             */
+            if (nCylinders) {
+                var nHeads = aDiskInfo[1];
+                var nSectorsPerTrack = aDiskInfo[2];
+                var nSectorsPerCylinder = nHeads * nSectorsPerTrack;
+                var nSectorsPerDisk = nCylinders * nSectorsPerCylinder;
+                if (iSector + nSectors <= nSectorsPerDisk) {
+                    drive.wCylinder = Math.floor(iSector / nSectorsPerCylinder);
+                    iSector %= nSectorsPerCylinder;
+                    drive.bHead = Math.floor(iSector / nSectorsPerTrack);
+                    /*
+                     * Important difference between the FDC and the XTC: the XTC uses 0-based sector numbers, so unlike
+                     * FDC.seekDrive(), we must NOT add 1 to bSector below.  I could change how sector numbers are stored in
+                     * hard drive images, but it seems preferable to keep the image format consistent and controller-independent.
+                     */
+                    drive.bSector = (iSector % nSectorsPerTrack);
+                    drive.nBytes = nSectors * aDiskInfo[3];
+                    /*
+                     * NOTE: We don't set nSectorEnd, as an HDC command would, but it's irrelevant, because we don't actually
+                     * do anything with nSectorEnd at this point.  Perhaps someday, when we faithfully honor/restrict requests
+                     * to a single track (or a single cylinder, in the case of multi-track requests).
+                     */
+                    drive.errorCode = HDC.XTC.DATA.ERR.NONE;
+                    /*
+                     * At this point, we've finished simulating what an HDC.XTC.DATA.CMD.READ_DATA command would have performed,
+                     * up through doRead().  Now it's the caller responsibility to call readData(), like the DMA Controller would.
+                     */
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+
+    /**
+     * autoMount(fRemount)
+     *
+     * @this {HDC}
+     * @param {boolean} [fRemount] is true if we're remounting all auto-mounted disks
+     * @return {boolean} true if one or more disk images are being auto-mounted, false if none
+     */
+    autoMount(fRemount)
+    {
+        if (!fRemount) this.cAutoMount = 0;
+
+        for (var iDrive = 0; iDrive < this.aDrives.length; iDrive++) {
+            var drive = this.aDrives[iDrive];
+            if (drive.name && drive.path) {
+
+                if (fRemount && drive.disk && drive.disk.isRemote()) {
+                    /*
+                     * The Disk component has its own logic for remounting remote disks, so skip this disk.
+                     *
+                     * TODO: Consider rewriting how ALL disks are automounted/remounted, now that the Disk component
+                     * is receiving its own powerDown() and powerUp() notifications (originally, it didn't receive them).
+                     */
+                    continue;
+                }
+
+                if (!this.loadDisk(iDrive, drive.name, drive.path, true) && fRemount)
+                    this.setReady(false);
+                continue;
+            }
+            if (fRemount && drive.type !== undefined) {
+                drive.disk = null;
+                this.verifyDrive(drive, drive.type);
+            }
+        }
+        return !!this.cAutoMount;
+    }
+
+    /**
+     * loadDisk(iDrive, sDiskName, sDiskPath, fAutoMount)
+     *
+     * @this {HDC}
+     * @param {number} iDrive
+     * @param {string} sDiskName
+     * @param {string} sDiskPath
+     * @param {boolean} fAutoMount
+     * @return {boolean} true if disk (already) loaded, false if queued up (or busy)
+     */
+    loadDisk(iDrive, sDiskName, sDiskPath, fAutoMount)
+    {
+        var drive = this.aDrives[iDrive];
+        if (drive.fBusy) {
+            this.notice("Drive " + iDrive + " busy");
+            return true;
+        }
+        drive.fBusy = true;
+        if (fAutoMount) {
+            drive.fAutoMount = true;
+            this.cAutoMount++;
+            if (this.messageEnabled()) this.printMessage("loading " + sDiskName);
+        }
+        var disk = drive.disk || new Disk(this, drive, drive.mode);
+        disk.load(sDiskName, sDiskPath, null, this.doneLoadDisk);
+        return false;
+    }
+
+    /**
+     * doneLoadDisk(drive, disk, sDiskName, sDiskPath)
+     *
+     * This is a callback issued by the Disk component once the load() operation has finished.
+     *
+     * @this {HDC}
+     * @param {Object} drive
+     * @param {Disk} disk is set if the disk was successfully mounted, null if not
+     * @param {string} sDiskName
+     * @param {string} sDiskPath
+     */
+    doneLoadDisk(drive, disk, sDiskName, sDiskPath)
+    {
+        drive.fBusy = false;
+        if ((drive.disk = disk)) {
+            /*
+             * With the addition of notify(), users are now "alerted" whenever a diskette has finished loading;
+             * notify() is selective about its output, using print() if a print window is open, otherwise alert().
+             *
+             * WARNING: This conversion of drive number to drive letter, starting with "C:" (0x43), is very simplistic
+             * and is not guaranteed to match the drive mapping that DOS ultimately uses.
+             */
+            this.notice("Mounted disk \"" + sDiskName + "\" in drive " + String.fromCharCode(0x43 + drive.iDrive), drive.fAutoMount);
+
+            var aDiskInfo = disk.info();
+            if (aDiskInfo[0] != drive.nCylinders || aDiskInfo[1] != drive.nHeads || aDiskInfo[2] != drive.nSectors || aDiskInfo[3] != drive.cbSector) {
+                /*
+                 * TODO: Decide how to deal with this problem; ie, either disallow disk access altogether, or automatically
+                 * map the controller's I/O requests to the disk's geometry.  Also, we should provide a way to reformat such a
+                 * disk so that its geometry matches the controller requirements.
+                 */
+                this.notice("Warning: disk geometry (" + aDiskInfo[0] + ':' + aDiskInfo[1] + ':' + aDiskInfo[2] + ") does not match " + HDC.aDriveTables[this.iDriveTable] + " drive type " + drive.type + " (" + drive.nCylinders + ':' + drive.nHeads + ':' + drive.nSectors + ")");
+            }
+        }
+        if (drive.fAutoMount) {
+            drive.fAutoMount = false;
+            if (!--this.cAutoMount) this.setReady();
+        }
+    }
+
+    /**
+     * intXTCData(port, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x320)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inXTCData(port, addrFrom)
+    {
+        var bIn = 0;
+        if (this.regDataIndex < this.regDataTotal) {
+            bIn = this.regDataArray[this.regDataIndex];
+        }
+        if (this.chipset) this.chipset.clearIRR(ChipSet.IRQ.XTC);
+        this.regStatus &= ~HDC.XTC.STATUS.INTERRUPT;
+
+        this.printMessageIO(port, null, addrFrom, "DATA[" + this.regDataIndex + "]", bIn);
+        if (++this.regDataIndex >= this.regDataTotal) {
+            this.regDataIndex = this.regDataTotal = 0;
+            this.regStatus &= ~(HDC.XTC.STATUS.IOMODE | HDC.XTC.STATUS.BUS | HDC.XTC.STATUS.BUSY);
+        }
+        return bIn;
+    }
+
+    /**
+     * outXTCData(port, bOut, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x320)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outXTCData(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "DATA[" + this.regDataTotal + "]");
+        if (this.regDataTotal < this.regDataArray.length) {
+            this.regDataArray[this.regDataTotal++] = bOut;
+        }
+        var bCmd = this.regDataArray[0];
+        var cbCmd = (bCmd != HDC.XTC.DATA.CMD.INIT_DRIVE? 6 : this.regDataArray.length);
+        if (this.regDataTotal == 6) {
+            /*
+             * XTC.STATUS.REQ must be CLEAR following any 6-byte command sequence that the HDC BIOS "COMMAND" function outputs,
+             * yet it must also be SET before the HDC BIOS will proceed with the remaining the 8-byte sequence that's part of
+             * HDC.XTC.DATA.CMD.INIT_DRIVE command. See inXTCStatus() for HACK details.
+             */
+            this.regStatus &= ~HDC.XTC.STATUS.REQ;
+        }
+        if (this.regDataTotal >= cbCmd) {
+            /*
+             * It's essential that XTC.STATUS.IOMODE be set here, at least after the final 8-byte HDC.XTC.DATA.CMD.INIT_DRIVE sequence.
+             */
+            this.regStatus |= HDC.XTC.STATUS.IOMODE;
+            this.regStatus &= ~HDC.XTC.STATUS.REQ;
+            this.doXTC();
+        }
+    }
+
+    /**
+     * inXTCStatus(port, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x321)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inXTCStatus(port, addrFrom)
+    {
+        var b = this.regStatus;
+        this.printMessageIO(port, null, addrFrom, "STATUS", b);
+        /*
+         * HACK: The HDC BIOS will not finish the HDC.XTC.DATA.CMD.INIT_DRIVE sequence unless it sees XTC.STATUS.REQ set again, nor will
+         * it read any of the XTC.DATA bytes returned from a HDC.XTC.DATA.CMD.REQUEST_SENSE command unless XTC.STATUS.REQ is set again, so
+         * we turn it back on if there are unprocessed data bytes.
+         */
+        if (this.regDataIndex < this.regDataTotal) {
+            this.regStatus |= HDC.XTC.STATUS.REQ;
+        }
+        return b;
+    }
+
+    /**
+     * outXTCReset(port, bOut, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x321)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outXTCReset(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "RESET");
+        /*
+         * Not sure what to do with this value, and the value itself may be "don't care", but we'll save it anyway.
+         */
+        this.regReset = bOut;
+        if (this.chipset) this.chipset.clearIRR(ChipSet.IRQ.XTC);
+        this.initController();
+    }
+
+    /**
+     * inXTCConfig(port, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x322)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inXTCConfig(port, addrFrom)
+    {
+        this.printMessageIO(port, null, addrFrom, "CONFIG", this.regConfig);
+        return this.regConfig;
+    }
+
+    /**
+     * outXTCPulse(port, bOut, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x322)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outXTCPulse(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "PULSE");
+        /*
+         * Not sure what to do with this value, and the value itself may be "don't care", but we'll save it anyway.
+         */
+        this.regPulse = bOut;
+        /*
+         * The HDC BIOS "COMMAND" function (@C800:0562) waits for these ALL status bits after writing to both regPulse
+         * and regPattern, so we must oblige it.
+         *
+         * TODO: Figure out exactly when either XTC.STATUS.BUS or XTC.STATUS.BUSY are supposed to be cleared.
+         * The HDC BIOS doesn't care much about them, except for the one location mentioned above. However, MS-DOS 4.0
+         * (aka the unreleased "multitasking" version of MS-DOS) cares, so I'm going to start by clearing them at the
+         * same point I clear XTC.STATUS.IOMODE.
+         */
+        this.regStatus = HDC.XTC.STATUS.REQ | HDC.XTC.STATUS.BUS | HDC.XTC.STATUS.BUSY;
+    }
+
+    /**
+     * outXTCPattern(port, bOut, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x323)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outXTCPattern(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "PATTERN");
+        this.regPattern = bOut;
+    }
+
+    /**
+     * outXTCNoise(port, bOut, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x327, 0x32B or 0x32F)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outXTCNoise(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "NOISE");
+    }
+
+    /**
+     * inATCByte(port, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x1F0)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inATCByte(port, addrFrom)
+    {
+        var bIn = -1;
+
+        if (this.drive) {
+            /*
+             * We use the synchronous form of readData() at this point because we have no choice; an I/O instruction
+             * has just occurred and cannot be delayed.  The good news is that doATCommand() should have already primed
+             * the pump; all we can do is assert that the pump has something in it.  If bIn is inexplicably negative,
+             * well, then the caller will get 0xff.
+             */
+            var hdc = this;
+            bIn = this.readData(this.drive, function onATCReadData(b, fAsync, obj, off) {
+
+                if (BACKTRACK) {
+                    if (!off && obj.file && hdc.messageEnabled(Messages.DISK)) {
+                        hdc.printMessage("loading " + obj.file.sPath + '[' + obj.offFile + "] via port " + Str.toHexWord(port), true);
+                    }
+                    /*
+                     * TODO: We could define a cached BTO that's reset prior to a new ATC command, and then pass that
+                     * to addBackTrackObject() here instead of null; but for now, we're going to rely on that function's
+                     * simplistic MRU logic.  If that fails, the worst that will (or should) happen is we'll burn through
+                     * more BackTrack wrapper objects than necessary, and risk running out.
+                     */
+                    var bto = hdc.bus.addBackTrackObject(obj, null, off);
+                    hdc.cpu.backTrack.btiIO = hdc.bus.getBackTrackIndex(bto, off);
+                }
+            });
+
+
+            if (this.drive.ibSector == 1 || this.drive.ibSector == this.drive.cbSector) {
+                /*
+                 * printMessageIO() calls, if enabled, can be overwhelming for this port, so limit them to the first
+                 * and last bytes of each sector.
+                 */
+                if (this.messageEnabled(Messages.PORT | Messages.HDC)) {
+                    this.printMessageIO(port, null, addrFrom, "DATA[" + this.drive.ibSector + "]", bIn);
+                }
+                if (this.drive.ibSector > 1) {      // in other words, if this.drive.ibSector == this.drive.cbSector...
+                    if (this.messageEnabled(Messages.DATA | Messages.HDC)) {
+                        var sDump = this.drive.disk.dumpSector(this.drive.sector);
+                        if (sDump) this.dbg.message(sDump);
+                    }
+                    /*
+                     * Now that we've supplied a full sector of data, see if the caller's expecting additional sectors;
+                     * if so, prime the pump again.  The caller should not poll us again until another interrupt's delivered.
+                     */
+                    this.drive.nBytes -= this.drive.cbSector;
+                    this.regSecCnt = (this.regSecCnt - 1) & 0xff;
+                    /*
+                     * TODO: If the WITH_ECC bit is set in the READ_DATA command, then we need to support "stuffing" 4
+                     * additional bytes into the inATCByte() stream.  And we must first set DATA_REQ in the STATUS register.
+                     */
+                    if (this.drive.nBytes >= this.drive.cbSector) {
+                        /*
+                         * FYI, with regard to regStatus, I'm simply aping what the ATC.COMMAND.READ_DATA setup code does
+                         * for the first sector, which may not strictly be necessary for subsequent sectors....
+                         */
+                        hdc.regStatus = HDC.ATC.STATUS.BUSY;
+                        this.readData(this.drive, function onATCReadDataNext(b, fAsync) {
+                            if (b >= 0) {
+                                hdc.setATCIRR();
+                                /*
+                                 * Due to the way I'm immediately triggering an interrupt whenever more data is available,
+                                 * I must take a "shotgun approach' to regStatus bits in order to make the MODEL_5170_REV1,
+                                 * MODEL_5170_REV3, and MODEL_COMPAQ_DESKPRO386 all happy.
+                                 *
+                                 * In general, it's fine for all of STATUS.READY, STATUS.SEEK_OK and STATUS.DATA_REQ to be
+                                 * set now; the MODEL_5170_REV3 requires at least the first two, and the MODEL_COMPAQ_DESKPRO386
+                                 * requires the third.  Unfortunately, the outlier is the MODEL_5170_REV1, which also needs
+                                 * the STATUS.BUSY to be set on the first regStatus read after it finishes reading a sector;
+                                 * otherwise, the MODEL_5170_REV1 BIOS will never read any remaining sectors.
+                                 *
+                                 * Technically, it doesn't make sense for both BUSY and READY to be set at the same time,
+                                 * so we fix that in inATCStatus() by clearing BUSY whenever READY is detected *after* that
+                                 * first read.  In addition, since this hack is really only needed for the MODEL_5170_REV1,
+                                 * we clear BUSY immediately on the MODEL_COMPAQ_DESKPRO386 (which makes the Windows 95
+                                 * protected-mode disk driver much happier).
+                                 */
+                                if (hdc.chipset && hdc.chipset.model == ChipSet.MODEL_COMPAQ_DESKPRO386) hdc.regStatus = 0;
+                                hdc.regStatus |= HDC.ATC.STATUS.READY | HDC.ATC.STATUS.SEEK_OK | HDC.ATC.STATUS.DATA_REQ;
+                            } else {
+                                /*
+                                 * TODO: It would be nice to be a bit more specific about the error (if any) that just occurred.
+                                 * Consult drive.errorCode (it uses older XTC error codes, but mapping those codes should be trivial).
+                                 */
+                                hdc.regStatus = HDC.ATC.STATUS.ERROR;
+                                hdc.regError = HDC.ATC.ERROR.NO_CHS;
+                                if (DEBUG) hdc.printMessage(this.idComponent + ".inATCByte(): read failed");
+                            }
+                        }, false);
+                    } else {
+
+                        this.regStatus = HDC.ATC.STATUS.READY | HDC.ATC.STATUS.SEEK_OK;
+                    }
+                }
+            }
+        }
+        return bIn;
+    }
+
+    /**
+     * inATCData(port, addrFrom)
+     *
+     * Wrapper around inATCByte() to treat this as a 16-bit port; see addPortInputWidth(HDC.ATC.DATA.PORT, 2).
+     *
+     * @this {HDC}
+     * @param {number} port (0x1F0)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port data
+     */
+    inATCData(port, addrFrom)
+    {
+        return this.inATCByte(port, addrFrom) | (this.inATCByte(port, addrFrom) << 8);
+    }
+
+    /**
+     * outATCByte(port, bOut, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x1F0)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outATCByte(port, bOut, addrFrom)
+    {
+        if (this.drive) {
+            if (this.drive.nBytes >= this.drive.cbSector) {
+                if (this.writeData(this.drive, bOut) < 0) {
+                    /*
+                     * TODO: It would be nice to be a bit more specific about the error (if any) that just occurred.
+                     * Consult drive.errorCode (it uses older XTC error codes, but mapping those codes should be trivial).
+                     */
+                    this.regStatus = HDC.ATC.STATUS.ERROR;
+                    this.regError = HDC.ATC.ERROR.NO_CHS;
+                    if (DEBUG && this.messageEnabled()) {
+                        this.printMessage(this.idComponent + ".outATCByte(" + Str.toHexByte(bOut) + "): write failed");
+                    }
+                }
+                else if (this.drive.ibSector == 1 || this.drive.ibSector == this.drive.cbSector) {
+                    /*
+                     * printMessageIO() calls, if enabled, can be overwhelming for this port, so limit them to the first
+                     * and last bytes of each sector.
+                     */
+                    if (this.messageEnabled(Messages.PORT | Messages.HDC)) {
+                        this.printMessageIO(port, bOut, addrFrom, "DATA[" + this.drive.ibSector + "]");
+                    }
+                    if (this.drive.ibSector > 1) {      // in other words, if this.drive.ibSector == this.drive.cbSector...
+                        if (this.messageEnabled(Messages.DATA | Messages.HDC)) {
+                            var sDump = this.drive.disk.dumpSector(this.drive.sector);
+                            if (sDump) this.dbg.message(sDump);
+                        }
+                        this.drive.nBytes -= this.drive.cbSector;
+                        this.regSecCnt = (this.regSecCnt - 1) & 0xff;
+                        this.setATCIRR(true);
+                        this.regStatus = HDC.ATC.STATUS.READY | HDC.ATC.STATUS.SEEK_OK;
+                        if (this.drive.nBytes >= this.drive.cbSector) {
+                            this.regStatus |= HDC.ATC.STATUS.DATA_REQ;
+                        } else {
+
+                        }
+                    }
+                }
+            } else {
+                /*
+                 * TODO: What to do about unexpected writes? The number of bytes has exceeded what the command specified.
+                 */
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage(this.idComponent + ".outATCByte(" + Str.toHexByte(bOut) + "): write exceeds count (" + this.drive.nBytes + ")");
+                }
+            }
+        } else {
+            /*
+             * TODO: What to do about unexpected writes? No command was specified.
+             */
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage(this.idComponent + ".outATCByte(" + Str.toHexByte(bOut) + "): write without command");
+            }
+        }
+    }
+
+    /**
+     * outATCData(port, data, addrFrom)
+     *
+     * Wrapper around outATCByte() to treat this as a 16-bit port; see addPortOutputWidth(HDC.ATC.DATA.PORT, 2)
+     *
+     * @this {HDC}
+     * @param {number} port (0x1F0)
+     * @param {number} data
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outATCData(port, data, addrFrom)
+    {
+        this.outATCByte(port, data & 0xff, addrFrom);
+        this.outATCByte(port, (data >> 8) & 0xff, addrFrom);
+    }
+
+    /**
+     * inATCError(port, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x1F1)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inATCError(port, addrFrom)
+    {
+        var bIn = this.regError;
+        this.printMessageIO(port, null, addrFrom, "ERROR", bIn);
+        return bIn;
+    }
+
+    /**
+     * outATCWPreC(port, bOut, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x1F1)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outATCWPreC(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "WPREC");
+        this.regWPreC = bOut;
+    }
+
+    /**
+     * inATCSecCnt(port, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x1F2)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inATCSecCnt(port, addrFrom)
+    {
+        var bIn = this.regSecCnt;
+        this.printMessageIO(port, null, addrFrom, "SECCNT", bIn);
+        return bIn;
+    }
+
+    /**
+     * outATCSecCnt(port, bOut, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x1F2)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outATCSecCnt(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "SECCNT");
+        this.regSecCnt = bOut;
+    }
+
+    /**
+     * inATCSecNum(port, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x1F3)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inATCSecNum(port, addrFrom)
+    {
+        var bIn = this.regSecNum;
+        this.printMessageIO(port, null, addrFrom, "SECNUM", bIn);
+        return bIn;
+    }
+
+    /**
+     * outATCSecNum(port, bOut, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x1F3)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outATCSecNum(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "SECNUM");
+        this.regSecNum = bOut;
+    }
+
+    /**
+     * inATCCylLo(port, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x1F4)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inATCCylLo(port, addrFrom)
+    {
+        var bIn = this.regCylLo;
+        this.printMessageIO(port, null, addrFrom, "CYLLO", bIn);
+        return bIn;
+    }
+
+    /**
+     * outATCCylLo(port, bOut, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x1F4)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outATCCylLo(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "CYLLO");
+        this.regCylLo = bOut;
+    }
+
+    /**
+     * inATCCylHi(port, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x1F5)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inATCCylHi(port, addrFrom)
+    {
+        var bIn = this.regCylHi;
+        this.printMessageIO(port, null, addrFrom, "CYLHI", bIn);
+        return bIn;
+    }
+
+    /**
+     * outATCCylHi(port, bOut, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x1F5)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outATCCylHi(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "CYLHI");
+        this.regCylHi = bOut;
+    }
+
+    /**
+     * inATCDrvHd(port, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x1F6)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inATCDrvHd(port, addrFrom)
+    {
+        var bIn = this.regDrvHd;
+        this.printMessageIO(port, null, addrFrom, "DRVHD", bIn);
+        return bIn;
+    }
+
+    /**
+     * outATCDrvHd(port, bOut, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x1F6)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outATCDrvHd(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "DRVHD");
+        this.regDrvHd = bOut;
+        /*
+         * The MODEL_5170_REV3 BIOS (see "POST2_CHK_HF2" @F000:14FC) probes for a 2nd hard drive when the number
+         * of configured hard drives is something other than 2, using INT 0x13/AH=0x10.  This in turn calls the
+         * BIOS "TST_RDY" function, which selects the drive in this register (see DRIVE_MASK), and then immediately
+         * expects regStatus to reflect success or failure.
+         *
+         * We were always returning success, because no ATC command was actually issued, and so the user would
+         * always get a spurious CMOS configuration error: "System Options Not Set-(Run SETUP)".
+         *
+         * So now we update regStatus here.  I'm not sure which status bits are normally set to indicate failure,
+         * but it should be sufficient to set or clear the READY bit according to whether the drive exists or not.
+         *
+         * TODO: Dig into the ATC documentation some more, and determine what other situations, if any, regStatus
+         * needs to be updated.
+         *
+         * UPDATE: The COMPAQ DeskPro 386 ROM BIOS requires setting STATUS.SEEK_OK in addition to STATUS.READY;
+         * a quick retest of the MODEL_5170_REV3 BIOS suggests that it's happy with that change, so it's quite likely
+         * that was the appropriate change all along.
+         */
+        var iDrive = (this.regDrvHd & HDC.ATC.DRVHD.DRIVE_MASK? 1 : 0);
+        if (this.aDrives[iDrive]) {
+            this.regStatus |= HDC.ATC.STATUS.READY | HDC.ATC.STATUS.SEEK_OK;
+        } else {
+            this.regStatus &= ~HDC.ATC.STATUS.READY;
+        }
+    }
+
+    /**
+     * inATCStatus(port, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x1F7)
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to read the specified port)
+     * @return {number} simulated port value
+     */
+    inATCStatus(port, addrFrom)
+    {
+        var bIn = this.regStatus;
+        this.printMessageIO(port, null, addrFrom, "STATUS", bIn);
+        /*
+         * Despite what IBM's documentation for the "Personal Computer AT Fixed Disk and Diskette Drive Adapter"
+         * (August 31, 1984) says (ie, "A read of the status register clears interrupt request 14"), we cannot
+         * unilaterally clear the IRQ on any read of STATUS.  For starters, that would completely break the PC AT
+         * ROM BIOS; here's what it does for multi-sector reads:
+         *
+         *      (1) read sector (REP INSW)
+         *      (2) check STATUS
+         *      (3) check sector count, exit if done
+         *      (4) wait for interrupt
+         *      (5) repeat
+         *
+         * Since we set the IRR immediately after (1), we cannot immediately clear the IRR at (2), otherwise the
+         * interrupt at (4) never happens.  So, maybe there are SOME situations where IRR should be cleared on
+         * a read, but I don't know what they are.
+         *
+         *      if (this.chipset) this.chipset.clearIRR(ChipSet.IRQ.ATC);
+         */
+        if (this.regStatus & HDC.ATC.STATUS.READY) this.regStatus &= ~HDC.ATC.STATUS.BUSY;
+        return bIn;
+    }
+
+    /**
+     * outATCCommand(port, bOut, addrFrom)
+     *
+     * @this {HDC}
+     * @param {number} port (0x1F7)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outATCCommand(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "COMMAND");
+        this.regCommand = bOut;
+        if (this.chipset) this.chipset.clearIRR(ChipSet.IRQ.ATC);
+        this.doATC();
+    }
+
+    /**
+     * outATCFDR(port, bOut, addrFrom)
+     *
+     * This is referred to in IBM's docs as the "Fixed Disk Register" (write-only)
+     *
+     * @this {HDC}
+     * @param {number} port (0x3F6)
+     * @param {number} bOut
+     * @param {number} [addrFrom] (not defined whenever the Debugger tries to write the specified port)
+     */
+    outATCFDR(port, bOut, addrFrom)
+    {
+        this.printMessageIO(port, bOut, addrFrom, "FDR");
+        /*
+         * I'm not really sure if I should set HDC.ATC.DIAG.NO_ERROR in regError after *every* write where
+         * HDC.ATC.FDR.RESET is clear, or only after it has transitioned from set to clear; since the BIOS only
+         * requires the latter, I'm going to be conservative and restrict regError updates to the latter.
+         */
+        if ((this.regFDR & HDC.ATC.FDR.RESET) && !(bOut & HDC.ATC.FDR.RESET)) this.regError = HDC.ATC.DIAG.NO_ERROR;
+        this.regFDR = bOut;
+    }
+
+    /**
+     * doATC()
+     *
+     * Handles ATC (AT Controller) commands
+     *
+     * @this {HDC}
+     */
+    doATC()
+    {
+        var hdc = this;
+        var fInterrupt = false;
+        var bCmd = this.regCommand;
+        var iDrive = (this.regDrvHd & HDC.ATC.DRVHD.DRIVE_MASK? 1 : 0);
+        var nHead = this.regDrvHd & HDC.ATC.DRVHD.HEAD_MASK;
+        var nCylinder = this.regCylLo | ((this.regCylHi & HDC.ATC.CYLHI.MASK) << 8);
+        var nSector = this.regSecNum;
+        var nSectors = this.regSecCnt || 256;
+
+        this.iDrive = -1;
+        this.drive = null;
+        this.regError = HDC.ATC.ERROR.NONE;
+        this.regStatus = HDC.ATC.STATUS.READY | HDC.ATC.STATUS.SEEK_OK;
+
+        var drive = this.aDrives[iDrive];
+        if (!drive) {
+            bCmd = -1;
+        } else {
+            /*
+             * Update the Drive object with the new positional information associated with this command.
+             */
+            drive.wCylinder = nCylinder;
+            drive.bHead = nHead;
+            drive.bSector = nSector;
+            drive.nBytes = nSectors * drive.cbSector;
+            bCmd = (bCmd >= HDC.ATC.COMMAND.DIAGNOSE? bCmd : (bCmd & HDC.ATC.COMMAND.MASK));
+            /*
+             * Since the ATC doesn't use DMA, we must now set some additional Drive state for the benefit of any
+             * follow-up I/O instructions.  For example, any subsequent inATCByte() and outATCByte() calls need to
+             * know which drive to talk to ("this.drive"), to issue their own readData() and writeData() calls.
+             *
+             * The XTC didn't need this, because it used doRead(), doWrite(), doFormat() helper functions,
+             * which reset the current drive's "sector" and "errorCode" properties themselves and then used DMA
+             * functions that delivered drive data with direct calls to readData() and writeData().
+             */
+            drive.sector = null;
+            drive.ibSector = 0;
+            drive.errorCode = 0;
+            this.iDrive = iDrive;
+            this.drive = drive;
+        }
+
+        if (DEBUG && this.messageEnabled(Messages.HDC)) {
+            this.printMessage(this.idComponent + ".doATC(" + Str.toHexByte(bCmd) + "): " + HDC.aATCCommands[bCmd], true);
+        }
+
+        switch (bCmd & HDC.ATC.COMMAND.MASK) {
+
+        case HDC.ATC.COMMAND.RESTORE:               // 0x10
+            /*
+             * Physically, this retracts the heads to cylinder 0, but logically, there isn't anything to do.
+             */
+            fInterrupt = true;
+            break;
+
+        case HDC.ATC.COMMAND.READ_DATA:             // 0x20
+            if (DEBUG && this.messageEnabled(Messages.HDC)) {
+                this.printMessage(this.idComponent + ".doATCRead(" + iDrive + ',' + drive.wCylinder + ':' + drive.bHead + ':' + drive.bSector + ',' + nSectors + ")", true);
+            }
+            /*
+             * We're using a call to readData() that disables auto-increment, so that once we've got the first
+             * byte of the next sector, we can signal an interrupt without also consuming the first byte, allowing
+             * inATCByte() to begin with that byte.
+             */
+            hdc.regStatus = HDC.ATC.STATUS.BUSY;
+            this.readData(drive, function onATCReadDataFirst(b, fAsync) {
+                if (b >= 0 && hdc.chipset) {
+                    hdc.setATCIRR();
+                    /*
+                     * Bytes from the requested sector(s) will now be delivered via inATCByte().
+                     *
+                     * FYI, I'm taking a shotgun approach to these status bits: I need to clear STATUS.BUSY and
+                     * set STATUS.DATA_REQ, because otherwise COMPAQ DeskPro 386 reads will fail, and I need to set
+                     * the STATUS.READY and STATUS.SEEK_OK bits, because otherwise MODEL_5170_REV3 reads will fail.
+                     */
+                    hdc.regStatus = HDC.ATC.STATUS.READY | HDC.ATC.STATUS.SEEK_OK | HDC.ATC.STATUS.DATA_REQ;
+                } else {
+                    /*
+                     * TODO: It would be nice to be a bit more specific about the error (if any) that just occurred.
+                     * Consult drive.errorCode (it uses older XTC error codes, but mapping those codes should be trivial).
+                     */
+                    hdc.regStatus = HDC.ATC.STATUS.ERROR;
+                    hdc.regError = HDC.ATC.ERROR.NO_CHS;
+                }
+            }, false);
+            break;
+
+        case HDC.ATC.COMMAND.WRITE_DATA:            // 0x30
+            if (DEBUG && this.messageEnabled(Messages.HDC)) {
+                this.printMessage(this.idComponent + ".doATCWrite(" + iDrive + ',' + drive.wCylinder + ':' + drive.bHead + ':' + drive.bSector + ',' + nSectors + ")", true);
+            }
+            this.regStatus = HDC.ATC.STATUS.DATA_REQ;
+            break;
+
+        case HDC.ATC.COMMAND.READ_VERF:             // 0x40
+            /*
+             * Since the READ VERIFY command returns no data, once again, logically, there isn't much we HAVE to
+             * to do, but... TODO: Verify that all the disk parameters are valid, and return an error if they're not.
+             */
+            fInterrupt = true;
+            break;
+
+        case HDC.ATC.COMMAND.SEEK:                  // 0x70
+            /*
+             * Physically, this moves the head(s) to the requested cylinder, but logically, there isn't anything to do;
+             * in fact, we didn't even need this command for the MODEL_5170 ROM BIOS (the COMPAQ DeskPro 386 ROM BIOS was
+             * another story).
+             */
+            fInterrupt = true;
+            break;
+
+        case HDC.ATC.COMMAND.DIAGNOSE:              // 0x90
+            this.regError = HDC.ATC.DIAG.NO_ERROR;
+            fInterrupt = true;
+            break;
+
+        case HDC.ATC.COMMAND.SETPARMS:              // 0x91
+            /*
+             * The documentation implies that the only parameters this command really affects are the number
+             * of heads (from regDrvHd) and sectors/track (from regSecCnt) -- this despite the fact that the BIOS
+             * programs all the other registers.  For a type 2 drive, that includes:
+             *
+             *      WPREC:   0x4B
+             *      SECCNT:  0x11 (for 17 sectors per track)
+             *      CYL:    0x100 (256 -- huh?)
+             *      SECNUM:  0x0C (12 -- huh?)
+             *      DRVHD:   0xA3 (max head of 0x03, for 4 total heads)
+             *
+             * The importance of SECCNT (nSectors) and DRVHD (nHeads) is controlling how multi-sector operations
+             * advance to the next sector; see advanceSector().
+             */
+
+
+            drive.nHeads = nHead + 1;
+            drive.nSectors = nSectors;
+            fInterrupt = true;
+            break;
+
+        default:
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage(this.idComponent + ".doATC(" + Str.toHexByte(this.regCommand) + "): " + (bCmd < 0? ("invalid drive (" + iDrive + ")") : "unsupported operation"));
+                if (MAXDEBUG && bCmd >= 0) this.dbg.stopCPU();
+            }
+            break;
+        }
+
+        if (fInterrupt) this.setATCIRR();
+    }
+
+    /**
+     * setATCIRR(fWrite)
+     *
+     * Raise the ATC's IRQ, provided ATC interrupts are enabled.
+     *
+     * @this {HDC}
+     * @param {boolean} [fWrite] is true on completion of a write to the sector buffer
+     */
+    setATCIRR(fWrite)
+    {
+        if (this.chipset) {
+            if (!(this.regFDR & HDC.ATC.FDR.INT_DISABLE)) {
+                /*
+                 * TODO: Determine what the "correct" instruction delay should be here.  When the OS/2 1.0 Install Disk
+                 * begins copying files to the hard drive, at one point it performs the following 125-sector write (use the
+                 * Debugger's "m hdc on" and "m pic on" commands to enable HDC and PIC messages, along with "m data on"
+                 * if you also want to see the actual sector data being written):
+                 *
+                 *      HDC.doATC(0x30): Write
+                 *      HDC.doATCWrite(0,2:0:5,125)
+                 *
+                 * As the write progresses, you'll notice that the HDC interrupt after each sector occurs at decreasingly
+                 * lower points in the stack, until we eventually start overwriting non-stack data:
+                 *
+                 *      getIRRVector(): IRQ 14 interrupting @0090:52A6 stack=0050:1906
+                 *      getIRRVector(): IRQ 14 interrupting @0318:196B stack=0050:18D6
+                 *      getIRRVector(): IRQ 14 interrupting @0318:196B stack=0050:18A6
+                 *      ...
+                 *      getIRRVector(): IRQ 14 interrupting @0318:196B stack=0050:1156
+                 *
+                 * At roughly this point, very bad things start happening.  I decided to try an arbitrarily large delay
+                 * on the setIRR() call here (120), and the problem vanished, so it seems likely that the OS/2 disk driver
+                 * has a low tolerance for fast controller interrupts during multi-sector operations.
+                 */
+                this.chipset.setIRR(ChipSet.IRQ.ATC, 120);
+                if (DEBUG) this.printMessage(this.idComponent + ".setATCIRR(): enabled", Messages.PIC | Messages.HDC);
+            } else {
+                if (DEBUG) this.printMessage(this.idComponent + ".setATCIRR(): disabled", Messages.PIC | Messages.HDC);
+            }
+        }
+    }
+
+    /**
+     * doXTC()
+     *
+     * Handles XTC (XT Controller) commands
+     *
+     * @this {HDC}
+     */
+    doXTC()
+    {
+        var hdc = this;
+        this.regDataIndex = 0;
+
+        var bCmd = this.popCmd();
+        var bCmdOrig = bCmd;
+        var b1 = this.popCmd();
+        var bDrive = b1 & 0x20;
+        var iDrive = (bDrive >> 5);
+
+        var bHead = b1 & 0x1f;
+        var b2 = this.popCmd();
+        var b3 = this.popCmd();
+        var wCylinder = ((b2 << 2) & 0x300) | b3;
+        var bSector = b2 & 0x3f;
+        var bCount = this.popCmd();             // block count or interleave count, depending on the command
+        var bControl = this.popCmd();
+        var bParm, bDataStatus;
+
+        var drive = this.aDrives[iDrive];
+        if (drive) {
+            drive.wCylinder = wCylinder;
+            drive.bHead = bHead;
+            drive.bSector = bSector;
+            drive.nBytes = bCount * drive.cbSector;
+        }
+
+        /*
+         * I tried to save normal command processing from having to deal with invalid drives,
+         * but the HDC BIOS initializes both drive 0 AND drive 1 on a HDC.XTC.DATA.CMD.INIT_DRIVE command,
+         * and apparently that particular command has no problem with non-existent drives.
+         *
+         * So I've separated the commands into two groups: drive-ambivalent commands should be
+         * processed in the first group, and all the rest should be processed in the second group.
+         */
+        switch (bCmd) {
+
+        case HDC.XTC.DATA.CMD.REQUEST_SENSE:        // 0x03
+            this.beginResult(drive? drive.errorCode : HDC.XTC.DATA.ERR.NOT_READY);
+            this.pushResult(b1);
+            this.pushResult(b2);
+            this.pushResult(b3);
+            /*
+             * Although not terribly clear from IBM's "Fixed Disk Adapter" documentation, a data "status byte"
+             * also follows the 4 "sense bytes".  Interestingly, The HDC BIOS checks that data status byte for
+             * XTC.DATA.STATUS.ERROR, but I have to wonder if it would have ever been set for this command....
+             *
+             * The whole point of the HDC.XTC.DATA.CMD.REQUEST_SENSE command is to obtain details about a
+             * previous error, so if HDC.XTC.DATA.CMD.REQUEST_SENSE itself reports an error, what would that mean?
+             */
+            this.pushResult(HDC.XTC.DATA.STATUS.OK | bDrive);
+            bCmd = -1;                              // mark the command as complete
+            break;
+
+        case HDC.XTC.DATA.CMD.INIT_DRIVE:           // 0x0C
+            /*
+             * Pop off all the extra "Initialize Drive Characteristics" bytes and store them, for the benefit of
+             * other functions, like verifyDrive().
+             */
+            var i = 0;
+            while ((bParm = this.popCmd()) >= 0) {
+                if (drive && i < drive.abDriveParms.length) {
+                    drive.abDriveParms[i++] = bParm;
+                }
+            }
+            if (drive) this.verifyDrive(drive);
+            bDataStatus = HDC.XTC.DATA.STATUS.OK;
+            if (!drive && this.iDriveAllowFail == iDrive) {
+                this.iDriveAllowFail = -1;
+                if (DEBUG) this.printMessage(this.idComponent + ".doXTC(): fake failure triggered");
+                bDataStatus = HDC.XTC.DATA.STATUS.ERROR;
+            }
+            this.beginResult(bDataStatus | bDrive);
+            bCmd = -1;                              // mark the command as complete
+            break;
+
+        case HDC.XTC.DATA.CMD.RAM_DIAGNOSTIC:       // 0xE0
+        case HDC.XTC.DATA.CMD.CTL_DIAGNOSTIC:       // 0xE4
+            this.beginResult(HDC.XTC.DATA.STATUS.OK | bDrive);
+            bCmd = -1;                              // mark the command as complete
+            break;
+
+        default:
+            break;
+        }
+
+        if (bCmd >= 0) {
+            if (drive === undefined) {
+                bCmd = -1;
+            } else {
+                /*
+                 * In preparation for this command, zero out the drive's errorCode and senseCode.
+                 * Commands that require a disk address should update senseCode with HDC.XTC.DATA.SENSE_ADDR_VALID.
+                 * And of course, any command that encounters an error should set the appropriate error code.
+                 */
+                drive.errorCode = HDC.XTC.DATA.ERR.NONE;
+                drive.senseCode = 0;
+            }
+            switch (bCmd) {
+            case HDC.XTC.DATA.CMD.TEST_READY:       // 0x00
+                this.beginResult(HDC.XTC.DATA.STATUS.OK | bDrive);
+                break;
+
+            case HDC.XTC.DATA.CMD.RECALIBRATE:      // 0x01
+                drive.bControl = bControl;
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage(this.idComponent + ".doXTC(): drive " + iDrive + " control byte: " + Str.toHexByte(bControl));
+                }
+                this.beginResult(HDC.XTC.DATA.STATUS.OK | bDrive);
+                break;
+
+            case HDC.XTC.DATA.CMD.READ_VERF:        // 0x05
+                /*
+                 * This is a non-DMA operation, so we simply pretend everything is OK for now.  TODO: Revisit.
+                 */
+                this.beginResult(HDC.XTC.DATA.STATUS.OK | bDrive);
+                break;
+
+            case HDC.XTC.DATA.CMD.READ_DATA:        // 0x08
+                this.doRead(drive, function onXTCReadDataCommand(bStatus) {
+                    hdc.beginResult(bStatus | bDrive);
+                });
+                break;
+
+            case HDC.XTC.DATA.CMD.WRITE_DATA:       // 0x0A
+                /*
+                 * QUESTION: The IBM TechRef (p.1-188) implies that bCount is used as part of HDC.XTC.DATA.CMD.WRITE_DATA command,
+                 * but it is omitted from the HDC.XTC.DATA.CMD.READ_DATA command.  Is that correct?  Note that, as far as the length
+                 * of the transfer is concerned, we rely exclusively on the DMA controller being programmed with the appropriate byte count.
+                 */
+                this.doWrite(drive, function onXTCWriteDataCommand(bStatus) {
+                    hdc.beginResult(bStatus | bDrive);
+                });
+                break;
+
+            case HDC.XTC.DATA.CMD.WRITE_BUFFER:     // 0x0F
+                this.doWriteBuffer(drive, function onXTCWriteBufferCommand(bStatus) {
+                    hdc.beginResult(bStatus | bDrive);
+                });
+                break;
+
+            default:
+                this.beginResult(HDC.XTC.DATA.STATUS.ERROR | bDrive);
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage(this.idComponent + ".doXTC(" + Str.toHexByte(bCmdOrig) + "): " + (bCmd < 0? ("invalid drive (" + iDrive + ")") : "unsupported operation"));
+                    if (MAXDEBUG && bCmd >= 0) this.dbg.stopCPU();
+                }
+                break;
+            }
+        }
+    }
+
+    /**
+     * popCmd()
+     *
+     * @this {HDC}
+     * @return {number}
+     */
+    popCmd()
+    {
+        var bCmd = -1;
+        var bCmdIndex = this.regDataIndex;
+        if (bCmdIndex < this.regDataTotal) {
+            bCmd = this.regDataArray[this.regDataIndex++];
+            if (DEBUG && this.messageEnabled((bCmdIndex > 0? Messages.PORT : 0) | Messages.HDC)) {
+                this.printMessage(this.idComponent + ".popCmd(" + bCmdIndex + "): " + Str.toHexByte(bCmd) + (!bCmdIndex && HDC.aXTCCommands[bCmd]? (" (" + HDC.aXTCCommands[bCmd] + ")") : ""), true);
+            }
+        }
+        return bCmd;
+    }
+
+    /**
+     * beginResult(bResult)
+     *
+     * @this {HDC}
+     * @param {number} [bResult]
+     */
+    beginResult(bResult)
+    {
+        this.regDataIndex = this.regDataTotal = 0;
+        if (bResult !== undefined) this.pushResult(bResult);
+        /*
+         * After the Execution phase (eg, DMA Terminal Count has occurred, or the EOT sector has been read/written),
+         * an interrupt is supposed to occur, signaling the beginning of the Result Phase.  Once the data "status byte"
+         * has been read from XTC.DATA, the interrupt is cleared (see inXTCData).
+         */
+        if (this.chipset) this.chipset.setIRR(ChipSet.IRQ.XTC);
+        this.regStatus |= HDC.XTC.STATUS.INTERRUPT;
+    }
+
+    /**
+     * pushResult(bResult)
+     *
+     * @this {HDC}
+     * @param {number} bResult
+     */
+    pushResult(bResult)
+    {
+        if (DEBUG && this.messageEnabled((this.regDataTotal > 0? Messages.PORT : 0) | Messages.HDC)) {
+            this.printMessage(this.idComponent + ".pushResult(" + this.regDataTotal + "): " + Str.toHexByte(bResult), true);
+        }
+        this.regDataArray[this.regDataTotal++] = bResult;
+    }
+
+    /**
+     * doDMARead(drive, b, done)
+     *
+     * @this {HDC}
+     * @param {Object} drive
+     * @param {number} b
+     * @param {function(number,boolean)} done
+     */
+    doDMARead(drive, b, done)
+    {
+        if (b === undefined || b < 0) {
+            this.readData(drive, done);
+            return;
+        }
+        /*
+         * The DMA controller should be ASKING for data, not GIVING us data; this suggests an internal DMA miscommunication
+         */
+        if (DEBUG) this.printMessage(this.idComponent + ".doDMARead(): invalid DMA acknowledgement");
+        done(-1, false);
+    }
+
+    /**
+     * doDMAWrite(drive, b)
+     *
+     * @this {HDC}
+     * @param {Object} drive
+     * @param {number} b
+     * @return {number}
+     */
+    doDMAWrite(drive, b)
+    {
+        if (b !== undefined && b >= 0)
+            return this.writeData(drive, b);
+        /*
+         * The DMA controller should be GIVING us data, not ASKING for data; this suggests an internal DMA miscommunication
+         */
+        if (DEBUG) this.printMessage(this.idComponent + ".doDMAWrite(): invalid DMA acknowledgement");
+        return -1;
+    }
+
+    /**
+     * doDMAWriteBuffer(drive, b)
+     *
+     * @this {HDC}
+     * @param {Object} drive
+     * @param {number} b
+     * @return {number}
+     */
+    doDMAWriteBuffer(drive, b)
+    {
+        if (b !== undefined && b >= 0)
+            return this.writeBuffer(drive, b);
+        /*
+         * The DMA controller should be GIVING us data, not ASKING for data; this suggests an internal DMA miscommunication
+         */
+        if (DEBUG) this.printMessage(this.idComponent + ".doDMAWriteBuffer(): invalid DMA acknowledgement");
+        return -1;
+    }
+
+    /**
+     * doDMAWriteFormat(drive, b)
+     *
+     * @this {HDC}
+     * @param {Object} drive
+     * @param {number} b
+     * @returns {number}
+     */
+    doDMAWriteFormat(drive, b)
+    {
+        if (b !== undefined && b >= 0)
+            return this.writeFormat(drive, b);
+        /*
+         * The DMA controller should be GIVING us data, not ASKING for data; this suggests an internal DMA miscommunication
+         */
+        if (DEBUG) this.printMessage(this.idComponent + ".doDMAWriteFormat(): invalid DMA acknowledgement");
+        return -1;
+    }
+
+    /**
+     * doRead(drive, done)
+     *
+     * @this {HDC}
+     * @param {Object} drive
+     * @param {function(number)} done (dataStatus is XTC.DATA.STATUS.OK or XTC.DATA.STATUS.ERROR; if error, then drive.errorCode should be set as well)
+     */
+    doRead(drive, done)
+    {
+        drive.errorCode = HDC.XTC.DATA.ERR.NOT_READY;
+
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage(this.idComponent + ".doRead(" + drive.iDrive + ',' + drive.wCylinder + ':' + drive.bHead + ':' + drive.bSector + ',' + ((drive.nBytes / drive.cbSector)|0) + ")");
+        }
+
+        if (drive.disk) {
+            drive.sector = null;
+            if (this.chipset) {
+                /*
+                 * We need to reverse the original logic, and default to success unless/until an actual error occurs;
+                 * otherwise doDMARead()/readData() will bail on us.  The original approach used to work because requestDMA()
+                 * would immediately call us back with fComplete set to true EVEN if the DMA channel was not yet unmasked;
+                 * now the callback is deferred until the DMA channel has been unmasked and the DMA request has finished.
+                 */
+                drive.errorCode = HDC.XTC.DATA.ERR.NONE;
+                this.chipset.connectDMA(ChipSet.DMA_HDC, this, 'dmaRead', drive);
+                this.chipset.requestDMA(ChipSet.DMA_HDC, function onDMAReadRequest(fComplete) {
+                    if (!fComplete) {
+                        /*
+                         * If an incomplete request wasn't triggered by an explicit error, then let's make explicit
+                         * (ie, revert to the default failure code that we originally set above).
+                         */
+                        if (drive.errorCode == HDC.XTC.DATA.ERR.NONE) {
+                            drive.errorCode = HDC.XTC.DATA.ERR.NOT_READY;
+                        }
+                    }
+                    done(drive.errorCode? HDC.XTC.DATA.STATUS.ERROR : HDC.XTC.DATA.STATUS.OK);
+                });
+                return;
+            }
+        }
+        done(drive.errorCode? HDC.XTC.DATA.STATUS.ERROR : HDC.XTC.DATA.STATUS.OK);
+    }
+
+    /**
+     * doWrite(drive, done)
+     *
+     * @this {HDC}
+     * @param {Object} drive
+     * @param {function(number)} done (dataStatus is XTC.DATA.STATUS.OK or XTC.DATA.STATUS.ERROR; if error, then drive.errorCode should be set as well)
+     */
+    doWrite(drive, done)
+    {
+        drive.errorCode = HDC.XTC.DATA.ERR.NOT_READY;
+
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage(this.idComponent + ".doWrite(" + drive.iDrive + ',' + drive.wCylinder + ':' + drive.bHead + ':' + drive.bSector + ',' + ((drive.nBytes / drive.cbSector)|0) + ")");
+        }
+
+        if (drive.disk) {
+            drive.sector = null;
+            if (this.chipset) {
+                /*
+                 * We need to reverse the original logic, and default to success unless/until an actual error occurs;
+                 * otherwise doDMAWrite()/writeData() will bail on us.  The original approach would work because requestDMA()
+                 * would immediately call us back with fComplete set to true EVEN if the DMA channel was not yet unmasked;
+                 * now the callback is deferred until the DMA channel has been unmasked and the DMA request has finished.
+                 */
+                drive.errorCode = HDC.XTC.DATA.ERR.NONE;
+                this.chipset.connectDMA(ChipSet.DMA_HDC, this, 'dmaWrite', drive);
+                this.chipset.requestDMA(ChipSet.DMA_HDC, function onDMAWriteRequest(fComplete) {
+                    if (!fComplete) {
+                        /*
+                         * If an incomplete request wasn't triggered by an explicit error, then let's make explicit
+                         * (ie, revert to the default failure code that we originally set above).
+                         */
+                        if (drive.errorCode == HDC.XTC.DATA.ERR.NONE) {
+                            drive.errorCode = HDC.XTC.DATA.ERR.NOT_READY;
+                        }
+                        /*
+                         * Mask any error that's the result of an attempt to write beyond the end of the track (which is
+                         * something the MS-DOS 4.0M's FORMAT utility seems to like to do).
+                         */
+                        if (drive.errorCode == HDC.XTC.DATA.ERR.NO_SECTOR) {
+                            drive.errorCode = HDC.XTC.DATA.ERR.NONE;
+                        }
+                    }
+                    done(drive.errorCode? HDC.XTC.DATA.STATUS.ERROR : HDC.XTC.DATA.STATUS.OK);
+                });
+                return;
+            }
+        }
+        done(drive.errorCode? HDC.XTC.DATA.STATUS.ERROR : HDC.XTC.DATA.STATUS.OK);
+    }
+
+    /**
+     * doWriteBuffer(drive, done)
+     *
+     * @this {HDC}
+     * @param {Object} drive
+     * @param {function(number)} done (dataStatus is XTC.DATA.STATUS.OK or XTC.DATA.STATUS.ERROR; if error, then drive.errorCode should be set as well)
+     */
+    doWriteBuffer(drive, done)
+    {
+        drive.errorCode = HDC.XTC.DATA.ERR.NOT_READY;
+
+        if (DEBUG) this.printMessage(this.idComponent + ".doWriteBuffer()");
+
+        if (!drive.abSector || drive.abSector.length != drive.nBytes) {
+            drive.abSector = new Array(drive.nBytes);
+        }
+        drive.ibSector = 0;
+        if (this.chipset) {
+            /*
+             * We need to reverse the original logic, and default to success unless/until an actual error occurs;
+             * otherwise doDMAWriteBuffer() will bail on us.  The original approach would work because requestDMA()
+             * would immediately call us back with fComplete set to true EVEN if the DMA channel was not yet unmasked;
+             * now the callback is deferred until the DMA channel has been unmasked and the DMA request has finished.
+             */
+            drive.errorCode = HDC.XTC.DATA.ERR.NONE;
+            this.chipset.connectDMA(ChipSet.DMA_HDC, this, 'dmaWriteBuffer', drive);
+            this.chipset.requestDMA(ChipSet.DMA_HDC, function onDMAWriteBufferRequest(fComplete) {
+                if (!fComplete) {
+                    /*
+                     * If an incomplete request wasn't triggered by an explicit error, then let's make explicit
+                     * (ie, revert to the default failure code that we originally set above).
+                     */
+                    if (drive.errorCode == HDC.XTC.DATA.ERR.NONE) {
+                        drive.errorCode = HDC.XTC.DATA.ERR.NOT_READY;
+                    }
+                }
+                done(drive.errorCode? HDC.XTC.DATA.STATUS.ERROR : HDC.XTC.DATA.STATUS.OK);
+            });
+            return;
+        }
+        done(drive.errorCode? HDC.XTC.DATA.STATUS.ERROR : HDC.XTC.DATA.STATUS.OK);
+    }
+
+    /**
+     * readData(drive, done)
+     *
+     * The following drive variable properties must have been setup prior to our first call:
+     *
+     *      drive.wCylinder
+     *      drive.bHead
+     *      drive.bSector
+     *      drive.sector (initialized to null)
+     *
+     * On the first readData() request, since drive.sector will be null, we ask the Disk object to look
+     * up the first sector of the request.  We then ask the Disk for bytes from that sector until the sector
+     * is exhausted, and then we look up the next sector and continue the process.
+     *
+     * NOTE: Since the HDC isn't aware of the extent of the transfer, all readData() can do is return bytes
+     * until the current track (or, in the case of a multi-track request, the current cylinder) has been exhausted.
+     *
+     * @this {HDC}
+     * @param {Object} drive
+     * @param {function(number,boolean,Object,number)} [done] (number is next available byte from drive, or -1 if no more bytes available)
+     * @param {boolean} [fAutoInc] (default is true to auto-increment)
+     * @return {number} the requested byte, or -1 if unavailable
+     */
+    readData(drive, done, fAutoInc)
+    {
+        var b = -1;
+        var obj = null, off = 0;    // these variables are purely for BACKTRACK purposes
+
+        if (drive.errorCode) {
+            if (done) done(b, false, obj, off);
+            return b;
+        }
+
+        var inc = (fAutoInc !== false? 1 : 0);
+
+        if (drive.sector) {
+            off = drive.ibSector;
+            b = drive.disk.read(drive.sector, drive.ibSector);
+            drive.ibSector += inc;
+            if (b >= 0) {
+                obj = drive.sector;
+                if (done) done(b, false, obj, off);
+                return b;
+            }
+        }
+
+        /*
+         * Locate the next sector, and then try reading again.
+         *
+         * Important difference between the FDC and the XTC: the XTC uses 0-based sector numbers,
+         * hence the bSectorBias below.  I could change how sector numbers are stored in the image,
+         * but it seems preferable to keep the image format consistent and controller-independent.
+         */
+        if (done) {
+            var hdc = this;
+            if (drive.disk) {
+                drive.disk.seek(drive.wCylinder, drive.bHead, drive.bSector + drive.bSectorBias, false, function onReadDataSeek(sector, fAsync) {
+                    if ((drive.sector = sector)) {
+                        obj = sector;
+                        off = drive.ibSector = 0;
+                        /*
+                         * We "pre-advance" bSector et al now, instead of waiting to advance it right before the seek().
+                         * This allows the initial call to readData() to perform a seek without triggering an unwanted advance.
+                         */
+                        hdc.advanceSector(drive);
+                        b = drive.disk.read(drive.sector, drive.ibSector);
+                        drive.ibSector += inc;
+                    } else {
+                        drive.errorCode = HDC.XTC.DATA.ERR.NO_SECTOR;
+                    }
+                    done(b, fAsync, obj, off);
+                });
+                return b;
+            }
+            drive.errorCode = HDC.XTC.DATA.ERR.NO_SECTOR;
+            done(b, false, obj, off);
+        }
+        return b;
+    }
+
+    /**
+     * writeData(drive, b)
+     *
+     * The following drive variable properties must have been setup prior to our first call:
+     *
+     *      drive.wCylinder
+     *      drive.bHead
+     *      drive.bSector
+     *      drive.sector (initialized to null)
+     *
+     * On the first writeData() request, since drive.sector will be null, we ask the Disk object to look
+     * up the first sector of the request.  We then send the Disk bytes for that sector until the sector
+     * is full, and then we look up the next sector and continue the process.
+     *
+     * NOTE: Since the HDC isn't aware of the extent of the transfer, all writeData() can do is accept bytes
+     * until the current track (or, in the case of a multi-track request, the current cylinder) has been exhausted.
+     *
+     * @this {HDC}
+     * @param {Object} drive
+     * @param {number} b containing next byte to write
+     * @return {number} (b unchanged; return -1 if command should be terminated)
+     */
+    writeData(drive, b)
+    {
+        if (drive.errorCode) return -1;
+        do {
+            if (drive.sector) {
+                if (drive.disk.write(drive.sector, drive.ibSector++, b))
+                    break;
+            }
+            /*
+             * Locate the next sector, and then try writing again.
+             *
+             * Important difference between the FDC and the XTC: the XTC uses 0-based sector numbers,
+             * hence the bSectorBias below.  I could change how sector numbers are stored in the image,
+             * but it seems preferable to keep the image format consistent and controller-independent.
+             */
+            if (drive.disk) {
+                drive.disk.seek(drive.wCylinder, drive.bHead, drive.bSector + drive.bSectorBias, true, function onWriteDataSeek(sector, fAsync) {
+                    drive.sector = sector;
+                });
+            }
+            if (!drive.sector) {
+                drive.errorCode = HDC.XTC.DATA.ERR.NO_SECTOR;
+                b = -1;
+                break;
+            }
+            drive.ibSector = 0;
+            /*
+             * We "pre-advance" bSector et al now, instead of waiting to advance it right before the seek().
+             * This allows the initial call to writeData() to perform a seek without triggering an unwanted advance.
+             */
+            this.advanceSector(drive);
+        } while (true);
+        return b;
+    }
+
+    /**
+     * advanceSector(drive)
+     *
+     * This increments the sector number; when the sector number reaches drive.nSectors on the current track, we
+     * increment drive.bHead and reset drive.bSector, and when drive.bHead reaches drive.nHeads, we reset drive.bHead
+     * and increment drive.wCylinder.
+     *
+     * One wrinkle is that the ATC uses 1-based sector numbers (bSectorBias is 0), whereas the XTC uses 0-based sector
+     * numbers (bSectorBias is 1).  Thus, the correct "reset" value for bSector is (1 - bSectorBias), and the correct
+     * limit for bSector is (nSectors + bSectorStart).
+     *
+     * @this {HDC}
+     * @param {Object} drive
+     */
+    advanceSector(drive)
+    {
+
+        drive.bSector++;
+        var bSectorStart = (1 - drive.bSectorBias);
+        if (drive.bSector >= drive.nSectors + bSectorStart) {
+            drive.bSector = bSectorStart;
+            drive.bHead++;
+            if (drive.bHead >= drive.nHeads) {
+                drive.bHead = 0;
+                drive.wCylinder++;
+            }
+        }
+    }
+
+    /**
+     * writeBuffer(drive, b)
+     *
+     * NOTE: Since the HDC isn't aware of the extent of the transfer, all writeBuffer() can do is accept bytes
+     * until the buffer is full.
+     *
+     * TODO: Support for HDC.XTC.DATA.CMD.READ_BUFFER is missing, and support for HDC.XTC.DATA.CMD.WRITE_BUFFER may not be complete;
+     * tests required.
+     *
+     * @this {HDC}
+     * @param {Object} drive
+     * @param {number} b containing next byte to write
+     * @return {number} (b unchanged; return -1 if command should be terminated)
+     */
+    writeBuffer(drive, b)
+    {
+        if (drive.ibSector < drive.abSector.length) {
+            drive.abSector[drive.ibSector++] = b;
+        } else {
+            /*
+             * TODO: Determine the proper error code to return here.
+             */
+            drive.errorCode = HDC.XTC.DATA.ERR.NO_SECTOR;
+            b = -1;
+        }
+        return b;
+    }
+
+    /**
+     * writeFormat(drive, b)
+     *
+     * @this {HDC}
+     * @param {Object} drive
+     * @param {number} b containing a format command byte
+     * @return {number} (b if successful, -1 if command should be terminated)
+     */
+    writeFormat(drive, b)
+    {
+        if (drive.errorCode) return -1;
+        drive.abFormat[drive.cbFormat++] = b;
+        if (drive.cbFormat == drive.abFormat.length) {
+            drive.wCylinder = drive.abFormat[0];    // C
+            drive.bHead = drive.abFormat[1];        // H
+            drive.bSector = drive.abFormat[2];      // R
+            drive.nBytes = 128 << drive.abFormat[3];// N (0 => 128, 1 => 256, 2 => 512, 3 => 1024)
+            drive.cbFormat = 0;
+
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage(this.idComponent + ".writeFormat(" + drive.wCylinder + ":" + drive.bHead + ":" + drive.bSector + ":" + drive.nBytes + ")");
+            }
+
+            for (var i = 0; i < drive.nBytes; i++) {
+                if (this.writeData(drive, drive.bFiller) < 0) {
+                    return -1;
+                }
+            }
+            drive.cSectorsFormatted++;
+        }
+        if (drive.cSectorsFormatted >= drive.bSectorEnd) b = -1;
+        return b;
+    }
+
+    /**
+     * intBIOSDisk(addr)
+     *
+     * NOTE: This function differentiates HDC requests from FDC requests, based on whether the INT 0x13 drive number
+     * in DL is >= 0x80.
+     *
+     * HACK: The HDC BIOS code for both INT 0x13/AH=0x00 and INT 0x13/AH=0x09 calls "INIT_DRV" @C800:0427, which is
+     * hard-coded to issue the HDC.XTC.DATA.CMD.INIT_DRIVE command for BOTH drives 0 and 1 (aka drive numbers 0x80 and
+     * 0x81), regardless of the drive number specified in DL; this means that the HDC.XTC.DATA.CMD.INIT_DRIVE command
+     * must always succeed for drive 1 if it also succeeds for drive 0 -- even if there is no drive 1.  Bizarre, but OK,
+     * whatever.
+     *
+     * So assuming we a have drive 0, when the power-on diagnostics in "DISK_SETUP" @C800:0003 call INT 0x13/AH=0x09
+     * (@C800:00DB) for drive 0, it must succeed.  No problem.  But when "DISK_SETUP" starts probing for additional drives,
+     * it first issues INT 0x13/AH=0x00, followed by INT 0x13/AH=0x11, and finally INT 0x13/AH=0x09.  If the first
+     * (AH=0x00) or third (AH=0x09) INT 0x13 fails, it quickly moves on (ie, it jumps to "POD_DONE").  But as we just
+     * discussed, both those operations call "INIT_DRV", which can't return an error.  This means the only function that
+     * can return an error in this context is the recalibrate function (AH=0x11).  That sucks, because the way the HDC
+     * BIOS is written, it will loop for anywhere from 1.5 seconds to 25 seconds (depending on whether the controller
+     * is part of the "System Unit" or not; see port 0x213), attempting to recalibrate drive 1 until it finally times out.
+     *
+     * Normally, you'll only experience the 1.5 second delay, but even so, it's a ridiculous waste of time and a lot of
+     * useless INT 0x13 calls.  So I monitor INT 0x13/AH=0x00 for DL >= 0x80 and set a special HDC.XTC.DATA.CMD.INIT_DRIVE
+     * override flag (iDriveAllowFail) that will allow that command to fail, and in theory, make the the HDC BIOS
+     * "DISK_SETUP" code much more efficient.
+     *
+     * @this {HDC}
+     * @param {number} addr
+     * @return {boolean} true to proceed with the INT 0x13 software interrupt, false to skip
+     */
+    intBIOSDisk(addr)
+    {
+        var AH = this.cpu.regEAX >> 8;
+        var DL = this.cpu.regEDX & 0xff;
+        if (!AH && DL > 0x80) this.iDriveAllowFail = DL - 0x80;
+        return true;
+    }
+
+    /**
+     * intBIOSDiskette(addr)
+     *
+     * When the HDC BIOS overwrites the ROM BIOS INT 0x13 address, it saves the original INT 0x13 address
+     * in the INT 0x40 vector.  This function intercepts calls to that vector to work around a minor nuisance.
+     *
+     * The HDC BIOS's plan was simple, albeit slightly flawed: assign fixed disks drive numbers >= 0x80,
+     * and whenever someone calls INT 0x13 with a drive number < 0x80, invoke the original INT 0x13 diskette
+     * code via INT 0x40 and return via RET 2.
+     *
+     * Unfortunately, not all original INT 0x13 functions required a drive number in DL (eg, the "reset"
+     * function, where AH=0).  And the HDC BIOS knew this, which is why, in the case of the "reset" function,
+     * the HDC BIOS performs BOTH an INT 0x40 diskette reset AND an HDC reset -- it can't be sure which
+     * controller the caller really wants to reset.
+     *
+     * An unfortunate side-effect of this behavior: when the HDC BIOS is initialized for the first time, it may
+     * issue several resets internally, depending on whether there are 0, 1 or 2 hard drives installed, and each
+     * of those resets also triggers completely useless diskette resets, each wasting up to two seconds waiting
+     * for the FDC to interrupt.  The FDC tries to interrupt, but it can't, because at this early stage of
+     * ROM BIOS initialization, IRQ.FDC hasn't been unmasked yet.
+     *
+     * My work-around: have the HDC component hook INT 0x40, and every time an INT 0x40 is issued with AH=0 and
+     * IRQ.FDC masked, bypass the INT 0x40 interrupt.  This is as close as PCx86 has come to patching any BIOS code
+     * (something I've refused to do), and even here, I'm not doing it out of necessity, just annoyance.
+     *
+     * @this {HDC}
+     * @param {number} addr
+     * @return {boolean} true to proceed with the INT 0x40 software interrupt, false to skip
+     */
+    intBIOSDiskette(addr)
+    {
+        var AH = this.cpu.regEAX >> 8;
+        if ((!AH && this.chipset && this.chipset.checkIMR(ChipSet.IRQ.FDC))) {
+            if (DEBUG) this.printMessage(this.idComponent + ".intBIOSDiskette(): skipping useless INT 0x40 diskette reset");
+            return false;
+        }
+        return true;
+    }
+
+    /**
+     * unloadDrive(iDrive)
+     *
+     * NOTE: At the moment, we support only auto-mounts; there is no user interface for selecting hard drive
+     * images, let alone unloading them, so there is currently no need for the following function.
+     *
+     * @this {HDC}
+     * @param {number} iDrive
+     *
+     unloadDrive(iDrive)
+     {
+        this.aDrives[iDrive].disk = null;
+        //
+        // WARNING: This conversion of drive number to drive letter, starting with "C:" (0x43), is very simplistic
+        // and is not guaranteed to match the drive mapping that DOS ultimately uses.
+        //
+        this.notice("Drive " + String.fromCharCode(0x43 + iDrive) + " unloaded");
+    }
+     */
+
+    /**
+     * doFormat(drive, done)
+     *
+     * The drive variable is initialized by doXTC() to the following extent:
+     *
+     *      drive.bHead (ignored)
+     *      drive.nBytes (bytes/sector)
+     *      drive.bSectorEnd (sectors/track)
+     *      drive.bFiller (fill byte)
+     *
+     * and we expect the DMA controller to provide C, H, R and N (ie, 4 bytes) for each sector to be formatted.
+     *
+     * NOTE: This function is not currently used.
+     *
+     * @this {HDC}
+     * @param {Object} drive
+     * @param {function(number)} done (dataStatus is XTC.DATA.STATUS.OK or XTC.DATA.STATUS.ERROR; if error, then drive.errorCode should be set as well)
+     *
+     doFormat(drive, done)
+     {
+         drive.errorCode = HDC.XTC.DATA.ERR.NOT_READY;
+
+         if (drive.disk) {
+             drive.sector = null;
+             if (this.chipset) {
+                 drive.cbFormat = 0;
+                 drive.abFormat = new Array(4);
+                 drive.bFormatting = true;
+                 drive.cSectorsFormatted = 0;
+                 //
+                 // We need to reverse the original logic, and default to success unless/until an actual error occurs;
+                 // otherwise doDMAWriteFormat() will bail on us.  The original approach would work because requestDMA()
+                 // would immediately call us back with fComplete set to true EVEN if the DMA channel was not yet unmasked;
+                 // now the callback is deferred until the DMA channel has been unmasked and the DMA request has finished.
+                 //
+                 drive.errorCode = HDC.XTC.DATA.ERR.NONE;
+                 this.chipset.connectDMA(ChipSet.DMA_HDC, this, 'dmaWriteFormat', drive);
+                 this.chipset.requestDMA(ChipSet.DMA_HDC, function onDMAFormat(fComplete) {
+                     if (!fComplete) {
+                         //
+                         // If an incomplete request wasn't triggered by an explicit error, then let's make explicit
+                         // (ie, revert to the default failure code that we originally set above).
+                         //
+                         if (drive.errorCode == HDC.XTC.DATA.ERR.NONE) {
+                             drive.errorCode = HDC.XTC.DATA.ERR.NOT_READY;
+                         }
+                     }
+                     drive.bFormatting = false;
+                     done(drive.errorCode? HDC.XTC.DATA.STATUS.ERROR : HDC.XTC.DATA.STATUS.OK);
+                 });
+                 return;
+             }
+         }
+         done(drive.errorCode? HDC.XTC.DATA.STATUS.ERROR : HDC.XTC.DATA.STATUS.OK);
+     }
+     */
+
+    /**
+     * HDC.init()
+     *
+     * This function operates on every HTML element of class "hdc", extracting the
+     * JSON-encoded parameters for the HDC constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a HDC component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeHDC = Component.getElementsByClass(document, PCX86.APPCLASS, "hdc");
+        for (var iHDC = 0; iHDC < aeHDC.length; iHDC++) {
+            var eHDC = aeHDC[iHDC];
+            var parmsHDC = Component.getComponentParms(eHDC);
+            var hdc = new HDC(parmsHDC);
+            Component.bindComponentControls(hdc, eHDC, PCX86.APPCLASS);
+        }
+    }
+}
+
+/*
+ * HDC defaults, in case drive parameters weren't specified
+ */
+HDC.DEFAULT_DRIVE_NAME = "Hard Drive";
+
+/*
+ * Each of the following DriveType entries contain (up to) 4 values:
+ *
+ *      [0]: total cylinders
+ *      [1]: total heads
+ *      [2]: total sectors/tracks (optional; default is 17)
+ *      [3]: total bytes/sector (optional; default is 512)
+ *
+ * verifyDrive() attempts to confirm that these values agree with the programmed drive characteristics.
+ *
+ * NOTE: For the record, in the world of PCjs, 1Kb is 1 kilobyte aka 1,024 bytes (NOT 1,000), and 1Mb
+ * is 1 megabyte aka 1024*1024 or 1,048,576 bytes (NOT 1,000,000).
+ *
+ * Apparently, in 1998, it was decided that a kilobyte should be 1,000 bytes and a megabyte should be
+ * 1,000,000 bytes, and that if you really meant 2^10 (1,024) or 2^20 (1,048,576), you should use "kibibyte"
+ * (KiB) or "mebibyte" (MiB) instead.  Well, since PCjs simulates machines that pre-date 1998, I feel
+ * perfectly justified in retaining my original understanding of Kb and Mb and completely ignoring the
+ * existence of KiB and MiB.
+ *
+ * Besides, I suspect these changes were nothing more than a self-serving push by hard drive manufacturers,
+ * who wanted to exaggerate their disk capacities by treating Mb as 1,000,000 bytes.
+ *
+ * Also, I capitalize only the first letter of units like Kb and Mb, because kilobyte and megabyte are
+ * single words; if they were two words, or even a pair of hyphenated words, then I might -- but they're not.
+ */
+
+/*
+ * Drive type tables differed across IBM controller models (XTC drive types don't match ATC drive types)
+ * and across OEMs (eg, COMPAQ drive types only match a few IBM drive types), so you must use iDriveTable to
+ * index the correct table type inside both aDriveTables and aDriveTypes.
+ */
+HDC.aDriveTables = ["XTC", "ATC", "COMPAQ"];
+
+HDC.aDriveTypes = [
+    /*
+     * aDriveTypes[0] is for the IBM PC XT (XTC) controller.
+     */
+    {
+         0: [306, 2],
+         1: [375, 8],
+         2: [306, 6],
+         3: [306, 4]            // 10Mb (10.16Mb: 306*4*17*512 or 10,653,696 bytes) (default XTC drive type: 3)
+    },
+    /*
+     * aDriveTypes[1] is for the IBM PC AT (ATC) controller.
+     *
+     * The following is a more complete description of the drive types supported by the MODEL_5170, where C is
+     * Cylinders, H is Heads, WP is Write Pre-Comp, and LZ is Landing Zone (in practice, we don't need WP or LZ).
+     *
+     * Type    C    H   WP   LZ
+     * ----  ---   --  ---  ---
+     *   1   306    4  128  305
+     *   2   615    4  300  615
+     *   3   615    6  300  615
+     *   4   940    8  512  940
+     *   5   940    6  512  940
+     *   6   615    4   no  615
+     *   7   462    8  256  511
+     *   8   733    5   no  733
+     *   9   900   15   no  901
+     *  10   820    3   no  820
+     *  11   855    5   no  855
+     *  12   855    7   no  855
+     *  13   306    8  128  319
+     *  14   733    7   no  733
+     *  15  (reserved--all zeros)
+     *  16   612    4  all  663
+     *  17   977    5  300  977
+     *  18   977    7   no  977
+     *  19  1024    7  512 1023
+     *  20   733    5  300  732
+     *  21   733    7  300  732
+     *  22   733    5  300  733
+     *  23   306    4   no  336
+     */
+    {
+         1: [306,  4],          // 10Mb (10.16Mb:  306*4*17*512 or 10,653,696 bytes)
+         2: [615,  4],          // 20Mb (20.42Mb:  615*4*17*512 or 21,411,840 bytes) (default ATC drive type: 2)
+         3: [615,  6],          // 31Mb (30.63Mb:  615*6*17*512 or 32,117,760 bytes)
+         4: [940,  8],          // 62Mb (62.42Mb:  940*8*17*512 or 65,454,080 bytes)
+         5: [940,  6],          // 47Mb (46.82Mb:  940*6*17*512 or 49,090,560 bytes)
+         6: [615,  4],
+         7: [462,  8],
+         8: [733,  5],
+         9: [900, 15],
+        10: [820,  3],
+        11: [855,  5],
+        12: [855,  7],
+        13: [306,  8],
+        14: [733,  7],
+        16: [612,  4],
+        17: [977,  5],
+        18: [977,  7],
+        19: [1024, 7],
+        20: [733,  5],
+        21: [733,  7],
+        22: [733,  5],
+        23: [306,  4]
+    },
+    /*
+     * aDriveTypes[2] is for the COMPAQ DeskPro (ATC) controller.
+     *
+     * NOTE: According to COMPAQ, drive type 25 (0x19) must be used with their 130Mb drive when using MS-DOS 3.1
+     * or earlier, or when using any [unspecified] application software that supports only 17 sectors per track;
+     * otherwise, use drive type 35 (0x23), which uses the drive's full capacity of 34 sectors per track.
+     */
+    {
+         1: [306,  4],          // same as IBM
+         2: [615,  4],          // same as IBM
+         3: [615,  6],          // same as IBM
+         4: [1023, 8],          // 68Mb (67.93Mb: 1023*8*17*512 or 71,233,536 bytes) (TODO: Cylinders is listed as 1024 in the COMPAQ TechRef; confirm)
+         5: [940,  6],          // same as IBM
+         6: [697,  5],
+         7: [462,  8],          // same as IBM
+         8: [925,  5],
+         9: [900, 15],          // same as IBM
+        10: [980,  5],
+        11: [925,  7],
+        12: [925,  9],          // 70Mb (69.10Mb: 925*9*17*512 or 72,460,800 bytes)
+        13: [612,  8],
+        14: [980,  4],
+        /*
+         * Since the remaining drive types are > 14, they must be stored in either EXTHDRIVE0 or EXTHDRIVE1 CMOS bytes (0x19 or 0x1A)
+         */
+        16: [612,  4],          // same as IBM
+        17: [980,  5],          // 40Mb (40.67Mb: 980*5*17*512 or 42,649,600 bytes)
+        18: [966,  6],
+        19: [1023, 8],
+        20: [733,  5],          // same as IBM
+        21: [733,  7],          // same as IBM
+        22: [524,  4, 40],
+        23: [924,  8],
+        24: [966, 14],
+        25: [966, 16],          // 130Mb (128.30Mb: 966*16*17*512 or 134,529,024 bytes)
+        26: [1023,14],
+        27: [832,  6, 33],
+        28: [1222,15, 34],
+        29: [1240, 7, 34],
+        30: [615,  4, 25],
+        31: [615,  8, 25],
+        32: [905,  9, 25],
+        33: [832,  8, 33],      // 110Mb (107.25Mb: 832*8*33*512 or 112,459,776 bytes)
+        34: [966,  7, 34],
+        35: [966,  8, 34],      // 130Mb (128.30Mb: 966*8*34*512 or 134,529,024 bytes)
+        36: [966,  9, 34],
+        37: [966,  5, 34],
+        38: [612, 16, 63],      // 300Mb (301.22Mb: 612*16*63*512 or 315,850,752 bytes) (TODO: Cylinders is listed as 611 in the COMPAQ TechRef; confirm)
+        39: [1023,11, 33],
+        40: [1023,15, 34],
+        41: [1630,15, 52],
+        42: [1023,16, 63],
+        43: [805,  4, 26],
+        44: [805,  2, 26],
+        45: [748,  8, 33],
+        46: [748,  6, 33],
+        47: [966,  5, 25]
+    }
+];
+
+/*
+ * ATC (AT Controller) Registers
+ *
+ * The "IBM Personal Computer AT Fixed Disk and Diskette Drive Adapter", aka the HFCOMBO card, contains what we refer
+ * to here as the ATC (AT Controller).  Even though that card contains both Fixed Disk and Diskette Drive controllers,
+ * this component (HDC) still deals only with the "Fixed Disk" portion.  Fortunately, the "Diskette Drive Adapter"
+ * portion of the card is compatible with the existing FDC component, so that component continues to be responsible
+ * for all diskette operations.
+ *
+ * ATC ports default to their primary addresses; secondary port addresses are 0x80 lower (eg, 0x170 instead of 0x1F0).
+ *
+ * It's important to know that the MODEL_5170 BIOS has a special relationship with the "Combo Hard File/Diskette
+ * (HFCOMBO) Card" (see @F000:144C).  Initially, the ChipSet component intercepted reads for HFCOMBO's STATUS port
+ * and returned the BUSY bit clear to reduce boot time; however, it turned out that was also a prerequisite for the
+ * BIOS to write test patterns to the CYLLO port (0x1F4) and set the "DUAL" bit (bit 0) of the "HFCNTRL" byte at 40:8Fh
+ * if those CYLLO operations succeeded (now that the HDC is "ATC-aware", the ChipSet port intercepts have been removed).
+ *
+ * Without the "DUAL" bit set, when it came time later to report the diskette drive type, the "DISK_TYPE" function
+ * (@F000:273D) would branch to one of two almost-identical blocks of code -- specifically, a block that disallowed
+ * diskette drive types >= 2 (ChipSet.CMOS.FDRIVE.FD360) instead of >= 3 (ChipSet.CMOS.FDRIVE.FD1200).
+ *
+ * In other words, the "Fixed Disk" portion of the HFCOMBO controller has to be present and operational if the user
+ * wants to use high-capacity (80-track) diskettes with "Diskette Drive" portion of the controller.  This may not be
+ * immediately obvious to anyone creating a 5170 machine configuration with the FDC component but no HDC component.
+ *
+ * TODO: Investigate what a MODEL_5170 can do, if anything, with diskettes if an "HFCOMBO card" was NOT installed;
+ * eg, was there Diskette-only Controller that could be installed, and if so, did it support high-capacity diskette
+ * drives?  Also, consider making the FDC component able to detect when the HDC is missing and provide the same minimal
+ * HFCOMBO port intercepts that ChipSet once provided (this is not a requirement, just a usability improvement).
+ *
+ * UPDATE: I later discovered that newer (ie, REV2 and REV3) 5170 ROMs are even less happy when no HDC is installed,
+ * *unless* an undocumented FDC "DIAGNOSTIC" register (port 0x3F1) provides a "MULTIPLE DATA RATE" response, bypassing
+ * the HDC port tests described above.  This may also imply that those newer 5170 revisions are incompatible with FD360
+ * diskette drives, because if none of the "MULTIPLE DATA RATE" tests succeed, a "601-Diskette Error" always occurs.
+ */
+HDC.ATC = {
+    DATA:   { PORT: 0x1F0},     // no register (read-write)
+    DIAG:   {                   // this.regError (read-only)
+        PORT:       0x1F1,
+        NO_ERROR:    0x01,
+        CTRL_ERROR:  0x02,
+        SEC_ERROR:   0x03,
+        ECC_ERROR:   0x04,
+        PROC_ERROR:  0x05
+    },
+    ERROR: {                    // this.regError (read-only)
+        PORT:       0x1F1,
+        NONE:        0x00,
+        NO_DAM:      0x01,      // Data Address Mark (DAM) not found
+        NO_TRK0:     0x02,      // Track 0 not detected
+        CMD_ABORT:   0x04,      // Aborted Command
+        NO_CHS:      0x10,      // ID field with the specified C:H:S not found
+        ECC_ERR:     0x40,      // Data ECC Error
+        BAD_BLOCK:   0x80       // Bad Block Detect
+    },
+    WPREC:  { PORT: 0x1F1},     // this.regWPreC (write-only)
+    SECCNT: { PORT: 0x1F2},     // this.regSecCnt (read-write; 0 implies a 256-sector request)
+    SECNUM: { PORT: 0x1F3},     // this.regSecNum (read-write)
+    CYLLO:  { PORT: 0x1F4},     // this.regCylLo (read-write; all 8 bits are used)
+    CYLHI:  {                   // this.regCylHi (read-write; only bits 0-1 are used, for a total of 10 bits, or 1024 max cylinders)
+        PORT:       0x1F5,
+        MASK:        0x03
+    },
+    DRVHD:  {                   // this.regDrvHd (read-write)
+        PORT:       0x1F6,
+        HEAD_MASK:   0x0F,      // set this to the max number of heads before issuing a SET PARAMETERS command
+        DRIVE_MASK:  0x10,
+        SET_MASK:    0xE0,
+        SET_BITS:    0xA0       // for whatever reason, these bits must always be set
+    },
+    STATUS: {                   // this.regStatus (read-only; reading clears IRQ.ATC)
+        PORT:       0x1F7,
+        ERROR:       0x01,      // set when the previous command ended in an error; one or more bits are set in the ERROR register (the next command to the controller resets the ERROR bit)
+        INDEX:       0x02,      // set once for every revolution of the disk
+        CORRECTED:   0x04,
+        DATA_REQ:    0x08,      // indicates that "the sector buffer requires servicing during a Read or Write command. If either bit 7 (BUSY) or this bit is active, a command is being executed. Upon receipt of any command, this bit is reset."
+        SEEK_OK:     0x10,      // seek operation complete
+        WFAULT:      0x20,      // write fault
+        READY:       0x40,      // if this is set (along with the SEEK_OK bit), the drive is ready to read/write/seek again
+        BUSY:        0x80       // if this is set, no other STATUS bits are valid
+    },
+    COMMAND: {                  // this.regCommand (write-only)
+        PORT:       0x1F7,
+        RESTORE:     0x10,      // low nibble x 500us equal stepping rate (except for 0, which corresponds to 35us) (aka RECALIBRATE)
+        READ_DATA:   0x20,      // also supports NO_RETRIES and WITH_ECC
+        WRITE_DATA:  0x30,      // also supports NO_RETRIES and WITH_ECC
+        READ_VERF:   0x40,      // also supports NO_RETRIES
+        FORMAT_TRK:  0x50,      // TODO
+        SEEK:        0x70,      // low nibble x 500us equal stepping rate (except for 0, which corresponds to 35us)
+        DIAGNOSE:    0x90,
+        SETPARMS:    0x91,
+        NO_RETRIES:  0x01,
+        WITH_ECC:    0x02,
+        MASK:        0xF0
+    },
+    FDR: {                      // this.regFDR
+        PORT:       0x3F6,
+        INT_DISABLE: 0x02,      // a logical 0 enables fixed disk interrupts
+        RESET:       0x04,      // a logical 1 enables reset fixed disk function
+        HS3:         0x08,      // a logical 1 enables head select 3 (a logical 0 enables reduced write current)
+        RESERVED:    0xF1
+    }
+};
+
+/*
+ * XTC (XT Controller) Registers
+ */
+HDC.XTC = {
+    /*
+     * XTC Data Register (0x320, read-write)
+     *
+     * Writes to this register are discussed below; see HDC Commands.
+     *
+     * Reads from this register after a command has been executed retrieve a "status byte",
+     * which must NOT be confused with the Status Register (see below).  This data "status byte"
+     * contains only two bits of interest: XTC.DATA.STATUS.ERROR and XTC.DATA.STATUS.UNIT.
+     */
+    DATA: {
+        PORT:          0x320,   // port address
+        STATUS: {
+            OK:         0x00,   // no error
+            ERROR:      0x02,   // error occurred during command execution
+            UNIT:       0x20    // logical unit number of the drive
+        },
+        /*
+         * XTC Commands, as issued to XTC_DATA
+         *
+         * Commands are multi-byte sequences sent to XTC_DATA, starting with a XTC_DATA.CMD byte,
+         * and followed by 5 more bytes, for a total of 6 bytes, which collectively are called a
+         * Device Control Block (DCB).  Not all commands use all 6 bytes, but all 6 bytes must be present;
+         * unused bytes are simply ignored.
+         *
+         *      XTC_DATA.CMD    (3-bit class code, 5-bit operation code)
+         *      XTC_DATA.HEAD   (1-bit drive number, 5-bit head number)
+         *      XTC_DATA.CLSEC  (upper bits of 10-bit cylinder number, 6-bit sector number)
+         *      XTC_DATA.CH     (lower bits of 10-bit cylinder number)
+         *      XTC_DATA.COUNT  (8-bit interleave or block count)
+         *      XTC_DATA.CTRL   (8-bit control field)
+         *
+         * One command, HDC.XTC.DATA.CMD.INIT_DRIVE, must include 8 additional bytes following the DCB:
+         *
+         *      maximum number of cylinders (high)
+         *      maximum number of cylinders (low)
+         *      maximum number of heads
+         *      start reduced write current cylinder (high)
+         *      start reduced write current cylinder (low)
+         *      start write precompensation cylinder (high)
+         *      start write precompensation cylinder (low)
+         *      maximum ECC data burst length
+         *
+         * Note that the 3 word values above are stored in "big-endian" format (high byte followed by low byte),
+         * rather than the more typical "little-endian" format (low byte followed by high byte).
+         */
+        CMD: {
+            TEST_READY:     0x00,       // Test Drive Ready
+            RECALIBRATE:    0x01,       // Recalibrate
+            REQUEST_SENSE:  0x03,       // Request Sense Status
+            FORMAT_DRIVE:   0x04,       // Format Drive
+            READ_VERF:      0x05,       // Read Verify
+            FORMAT_TRK:     0x06,       // Format Track
+            FORMAT_BAD:     0x07,       // Format Bad Track
+            READ_DATA:      0x08,       // Read
+            WRITE_DATA:     0x0A,       // Write
+            SEEK:           0x0B,       // Seek
+            INIT_DRIVE:     0x0C,       // Initialize Drive Characteristics
+            READ_ECC_BURST: 0x0D,       // Read ECC Burst Error Length
+            READ_BUFFER:    0x0E,       // Read Data from Sector Buffer
+            WRITE_BUFFER:   0x0F,       // Write Data to Sector Buffer
+            RAM_DIAGNOSTIC: 0xE0,       // RAM Diagnostic
+            DRV_DIAGNOSTIC: 0xE3,       // HDC BIOS: CHK_DRV_CMD
+            CTL_DIAGNOSTIC: 0xE4,       // HDC BIOS: CNTLR_DIAG_CMD
+            READ_LONG:      0xE5,       // HDC BIOS: RD_LONG_CMD
+            WRITE_LONG:     0xE6        // HDC BIOS: WR_LONG_CMD
+        },
+        ERR: {
+            /*
+             * HDC error conditions, as returned in byte 0 of the (4) bytes returned by the Request Sense Status command
+             */
+            NONE:           0x00,
+            NO_INDEX:       0x01,       // no index signal detected
+            SEEK_INCOMPLETE:0x02,       // no seek-complete signal
+            WRITE_FAULT:    0x03,
+            NOT_READY:      0x04,       // after the controller selected the drive, the drive did not respond with a ready signal
+            NO_TRACK:       0x06,       // after stepping the max number of cylinders, the controller did not receive the track 00 signal from the drive
+            STILL_SEEKING:  0x08,
+            ECC_ID_ERROR:   0x10,
+            ECC_DATA_ERROR: 0x11,
+            NO_ADDR_MARK:   0x12,
+            NO_SECTOR:      0x14,
+            BAD_SEEK:       0x15,       // seek error: the cylinder and/or head address did not compare with the expected target address
+            ECC_CORRECTABLE:0x18,       // correctable data error
+            BAD_TRACK:      0x19,
+            BAD_CMD:        0x20,
+            BAD_DISK_ADDR:  0x21,
+            RAM:            0x30,
+            CHECKSUM:       0x31,
+            POLYNOMIAL:     0x32,
+            MASK:           0x3F
+        },
+        SENSE: {
+            ADDR_VALID:     0x80
+        }
+    },
+    /*
+     * XTC Status Register (0x321, read-only)
+     *
+     * WARNING: The IBM Technical Reference Manual *badly* confuses the XTC_DATA "status byte" (above)
+     * that the controller sends following an HDC.XTC.DATA.CMD operation with the Status Register (below).
+     * In fact, it's so badly confused that it completely fails to document any of the Status Register
+     * bits below; I'm forced to guess at their meanings from the HDC BIOS listing.
+     */
+    STATUS: {
+        PORT:          0x321,   // port address
+        NONE:           0x00,
+        REQ:            0x01,   // HDC BIOS: request bit
+        IOMODE:         0x02,   // HDC BIOS: mode bit (GUESS: set whenever XTC_DATA contains a response?)
+        BUS:            0x04,   // HDC BIOS: command/data bit (GUESS: set whenever XTC_DATA ready for request?)
+        BUSY:           0x08,   // HDC BIOS: busy bit
+        INTERRUPT:      0x20    // HDC BIOS: interrupt bit
+    }
+};
+
+/*
+ * XTC Config Register (0x322, read-only)
+ *
+ * This register is used to read HDC card switch settings that defined the "Drive Type" for
+ * drives 0 and 1.  SW[1],SW[2] (for drive 0) and SW[3],SW[4] (for drive 1) are set as follows:
+ *
+ *      ON,  ON     Drive Type 0   (306 cylinders, 2 heads)
+ *      ON,  OFF    Drive Type 1   (375 cylinders, 8 heads)
+ *      OFF, ON     Drive Type 2   (306 cylinders, 6 heads)
+ *      OFF, OFF    Drive Type 3   (306 cylinders, 4 heads)
+ */
+
+/*
+ * HDC Command Sequences
+ *
+ * Unlike the FDC, all the HDC commands have fixed-length command request sequences (well, OK, except for
+ * HDC.XTC.DATA.CMD.INIT_DRIVE) and fixed-length response sequences (well, OK, except for HDC.XTC.DATA.CMD.REQUEST_SENSE),
+ * so a table of byte-lengths isn't much use, but having names for all the commands is still handy for debugging.
+ */
+if (DEBUG) {
+    HDC.aATCCommands = {
+        0x10: "Restore (Recalibrate)",
+        0x20: "Read",
+        0x30: "Write",
+        0x40: "Read Verify",
+        0x50: "Format Track",
+        0x70: "Seek",
+        0x90: "Diagnose",
+        0x91: "Set Parameters"
+    };
+    HDC.aXTCCommands = {
+        0x00: "Test Drive Ready",
+        0x01: "Recalibrate",
+        0x03: "Request Sense Status",
+        0x04: "Format Drive",
+        0x05: "Read Verify",
+        0x06: "Format Track",
+        0x07: "Format Bad Track",
+        0x08: "Read",
+        0x0A: "Write",
+        0x0B: "Seek",
+        0x0C: "Initialize Drive Characteristics",
+        0x0D: "Read ECC Burst Error Length",
+        0x0E: "Read Data from Sector Buffer",
+        0x0F: "Write Data to Sector Buffer",
+        0xE0: "RAM Diagnostic",
+        0xE3: "Drive Diagnostic",
+        0xE4: "Controller Diagnostic",
+        0xE5: "Read Long",
+        0xE6: "Write Long"
+    };
+}
+
+/*
+ * Port input notification tables
+ */
+HDC.aXTCPortInput = {
+    0x320:  HDC.prototype.inXTCData,
+    0x321:  HDC.prototype.inXTCStatus,
+    0x322:  HDC.prototype.inXTCConfig
+};
+
+/*
+ * For future reference, the REV2 and REV3 PC AT ROM BIOS also refer to a "FIXED DISK DIAGNOSTIC REGISTER" at
+ * port 0x5F7, but I have no documentation on it, and failure to respond is non-fatal.  See the discussion of the
+ * FDC diagnostic register in inFDCDiagnostic() for more details.
+ */
+HDC.aATCPortInput = {
+    0x1F0:  HDC.prototype.inATCData,
+    0x1F1:  HDC.prototype.inATCError,
+    0x1F2:  HDC.prototype.inATCSecCnt,
+    0x1F3:  HDC.prototype.inATCSecNum,
+    0x1F4:  HDC.prototype.inATCCylLo,
+    0x1F5:  HDC.prototype.inATCCylHi,
+    0x1F6:  HDC.prototype.inATCDrvHd,
+    0x1F7:  HDC.prototype.inATCStatus
+};
+
+/*
+ * Port output notification tables
+ */
+HDC.aXTCPortOutput = {
+    0x320:  HDC.prototype.outXTCData,
+    0x321:  HDC.prototype.outXTCReset,
+    0x322:  HDC.prototype.outXTCPulse,
+    0x323:  HDC.prototype.outXTCPattern,
+    /*
+     * The PC XT Fixed Disk BIOS includes some additional "housekeeping" that it performs
+     * not only on port 0x323 but also on three additional ports, at increments of 4 (see all
+     * references to "RESET INT/DMA MASK" in the Fixed Disk BIOS).  It's not clear to me if
+     * those ports refer to additional HDC controllers, and I haven't seen other references to
+     * them, but in any case, they represent a lot of "I/O noise" that we simply squelch here.
+     */
+    0x327:  HDC.prototype.outXTCNoise,
+    0x32B:  HDC.prototype.outXTCNoise,
+    0x32F:  HDC.prototype.outXTCNoise
+};
+
+HDC.aATCPortOutput = {
+    0x1F0:  HDC.prototype.outATCData,
+    0x1F1:  HDC.prototype.outATCWPreC,
+    0x1F2:  HDC.prototype.outATCSecCnt,
+    0x1F3:  HDC.prototype.outATCSecNum,
+    0x1F4:  HDC.prototype.outATCCylLo,
+    0x1F5:  HDC.prototype.outATCCylHi,
+    0x1F6:  HDC.prototype.outATCDrvHd,
+    0x1F7:  HDC.prototype.outATCCommand,
+    0x3F6:  HDC.prototype.outATCFDR
+};
+
+/*
+ * Initialize every Hard Drive Controller (HDC) module on the page.
+ */
+Web.onInit(HDC.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/debugger.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * Debugger Address Object
+ *
+ * This is the basic structure; other debuggers may extend it.
+ *
+ *      addr            address
+ *      fTemporary      true if this is a temporary breakpoint address
+ *      sCmd            set for breakpoint addresses if there's an associated command string
+ *      aCmds           preprocessed commands (from sCmd)
+ *
+ * @typedef {{
+ *      addr:(number|undefined),
+ *      fTemporary:(boolean|undefined),
+ *      sCmd:(string|undefined),
+ *      aCmds:(Array.<string>|undefined)
+ * }}
+ */
+var DbgAddr;
+
+/**
+ * Since the Closure Compiler treats ES6 classes as @struct rather than @dict by default,
+ * it deters us from defining named properties on our components; eg:
+ *
+ *      this['exports'] = {...}
+ *
+ * results in an error:
+ *
+ *      Cannot do '[]' access on a struct
+ *
+ * So, in order to define 'exports', we must override the @struct assumption by annotating
+ * the class as @unrestricted (or @dict).  Note that this must be done both here and in the
+ * subclass (eg, SerialPort), because otherwise the Compiler won't allow us to *reference*
+ * the named property either.
+ *
+ * TODO: Consider marking ALL our classes unrestricted, because otherwise it forces us to
+ * define every single property the class uses in its constructor, which results in a fair
+ * bit of redundant initialization, since many properties aren't (and don't need to be) fully
+ * initialized until the appropriate init(), reset(), restore(), etc. function is called.
+ *
+ * The upside, however, may be that since the structure of the class is completely defined by
+ * the constructor, JavaScript engines may be able to optimize and run more efficiently.
+ *
+ * @unrestricted
+ */
+class Debugger extends Component
+{
+    /**
+     * Debugger(parmsDbg)
+     *
+     * The Debugger component supports the following optional (parmsDbg) properties:
+     *
+     *      base: the base to use for most numeric input/output (default is 16)
+     *
+     * The Debugger component is a shared component containing a subset of functionality used by
+     * the other CPU-specific Debuggers (eg, DebuggerX86).  Over time, the goal is to factor out as
+     * much common debugging support as possible from those components into this one.
+     *
+     * @param {Object} parmsDbg
+     */
+    constructor(parmsDbg)
+    {
+        if (DEBUGGER) {
+
+            super("Debugger", parmsDbg);
+
+            /*
+             * Default base used to display all values; modified with the "s base" command.
+             */
+            this.nBase = +parmsDbg['base'] || 16;
+
+            /*
+             * Default number of bits of integer precision; it can be overridden by the Debugger
+             * but there is no command to adjust it.
+             */
+            this.nBits = 32;
+
+            this.achGroup = ['{','}'];
+            this.achAddress = ['[',']'];
+
+            /*
+             * These keep track of instruction activity, but only when tracing or when Debugger checks
+             * have been enabled (eg, one or more breakpoints have been set).
+             *
+             * They are zeroed by the reset() notification handler.  cInstructions is advanced by
+             * stepCPU() and checkInstruction() calls.  nCycles is updated by every stepCPU() or stop()
+             * call and simply represents the number of cycles performed by the last run of instructions.
+             */
+            this.nCycles = 0;
+            this.cOpcodes = this.cOpcodesStart = 0;
+
+            /*
+             * fAssemble is true when "assemble mode" is active, false when not.
+             */
+            this.fAssemble = false;
+
+            /*
+             * This maintains command history.  New commands are inserted at index 0 of the array.
+             * When Enter is pressed on an empty input buffer, we default to the command at aPrevCmds[0].
+             */
+            this.iPrevCmd = -1;
+            this.aPrevCmds = [];
+
+            /*
+             * aVariables is an object with properties that grow as setVariable() assigns more variables;
+             * each property corresponds to one variable, where the property name is the variable name (ie,
+             * a string beginning with a non-digit, followed by zero or more symbol characters and/or digits)
+             * and the property value is the variable's numeric value.  See doVar() and setVariable() for
+             * details.
+             *
+             * Note that parseValue() parses variables before numbers, so any variable that looks like a
+             * unprefixed hex value (eg, "a5" as opposed to "0xa5") will trump the numeric value.  Unprefixed
+             * hex values are a convenience of parseValue(), which always calls Str.parseInt() with a default
+             * base of 16; however, that default be overridden with a variety of explicit prefixes or suffixes
+             * (eg, a leading "0o" to indicate octal, a trailing period to indicate decimal, etc.)
+             *
+             * See Str.parseInt() for more details about supported numbers.
+             */
+            this.aVariables = {};
+
+        }   // endif DEBUGGER
+    }
+
+    /**
+     * getRegIndex(sReg, off)
+     *
+     * NOTE: This must be implemented by the individual debuggers.
+     *
+     * @this {Debugger}
+     * @param {string} sReg
+     * @param {number} [off] optional offset into sReg
+     * @return {number} register index, or -1 if not found
+     */
+    getRegIndex(sReg, off)
+    {
+        return -1;
+    }
+
+    /**
+     * getRegValue(iReg)
+     *
+     * NOTE: This must be implemented by the individual debuggers.
+     *
+     * @this {Debugger}
+     * @param {number} iReg
+     * @return {number|undefined}
+     */
+    getRegValue(iReg)
+    {
+        return undefined;
+    }
+
+    /**
+     * parseAddrReference(s, sAddr)
+     *
+     * Returns the given string with the given address reference replaced with the contents of that address.
+     *
+     * NOTE: This must be implemented by the individual debuggers.
+     *
+     * @this {Debugger}
+     * @param {string} s
+     * @param {string} sAddr
+     * @return {string}
+     */
+    parseAddrReference(s, sAddr)
+    {
+        return s.replace('[' + sAddr + ']', "unimplemented");
+    }
+
+    /**
+     * getNextCommand()
+     *
+     * @this {Debugger}
+     * @return {string}
+     */
+    getNextCommand()
+    {
+        var sCmd;
+        if (this.iPrevCmd > 0) {
+            sCmd = this.aPrevCmds[--this.iPrevCmd];
+        } else {
+            sCmd = "";
+            this.iPrevCmd = -1;
+        }
+        return sCmd;
+    }
+
+    /**
+     * getPrevCommand()
+     *
+     * @this {Debugger}
+     * @return {string|null}
+     */
+    getPrevCommand()
+    {
+        var sCmd = null;
+        if (this.iPrevCmd < this.aPrevCmds.length - 1) {
+            sCmd = this.aPrevCmds[++this.iPrevCmd];
+        }
+        return sCmd;
+    }
+
+    /**
+     * parseCommand(sCmd, fSave, chSep)
+     *
+     * @this {Debugger}
+     * @param {string|undefined} sCmd
+     * @param {boolean} [fSave] is true to save the command, false if not
+     * @param {string} [chSep] is the command separator character (default is ';')
+     * @return {Array.<string>}
+     */
+    parseCommand(sCmd, fSave, chSep)
+    {
+        if (fSave) {
+            if (!sCmd) {
+                if (this.fAssemble) {
+                    sCmd = "end";
+                } else {
+                    sCmd = this.aPrevCmds[this.iPrevCmd+1];
+                }
+            } else {
+                if (this.iPrevCmd < 0 && this.aPrevCmds.length) {
+                    this.iPrevCmd = 0;
+                }
+                if (this.iPrevCmd < 0 || sCmd != this.aPrevCmds[this.iPrevCmd]) {
+                    this.aPrevCmds.splice(0, 0, sCmd);
+                    this.iPrevCmd = 0;
+                }
+                this.iPrevCmd--;
+            }
+        }
+        var a = [];
+        if (sCmd) {
+            /*
+             * With the introduction of breakpoint commands (ie, quoted command sequences
+             * associated with a breakpoint), we can no longer perform simplistic splitting.
+             *
+             *      a = sCmd.split(chSep || ';');
+             *      for (var i = 0; i < a.length; i++) a[i] = Str.trim(a[i]);
+             *
+             * We may now split on semi-colons ONLY if they are outside a quoted sequence.
+             *
+             * Also, to allow quoted strings *inside* breakpoint commands, we first replace all
+             * DOUBLE double-quotes with single quotes.
+             */
+            sCmd = sCmd.replace(/""/g, "'");
+
+            var iPrev = 0;
+            var chQuote = null;
+            chSep = chSep || ';';
+            /*
+             * NOTE: Processing charAt() up to and INCLUDING length is not a typo; we're taking
+             * advantage of the fact that charAt() with an invalid index returns an empty string,
+             * allowing us to use the same substring() call to capture the final portion of sCmd.
+             *
+             * In a sense, it allows us to pretend that the string ends with a zero terminator.
+             */
+            for (var i = 0; i <= sCmd.length; i++) {
+                var ch = sCmd.charAt(i);
+                if (ch == '"' || ch == "'") {
+                    if (!chQuote) {
+                        chQuote = ch;
+                    } else if (ch == chQuote) {
+                        chQuote = null;
+                    }
+                }
+                else if (ch == chSep && !chQuote || !ch) {
+                    /*
+                     * Recall that substring() accepts starting (inclusive) and ending (exclusive)
+                     * indexes, whereas substr() accepts a starting index and a length.  We need the former.
+                     */
+                    a.push(Str.trim(sCmd.substring(iPrev, i)));
+                    iPrev = i + 1;
+                }
+            }
+        }
+        return a;
+    }
+
+    /**
+     * evalAND(dst, src)
+     *
+     * Adapted from /modules/pdp10/lib/cpuops.js:PDP10.AND().
+     *
+     * Performs the bitwise "and" (AND) of two operands > 32 bits.
+     *
+     * @this {Debugger}
+     * @param {number} dst
+     * @param {number} src
+     * @return {number} (dst & src)
+     */
+    evalAND(dst, src)
+    {
+        /*
+         * We AND the low 32 bits separately from the higher bits, and then combine them with addition.
+         * Since all bits above 32 will be zero, and since 0 AND 0 is 0, no special masking for the higher
+         * bits is required.
+         *
+         * WARNING: When using JavaScript's 32-bit operators with values that could set bit 31 and produce a
+         * negative value, it's critical to perform a final right-shift of 0, ensuring that the final result is
+         * positive.
+         */
+        if (this.nBits <= 32) {
+            return dst & src;
+        }
+        /*
+         * Negative values don't yield correct results when dividing, so pass them through an unsigned truncate().
+         */
+        dst = this.truncate(dst, 0, true);
+        src = this.truncate(src, 0, true);
+        return ((((dst / Debugger.TWO_POW32)|0) & ((src / Debugger.TWO_POW32)|0)) * Debugger.TWO_POW32) + ((dst & src) >>> 0);
+    }
+
+    /**
+     * evalIOR(dst, src)
+     *
+     * Adapted from /modules/pdp10/lib/cpuops.js:PDP10.IOR().
+     *
+     * Performs the logical "inclusive-or" (OR) of two operands > 32 bits.
+     *
+     * @this {Debugger}
+     * @param {number} dst
+     * @param {number} src
+     * @return {number} (dst | src)
+     */
+    evalIOR(dst, src)
+    {
+        /*
+         * We OR the low 32 bits separately from the higher bits, and then combine them with addition.
+         * Since all bits above 32 will be zero, and since 0 OR 0 is 0, no special masking for the higher
+         * bits is required.
+         *
+         * WARNING: When using JavaScript's 32-bit operators with values that could set bit 31 and produce a
+         * negative value, it's critical to perform a final right-shift of 0, ensuring that the final result is
+         * positive.
+         */
+        if (this.nBits <= 32) {
+            return dst | src;
+        }
+        /*
+         * Negative values don't yield correct results when dividing, so pass them through an unsigned truncate().
+         */
+        dst = this.truncate(dst, 0, true);
+        src = this.truncate(src, 0, true);
+        return ((((dst / Debugger.TWO_POW32)|0) | ((src / Debugger.TWO_POW32)|0)) * Debugger.TWO_POW32) + ((dst | src) >>> 0);
+    }
+
+    /**
+     * evalXOR(dst, src)
+     *
+     * Adapted from /modules/pdp10/lib/cpuops.js:PDP10.XOR().
+     *
+     * Performs the logical "exclusive-or" (XOR) of two operands > 32 bits.
+     *
+     * @this {Debugger}
+     * @param {number} dst
+     * @param {number} src
+     * @return {number} (dst ^ src)
+     */
+    evalXOR(dst, src)
+    {
+        /*
+         * We XOR the low 32 bits separately from the higher bits, and then combine them with addition.
+         * Since all bits above 32 will be zero, and since 0 XOR 0 is 0, no special masking for the higher
+         * bits is required.
+         *
+         * WARNING: When using JavaScript's 32-bit operators with values that could set bit 31 and produce a
+         * negative value, it's critical to perform a final right-shift of 0, ensuring that the final result is
+         * positive.
+         */
+        if (this.nBits <= 32) {
+            return dst | src;
+        }
+        /*
+         * Negative values don't yield correct results when dividing, so pass them through an unsigned truncate().
+         */
+        dst = this.truncate(dst, 0, true);
+        src = this.truncate(src, 0, true);
+        return ((((dst / Debugger.TWO_POW32)|0) ^ ((src / Debugger.TWO_POW32)|0)) * Debugger.TWO_POW32) + ((dst ^ src) >>> 0);
+    }
+
+    /**
+     * evalMUL(dst, src)
+     *
+     * I could have adapted the code from /modules/pdp10/lib/cpuops.js:PDP10.doMUL(), but it was simpler to
+     * write this base method and let the PDP-10 Debugger override it with a call to the *actual* doMUL() method.
+     *
+     * @this {Debugger}
+     * @param {number} dst
+     * @param {number} src
+     * @return {number} (dst * src)
+     */
+    evalMUL(dst, src)
+    {
+        return dst * src;
+    }
+
+    /**
+     * truncate(v, nBits, fUnsigned)
+     *
+     * @this {Debugger}
+     * @param {number} v
+     * @param {number} [nBits]
+     * @param {boolean} [fUnsigned]
+     * @return {number}
+     */
+    truncate(v, nBits, fUnsigned)
+    {
+        var limit, vNew = v;
+        nBits = nBits || this.nBits;
+
+        if (fUnsigned) {
+            if (nBits == 32) {
+                vNew = v >>> 0;
+            }
+            else if (nBits < 32) {
+                vNew = v & ((1 << nBits) - 1);
+            }
+            else {
+                limit = Math.pow(2, nBits);
+                if (v < 0 || v >= limit) {
+                    vNew = v % limit;
+                    if (vNew < 0) vNew += limit;
+                }
+            }
+        }
+        else {
+            if (nBits <= 32) {
+                vNew = (v << (32 - nBits)) >> (32 - nBits);
+            }
+            else {
+                limit = Math.pow(2, nBits - 1);
+                if (v >= limit) {
+                    vNew = (v % limit);
+                    if (((v / limit)|0) & 1) vNew -= limit;
+                } else if (v < -limit) {
+                    vNew = (v % limit);
+                    if ((((-v - 1) / limit) | 0) & 1) {
+                        if (vNew) vNew += limit;
+                    }
+                    else {
+                        if (!vNew) vNew -= limit;
+                    }
+                }
+            }
+        }
+        if (v != vNew) {
+            if (MAXDEBUG) this.println("warning: value " + v + " truncated to " + vNew);
+            v = vNew;
+        }
+        return v;
+    }
+
+    /**
+     * evalOps(aVals, aOps, cOps)
+     *
+     * Some of our clients want a specific number of bits of integer precision.  If that precision is
+     * greater than 32, some of the operations below will fail; for example, JavaScript bitwise operators
+     * always truncate the result to 32 bits, so beware when using shift operations.  Similarly, it would
+     * be wrong to always "|0" the final result, which is why we rely on truncate() now.
+     *
+     * Note that JavaScript integer precision is limited to 52 bits.  For example, in Node, if you set a
+     * variable to 0x80000001:
+     *
+     *      foo=0x80000001|0
+     *
+     * then calculate foo*foo and display the result in binary using "(foo*foo).toString(2)":
+     *
+     *      '11111111111111111111111111111100000000000000000000000000000000'
+     *
+     * which is slightly incorrect because it has overflowed JavaScript's floating-point precision.
+     *
+     * 0x80000001 in decimal is -2147483647, so the product is 4611686014132420609, which is 0x3FFFFFFF00000001.
+     *
+     * @this {Debugger}
+     * @param {Array.<number>} aVals
+     * @param {Array.<string>} aOps
+     * @param {number} [cOps] (default is -1 for all)
+     * @return {boolean} true if successful, false if error
+     */
+    evalOps(aVals, aOps, cOps = -1)
+    {
+        while (cOps-- && aOps.length) {
+            var chOp = aOps.pop();
+            if (aVals.length < 2) return false;
+            var valNew;
+            var val2 = aVals.pop();
+            var val1 = aVals.pop();
+            switch(chOp) {
+            case '*':
+                valNew = this.evalMUL(val1, val2);
+                break;
+            case '/':
+                if (!val2) return false;
+                valNew = Math.trunc(val1 / val2);
+                break;
+            case '^/':
+                if (!val2) return false;
+                valNew = val1 % val2;
+                break;
+            case '+':
+                valNew = val1 + val2;
+                break;
+            case '-':
+                valNew = val1 - val2;
+                break;
+            case '<<':
+                valNew = val1 << val2;
+                break;
+            case '>>':
+                valNew = val1 >> val2;
+                break;
+            case '>>>':
+                valNew = val1 >>> val2;
+                break;
+            case '<':
+                valNew = (val1 < val2? 1 : 0);
+                break;
+            case '<=':
+                valNew = (val1 <= val2? 1 : 0);
+                break;
+            case '>':
+                valNew = (val1 > val2? 1 : 0);
+                break;
+            case '>=':
+                valNew = (val1 >= val2? 1 : 0);
+                break;
+            case '==':
+                valNew = (val1 == val2? 1 : 0);
+                break;
+            case '!=':
+                valNew = (val1 != val2? 1 : 0);
+                break;
+            case '&':
+                valNew = this.evalAND(val1, val2);
+                break;
+            case '!':           // alias for MACRO-10 to perform a bitwise inclusive-or (OR)
+            case '|':
+                valNew = this.evalIOR(val1, val2);
+                break;
+            case '^!':          // since MACRO-10 uses '^' for base overrides, '^!' is used for bitwise exclusive-or (XOR)
+                valNew = this.evalXOR(val1, val2);
+                break;
+            case '&&':
+                valNew = (val1 && val2? 1 : 0);
+                break;
+            case '||':
+                valNew = (val1 || val2? 1 : 0);
+                break;
+            case ',,':
+                valNew = this.truncate(val1, 18, true) * Math.pow(2, 18) + this.truncate(val2, 18, true);
+                break;
+            case '_':
+            case '^_':
+                valNew = val1;
+                /*
+                 * While we always try to avoid assuming any particular number of bits of precision, the 'B' shift
+                 * operator (which we've converted to '^_') is unique to the MACRO-10 environment, which imposes the
+                 * following restrictions on the shift count.
+                 */
+                if (chOp == '^_') val2 = 35 - (val2 & 0xff);
+                if (val2) {
+                    /*
+                     * Since binary shifting is a logical (not arithmetic) operation, and since shifting by division only
+                     * works properly with positive numbers, we call truncate() to produce an unsigned value.
+                     */
+                    valNew = this.truncate(valNew, 0, true);
+                    if (val2 > 0) {
+                        valNew *= Math.pow(2, val2);
+                    } else {
+                        valNew = Math.trunc(valNew / Math.pow(2, -val2));
+                    }
+                }
+                break;
+            default:
+                return false;
+            }
+            aVals.push(this.truncate(valNew));
+        }
+        return true;
+    }
+
+    /**
+     * parseArray(asValues, iValue, iLimit, nBase, aUndefined)
+     *
+     * parseExpression() takes a complete expression and divides it into array elements, where even elements
+     * are values (which may be empty if two or more operators appear consecutively) and odd elements are operators.
+     *
+     * For example, if the original expression was "2*{3+{4/2}}", parseExpression() would call parseArray() with:
+     *
+     *      0   1   2   3   4   5   6   7   8   9  10  11  12  13  14
+     *      -   -   -   -   -   -   -   -   -   -  --  --  --  --  --
+     *      2   *       {   3   +       {   4   /   2   }       }
+     *
+     * This function takes care of recursively processing grouped expressions, by processing subsets of the array,
+     * as well as handling certain base overrides (eg, temporarily switching to base-10 for binary shift suffixes).
+     *
+     * @param {Array.<string>} asValues
+     * @param {number} iValue
+     * @param {number} iLimit
+     * @param {number} nBase
+     * @param {Array|undefined} [aUndefined]
+     * @return {number|undefined}
+     */
+    parseArray(asValues, iValue, iLimit, nBase, aUndefined)
+    {
+        var value;
+        var sValue, sOp;
+        var fError = false;
+        var nUnary = 0;
+        var aVals = [], aOps = [];
+
+        var nBasePrev = this.nBase;
+        this.nBase = nBase;
+
+        while (iValue < iLimit) {
+            var v;
+            sValue = asValues[iValue++].trim();
+            sOp = (iValue < iLimit? asValues[iValue++] : "");
+
+            if (sValue) {
+                v = this.parseValue(sValue, null, aUndefined, nUnary);
+            } else {
+                if (sOp == '{') {
+                    var cOpen = 1;
+                    var iStart = iValue;
+                    while (iValue < iLimit) {
+                        sValue = asValues[iValue++].trim();
+                        sOp = (iValue < asValues.length? asValues[iValue++] : "");
+                        if (sOp == '{') {
+                            cOpen++;
+                        } else if (sOp == '}') {
+                            if (!--cOpen) break;
+                        }
+                    }
+                    v = this.parseArray(asValues, iStart, iValue-1, this.nBase, aUndefined);
+                    if (v != null && nUnary) {
+                        v = this.parseUnary(v, nUnary);
+                    }
+                    sValue = (iValue < iLimit? asValues[iValue++].trim() : "");
+                    sOp = (iValue < iLimit? asValues[iValue++] : "");
+                }
+                else {
+                    /*
+                     * When parseExpression() calls us, it has collapsed all runs of whitespace into single spaces,
+                     * and although it allows single spaces to divide the elements of the expression, a space is neither
+                     * a unary nor binary operator.  It's essentially a no-op.  If we encounter it here, then it followed
+                     * another operator and is easily ignored (although perhaps it should still trigger a reset of nBase
+                     * and nUnary -- TBD).
+                     */
+                    if (sOp == ' ') {
+                        continue;
+                    }
+                    if (sOp == '^B') {
+                        this.nBase = 2;
+                        continue;
+                    }
+                    if (sOp == '^O') {
+                        this.nBase = 8;
+                        continue;
+                    }
+                    if (sOp == '^D') {
+                        this.nBase = 10;
+                        continue;
+                    }
+                    if (!(nUnary & (0xC0000000|0))) {
+                        if (sOp == '+') {
+                            continue;
+                        }
+                        if (sOp == '-') {
+                            nUnary = (nUnary << 2) | 1;
+                            continue;
+                        }
+                        if (sOp == '~' || sOp == '^-') {
+                            nUnary = (nUnary << 2) | 2;
+                            continue;
+                        }
+                        if (sOp == '^L') {
+                            nUnary = (nUnary << 2) | 3;
+                            continue;
+                        }
+                    }
+                    fError = true;
+                    break;
+                }
+            }
+
+            if (v === undefined) {
+                if (aUndefined) {
+                    aUndefined.push(sValue);
+                    v = 0;
+                } else {
+                    fError = true;
+                    aUndefined = [];
+                    break;
+                }
+            }
+
+            aVals.push(this.truncate(v));
+
+            /*
+             * When parseExpression() calls us, it has collapsed all runs of whitespace into single spaces,
+             * and although it allows single spaces to divide the elements of the expression, a space is neither
+             * a unary nor binary operator.  It's essentially a no-op.  If we encounter it here, then it followed
+             * a value, and since we don't want to misinterpret the next operator as a unary operator, we look
+             * ahead and grab the next operator if it's not preceded by a value.
+             */
+            if (sOp == ' ') {
+                if (iValue < asValues.length - 1 && !asValues[iValue]) {
+                    iValue++;
+                    sOp = asValues[iValue++]
+                } else {
+                    fError = true;
+                    break;
+                }
+            }
+
+            if (!sOp) break;
+
+            var aBinOp = (this.achGroup[0] == '<'? Debugger.aDECOpPrecedence : Debugger.aBinOpPrecedence);
+            if (!aBinOp[sOp]) {
+                fError = true;
+                break;
+            }
+            if (aOps.length && aBinOp[sOp] <= aBinOp[aOps[aOps.length - 1]]) {
+                this.evalOps(aVals, aOps, 1);
+            }
+            aOps.push(sOp);
+
+            /*
+             * The MACRO-10 binary shifting operator assumes a base-10 shift count, regardless of the current
+             * base, so we must override the current base to ensure the count is parsed correctly.
+             */
+            this.nBase = (sOp == '^_')? 10 : nBase;
+            nUnary = 0;
+        }
+
+        if (fError || !this.evalOps(aVals, aOps) || aVals.length != 1) {
+            fError = true;
+        }
+
+        if (!fError) {
+            value = aVals.pop();
+
+        } else if (!aUndefined) {
+            this.println("parse error (" + (sValue || sOp) + ")");
+        }
+
+        this.nBase = nBasePrev;
+        return value;
+    }
+
+    /**
+     * parseASCII(sExp, chDelim, nBits, cchMax)
+     *
+     * @this {Debugger}
+     * @param {string} sExp
+     * @param {string} chDelim
+     * @param {number} nBits
+     * @param {number} cchMax
+     * @return {string|undefined}
+     */
+    parseASCII(sExp, chDelim, nBits, cchMax)
+    {
+        var i;
+        while ((i = sExp.indexOf(chDelim)) >= 0) {
+            var v = 0;
+            var j = i + 1;
+            var cch = cchMax;
+            while (j < sExp.length) {
+                var ch = sExp[j++];
+                if (ch == chDelim) {
+                    cch = -1;
+                    break;
+                }
+                if (!cch) break;
+                cch--;
+                var c = ch.charCodeAt(0);
+                if (nBits == 7) {
+                    c &= 0x7F;
+                } else {
+                    c = (c - 0x20) & 0x3F;
+                }
+                v = this.truncate(v * Math.pow(2, nBits) + c, nBits * cchMax, true);
+            }
+            if (cch >= 0) {
+                this.println("parse error (" + chDelim + sExp + chDelim + ")");
+                return undefined;
+            } else {
+                sExp = sExp.substr(0, i) + this.toStrBase(v, -1) + sExp.substr(j);
+            }
+        }
+        return sExp;
+    }
+
+    /**
+     * parseExpression(sExp, fQuiet)
+     *
+     * A quick-and-dirty expression parser.  It takes an expression like:
+     *
+     *      EDX+EDX*4+12345678
+     *
+     * and builds a value stack in aVals and a "binop" (binary operator) stack in aOps:
+     *
+     *      aVals       aOps
+     *      -----       ----
+     *      EDX         +
+     *      EDX         *
+     *      4           +
+     *      ...
+     *
+     * We pop 1 "binop" from aOps and 2 values from aVals whenever a "binop" of lower priority than its
+     * predecessor is encountered, evaluate, and push the result back onto aVals.  Only selected unary
+     * operators are supported (eg, negate and complement); no ternary operators like '?:' are supported.
+     *
+     * fQuiet can be used to pass an array that collects any undefined variables that parseExpression()
+     * encounters; the value of an undefined variable is zero.  This mode was added for components that need
+     * to support expressions containing "fixups" (ie, values that must be determined later).
+     *
+     * @this {Debugger}
+     * @param {string|undefined} sExp
+     * @param {Array|undefined|boolean} [fQuiet]
+     * @return {number|undefined} numeric value, or undefined if sExp contains any undefined or invalid values
+     */
+    parseExpression(sExp, fQuiet)
+    {
+        var value = undefined;
+        var fPrint = (fQuiet === false);
+        var aUndefined = Array.isArray(fQuiet)? fQuiet : undefined;
+
+        if (sExp) {
+
+            /*
+             * The default delimiting characters for grouped expressions are braces; they can be changed by altering
+             * achGroup, but when that happens, instead of changing our regular expressions and operator tables,
+             * we simply replace all achGroup characters with braces in the given expression.
+             *
+             * Why not use parentheses for grouped expressions?  Because some debuggers use parseReference() to perform
+             * parenthetical value replacements in message strings, and they don't want parentheses taking on a different
+             * meaning.  And for some machines, like the PDP-10, the convention is to use parentheses for other things,
+             * like indexed addressing, and to use angle brackets for grouped expressions.
+             */
+            if (this.achGroup[0] != '{') {
+                sExp = sExp.split(this.achGroup[0]).join('{').split(this.achGroup[1]).join('}');
+            }
+
+            /*
+             * Quoted ASCII characters can have a numeric value, too, which must be converted now, to avoid any
+             * conflicts with the operators below.
+             */
+            sExp = this.parseASCII(sExp, '"', 7, 5);    // MACRO-10 packs up to 5 7-bit ASCII codes into a value
+            if (!sExp) return value;
+            sExp = this.parseASCII(sExp, "'", 6, 6);    // MACRO-10 packs up to 6 6-bit ASCII (SIXBIT) codes into a value
+            if (!sExp) return value;
+
+            /*
+             * All browsers (including, I believe, IE9 and up) support the following idiosyncrasy of a RegExp split():
+             * when the RegExp uses a capturing pattern, the resulting array will include entries for all the pattern
+             * matches along with the non-matches.  This effectively means that, in the set of expressions that we
+             * support, all even entries in asValues will contain "values" and all odd entries will contain "operators".
+             *
+             * Although I started listing the operators in the RegExp in "precedential" order, that's not important;
+             * what IS important is listing operators than contain shorter operators first.  For example, bitwise
+             * shift operators must be listed BEFORE the logical less-than or greater-than operators.  The aBinOp tables
+             * (aBinOpPrecedence and aDECOpPrecedence) are what determine precedence, not the RegExp.
+             *
+             * Also, to better accommodate MACRO-10 syntax, I've replaced the single '^' for XOR with '^!', and I've
+             * added '!' as an alias for '|' (bitwise inclusive-or), '^-' as an alias for '~' (one's complement operator),
+             * and '_' as a shift operator (+/- values specify a left/right shift, and the count is not limited to 32).
+             *
+             * And to avoid conflicts with MACRO-10 syntax, I've replaced the original mod operator ('%') with '^/'.
+             *
+             * The MACRO-10 binary shifting suffix ('B') is a bit more problematic, since a capital B can also appear
+             * inside symbols, or inside hex values.  So if the default base is NOT 16, then I pre-scan for that suffix
+             * and replace all non-symbolic occurrences with an internal shift operator ('^_').
+             *
+             * Note that Str.parseInt(), which parseValue() relies on, supports both the MACRO-10 base prefix overrides
+             * and the binary shifting suffix ('B'), but since that suffix can also be a bracketed expression, we have to
+             * support it here as well.
+             *
+             * MACRO-10 supports only a subset of all the PCjs operators; for example, MACRO-10 doesn't support any of
+             * the boolean logical/compare operators.  But unless we run into conflicts, I prefer sticking with this
+             * common set of operators.
+             *
+             * All whitespace in the expression is collapsed to single spaces, and space has been added to the list
+             * of "operators", but its sole function is as a separator, not as an operator.  parseArray() will ignore
+             * single spaces as long as they are preceded and/or followed by a "real" operator.  It would be dangerous
+             * to remove spaces entirely, because if an operator-less expression like "A B" was passed in, we would want
+             * that to generate an error; if we converted it to "AB", evaluation might inadvertently succeed.
+             */
+            var regExp = /({|}|\|\||&&|\||\^!|\^B|\^O|\^D|\^L|\^-|~|\^_|_|&|!=|!|==|>=|>>>|>>|>|<=|<<|<|-|\+|\^\/|\/|\*|,,| )/;
+            if (this.nBase != 16) {
+                sExp = sExp.replace(/(^|[^A-Z0-9$%.])([0-9]+)B/, "$1$2^_").replace(/\s+/g, ' ');
+            }
+            var asValues = sExp.split(regExp);
+            value = this.parseArray(asValues, 0, asValues.length, this.nBase, aUndefined);
+            if (value !== undefined && fPrint) {
+                this.printValue(null, value);
+            }
+        }
+        return value;
+    }
+
+    /**
+     * parseReference(s)
+     *
+     * Returns the given string with any "{expression}" sequences replaced with the value of the expression,
+     * and any "[address]" references replaced with the contents of the address.  Expressions are parsed BEFORE
+     * addresses.
+     *
+     * @this {Debugger}
+     * @param {string} s
+     * @return {string|undefined}
+     */
+    parseReference(s)
+    {
+        var a;
+        var chOpen = this.achGroup[0];
+        var chClose = this.achGroup[1];
+        var chEscape = (chOpen == '(' || chOpen == '{' || chOpen == '[')? '\\' : '';
+        var chInnerEscape = (chOpen == '['? '\\' : '');
+        var reSubExp = new RegExp(chEscape + chOpen + "([^" + chInnerEscape + chOpen + chInnerEscape + chClose + "]+)" + chEscape + chClose);
+        while (a = s.match(reSubExp)) {
+            var value = this.parseExpression(a[1]);
+            if (value === undefined) return undefined;
+            var sSearch = chOpen + a[1] + chClose;
+            var sReplace = value != null? this.toStrBase(value) : "undefined";
+            /*
+             * Note that by default, the String replace() method only replaces the FIRST occurrence,
+             * and there MIGHT be more than one occurrence of the expression we just parsed, so we could
+             * do this instead:
+             *
+             *      s = s.split(sSearch).join(sReplace);
+             *
+             * However, that's knd of an expensive (slow) solution, and it's not strictly necessary, since
+             * any additional identical expressions will be picked up on a subsequent iteration through this loop.
+             */
+            s = s.replace(sSearch, sReplace);
+        }
+        if (this.achAddress.length) {
+            chOpen = this.achAddress[0];
+            chClose = this.achAddress[1];
+            chEscape = (chOpen == '(' || chOpen == '{' || chOpen == '[')? '\\' : '';
+            chInnerEscape = (chOpen == '['? '\\' : '');
+            reSubExp = new RegExp(chEscape + chOpen + "([^" + chInnerEscape + chOpen + chInnerEscape + chClose + "]+)" + chEscape + chClose);
+            while (a = s.match(reSubExp)) {
+                s = this.parseAddrReference(s, a[1]);
+            }
+        }
+        return this.parseSysVars(s);
+    }
+
+    /**
+     * parseSysVars(s)
+     *
+     * Returns the given string with any recognized "$var" replaced with its value; eg:
+     *
+     *      $ops: the number of opcodes executed since the last time it was displayed (or reset)
+     *
+     * @this {Debugger}
+     * @param {string} s
+     * @return {string}
+     */
+    parseSysVars(s)
+    {
+        var a;
+        while (a = s.match(/\$([a-z]+)/i)) {
+            var v = null;
+            switch(a[1].toLowerCase()) {
+            case "ops":
+                v = this.cOpcodes - this.cOpcodesStart;
+                break;
+            }
+            if (v == null) break;
+            s = s.replace(a[0], v.toString());
+        }
+        return s;
+    }
+
+    /**
+     * parseUnary(value, nUnary)
+     *
+     * nUnary is actually a small "stack" of unary operations encoded in successive pairs of bits.
+     * As parseExpression() encounters each unary operator, nUnary is shifted left 2 bits, and the
+     * new unary operator is encoded in bits 0 and 1 (0b00 is none, 0b01 is negate, 0b10 is complement,
+     * and 0b11 is reserved).  Here, we process the bits in reverse order (hence the stack-like nature),
+     * ensuring that we process the unary operators associated with this value right-to-left.
+     *
+     * Since bitwise operators see only 32 bits, more than 16 unary operators cannot be supported
+     * using this method.  We'll let parseExpression() worry about that; if it ever happens in practice,
+     * then we'll have to switch to a more "expensive" approach (eg, an actual array of unary operators).
+     *
+     * @this {Debugger}
+     * @param {number} value
+     * @param {number} nUnary
+     * @return {number}
+     */
+    parseUnary(value, nUnary)
+    {
+        while (nUnary) {
+            switch(nUnary & 0o3) {
+            case 1:
+                value = -this.truncate(value);
+                break;
+            case 2:
+                value = this.evalXOR(value, -1);        // this is easier than adding an evalNOT()...
+                break;
+            case 3:
+                var bit = 35;                           // simple left-to-right zero-bit-counting loop...
+                while (bit >= 0 && !this.evalAND(value, Math.pow(2, bit))) bit--;
+                value = 35 - bit;
+                break;
+            }
+            nUnary >>>= 2;
+        }
+        return value;
+    }
+
+    /**
+     * parseValue(sValue, sName, fQuiet, nUnary)
+     *
+     * @this {Debugger}
+     * @param {string|undefined} sValue
+     * @param {string|null} [sName] is the name of the value, if any
+     * @param {Array|undefined|boolean} [fQuiet]
+     * @param {number} [nUnary] (0 for none, 1 for negate, 2 for complement, 3 for leading zeros)
+     * @return {number|undefined} numeric value, or undefined if sValue is either undefined or invalid
+     */
+    parseValue(sValue, sName, fQuiet, nUnary = 0)
+    {
+        var value;
+        var aUndefined = Array.isArray(fQuiet)? fQuiet : undefined;
+
+        if (sValue != null) {
+            var iReg = this.getRegIndex(sValue);
+            if (iReg >= 0) {
+                value = this.getRegValue(iReg);
+            } else {
+                value = this.getVariable(sValue);
+                if (value != null) {
+                    var sUndefined = this.getVariableFixup(sValue);
+                    if (sUndefined) {
+                        if (aUndefined) {
+                            aUndefined.push(sUndefined);
+                        } else {
+                            var valueUndefined = this.parseExpression(sUndefined, fQuiet);
+                            if (valueUndefined !== undefined) {
+                                value += valueUndefined;
+                            } else {
+                                if (!fQuiet) {
+                                    this.println("undefined " + (sName || "value") + ": " + sValue + " (" + sUndefined + ")");
+                                }
+                                value = undefined;
+                            }
+                        }
+                    }
+                } else {
+                    /*
+                     * A feature of MACRO-10 is that any single-digit number is automatically interpreted as base-10.
+                     */
+                    value = Str.parseInt(sValue, sValue.length > 1 || this.nBase > 10? this.nBase : 10);
+                }
+            }
+            if (value != null) {
+                value = this.truncate(this.parseUnary(value, nUnary));
+            } else {
+                if (!fQuiet) {
+                    this.println("invalid " + (sName || "value") + ": " + sValue);
+                }
+            }
+        } else {
+            if (!fQuiet) {
+                this.println("missing " + (sName || "value"));
+            }
+        }
+        return value;
+    }
+
+    /**
+     * printValue(sVar, value)
+     *
+     * @this {Debugger}
+     * @param {string|null} sVar
+     * @param {number|undefined} value
+     * @return {boolean} true if value defined, false if not
+     */
+    printValue(sVar, value)
+    {
+        var sValue;
+        var fDefined = false;
+        if (value !== undefined) {
+            fDefined = true;
+            if (this.nBase == 8) {
+                sValue = this.toStrBase(value, this.nBits, 8, 1) + "  " + value + '.';
+            } else {
+                sValue = this.toStrBase(value, this.nBits, 16, 1) + "  " + this.toStrBase(value, this.nBits, 8, 1) + "  " + this.toStrBase(value, this.nBits, 2, this.nBits <= 32? 8 : 6) + "  " + value + '.';
+            }
+            if (value >= 0x20 && value < 0x7F) {
+                sValue += " '" + String.fromCharCode(value) + "'";
+            }
+        }
+        sVar = (sVar != null? (sVar + ": ") : "");
+        this.println(sVar + sValue);
+        return fDefined;
+    }
+
+    /**
+     * resetVariables()
+     *
+     * @this {Debugger}
+     * @return {Object}
+     */
+    resetVariables()
+    {
+        var a = this.aVariables;
+        this.aVariables = {};
+        return a;
+    }
+
+    /**
+     * restoreVariables(a)
+     *
+     * @this {Debugger}
+     * @param {Object} a (from previous resetVariables() call)
+     */
+    restoreVariables(a)
+    {
+        this.aVariables = a;
+    }
+
+    /**
+     * printVariable(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} [sVar]
+     * @return {boolean} true if all value(s) defined, false if not
+     */
+    printVariable(sVar)
+    {
+        var cVariables = 0;
+        if (this.aVariables) {
+            if (sVar) {
+                return this.printValue(sVar, this.aVariables[sVar] && this.aVariables[sVar].value);
+            }
+            var aVars = Object.keys(this.aVariables);
+            aVars.sort();
+            for (var i = 0; i < aVars.length; i++) {
+                this.printValue(aVars[i], this.aVariables[aVars[i]].value);
+                cVariables++;
+            }
+        }
+        return cVariables > 0;
+    }
+
+    /**
+     * delVariable(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     */
+    delVariable(sVar)
+    {
+        delete this.aVariables[sVar];
+    }
+
+    /**
+     * getVariable(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     * @return {number|undefined}
+     */
+    getVariable(sVar)
+    {
+        if (this.aVariables[sVar]) {
+            return this.aVariables[sVar].value;
+        }
+        sVar = sVar.substr(0, 6);
+        return this.aVariables[sVar] && this.aVariables[sVar].value;
+    }
+
+    /**
+     * getVariableFixup(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     * @return {string|undefined}
+     */
+    getVariableFixup(sVar)
+    {
+        return this.aVariables[sVar] && this.aVariables[sVar].sUndefined;
+    }
+
+    /**
+     * isVariable(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     * @return {boolean}
+     */
+    isVariable(sVar)
+    {
+        return this.aVariables[sVar] !== undefined;
+    }
+
+    /**
+     * setVariable(sVar, value, sUndefined)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     * @param {number} value
+     * @param {string|undefined} [sUndefined]
+     */
+    setVariable(sVar, value, sUndefined)
+    {
+        this.aVariables[sVar] = {value, sUndefined};
+    }
+
+    /**
+     * toStrBase(n, nBits, nBase, nGrouping)
+     *
+     * Use this instead of Str's toOct()/toDec()/toHex() to convert numbers to the Debugger's default base.
+     *
+     * @this {Debugger}
+     * @param {number|null|undefined} n
+     * @param {number} [nBits] (-1 to strip leading zeros, 0 to allow a variable number of digits)
+     * @param {number} [nBase]
+     * @param {number} [nGrouping] (if nBase is 2, this is a grouping; otherwise, it's a prefix condition)
+     * @return {string}
+     */
+    toStrBase(n, nBits = 0, nBase = 0, nGrouping = 0)
+    {
+        var s;
+        switch(nBase || this.nBase) {
+        case 2:
+            s = Str.toBin(n, nBits > 0? nBits : 0, nGrouping);
+            break;
+        case 8:
+            s = Str.toOct(n, nBits > 0? ((nBits + 2)/3)|0 : 0, !!nGrouping);
+            break;
+        case 10:
+            /*
+             * The multiplier is actually Math.log(2)/Math.log(10), but an approximation is more than adequate.
+             */
+            s = Str.toDec(n, nBits > 0? Math.ceil(nBits * 0.3) : 0);
+            break;
+        case 16:
+        default:
+            s = Str.toHex(n, nBits > 0? ((nBits + 3) >> 2) : 0, !!nGrouping);
+            break;
+        }
+        return (nBits < 0? Str.stripLeadingZeros(s) : s);
+    }
+}
+
+if (DEBUGGER) {
+
+    /*
+     * These are our operator precedence tables.  Operators toward the bottom (with higher values) have
+     * higher precedence.  aBinOpPrecedence was our original table; we had to add aDECOpPrecedence because
+     * the precedence of operators in DEC's MACRO-10 expressions differ.  Having separate tables also allows
+     * us to remove operators that shouldn't be supported, but unless some operator creates a problem,
+     * I prefer to keep as much commonality between the tables as possible.
+     *
+     * Missing from these tables are the (limited) set of unary operators we support (negate and complement),
+     * since this is only a BINARY operator precedence, not a general-purpose precedence table.  Assume that
+     * all unary operators take precedence over all binary operators.
+     */
+    Debugger.aBinOpPrecedence = {
+        '||':   5,      // logical OR
+        '&&':   6,      // logical AND
+        '!':    7,      // bitwise OR (conflicts with logical NOT, but we never supported that)
+        '|':    7,      // bitwise OR
+        '^!':   8,      // bitwise XOR (added by MACRO-10 sometime between the 1972 and 1978 versions)
+        '&':    9,      // bitwise AND
+        '!=':   10,     // inequality
+        '==':   10,     // equality
+        '>=':   11,     // greater than or equal to
+        '>':    11,     // greater than
+        '<=':   11,     // less than or equal to
+        '<':    11,     // less than
+        '>>>':  12,     // unsigned bitwise right shift
+        '>>':   12,     // bitwise right shift
+        '<<':   12,     // bitwise left shift
+        '-':    13,     // subtraction
+        '+':    13,     // addition
+        '^/':   14,     // remainder
+        '/':    14,     // division
+        '*':    14,     // multiplication
+        '_':    19,     // MACRO-10 shift operator
+        '^_':   19,     // MACRO-10 internal shift operator (converted from 'B' suffix form that MACRO-10 uses)
+        '{':    20,     // open grouped expression (converted from achGroup[0])
+        '}':    20      // close grouped expression (converted from achGroup[1])
+    };
+    Debugger.aDECOpPrecedence = {
+        ',,':   1,      // high-word,,low-word
+        '||':   5,      // logical OR
+        '&&':   6,      // logical AND
+        '!=':   10,     // inequality
+        '==':   10,     // equality
+        '>=':   11,     // greater than or equal to
+        '>':    11,     // greater than
+        '<=':   11,     // less than or equal to
+        '<':    11,     // less than
+        '>>>':  12,     // unsigned bitwise right shift
+        '>>':   12,     // bitwise right shift
+        '<<':   12,     // bitwise left shift
+        '-':    13,     // subtraction
+        '+':    13,     // addition
+        '^/':   14,     // remainder
+        '/':    14,     // division
+        '*':    14,     // multiplication
+        '!':    15,     // bitwise OR (conflicts with logical NOT, but we never supported that)
+        '|':    15,     // bitwise OR
+        '^!':   15,     // bitwise XOR (added by MACRO-10 sometime between the 1972 and 1978 versions)
+        '&':    15,     // bitwise AND
+        '_':    19,     // MACRO-10 shift operator
+        '^_':   19,     // MACRO-10 internal shift operator (converted from 'B' suffix form that MACRO-10 uses)
+        '{':    20,     // open grouped expression (converted from achGroup[0])
+        '}':    20      // close grouped expression (converted from achGroup[1])
+    };
+
+    /*
+     * Assorted constants
+     */
+    Debugger.TWO_POW32 = Math.pow(2, 32);
+
+}   // endif DEBUGGER
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/debugger.js (C) Jeff Parsons 2012-2017
+ */
+
+if (DEBUGGER) {
+}
+
+/**
+ * Debugger Address Object
+ *
+ *      off             offset, if any
+ *      sel             selector, if any (if null, addr should be set to a linear address)
+ *      addr            linear address, if any (if null, addr will be recomputed from sel:off)
+ *      type            one of the DebuggerX86.ADDRTYPE values
+ *      fData32         true if 32-bit operand size in effect
+ *      fAddr32         true if 32-bit address size in effect
+ *      fData32Orig     original fData32 value, if any
+ *      fAddr32Orig     original fAddr32 value, if any
+ *      cOverrides      non-zero if any overrides were processed with this address
+ *      fComplete       true if a complete instruction was processed with this address
+ *      fTempBreak      true if this is a temporary breakpoint address
+ *      sCmd            set for breakpoint addresses if there's an associated command string
+ *      aCmds           preprocessed commands (from sCmd)
+ *
+ * @typedef {{
+ *      off:(number|null|undefined),
+ *      sel:(number|null|undefined),
+ *      addr:(number|null|undefined),
+ *      type:(number|undefined),
+ *      fData32:(boolean|undefined),
+ *      fAddr32:(boolean|undefined),
+ *      fData32Orig:(boolean|undefined),
+ *      fAddr32Orig:(boolean|undefined),
+ *      cOverrides:(number|undefined),
+ *      fComplete:(boolean|undefined),
+ *      fTempBreak:(boolean|undefined),
+ *      sCmd:(string|undefined),
+ *      aCmds:(Array.<string>|undefined)
+ * }} DbgAddrX86
+ */
+var DbgAddrX86;
+
+/*
+ * Debugger Breakpoint Tips
+ *
+ * Here's an example of our powerful new breakpoint command capabilities:
+ *
+ *      bp 0397:022B "?'GlobalAlloc(wFlags:[ss:sp+8],dwBytes:[ss:sp+6][ss:sp+4])';g [ss:sp+2]:[ss:sp] '?ax;if ax'"
+ *
+ * The above breakpoint will display a pleasing "GlobalAlloc()" string containing the current
+ * stack parameters, and will briefly stop execution on the return to print the result in AX,
+ * halting the CPU whenever AX is zero (the default behavior of "if" whenever the expression is
+ * false is to look for an "else" and automatically halt when there is no "else").
+ *
+ * How do you figure out where the code for GlobalAlloc is in the first place?  You need to have
+ * BACKTRACK support enabled (which currently means running the non-COMPILED version), so that as
+ * the Disk component loads disk images, it will automatically extract symbolic information from all
+ * "NE" (New Executable) binaries on those disks, which the Debugger's "dt" command can then search
+ * for you; eg:
+ *
+ *      ## dt globalalloc
+ *      GLOBALALLOC: KRNL386.EXE 0001:022B len 0xC570
+ *
+ * And then you just need to do a bit more sleuthing to find the right CODE segment.  And that just
+ * got easier, now that the PCx86 Debugger mimics portions of the Windows Debugger INT 0x41 interface;
+ * see intWindowsDebugger() for details.  So even if you neglect to run WDEB386.EXE /E inside the
+ * machine before running Windows, you should still see notifications like:
+ *
+ *      KERNEL!undefined code(0001)=#0397 len 0000C580
+ *
+ * in the PCx86 Debugger output window, as segments are being loaded by the Windows kernel.
+ */
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class DebuggerX86 extends Debugger {
+    /**
+     * DebuggerX86(parmsDbg)
+     *
+     * The DebuggerX86 component is an optional component that implements a variety of user commands
+     * for controlling the CPU, dumping and editing memory, etc.
+     *
+     * DebuggerX86 extends the shared Debugger component and supports the following optional (parmsDbg)
+     * properties:
+     *
+     *      commands: string containing zero or more commands, separated by ';'
+     *
+     *      messages: string containing zero or more message categories to enable;
+     *      multiple categories must be separated by '|' or ';'.  Parsed by messageInit().
+     *
+     * @this {DebuggerX86}
+     * @param {Object} parmsDbg
+     */
+    constructor(parmsDbg)
+    {
+        if (DEBUGGER) {
+
+            super(parmsDbg);
+
+            /*
+             * Default number of hex chars in a register and a linear address (ie, for real-mode);
+             * updated by initBus().
+             */
+            this.cchReg = 4;
+            this.cchAddr = 5;
+            this.maskAddr = 0xfffff;
+
+            /*
+             * Most commands that require an address call parseAddr(), which defaults to dbgAddrNextCode
+             * or dbgAddrNextData when no address has been given.  doDump() and doUnassemble(), in turn,
+             * update dbgAddrNextData and dbgAddrNextCode, respectively, when they're done.
+             *
+             * All dbgAddr variables contain properties off, sel, and addr, where sel:off represents the
+             * segmented address and addr is the corresponding linear address (if known).  For certain
+             * segmented addresses (eg, breakpoint addresses), we pre-compute the linear address and save
+             * that in addr, so that the breakpoint will still operate as intended even if the mode changes
+             * later (eg, from real-mode to protected-mode).
+             *
+             * Finally, for TEMPORARY breakpoint addresses, we set fTempBreak to true, so that they can be
+             * automatically cleared when they're hit.
+             */
+            this.dbgAddrNextCode = this.newAddr();
+            this.dbgAddrNextData = this.newAddr();
+            this.dbgAddrAssemble = this.newAddr();
+
+            /*
+             * aSymbolTable is an array of SymbolTable objects, one per ROM or other chunk of address space,
+             * where each object contains the following properties:
+             *
+             *      sModule
+             *      nSegment
+             *      sel
+             *      off
+             *      addr (physical address, if any; eg, symbols for a ROM)
+             *      len
+             *      aSymbols
+             *      aOffsets
+             *
+             * See addSymbols() for more details, since that's how callers add sets of symbols to the table.
+             */
+            this.aSymbolTable = [];
+
+            /*
+             * clearBreakpoints() initializes the breakpoints lists: aBreakExec is a list of addresses
+             * to halt on whenever attempting to execute an instruction at the corresponding address,
+             * and aBreakRead and aBreakWrite are lists of addresses to halt on whenever a read or write,
+             * respectively, occurs at the corresponding address.
+             *
+             * NOTE: Curiously, after upgrading the Google Closure Compiler from v20141215 to v20150609,
+             * the resulting compiled code would crash in clearBreakpoints(), because the (renamed) aBreakRead
+             * property was already defined.  To eliminate whatever was confusing the Closure Compiler, I've
+             * explicitly initialized all the properties that clearBreakpoints() (re)initializes.
+             */
+            this.aBreakExec = this.aBreakRead = this.aBreakWrite = [];
+            this.clearBreakpoints();
+
+            /*
+             * The new "bn" command allows you to specify a number of instructions to execute and then stop;
+             * "bn 0" disables any outstanding count.
+             */
+            this.nBreakIns = 0;
+
+            /*
+             * Execution history is allocated by historyInit() whenever checksEnabled() conditions change.
+             * Execution history is updated whenever the CPU calls checkInstruction(), which will happen
+             * only when checksEnabled() returns true (eg, whenever one or more breakpoints have been set).
+             * This ensures that, by default, the CPU runs as fast as possible.
+             */
+            this.historyInit();
+
+            /*
+             * Initialize Debugger message support
+             */
+            this.afnDumpers = {};
+            this.messageInit(parmsDbg['messages']);
+
+            this.sInitCommands = parmsDbg['commands'];
+
+            /*
+             * Make it easier to access Debugger commands from an external REPL (eg, the WebStorm
+             * "live" console window); eg:
+             *
+             *      pcx86('r')
+             *      pcx86('dw 0:0')
+             *      pcx86('h')
+             *      ...
+             */
+            var dbg = this;
+            if (window) {
+                if (window[PCX86.APPCLASS] === undefined) {
+                    window[PCX86.APPCLASS] = function(s) { return dbg.doCommands(s); };
+                }
+            } else {
+                if (global[PCX86.APPCLASS] === undefined) {
+                    global[PCX86.APPCLASS] = function(s) { return dbg.doCommands(s); };
+                }
+            }
+
+        }   // endif DEBUGGER
+    }
+
+    /**
+     * initBus(bus, cpu, dbg)
+     *
+     * @this {DebuggerX86}
+     * @param {Computer} cmp
+     * @param {Bus} bus
+     * @param {X86CPU} cpu
+     * @param {DebuggerX86} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cpu = cpu;
+        this.cmp = cmp;
+        this.fdc = cmp.getMachineComponent("FDC");
+        this.hdc = cmp.getMachineComponent("HDC");
+        this.fpu = cmp.getMachineComponent("FPU");
+        this.mouse = cmp.getMachineComponent("Mouse");
+        if (MAXDEBUG) this.chipset = cmp.getMachineComponent("ChipSet");
+
+        /*
+         * Re-initialize Debugger message support if necessary
+         */
+        var sMessages = cmp.getMachineParm('messages');
+        if (sMessages) this.messageInit(sMessages);
+
+        this.cchAddr = bus.getWidth() >> 2;
+        this.maskAddr = bus.nBusLimit;
+
+        /*
+         * Allocate a special segment "register", for use whenever a requested selector is not currently loaded
+         */
+        this.segDebugger = new X86Seg(this.cpu, X86Seg.ID.DBG, "DBG");
+
+        this.aaOpDescs = DebuggerX86.aaOpDescs;
+        if (this.cpu.model >= X86.MODEL_80186) {
+            this.aaOpDescs = DebuggerX86.aaOpDescs.slice();
+            this.aaOpDescs[0x0F] = DebuggerX86.aOpDescUndefined;
+            if (this.cpu.model >= X86.MODEL_80286) {
+                /*
+                 * TODO: Consider whether the aOpDesc0F table should be split in two: one for 80286-only instructions,
+                 * and one for both 80286 and 80386.  For now, the Debugger is not as strict as the X86CPU is about
+                 * the instructions it supports for each type of CPU, in part because an 80286 machine could still be
+                 * presented with 80386-only code that is simply "skipped over" when then CPU doesn't support it.
+                 *
+                 * Obviously I'm not being entirely consistent, since I don't disassemble *any* 0x0F opcodes for any
+                 * pre-80286 CPUs.  But at least I'm being up front about it.
+                 */
+                this.aaOpDescs[0x0F] = DebuggerX86.aOpDesc0F;
+                if (I386 && this.cpu.model >= X86.MODEL_80386) this.cchReg = 8;
+            }
+        }
+
+        this.messageDump(Messages.BUS,  function onDumpBus(asArgs) { dbg.dumpBus(asArgs); });
+        this.messageDump(Messages.DESC, function onDumpSel(asArgs) { dbg.dumpSel(asArgs); });
+        this.messageDump(Messages.DOS,  function onDumpDOS(asArgs) { dbg.dumpDOS(asArgs); });
+        this.messageDump(Messages.MEM,  function onDumpMem(asArgs) { dbg.dumpMem(asArgs); });
+        this.messageDump(Messages.TSS,  function onDumpTSS(asArgs) { dbg.dumpTSS(asArgs); });
+
+        if (Interrupts.WINDBG.ENABLED || Interrupts.WINDBGRM.ENABLED) {
+            this.fWinDbg = null;
+            this.cTrapFaults = 0;
+            this.fIgnoreNextCheckFault = false;
+            this.cpu.addIntNotify(Interrupts.WINCB.VECTOR, this.intWindowsCallBack.bind(this));
+            this.cpu.addIntNotify(Interrupts.WINDBG.VECTOR, this.intWindowsDebugger.bind(this));
+        }
+        if (Interrupts.WINDBGRM.ENABLED) {
+            this.fWinDbgRM = null;
+            this.cpu.addIntNotify(Interrupts.WINDBGRM.VECTOR, this.intWindowsDebuggerRM.bind(this));
+        }
+
+        this.setReady();
+    }
+
+    /**
+     * addSegmentInfo(dbgAddr, nSegment, sel, fCode, fPrint)
+     *
+     * CONDITIONAL: if (Interrupts.WINDBG.ENABLED || Interrupts.WINDBGRM.ENABLED)
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr (address of module name)
+     * @param {number} nSegment (logical segment number)
+     * @param {number} sel (current selector)
+     * @param {boolean} fCode (true if code segment, false if data segment)
+     * @param {boolean} [fPrint] (false means we're merely monitoring, so let WDEB386 print its own notifications)
+     */
+    addSegmentInfo(dbgAddr, nSegment, sel, fCode, fPrint)
+    {
+        var sModule = this.getSZ(dbgAddr);
+        var seg = this.getSegment(sel);
+        var len = seg? seg.limit + 1 : 0;
+        var sSection = (fCode? "_CODE" : "_DATA") + Str.toHex(nSegment, 2);
+        if (fPrint && this.messageEnabled(Messages.MEM)) {
+            this.message(sModule + ' ' + (fCode? "code" : "data") + '(' + Str.toHex(nSegment, 4) + ")=#" + Str.toHex(sel, 4) + " len " + Str.toHex(len));
+        }
+        var off = 0;
+        var aSymbols = this.findModuleInfo(sModule, nSegment);
+        aSymbols[sModule + sSection] = off;
+        this.addSymbols(sModule, nSegment, sel, off, null, len, aSymbols);
+    }
+
+    /**
+     * removeSegmentInfo(sel, fPrint)
+     *
+     * CONDITIONAL: if (Interrupts.WINDBG.ENABLED || Interrupts.WINDBGRM.ENABLED)
+     *
+     * @this {DebuggerX86}
+     * @param {number} sel
+     * @param {boolean} [fPrint] (false means we're merely monitoring OR we don't really care about these notifications)
+     */
+    removeSegmentInfo(sel, fPrint)
+    {
+        var sModuleRemoved = this.removeSymbols(null, sel);
+        if (fPrint && this.messageEnabled(Messages.MEM)) {
+            if (sModuleRemoved) {
+                this.message(sModuleRemoved + " #" + Str.toHex(sel, 4) + " removed");
+            } else {
+                this.message("unable to remove module for segment #" + Str.toHex(sel, 4));
+            }
+        }
+    }
+
+    /**
+     * addSectionInfo(dbgAddr, fCode, fPrint)
+     *
+     * CONDITIONAL: if (Interrupts.WINDBG.ENABLED || Interrupts.WINDBGRM.ENABLED)
+     *
+     *  dbgAddr -> D386_Device_Params structure:
+     *      DD_logical_seg  dw  ?   ; logical segment # from map
+     *      DD_actual_sel   dw  ?   ; actual selector value
+     *      DD_base         dd  ?   ; linear address offset for start of segment
+     *      DD_length       dd  ?   ; actual length of segment
+     *      DD_name         df  ?   ; 16:32 ptr to null terminated module name
+     *      DD_sym_name     df  ?   ; 16:32 ptr to null terminated parent name (eg, "DOS386")
+     *      DD_alias_sel    dw  ?   ; alias selector value (0 = none)
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr (address of D386_Device_Params)
+     * @param {boolean} fCode (true if code section, false if data section)
+     * @param {boolean} [fPrint] (false means we're merely monitoring, so let WDEB386 print its own notifications)
+     */
+    addSectionInfo(dbgAddr, fCode, fPrint)
+    {
+        var nSegment = this.getShort(dbgAddr, 2);
+        var sel = this.getShort(dbgAddr, 2);
+        var off = this.getLong(dbgAddr, 4);
+        var len = this.getLong(dbgAddr, 4);
+        var dbgAddrModule = this.newAddr(this.getLong(dbgAddr, 4), this.getShort(dbgAddr, 2));
+        var dbgAddrParent = this.newAddr(this.getLong(dbgAddr, 4), this.getShort(dbgAddr, 2));
+        // sel = this.getShort(dbgAddr, 2) || sel;
+        var sParent = this.getSZ(dbgAddrParent).toUpperCase();
+        var sModule = this.getSZ(dbgAddrModule).toUpperCase();
+        if (sParent == sModule) {
+            sParent = "";
+        } else {
+            sParent += '!';
+        }
+        var sSection = (fCode? "_CODE" : "_DATA") + Str.toHex(nSegment, 2);
+        if (fPrint && this.messageEnabled(Messages.MEM)) {
+            /*
+             * Mimics WDEB386 output, except that WDEB386 only displays a linear address, omitting the selector.
+             */
+            this.message(sParent + sModule + ' ' + (fCode? "code" : "data") + '(' + Str.toHex(nSegment, 4) + ")=" + Str.toHex(sel, 4) + ':' + Str.toHex(off) + " len " + Str.toHex(len));
+        }
+        /*
+         * TODO: Add support for 32-bit symbols; findModuleInfo() relies on Disk.getModuleInfo(), and the Disk
+         * component doesn't yet know how to parse 32-bit executables.
+         */
+        var aSymbols = this.findModuleInfo(sModule, nSegment);
+        aSymbols[sModule + sSection] = off;
+        this.addSymbols(sModule, nSegment, sel, off, null, len, aSymbols);
+    }
+
+    /**
+     * removeSectionInfo(nSegment, dbgAddr, fPrint)
+     *
+     * CONDITIONAL: if (Interrupts.WINDBG.ENABLED || Interrupts.WINDBGRM.ENABLED)
+     *
+     * @this {DebuggerX86}
+     * @param {number} nSegment (logical segment number)
+     * @param {DbgAddrX86} dbgAddr (address of module)
+     * @param {boolean} [fPrint] (false means we're merely monitoring OR we don't really care about these notifications)
+     */
+    removeSectionInfo(nSegment, dbgAddr, fPrint)
+    {
+        var sModule = this.getSZ(dbgAddr).toUpperCase();
+        var sModuleRemoved = this.removeSymbols(sModule, nSegment);
+        if (fPrint && this.messageEnabled(Messages.MEM)) {
+            if (sModuleRemoved) {
+                this.message(sModule + ' ' + Str.toHex(nSegment, 4) + " removed");
+            } else {
+                this.message("unable to remove " + sModule + " for section " + Str.toHex(nSegment, 4));
+            }
+        }
+    }
+
+    /**
+     * intWindowsCallBack()
+     *
+     * CONDITIONAL: if (Interrupts.WINDBG.ENABLED || Interrupts.WINDBGRM.ENABLED)
+     *
+     * This intercepts calls to Windows callback addresses, which use INT 0x30 (aka Transfer Space Faults).
+     *
+     * We're only interested in one particular callback: the VW32_Int41Dispatch (0x002A002A) that KERNEL32
+     * issues as 32-bit executable sections are loaded.
+     *
+     * At the time that INT 0x30 occurs, a far 32-bit call has been made, preceded by a near 32-bit call,
+     * preceded by a 32-bit push of the Windows Debugger function # that would normally be in EAX if this had
+     * been an actual INT 0x41.
+     *
+     * NOTE: Regardless whether we're "handling" INT 0x41 or merely "monitoring" INT 0x41, as far as THIS
+     * interrupt is concerned, we always let the system process it, because execution never continues at the
+     * instruction following an INT 0x30; in fact, execution doesn't even continue after the far 32-bit call
+     * (even though the kernel places a "RET 4" after that call).  So, rather than recreate all that automatic
+     * address popping, we let the system do it for us, since it's designed to work whether a debugger (eg,
+     * WDEB386's DEBUG VxD) is installed or not.
+     *
+     * TODO: Consider "consuming" all VW32_Int41Dispatch callbacks, because the Windows 95 kernel goes to
+     * great effort to pass those requests on to the DEBUG VxD, which end up going nowhere when the VxD isn't
+     * loaded (to load it, you must either run WDEB386.EXE or install the VxD via SYSTEM.INI).  Regrettably,
+     * Windows 95 assumes that if WDEB386 support is present, then a DEBUG VxD must be present as well.
+     *
+     * @this {DebuggerX86}
+     * @param {number} addr
+     * @return {boolean} true to proceed with the INT 0x30 software interrupt
+     */
+    intWindowsCallBack(addr)
+    {
+        var cpu = this.cpu;
+
+        if (this.fWinDbg != null && cpu.regEAX == 0x002A002A) {
+
+            var DX = cpu.regEDX & 0xffff;
+            var SI = cpu.regESI & 0xffff;
+            var dbgAddr = this.newAddr(cpu.getSP() + 0x0C, cpu.getSS());
+            var EAX = this.getLong(dbgAddr);
+
+            switch(EAX) {
+            case Interrupts.WINDBG.LOADSEG32:
+                /*
+                 *  SI == segment type:
+                 *      0x0     code selector
+                 *      0x1     data selector
+                 *  DX:EBX -> D386_Device_Params structure (see addSectionInfo() for details)
+                 */
+                this.addSectionInfo(this.newAddr(cpu.regEBX, DX), !SI, !!this.fWinDbg);
+                break;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * intWindowsDebugger()
+     *
+     * CONDITIONAL: if (Interrupts.WINDBG.ENABLED || Interrupts.WINDBGRM.ENABLED)
+     *
+     * This intercepts calls to the Windows Debugger protected-mode interface (INT 0x41).
+     *
+     * It's enabled if Interrupts.WINDBG.ENABLED is true, but it must ALSO be enabled if
+     * Interrupts.WINDBGRM.ENABLED is true, because if the latter decides to respond to requests,
+     * then we must start responding, too.  Windows assumes that if INT 0x68 support is present,
+     * then INT 0x41 support must be present as well.
+     *
+     * That is why intWindowsDebuggerRM() will also set this.fWinDbg to true: we MUST return false
+     * for all INT 0x41 requests, so that all requests are consumed, since there's no guarantee
+     * that a valid INT 0x41 handler will exist inside the machine.
+     *
+     * @this {DebuggerX86}
+     * @param {number} addr
+     * @return {boolean} true to proceed with the INT 0x41 software interrupt, false to skip
+     */
+    intWindowsDebugger(addr)
+    {
+        var dbgAddr;
+        var cpu = this.cpu;
+        var AX = cpu.regEAX & 0xffff;
+        var BX = cpu.regEBX & 0xffff;
+        var CX = cpu.regECX & 0xffff;
+        var DX = cpu.regEDX & 0xffff;
+        var SI = cpu.regESI & 0xffff;
+        var DI = cpu.regEDI & 0xffff;
+        var ES = cpu.segES.sel;
+
+        if (this.fWinDbg == null) {
+            if (AX == Interrupts.WINDBG.IS_LOADED) {
+                /*
+                 * We're only going to respond to this function if no one else did, in which case,
+                 * we'll set fWinDbg to true and handle additional notifications.
+                 */
+                cpu.addIntReturn(addr, function(dbg) {
+                    return function onInt41Return(nLevel) {
+                        if ((cpu.regEAX & 0xffff) != Interrupts.WINDBG.LOADED) {
+                            cpu.regEAX = (cpu.regEAX & ~0xffff) | Interrupts.WINDBG.LOADED;
+                            /*
+                             * TODO: We need a DEBUGGER message category; using the MEM category for now.
+                             */
+                            dbg.printMessage("INT 0x41 handling enabled", Messages.MEM);
+                            dbg.fWinDbg = true;
+                        } else {
+                            dbg.printMessage("INT 0x41 monitoring enabled", Messages.MEM);
+                            dbg.fWinDbg = false;
+                        }
+                    };
+                }(this));
+            }
+            return true;
+        }
+
+        /*
+         * NOTE: If this.fWinDbg is true, then all cases should return false, because we're taking full
+         * responsibility for all requests (don't assume there's valid interrupt handler inside the machine).
+         */
+        switch(AX) {
+        case Interrupts.WINDBG.IS_LOADED:           // 0x004F
+            if (this.fWinDbg) {
+                cpu.regEAX = (cpu.regEAX & ~0xffff) | Interrupts.WINDBG.LOADED;
+                this.printMessage("INT 0x41 handling enabled", Messages.MEM);
+            }
+            break;
+
+        case Interrupts.WINDBG.LOADSEG:             // 0x0050
+            this.addSegmentInfo(this.newAddr(DI, ES), BX+1, CX, !(SI & 0x1), !!this.fWinDbg);
+            break;
+
+        case Interrupts.WINDBG.FREESEG:             // 0x0052
+            this.removeSegmentInfo(BX);
+            break;
+
+        case Interrupts.WINDBG.KRNLVARS:            // 0x005A
+            /*
+             *  BX = version number of this data (0x3A0)
+             *  DX:CX points to:
+             *      WORD    hGlobalHeap     ****
+             *      WORD    pGlobalHeap     ****
+             *      WORD    hExeHead        ****
+             *      WORD    hExeSweep
+             *      WORD    topPDB
+             *      WORD    headPDB
+             *      WORD    topsizePDB
+             *      WORD    headTDB         ****
+             *      WORD    curTDB          ****
+             *      WORD    loadTDB
+             *      WORD    LockTDB
+             *      WORD    SelTableLen     ****
+             *      DWORD   SelTableStart   ****
+             */
+            break;
+
+        case Interrupts.WINDBG.RELSEG:              // 0x005C
+        case Interrupts.WINDBG.EXITCALL:            // 0x0062
+        case Interrupts.WINDBG.LOADDLL:             // 0x0064
+        case Interrupts.WINDBG.DELMODULE:           // 0x0065
+        case Interrupts.WINDBG.UNKNOWN66:           // 0x0066
+        case Interrupts.WINDBG.UNKNOWN67:           // 0x0067
+            /*
+             * TODO: Figure out what to do with these notifications, if anything
+             */
+            break;
+
+        case Interrupts.WINDBG.LOADHIGH:            // 0x005D
+        case Interrupts.WINDBG.REGDOTCMD:           // 0x0070
+        case Interrupts.WINDBG.CONDBP:              // 0xF001
+            break;
+
+        case Interrupts.WINDBG.CHECKFAULT:          // 0x007F
+            if (this.fWinDbg) {
+                /*
+                 * AX == 0 means handle fault normally, 1 means issue TRAPFAULT
+                 */
+                cpu.regEAX = (cpu.regEAX & ~0xffff) | (this.fIgnoreNextCheckFault? 0 : 1);
+                if (DEBUG) this.println("INT 0x41 CHECKFAULT: fault=" + Str.toHexWord(BX) + " type=" + Str.toHexWord(CX) + " trap=" + !this.fIgnoreNextCheckFault);
+            }
+            break;
+
+        case Interrupts.WINDBG.TRAPFAULT:           // 0x0083
+            /*
+             * If we responded with AX == 1 to a preceding CHECKFAULT notification, then we should receive the
+             * following TRAPFAULT notification; additionally, a TRAPFAULT notification may be issued without
+             * any CHECKFAULT warning if the user was presented with a fault dialog containing a "Debug" button,
+             * and the user clicked it.
+             *
+             * Regardless, whenever we receive this notification, we allocate a temporary breakpoint at the
+             * reported fault address.
+             */
+            if (this.fWinDbg) {
+                dbgAddr = this.newAddr(cpu.regEDX, CX);
+                if (!this.cTrapFaults++) {
+                    this.println("INT 0x41 TRAPFAULT: fault=" + Str.toHexWord(BX) + " error=" + Str.toHexLong(cpu.regESI) + " addr=" + this.toHexAddr(dbgAddr));
+                    this.addBreakpoint(this.aBreakExec, dbgAddr, true);
+                    this.historyInit(true);         // temporary breakpoints don't normally trigger history, but in this case, we want it to
+                } else {
+                    this.println("TRAPFAULT failed");
+                    this.findBreakpoint(this.aBreakExec, dbgAddr, true, true, true);
+                    this.cTrapFaults = 0;
+                    this.stopCPU();
+                }
+            }
+            break;
+
+        case Interrupts.WINDBG.GETSYMBOL:           // 0x008D
+            if (this.fWinDbg) cpu.regEAX = (cpu.regEAX & ~0xffff)|1;        // AX == 1 means not found
+            break;
+
+        case Interrupts.WINDBG.LOADSEG32:           // 0x0150
+            /*
+             *  SI == segment type:
+             *      0x0     code selector
+             *      0x1     data selector
+             *  DX:EBX -> D386_Device_Params structure (see addSectionInfo() for details)
+             */
+            this.addSectionInfo(this.newAddr(cpu.regEBX, DX), !SI, !!this.fWinDbg);
+            break;
+
+        case Interrupts.WINDBG.FREESEG32:           // 0x0152
+            /*
+             *  BX == segment number
+             *  DX:EDI -> module name
+             */
+            this.removeSectionInfo(BX, this.newAddr(cpu.regEDI, DX));
+            break;
+
+        default:
+            if (DEBUG && this.fWinDbg) {
+                this.println("INT 0x41: " + Str.toHexWord(AX));
+            }
+            break;
+        }
+
+        /*
+         * Let's try to limit the scope of any "gt" command by resetting this flag after any INT 0x41
+         */
+        this.fIgnoreNextCheckFault = false;
+
+        return !this.fWinDbg;
+    }
+
+    /**
+     * intWindowsDebuggerRM()
+     *
+     * CONDITIONAL: if (Interrupts.WINDBGRM.ENABLED)
+     *
+     * This intercepts calls to the Windows Debugger real-mode interface (INT 0x68).
+     *
+     * @this {DebuggerX86}
+     * @param {number} addr
+     * @return {boolean} true to proceed with the INT 0x68 software interrupt, false to skip
+     */
+    intWindowsDebuggerRM(addr)
+    {
+        var cpu = this.cpu;
+        var AL = cpu.regEAX & 0xff;
+        var AH = (cpu.regEAX >> 8) & 0xff;
+        var BX = cpu.regEBX & 0xffff;
+        var CX = cpu.regECX & 0xffff;
+        var DX = cpu.regEDX & 0xffff;
+        var DI = cpu.regEDI & 0xffff;
+        var ES = cpu.segES.sel;
+
+        if (this.fWinDbgRM == null) {
+            if (AH == Interrupts.WINDBGRM.IS_LOADED) {
+                /*
+                 * It looks like IFSHLP.SYS issues a preliminary INT 0x68 before Windows 95 gets rolling,
+                 * and the Windows Debugger will not have had a chance to load yet, so we need to ignore
+                 * that call.  We detect IFSHLP.SYS by looking for "IFS$" in the caller's code segment,
+                 * where the IFSHLP device driver header is located.
+                 */
+                if (cpu.getLong((cpu.segCS.sel << 4) + 0x0A) == 0x24534649) {
+                    if (DEBUG) this.println("Ignoring INT 0x68 from IFSHLP.SYS");
+                    return true;
+                }
+                /*
+                 * Ditto for WDEB386 itself, which presumably wants to avoid loading on top of itself.
+                 */
+                if (cpu.getLong((cpu.segCS.sel << 4) + 0x5F) == 0x42454457) {
+                    if (DEBUG) this.println("Ignoring INT 0x68 from WDEB386.EXE");
+                    return true;
+                }
+                /*
+                 * We're only going to respond to this function if no one else did, in which case, we'll set
+                 * fWinDbgRM to true and handle additional notifications.
+                 */
+                cpu.addIntReturn(addr, function(dbg) {
+                    return function onInt68Return(nLevel) {
+                        if ((cpu.regEAX & 0xffff) != Interrupts.WINDBGRM.LOADED) {
+                            cpu.regEAX = (cpu.regEAX & ~0xffff) | Interrupts.WINDBGRM.LOADED;
+                            dbg.printMessage("INT 0x68 handling enabled", Messages.MEM);
+                            /*
+                             * If we turn on INT 0x68 handling, we must also turn on INT 0x41 handling,
+                             * because Windows assumes that the latter handler exists whenever the former does.
+                             */
+                            dbg.fWinDbg = dbg.fWinDbgRM = true;
+                        } else {
+                            dbg.printMessage("INT 0x68 monitoring enabled", Messages.MEM);
+                            dbg.fWinDbgRM = false;
+                        }
+                    };
+                }(this));
+            }
+            return true;
+        }
+
+        /*
+         * NOTE: If this.fWinDbgRM is true, then all cases should return false, because we're taking full
+         * responsibility for all requests (don't assume there's valid interrupt handler inside the machine).
+         */
+        switch(AH) {
+        case Interrupts.WINDBGRM.IS_LOADED:         // 0x43
+            if (this.fWinDbgRM) {
+                cpu.regEAX = (cpu.regEAX & ~0xffff) | Interrupts.WINDBGRM.LOADED;
+            }
+            break;
+
+        case Interrupts.WINDBGRM.PREP_PMODE:        // 0x44
+            if (this.fWinDbgRM) {
+                /*
+                 * Use our fancy new "call break" mechanism to obtain a special address that will
+                 * trap all calls, routing control to the specified function (callWindowsDebuggerPMInit).
+                 */
+                var a = cpu.segCS.addCallBreak(this.callWindowsDebuggerPMInit.bind(this));
+                if (a) {
+                    cpu.regEDI = a[0];              // ES:EDI receives the "call break" address
+                    cpu.setES(a[1]);
+                }
+            }
+            break;
+
+        case Interrupts.WINDBGRM.FREESEG:           // 0x48
+            this.removeSegmentInfo(BX);
+            break;
+
+        case Interrupts.WINDBGRM.REMOVESEGS:        // 0x4F
+            /*
+             * TODO: This probably just signals the end of module loading; nothing is required, but we should
+             * clean up whatever we can....
+             */
+            break;
+
+        case Interrupts.WINDBGRM.LOADSEG:           // 0x50
+            if (AL == 0x20) {
+                /*
+                 *  Real-mode EXE
+                 *  CX == paragraph
+                 *  ES:DI -> module name
+                 */
+                this.addSegmentInfo(this.newAddr(DI, ES), 0, CX, true, !!this.fWinDbgRM);
+            }
+            else if (AL < 0x80) {
+                /*
+                 *  AL == segment type:
+                 *      0x00    code selector
+                 *      0x01    data selector
+                 *      0x10    code segment
+                 *      0x11    data segment
+                 *      0x40    code segment & sel
+                 *      0x41    data segment & sel
+                 *  BX == segment #
+                 *  CX == actual segment/selector
+                 *  DX == actual selector (if 0x40 or 0x41)
+                 *  ES:DI -> module name
+                 */
+                this.addSegmentInfo(this.newAddr(DI, ES), BX+1, (AL & 0x40)? DX : CX, !(AL & 0x1), !!this.fWinDbgRM);
+            }
+            else {
+                /*
+                 *  AL == segment type:
+                 *      0x80    device driver code seg
+                 *      0x81    device driver data seg
+                 *  ES:DI -> D386_Device_Params structure (see addSectionInfo() for details)
+                 */
+                this.addSectionInfo(this.newAddr(DI, ES), !(AL & 0x1), !!this.fWinDbgRM);
+            }
+            if (this.fWinDbgRM) {
+                cpu.regEAX = (cpu.regEAX & ~0xff) | 0x01;
+            }
+            break;
+
+        default:
+            if (DEBUG && this.fWinDbgRM) {
+                this.println("INT 0x68: " + Str.toHexByte(AH));
+            }
+            break;
+        }
+
+        return !this.fWinDbgRM;
+    }
+
+    /**
+     * callWindowsDebuggerPMInit()
+     *
+     * CONDITIONAL: if (Interrupts.WINDBGRM.ENABLED)
+     *
+     * This intercepts calls to the Windows Debugger "PMInit" interface; eg:
+     *
+     *      AL = function code
+     *
+     *          0 - initialize IDT
+     *              ES:EDI points to protected mode IDT
+     *
+     *          1 - initialize page checking
+     *              BX = physical selector
+     *              ECX = linear bias
+     *
+     *          2 - specify that debug queries are supported
+     *
+     *          3 - initialize spare PTE
+     *              EBX = linear address of spare PTE
+     *              EDX = linear address the PTE represents
+     *
+     *          4 - set Enter/Exit VMM routine address
+     *              EBX = Enter VMM routine address
+     *              ECX = Exit VMM routine address
+     *              EDX = $_Debug_Out_Service address
+     *              ESI = $_Trace_Out_Service address
+     *              The VMM enter/exit routines must return with a retfd
+     *
+     *          5 - get debugger size/physical address
+     *              returns: AL = 0 (don't call AL = 1)
+     *              ECX = size in bytes
+     *              ESI = starting physical code/data address
+     *
+     *          6 - set debugger base/initialize spare PTE
+     *              EBX = linear address of spare PTE
+     *              EDX = linear address the PTE represents
+     *              ESI = starting linear address of debug code/data
+     *
+     *          7 - enable memory context functions
+     *
+     * @this {DebuggerX86}
+     * @return {boolean} (must always return false to skip the call, because the call is using a CALLBREAK address)
+     */
+    callWindowsDebuggerPMInit()
+    {
+        var cpu = this.cpu;
+        var AL = cpu.regEAX & 0xff;
+        if (MAXDEBUG) this.println("INT 0x68 callback: " + Str.toHexByte(AL));
+        if (AL == 5) {
+            cpu.regECX = cpu.regESI = 0;                // our in-machine debugger footprint is zero
+            cpu.regEAX = (cpu.regEAX & ~0xff) | 0x01;   // TODO: Returning a "don't call" response sounds good, but what does it REALLY mean?
+        }
+        return false;
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * @this {DebuggerX86}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "debugInput")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        var dbg = this;
+        switch (sBinding) {
+
+        case "debugInput":
+            this.bindings[sBinding] = control;
+            this.controlDebug = control;
+            /*
+             * For halted machines, this is fine, but for auto-start machines, it can be annoying.
+             *
+             *      control.focus();
+             */
+            control.onkeydown = function onKeyDownDebugInput(event) {
+                var sCmd;
+                if (event.keyCode == Keys.KEYCODE.CR) {
+                    sCmd = control.value;
+                    control.value = "";
+                    dbg.doCommands(sCmd, true);
+                }
+                else if (event.keyCode == Keys.KEYCODE.ESC) {
+                    control.value = sCmd = "";
+                }
+                else {
+                    if (event.keyCode == Keys.KEYCODE.UP) {
+                        sCmd = dbg.getPrevCommand();
+                    }
+                    else if (event.keyCode == Keys.KEYCODE.DOWN) {
+                        sCmd = dbg.getNextCommand();
+                    }
+                    if (sCmd != null) {
+                        var cch = sCmd.length;
+                        control.value = sCmd;
+                        control.setSelectionRange(cch, cch);
+                    }
+                }
+                if (sCmd != null && event.preventDefault) event.preventDefault();
+            };
+            return true;
+
+        case "debugEnter":
+            this.bindings[sBinding] = control;
+            Web.onClickRepeat(
+                control,
+                500, 100,
+                function onClickDebugEnter(fRepeat) {
+                    if (dbg.controlDebug) {
+                        var sCmds = dbg.controlDebug.value;
+                        dbg.controlDebug.value = "";
+                        dbg.doCommands(sCmds, true);
+                        return true;
+                    }
+                    if (DEBUG) dbg.log("no debugger input buffer");
+                    return false;
+                }
+            );
+            return true;
+
+        case "step":
+            this.bindings[sBinding] = control;
+            Web.onClickRepeat(
+                control,
+                500, 100,
+                function onClickStep(fRepeat) {
+                    var fCompleted = false;
+                    if (!dbg.isBusy(true)) {
+                        dbg.setBusy(true);
+                        fCompleted = dbg.stepCPU(fRepeat? 1 : 0);
+                        dbg.setBusy(false);
+                    }
+                    return fCompleted;
+                }
+            );
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * updateFocus()
+     *
+     * @this {DebuggerX86}
+     */
+    updateFocus()
+    {
+        if (this.controlDebug) this.controlDebug.focus();
+    }
+
+    /**
+     * getCPUMode()
+     *
+     * @this {DebuggerX86}
+     * @return {boolean} (true if protected mode, false if not)
+     */
+    getCPUMode()
+    {
+        return !!(this.cpu && (this.cpu.regCR0 & X86.CR0.MSW.PE) && !(this.cpu.regPS & X86.PS.VM));
+    }
+
+    /**
+     * getAddressType()
+     *
+     * @this {DebuggerX86}
+     * @return {number}
+     */
+    getAddressType()
+    {
+        return this.getCPUMode()? DebuggerX86.ADDRTYPE.PROT : DebuggerX86.ADDRTYPE.REAL;
+    }
+
+    /**
+     * getSegment(sel, type)
+     *
+     * If the selector matches that of any of the CPU segment registers, then return the CPU's segment
+     * register, instead of using our own segDebugger segment register.  This makes it possible for us to
+     * see what the CPU is seeing at certain critical junctures, such as after an LMSW instruction has
+     * switched the processor from real to protected mode.  Actually loading the selector from the GDT/LDT
+     * should be done only as a last resort.
+     *
+     * @this {DebuggerX86}
+     * @param {number|null|undefined} sel
+     * @param {number} [type] (defaults to getAddressType())
+     * @return {X86Seg|null} seg
+     */
+    getSegment(sel, type)
+    {
+        var typeDefault = this.getAddressType();
+
+        if (!type) type = typeDefault;
+
+        if (type == typeDefault) {
+            if (sel === this.cpu.getCS()) return this.cpu.segCS;
+            if (sel === this.cpu.getDS()) return this.cpu.segDS;
+            if (sel === this.cpu.getES()) return this.cpu.segES;
+            if (sel === this.cpu.getSS()) return this.cpu.segSS;
+            if (I386 && this.cpu.model >= X86.MODEL_80386) {
+                if (sel === this.cpu.getFS()) return this.cpu.segFS;
+                if (sel === this.cpu.getGS()) return this.cpu.segGS;
+            }
+            /*
+             * Even if nSuppressBreaks is set, we'll allow the call in real-mode,
+             * because a loadReal() request using segDebugger should generally be safe.
+             */
+            if (this.nSuppressBreaks && type == DebuggerX86.ADDRTYPE.PROT || !this.segDebugger) return null;
+        }
+        var seg = this.segDebugger;
+        if (type != DebuggerX86.ADDRTYPE.PROT) {
+            seg.loadReal(sel);
+            seg.limit = 0xffff;         // although an ACTUAL real-mode segment load would not modify the limit,
+            seg.offMax = 0x10000;       // proper segDebugger operation requires that we update the limit ourselves
+        } else {
+            seg.probeDesc(sel);
+        }
+        return seg;
+    }
+
+    /**
+     * getAddr(dbgAddr, fWrite, nb)
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86|null|undefined} dbgAddr
+     * @param {boolean} [fWrite]
+     * @param {number} [nb] number of bytes to check (1, 2 or 4); default is 1
+     * @return {number} is the corresponding linear address, or X86.ADDR_INVALID
+     */
+    getAddr(dbgAddr, fWrite, nb)
+    {
+        /*
+         * Some addresses (eg, breakpoint addresses) save their original linear address in dbgAddr.addr,
+         * so we want to use that if it's there, but otherwise, dbgAddr is assumed to be a segmented address
+         * whose linear address must always be (re)calculated based on current machine state (mode, active
+         * descriptor tables, etc).
+         */
+        var addr = dbgAddr && dbgAddr.addr;
+        if (addr == null) {
+            addr = X86.ADDR_INVALID;
+            if (dbgAddr) {
+                /*
+                 * TODO: We should try to cache the seg inside dbgAddr, to avoid unnecessary calls to getSegment().
+                 */
+                var seg = this.getSegment(dbgAddr.sel, dbgAddr.type);
+                if (seg) {
+                    if (!fWrite) {
+                        addr = seg.checkReadDebugger(dbgAddr.off || 0, nb || 1);
+                    } else {
+                        addr = seg.checkWriteDebugger(dbgAddr.off || 0, nb || 1);
+                    }
+                    dbgAddr.addr = addr;
+                }
+            }
+        }
+        return addr;
+    }
+
+    /**
+     * getByte(dbgAddr, inc)
+     *
+     * We must route all our memory requests through the CPU now, in case paging is enabled.
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr
+     * @param {number} [inc]
+     * @return {number}
+     */
+    getByte(dbgAddr, inc)
+    {
+        var b = 0xff;
+        var addr = this.getAddr(dbgAddr, false, 1);
+        if (addr !== X86.ADDR_INVALID) {
+            /*
+             * TODO: Determine what we should do about the fact that we're masking any error from probeAddr()
+             */
+            b = this.cpu.probeAddr(addr, 1, dbgAddr.type == DebuggerX86.ADDRTYPE.PHYSICAL) | 0;
+            if (inc) this.incAddr(dbgAddr, inc);
+        }
+        return b;
+    }
+
+    /**
+     * getWord(dbgAddr, fAdvance)
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr
+     * @param {boolean} [fAdvance]
+     * @return {number}
+     */
+    getWord(dbgAddr, fAdvance)
+    {
+        return dbgAddr.fData32? this.getLong(dbgAddr, fAdvance? 4 : 0) : this.getShort(dbgAddr, fAdvance? 2 : 0);
+    }
+
+    /**
+     * getShort(dbgAddr, inc)
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr
+     * @param {number} [inc]
+     * @return {number}
+     */
+    getShort(dbgAddr, inc)
+    {
+        var w = 0xffff;
+        var addr = this.getAddr(dbgAddr, false, 2);
+        if (addr !== X86.ADDR_INVALID) {
+            /*
+             * TODO: Determine what we should do about the fact that we're masking any error from probeAddr()
+             */
+            w = this.cpu.probeAddr(addr, 2, dbgAddr.type == DebuggerX86.ADDRTYPE.PHYSICAL) | 0;
+            if (inc) this.incAddr(dbgAddr, inc);
+        }
+        return w;
+    }
+
+    /**
+     * getLong(dbgAddr, inc)
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr
+     * @param {number} [inc]
+     * @return {number}
+     */
+    getLong(dbgAddr, inc)
+    {
+        var l = -1;
+        var addr = this.getAddr(dbgAddr, false, 4);
+        if (addr !== X86.ADDR_INVALID) {
+            /*
+             * TODO: Determine what we should do about the fact that we're masking any error from probeAddr()
+             */
+            l = this.cpu.probeAddr(addr, 4, dbgAddr.type == DebuggerX86.ADDRTYPE.PHYSICAL) | 0;
+            if (inc) this.incAddr(dbgAddr, inc);
+        }
+        return l;
+    }
+
+    /**
+     * setByte(dbgAddr, b, inc, fNoUpdate)
+     *
+     * NOTE: If you need to patch a ROM, you MUST use the ROM location's physical address.
+     *
+     * WARNING: Be careful with the editing commands that use function, because we don't have a safe
+     * counterpart to cpu.probeAddr().
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr
+     * @param {number} b
+     * @param {number} [inc]
+     * @param {boolean} [fNoUpdate] (when doing a large number of setByte() calls, set this to true and call cpu.updateCPU() when you're done)
+     */
+    setByte(dbgAddr, b, inc, fNoUpdate)
+    {
+        var addr = this.getAddr(dbgAddr, true, 1);
+        if (addr !== X86.ADDR_INVALID) {
+            if (dbgAddr.type != DebuggerX86.ADDRTYPE.PHYSICAL) {
+                this.cpu.setByte(addr, b);
+            } else {
+                this.bus.setByteDirect(addr, b);
+            }
+            if (inc) this.incAddr(dbgAddr, inc);
+            if (!fNoUpdate) this.cpu.updateCPU(true);   // we set fForce to true in case video memory was the target
+        }
+    }
+
+    /**
+     * setShort(dbgAddr, w, inc)
+     *
+     * NOTE: If you need to patch a ROM, you MUST use the ROM location's physical address.
+     *
+     * WARNING: Be careful with the editing commands that use function, because we don't have a safe
+     * counterpart to cpu.probeAddr().
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr
+     * @param {number} w
+     * @param {number} [inc]
+     */
+    setShort(dbgAddr, w, inc)
+    {
+        var addr = this.getAddr(dbgAddr, true, 2);
+        if (addr !== X86.ADDR_INVALID) {
+            if (dbgAddr.type != DebuggerX86.ADDRTYPE.PHYSICAL) {
+                this.cpu.setShort(addr, w);
+            } else {
+                this.bus.setShortDirect(addr, w);
+            }
+            if (inc) this.incAddr(dbgAddr, inc);
+            this.cpu.updateCPU(true);           // we set fForce to true in case video memory was the target
+        }
+    }
+
+    /**
+     * newAddr(off, sel, addr, type, fData32, fAddr32)
+     *
+     * Returns a NEW DbgAddrX86 object, initialized with specified values and/or defaults.
+     *
+     * @this {DebuggerX86}
+     * @param {number|null|undefined} [off] (default is zero)
+     * @param {number|null|undefined} [sel] (default is undefined)
+     * @param {number|null|undefined} [addr] (default is undefined)
+     * @param {number} [type] (default is based on current CPU mode)
+     * @param {boolean} [fData32] (default is the current CPU operand size)
+     * @param {boolean} [fAddr32] (default is the current CPU address size)
+     * @return {DbgAddrX86}
+     */
+    newAddr(off, sel, addr, type, fData32, fAddr32)
+    {
+        return this.setAddr({}, off, sel, addr, type, fData32, fAddr32);
+    }
+
+    /**
+     * getAddrPrefix(dbgAddr)
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr
+     * @return {string}
+     */
+    getAddrPrefix(dbgAddr)
+    {
+        var ch;
+
+        switch (dbgAddr.type) {
+        case DebuggerX86.ADDRTYPE.REAL:
+        case DebuggerX86.ADDRTYPE.V86:
+            ch = '&';
+            break;
+        case DebuggerX86.ADDRTYPE.PROT:
+            ch = '#';
+            break;
+        case DebuggerX86.ADDRTYPE.LINEAR:
+            ch = '%';
+            break;
+        case DebuggerX86.ADDRTYPE.PHYSICAL:
+            ch = '%%';
+            break;
+        default:
+            ch = dbgAddr.sel? '' : '%';
+            break;
+        }
+        return ch;
+    }
+
+    /**
+     * setAddr(dbgAddr, off, sel, addr, type, fData32, fAddr32)
+     *
+     * Updates an EXISTING DbgAddrX86 object, initialized with specified values and/or defaults.
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr
+     * @param {number|null|undefined} [off] (default is zero)
+     * @param {number|null|undefined} [sel] (default is undefined)
+     * @param {number|null|undefined} [addr] (default is undefined)
+     * @param {number} [type] (default is based on current CPU mode)
+     * @param {boolean} [fData32] (default is the current CPU operand size)
+     * @param {boolean} [fAddr32] (default is the current CPU address size)
+     * @return {DbgAddrX86}
+     */
+    setAddr(dbgAddr, off, sel, addr, type, fData32, fAddr32)
+    {
+        dbgAddr.off = off || 0;
+        dbgAddr.sel = sel;
+        dbgAddr.addr = addr;
+        dbgAddr.type = type || this.getAddressType();
+        dbgAddr.fData32 = (fData32 != null)? fData32 : !!(this.cpu && this.cpu.segCS.sizeData == 4);
+        dbgAddr.fAddr32 = (fAddr32 != null)? fAddr32 : !!(this.cpu && this.cpu.segCS.sizeAddr == 4);
+        dbgAddr.fTempBreak = false;
+        return dbgAddr;
+    }
+
+    /**
+     * packAddr(dbgAddr)
+     *
+     * Packs a DbgAddrX86 object into an Array suitable for saving in a machine state object.
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr
+     * @return {Array}
+     */
+    packAddr(dbgAddr)
+    {
+        return [dbgAddr.off, dbgAddr.sel, dbgAddr.addr, dbgAddr.fTempBreak, dbgAddr.fData32, dbgAddr.fAddr32, dbgAddr.cOverrides, dbgAddr.fComplete];
+    }
+
+    /**
+     * unpackAddr(aAddr)
+     *
+     * Unpacks a DbgAddrX86 object from an Array created by packAddr() and restored from a saved machine state.
+     *
+     * @this {DebuggerX86}
+     * @param {Array} aAddr
+     * @return {DbgAddrX86}
+     */
+    unpackAddr(aAddr)
+    {
+        return {off: aAddr[0], sel: aAddr[1], addr: aAddr[2], fTempBreak: aAddr[3], fData32: aAddr[4], fAddr32: aAddr[5], cOverrides: aAddr[6], fComplete: aAddr[7]};
+    }
+
+    /**
+     * checkLimit(dbgAddr, fUpdate)
+     *
+     * Used by incAddr() and parseAddr() to ensure that the (updated) dbgAddr offset is within segment bounds.
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr
+     * @param {boolean} [fUpdate] (true to update segment info)
+     * @return {boolean}
+     */
+    checkLimit(dbgAddr, fUpdate)
+    {
+        if (dbgAddr.sel != null) {
+            var seg = this.getSegment(dbgAddr.sel, dbgAddr.type);
+            if (seg) {
+                var off = dbgAddr.off & seg.maskAddr;
+                if (!seg.fExpDown) {
+                    if ((off >>> 0) >= seg.offMax) {
+                        return false;
+                    }
+                }
+                else {
+                    if ((off >>> 0) < seg.offMax) {
+                        return false;
+                    }
+                }
+                if (fUpdate) {
+                    dbgAddr.off = off;
+                    dbgAddr.fData32 = (seg.sizeData == 4);
+                    dbgAddr.fAddr32 = (seg.sizeAddr == 4);
+                }
+            }
+        }
+        return true;
+    }
+
+    /**
+     * parseAddr(sAddr, fCode, fNoChecks, fQuiet)
+     *
+     * As discussed above, dbgAddr variables contain one or more of: off, sel, and addr.  They represent
+     * a segmented address (sel:off) when sel is defined or a linear address (addr) when sel is undefined
+     * (or null).
+     *
+     * To create a segmented address, specify two values separated by ':'; for a linear address, use
+     * a '%' prefix.  We check for ':' after '%', so if for some strange reason you specify both, the
+     * address will be treated as segmented, not linear.
+     *
+     * The '%' syntax is similar to that used by the Windows 80386 kernel debugger (wdeb386) for linear
+     * addresses.  If/when we add support for processors with page tables, we will likely adopt the same
+     * convention for linear addresses and provide a different syntax (eg, "%%") physical memory references.
+     *
+     * Address evaluation and validation (eg, range checks) are no longer performed at this stage.  That's
+     * done later, by getAddr(), which returns X86.ADDR_INVALID for invalid segments, out-of-range offsets,
+     * etc.  The Debugger's low-level get/set memory functions verify all getAddr() results, but even if an
+     * invalid address is passed through to the Bus memory interfaces, the address will simply be masked with
+     * Bus.nBusLimit; in the case of X86.ADDR_INVALID, that will generally refer to the top of the physical
+     * address space.
+     *
+     * @this {DebuggerX86}
+     * @param {string|undefined} sAddr
+     * @param {boolean} [fCode] (true if target is code, false if target is data)
+     * @param {boolean} [fNoChecks] (true when setting breakpoints that may not be valid now, but will be later)
+     * @param {boolean} [fQuiet]
+     * @return {DbgAddrX86|null|undefined}
+     */
+    parseAddr(sAddr, fCode, fNoChecks, fQuiet)
+    {
+        var dbgAddr;
+        var dbgAddrNext = (fCode? this.dbgAddrNextCode : this.dbgAddrNextData);
+
+        var type = fNoChecks? DebuggerX86.ADDRTYPE.NONE : dbgAddrNext.type;
+        var off = dbgAddrNext.off, sel = dbgAddrNext.sel, addr = dbgAddrNext.addr;
+
+        if (sAddr !== undefined) {
+
+            sAddr = this.parseReference(sAddr);
+
+            var ch = sAddr.charAt(0);
+            var iColon = sAddr.indexOf(':');
+
+            switch(ch) {
+            case '&':
+                type = DebuggerX86.ADDRTYPE.REAL;
+                break;
+            case '#':
+                type = DebuggerX86.ADDRTYPE.PROT;
+                break;
+            case '%':
+                type = DebuggerX86.ADDRTYPE.LINEAR;
+                ch = sAddr.charAt(1);
+                if (ch == '%') {
+                    type = DebuggerX86.ADDRTYPE.PHYSICAL;
+                    ch += ch;
+                }
+                off = addr = 0;
+                sel = null;             // we still have code that relies on this crutch, instead of the type field
+                break;
+            default:
+                if (iColon >= 0) type = DebuggerX86.ADDRTYPE.NONE;
+                ch = '';
+                break;
+            }
+
+            if (ch) {
+                sAddr = sAddr.substr(ch.length);
+                iColon -= ch.length;
+            }
+
+            dbgAddr = this.findSymbolAddr(sAddr);
+            if (dbgAddr) return dbgAddr;
+
+            if (iColon < 0) {
+                if (sel != null) {
+                    off = this.parseExpression(sAddr, fQuiet);
+                    addr = null;
+                } else {
+                    addr = this.parseExpression(sAddr, fQuiet);
+                    if (addr == null) off = null;
+                }
+            }
+            else {
+                sel = this.parseExpression(sAddr.substring(0, iColon), fQuiet);
+                off = this.parseExpression(sAddr.substring(iColon + 1), fQuiet);
+                addr = null;
+            }
+        }
+
+        if (off != null) {
+            dbgAddr = this.newAddr(off, sel, addr, type);
+            if (!fNoChecks && !this.checkLimit(dbgAddr, true)) {
+                this.println("invalid offset: " + this.toHexAddr(dbgAddr));
+                dbgAddr = null;
+            }
+        }
+        return dbgAddr;
+    }
+
+    /**
+     * parseAddrOptions(dbgAddr, sOptions)
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr
+     * @param {string} [sOptions]
+     */
+    parseAddrOptions(dbgAddr, sOptions)
+    {
+        if (sOptions) {
+            var a = sOptions.match(/(['"])(.*?)\1/);
+            if (a) {
+                dbgAddr.aCmds = this.parseCommand(dbgAddr.sCmd = a[2]);
+            }
+        }
+    }
+
+    /**
+     * parseAddrReference(s, sAddr)
+     *
+     * Returns the given string with the given address references replaced with the contents of the address.
+     *
+     * @this {Debugger}
+     * @param {string} s
+     * @param {string} sAddr
+     * @return {string}
+     */
+    parseAddrReference(s, sAddr)
+    {
+        var dbgAddr = this.parseAddr(sAddr);
+        return s.replace('[' + sAddr + ']', dbgAddr? Str.toHex(this.getWord(dbgAddr), dbgAddr.fData32? 8 : 4) : "undefined");
+    }
+
+    /**
+     * incAddr(dbgAddr, inc)
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr
+     * @param {number} [inc] contains value to increment dbgAddr by (default is 1)
+     */
+    incAddr(dbgAddr, inc)
+    {
+        inc = inc || 1;
+        if (dbgAddr.addr != null) {
+            dbgAddr.addr += inc;
+        }
+        if (dbgAddr.sel != null) {
+            dbgAddr.off += inc;
+            if (!this.checkLimit(dbgAddr)) {
+                dbgAddr.off = 0;
+                dbgAddr.addr = null;
+            }
+        }
+    }
+
+    /**
+     * toHexOffset(off, sel, fAddr32)
+     *
+     * @this {DebuggerX86}
+     * @param {number|null|undefined} [off]
+     * @param {number|null|undefined} [sel]
+     * @param {boolean} [fAddr32] is true for 32-bit ADDRESS size
+     * @return {string} the hex representation of off (or sel:off)
+     */
+    toHexOffset(off, sel, fAddr32)
+    {
+        if (sel != null) {
+            return Str.toHex(sel, 4) + ':' + Str.toHex(off, (off & ~0xffff) || fAddr32? 8 : 4);
+        }
+        return Str.toHex(off);
+    }
+
+    /**
+     * toHexAddr(dbgAddr)
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr
+     * @return {string} the hex representation of the address
+     */
+    toHexAddr(dbgAddr)
+    {
+        var ch = this.getAddrPrefix(dbgAddr);
+        /*
+         * TODO: Revisit the decision to check sel == null; I would rather see these decisions based on type.
+         */
+        return (dbgAddr.type >= DebuggerX86.ADDRTYPE.LINEAR || dbgAddr.sel == null)? (ch + Str.toHex(dbgAddr.addr)) : (ch + this.toHexOffset(dbgAddr.off, dbgAddr.sel, dbgAddr.fAddr32));
+    }
+
+    /**
+     * getSZ(dbgAddr, cchMax)
+     *
+     * Gets zero-terminated (aka "ASCIIZ") string from dbgAddr.  It also stops at the first '$', in case this is
+     * a '$'-terminated string -- mainly because I'm lazy and didn't feel like writing a separate get() function.
+     * Yes, a zero-terminated string containing a '$' will be prematurely terminated, and no, I don't care.
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr
+     * @param {number} [cchMax] (default is 256)
+     * @return {string} (and dbgAddr advanced past the terminating zero)
+     */
+    getSZ(dbgAddr, cchMax)
+    {
+        var s = "";
+        cchMax = cchMax || 256;
+        while (s.length < cchMax) {
+            var b = this.getByte(dbgAddr, 1);
+            if (!b || b == 0x24 || b >= 127) break;
+            s += (b >= 32? String.fromCharCode(b) : '.');
+        }
+        return s;
+    }
+
+    /**
+     * dumpBackTrack(asArgs)
+     *
+     * @this {DebuggerX86}
+     * @param {Array.<string>} asArgs
+     */
+    dumpBackTrack(asArgs)
+    {
+        var sInfo = "no information";
+        if (BACKTRACK) {
+            var sAddr = asArgs[0];
+            var dbgAddr = this.parseAddr(sAddr, true, true, true);
+            if (dbgAddr) {
+                var addr = this.getAddr(dbgAddr);
+                if (dbgAddr.type != DebuggerX86.ADDRTYPE.PHYSICAL) {
+                    var pageInfo = this.getPageInfo(addr);
+                    if (pageInfo) {
+                        dbgAddr.addr = pageInfo.addrPhys;
+                        dbgAddr.type = DebuggerX86.ADDRTYPE.PHYSICAL;
+                    }
+                }
+                sInfo = this.toHexAddr(dbgAddr) + ": " + (this.bus.getSymbol(addr, true) || sInfo);
+            } else {
+                var component, componentPrev = null;
+                while (component = this.cmp.getMachineComponent("Disk", componentPrev)) {
+                    var aInfo = component.getSymbolInfo(sAddr);
+                    if (aInfo.length) {
+                        sInfo = "";
+                        for (var i in aInfo) {
+                            var a = aInfo[i];
+                            if (sInfo) sInfo += '\n';
+                            sInfo += a[0] + ": " + a[1] + ' ' + Str.toHex(a[2], 4) + ':' + Str.toHex(a[3], 4) + " len " + Str.toHexWord(a[4]);
+                        }
+                    }
+                    componentPrev = component;
+                }
+            }
+        }
+        return sInfo;
+    }
+
+    /**
+     * dumpBlocks(aBlocks, sAddr, fLinear)
+     *
+     * @this {DebuggerX86}
+     * @param {Array} aBlocks
+     * @param {string} [sAddr] (optional block address)
+     * @param {boolean} [fLinear] (true if linear, physical otherwise)
+     */
+    dumpBlocks(aBlocks, sAddr, fLinear)
+    {
+        var addr = 0, i = 0, n = aBlocks.length;
+
+        if (sAddr) {
+            addr = this.getAddr(this.parseAddr(sAddr));
+            if (addr === X86.ADDR_INVALID) {
+                this.println("invalid address: " + sAddr);
+                return;
+            }
+            i = addr >>> this.cpu.nBlockShift;
+            n = 1;
+        }
+
+        this.println("blockid   " + (fLinear? "linear  " : "physical") + "   blockaddr   used    size    type");
+        this.println("--------  ---------  ----------  ------  ------  ----");
+
+        var typePrev = -1, cPrev = 0;
+        while (n--) {
+            var block = aBlocks[i];
+            /*
+             * We need to replicate a portion of what probeAddr() does, which is to "peek" at the
+             * underlying physical block of any UNPAGED block.  An UNPAGED block doesn't imply
+             * that the page is invalid, but merely that the CPU has not yet been asked to perform
+             * the page directory/page table lookup.
+             *
+             * To do that, we use the same mapPageBlock() interface that the CPU uses, with fSuppress
+             * set, so that it doesn't 1) generate a fault or 2) modify the block.  Blocks should only
+             * "validated" when a CPU operation touches the corresponding page, and they should be only
+             * be "invalidated" when the CPU wants to flush the TLB (ie, whenever CR3 is updated).
+             */
+            if (block && block.type == Memory.TYPE.UNPAGED) {
+                block = this.cpu.mapPageBlock(addr, false, true);
+            }
+            if (block.type == typePrev) {
+                if (!cPrev++) this.println("...");
+            } else {
+                typePrev = block.type;
+                var sType = Memory.TYPE.NAMES[typePrev];
+                if (typePrev == Memory.TYPE.PAGED) {
+                    block = block.blockPhys;
+
+                    sType += " -> " + Memory.TYPE.NAMES[block.type];
+                }
+                if (block) {
+                    this.println(Str.toHex(block.id, 8) + "  %" + Str.toHex(i << this.cpu.nBlockShift, 8) + "  %%" + Str.toHex(block.addr, 8) + "  " + Str.toHexWord(block.used) + "  " + Str.toHexWord(block.size) + "  " + sType);
+                }
+                if (typePrev != Memory.TYPE.NONE && typePrev != Memory.TYPE.UNPAGED) typePrev = -1;
+                cPrev = 0;
+            }
+            addr += this.cpu.nBlockSize;
+            i++;
+        }
+    }
+
+    /**
+     * dumpBus(asArgs)
+     *
+     * Dumps Bus allocations.
+     *
+     * @this {DebuggerX86}
+     * @param {Array.<string>} asArgs (asArgs[0] is an optional block address)
+     */
+    dumpBus(asArgs)
+    {
+        this.dumpBlocks(this.cpu.aBusBlocks, asArgs[0]);
+    }
+
+    /**
+     * dumpDOS(asArgs)
+     *
+     * Dumps DOS MCBs (Memory Control Blocks).
+     *
+     * TODO: Add some code to detect the current version of DOS (if any) and locate the first MCB automatically.
+     *
+     * @this {DebuggerX86}
+     * @param {Array.<string>} asArgs
+     */
+    dumpDOS(asArgs)
+    {
+        var mcb;
+        var sMCB = asArgs[0];
+        if (sMCB) {
+            mcb = this.parseValue(sMCB);
+        }
+        if (mcb === undefined) {
+            this.println("invalid MCB");
+            return;
+        }
+        this.println("dumpMCB(" + Str.toHexWord(mcb) + ')');
+        while (mcb) {
+            var dbgAddr = this.newAddr(0, mcb);
+            var bSig = this.getByte(dbgAddr, 1);
+            var wPID = this.getShort(dbgAddr, 2);
+            var wParas = this.getShort(dbgAddr, 5);
+            if (bSig != 0x4D && bSig != 0x5A) break;
+            this.println(this.toHexOffset(0, mcb) + ": '" + String.fromCharCode(bSig) + "' PID=" + Str.toHexWord(wPID) + " LEN=" + Str.toHexWord(wParas) + ' "' + this.getSZ(dbgAddr, 8) + '"');
+            mcb += 1 + wParas;
+        }
+    }
+
+    /**
+     * dumpIDT(asArgs)
+     *
+     * Dumps an IDT vector entry.
+     *
+     * @this {DebuggerX86}
+     * @param {Array.<string>} asArgs
+     */
+    dumpIDT(asArgs)
+    {
+        var sIDT = asArgs[0];
+
+        if (!sIDT) {
+            this.println("no IDT vector");
+            return;
+        }
+
+        var nIDT = this.parseValue(sIDT);
+        if (nIDT === undefined || nIDT < 0 || nIDT > 255) {
+            this.println("invalid vector: " + sIDT);
+            return;
+        }
+
+        var ch = '&', fProt = this.cpu.getProtMode(), fAddr32 = false;
+        var addrIDT = this.cpu.addrIDT + (nIDT << (fProt? 3 : 2));
+        var off = this.cpu.getShort(addrIDT + X86.DESC.LIMIT.OFFSET);
+        var sel = this.cpu.getShort(addrIDT + X86.DESC.BASE.OFFSET);
+        if (fProt) {
+            ch = '#';
+            var acc = this.cpu.getShort(addrIDT + X86.DESC.ACC.OFFSET);
+            if (acc & X86.DESC.ACC.TYPE.NONSEG_386) {
+                fAddr32 = true;
+                off |= this.cpu.getShort(addrIDT + X86.DESC.EXT.OFFSET) << 16;
+            }
+        }
+
+        this.println("dumpIDT(" + Str.toHexWord(nIDT) + "): " + ch + Str.toHex(sel, 4) + ':' + Str.toHex(off, fAddr32? 8 : 4));
+    }
+
+    /**
+     * dumpMem(asArgs)
+     *
+     * Dumps page allocations.
+     *
+     * @this {DebuggerX86}
+     * @param {Array.<string>} asArgs (asArgs[0] is an optional block address)
+     */
+    dumpMem(asArgs)
+    {
+        this.dumpBlocks(this.cpu.aMemBlocks, asArgs[0], this.cpu.aMemBlocks !== this.cpu.aBusBlocks);
+    }
+
+    /**
+     * getPageEntry(addrPE, lPE, fPTE)
+     *
+     * @this {DebuggerX86}
+     * @param {number} addrPE
+     * @param {number} lPE
+     * @param {boolean} [fPTE] (true if the entry is a PTE, false if it's a PDE)
+     * @return {string}
+     */
+    getPageEntry(addrPE, lPE, fPTE)
+    {
+        var s = Str.toHex(addrPE) + ' ' + Str.toHex(lPE) + ' ';
+        s += (fPTE && (lPE & X86.PTE.DIRTY))? 'D' : '-';
+        s += (lPE & X86.PTE.ACCESSED)? 'A' : '-';
+        s += (lPE & X86.PTE.USER)? 'U' : 'S';
+        s += (lPE & X86.PTE.READWRITE)? 'W' : 'R';
+        s += (lPE & X86.PTE.PRESENT)? 'P' : 'N';
+        return s;
+    }
+
+    /**
+     * getPageInfo(addr)
+     *
+     * @this {DebuggerX86}
+     * @param {number} addr
+     * @return {Object|null}
+     */
+    getPageInfo(addr)
+    {
+        var pageInfo = null;
+        if (I386 && this.cpu.model >= X86.MODEL_80386) {
+            var bus = this.bus;
+            /*
+             * Here begins code remarkably similar to mapPageBlock() (with fSuppress set).
+             */
+            pageInfo = {};
+            pageInfo.offPDE = (addr & X86.LADDR.PDE.MASK) >>> X86.LADDR.PDE.SHIFT;
+            pageInfo.addrPDE = this.cpu.regCR3 + pageInfo.offPDE;
+            pageInfo.blockPDE = bus.aMemBlocks[(pageInfo.addrPDE & bus.nBusMask) >>> bus.nBlockShift];
+            pageInfo.lPDE = pageInfo.blockPDE.readLong(pageInfo.offPDE);
+            pageInfo.offPTE = (addr & X86.LADDR.PTE.MASK) >>> X86.LADDR.PTE.SHIFT;
+            pageInfo.addrPTE = (pageInfo.lPDE & X86.PTE.FRAME) + pageInfo.offPTE;
+            pageInfo.blockPTE = bus.aMemBlocks[(pageInfo.addrPTE & bus.nBusMask) >>> bus.nBlockShift];
+            pageInfo.lPTE = pageInfo.blockPTE.readLong(pageInfo.offPTE);
+            pageInfo.addrPhys = (pageInfo.lPTE & X86.PTE.FRAME) + (addr & X86.LADDR.OFFSET);
+            //var blockPhys = bus.aMemBlocks[(addrPhys & bus.nBusMask) >>> bus.nBlockShift];
+        }
+        return pageInfo;
+    }
+
+    /**
+     * dumpPage(asArgs)
+     *
+     * Dumps page table information about the given linear address.
+     *
+     * @this {DebuggerX86}
+     * @param {Array.<string>} asArgs
+     */
+    dumpPage(asArgs)
+    {
+        var sAddr = asArgs[0];
+        if (!sAddr) {
+            this.println("missing address");
+            return;
+        }
+
+        var addr = this.getAddr(this.parseAddr(sAddr));
+        if (addr === X86.ADDR_INVALID) {
+            this.println("invalid address: " + sAddr);
+            return;
+        }
+
+        var pageInfo = this.getPageInfo(addr);
+        if (!pageInfo) {
+            this.println("unsupported operation");
+            return;
+        }
+
+        this.println("linear     PDE addr   PDE             PTE addr   PTE             physical" );
+        this.println("---------  ---------- --------        ---------- --------        ----------");
+        var s = '%' + Str.toHex(addr);
+        s += "  %%" + this.getPageEntry(pageInfo.addrPDE, pageInfo.lPDE);
+        s += "  %%" + this.getPageEntry(pageInfo.addrPTE, pageInfo.lPTE, true);
+        s += "  %%" + Str.toHex(pageInfo.addrPhys);
+        this.println(s);
+    }
+
+    /**
+     * dumpSel(asArgs)
+     *
+     * Dumps a descriptor for the given selector.
+     *
+     * @this {DebuggerX86}
+     * @param {Array.<string>} asArgs
+     */
+    dumpSel(asArgs)
+    {
+        var sSel = asArgs[0];
+
+        if (!sSel) {
+            this.println("no selector");
+            return;
+        }
+
+        var sel = this.parseValue(sSel);
+        if (sel === undefined) {
+            this.println("invalid selector: " + sSel);
+            return;
+        }
+
+        var seg = this.getSegment(sel, DebuggerX86.ADDRTYPE.PROT);
+        this.println("dumpSel(" + Str.toHexWord(seg? seg.sel : sel) + "): %" + Str.toHex(seg? seg.addrDesc : null, this.cchAddr));
+        if (!seg) return;
+
+        var sType;
+        var fGate = false;
+        if (seg.type & X86.DESC.ACC.TYPE.SEG) {
+            if (seg.type & X86.DESC.ACC.TYPE.CODE) {
+                sType = "code";
+                sType += (seg.type & X86.DESC.ACC.TYPE.READABLE)? ",readable" : ",execonly";
+                if (seg.type & X86.DESC.ACC.TYPE.CONFORMING) sType += ",conforming";
+            }
+            else {
+                sType = "data";
+                sType += (seg.type & X86.DESC.ACC.TYPE.WRITABLE)? ",writable" : ",readonly";
+                if (seg.type & X86.DESC.ACC.TYPE.EXPDOWN) sType += ",expdown";
+            }
+            if (seg.type & X86.DESC.ACC.TYPE.ACCESSED) sType += ",accessed";
+        }
+        else {
+            var sysDesc = DebuggerX86.SYSDESCS[seg.type];
+            if (sysDesc) {
+                sType = sysDesc[0];
+                fGate = sysDesc[1];
+            }
+        }
+
+        if (sType && !(seg.acc & X86.DESC.ACC.PRESENT)) sType += ",not present";
+
+        var sDump;
+        if (fGate) {
+            sDump = "seg=" + Str.toHexWord(seg.base & 0xffff) + " off=" + Str.toHexWord(seg.limit);
+        } else {
+            sDump = "base=" + Str.toHex(seg.base, this.cchAddr) + " limit=" + this.getLimitString(seg.limit);
+        }
+        /*
+         * When we dump the EXT word, we mask off the LIMIT1619 and BASE2431 bits, because those have already
+         * been incorporated into the limit and base properties of the segment register; all we care about here
+         * are whether EXT contains any of the AVAIL (0x10), BIG (0x40) or LIMITPAGES (0x80) bits.
+         */
+        this.println(sDump + " type=" + Str.toHexByte(seg.type >> 8) + " (" + sType + ')' + " ext=" + Str.toHexWord(seg.ext & ~(X86.DESC.EXT.LIMIT1619 | X86.DESC.EXT.BASE2431)) + " dpl=" + Str.toHexByte(seg.dpl));
+    }
+
+    /**
+     * dumpHistory(sPrev, sLines)
+     *
+     * If sLines is not a number, it can be a instruction filter.  However, for the moment, the only
+     * supported filter is "call", which filters the history buffer for all CALL and RET instructions
+     * from the specified previous point forward.
+     *
+     * @this {DebuggerX86}
+     * @param {string} [sPrev] is a (decimal) number of instructions to rewind to (default is 10)
+     * @param {string} [sLines] is a (decimal) number of instructions to print (default is, again, 10)
+     */
+    dumpHistory(sPrev, sLines)
+    {
+        var sMore = "";
+        var cHistory = 0;
+        var iHistory = this.iOpcodeHistory;
+        var aHistory = this.aOpcodeHistory;
+
+        if (aHistory.length) {
+            var nPrev = +sPrev || this.nextHistory;
+            var nLines = +sLines || 10;
+
+            if (isNaN(nPrev)) {
+                nPrev = nLines;
+            } else {
+                sMore = "more ";
+            }
+
+            if (nPrev > aHistory.length) {
+                this.println("note: only " + aHistory.length + " available");
+                nPrev = aHistory.length;
+            }
+
+            iHistory -= nPrev;
+            if (iHistory < 0) {
+                /*
+                 * If the dbgAddr of the last aHistory element contains a valid selector, wrap around.
+                 */
+                if (aHistory[aHistory.length - 1].sel == null) {
+                    nPrev = iHistory + nPrev;
+                    iHistory = 0;
+                } else {
+                    iHistory += aHistory.length;
+                }
+            }
+
+            var aFilters = [];
+            if (sLines == "call") {
+                nLines = 100000;
+                aFilters = ["CALL"];
+            }
+
+            if (sPrev !== undefined) {
+                this.println(nPrev + " instructions earlier:");
+            }
+
+            /*
+             * TODO: The following is necessary to prevent dumpHistory() from causing additional (or worse, recursive)
+             * faults due to segmented addresses that are no longer valid, but the only alternative is to dramatically
+             * increase the amount of memory used to store instruction history (eg, storing copies of all the instruction
+             * bytes alongside the execution addresses).
+             *
+             * For now, we're living dangerously, so that our history dumps actually work.
+             *
+             *      this.nSuppressBreaks++;
+             *
+             * If you re-enable this protection, be sure to re-enable the decrement below, too.
+             */
+            while (nLines > 0 && iHistory != this.iOpcodeHistory) {
+
+                var dbgAddr = aHistory[iHistory++];
+                if (dbgAddr.sel == null) break;
+
+                /*
+                 * We must create a new dbgAddr from the address in aHistory, because dbgAddr was
+                 * a reference, not a copy, and we don't want getInstruction() modifying the original.
+                 */
+                var dbgAddrNew = this.newAddr(dbgAddr.off, dbgAddr.sel, dbgAddr.addr, dbgAddr.type, dbgAddr.fData32, dbgAddr.fAddr32);
+
+                var sComment = "history";
+                var nSequence = nPrev--;
+                if (DEBUG && dbgAddr.cycleCount != null) {
+                    sComment = "cycles";
+                    nSequence = dbgAddr.cycleCount;
+                }
+
+                var sInstruction = this.getInstruction(dbgAddrNew, sComment, nSequence);
+
+                if (!aFilters.length || sInstruction.indexOf(aFilters[0]) >= 0) {
+                    this.println(sInstruction);
+                }
+
+                /*
+                 * If there were OPERAND or ADDRESS overrides on the previous instruction, getInstruction()
+                 * will have automatically disassembled additional bytes, so skip additional history entries.
+                 */
+                if (dbgAddrNew.cOverrides) {
+                    iHistory += dbgAddrNew.cOverrides; nLines -= dbgAddrNew.cOverrides; nPrev -= dbgAddrNew.cOverrides;
+                }
+
+                if (iHistory >= aHistory.length) iHistory = 0;
+                this.nextHistory = nPrev;
+                cHistory++;
+                nLines--;
+            }
+            /*
+             * See comments above.
+             *
+             *      this.nSuppressBreaks--;
+             */
+        }
+
+        if (!cHistory) {
+            this.println("no " + sMore + "history available");
+            this.nextHistory = undefined;
+        }
+    }
+
+    /**
+     * dumpTSS(asArgs)
+     *
+     * This dumps a TSS using the given selector.  If none is specified, the current TR is used.
+     *
+     * @this {DebuggerX86}
+     * @param {Array.<string>} asArgs
+     */
+    dumpTSS(asArgs)
+    {
+        var seg;
+        var sSel = asArgs[0];
+
+        if (!sSel) {
+            seg = this.cpu.segTSS;
+        } else {
+            var sel = this.parseValue(sSel);
+            if (sel === undefined) {
+                this.println("invalid task selector: " + sSel);
+                return;
+            }
+            seg = this.getSegment(sel, DebuggerX86.ADDRTYPE.PROT);
+        }
+
+        this.println("dumpTSS(" + Str.toHexWord(seg? seg.sel : sel) + "): %" + Str.toHex(seg? seg.base : null, this.cchAddr));
+        if (!seg) return;
+
+        var sDump = "";
+        var type = seg.type & ~X86.DESC.ACC.TYPE.TSS_BUSY;
+        var cch = (type == X86.DESC.ACC.TYPE.TSS286? 4 : 8);
+        var aTSSFields = (type == X86.DESC.ACC.TYPE.TSS286? DebuggerX86.TSS286 : DebuggerX86.TSS386);
+        var off, addr, v;
+        for (var sField in aTSSFields) {
+            off = aTSSFields[sField];
+            addr = seg.base + off;
+            v = this.cpu.probeAddr(addr, 2);
+            if (type == X86.DESC.ACC.TYPE.TSS386) {
+                v |= this.cpu.probeAddr(addr + 2, 2) << 16;
+            }
+            if (sDump) sDump += '\n';
+            sDump += Str.toHexWord(off) + ' ' + Str.pad(sField + ':', 11) + Str.toHex(v, cch);
+        }
+        if (type == X86.DESC.ACC.TYPE.TSS386) {
+            var iPort = 0;
+            off = (v >>> 16);
+            /*
+             * We arbitrarily cut the IOPM dump off at port 0x3FF; we're not currently interested in anything above that.
+             */
+            while (off < seg.offMax && iPort < 0x3ff) {
+                addr = seg.base + off;
+                v = this.cpu.probeAddr(addr, 2);
+                sDump += "\n" + Str.toHexWord(off) + " ports " + Str.toHexWord(iPort) + '-' + Str.toHexWord(iPort+15) + ": " + Str.toBinBytes(v, 2);
+                iPort += 16;
+                off += 2;
+            }
+        }
+        this.println(sDump);
+    }
+
+    /**
+     * findModuleInfo(sModule, nSegment)
+     *
+     * Since we're not sure what Disk the module was loaded from, we have to check all of them.
+     *
+     * @this {DebuggerX86}
+     * @param {string} sModule
+     * @param {number} nSegment
+     * @return {Object}
+     */
+    findModuleInfo(sModule, nSegment)
+    {
+        var aSymbols = [];
+        if (SYMBOLS) {
+            var component, componentPrev = null;
+            while (component = this.cmp.getMachineComponent("Disk", componentPrev)) {
+                aSymbols = component.getModuleInfo(sModule, nSegment);
+                if (aSymbols.length) break;
+                componentPrev = component;
+            }
+        }
+        return aSymbols;
+    }
+
+    /**
+     * messageInit(sEnable)
+     *
+     * @this {DebuggerX86}
+     * @param {string|undefined} sEnable contains zero or more message categories to enable, separated by '|'
+     */
+    messageInit(sEnable)
+    {
+        this.dbg = this;
+        this.bitsMessage = this.bitsWarning = Messages.WARN;
+        this.sMessagePrev = null;
+        /*
+         * Internally, we use "key" instead of "keys", since the latter is a method on JavasScript objects,
+         * but externally, we allow the user to specify "keys"; "kbd" is also allowed as shorthand for "keyboard".
+         */
+        var aEnable = this.parseCommand(sEnable.replace("keys","key").replace("kbd","keyboard"), false, '|');
+        if (aEnable.length) {
+            for (var m in Messages.CATEGORIES) {
+                if (Usr.indexOf(aEnable, m) >= 0) {
+                    this.bitsMessage |= Messages.CATEGORIES[m];
+                    this.println(m + " messages enabled");
+                }
+            }
+        }
+        this.historyInit();     // call this just in case Messages.INT was turned on
+    }
+
+    /**
+     * messageDump(bitMessage, fnDumper)
+     *
+     * @this {DebuggerX86}
+     * @param {number} bitMessage is one Messages category flag
+     * @param {function(Array.<string>)} fnDumper is a function the Debugger can use to dump data for that category
+     * @return {boolean} true if successfully registered, false if not
+     */
+    messageDump(bitMessage, fnDumper)
+    {
+        for (var m in Messages.CATEGORIES) {
+            if (bitMessage == Messages.CATEGORIES[m]) {
+                this.afnDumpers[m] = fnDumper;
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * getRegIndex(sReg, off)
+     *
+     * @this {DebuggerX86}
+     * @param {string} sReg
+     * @param {number} [off] optional offset into sReg
+     * @return {number} register index, or -1 if not found
+     */
+    getRegIndex(sReg, off)
+    {
+        var i;
+        sReg = sReg.toUpperCase();
+        if (off == null) {
+            i = Usr.indexOf(DebuggerX86.REGS, sReg);
+        } else {
+            i = Usr.indexOf(DebuggerX86.REGS, sReg.substr(off, 3));
+            if (i < 0) i = Usr.indexOf(DebuggerX86.REGS, sReg.substr(off, 2));
+        }
+        return i;
+    }
+
+    /**
+     * getRegString(iReg)
+     *
+     * @this {DebuggerX86}
+     * @param {number} iReg
+     * @return {string}
+     */
+    getRegString(iReg)
+    {
+        var cch = 0;
+        var n = this.getRegValue(iReg);
+        if (n != null) {
+            switch(iReg) {
+            case DebuggerX86.REG_AL:
+            case DebuggerX86.REG_CL:
+            case DebuggerX86.REG_DL:
+            case DebuggerX86.REG_BL:
+            case DebuggerX86.REG_AH:
+            case DebuggerX86.REG_CH:
+            case DebuggerX86.REG_DH:
+            case DebuggerX86.REG_BH:
+                cch = 2;
+                break;
+            case DebuggerX86.REG_AX:
+            case DebuggerX86.REG_CX:
+            case DebuggerX86.REG_DX:
+            case DebuggerX86.REG_BX:
+            case DebuggerX86.REG_SP:
+            case DebuggerX86.REG_BP:
+            case DebuggerX86.REG_SI:
+            case DebuggerX86.REG_DI:
+            case DebuggerX86.REG_IP:
+            case DebuggerX86.REG_SEG + DebuggerX86.REG_ES:
+            case DebuggerX86.REG_SEG + DebuggerX86.REG_CS:
+            case DebuggerX86.REG_SEG + DebuggerX86.REG_SS:
+            case DebuggerX86.REG_SEG + DebuggerX86.REG_DS:
+            case DebuggerX86.REG_SEG + DebuggerX86.REG_FS:
+            case DebuggerX86.REG_SEG + DebuggerX86.REG_GS:
+                cch = 4;
+                break;
+            case DebuggerX86.REG_EAX:
+            case DebuggerX86.REG_ECX:
+            case DebuggerX86.REG_EDX:
+            case DebuggerX86.REG_EBX:
+            case DebuggerX86.REG_ESP:
+            case DebuggerX86.REG_EBP:
+            case DebuggerX86.REG_ESI:
+            case DebuggerX86.REG_EDI:
+            case DebuggerX86.REG_CR0:
+            case DebuggerX86.REG_CR1:
+            case DebuggerX86.REG_CR2:
+            case DebuggerX86.REG_CR3:
+            case DebuggerX86.REG_EIP:
+                cch = 8;
+                break;
+            case DebuggerX86.REG_PS:
+                cch = this.cchReg;
+                break;
+            }
+        }
+        return cch? Str.toHex(n, cch) : "??";
+    }
+
+    /**
+     * getRegValue(iReg)
+     *
+     * @this {DebuggerX86}
+     * @param {number} iReg
+     * @return {number|undefined}
+     */
+    getRegValue(iReg)
+    {
+        var n;
+        if (iReg >= 0) {
+            var cpu = this.cpu;
+            switch(iReg) {
+            case DebuggerX86.REG_AL:
+                n = cpu.regEAX & 0xff;
+                break;
+            case DebuggerX86.REG_CL:
+                n = cpu.regECX & 0xff;
+                break;
+            case DebuggerX86.REG_DL:
+                n = cpu.regEDX & 0xff;
+                break;
+            case DebuggerX86.REG_BL:
+                n = cpu.regEBX & 0xff;
+                break;
+            case DebuggerX86.REG_AH:
+                n = (cpu.regEAX >> 8) & 0xff;
+                break;
+            case DebuggerX86.REG_CH:
+                n = (cpu.regECX >> 8) & 0xff;
+                break;
+            case DebuggerX86.REG_DH:
+                n = (cpu.regEDX >> 8) & 0xff;
+                break;
+            case DebuggerX86.REG_BH:
+                n = (cpu.regEBX >> 8) & 0xff;
+                break;
+            case DebuggerX86.REG_AX:
+                n = cpu.regEAX & 0xffff;
+                break;
+            case DebuggerX86.REG_CX:
+                n = cpu.regECX & 0xffff;
+                break;
+            case DebuggerX86.REG_DX:
+                n = cpu.regEDX & 0xffff;
+                break;
+            case DebuggerX86.REG_BX:
+                n = cpu.regEBX & 0xffff;
+                break;
+            case DebuggerX86.REG_SP:
+                n = cpu.getSP() & 0xffff;
+                break;
+            case DebuggerX86.REG_BP:
+                n = cpu.regEBP & 0xffff;
+                break;
+            case DebuggerX86.REG_SI:
+                n = cpu.regESI & 0xffff;
+                break;
+            case DebuggerX86.REG_DI:
+                n = cpu.regEDI & 0xffff;
+                break;
+            case DebuggerX86.REG_IP:
+                n = cpu.getIP() & 0xffff;
+                break;
+            case DebuggerX86.REG_PS:
+                n = cpu.getPS();
+                break;
+            case DebuggerX86.REG_SEG + DebuggerX86.REG_ES:
+                n = cpu.getES();
+                break;
+            case DebuggerX86.REG_SEG + DebuggerX86.REG_CS:
+                n = cpu.getCS();
+                break;
+            case DebuggerX86.REG_SEG + DebuggerX86.REG_SS:
+                n = cpu.getSS();
+                break;
+            case DebuggerX86.REG_SEG + DebuggerX86.REG_DS:
+                n = cpu.getDS();
+                break;
+            default:
+                if (this.cpu.model == X86.MODEL_80286) {
+                    if (iReg == DebuggerX86.REG_CR0) {
+                        n = cpu.regCR0;
+                    }
+                }
+                else if (I386 && this.cpu.model >= X86.MODEL_80386) {
+                    switch(iReg) {
+                    case DebuggerX86.REG_EAX:
+                        n = cpu.regEAX;
+                        break;
+                    case DebuggerX86.REG_ECX:
+                        n = cpu.regECX;
+                        break;
+                    case DebuggerX86.REG_EDX:
+                        n = cpu.regEDX;
+                        break;
+                    case DebuggerX86.REG_EBX:
+                        n = cpu.regEBX;
+                        break;
+                    case DebuggerX86.REG_ESP:
+                        n = cpu.getSP();
+                        break;
+                    case DebuggerX86.REG_EBP:
+                        n = cpu.regEBP;
+                        break;
+                    case DebuggerX86.REG_ESI:
+                        n = cpu.regESI;
+                        break;
+                    case DebuggerX86.REG_EDI:
+                        n = cpu.regEDI;
+                        break;
+                    case DebuggerX86.REG_CR0:
+                        n = cpu.regCR0;
+                        break;
+                    case DebuggerX86.REG_CR1:
+                        n = cpu.regCR1;
+                        break;
+                    case DebuggerX86.REG_CR2:
+                        n = cpu.regCR2;
+                        break;
+                    case DebuggerX86.REG_CR3:
+                        n = cpu.regCR3;
+                        break;
+                    case DebuggerX86.REG_SEG + DebuggerX86.REG_FS:
+                        n = cpu.getFS();
+                        break;
+                    case DebuggerX86.REG_SEG + DebuggerX86.REG_GS:
+                        n = cpu.getGS();
+                        break;
+                    case DebuggerX86.REG_EIP:
+                        n = cpu.getIP();
+                        break;
+                    }
+                }
+                break;
+            }
+        }
+        return n;
+    }
+
+    /**
+     * replaceRegs(s)
+     *
+     * @this {DebuggerX86}
+     * @param {string} s
+     * @return {string}
+     */
+    replaceRegs(s)
+    {
+        /*
+         * Replace any references first; this means that register references inside the reference
+         * do NOT need to be prefixed with '@'.
+         */
+        s = this.parseReference(s) || s;
+
+        /*
+         * Replace every @XX (or @XXX), where XX (or XXX) is a register, with the register's value.
+         */
+        var i = 0;
+        var b, sChar, sAddr, dbgAddr, sReplace;
+        while ((i = s.indexOf('@', i)) >= 0) {
+            var iReg = this.getRegIndex(s, i + 1);
+            if (iReg >= 0) {
+                s = s.substr(0, i) + this.getRegString(iReg) + s.substr(i + 1 + DebuggerX86.REGS[iReg].length);
+            }
+            i++;
+        }
+        /*
+         * Replace every #XX, where XX is a hex byte value, with the corresponding ASCII character (if printable).
+         */
+        i = 0;
+        while ((i = s.indexOf('#', i)) >= 0) {
+            sChar = s.substr(i+1, 2);
+            b = Str.parseInt(sChar, 16);
+            if (b != null && b >= 32 && b < 128) {
+                sReplace = sChar + " '" + String.fromCharCode(b) + "'";
+                s = s.replace('#' + sChar, sReplace);
+                i += sReplace.length;
+                continue;
+            }
+            i++;
+        }
+        /*
+         * Replace every $XXXX:XXXX, where XXXX:XXXX is a segmented address, with the zero-terminated string at that address.
+         */
+        i = 0;
+        while ((i = s.indexOf('$', i)) >= 0) {
+            sAddr = s.substr(i+1, 9);
+            dbgAddr = this.parseAddr(sAddr);
+            if (dbgAddr) {
+                sReplace = sAddr + ' "' + this.getSZ(dbgAddr) + '"';
+                s = s.replace('$' + sAddr, sReplace);
+                i += sReplace.length;
+                continue;
+            }
+            i++;
+        }
+        /*
+         * Replace every ^XXXX:XXXX, where XXXX:XXXX is a segmented address, with the FCB filename stored at that address.
+         */
+        i = 0;
+        while ((i = s.indexOf('^', i)) >= 0) {
+            sAddr = s.substr(i+1, 9);
+            dbgAddr = this.parseAddr(sAddr);
+            if (dbgAddr) {
+                this.incAddr(dbgAddr);
+                sReplace = sAddr + ' "' + this.getSZ(dbgAddr, 11) + '"';
+                s = s.replace('^' + sAddr, sReplace);
+                i += sReplace.length;
+                continue;
+            }
+            i++;
+        }
+        return s;
+    }
+
+    /**
+     * message(sMessage, fAddress)
+     *
+     * @this {DebuggerX86}
+     * @param {string} sMessage is any caller-defined message string
+     * @param {boolean} [fAddress] is true to display the current CS:IP
+     */
+    message(sMessage, fAddress)
+    {
+        if (fAddress) {
+            sMessage += " at " + this.toHexAddr(this.newAddr(this.cpu.getIP(), this.cpu.getCS())) + " (%" + Str.toHex(this.cpu.regLIP) + ")";
+        }
+
+        if (this.sMessagePrev && sMessage == this.sMessagePrev) return;
+        this.sMessagePrev = sMessage;
+
+        if (this.bitsMessage & Messages.HALT) {
+            this.stopCPU();
+            sMessage += " (cpu halted)";
+        }
+
+        this.println(sMessage); // + " (" + this.cpu.getCycles() + " cycles)"
+
+        /*
+         * We have no idea what the frequency of println() calls might be; all we know is that they easily
+         * screw up the CPU's careful assumptions about cycles per burst.  So we call yieldCPU() after every
+         * message, to effectively end the current burst and start fresh.
+         *
+         * TODO: See CPU.calcStartTime() for a discussion of why we might want to call yieldCPU() *before*
+         * we display the message.
+         */
+        if (this.cpu) this.cpu.yieldCPU();
+    }
+
+    /**
+     * messageInt(nInt, addr, fForce)
+     *
+     * @this {DebuggerX86}
+     * @param {number} nInt
+     * @param {number} addr (LIP after the "INT n" instruction has been fetched but not dispatched)
+     * @param {boolean} [fForce] (true if the message should be forced)
+     * @return {boolean} true if message generated (which in turn triggers addIntReturn() inside checkIntNotify()), false if not
+     */
+    messageInt(nInt, addr, fForce)
+    {
+        var AH, DL;
+        var fMessage = fForce;
+
+        /*
+         * We currently arrive here only because the CPU has already determined that INT messages are enabled,
+         * or because the ChipSet's RTC interrupt handler has already determined that INT messages are enabled.
+         *
+         * But software interrupts are very common, so we generally require additional categories to be enabled;
+         * unless the caller has set fForce, we check those additional categories now.
+         */
+        if (!fMessage) {
+            /*
+             * Display all software interrupts if CPU messages are enabled (and it's not an "annoying" interrupt);
+             * note that in some cases, even "annoying" interrupts can be turned with an extra message category.
+             */
+            fMessage = this.messageEnabled(Messages.CPU) && DebuggerX86.INT_ANNOYING.indexOf(nInt) < 0;
+            if (!fMessage) {
+                /*
+                 * Alternatively, display this software interrupt if its corresponding message category is enabled.
+                 */
+                var nCategory = DebuggerX86.INT_MESSAGES[nInt];
+                if (nCategory) {
+                    if (this.messageEnabled(nCategory)) {
+                        fMessage = true;
+                    } else {
+                        /*
+                         * Alternatively, display this FDC interrupt if HDC messages are enabled (since they share
+                         * a common software interrupt).  Normally, an HDC BIOS will copy the original DISK (0x13)
+                         * vector to the ALT_DISK (0x40) vector, but it's a nuisance having to check different
+                         * interrupts in different configurations for the same frickin' functionality, so we don't.
+                         */
+                        fMessage = (nCategory == Messages.FDC && this.messageEnabled(nCategory = Messages.HDC));
+                    }
+                }
+            }
+        }
+        if (fMessage) {
+            AH = (this.cpu.regEAX >> 8) & 0xff;
+            DL = this.cpu.regEDX & 0xff;
+            if (nInt == Interrupts.DOS /* 0x21 */ && AH == 0x0b ||
+                nCategory == Messages.FDC && DL >= 0x80 || nCategory == Messages.HDC && DL < 0x80) {
+                fMessage = false;
+            }
+        }
+        if (fMessage) {
+            var aFuncs = Interrupts.FUNCS[nInt];
+            var sFunc = (aFuncs && aFuncs[AH]) || "";
+            if (sFunc) sFunc = ' ' + this.replaceRegs(sFunc);
+            /*
+             * For display purposes only, rewind addr to the address of the responsible "INT n" instruction;
+             * we know it's the two-byte "INT n" instruction because that's the only opcode handler that calls
+             * checkIntNotify() at the moment.
+             */
+            addr -= 2;
+            this.message("INT " + Str.toHexByte(nInt) + ": AH=" + Str.toHexByte(AH) + " at " + this.toHexOffset(addr - this.cpu.segCS.base, this.cpu.getCS()) + sFunc);
+        }
+        return fMessage;
+    }
+
+    /**
+     * messageIntReturn(nInt, nLevel, nCycles)
+     *
+     * @this {DebuggerX86}
+     * @param {number} nInt
+     * @param {number} nLevel
+     * @param {number} nCycles
+     * @param {string} [sResult]
+     */
+    messageIntReturn(nInt, nLevel, nCycles, sResult)
+    {
+        this.message("INT " + Str.toHexByte(nInt) + ": C=" + (this.cpu.getCF()? 1 : 0) + (sResult || "") + " (cycles=" + nCycles + (nLevel? ",level=" + (nLevel+1) : "") + ')');
+    }
+
+    /**
+     * messageIO(component, port, bOut, addrFrom, name, bIn, bitsMessage)
+     *
+     * @this {DebuggerX86}
+     * @param {Component} component
+     * @param {number} port
+     * @param {number|null} bOut if an output operation
+     * @param {number|null} [addrFrom]
+     * @param {string|null} [name] of the port, if any
+     * @param {number|null} [bIn] is the input value, if known, on an input operation
+     * @param {number} [bitsMessage] is one or more Messages category flag(s)
+     */
+    messageIO(component, port, bOut, addrFrom, name, bIn, bitsMessage)
+    {
+        bitsMessage |= Messages.PORT;
+        if (addrFrom == null || (this.bitsMessage & bitsMessage) == bitsMessage) {
+            var selFrom = null;
+            if (addrFrom != null) {
+                selFrom = this.cpu.getCS();
+                addrFrom -= this.cpu.segCS.base;
+            }
+            this.message(component.idComponent + '.' + (bOut != null? "outPort" : "inPort") + '(' + Str.toHexWord(port) + ',' + (name? name : "unknown") + (bOut != null? ',' + Str.toHexByte(bOut) : "") + ')' + (bIn != null? (": " + Str.toHexByte(bIn)) : "") + (addrFrom != null? (" at " + this.toHexOffset(addrFrom, selFrom)) : ""));
+        }
+    }
+
+    /**
+     * init()
+     *
+     * @this {DebuggerX86}
+     */
+    init()
+    {
+        this.println("Type ? for help with PCx86 Debugger commands");
+        this.updateStatus();
+        if (this.sInitCommands) {
+            var sCmds = this.sInitCommands;
+            this.sInitCommands = null;
+            this.doCommands(sCmds);
+        }
+    }
+
+    /**
+     * historyInit(fQuiet)
+     *
+     * This function is intended to be called by the constructor, reset(), addBreakpoint(), findBreakpoint()
+     * and any other function that changes the checksEnabled() criteria used to decide whether checkInstruction()
+     * should be called.
+     *
+     * That is, if the history arrays need to be allocated and haven't already been allocated, then allocate them,
+     * and if the arrays are no longer needed, then deallocate them.
+     *
+     * @this {DebuggerX86}
+     * @param {boolean} [fQuiet]
+     */
+    historyInit(fQuiet)
+    {
+        var i;
+        if (!this.checksEnabled()) {
+            if (this.aOpcodeHistory && this.aOpcodeHistory.length && !fQuiet) {
+                this.println("instruction history buffer freed");
+            }
+            this.iOpcodeHistory = 0;
+            this.aOpcodeHistory = [];
+            this.aaOpcodeCounts = [];
+            return;
+        }
+        if (!this.aOpcodeHistory || !this.aOpcodeHistory.length) {
+            this.aOpcodeHistory = new Array(DebuggerX86.HISTORY_LIMIT);
+            for (i = 0; i < this.aOpcodeHistory.length; i++) {
+                /*
+                 * Preallocate dummy Addr (Array) objects in every history slot, so that
+                 * checkInstruction() doesn't need to call newAddr() on every slot update.
+                 */
+                this.aOpcodeHistory[i] = this.newAddr();
+            }
+            this.iOpcodeHistory = 0;
+            if (!fQuiet) {
+                this.println("instruction history buffer allocated");
+            }
+        }
+        if (!this.aaOpcodeCounts || !this.aaOpcodeCounts.length) {
+            this.aaOpcodeCounts = new Array(256);
+            for (i = 0; i < this.aaOpcodeCounts.length; i++) {
+                this.aaOpcodeCounts[i] = [i, 0];
+            }
+        }
+    }
+
+    /**
+     * runCPU(fUpdateFocus)
+     *
+     * @this {DebuggerX86}
+     * @param {boolean} [fUpdateFocus] is true to update focus
+     * @return {boolean} true if run request successful, false if not
+     */
+    runCPU(fUpdateFocus)
+    {
+        if (!this.isCPUAvail()) return false;
+        this.cpu.runCPU(fUpdateFocus);
+        return true;
+    }
+
+    /**
+     * stepCPU(nCycles, fRegs, fUpdateCPU)
+     *
+     * @this {DebuggerX86}
+     * @param {number} nCycles (0 for one instruction without checking breakpoints)
+     * @param {boolean} [fRegs] is true to display registers after step (default is false)
+     * @param {boolean} [fUpdateCPU] is false to disable calls to updateCPU() (default is true)
+     * @return {boolean}
+     */
+    stepCPU(nCycles, fRegs, fUpdateCPU)
+    {
+        if (!this.isCPUAvail()) return false;
+
+        this.nCycles = 0;
+        do {
+            if (!nCycles) {
+                /*
+                 * When single-stepping, the CPU won't call checkInstruction(), which is good for
+                 * avoiding breakpoints, but bad for instruction data collection if checks are enabled.
+                 * So we call checkInstruction() ourselves.
+                 */
+                if (this.checksEnabled()) this.checkInstruction(this.cpu.regLIP, 0);
+            }
+            try {
+                var nCyclesStep = this.cpu.stepCPU(nCycles);
+                if (nCyclesStep > 0) {
+                    this.nCycles += nCyclesStep;
+                    this.cpu.addCycles(nCyclesStep, true);
+                    this.cpu.updateChecksum(nCyclesStep);
+                    this.cOpcodes++;
+                }
+            }
+            catch(exception) {
+                if (typeof exception != "number") {
+                    var e = exception;
+                    this.nCycles = 0;
+                    this.cpu.setError(e.stack || e.message);
+                }
+            }
+        } while (this.cpu.opFlags & X86.OPFLAG_PREFIXES);
+
+        /*
+         * Because we called cpu.stepCPU() and not cpu.runCPU(), we must nudge the cpu's update code,
+         * and then update our own state.  Normally, the only time fUpdateCPU will be false is when doTrace()
+         * is calling us in a loop, in which case it will perform its own updateCPU() when it's done.
+         */
+        if (fUpdateCPU !== false) this.cpu.updateCPU();
+
+        this.updateStatus(fRegs || false);
+        return (this.nCycles > 0);
+    }
+
+    /**
+     * stopCPU()
+     *
+     * @this {DebuggerX86}
+     * @param {boolean} [fComplete]
+     */
+    stopCPU(fComplete)
+    {
+        if (this.cpu) this.cpu.stopCPU(fComplete);
+    }
+
+    /**
+     * updateStatus(fRegs)
+     *
+     * @this {DebuggerX86}
+     * @param {boolean} [fRegs] (default is true)
+     */
+    updateStatus(fRegs)
+    {
+        if (fRegs === undefined) fRegs = true;
+
+        this.dbgAddrNextCode = this.newAddr(this.cpu.getIP(), this.cpu.getCS());
+        /*
+         * this.nStep used to be a simple boolean, but now it's 0 (or undefined)
+         * if inactive, 1 if stepping over an instruction without a register dump, or 2
+         * if stepping over an instruction with a register dump.
+         */
+        if (!fRegs || this.nStep == 1)
+            this.doUnassemble();
+        else {
+            this.doRegisters();
+        }
+    }
+
+    /**
+     * isCPUAvail()
+     *
+     * Make sure the CPU is ready (finished initializing), not busy (already running), and not in an error state.
+     *
+     * @this {DebuggerX86}
+     * @return {boolean}
+     */
+    isCPUAvail()
+    {
+        if (!this.cpu)
+            return false;
+        if (!this.cpu.isReady())
+            return false;
+        if (!this.cpu.isPowered())
+            return false;
+        if (this.cpu.isBusy())
+            return false;
+        return !this.cpu.isError();
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {DebuggerX86}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            /*
+             * Because Debugger save/restore support is somewhat limited (and didn't always exist),
+             * we deviate from the typical save/restore design pattern: instead of reset OR restore,
+             * we always reset and then perform a (potentially limited) restore.
+             */
+            this.reset(true);
+
+            // this.println(data? "resuming" : "powering up");
+
+            if (data && this.restore) {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {DebuggerX86}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean}
+     */
+    powerDown(fSave, fShutdown)
+    {
+        if (fShutdown) this.println(fSave? "suspending" : "shutting down");
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * reset(fQuiet)
+     *
+     * This is a notification handler, called by the Computer, to inform us of a reset.
+     *
+     * @this {DebuggerX86}
+     * @param {boolean} fQuiet (true only when called from our own powerUp handler)
+     */
+    reset(fQuiet)
+    {
+        this.historyInit();
+        this.cOpcodes = this.cOpcodesStart = 0;
+        this.sMessagePrev = null;
+        this.nCycles = 0;
+        this.dbgAddrNextCode = this.newAddr(this.cpu.getIP(), this.cpu.getCS());
+        /*
+         * fRunning is set by start() and cleared by stop().  In addition, we clear
+         * it here, so that if the CPU is reset while running, we can prevent stop()
+         * from unnecessarily dumping the CPU state.
+         */
+        this.flags.running = false;
+        this.clearTempBreakpoint();
+        if (!fQuiet) this.updateStatus();
+    }
+
+    /**
+     * save()
+     *
+     * This implements (very rudimentary) save support for the Debugger component.
+     *
+     * @this {DebuggerX86}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, this.packAddr(this.dbgAddrNextCode));
+        state.set(1, this.packAddr(this.dbgAddrAssemble));
+        state.set(2, [this.aPrevCmds, this.fAssemble, this.bitsMessage]);
+        state.set(3, this.aSymbolTable);
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements (very rudimentary) restore support for the Debugger component.
+     *
+     * @this {DebuggerX86}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        var i = 0;
+        if (data[2] !== undefined) {
+            this.dbgAddrNextCode = this.unpackAddr(data[i++]);
+            this.dbgAddrAssemble = this.unpackAddr(data[i++]);
+            this.aPrevCmds = data[i][0];
+            if (typeof this.aPrevCmds == "string") this.aPrevCmds = [this.aPrevCmds];
+            this.fAssemble = data[i][1];
+            this.bitsMessage |= data[i][2];     // keep our current message bits set, and simply "add" any extra bits defined by the saved state
+        }
+        if (data[3]) this.aSymbolTable = data[3];
+        return true;
+    }
+
+    /**
+     * start(ms, nCycles)
+     *
+     * This is a notification handler, called by the Computer, to inform us the CPU has started.
+     *
+     * @this {DebuggerX86}
+     * @param {number} ms
+     * @param {number} nCycles
+     */
+    start(ms, nCycles)
+    {
+        if (!this.nStep) this.println("running");
+        this.flags.running = true;
+        this.msStart = ms;
+        this.nCyclesStart = nCycles;
+    }
+
+    /**
+     * stop(ms, nCycles)
+     *
+     * This is a notification handler, called by the Computer, to inform us the CPU has now stopped.
+     *
+     * @this {DebuggerX86}
+     * @param {number} ms
+     * @param {number} nCycles
+     */
+    stop(ms, nCycles)
+    {
+        if (this.flags.running) {
+            this.flags.running = false;
+            this.nCycles = nCycles - this.nCyclesStart;
+            if (!this.nStep) {
+                var sStopped = "stopped";
+                if (this.nCycles) {
+                    var msTotal = ms - this.msStart;
+                    var nCyclesPerSecond = (msTotal > 0? Math.round(this.nCycles * 1000 / msTotal) : 0);
+                    sStopped += " (";
+                    if (this.checksEnabled()) {
+                        sStopped += this.cOpcodes + " opcodes, ";
+                        /*
+                         * $ops displays progress by calculating cOpcodes - cOpcodesStart, so before
+                         * zeroing cOpcodes, we should subtract cOpcodes from cOpcodesStart (since we're
+                         * effectively subtracting cOpcodes from cOpcodes as well).
+                         */
+                        this.cOpcodesStart -= this.cOpcodes;
+                        this.cOpcodes = 0;
+                    }
+                    sStopped += this.nCycles + " cycles, " + msTotal + " ms, " + nCyclesPerSecond + " hz)";
+                    if (MAXDEBUG && this.chipset) {
+                        var i, c, n;
+                        for (i = 0; i < this.chipset.acInterrupts.length; i++) {
+                            c = this.chipset.acInterrupts[i];
+                            if (!c) continue;
+                            n = c / Math.round(msTotal / 1000);
+                            this.println("IRQ" + i + ": " + c + " interrupts (" + n + " per sec)");
+                            this.chipset.acInterrupts[i] = 0;
+                        }
+                        for (i = 0; i < this.chipset.acTimersFired.length; i++) {
+                            c = this.chipset.acTimersFired[i];
+                            if (!c) continue;
+                            n = c / Math.round(msTotal / 1000);
+                            this.println("TIMER" + i + ": " + c + " fires (" + n + " per sec)");
+                            this.chipset.acTimersFired[i] = 0;
+                        }
+                        n = 0;
+                        for (i = 0; i < this.chipset.acTimer0Counts.length; i++) {
+                            var a = this.chipset.acTimer0Counts[i];
+                            n += a[0];
+                            this.println("TIMER0 update #" + i + ": [" + a[0] + ',' + a[1] + ',' + a[2] + ']');
+                        }
+                        this.chipset.acTimer0Counts = [];
+                    }
+                } else {
+                    if (this.messageEnabled(Messages.HALT)) {
+                        /*
+                         * It's possible the user is trying to 'g' past a fault that was blocked by helpCheckFault()
+                         * for the Debugger's benefit; if so, it will continue to be blocked, so try displaying a helpful
+                         * message (another helpful tip would be to simply turn off the "halt" message category).
+                         */
+                        sStopped += " (use the 't' command to execute blocked faults)";
+                    }
+                }
+                this.println(sStopped);
+            }
+            this.updateStatus(true);
+            this.updateFocus();
+            this.clearTempBreakpoint(this.cpu.regLIP);
+        }
+    }
+
+    /**
+     * checksEnabled(fRelease)
+     *
+     * This "check" function is called by the CPU; we indicate whether or not every instruction needs to be checked.
+     *
+     * Originally, this returned true even when there were only read and/or write breakpoints, but those breakpoints
+     * no longer require the intervention of checkInstruction(); the Bus component automatically swaps in/out appropriate
+     * "checked" Memory access functions to deal with those breakpoints in the corresponding Memory blocks.  So I've
+     * simplified the test below.
+     *
+     * @this {DebuggerX86}
+     * @param {boolean} [fRelease] is true for release criteria only; default is false (any criteria)
+     * @return {boolean} true if every instruction needs to pass through checkInstruction(), false if not
+     */
+    checksEnabled(fRelease)
+    {
+        return ((DEBUG && !fRelease)? true : (this.aBreakExec.length > 1 || !!this.nBreakIns || this.messageEnabled(Messages.INT) /* || this.aBreakRead.length > 1 || this.aBreakWrite.length > 1 */));
+    }
+
+    /**
+     * checkInstruction(addr, nState)
+     *
+     * This "check" function is called by the CPU to inform us about the next instruction to be executed,
+     * giving us an opportunity to look for "exec" breakpoints and update opcode frequencies and instruction history.
+     *
+     * @this {DebuggerX86}
+     * @param {number} addr
+     * @param {number} nState is < 0 if stepping, 0 if starting, or > 0 if running
+     * @return {boolean} true if breakpoint hit, false if not
+     */
+    checkInstruction(addr, nState)
+    {
+        var cpu = this.cpu;
+
+        if (nState > 0) {
+            if (this.nBreakIns && !--this.nBreakIns) {
+                return true;
+            }
+            if (this.checkBreakpoint(addr, 1, this.aBreakExec)) {
+                return true;
+            }
+            /*
+             * Halt if running with interrupts disabled and IOPL < CPL, because that's likely an error
+             */
+            if (MAXDEBUG && !(cpu.regPS & X86.PS.IF) && cpu.nIOPL < cpu.nCPL) {
+                this.printMessage("interrupts disabled at IOPL " + cpu.nIOPL + " and CPL " + cpu.nCPL, true);
+                return true;
+            }
+        }
+
+        /*
+         * The rest of the instruction tracking logic can only be performed if historyInit() has allocated the
+         * necessary data structures.  Note that there is no explicit UI for enabling/disabling history, other than
+         * adding/removing breakpoints, simply because it's breakpoints that trigger the call to checkInstruction();
+         * well, OK, and a few other things now, like enabling Messages.INT messages.
+         */
+        if (nState >= 0 && this.aaOpcodeCounts.length) {
+            this.cOpcodes++;
+            var bOpcode = cpu.probeAddr(addr);
+            if (bOpcode != null) {
+                this.aaOpcodeCounts[bOpcode][1]++;
+                var dbgAddr = this.aOpcodeHistory[this.iOpcodeHistory];
+                this.setAddr(dbgAddr, cpu.getIP(), cpu.getCS());
+                if (DEBUG) dbgAddr.cycleCount = cpu.getCycles();
+                if (++this.iOpcodeHistory == this.aOpcodeHistory.length) this.iOpcodeHistory = 0;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * checkMemoryRead(addr, nb)
+     *
+     * This "check" function is called by a Memory block to inform us that a memory read occurred, giving us an
+     * opportunity to track the read if we want, and look for a matching "read" breakpoint, if any.
+     *
+     * In the "old days", it would be an error for this call to fail to find a matching Debugger breakpoint, but now
+     * Memory blocks have no idea whether the Debugger or the machine's Debug register(s) triggered this "checked" read.
+     *
+     * If we return true, we "trump" the machine's Debug register(s); false allows normal Debug register processing.
+     *
+     * @this {DebuggerX86}
+     * @param {number} addr
+     * @param {number} [nb] (# of bytes; default is 1)
+     * @return {boolean} true if breakpoint hit, false if not
+     */
+    checkMemoryRead(addr, nb)
+    {
+        if (this.checkBreakpoint(addr, nb || 1, this.aBreakRead)) {
+            this.stopCPU(true);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * checkMemoryWrite(addr, nb)
+     *
+     * This "check" function is called by a Memory block to inform us that a memory write occurred, giving us an
+     * opportunity to track the write if we want, and look for a matching "write" breakpoint, if any.
+     *
+     * In the "old days", it would be an error for this call to fail to find a matching Debugger breakpoint, but now
+     * Memory blocks have no idea whether the Debugger or the machine's Debug register(s) triggered this "checked" write.
+     *
+     * If we return true, we "trump" the machine's Debug register(s); false allows normal Debug register processing.
+     *
+     * @this {DebuggerX86}
+     * @param {number} addr
+     * @param {number} [nb] (# of bytes; default is 1)
+     * @return {boolean} true if breakpoint hit, false if not
+     */
+    checkMemoryWrite(addr, nb)
+    {
+        if (this.checkBreakpoint(addr, nb || 1, this.aBreakWrite)) {
+            this.stopCPU(true);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * checkPortInput(port, size, data)
+     *
+     * This "check" function is called by the Bus component to inform us that port input occurred.
+     *
+     * @this {DebuggerX86}
+     * @param {number} port
+     * @param {number} size
+     * @param {number} data
+     * @return {boolean} true if breakpoint hit, false if not
+     */
+    checkPortInput(port, size, data)
+    {
+        /*
+         * We trust that the Bus component won't call us unless we told it to, so we halt unconditionally
+         */
+        this.println("break on input from port " + Str.toHexWord(port) + ": " + Str.toHex(data));
+        this.stopCPU(true);
+        return true;
+    }
+
+    /**
+     * checkPortOutput(port, size, data)
+     *
+     * This "check" function is called by the Bus component to inform us that port output occurred.
+     *
+     * @this {DebuggerX86}
+     * @param {number} port
+     * @param {number} size
+     * @param {number} data
+     * @return {boolean} true if breakpoint hit, false if not
+     */
+    checkPortOutput(port, size, data)
+    {
+        /*
+         * We trust that the Bus component won't call us unless we told it to, so we halt unconditionally
+         */
+        this.println("break on output to port " + Str.toHexWord(port) + ": " + Str.toHex(data));
+        this.stopCPU(true);
+        return true;
+    }
+
+    /**
+     * clearBreakpoints()
+     *
+     * @this {DebuggerX86}
+     */
+    clearBreakpoints()
+    {
+        var i, dbgAddr;
+        this.aBreakExec = ["bp"];
+        if (this.aBreakRead !== undefined) {
+            for (i = 1; i < this.aBreakRead.length; i++) {
+                dbgAddr = this.aBreakRead[i];
+                this.cpu.removeMemBreak(this.getAddr(dbgAddr), false, dbgAddr.type == DebuggerX86.ADDRTYPE.PHYSICAL);
+            }
+        }
+        this.aBreakRead = ["br"];
+        if (this.aBreakWrite !== undefined) {
+            for (i = 1; i < this.aBreakWrite.length; i++) {
+                dbgAddr = this.aBreakWrite[i];
+                this.cpu.removeMemBreak(this.getAddr(dbgAddr), true, dbgAddr.type == DebuggerX86.ADDRTYPE.PHYSICAL);
+            }
+        }
+        this.aBreakWrite = ["bw"];
+        /*
+         * nSuppressBreaks ensures we can't get into an infinite loop where a breakpoint lookup requires
+         * reading a segment descriptor via getSegment(), and that triggers more memory reads, which triggers
+         * more breakpoint checks.
+         */
+        this.nSuppressBreaks = 0;
+    }
+
+    /**
+     * addBreakpoint(aBreak, dbgAddr, fTempBreak)
+     *
+     * In case you haven't already figured this out, all our breakpoint commands use the address
+     * to identify a breakpoint, not an incrementally assigned breakpoint index like other debuggers;
+     * see doBreak() for details.
+     *
+     * This has a few implications, one being that you CANNOT set more than one kind of breakpoint
+     * on a single address.  In practice, that's rarely a problem, because you can almost always set
+     * a different breakpoint on a neighboring address.
+     *
+     * Also, there is one exception to the "one address, one breakpoint" rule, and that involves
+     * temporary breakpoints (ie, one-time execution breakpoints that either a "p" or "g" command
+     * may create to step over a chunk of code).  Those breakpoints automatically clear themselves,
+     * so there usually isn't any need to refer to them using breakpoint commands.
+     *
+     * TODO: Consider supporting the more "traditional" breakpoint index syntax; the current
+     * address-based syntax was implemented solely for expediency and consistency.  At the same time,
+     * also consider a more WDEB386-like syntax, where "br" is used to set a variety of access-specific
+     * breakpoints, using modifiers like "r1", "r2", "w1", "w2, etc.
+     *
+     * @this {DebuggerX86}
+     * @param {Array} aBreak
+     * @param {DbgAddrX86} dbgAddr
+     * @param {boolean} [fTempBreak]
+     * @return {boolean} true if breakpoint added, false if already exists
+     */
+    addBreakpoint(aBreak, dbgAddr, fTempBreak)
+    {
+        var fSuccess = true;
+
+        // this.nSuppressBreaks++;
+
+        /*
+         * Instead of complaining that a breakpoint already exists (as we used to do), we now
+         * allow breakpoints to be re-set; this makes it easier to update any commands that may
+         * be associated with the breakpoint.
+         *
+         * The only exception: we DO allow a temporary breakpoint at an address where there may
+         * already be a breakpoint, so that you can easily step ("p" or "g") over such addresses.
+         */
+        if (!fTempBreak) {
+            this.findBreakpoint(aBreak, dbgAddr, true, false, true);
+        }
+
+        if (aBreak != this.aBreakExec) {
+            var addr = this.getAddr(dbgAddr);
+            if (addr === X86.ADDR_INVALID) {
+                this.println("invalid address: " + this.toHexAddr(dbgAddr));
+                fSuccess = false;
+            } else {
+                this.cpu.addMemBreak(addr, aBreak == this.aBreakWrite, dbgAddr.type == DebuggerX86.ADDRTYPE.PHYSICAL);
+            }
+        }
+
+        if (fSuccess) {
+            aBreak.push(dbgAddr);
+            if (fTempBreak) {
+                /*
+                 * Force temporary breakpoints to use their linear address, if one is available, by zapping
+                 * the selector; this allows us to step over calls or interrupts that change the processor mode.
+                 *
+                 * TODO: Unfortunately, this will fail to "step" over a call in segment that moves during the call;
+                 * consider alternatives.
+                 */
+                if (dbgAddr.addr != null) dbgAddr.sel = null;
+                dbgAddr.fTempBreak = true;
+            }
+            else {
+                this.printBreakpoint(aBreak, aBreak.length-1, "set");
+                this.historyInit();
+            }
+        }
+
+        // this.nSuppressBreaks--;
+
+        return fSuccess;
+    }
+
+    /**
+     * findBreakpoint(aBreak, dbgAddr, fRemove, fTempBreak, fQuiet)
+     *
+     * @this {DebuggerX86}
+     * @param {Array} aBreak
+     * @param {DbgAddrX86} dbgAddr
+     * @param {boolean} [fRemove]
+     * @param {boolean} [fTempBreak]
+     * @param {boolean} [fQuiet]
+     * @return {boolean} true if found, false if not
+     */
+    findBreakpoint(aBreak, dbgAddr, fRemove, fTempBreak, fQuiet)
+    {
+        var fFound = false;
+        var addr = this.mapBreakpoint(this.getAddr(dbgAddr));
+        for (var i = 1; i < aBreak.length; i++) {
+            var dbgAddrBreak = aBreak[i];
+            if (addr !== X86.ADDR_INVALID && addr == this.mapBreakpoint(this.getAddr(dbgAddrBreak)) ||
+                addr === X86.ADDR_INVALID && dbgAddr.sel == dbgAddrBreak.sel && dbgAddr.off == dbgAddrBreak.off) {
+                if (!fTempBreak || dbgAddrBreak.fTempBreak) {
+                    fFound = true;
+                    if (fRemove) {
+                        if (!dbgAddrBreak.fTempBreak && !fQuiet) {
+                            this.printBreakpoint(aBreak, i, "cleared");
+                        }
+                        aBreak.splice(i, 1);
+                        if (aBreak != this.aBreakExec) {
+                            this.cpu.removeMemBreak(addr, aBreak == this.aBreakWrite, dbgAddrBreak.type == DebuggerX86.ADDRTYPE.PHYSICAL);
+                        }
+                        /*
+                         * We'll mirror the logic in addBreakpoint() and leave the history buffer alone if this
+                         * was a temporary breakpoint.
+                         */
+                        if (!dbgAddrBreak.fTempBreak) {
+                            this.historyInit();
+                        }
+                        break;
+                    }
+                    if (!fQuiet) this.printBreakpoint(aBreak, i, "exists");
+                    break;
+                }
+            }
+        }
+        return fFound;
+    }
+
+    /**
+     * listBreakpoints(aBreak)
+     *
+     * @this {DebuggerX86}
+     * @param {Array} aBreak
+     * @return {number} of breakpoints listed, 0 if none
+     */
+    listBreakpoints(aBreak)
+    {
+        for (var i = 1; i < aBreak.length; i++) {
+            this.printBreakpoint(aBreak, i);
+        }
+        return aBreak.length - 1;
+    }
+
+    /**
+     * printBreakpoint(aBreak, i, sAction)
+     *
+     * TODO: We may need to start printing linear addresses also (if any), because segmented address can be ambiguous.
+     *
+     * @this {DebuggerX86}
+     * @param {Array} aBreak
+     * @param {number} i
+     * @param {string} [sAction]
+     */
+    printBreakpoint(aBreak, i, sAction)
+    {
+        var dbgAddr = aBreak[i];
+        this.println(aBreak[0] + ' ' + this.toHexAddr(dbgAddr) + (sAction? (' ' + sAction) : (dbgAddr.sCmd? (' "' + dbgAddr.sCmd + '"') : '')));
+    }
+
+    /**
+     * setTempBreakpoint(dbgAddr)
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr of new temp breakpoint
+     */
+    setTempBreakpoint(dbgAddr)
+    {
+        this.addBreakpoint(this.aBreakExec, dbgAddr, true);
+    }
+
+    /**
+     * clearTempBreakpoint(addr)
+     *
+     * @this {DebuggerX86}
+     * @param {number|undefined} [addr] clear all temp breakpoints if no address specified
+     */
+    clearTempBreakpoint(addr)
+    {
+        if (addr !== undefined) {
+            this.checkBreakpoint(addr, 1, this.aBreakExec, true);
+            this.nStep = 0;
+        } else {
+            for (var i = 1; i < this.aBreakExec.length; i++) {
+                var dbgAddrBreak = this.aBreakExec[i];
+                if (dbgAddrBreak.fTempBreak) {
+                    if (!this.findBreakpoint(this.aBreakExec, dbgAddrBreak, true, true)) break;
+                    i = 0;
+                }
+            }
+        }
+    }
+
+    /**
+     * mapBreakpoint(addr)
+     *
+     * @this {DebuggerX86}
+     * @param {number} addr
+     * @return {number}
+     */
+    mapBreakpoint(addr)
+    {
+        /*
+         * Map addresses in the top 64Kb at the top of the address space (assuming either a 16Mb or 4Gb
+         * address space) to the top of the 1Mb range.
+         *
+         * The fact that those two 64Kb regions are aliases of each other on an 80286 is a pain in the BUTT,
+         * because any CS-based breakpoint you set immediately after a CPU reset will have a physical address
+         * in the top 16Mb, yet after the first inter-segment JMP, you will be running in the first 1Mb.
+         */
+        if (addr !== X86.ADDR_INVALID) {
+            var mask = (this.maskAddr & ~0xffff);
+            if ((addr & mask) == mask) addr &= 0x000fffff;
+        }
+        return addr;
+    }
+
+    /**
+     * checkBreakpoint(addr, nb, aBreak, fTempBreak)
+     *
+     * @this {DebuggerX86}
+     * @param {number} addr
+     * @param {number} nb (# of bytes)
+     * @param {Array} aBreak
+     * @param {boolean} [fTempBreak]
+     * @return {boolean} true if breakpoint has been hit, false if not
+     */
+    checkBreakpoint(addr, nb, aBreak, fTempBreak)
+    {
+        /*
+         * Time to check for execution breakpoints; note that this should be done BEFORE updating frequency
+         * or history data (see checkInstruction), since we might not actually execute the current instruction.
+         */
+        var fBreak = false;
+
+        if (!this.nSuppressBreaks++) {
+
+            addr = this.mapBreakpoint(addr);
+
+            /*
+             * As discussed in opINT3(), I decided to check for INT3 instructions here: we'll tell the CPU to
+             * stop on INT3 whenever both the INT and HALT message bits are set; a simple "g" command allows you
+             * to continue.
+             */
+            if (this.messageEnabled(Messages.INT | Messages.HALT)) {
+                if (this.cpu.probeAddr(addr) == X86.OPCODE.INT3) {
+                    fBreak = true;
+                }
+            }
+
+            for (var i = 1; !fBreak && i < aBreak.length; i++) {
+
+                var dbgAddrBreak = aBreak[i];
+
+                if (fTempBreak && !dbgAddrBreak.fTempBreak) continue;
+
+                /*
+                 * We need to zap the linear address field of the breakpoint address before
+                 * calling getAddr(), to force it to recalculate the linear address every time,
+                 * unless this is a breakpoint on a linear address (as indicated by a null sel).
+                 */
+                if (dbgAddrBreak.sel != null) dbgAddrBreak.addr = null;
+
+                /*
+                 * We used to calculate the linear address of the breakpoint at the time the
+                 * breakpoint was added, so that a breakpoint set in one mode (eg, in real-mode)
+                 * would still work as intended if the mode changed later (eg, to protected-mode).
+                 *
+                 * However, that created difficulties setting protected-mode breakpoints in segments
+                 * that might not be defined yet, or that could move in physical memory.
+                 *
+                 * If you want to create a real-mode breakpoint that will break regardless of mode,
+                 * use the physical address of the real-mode memory location instead.
+                 */
+                var addrBreak = this.mapBreakpoint(this.getAddr(dbgAddrBreak));
+                for (var n = 0; n < nb; n++) {
+                    if (addr + n == addrBreak) {
+                        var a;
+                        fBreak = true;
+                        if (dbgAddrBreak.fTempBreak) {
+                            this.findBreakpoint(aBreak, dbgAddrBreak, true, true);
+                            fTempBreak = true;
+                        }
+                        if (a = dbgAddrBreak.aCmds) {
+                            /*
+                             * When one or more commands are attached to a breakpoint, we don't halt by default.
+                             * Instead, we set fBreak to true only if, at the completion of all the commands, the
+                             * CPU is halted; in other words, you should include "h" as one of the breakpoint commands
+                             * if you want the breakpoint to stop execution.
+                             *
+                             * Another useful command is "if", which will return false if the expression is false,
+                             * at which point we'll jump ahead to the next "else" command, and if there isn't an "else",
+                             * we abort.
+                             */
+                            fBreak = false;
+                            for (var j = 0; j < a.length; j++) {
+                                if (!this.doCommand(a[j], true)) {
+                                    if (a[j].indexOf("if")) {
+                                        fBreak = true;          // the failed command wasn't "if", so abort
+                                        break;
+                                    }
+                                    var k = j + 1;
+                                    for (; k < a.length; k++) {
+                                        if (!a[k].indexOf("else")) break;
+                                        j++;
+                                    }
+                                    if (k == a.length) {        // couldn't find an "else" after the "if", so abort
+                                        fBreak = true;
+                                        break;
+                                    }
+                                    /*
+                                     * If we're still here, we'll execute the "else" command (which is just a no-op),
+                                     * followed by any remaining commands.
+                                     */
+                                }
+                            }
+                            if (!this.cpu.isRunning()) fBreak = true;
+                        }
+                        if (fBreak) {
+                            if (!fTempBreak) this.printBreakpoint(aBreak, i, "hit");
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+
+        this.nSuppressBreaks--;
+
+        return fBreak;
+    }
+
+    /**
+     * getInstruction(dbgAddr, sComment, nSequence)
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr
+     * @param {string} [sComment] is an associated comment
+     * @param {number|null} [nSequence] is an associated sequence number, null or undefined if none
+     * @return {string} (and dbgAddr is updated to the next instruction)
+     */
+    getInstruction(dbgAddr, sComment, nSequence)
+    {
+        var dbgAddrIns = this.newAddr(dbgAddr.off, dbgAddr.sel, dbgAddr.addr, dbgAddr.type);
+
+        var bOpcode = this.getByte(dbgAddr, 1);
+
+        /*
+         * Incorporate OPERAND and ADDRESS size prefixes into the current instruction.
+         *
+         * And the verdict is in: redundant OPERAND and ADDRESS prefixes must be ignored;
+         * see opOS() and opAS() for details.  We limit the amount of redundancy to something
+         * reasonable (ie, 4).
+         */
+        var cMaxOverrides = 4, cOverrides = 0;
+        var fDataPrefix = false, fAddrPrefix = false;
+
+        while ((bOpcode == X86.OPCODE.OS || bOpcode == X86.OPCODE.AS) && cMaxOverrides--) {
+            if (bOpcode == X86.OPCODE.OS) {
+                if (!fDataPrefix) {
+                    dbgAddr.fData32 = !dbgAddr.fData32;
+                    fDataPrefix = true;
+                }
+                cOverrides++;
+            } else {
+                if (!fAddrPrefix) {
+                    dbgAddr.fAddr32 = !dbgAddr.fAddr32;
+                    fAddrPrefix = true;
+                }
+                cOverrides++;
+            }
+            bOpcode = this.getByte(dbgAddr, 1);
+        }
+
+        var bModRM = -1;
+        var asOpcodes = DebuggerX86.INS_NAMES;
+        var aOpDesc = this.aaOpDescs[bOpcode];
+        var iIns = aOpDesc[0];
+
+        if (iIns == DebuggerX86.INS.OP0F) {
+            var b = this.getByte(dbgAddr, 1);
+            aOpDesc = DebuggerX86.aaOp0FDescs[b] || DebuggerX86.aOpDescUndefined;
+            bOpcode |= (b << 8);
+            iIns = aOpDesc[0];
+        }
+
+        if (iIns == DebuggerX86.INS.ESC) {
+            bModRM = this.getByte(dbgAddr, 1);
+            var aOpFPUDesc = this.getFPUInstruction(bOpcode, bModRM);
+            if (aOpFPUDesc) {
+                asOpcodes = DebuggerX86.FINS_NAMES;
+                aOpDesc = aOpFPUDesc;
+                iIns = aOpDesc[0];
+            }
+        }
+
+        if (iIns >= asOpcodes.length) {
+            bModRM = this.getByte(dbgAddr, 1);
+            aOpDesc = DebuggerX86.aaGrpDescs[iIns - asOpcodes.length][(bModRM >> 3) & 0x7];
+            iIns = aOpDesc[0];
+        }
+
+        var sOpcode = asOpcodes[iIns];
+        var cOperands = aOpDesc.length - 1;
+        var sOperands = "";
+
+        if (dbgAddr.fData32) {
+            if (iIns == DebuggerX86.INS.CBW) {
+                sOpcode = "CWDE";           // sign-extend AX into EAX, instead of AL into AX
+            }
+            else if (iIns == DebuggerX86.INS.CWD) {
+                sOpcode = "CDQ";            // sign-extend EAX into EDX:EAX, instead of AX into DX:AX
+            }
+            else if (iIns >= DebuggerX86.INS.POPA && iIns <= DebuggerX86.INS.PUSHA) {
+                sOpcode += 'D';             // transform POPA/POPF/PUSHF/PUSHA to POPAD/POPFD/PUSHFD/PUSHAD as appropriate
+            }
+        }
+        if (this.isStringIns(bOpcode)) {
+            cOperands = 0;              // suppress operands for string instructions, and add 'D' suffix as appropriate
+            if (dbgAddr.fData32 && sOpcode.slice(-1) == 'W') sOpcode = sOpcode.slice(0, -1) + 'D';
+        }
+
+        var typeCPU = -1;
+        var fComplete = true;
+
+        for (var iOperand = 1; iOperand <= cOperands; iOperand++) {
+
+            var disp, off, cch;
+            var sOperand = "";
+            var type = aOpDesc[iOperand];
+            if (type === undefined) continue;
+
+            if (typeCPU < 0) typeCPU = type >> DebuggerX86.TYPE_CPU_SHIFT;
+
+            if (iIns == DebuggerX86.INS.LOADALL) {
+                if (typeCPU == DebuggerX86.CPU_80286) {
+                    sOperands = "[%800]";
+                } else if (typeCPU == DebuggerX86.CPU_80386) {
+                    sOperands = "ES:[" + (dbgAddr.fAddr32? 'E':'') + "DI]";
+                }
+            }
+
+            var typeSize = type & DebuggerX86.TYPE_SIZE;
+            if (typeSize == DebuggerX86.TYPE_NONE) {
+                continue;
+            }
+            if (typeSize == DebuggerX86.TYPE_PREFIX) {
+                fComplete = false;
+                continue;
+            }
+            var typeMode = type & DebuggerX86.TYPE_MODE;
+            if (typeMode >= DebuggerX86.TYPE_MODRM) {
+                if (bModRM < 0) {
+                    bModRM = this.getByte(dbgAddr, 1);
+                }
+                if (typeMode < DebuggerX86.TYPE_MODREG) {
+                    /*
+                     * This test also encompasses TYPE_MODMEM, which is basically the inverse of the case
+                     * below (ie, only Mod values *other* than 11 are allowed); however, I believe that in
+                     * some cases that's merely a convention, and that if you try to execute an instruction
+                     * like "LEA AX,BX", it will actually do something (on some if not all processors), so
+                     * there's probably some diagnostic value in allowing those cases to be disassembled.
+                     */
+                    sOperand = this.getModRMOperand(sOpcode, bModRM, type, cOperands, dbgAddr);
+                }
+                else if (typeMode == DebuggerX86.TYPE_MODREG) {
+                    /*
+                     * TYPE_MODREG instructions assume that Mod is 11 (only certain early 80486 steppings
+                     * actually *required* that Mod contain 11) and always treat RM as a register (which we
+                     * could also simulate by setting Mod to 11 and letting getModRMOperand() do its thing).
+                     */
+                    sOperand = this.getRegOperand(bModRM & 0x7, type, dbgAddr);
+                }
+                else {
+                    /*
+                     * All remaining cases are register-based (eg, TYPE_REG); getRegOperand() will figure out which.
+                     */
+                    sOperand = this.getRegOperand((bModRM >> 3) & 0x7, type, dbgAddr);
+                }
+            }
+            else if (typeMode == DebuggerX86.TYPE_ONE) {
+                sOperand = '1';
+            }
+            else if (typeMode == DebuggerX86.TYPE_IMM) {
+                sOperand = this.getImmOperand(type, dbgAddr);
+            }
+            else if (typeMode == DebuggerX86.TYPE_IMMOFF) {
+                if (!dbgAddr.fAddr32) {
+                    cch = 4;
+                    off = this.getShort(dbgAddr, 2);
+                } else {
+                    cch = 8;
+                    off = this.getLong(dbgAddr, 4);
+                }
+                sOperand = '[' + Str.toHex(off, cch) + ']';
+            }
+            else if (typeMode == DebuggerX86.TYPE_IMMREL) {
+                if (typeSize == DebuggerX86.TYPE_BYTE) {
+                    disp = ((this.getByte(dbgAddr, 1) << 24) >> 24);
+                }
+                else {
+                    disp = this.getWord(dbgAddr, true);
+                }
+                off = (dbgAddr.off + disp) & (dbgAddr.fData32? -1 : 0xffff);
+                sOperand = Str.toHex(off, dbgAddr.fData32? 8: 4);
+                var aSymbol = this.findSymbol(this.newAddr(off, dbgAddr.sel));
+                if (aSymbol[0]) sOperand += " (" + aSymbol[0] + ")";
+            }
+            else if (typeMode == DebuggerX86.TYPE_IMPREG) {
+                if (typeSize == DebuggerX86.TYPE_ST) {
+                    sOperand = "ST";
+                } else if (typeSize == DebuggerX86.TYPE_STREG) {
+                    sOperand = "ST(" + (bModRM & 0x7) + ")";
+                } else {
+                    sOperand = this.getRegOperand((type & DebuggerX86.TYPE_IREG) >> 8, type, dbgAddr);
+                }
+            }
+            else if (typeMode == DebuggerX86.TYPE_IMPSEG) {
+                sOperand = this.getRegOperand((type & DebuggerX86.TYPE_IREG) >> 8, DebuggerX86.TYPE_SEGREG, dbgAddr);
+            }
+            else if (typeMode == DebuggerX86.TYPE_DSSI) {
+                sOperand = "DS:[SI]";
+            }
+            else if (typeMode == DebuggerX86.TYPE_ESDI) {
+                sOperand = "ES:[DI]";
+            }
+            if (!sOperand || !sOperand.length) {
+                sOperands = "INVALID";
+                break;
+            }
+            if (sOperands.length > 0) sOperands += ',';
+            sOperands += (sOperand || "???");
+        }
+
+        var sBytes = "";
+        var sLine = this.toHexAddr(dbgAddrIns) + ' ';
+        if (dbgAddrIns.addr !== X86.ADDR_INVALID && dbgAddr.addr !== X86.ADDR_INVALID) {
+            do {
+                sBytes += Str.toHex(this.getByte(dbgAddrIns, 1), 2);
+                if (dbgAddrIns.addr == null) break;
+            } while (dbgAddrIns.addr != dbgAddr.addr);
+        }
+
+        sLine += Str.pad(sBytes, dbgAddrIns.fAddr32? 24 : 16);
+        sLine += Str.pad(sOpcode, 8);
+        if (sOperands) sLine += ' ' + sOperands;
+
+        if (this.cpu.model < DebuggerX86.CPUS[typeCPU]) {
+            sComment = DebuggerX86.CPUS[typeCPU] + " CPU only";
+        }
+
+        if (sComment && fComplete) {
+            sLine = Str.pad(sLine, dbgAddrIns.fAddr32? 74 : 56) + ';' + sComment;
+            if (!this.cpu.flags.checksum) {
+                sLine += (nSequence != null? '=' + nSequence.toString() : "");
+            } else {
+                var nCycles = this.cpu.getCycles();
+                sLine += "cycles=" + nCycles.toString() + " cs=" + Str.toHex(this.cpu.aCounts.nChecksum);
+            }
+        }
+
+        this.initAddrSize(dbgAddr, fComplete, cOverrides);
+        return sLine;
+    }
+
+    /**
+     * getFPUInstruction(bOpcode, bModRM)
+     *
+     * @this {DebuggerX86}
+     * @param {number} bOpcode
+     * @param {number} bModRM
+     * @return {Array|null} (FPU instruction group, or null if none)
+     */
+    getFPUInstruction(bOpcode, bModRM)
+    {
+        var aOpDesc = null;
+
+        var mod = (bModRM >> 6) & 0x3;
+        var reg = (bModRM >> 3) & 0x7;
+        var r_m = (bModRM & 0x7);
+
+        /*
+         * Similar to how opFPU() decodes FPU instructions, we combine mod and reg into one
+         * decodable value: put mod in the high nibble and reg in the low nibble, after first
+         * collapsing all mod values < 3 to zero.
+         */
+        var modReg = (mod < 3? 0 : 0x30) + reg;
+
+        /*
+         * All values >= 0x34 imply mod == 3 and reg >= 4, so now we shift reg into the high
+         * nibble and r_m into the low, yielding values >= 0x40.
+         */
+        if ((bOpcode == X86.OPCODE.ESC1 || bOpcode == X86.OPCODE.ESC3) && modReg >= 0x34) {
+            modReg = (reg << 4) | r_m;
+        }
+
+        var aaOpDesc = DebuggerX86.aaaOpFPUDescs[bOpcode];
+        if (aaOpDesc) aOpDesc = aaOpDesc[modReg];
+
+        return aOpDesc;
+    }
+
+    /**
+     * getImmOperand(type, dbgAddr)
+     *
+     * @this {DebuggerX86}
+     * @param {number} type
+     * @param {DbgAddrX86} dbgAddr
+     * @return {string} operand
+     */
+    getImmOperand(type, dbgAddr)
+    {
+        var sOperand = ' ';
+        var typeSize = type & DebuggerX86.TYPE_SIZE;
+
+        switch (typeSize) {
+        case DebuggerX86.TYPE_BYTE:
+            /*
+             * There's the occasional immediate byte we don't need to display (eg, the 0x0A
+             * following an AAM or AAD instruction), so we suppress the byte if it lacks a TYPE_IN
+             * or TYPE_OUT designation (and TYPE_BOTH, as the name implies, includes both).
+             */
+            if (type & DebuggerX86.TYPE_BOTH) {
+                sOperand = Str.toHex(this.getByte(dbgAddr, 1), 2);
+            }
+            break;
+        case DebuggerX86.TYPE_SBYTE:
+            sOperand = Str.toHex((this.getByte(dbgAddr, 1) << 24) >> 24, dbgAddr.fData32? 8: 4);
+            break;
+        case DebuggerX86.TYPE_WORD:
+            if (dbgAddr.fData32) {
+                sOperand = Str.toHex(this.getLong(dbgAddr, 4));
+                break;
+            }
+            /* falls through */
+        case DebuggerX86.TYPE_SHORT:
+            sOperand = Str.toHex(this.getShort(dbgAddr, 2), 4);
+            break;
+        case DebuggerX86.TYPE_FARP:
+            dbgAddr = this.newAddr(this.getWord(dbgAddr, true), this.getShort(dbgAddr, 2), null, dbgAddr.type, dbgAddr.fData32, dbgAddr.fAddr32);
+            sOperand = this.toHexAddr(dbgAddr);
+            var aSymbol = this.findSymbol(dbgAddr);
+            if (aSymbol[0]) sOperand += " (" + aSymbol[0] + ")";
+            break;
+        default:
+            sOperand = "imm(" + Str.toHexWord(type) + ')';
+            break;
+        }
+        return sOperand;
+    }
+
+    /**
+     * getRegOperand(bReg, type, dbgAddr)
+     *
+     * @this {DebuggerX86}
+     * @param {number} bReg
+     * @param {number} type
+     * @param {DbgAddrX86} dbgAddr
+     * @return {string} operand
+     */
+    getRegOperand(bReg, type, dbgAddr)
+    {
+        var typeMode = type & DebuggerX86.TYPE_MODE;
+        if (typeMode == DebuggerX86.TYPE_SEGREG) {
+            if (bReg > DebuggerX86.REG_GS ||
+                bReg >= DebuggerX86.REG_FS && this.cpu.model < X86.MODEL_80386) return "??";
+            bReg += DebuggerX86.REG_SEG;
+        }
+        else if (typeMode == DebuggerX86.TYPE_CTLREG) {
+            bReg += DebuggerX86.REG_CR0;
+        }
+        else if (typeMode == DebuggerX86.TYPE_DBGREG) {
+            bReg += DebuggerX86.REG_DR0;
+        }
+        else if (typeMode == DebuggerX86.TYPE_TSTREG) {
+            bReg += DebuggerX86.REG_TR0;
+        }
+        else {
+            var typeSize = type & DebuggerX86.TYPE_SIZE;
+            if (typeSize >= DebuggerX86.TYPE_SHORT) {
+                if (bReg < DebuggerX86.REG_AX) {
+                    bReg += DebuggerX86.REG_AX - DebuggerX86.REG_AL;
+                }
+                if (typeSize == DebuggerX86.TYPE_LONG || typeSize == DebuggerX86.TYPE_WORD && dbgAddr.fData32) {
+                    bReg += DebuggerX86.REG_EAX - DebuggerX86.REG_AX;
+                }
+            }
+        }
+        return DebuggerX86.REGS[bReg];
+    }
+
+    /**
+     * getSIBOperand(bMod, dbgAddr)
+     *
+     * @this {DebuggerX86}
+     * @param {number} bMod
+     * @param {DbgAddrX86} dbgAddr
+     * @return {string} operand
+     */
+    getSIBOperand(bMod, dbgAddr)
+    {
+        var bSIB = this.getByte(dbgAddr, 1);
+        var bScale = bSIB >> 6;
+        var bIndex = (bSIB >> 3) & 0x7;
+        var bBase = bSIB & 0x7;
+        var sOperand = "";
+        /*
+         * Unless bMod is zero AND bBase is 5, there's always a base register.
+         */
+        if (bMod || bBase != 5) {
+            sOperand = DebuggerX86.RMS[bBase + 8];
+        }
+        if (bIndex != 4) {
+            if (sOperand) sOperand += '+';
+            sOperand += DebuggerX86.RMS[bIndex + 8];
+            if (bScale) sOperand += '*' + (0x1 << bScale);
+        }
+        /*
+         * If bMod is zero AND bBase is 5, there's a 32-bit displacement instead of a base register.
+         */
+        if (!bMod && bBase == 5) {
+            if (sOperand) sOperand += '+';
+            sOperand += Str.toHex(this.getLong(dbgAddr, 4));
+        }
+        return sOperand;
+    }
+
+    /**
+     * getModRMOperand(sOpcode, bModRM, type, cOperands, dbgAddr)
+     *
+     * @this {DebuggerX86}
+     * @param {string} sOpcode
+     * @param {number} bModRM
+     * @param {number} type
+     * @param {number} cOperands (if 1, memory operands are prefixed with the size; otherwise, size can be inferred)
+     * @param {DbgAddrX86} dbgAddr
+     * @return {string} operand
+     */
+    getModRMOperand(sOpcode, bModRM, type, cOperands, dbgAddr)
+    {
+        var sOperand = "";
+        var bMod = bModRM >> 6;
+        var bRM = bModRM & 0x7;
+        if (bMod < 3) {
+            var disp;
+            var fInteger = (sOpcode.indexOf("FI") == 0);
+            if (!bMod && (!dbgAddr.fAddr32 && bRM == 6 || dbgAddr.fAddr32 && bRM == 5)) {
+                bMod = 2;
+            } else {
+                if (dbgAddr.fAddr32) {
+                    if (bRM != 4) {
+                        bRM += 8;
+                    } else {
+                        sOperand = this.getSIBOperand(bMod, dbgAddr);
+                    }
+                }
+                if (!sOperand) sOperand = DebuggerX86.RMS[bRM];
+            }
+            if (bMod == 1) {
+                disp = this.getByte(dbgAddr, 1);
+                if (!(disp & 0x80)) {
+                    sOperand += '+' + Str.toHex(disp, 2);
+                }
+                else {
+                    disp = ((disp << 24) >> 24);
+                    sOperand += '-' + Str.toHex(-disp, 2);
+                }
+            }
+            else if (bMod == 2) {
+                if (sOperand) sOperand += '+';
+                if (!dbgAddr.fAddr32) {
+                    disp = this.getShort(dbgAddr, 2);
+                    sOperand += Str.toHex(disp, 4);
+                } else {
+                    disp = this.getLong(dbgAddr, 4);
+                    sOperand += Str.toHex(disp);
+                }
+            }
+            sOperand = '[' + sOperand + ']';
+            if (cOperands == 1) {
+                var sPrefix = "";
+                type &= DebuggerX86.TYPE_SIZE;
+                if (type == DebuggerX86.TYPE_WORD) {
+                    type = (dbgAddr.fData32? DebuggerX86.TYPE_LONG : DebuggerX86.TYPE_SHORT);
+                }
+                switch(type) {
+                case DebuggerX86.TYPE_FARP:
+                    sPrefix = "FAR";
+                    break;
+                case DebuggerX86.TYPE_BYTE:
+                    sPrefix = "BYTE";
+                    break;
+                case DebuggerX86.TYPE_SHORT:
+                    if (fInteger) {
+                        sPrefix = "INT16";
+                        break;
+                    }
+                    /* falls through */
+                    sPrefix = "WORD";
+                    break;
+                case DebuggerX86.TYPE_LONG:
+                    sPrefix = "DWORD";
+                    break;
+                case DebuggerX86.TYPE_SINT:
+                    if (fInteger) {
+                        sPrefix = "INT32";
+                        break;
+                    }
+                    /* falls through */
+                case DebuggerX86.TYPE_SREAL:
+                    sPrefix = "REAL32";
+                    break;
+                case DebuggerX86.TYPE_LINT:
+                    if (fInteger) {
+                        sPrefix = "INT64";
+                        break;
+                    }
+                    /* falls through */
+                case DebuggerX86.TYPE_LREAL:
+                    sPrefix = "REAL64";
+                    break;
+                case DebuggerX86.TYPE_TREAL:
+                    sPrefix = "REAL80";
+                    break;
+                case DebuggerX86.TYPE_BCD80:
+                    sPrefix = "BCD80";
+                    break;
+                }
+                if (sPrefix) sOperand = sPrefix + ' ' + sOperand;
+            }
+        }
+        else {
+            sOperand = this.getRegOperand(bRM, type, dbgAddr);
+        }
+        return sOperand;
+    }
+
+    /**
+     * parseInstruction(sOp, sOperand, addr)
+     *
+     * TODO: Unimplemented.  See parseInstruction() in modules/c1pjs/lib/debugger.js for a working implementation.
+     *
+     * @this {DebuggerX86}
+     * @param {string} sOp
+     * @param {string|undefined} sOperand
+     * @param {DbgAddrX86} dbgAddr of memory where this instruction is being assembled
+     * @return {Array.<number>} of opcode bytes; if the instruction can't be parsed, the array will be empty
+     */
+    parseInstruction(sOp, sOperand, dbgAddr)
+    {
+        var aOpBytes = [];
+        this.println("not supported yet");
+        return aOpBytes;
+    }
+
+    /**
+     * getFlagOutput(sFlag)
+     *
+     * @this {DebuggerX86}
+     * @param {string} sFlag
+     * @return {string} value of flag
+     */
+    getFlagOutput(sFlag)
+    {
+        var b;
+        switch (sFlag) {
+        case 'V':
+            b = this.cpu.getOF();
+            break;
+        case 'D':
+            b = this.cpu.getDF();
+            break;
+        case 'I':
+            b = this.cpu.getIF();
+            break;
+        case 'T':
+            b = this.cpu.getTF();
+            break;
+        case 'S':
+            b = this.cpu.getSF();
+            break;
+        case 'Z':
+            b = this.cpu.getZF();
+            break;
+        case 'A':
+            b = this.cpu.getAF();
+            break;
+        case 'P':
+            b = this.cpu.getPF();
+            break;
+        case 'C':
+            b = this.cpu.getCF();
+            break;
+        default:
+            b = 0;
+            break;
+        }
+        return sFlag + (b? '1' : '0') + ' ';
+    }
+
+    /**
+     * getLimitString(l)
+     *
+     * @this {DebuggerX86}
+     * @param {number} l
+     * @return {string}
+     */
+    getLimitString(l)
+    {
+        return Str.toHex(l, (l & ~0xffff)? 8 : 4);
+    }
+
+    /**
+     * getRegOutput(iReg)
+     *
+     * @this {DebuggerX86}
+     * @param {number} iReg
+     * @return {string}
+     */
+    getRegOutput(iReg)
+    {
+        if (iReg >= DebuggerX86.REG_AX && iReg <= DebuggerX86.REG_DI && this.cchReg > 4) iReg += DebuggerX86.REG_EAX - DebuggerX86.REG_AX;
+        var sReg = DebuggerX86.REGS[iReg];
+        if (iReg == DebuggerX86.REG_CR0 && this.cpu.model == X86.MODEL_80286) sReg = "MS";
+        return sReg + '=' + this.getRegString(iReg) + ' ';
+    }
+
+    /**
+     * getSegOutput(seg, fProt)
+     *
+     * @this {DebuggerX86}
+     * @param {X86Seg} seg
+     * @param {boolean} [fProt]
+     * @return {string}
+     */
+    getSegOutput(seg, fProt)
+    {
+        return seg.sName + '=' + Str.toHex(seg.sel, 4) + (fProt? '[' + Str.toHex(seg.base, this.cchAddr) + ',' + this.getLimitString(seg.limit) + ']' : "");
+    }
+
+    /**
+     * getDTROutput(sName, sel, addr, addrLimit)
+     *
+     * @this {DebuggerX86}
+     * @param {string} sName
+     * @param {number|null} sel
+     * @param {number} addr
+     * @param {number} addrLimit
+     * @return {string}
+     */
+    getDTROutput(sName, sel, addr, addrLimit)
+    {
+        return sName + '=' + (sel != null? Str.toHex(sel, 4) : "") + '[' + Str.toHex(addr, this.cchAddr) + ',' + Str.toHex(addrLimit - addr, 4) + ']';
+    }
+
+    /**
+     * getRegDump(fProt)
+     *
+     * Sample 8086 and 80286 real-mode register dump:
+     *
+     *      AX=0000 BX=0000 CX=0000 DX=0000 SP=0000 BP=0000 SI=0000 DI=0000
+     *      SS=0000 DS=0000 ES=0000 PS=0002 V0 D0 I0 T0 S0 Z0 A0 P0 C0
+     *      F000:FFF0 EA5BE000F0    JMP      F000:E05B
+     *
+     * Sample 80386 real-mode register dump:
+     *
+     *      EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000000
+     *      ESP=00000000 EBP=00000000 ESI=00000000 EDI=00000000
+     *      SS=0000 DS=0000 ES=0000 FS=0000 GS=0000 PS=00000002 V0 D0 I0 T0 S0 Z0 A0 P0 C0
+     *      F000:FFF0 EA05F900F0    JMP      F000:F905
+     *
+     * Sample 80286 protected-mode register dump:
+     *
+     *      AX=0000 BX=0000 CX=0000 DX=0000 SP=0000 BP=0000 SI=0000 DI=0000
+     *      SS=0000[000000,FFFF] DS=0000[000000,FFFF] ES=0000[000000,FFFF] A20=ON
+     *      CS=F000[FF0000,FFFF] LD=0000[000000,FFFF] GD=[000000,FFFF] ID=[000000,03FF]
+     *      TR=0000 MS=FFF0 PS=0002 V0 D0 I0 T0 S0 Z0 A0 P0 C0
+     *      F000:FFF0 EA5BE000F0    JMP      F000:E05B
+     *
+     * Sample 80386 protected-mode register dump:
+     *
+     *      EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000000
+     *      ESP=00000000 EBP=00000000 ESI=00000000 EDI=00000000
+     *      SS=0000[00000000,FFFF] DS=0000[00000000,FFFF] ES=0000[00000000,FFFF]
+     *      CS=F000[FFFF0000,FFFF] FS=0000[00000000,FFFF] GS=0000[00000000,FFFF]
+     *      LD=0000[00000000,FFFF] GD=[00000000,FFFF] ID=[00000000,03FF] TR=0000 A20=ON
+     *      CR0=00000010 CR2=00000000 CR3=00000000 PS=00000002 V0 D0 I0 T0 S0 Z0 A0 P0 C0
+     *      F000:0000FFF0 EA05F900F0    JMP      F000:0000F905
+     *
+     * This no longer includes CS in real-mode (or EIP in any mode), because that information can be obtained from the
+     * first line of disassembly, which an "r" or "rp" command will also display.
+     *
+     * Note that even when the processor is in real mode, you can always use the "rp" command to force a protected-mode
+     * dump, in case you need to verify any selector base or limit values, since those also affect real-mode operation.
+     *
+     * @this {DebuggerX86}
+     * @param {boolean} [fProt]
+     * @return {string}
+     */
+    getRegDump(fProt)
+    {
+        var s;
+        if (fProt === undefined) fProt = this.getCPUMode();
+
+        s = this.getRegOutput(DebuggerX86.REG_AX) +
+            this.getRegOutput(DebuggerX86.REG_BX) +
+            this.getRegOutput(DebuggerX86.REG_CX) +
+            this.getRegOutput(DebuggerX86.REG_DX) + (this.cchReg > 4? '\n' : '') +
+            this.getRegOutput(DebuggerX86.REG_SP) +
+            this.getRegOutput(DebuggerX86.REG_BP) +
+            this.getRegOutput(DebuggerX86.REG_SI) +
+            this.getRegOutput(DebuggerX86.REG_DI) + '\n' +
+            this.getSegOutput(this.cpu.segSS, fProt) + ' ' +
+            this.getSegOutput(this.cpu.segDS, fProt) + ' ' +
+            this.getSegOutput(this.cpu.segES, fProt) + ' ';
+
+        if (fProt) {
+            var sTR = "TR=" + Str.toHex(this.cpu.segTSS.sel, 4);
+            var sA20 = "A20=" + (this.bus.getA20()? "ON " : "OFF ");
+            if (this.cpu.model < X86.MODEL_80386) {
+                sTR = '\n' + sTR;
+                s += sA20; sA20 = '';
+            }
+            s += '\n' + this.getSegOutput(this.cpu.segCS, fProt) + ' ';
+            if (I386 && this.cpu.model >= X86.MODEL_80386) {
+                sA20 += '\n';
+                s += this.getSegOutput(this.cpu.segFS, fProt) + ' ' +
+                     this.getSegOutput(this.cpu.segGS, fProt) + '\n';
+            }
+            s += this.getDTROutput("LD", this.cpu.segLDT.sel, this.cpu.segLDT.base, this.cpu.segLDT.base + this.cpu.segLDT.limit) + ' ' +
+                 this.getDTROutput("GD", null, this.cpu.addrGDT, this.cpu.addrGDTLimit) + ' ' +
+                 this.getDTROutput("ID", null, this.cpu.addrIDT, this.cpu.addrIDTLimit) + ' ';
+            s += sTR + ' ' + sA20;
+            s += this.getRegOutput(DebuggerX86.REG_CR0);
+            if (I386 && this.cpu.model >= X86.MODEL_80386) {
+                s += this.getRegOutput(DebuggerX86.REG_CR2) + this.getRegOutput(DebuggerX86.REG_CR3);
+            }
+        } else {
+            if (I386 && this.cpu.model >= X86.MODEL_80386) {
+                s += this.getSegOutput(this.cpu.segFS, fProt) + ' ' +
+                     this.getSegOutput(this.cpu.segGS, fProt) + ' ';
+            }
+        }
+
+        s += this.getRegOutput(DebuggerX86.REG_PS) +
+             this.getFlagOutput('V') + this.getFlagOutput('D') + this.getFlagOutput('I') + this.getFlagOutput('T') +
+             this.getFlagOutput('S') + this.getFlagOutput('Z') + this.getFlagOutput('A') + this.getFlagOutput('P') + this.getFlagOutput('C');
+
+        return s;
+    }
+
+    /**
+     * comparePairs(p1, p2)
+     *
+     * @this {DebuggerX86}
+     * @param {number|string|Array|Object} p1
+     * @param {number|string|Array|Object} p2
+     * @return {number}
+     */
+    comparePairs(p1, p2)
+    {
+        return p1[0] > p2[0]? 1 : p1[0] < p2[0]? -1 : 0;
+    }
+
+    /**
+     * addSymbols(sModule, nSegment, sel, off, addr, len, aSymbols)
+     *
+     * As filedump.js (formerly convrom.php) explains, aSymbols is a JSON-encoded object whose properties consist
+     * of all the symbols (in upper-case), and the values of those properties are objects containing any or all of
+     * the following properties:
+     *
+     *      'v': the value of an absolute (unsized) value
+     *      'b': either 1, 2, 4 or undefined if an unsized value
+     *      's': either a hard-coded segment or undefined
+     *      'o': the offset of the symbol within the associated address space
+     *      'l': the original-case version of the symbol, present only if it wasn't originally upper-case
+     *      'a': annotation for the specified offset; eg, the original assembly language, with optional comment
+     *
+     * To that list of properties, we also add:
+     *
+     *      'p': the physical address (calculated whenever both 's' and 'o' properties are defined)
+     *
+     * Note that values for any 'v', 'b', 's' and 'o' properties are unquoted decimal values, and the values
+     * for any 'l' or 'a' properties are quoted strings. Also, if double-quotes were used in any of the original
+     * annotation ('a') values, they will have been converted to two single-quotes, so we're responsible for
+     * converting them back to individual double-quotes.
+     *
+     * For example:
+     *      {
+     *          'HF_PORT': {
+     *              'v':800
+     *          },
+     *          'HDISK_INT': {
+     *              'b':4, 's':0, 'o':52
+     *          },
+     *          'ORG_VECTOR': {
+     *              'b':4, 's':0, 'o':76
+     *          },
+     *          'CMD_BLOCK': {
+     *              'b':1, 's':64, 'o':66
+     *          },
+     *          'DISK_SETUP': {
+     *              'o':3
+     *          },
+     *          '.40': {
+     *              'o':40, 'a':"MOV AX,WORD PTR ORG_VECTOR ;GET DISKETTE VECTOR"
+     *          }
+     *      }
+     *
+     * If a symbol only has an offset, then that offset value can be assigned to the symbol property directly:
+     *
+     *          'DISK_SETUP': 3
+     *
+     * The last property is an example of an "anonymous" entry, for offsets where there is no associated symbol.
+     * Such entries are identified by a period followed by a unique number (usually the offset of the entry), and
+     * they usually only contain offset ('o') and annotation ('a') properties.  I could eliminate the leading
+     * period, but it offers a very convenient way of quickly discriminating among genuine vs. anonymous symbols.
+     *
+     * We add all these entries to our internal symbol table, which is an array of 4-element arrays, each of which
+     * look like:
+     *
+     *      [sel, off, addr, len, aSymbols, aOffsets]
+     *
+     * There are two basic symbol operations: findSymbol(), which takes an address and finds the symbol, if any,
+     * at that address, and findSymbolAddr(), which takes a string and attempts to match it to a non-anonymous
+     * symbol with a matching offset ('o') property.
+     *
+     * To implement findSymbol() efficiently, addSymbols() creates an array of [offset, sSymbol] pairs
+     * (aOffsets), one pair for each symbol that corresponds to an offset within the specified address space.
+     *
+     * We guarantee the elements of aOffsets are in offset order, because we build it using binaryInsert();
+     * it's quite likely that the MAP file already ordered all its symbols in offset order, but since they're
+     * hand-edited files, we can't assume that, and we need to ensure that findSymbol()'s binarySearch() operates
+     * properly.
+     *
+     * @this {DebuggerX86}
+     * @param {string|null} sModule
+     * @param {number} nSegment (zero if undefined)
+     * @param {number} sel (the default segment/selector for all symbols in this group)
+     * @param {number} off (from the base of the given selector)
+     * @param {number|null} addr (physical address where the symbols are located, if the memory is physical; eg, ROM)
+     * @param {number} len (the size of the region, in bytes)
+     * @param {Object} aSymbols (collection of symbols in this group; the format of this collection is described below)
+     */
+    addSymbols(sModule, nSegment, sel, off, addr, len, aSymbols)
+    {
+        var dbgAddr = {};
+        var aOffsets = [];
+        for (var sSymbol in aSymbols) {
+            var symbol = aSymbols[sSymbol];
+            if (typeof symbol == "number") {
+                aSymbols[sSymbol] = symbol = {'o': symbol};
+            }
+            var offSymbol = symbol['o'];
+            var selSymbol = symbol['s'];
+            var sAnnotation = symbol['a'];
+            if (offSymbol !== undefined) {
+                if (selSymbol !== undefined) {
+                    dbgAddr.off = offSymbol;
+                    dbgAddr.sel = selSymbol;
+                    dbgAddr.addr = null;
+                    /*
+                     * getAddr() computes the corresponding physical address and saves it in dbgAddr.addr.
+                     */
+                    this.getAddr(dbgAddr);
+                    /*
+                     * The physical address for any symbol located in the top 64Kb of the machine's address space
+                     * should be relocated to the top 64Kb of the first 1Mb, so that we're immune from any changes
+                     * to the A20 line.
+                     */
+                    if ((dbgAddr.addr & ~0xffff) == (this.bus.nBusLimit & ~0xffff)) {
+                        dbgAddr.addr &= 0x000fffff;
+                    }
+                    symbol['p'] = dbgAddr.addr;
+                }
+                Usr.binaryInsert(aOffsets, [offSymbol >>> 0, sSymbol], this.comparePairs);
+            }
+            if (sAnnotation) symbol['a'] = sAnnotation.replace(/''/g, "\"");
+        }
+        var symbolTable = {
+            sModule: sModule,
+            nSegment: nSegment,
+            sel: sel,
+            off: off,
+            addr: addr,
+            len: len,
+            aSymbols: aSymbols,
+            aOffsets: aOffsets
+        };
+        this.aSymbolTable.push(symbolTable);
+    }
+
+    /**
+     * removeSymbols(sModule, nSegment)
+     *
+     * @this {DebuggerX86}
+     * @param {string|null} sModule
+     * @param {number} [nSegment] (segment # if sModule set, selector if sModule clear)
+     * @return {string|null} name of the module removed, or null if no module was found
+     */
+    removeSymbols(sModule, nSegment)
+    {
+        var sModuleRemoved = null;
+        for (var iTable = 0; iTable < this.aSymbolTable.length; iTable++) {
+            var symbolTable = this.aSymbolTable[iTable];
+            if (sModule && symbolTable.sModule != sModule) continue;
+            if (sModule && nSegment == symbolTable.nSegment || !sModule && nSegment == symbolTable.sel) {
+                sModuleRemoved = symbolTable.sModule;
+                this.aSymbolTable.splice(iTable, 1);
+                break;
+            }
+        }
+        return sModuleRemoved;
+    }
+
+    /**
+     * dumpSymbols()
+     *
+     * TODO: Add "numerical" and "alphabetical" dump options. This is simply dumping them in whatever
+     * order they appeared in the original MAP file.
+     *
+     * @this {DebuggerX86}
+     */
+    dumpSymbols()
+    {
+        for (var iTable = 0; iTable < this.aSymbolTable.length; iTable++) {
+            var symbolTable = this.aSymbolTable[iTable];
+            for (var sSymbol in symbolTable.aSymbols) {
+                if (sSymbol.charAt(0) == '.') continue;
+                var symbol = symbolTable.aSymbols[sSymbol];
+                var offSymbol = symbol['o'];
+                if (offSymbol === undefined) continue;
+                var selSymbol = symbol['s'];
+                if (selSymbol === undefined) selSymbol = symbolTable.sel;
+                var sSymbolOrig = symbolTable.aSymbols[sSymbol]['l'];
+                if (sSymbolOrig) sSymbol = sSymbolOrig;
+                this.println(this.toHexOffset(offSymbol, selSymbol) + ' ' + sSymbol);
+            }
+        }
+    }
+
+    /**
+     * findSymbol(dbgAddr, fNearest)
+     *
+     * Search aSymbolTable for dbgAddr, and return an Array for the corresponding symbol (empty if not found).
+     *
+     * If fNearest is true, and no exact match was found, then the Array returned will contain TWO sets of
+     * entries: [0]-[3] will refer to closest preceding symbol, and [4]-[7] will refer to the closest subsequent symbol.
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr
+     * @param {boolean} [fNearest]
+     * @return {Array} where [0] == symbol name, [1] == symbol value, [2] == any annotation, and [3] == any associated comment
+     */
+    findSymbol(dbgAddr, fNearest)
+    {
+        var aSymbol = [];
+        var offSymbol = dbgAddr.off >>> 0;
+        var addrSymbol = this.getAddr(dbgAddr) >>> 0;
+        for (var iTable = 0; iTable < this.aSymbolTable.length; iTable++) {
+            var symbolTable = this.aSymbolTable[iTable];
+            var sel = symbolTable.sel;
+            var off = symbolTable.off >>> 0;
+            var addr = symbolTable.addr;
+            if (addr != null) addr >>>= 0;
+            var len = symbolTable.len;
+            if (sel == 0x30) sel = 0x28;        // TODO: Remove this hack once we're able to differentiate Windows 95 ring 0 code and data
+            if (sel == dbgAddr.sel && offSymbol >= off && offSymbol < off + len || addr != null && addrSymbol >= addr && addrSymbol < addr + len) {
+                var result = Usr.binarySearch(symbolTable.aOffsets, [offSymbol], this.comparePairs);
+                if (result >= 0) {
+                    this.returnSymbol(iTable, result, aSymbol);
+                }
+                else if (fNearest) {
+                    result = ~result;
+                    this.returnSymbol(iTable, result-1, aSymbol);
+                    this.returnSymbol(iTable, result, aSymbol);
+                }
+                break;
+            }
+        }
+        if (!aSymbol.length) {
+            var sSymbol = this.bus.getSymbol(addrSymbol, true);
+            if (sSymbol) {
+                aSymbol.push(sSymbol);
+                aSymbol.push(addrSymbol);
+            }
+        }
+        return aSymbol;
+    }
+
+    /**
+     * findSymbolAddr(sSymbol)
+     *
+     * Search aSymbolTable for sSymbol, and if found, return a dbgAddr (same as parseAddr())
+     *
+     * @this {DebuggerX86}
+     * @param {string} sSymbol
+     * @return {DbgAddrX86|undefined}
+     */
+    findSymbolAddr(sSymbol)
+    {
+        var dbgAddr;
+        if (sSymbol.match(/^[a-z_][a-z0-9_]*$/i)) {
+            var sUpperCase = sSymbol.toUpperCase();
+            for (var iTable = 0; iTable < this.aSymbolTable.length; iTable++) {
+                var symbolTable = this.aSymbolTable[iTable];
+                var symbol = symbolTable.aSymbols[sUpperCase];
+                if (symbol !== undefined) {
+                    var offSymbol = symbol['o'];
+                    if (offSymbol !== undefined) {
+                        /*
+                         * We assume that every ROM is ORG'ed at 0x0000, and therefore unless the symbol has an
+                         * explicitly-defined segment, we return the segment associated with the entire group; for
+                         * a ROM, that segment is normally "addrROM >>> 4".  Down the road, we may want/need to
+                         * support a special symbol entry (eg, ".ORG") that defines an alternate origin.
+                         */
+                        var selSymbol = symbol['s'];
+                        if (selSymbol === undefined) selSymbol = symbolTable.sel;
+                        dbgAddr = this.newAddr(offSymbol, selSymbol, symbol['p']);
+                    }
+                    /*
+                     * The symbol matched, but it wasn't for an address (no 'o' offset), and there's no point
+                     * looking any farther, since each symbol appears only once, so we indicate it's an unknown symbol.
+                     */
+                    break;
+                }
+            }
+        }
+        return dbgAddr;
+    }
+
+    /**
+     * returnSymbol(iTable, iOffset, aSymbol)
+     *
+     * Helper function for findSymbol().
+     *
+     * @param {number} iTable
+     * @param {number} iOffset
+     * @param {Array} aSymbol is updated with the specified symbol, if it exists
+     */
+    returnSymbol(iTable, iOffset, aSymbol)
+    {
+        var symbol = {};
+        var aOffsets = this.aSymbolTable[iTable].aOffsets;
+        var offset = 0, sSymbol = null;
+        if (iOffset >= 0 && iOffset < aOffsets.length) {
+            offset = aOffsets[iOffset][0];
+            sSymbol = aOffsets[iOffset][1];
+        }
+        if (sSymbol) {
+            symbol = this.aSymbolTable[iTable].aSymbols[sSymbol];
+            sSymbol = (sSymbol.charAt(0) == '.'? null : (symbol['l'] || sSymbol));
+        }
+        aSymbol.push(sSymbol);
+        aSymbol.push(offset);
+        aSymbol.push(symbol['a']);
+        aSymbol.push(symbol['c']);
+    }
+
+    /**
+     * doHelp()
+     *
+     * @this {DebuggerX86}
+     */
+    doHelp()
+    {
+        var s = "commands:";
+        for (var sCommand in DebuggerX86.COMMANDS) {
+            s += '\n' + Str.pad(sCommand, 7) + DebuggerX86.COMMANDS[sCommand];
+        }
+        if (!this.checksEnabled()) s += "\nnote: frequency/history disabled if no exec breakpoints";
+        this.println(s);
+    }
+
+    /**
+     * doAssemble(asArgs)
+     *
+     * This always receives the complete argument array, where the order of the arguments is:
+     *
+     *      [0]: the assemble command (assumed to be "a")
+     *      [1]: the target address (eg, "200")
+     *      [2]: the operation code, aka instruction name (eg, "adc")
+     *      [3]: the operation mode operand, if any (eg, "14", "[1234]", etc)
+     *
+     * The Debugger enters "assemble mode" whenever only the first (or first and second) arguments are present.
+     * As long as "assemble mode is active, the user can omit the first two arguments on all later assemble commands
+     * until "assemble mode" is cancelled with an empty command line; the command processor automatically prepends "a"
+     * and the next available target address to the argument array.
+     *
+     * Entering "assemble mode" is optional; one could enter a series of fully-qualified assemble commands; eg:
+     *
+     *      a ff00 cld
+     *      a ff01 ldx 28
+     *      ...
+     *
+     * without ever entering "assemble mode", but of course, that requires more typing and doesn't take advantage
+     * of automatic target address advancement (see dbgAddrAssemble).
+     *
+     * NOTE: As the previous example implies, you can even assemble new instructions into ROM address space;
+     * as our setByte() function explains, the ROM write-notification handlers only refuse writes from the CPU.
+     *
+     * @this {DebuggerX86}
+     * @param {Array.<string>} asArgs is the complete argument array, beginning with the "a" command in asArgs[0]
+     */
+    doAssemble(asArgs)
+    {
+        var dbgAddr = this.parseAddr(asArgs[1], true);
+        if (!dbgAddr) return;
+
+        this.dbgAddrAssemble = dbgAddr;
+        if (asArgs[2] === undefined) {
+            this.println("begin assemble at " + this.toHexAddr(dbgAddr));
+            this.fAssemble = true;
+            this.cpu.updateCPU();
+            return;
+        }
+
+        var aOpBytes = this.parseInstruction(asArgs[2], asArgs[3], dbgAddr);
+        if (aOpBytes.length) {
+            for (var i = 0; i < aOpBytes.length; i++) {
+                this.setByte(dbgAddr, aOpBytes[i], 1);
+            }
+            /*
+             * Since getInstruction() also updates the specified address, dbgAddrAssemble is automatically advanced.
+             */
+            this.println(this.getInstruction(this.dbgAddrAssemble));
+        }
+    }
+
+    /**
+     * doBreak(sCmd, sAddr, sOptions)
+     *
+     * As the "help" output below indicates, the following breakpoint commands are supported:
+     *
+     *      bp [a]  set exec breakpoint on linear addr [a]
+     *      br [a]  set read breakpoint on linear addr [a]
+     *      bw [a]  set write breakpoint on linear addr [a]
+     *      bc [a]  clear breakpoint on linear addr [a] (use "*" for all breakpoints)
+     *      bl      list breakpoints
+     *
+     * to which we have recently added the following I/O breakpoint commands:
+     *
+     *      bi [p]  toggle input breakpoint on port [p] (use "*" for all input ports)
+     *      bo [p]  toggle output breakpoint on port [p] (use "*" for all output ports)
+     *
+     * These two new commands operate as toggles so that if "*" is used to trap all input (or output),
+     * you can also use these commands to NOT trap specific ports.
+     *
+     *      bn [n]  break after [n] instructions
+     *
+     * TODO: Update the "bl" command to include any/all I/O breakpoints, and the "bc" command to
+     * clear them.  Because "bi" and "bo" commands are piggy-backing on Bus functions, those breakpoints
+     * are currently outside the realm of what the "bl" and "bc" commands are aware of.
+     *
+     * @this {DebuggerX86}
+     * @param {string} sCmd
+     * @param {string|undefined} [sAddr]
+     * @param {string} [sOptions] (the rest of the breakpoint command-line)
+     */
+    doBreak(sCmd, sAddr, sOptions)
+    {
+        if (sAddr == '?') {
+            this.println("breakpoint commands:");
+            this.println("\tbi [p]\ttoggle break on input port [p]");
+            this.println("\tbo [p]\ttoggle break on output port [p]");
+            this.println("\tbp [a]\tset exec breakpoint at addr [a]");
+            this.println("\tbr [a]\tset read breakpoint at addr [a]");
+            this.println("\tbw [a]\tset write breakpoint at addr [a]");
+            this.println("\tbc [a]\tclear breakpoint at addr [a]");
+            this.println("\tbl\tlist all breakpoints");
+            this.println("\tbn [n]\tbreak after [n] instruction(s)");
+            return;
+        }
+        var sParm = sCmd.charAt(1);
+        if (sParm == 'l') {
+            var cBreaks = 0;
+            cBreaks += this.listBreakpoints(this.aBreakExec);
+            cBreaks += this.listBreakpoints(this.aBreakRead);
+            cBreaks += this.listBreakpoints(this.aBreakWrite);
+            if (!cBreaks) this.println("no breakpoints");
+            return;
+        }
+        if (sParm == 'n') {
+            this.nBreakIns = this.parseValue(sAddr);
+            this.println("break after " + this.nBreakIns + " instruction(s)");
+            return;
+        }
+        if (sAddr === undefined) {
+            this.println("missing breakpoint address");
+            return;
+        }
+        var dbgAddr = {};
+        if (sAddr != '*') {
+            dbgAddr = this.parseAddr(sAddr, true, true);
+            if (!dbgAddr) return;
+        }
+
+        sAddr = (dbgAddr.off == null? sAddr : Str.toHexWord(dbgAddr.off));
+
+        if (sParm == 'c') {
+            if (dbgAddr.off == null) {
+                this.clearBreakpoints();
+                this.println("all breakpoints cleared");
+                return;
+            }
+            if (this.findBreakpoint(this.aBreakExec, dbgAddr, true))
+                return;
+            if (this.findBreakpoint(this.aBreakRead, dbgAddr, true))
+                return;
+            if (this.findBreakpoint(this.aBreakWrite, dbgAddr, true))
+                return;
+            this.println("breakpoint missing: " + this.toHexAddr(dbgAddr));
+            return;
+        }
+
+        if (sParm == 'i') {
+            this.println("breakpoint " + (this.bus.addPortInputBreak(dbgAddr.off)? "enabled" : "cleared") + ": port " + sAddr + " (input)");
+            return;
+        }
+
+        if (sParm == 'o') {
+            this.println("breakpoint " + (this.bus.addPortOutputBreak(dbgAddr.off)? "enabled" : "cleared") + ": port " + sAddr + " (output)");
+            return;
+        }
+
+        if (dbgAddr.off == null) return;
+
+        this.parseAddrOptions(dbgAddr, sOptions);
+
+        if (sParm == 'p') {
+            this.addBreakpoint(this.aBreakExec, dbgAddr);
+            return;
+        }
+        if (sParm == 'r') {
+            this.addBreakpoint(this.aBreakRead, dbgAddr);
+            return;
+        }
+        if (sParm == 'w') {
+            this.addBreakpoint(this.aBreakWrite, dbgAddr);
+            return;
+        }
+        this.println("unknown breakpoint command: " + sParm);
+    }
+
+    /**
+     * doClear(sCmd)
+     *
+     * @this {DebuggerX86}
+     * @param {string} [sCmd] (eg, "cls" or "clear")
+     */
+    doClear(sCmd)
+    {
+        /*
+         * TODO: There should be a clear() component method that the Control Panel overrides to perform this function.
+         */
+        if (this.controlPrint) this.controlPrint.value = "";
+    }
+
+    /**
+     * doDump(asArgs)
+     *
+     * The length parameter is interpreted as a number of bytes, in hex, which we convert to the appropriate number
+     * of lines, because we always display whole lines.  If the length is omitted/undefined, it defaults to 0x80 (128.)
+     * bytes, which normally translates to 8 lines.
+     *
+     * @this {DebuggerX86}
+     * @param {Array.<string>} asArgs (formerly sCmd, [sAddr], [sLen] and [sBytes])
+     */
+    doDump(asArgs)
+    {
+        var m;
+        var sCmd = asArgs[0];
+        var sAddr = asArgs[1];
+        var sLen = asArgs[2];
+        var sBytes = asArgs[3];
+
+        if (sAddr == '?') {
+            var sDumpers = "";
+            for (m in Messages.CATEGORIES) {
+                if (this.afnDumpers[m]) {
+                    if (sDumpers) sDumpers += ',';
+                    sDumpers = sDumpers + m;
+                }
+            }
+            sDumpers += ",state,symbols";
+            this.println("dump memory commands:");
+            this.println("\tdb [a] [#]    dump # bytes at address a");
+            this.println("\tdw [a] [#]    dump # words at address a");
+            this.println("\tdd [a] [#]    dump # dwords at address a");
+            this.println("\tdh [#] [#]    dump # instructions from history");
+            this.println("\tdi [#]        dump descriptor info for IDT #");
+            this.println("\tds [#]        dump descriptor info for selector #");
+            if (BACKTRACK) {
+                this.println("\tdt [a]        dump backtrack info for address a");
+            }
+            if (sDumpers.length) this.println("dump extension commands:\n\t" + sDumpers);
+            return;
+        }
+
+        if (sAddr == "state") {
+            var sState = this.cmp.powerOff(true);
+            if (!sState) {
+                this.println("powerOff() error");
+            }
+            else if (sLen == "console") {
+                /*
+                 * Console buffers are notoriously small, and even the following code, which breaks the
+                 * data into parts (eg, "d state console 1", "d state console 2", etc) just isn't that helpful.
+                 *
+                 *      var nPart = +sBytes;
+                 *      if (nPart) sState = sState.substr(1000000 * (nPart-1), 1000000);
+                 *
+                 * So, the best way to capture a large machine state is to use the new "Save Machine" link
+                 * that downloads a machine's entire state.  Alternatively, run your own local server and use
+                 * server-side storage.  Take a look at the "Save" binding in computer.js, which binds an HTML
+                 * control to the computer.powerOff() and computer.saveServerState() functions.
+                 */
+                console.log(sState);
+            } else {
+                this.doClear();
+                this.println(sState);
+            }
+            return;
+        }
+
+        if (sAddr == "symbols") {
+            this.dumpSymbols();
+            return;
+        }
+
+        /*
+         * Transform a "ds" command into a "d desc" command (simply as shorthand); ditto for "dg" and "dl",
+         * only because that's the syntax that WDEB386 used.  I'm uncertain what WDEB386 would do with an LDT
+         * selector passed to "dg" or a GDT selector passed to "dl" (because I'm too lazy to check right now),
+         * but that seems nonsensical.
+         */
+        if (sCmd == "ds" || sCmd == "dg" || sCmd == "dl") {
+            sCmd = "d";
+            asArgs = [sCmd, "desc", sAddr];
+        }
+
+        /*
+         * Handle the "dp" (aka "d page") commands here.
+         */
+        if (sCmd == "d" && sAddr == "page") {
+            sCmd = "dp";
+            asArgs.shift();
+        }
+        if (sCmd == "dp") {
+            asArgs.shift();
+            this.dumpPage(asArgs);
+            return;
+        }
+
+        if (sCmd == "d") {
+            /*
+             * Transform a "d disk" command into a "l json" command (TODO: Register a dumper for "disk" instead?)
+             */
+            if (sAddr == "disk") {
+                asArgs[0] = "l";
+                asArgs[1] = "json";
+                this.doLoad(asArgs);
+                return;
+            }
+            for (m in Messages.CATEGORIES) {
+                if (asArgs[1] == m) {
+                    var fnDumper = this.afnDumpers[m];
+                    if (fnDumper) {
+                        asArgs.shift();
+                        asArgs.shift();
+                        fnDumper(asArgs);
+                    } else {
+                        this.println("no dump registered for " + sAddr);
+                    }
+                    return;
+                }
+            }
+            if (!sAddr) sCmd = this.sCmdDumpPrev || "db";
+        } else {
+            this.sCmdDumpPrev = sCmd;
+        }
+
+        if (sCmd == "dh") {
+            this.dumpHistory(sAddr, sLen);
+            return;
+        }
+
+        if (sCmd == "di") {
+            asArgs.shift();
+            this.dumpIDT(asArgs);
+            return;
+        }
+
+        if (sCmd == "dt") {
+            asArgs.shift();
+            var sInfo = this.dumpBackTrack(asArgs);
+            this.println(sInfo);
+            return;
+        }
+
+        var dbgAddr = this.parseAddr(sAddr);
+        if (!dbgAddr || dbgAddr.sel == null && dbgAddr.addr == null) return;
+
+        var len = 0;                            // 0 is not a default; it triggers the appropriate default below
+        if (sLen) {
+            if (sLen.charAt(0) == 'l') {
+                sLen = sLen.substr(1) || sBytes;
+            }
+            len = this.parseValue(sLen) >>> 0;  // negative lengths not allowed
+            if (len > 0x10000) len = 0x10000;   // prevent bad user (or variable) input from producing excessive output
+        }
+
+        var sDump = "";
+        var size = (sCmd == "dd"? 4 : (sCmd == "dw"? 2 : 1));
+        var cb = (size * len) || 128;
+        var cLines = ((cb + 15) >> 4) || 1;
+
+        while (cLines-- && cb > 0) {
+            var data = 0, iByte = 0, i;
+            var sData = "", sChars = "";
+            sAddr = this.toHexAddr(dbgAddr);
+            /*
+             * It's just coincidence that we want to dump 8 bytes per line when using base 8 and 16 bytes
+             * per line when using base 16, because octal requires more digits.
+             */
+            var nBytes = (size == 4? 16 : this.nBase);
+            for (i = nBytes; i > 0 && cb > 0; i--) {
+                var b = this.getByte(dbgAddr, 1);
+                data |= (b << (iByte++ << 3));
+                if (iByte == size) {
+                    sData += (this.nBase == 8? Str.toOct(data, size * 3) : Str.toHex(data, size * 2));
+                    sData += (size == 1? (i == 9? '-' : ' ') : "  ");
+                    data = iByte = 0;
+                }
+                sChars += (b >= 32 && b < 128? String.fromCharCode(b) : '.');
+                cb--;
+            }
+            if (sDump) sDump += '\n';
+            sDump += sAddr + "  " + sData + ((i == 0)? (' ' + sChars) : "");
+        }
+
+        if (sDump) this.println(sDump);
+        this.dbgAddrNextData = dbgAddr;
+    }
+
+    /**
+     * doEdit(asArgs)
+     *
+     * @this {DebuggerX86}
+     * @param {Array.<string>} asArgs
+     */
+    doEdit(asArgs)
+    {
+        var size = 1;
+        var mask = 0xff;
+        var fnGet = this.getByte;
+        var fnSet = this.setByte;
+        if (asArgs[0] == "ew") {
+            size = 2;
+            mask = 0xffff;
+            fnGet = this.getShort;
+            fnSet = this.setShort;
+        }
+        var cch = size << 1;
+
+        var sAddr = asArgs[1];
+        if (sAddr == null) {
+            this.println("edit memory commands:");
+            this.println("\teb [a] [...]  edit bytes at address a");
+            this.println("\tew [a] [...]  edit words at address a");
+            return;
+        }
+
+        var dbgAddr = this.parseAddr(sAddr);
+        if (!dbgAddr) return;
+
+        for (var i = 2; i < asArgs.length; i++) {
+            var vNew = this.parseExpression(asArgs[i]);
+            if (vNew === undefined) {
+                this.println("unrecognized value: " + asArgs[i]);
+                break;
+            }
+            if (vNew & ~mask) {
+                this.println("warning: " + Str.toHex(vNew) + " exceeds " + size + "-byte value");
+            }
+            var vOld = fnGet.call(this, dbgAddr);
+            this.println("changing " + this.toHexAddr(dbgAddr) + " from " + Str.toHex(vOld, cch, true) + " to " + Str.toHex(vNew, cch, true));
+            fnSet.call(this, dbgAddr, vNew, size);
+        }
+    }
+
+    /**
+     * doFreqs(sParm)
+     *
+     * @this {DebuggerX86}
+     * @param {string|undefined} sParm
+     */
+    doFreqs(sParm)
+    {
+        if (sParm == '?') {
+            this.println("frequency commands:");
+            this.println("\tclear\tclear all frequency counts");
+            return;
+        }
+        var i;
+        var cData = 0;
+        if (this.aaOpcodeCounts) {
+            if (sParm == "clear") {
+                for (i = 0; i < this.aaOpcodeCounts.length; i++)
+                    this.aaOpcodeCounts[i] = [i, 0];
+                this.println("frequency data cleared");
+                cData++;
+            }
+            else if (sParm !== undefined) {
+                this.println("unknown frequency command: " + sParm);
+                cData++;
+            }
+            else {
+                var aaSortedOpcodeCounts = this.aaOpcodeCounts.slice();
+                aaSortedOpcodeCounts.sort(function(p, q) {
+                    return q[1] - p[1];
+                });
+                for (i = 0; i < aaSortedOpcodeCounts.length; i++) {
+                    var bOpcode = aaSortedOpcodeCounts[i][0];
+                    var cFreq = aaSortedOpcodeCounts[i][1];
+                    if (cFreq) {
+                        this.println((DebuggerX86.INS_NAMES[this.aaOpDescs[bOpcode][0]] + "  ").substr(0, 5) + " (" + Str.toHexByte(bOpcode) + "): " + cFreq + " times");
+                        cData++;
+                    }
+                }
+            }
+        }
+        if (!cData) {
+            this.println("no frequency data available");
+        }
+    }
+
+    /**
+     * doHalt(fQuiet)
+     *
+     * @this {DebuggerX86}
+     * @param {boolean} [fQuiet]
+     */
+    doHalt(fQuiet)
+    {
+        var sMsg;
+        if (this.flags.running) {
+            sMsg = "halting";
+            this.stopCPU();
+        } else {
+            if (this.isBusy(true)) return;
+            sMsg = "already halted";
+        }
+        if (!fQuiet) this.println(sMsg);
+    }
+
+    /**
+     * doIf(sCmd, fQuiet)
+     *
+     * NOTE: Don't forget that the default base for all numeric constants is 16 (hex), so when you evaluate
+     * an expression like "a==10", it will compare the value of the variable "a" to 0x10; use a trailing period
+     * (eg, "10.") if you really intend decimal.
+     *
+     * Also, if no variable named "a" exists, "a" will evaluate to 0x0A, so the expression "a==10" becomes
+     * "0x0A==0x10" (false), whereas the expression "a==10." becomes "0x0A==0x0A" (true).
+     *
+     * @this {DebuggerX86}
+     * @param {string} sCmd
+     * @param {boolean} [fQuiet]
+     * @return {boolean} true if expression is non-zero, false if zero (or undefined due to a parse error)
+     */
+    doIf(sCmd, fQuiet)
+    {
+        sCmd = Str.trim(sCmd);
+        if (!this.parseExpression(sCmd)) {
+            if (!fQuiet) this.println("false: " + sCmd);
+            return false;
+        }
+        if (!fQuiet) this.println("true: " + sCmd);
+        return true;
+    }
+
+    /**
+     * doInfo(asArgs)
+     *
+     * @this {DebuggerX86}
+     * @param {Array.<string>} asArgs
+     * @return {boolean} true only if the instruction info command ("n") is supported
+     */
+    doInfo(asArgs)
+    {
+        if (DEBUG) {
+            this.println("msPerYield: " + this.cpu.aCounts.msPerYield);
+            this.println("nCyclesPerBurst: " + this.cpu.aCounts.nCyclesPerBurst);
+            this.println("nCyclesPerYield: " + this.cpu.aCounts.nCyclesPerYield);
+            this.println("nCyclesPerVideoUpdate: " + this.cpu.aCounts.nCyclesPerVideoUpdate);
+            this.println("nCyclesPerStatusUpdate: " + this.cpu.aCounts.nCyclesPerStatusUpdate);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * doInput(sPort)
+     *
+     * Simulate a 1-byte port input operation.
+     *
+     * @this {DebuggerX86}
+     * @param {string|undefined} sPort
+     */
+    doInput(sPort)
+    {
+        if (!sPort || sPort == '?') {
+            this.println("input commands:");
+            this.println("\ti [p]\tread port [p]");
+            /*
+             * TODO: Regarding this warning, consider adding an "unchecked" version of
+             * bus.checkPortInputNotify(), since all Debugger memory accesses are unchecked, too.
+             *
+             * All port I/O handlers ARE aware when the Debugger is calling (addrFrom is undefined),
+             * but changing them all to be non-destructive would take time, and situations where you
+             * actually want to affect the hardware state are just as likely as not....
+             */
+            this.println("warning: port accesses can affect hardware state");
+            return;
+        }
+        var port = this.parseValue(sPort);
+        if (port !== undefined) {
+            var bIn = this.bus.checkPortInputNotify(port, 1);
+            this.println(Str.toHexWord(port) + ": " + Str.toHexByte(bIn));
+        }
+    }
+
+    /**
+     * doInt(sInt)
+     *
+     * Displays information about the given software interrupt (assuming that said interrupt is in progress).
+     *
+     * These messages also reset the system variable $ops (by updating cOpcodesStart), to make it easier to see
+     * how many opcodes were executed since these interrupts "started".
+     *
+     * @this {DebuggerX86}
+     * @param {string|undefined} sInt
+     * @return {boolean} true if successful, false if not
+     */
+    doInt(sInt)
+    {
+        switch(this.parseValue(sInt)) {
+        case 0x13:
+            this.messageInt(Interrupts.DISK, this.cpu.regLIP, true);
+            this.cOpcodesStart = this.cOpcodes;
+            return true;
+        case 0x21:
+            this.messageInt(Interrupts.DOS, this.cpu.regLIP, true);
+            this.cOpcodesStart = this.cOpcodes;
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    /**
+     * doVar(sCmd)
+     *
+     * The command must be of the form "{variable} = [{expression}]", where expression may contain constants,
+     * operators, registers, symbols, other variables, or nothing at all; in the latter case, the variable, if
+     * any, is deleted.
+     *
+     * Other supported shorthand: "var" with no parameters prints the values of all variables, and "var {variable}"
+     * prints the value of the specified variable.
+     *
+     * @this {DebuggerX86}
+     * @param {string} sCmd
+     * @return {boolean} true if valid "var" assignment, false if not
+     */
+    doVar(sCmd)
+    {
+        var a = sCmd.match(/^\s*([A-Z_]?[A-Z0-9_]*)\s*(=?)\s*(.*)$/i);
+        if (a) {
+            if (!a[1]) {
+                if (!this.printVariable()) this.println("no variables");
+                return true;    // it's not considered an error to print an empty list of variables
+            }
+            if (!a[2]) {
+                return this.printVariable(a[1]);
+            }
+            if (!a[3]) {
+                this.delVariable(a[1]);
+                return true;    // it's not considered an error to delete a variable that didn't exist
+            }
+            var v = this.parseExpression(a[3]);
+            if (v !== undefined) {
+                this.setVariable(a[1], v);
+                return true;
+            }
+            return false;
+        }
+        this.println("invalid assignment:" + sCmd);
+        return false;
+    }
+
+    /**
+     * doList(sAddr, fPrint)
+     *
+     * @this {DebuggerX86}
+     * @param {string} sAddr
+     * @param {boolean} [fPrint]
+     * @return {string|null}
+     */
+    doList(sAddr, fPrint)
+    {
+        var sSymbol = null;
+
+        var dbgAddr = this.parseAddr(sAddr, true);
+        if (dbgAddr) {
+
+            var addr = this.getAddr(dbgAddr);
+            if (MAXDEBUG && fPrint) {
+                this.println(this.toHexAddr(dbgAddr) + " (%" + Str.toHex(addr, this.cchAddr) + ')');
+            }
+
+            var aSymbol = this.findSymbol(dbgAddr, true);
+            if (aSymbol.length) {
+                var nDelta, sDelta, s;
+                if (aSymbol[0]) {
+                    sDelta = "";
+                    nDelta = dbgAddr.off - aSymbol[1];
+                    if (nDelta) sDelta = " + " + Str.toHexWord(nDelta);
+                    s = aSymbol[0] + " (" + this.toHexOffset(aSymbol[1], dbgAddr.sel) + ')' + sDelta;
+                    if (fPrint) this.println(s);
+                    sSymbol = s;
+                }
+                if (aSymbol.length > 4 && aSymbol[4]) {
+                    sDelta = "";
+                    nDelta = aSymbol[5] - dbgAddr.off;
+                    if (nDelta) sDelta = " - " + Str.toHexWord(nDelta);
+                    s = aSymbol[4] + " (" + this.toHexOffset(aSymbol[5], dbgAddr.sel) + ')' + sDelta;
+                    if (fPrint) this.println(s);
+                    if (!sSymbol) sSymbol = s;
+                }
+            } else {
+                if (fPrint) this.println("no symbols");
+            }
+        }
+        return sSymbol;
+    }
+
+    /**
+     * doLoad(asArgs)
+     *
+     * The format of this command mirrors the DOS DEBUG "L" command:
+     *
+     *      l [address] [drive #] [sector #] [# sectors]
+     *
+     * The only optional parameter is the last, which defaults to 1 sector if not specified.
+     *
+     * As a quick-and-dirty way of getting the current contents of a disk image as a JSON dump
+     * (which you can then save as .json disk image file), I also support this command:
+     *
+     *      l json [drive #]
+     *
+     * which is aliased to this command:
+     *
+     *      d disk [drive #]
+     *
+     * @this {DebuggerX86}
+     * @param {Array.<string>} asArgs
+     */
+    doLoad(asArgs)
+    {
+        if (!asArgs[1] || asArgs[1] == '?') {
+            this.println("load commands:");
+            this.println("\tl [address] [drive #] [sector #] [# sectors]");
+            return;
+        }
+
+        var fJSON = (asArgs[1] == "json");
+        var iDrive, iSector = 0, nSectors = 0;
+
+        var dbgAddr = (fJSON? {} : this.parseAddr(asArgs[1]));
+        if (!dbgAddr) return;
+
+        iDrive = this.parseValue(asArgs[2], "drive #");
+        if (iDrive === undefined) return;
+        if (!fJSON) {
+            iSector = this.parseValue(asArgs[3], "sector #");
+            if (iSector === undefined) return;
+            nSectors = this.parseValue(asArgs[4], "# of sectors");
+            if (nSectors === undefined) nSectors = 1;
+        }
+
+        /*
+         * We choose the disk controller very simplistically: FDC for drives 0 or 1, and HDC for drives 2
+         * and up, unless no HDC is present, in which case we assume FDC for all drive numbers.
+         *
+         * Both controllers must obviously support the same interfaces; ie, copyDrive(), seekDrive(),
+         * and readData().  We also rely on the disk property to determine whether the drive is "loaded".
+         *
+         * In the case of the HDC, if the drive is valid, then by definition it is also "loaded", since an HDC
+         * drive and its disk are inseparable; it's certainly possible that the disk object may be empty at
+         * this point (ie, if the disk is uninitialized and unformatted), but that will only affect whether the
+         * read succeeds or not.
+         */
+        var dc = this.fdc;
+        if (iDrive >= 2 && this.hdc) {
+            iDrive -= 2;
+            dc = this.hdc;
+        }
+        if (dc) {
+            var drive = dc.copyDrive(iDrive);
+            if (drive) {
+                if (drive.disk) {
+                    if (fJSON) {
+                        /*
+                         * This is an interim solution to dumping disk images in JSON.  It has many problems, the
+                         * "biggest" being that the large disk images really need to be compressed first, because they
+                         * get "inflated" with use.  See the dump() method in the Disk component for more details.
+                         */
+                        this.doClear();
+                        this.println(drive.disk.toJSON());
+                        return;
+                    }
+                    if (dc.seekDrive(drive, iSector, nSectors)) {
+                        var cb = 0;
+                        var fAbort = false;
+                        var sAddr = this.toHexAddr(dbgAddr);
+                        while (!fAbort && drive.nBytes-- > 0) {
+                            (function(dbg, dbgAddrCur) {
+                                dc.readData(drive, function(b, fAsync) {
+                                    if (b < 0) {
+                                        dbg.println("out of data at address " + dbg.toHexAddr(dbgAddrCur));
+                                        fAbort = true;
+                                        return;
+                                    }
+                                    dbg.setByte(dbgAddrCur, b, 1, true);
+                                    cb++;
+                                });
+                            }(this, dbgAddr));
+                        }
+                        /*
+                         * Call updateCPU() now, since we forced setByte() to defer all updates
+                         */
+                        this.cpu.updateCPU(true);
+                        this.println(cb + " bytes read at " + sAddr);
+                    } else {
+                        this.println("sector " + iSector + " request out of range");
+                    }
+                } else {
+                    this.println("drive " + iDrive + " not loaded");
+                }
+            } else {
+                this.println("invalid drive: " + iDrive);
+            }
+        } else {
+            this.println("disk controller not present");
+        }
+    }
+
+    /**
+     * doMessages(asArgs)
+     *
+     * @this {DebuggerX86}
+     * @param {Array.<string>} asArgs
+     */
+    doMessages(asArgs)
+    {
+        var m;
+        var fCriteria = null;
+        var sCategory = asArgs[1];
+        if (sCategory == '?') sCategory = undefined;
+
+        if (sCategory !== undefined) {
+            var bitsMessage = 0;
+            if (sCategory == "all") {
+                bitsMessage = (0xffffffff|0) & ~(Messages.HALT | Messages.KEYS | Messages.LOG);
+                sCategory = null;
+            } else if (sCategory == "on") {
+                fCriteria = true;
+                sCategory = null;
+            } else if (sCategory == "off") {
+                fCriteria = false;
+                sCategory = null;
+            } else {
+                /*
+                 * Internally, we use "key" instead of "keys", since the latter is a method on JavasScript objects,
+                 * but externally, we allow the user to specify "keys"; "kbd" is also allowed as shorthand for "keyboard".
+                 */
+                if (sCategory == "keys") sCategory = "key";
+                if (sCategory == "kbd") sCategory = "keyboard";
+                for (m in Messages.CATEGORIES) {
+                    if (sCategory == m) {
+                        bitsMessage = Messages.CATEGORIES[m];
+                        fCriteria = !!(this.bitsMessage & bitsMessage);
+                        break;
+                    }
+                }
+                if (!bitsMessage) {
+                    this.println("unknown message category: " + sCategory);
+                    return;
+                }
+            }
+            if (bitsMessage) {
+                if (asArgs[2] == "on") {
+                    this.bitsMessage |= bitsMessage;
+                    fCriteria = true;
+                }
+                else if (asArgs[2] == "off") {
+                    this.bitsMessage &= ~bitsMessage;
+                    fCriteria = false;
+                }
+            }
+        }
+
+        /*
+         * Display those message categories that match the current criteria (on or off)
+         */
+        var n = 0;
+        var sCategories = "";
+        for (m in Messages.CATEGORIES) {
+            if (!sCategory || sCategory == m) {
+                var bitMessage = Messages.CATEGORIES[m];
+                var fEnabled = !!(this.bitsMessage & bitMessage);
+                if (fCriteria !== null && fCriteria != fEnabled) continue;
+                if (sCategories) sCategories += ',';
+                if (!(++n % 10)) sCategories += "\n\t";     // jshint ignore:line
+                /*
+                 * Internally, we use "key" instead of "keys", since the latter is a method on JavasScript objects,
+                 * but externally, we allow the user to specify "keys".
+                 */
+                if (m == "key") m = "keys";
+                sCategories += m;
+            }
+        }
+
+        if (sCategory === undefined) {
+            this.println("message commands:\n\tm [category] [on|off]\tturn categories on/off");
+        }
+
+        this.println((fCriteria !== null? (fCriteria? "messages on:  " : "messages off: ") : "message categories:\n\t") + (sCategories || "none"));
+
+        this.historyInit();     // call this just in case Messages.INT was turned on
+    }
+
+    /**
+     * doMouse(sAction, sDelta)
+     *
+     * When using the "click" action, specify 0 for Mouse.BUTTON.LEFT or 2 for Mouse.BUTTON.RIGHT.
+     *
+     * @this {DebuggerX86}
+     * @param {string} sAction
+     * @param {string} sDelta
+     */
+    doMouse(sAction, sDelta)
+    {
+        if (this.mouse) {
+            var sign = 1;
+            if (sDelta.charAt(0) == '-') {
+                sign = -1;
+                sDelta = sDelta.substr(1);
+            }
+            var n = this.parseValue(sDelta, sAction);
+            if (n === undefined) return;
+            n = (n * sign)|0;
+            switch(sAction) {
+            case "x":
+                this.mouse.moveMouse(n, 0);
+                break;
+            case "y":
+                this.mouse.moveMouse(0, n);
+                break;
+            case "click":
+                this.mouse.clickMouse(n, true);
+                this.mouse.clickMouse(n, false);
+                break;
+            default:
+                this.println("unknown action: " + sAction);
+                break;
+            }
+            return;
+        }
+        this.println("no mouse");
+    }
+
+    /**
+     * doExecOptions(asArgs)
+     *
+     * @this {DebuggerX86}
+     * @param {Array.<string>} asArgs
+     */
+    doExecOptions(asArgs)
+    {
+        if (!asArgs[1] || asArgs[1] == '?') {
+            this.println("execution options:");
+            this.println("\tcs int #\tset checksum cycle interval to #");
+            this.println("\tcs start #\tset checksum cycle start count to #");
+            this.println("\tcs stop #\tset checksum cycle stop count to #");
+            this.println("\tsp #\t\tset speed multiplier to #");
+            return;
+        }
+        switch (asArgs[1]) {
+        case "cs":
+            var nCycles;
+            if (asArgs[3] !== undefined) nCycles = +asArgs[3];          // warning: decimal instead of hex conversion
+            switch (asArgs[2]) {
+                case "int":
+                    this.cpu.aCounts.nCyclesChecksumInterval = nCycles;
+                    break;
+                case "start":
+                    this.cpu.aCounts.nCyclesChecksumStart = nCycles;
+                    break;
+                case "stop":
+                    this.cpu.aCounts.nCyclesChecksumStop = nCycles;
+                    break;
+                default:
+                    this.println("unknown cs option");
+                    return;
+            }
+            if (nCycles !== undefined) {
+                this.cpu.resetChecksum();
+            }
+            this.println("checksums " + (this.cpu.flags.checksum? "enabled" : "disabled"));
+            break;
+        case "sp":
+            if (asArgs[2] !== undefined) {
+                if (!this.cpu.setSpeed(+asArgs[2])) {
+                    this.println("warning: using 1x multiplier, previous target not reached");
+                }
+            }
+            this.println("target speed: " + this.cpu.getSpeedTarget() + " (" + this.cpu.getSpeed() + "x)");
+            break;
+        default:
+            this.println("unknown option: " + asArgs[1]);
+            break;
+        }
+    }
+
+    /**
+     * doOutput(sPort, sByte)
+     *
+     * Simulate a 1-byte port output operation.
+     *
+     * @this {DebuggerX86}
+     * @param {string|undefined} sPort
+     * @param {string|undefined} sByte (string representation of 1 byte)
+     */
+    doOutput(sPort, sByte)
+    {
+        if (!sPort || sPort == '?') {
+            this.println("output commands:");
+            this.println("\to [p] [b]\twrite byte [b] to port [p]");
+            /*
+             * TODO: Regarding this warning, consider adding an "unchecked" version of
+             * bus.checkPortOutputNotify(), since all Debugger memory accesses are unchecked, too.
+             *
+             * All port I/O handlers ARE aware when the Debugger is calling (addrFrom is undefined),
+             * but changing them all to be non-destructive would take time, and situations where you
+             * actually want to affect the hardware state are just as likely as not....
+             */
+            this.println("warning: port accesses can affect hardware state");
+            return;
+        }
+        var port = this.parseValue(sPort, "port #");
+        var bOut = this.parseValue(sByte);
+        if (port !== undefined && bOut !== undefined) {
+            this.bus.checkPortOutputNotify(port, 1, bOut);
+            this.println(Str.toHexWord(port) + ": " + Str.toHexByte(bOut));
+        }
+    }
+
+    /**
+     * doRegisters(asArgs, fInstruction)
+     *
+     * @this {DebuggerX86}
+     * @param {Array.<string>} [asArgs]
+     * @param {boolean} [fInstruction] (true to include the current instruction; default is true)
+     */
+    doRegisters(asArgs, fInstruction)
+    {
+        if (asArgs && asArgs[1] == '?') {
+            this.println("register commands:");
+            this.println("\tr\tdump registers");
+            if (this.fpu) this.println("\trfp\tdump floating-point registers");
+            this.println("\trp\tdump all registers");
+            this.println("\trx [#]\tset flag or register x to [#]");
+            return;
+        }
+
+        var fProt;
+        if (fInstruction == null) fInstruction = true;
+
+        if (asArgs != null && asArgs.length > 1) {
+            var sReg = asArgs[1];
+            if (this.fpu && sReg == "fp") {
+                this.doFPURegisters(asArgs);
+                return;
+            }
+            if (sReg == 'p') {
+                fProt = (this.cpu.model >= X86.MODEL_80286);
+            }
+            else {
+             // fInstruction = false;
+                var sValue = null;
+                var i = sReg.indexOf('=');
+                if (i > 0) {
+                    sValue = sReg.substr(i + 1);
+                    sReg = sReg.substr(0, i);
+                }
+                else if (asArgs.length > 2) {
+                    sValue = asArgs[2];
+                }
+                else {
+                    this.println("missing value for " + asArgs[1]);
+                    return;
+                }
+
+                var w = this.parseExpression(sValue);
+                if (w === undefined) return;
+
+                var fValid = true;
+                var sRegMatch = sReg.toUpperCase();
+                if (sRegMatch.charAt(0) == 'E' && this.cchReg <= 4) {
+                    sRegMatch = null;
+                }
+                switch (sRegMatch) {
+                case "AL":
+                    this.cpu.regEAX = (this.cpu.regEAX & ~0xff) | (w & 0xff);
+                    break;
+                case "AH":
+                    this.cpu.regEAX = (this.cpu.regEAX & ~0xff00) | ((w << 8) & 0xff);
+                    break;
+                case "AX":
+                    this.cpu.regEAX = (this.cpu.regEAX & ~0xffff) | (w & 0xffff);
+                    break;
+                case "BL":
+                    this.cpu.regEBX = (this.cpu.regEBX & ~0xff) | (w & 0xff);
+                    break;
+                case "BH":
+                    this.cpu.regEBX = (this.cpu.regEBX & ~0xff00) | ((w << 8) & 0xff);
+                    break;
+                case "BX":
+                    this.cpu.regEBX = (this.cpu.regEBX & ~0xffff) | (w & 0xffff);
+                    break;
+                case "CL":
+                    this.cpu.regECX = (this.cpu.regECX & ~0xff) | (w & 0xff);
+                    break;
+                case "CH":
+                    this.cpu.regECX = (this.cpu.regECX & ~0xff00) | ((w << 8) & 0xff);
+                    break;
+                case "CX":
+                    this.cpu.regECX = (this.cpu.regECX & ~0xffff) | (w & 0xffff);
+                    break;
+                case "DL":
+                    this.cpu.regEDX = (this.cpu.regEDX & ~0xff) | (w & 0xff);
+                    break;
+                case "DH":
+                    this.cpu.regEDX = (this.cpu.regEDX & ~0xff00) | ((w << 8) & 0xff);
+                    break;
+                case "DX":
+                    this.cpu.regEDX = (this.cpu.regEDX & ~0xffff) | (w & 0xffff);
+                    break;
+                case "SP":
+                    this.cpu.setSP((this.cpu.getSP() & ~0xffff) | (w & 0xffff));
+                    break;
+                case "BP":
+                    this.cpu.regEBP = (this.cpu.regEBP & ~0xffff) | (w & 0xffff);
+                    break;
+                case "SI":
+                    this.cpu.regESI = (this.cpu.regESI & ~0xffff) | (w & 0xffff);
+                    break;
+                case "DI":
+                    this.cpu.regEDI = (this.cpu.regEDI & ~0xffff) | (w & 0xffff);
+                    break;
+                /*
+                 * DANGER: For any of the segment loads below, by going through the normal CPU
+                 * segment load procedure, you run the risk of generating a fault in the machine
+                 * if you're not careful.  So, um, be careful.
+                 */
+                case "DS":
+                    this.cpu.setDS(w);
+                    break;
+                case "ES":
+                    this.cpu.setES(w);
+                    break;
+                case "SS":
+                    this.cpu.setSS(w);
+                    break;
+                case "CS":
+                 // fInstruction = true;
+                    this.cpu.setCS(w);
+                    this.dbgAddrNextCode = this.newAddr(this.cpu.getIP(), this.cpu.getCS());
+                    break;
+                case "IP":
+                case "EIP":
+                 // fInstruction = true;
+                    this.cpu.setIP(w);
+                    this.dbgAddrNextCode = this.newAddr(this.cpu.getIP(), this.cpu.getCS());
+                    break;
+                /*
+                 * I used to alias "PC" (Program Counter) to "IP" (Instruction Pointer), because in PC-DOS 1.00
+                 * through 2.10, DEBUG.COM did the same thing.  Then I discovered that, starting with PC-DOS 3.00,
+                 * DEBUG.COM changed "PC" to refer to the 16-bit flags register (Program or Processor Control?)
+                 * I've elected to go for PC-DOS 3.00+ compatibility, since that will be more widely known.
+                 *
+                 * PCx86 prefers "PS" (Processor Status) for accessing the FLAGS register in its 16-bit (or 32-bit)
+                 * entirety.  Individual flag bits can also be accessed as 1-bit registers, using the names shown
+                 * below ("C", "P", "A", "Z", etc.)
+                 */
+                case "PC":
+                case "PS":
+                    this.cpu.setPS(w);
+                    break;
+                case 'C':
+                    if (w) this.cpu.setCF(); else this.cpu.clearCF();
+                    break;
+                case 'P':
+                    if (w) this.cpu.setPF(); else this.cpu.clearPF();
+                    break;
+                case 'A':
+                    if (w) this.cpu.setAF(); else this.cpu.clearAF();
+                    break;
+                case 'Z':
+                    if (w) this.cpu.setZF(); else this.cpu.clearZF();
+                    break;
+                case 'S':
+                    if (w) this.cpu.setSF(); else this.cpu.clearSF();
+                    break;
+                case 'I':
+                    if (w) this.cpu.setIF(); else this.cpu.clearIF();
+                    break;
+                case 'D':
+                    if (w) this.cpu.setDF(); else this.cpu.clearDF();
+                    break;
+                case 'V':
+                    if (w) this.cpu.setOF(); else this.cpu.clearOF();
+                    break;
+                default:
+                    var fUnknown = true;
+                    if (this.cpu.model >= X86.MODEL_80286) {
+                        fUnknown = false;
+                        switch(sRegMatch){
+                        case "MS":
+                            this.cpu.setMSW(w);
+                            break;
+                        case "TR":
+                            /*
+                             * DANGER: Like any of the segment loads above, by going through the normal CPU
+                             * segment load procedure, you run the risk of generating a fault in the machine
+                             * if you're not careful.  So, um, be careful.
+                             */
+                            if (this.cpu.segTSS.load(w) === X86.ADDR_INVALID) {
+                                fValid = false;
+                            }
+                            break;
+                        /*
+                         * TODO: Add support for GDTR (addr and limit), IDTR (addr and limit), and perhaps
+                         * even the ability to edit descriptor information associated with each segment register.
+                         */
+                        default:
+                            fUnknown = true;
+                            if (I386 && this.cpu.model >= X86.MODEL_80386) {
+                                fUnknown = false;
+                                switch(sRegMatch){
+                                case "EAX":
+                                    this.cpu.regEAX = w;
+                                    break;
+                                case "EBX":
+                                    this.cpu.regEBX = w;
+                                    break;
+                                case "ECX":
+                                    this.cpu.regECX = w;
+                                    break;
+                                case "EDX":
+                                    this.cpu.regEDX = w;
+                                    break;
+                                case "ESP":
+                                    this.cpu.setSP(w);
+                                    break;
+                                case "EBP":
+                                    this.cpu.regEBP = w;
+                                    break;
+                                case "ESI":
+                                    this.cpu.regESI = w;
+                                    break;
+                                case "EDI":
+                                    this.cpu.regEDI = w;
+                                    break;
+                                /*
+                                 * DANGER: For any of the segment loads below, by going through the normal CPU
+                                 * segment load procedure, you run the risk of generating a fault in the machine
+                                 * if you're not careful.  So, um, be careful.
+                                 */
+                                case "FS":
+                                    this.cpu.setFS(w);
+                                    break;
+                                case "GS":
+                                    this.cpu.setGS(w);
+                                    break;
+                                case "CR0":
+                                    this.cpu.regCR0 = w;
+                                    X86.helpLoadCR0.call(this.cpu, w);
+                                    break;
+                                case "CR2":
+                                    this.cpu.regCR2 = w;
+                                    break;
+                                case "CR3":
+                                    this.cpu.regCR3 = w;
+                                    X86.helpLoadCR3.call(this.cpu, w);
+                                    break;
+                                /*
+                                 * TODO: Add support for DR0-DR7 and TR6-TR7.
+                                 */
+                                default:
+                                    fUnknown = true;
+                                    break;
+                                }
+                            }
+                            break;
+                        }
+                    }
+                    if (fUnknown) {
+                        this.println("unknown register: " + sReg);
+                        return;
+                    }
+                }
+                if (!fValid) {
+                    this.println("invalid value: " + sValue);
+                    return;
+                }
+                this.cpu.updateCPU();
+                this.println("updated registers:");
+            }
+        }
+
+        this.println(this.getRegDump(fProt));
+
+        if (fInstruction) {
+            this.dbgAddrNextCode = this.newAddr(this.cpu.getIP(), this.cpu.getCS());
+            this.doUnassemble(this.toHexAddr(this.dbgAddrNextCode));
+        }
+    }
+
+    /**
+     * doFPURegisters(asArgs)
+     *
+     * NOTE: If we're called, the existence of an FPU has already been verified.
+     *
+     * @this {DebuggerX86}
+     * @param {Array.<string>} [asArgs]
+     */
+    doFPURegisters(asArgs)
+    {
+        var fpu = this.fpu;
+
+        var wStatus = fpu.getStatus(), wControl = fpu.getControl();
+        for (var i = 0; i < 8; i++) {
+            var a = fpu.readFPUStack(i);
+            if (!a) break;
+            var sValue = Str.pad(a[2].toFixed(15), 24, true);
+            this.println("ST" + i + ": " + sValue + "  " + Str.toHex(a[4]) + "," + Str.toHex(a[3]) + "  [" + a[0] + ":" + DebuggerX86.FPU_TAGS[a[1]] + "]");
+            // this.println("  REG" + a[0] + " " + Str.toBin(a[7], 16) + Str.toBin(a[6]) + Str.toBin(a[5]));
+        }
+        this.println("    B3SSS210ESPUOZDI               xxxIRRPPIxPUOZDI");
+        this.println("SW: " + Str.toBin(wStatus, 16) + " (" + Str.toHexWord(wStatus) + ")  CW: " + Str.toBin(wControl, 16) + " (" + Str.toHexWord(wControl) + ")");
+    }
+
+    /**
+     * doRun(sCmd, sAddr, sOptions, fQuiet)
+     *
+     * @this {DebuggerX86}
+     * @param {string} sCmd
+     * @param {string|undefined} [sAddr]
+     * @param {string} [sOptions] (the rest of the breakpoint command-line)
+     * @param {boolean} [fQuiet]
+     */
+    doRun(sCmd, sAddr, sOptions, fQuiet)
+    {
+        if (sCmd == "gt") {
+            this.fIgnoreNextCheckFault = true;
+        }
+        if (sAddr !== undefined) {
+            var dbgAddr = this.parseAddr(sAddr, true);
+            if (!dbgAddr) return;
+            this.parseAddrOptions(dbgAddr, sOptions);
+            this.setTempBreakpoint(dbgAddr);
+        }
+        if (!this.runCPU(true)) {
+            if (!fQuiet) this.println("cpu busy or unavailable, run command ignored");
+        }
+    }
+
+    /**
+     * doPrint(sCmd)
+     *
+     * NOTE: If the string to print is a quoted string, then we run it through replaceRegs(), so that
+     * you can take advantage of all the special replacement options used for software interrupt logging.
+     *
+     * @this {DebuggerX86}
+     * @param {string} sCmd
+     */
+    doPrint(sCmd)
+    {
+        sCmd = Str.trim(sCmd);
+        var a = sCmd.match(/^(['"])(.*?)\1$/);
+        if (!a) {
+            this.parseExpression(sCmd, false);
+        } else {
+            this.println(this.replaceRegs(a[2]));
+        }
+    }
+
+    /**
+     * doStep(sCmd)
+     *
+     * @this {DebuggerX86}
+     * @param {string} [sCmd] "p" or "pr"
+     */
+    doStep(sCmd)
+    {
+        var fCallStep = true;
+        var nRegs = (sCmd == "pr"? 1 : 0);
+        /*
+         * Set up the value for this.nStep (ie, 1 or 2) depending on whether the user wants
+         * a subsequent register dump ("pr") or not ("p").
+         */
+        var nStep = 1 + nRegs;
+        if (!this.nStep) {
+            var fPrefix;
+            var fRepeat = false;
+            var dbgAddr = this.newAddr(this.cpu.getIP(), this.cpu.getCS());
+            do {
+                fPrefix = false;
+                var bOpcode = this.getByte(dbgAddr);
+                switch (bOpcode) {
+                case X86.OPCODE.ES:
+                case X86.OPCODE.CS:
+                case X86.OPCODE.SS:
+                case X86.OPCODE.DS:
+                case X86.OPCODE.FS:     // I386 only
+                case X86.OPCODE.GS:     // I386 only
+                case X86.OPCODE.OS:     // I386 only
+                case X86.OPCODE.AS:     // I386 only
+                case X86.OPCODE.LOCK:
+                    this.incAddr(dbgAddr, 1);
+                    fPrefix = true;
+                    break;
+                case X86.OPCODE.INT3:
+                case X86.OPCODE.INTO:
+                    this.nStep = nStep;
+                    this.incAddr(dbgAddr, 1);
+                    break;
+                case X86.OPCODE.INTN:
+                case X86.OPCODE.LOOPNZ:
+                case X86.OPCODE.LOOPZ:
+                case X86.OPCODE.LOOP:
+                    this.nStep = nStep;
+                    this.incAddr(dbgAddr, dbgAddr.fData32? 4 : 2);
+                    break;
+                case X86.OPCODE.CALL:
+                    if (fCallStep) {
+                        this.nStep = nStep;
+                        this.incAddr(dbgAddr, dbgAddr.fData32? 5 : 3);
+                    }
+                    break;
+                case X86.OPCODE.CALLF:
+                    if (fCallStep) {
+                        this.nStep = nStep;
+                        this.incAddr(dbgAddr, dbgAddr.fData32? 7 : 5);
+                    }
+                    break;
+                case X86.OPCODE.GRP4W:
+                    if (fCallStep) {
+                        var w = this.getWord(dbgAddr) & X86.OPCODE.CALLMASK;
+                        if (w == X86.OPCODE.CALLW || w == X86.OPCODE.CALLFDW) {
+                            this.nStep = nStep;
+                            this.getInstruction(dbgAddr);       // advance dbgAddr past this variable-length CALL
+                        }
+                    }
+                    break;
+                case X86.OPCODE.REPZ:
+                case X86.OPCODE.REPNZ:
+                    this.incAddr(dbgAddr, 1);
+                    fRepeat = fPrefix = true;
+                    break;
+                case X86.OPCODE.INSB:
+                case X86.OPCODE.INSW:
+                case X86.OPCODE.OUTSB:
+                case X86.OPCODE.OUTSW:
+                case X86.OPCODE.MOVSB:
+                case X86.OPCODE.MOVSW:
+                case X86.OPCODE.CMPSB:
+                case X86.OPCODE.CMPSW:
+                case X86.OPCODE.STOSB:
+                case X86.OPCODE.STOSW:
+                case X86.OPCODE.LODSB:
+                case X86.OPCODE.LODSW:
+                case X86.OPCODE.SCASB:
+                case X86.OPCODE.SCASW:
+                    if (fRepeat) {
+                        this.nStep = nStep;
+                        this.incAddr(dbgAddr, 1);
+                    }
+                    break;
+                default:
+                    break;
+                }
+            } while (fPrefix);
+
+            if (this.nStep) {
+                this.setTempBreakpoint(dbgAddr);
+                if (!this.runCPU()) {
+                    if (this.cmp) this.cmp.updateFocus();
+                    this.nStep = 0;
+                }
+                /*
+                 * A successful run will ultimately call stop(), which will in turn call clearTempBreakpoint(),
+                 * which will clear nStep, so there's your assurance that nStep will be reset.  Now we may have
+                 * stopped for reasons unrelated to the temporary breakpoint, but that's OK.
+                 */
+            } else {
+                this.doTrace(nRegs? "tr" : "t");
+            }
+        } else {
+            this.println("step in progress");
+        }
+    }
+
+    /**
+     * getCall(dbgAddr, fFar)
+     *
+     * Given a possible return address (typically from the stack), look for a matching CALL (or INT) that
+     * immediately precedes that address.
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr
+     * @param {boolean} [fFar]
+     * @return {string|null} CALL instruction at or near dbgAddr, or null if none
+     */
+    getCall(dbgAddr, fFar)
+    {
+        var sCall = null;
+        var off = dbgAddr.off;
+        var offOrig = off;
+        for (var n = 1; n <= 6 && !!off; n++) {
+            if (n > 2) {
+                dbgAddr.off = off;
+                dbgAddr.addr = null;
+                var s = this.getInstruction(dbgAddr);
+                if (s.indexOf("CALL") >= 0 || fFar && s.indexOf("INT") >= 0) {
+                    /*
+                     * Verify that the length of this CALL (or INT), when added to the address of the CALL (or INT),
+                     * matches the original return address.  We do this by getting the string index of the opcode bytes,
+                     * subtracting that from the string index of the next space, and dividing that difference by two,
+                     * to yield the length of the CALL (or INT) instruction, in bytes.
+                     */
+                    var i = s.indexOf(' ');
+                    var j = s.indexOf(' ', i+1);
+                    if (off + (j - i - 1)/2 == offOrig) {
+                        sCall = s;
+                        break;
+                    }
+                }
+            }
+            off--;
+        }
+        dbgAddr.off = offOrig;
+        return sCall;
+    }
+
+    /**
+     * doStackTrace(sCmd, sAddr)
+     *
+     * Use "k" for a normal stack trace and "ks" for a stack trace with symbolic info.
+     *
+     * @this {DebuggerX86}
+     * @param {string} [sCmd]
+     * @param {string} [sAddr] (not used yet)
+     */
+    doStackTrace(sCmd, sAddr)
+    {
+        if (sAddr == '?') {
+            this.println("stack trace commands:");
+            this.println("\tk\tshow frame addresses");
+            this.println("\tks\tshow symbol information");
+            return;
+        }
+
+        var nFrames = 10, cFrames = 0;
+        var selCode = this.cpu.segCS.sel;
+        var dbgAddrCall = this.newAddr();
+        var dbgAddrStack = this.newAddr(this.cpu.getSP(), this.cpu.getSS());
+        this.println("stack trace for " + this.toHexAddr(dbgAddrStack));
+
+        while (cFrames < nFrames) {
+            var sCall = null, sCallPrev = null, cTests = 256;
+            while ((dbgAddrStack.off >>> 0) < (this.cpu.regLSPLimit >>> 0)) {
+                dbgAddrCall.off = this.getWord(dbgAddrStack, true);
+                /*
+                 * Because we're using the auto-increment feature of getWord(), and because that will automatically
+                 * wrap the offset around the end of the segment, we must also check the addr property to detect the wrap.
+                 */
+                if (dbgAddrStack.addr == null || !cTests--) break;
+                dbgAddrCall.sel = selCode;
+                sCall = this.getCall(dbgAddrCall);
+                if (sCall) break;
+                dbgAddrCall.sel = this.getWord(dbgAddrStack);
+                sCall = this.getCall(dbgAddrCall, true);
+                if (sCall) {
+                    selCode = this.getWord(dbgAddrStack, true);
+                    /*
+                     * It's not strictly necessary that we skip over the flags word that's pushed as part of any INT
+                     * instruction, but it reduces the risk of misinterpreting it as a return address on the next iteration.
+                     */
+                    if (sCall.indexOf("INT") > 0) this.getWord(dbgAddrStack, true);
+                    break;
+                }
+            }
+            /*
+             * The sCallPrev check eliminates duplicate sequential calls, which are usually (but not always)
+             * indicative of a false positive, in which case the previous call is probably bogus as well, but
+             * at least we won't duplicate that mistake.  Of course, there are always exceptions, recursion
+             * being one of them, but it's rare that we're debugging recursive code.
+             */
+            if (!sCall || sCall == sCallPrev) break;
+            var sSymbol = null;
+            if (sCmd == "ks") {
+                var a = sCall.match(/[0-9A-F]+$/);
+                if (a) sSymbol = this.doList(a[0]);
+            }
+            sCall = Str.pad(sCall, 50) + "  ;" + (sSymbol || "stack=" + this.toHexAddr(dbgAddrStack)); // + " return=" + this.toHexAddr(dbgAddrCall));
+            this.println(sCall);
+            sCallPrev = sCall;
+            cFrames++;
+        }
+        if (!cFrames) this.println("no return addresses found");
+    }
+
+    /**
+     * doTrace(sCmd, sCount)
+     *
+     * The "t" and "tr" commands interpret the count as a number of instructions, and since
+     * we call the Debugger's stepCPU() for each iteration, a single instruction includes
+     * any/all prefixes; the CPU's stepCPU() treats prefixes as discrete operations.  The only
+     * difference between "t" and "tr": the former displays only the next instruction, while
+     * the latter also displays the (updated) registers.
+     *
+     * The "tc" command interprets the count as a number of cycles rather than instructions,
+     * allowing you to quickly execute large chunks of instructions with a single command; it
+     * doesn't display anything until the the chunk has finished.
+     *
+     * However, generally a more useful command is "bn", which allows you to break after some
+     * number of instructions have been executed (as opposed to some number of cycles).
+     *
+     * @this {DebuggerX86}
+     * @param {string} [sCmd] ("t", "tc", or "tr")
+     * @param {string} [sCount] # of instructions to step
+     */
+    doTrace(sCmd, sCount)
+    {
+        var dbg = this;
+        var fRegs = (sCmd != "t");
+        var nCount = this.parseValue(sCount, null, true) || 1;
+        var nCycles = (nCount == 1? 0 : 1);
+        if (sCmd == "tc") {
+            nCycles = nCount;
+            nCount = 1;
+        }
+        Web.onCountRepeat(
+            nCount,
+            function onCountStep() {
+                return dbg.setBusy(true) && dbg.stepCPU(nCycles, fRegs, false);
+            },
+            function onCountStepComplete() {
+                /*
+                 * We explicitly called stepCPU() with fUpdateCPU === false, because repeatedly
+                 * calling updateCPU() can be very slow, especially when fDisplayLiveRegs is true,
+                 * so once the repeat count has been exhausted, we must perform a final updateCPU().
+                 */
+                dbg.cpu.updateCPU();
+                dbg.setBusy(false);
+            }
+        );
+    }
+
+    /**
+     * initAddrSize(dbgAddr, fComplete, cOverrides)
+     *
+     * @this {DebuggerX86}
+     * @param {DbgAddrX86} dbgAddr
+     * @param {boolean} fComplete
+     * @param {number} [cOverrides]
+     */
+    initAddrSize(dbgAddr, fComplete, cOverrides)
+    {
+        /*
+         * We use dbgAddr.fComplete to record whether or not the caller (ie, getInstruction())
+         * processed a complete instruction.
+         */
+        dbgAddr.fComplete = fComplete;
+        /*
+         * For proper disassembly of instructions preceded by an OPERAND (0x66) size prefix, we set
+         * dbgAddr.fData32 to true whenever the operand size is 32-bit; similarly, for an ADDRESS (0x67)
+         * size prefix, we set dbgAddr.fAddr32 to true whenever the address size is 32-bit.
+         *
+         * Initially (and every time we've processed a complete instruction), both fields must be
+         * set to their original value.
+         */
+        if (fComplete) {
+            if (dbgAddr.fData32Orig != null) dbgAddr.fData32 = dbgAddr.fData32Orig;
+            if (dbgAddr.fAddr32Orig != null) dbgAddr.fAddr32 = dbgAddr.fAddr32Orig;
+            dbgAddr.fData32Orig = dbgAddr.fData32;
+            dbgAddr.fAddr32Orig = dbgAddr.fAddr32;
+        }
+        /*
+         * Use cOverrides to record whether we previously processed any OPERAND or ADDRESS overrides.
+         */
+        dbgAddr.cOverrides = cOverrides || 0;
+    }
+
+    /**
+     * isStringIns(bOpcode)
+     *
+     * @this {DebuggerX86}
+     * @param {number} bOpcode
+     * @return {boolean} true if string instruction, false if not
+     */
+    isStringIns(bOpcode)
+    {
+        return (bOpcode >= X86.OPCODE.MOVSB && bOpcode <= X86.OPCODE.CMPSW || bOpcode >= X86.OPCODE.STOSB && bOpcode <= X86.OPCODE.SCASW);
+    }
+
+    /**
+     * doUnassemble(sAddr, sAddrEnd, n)
+     *
+     * @this {DebuggerX86}
+     * @param {string} [sAddr]
+     * @param {string} [sAddrEnd]
+     * @param {number} [n]
+     */
+    doUnassemble(sAddr, sAddrEnd, n)
+    {
+        var dbgAddr = this.parseAddr(sAddr, true);
+        if (!dbgAddr) return;
+
+        if (n === undefined) n = 1;
+
+        var cb = 0x100;
+        if (sAddrEnd !== undefined) {
+
+            var dbgAddrEnd = this.parseAddr(sAddrEnd, true);
+            if (!dbgAddrEnd || dbgAddrEnd.off < dbgAddr.off) return;
+
+            cb = dbgAddrEnd.off - dbgAddr.off;
+            if (!DEBUG && cb > 0x100) {
+                /*
+                 * Limiting the amount of disassembled code to 256 bytes in non-DEBUG builds is partly to
+                 * prevent the user from wedging the browser by dumping too many lines, but also a recognition
+                 * that, in non-DEBUG builds, this.println() keeps print output buffer truncated to 8Kb anyway.
+                 */
+                this.println("range too large");
+                return;
+            }
+            n = -1;
+        }
+
+        var cLines = 0;
+        var sInstruction;
+        this.initAddrSize(dbgAddr, true);
+
+        while (cb > 0 && n--) {
+
+            var nSequence = (this.isBusy(false) || this.nStep)? this.nCycles : null;
+            var sComment = (nSequence != null? "cycles" : null);
+            var aSymbol = this.findSymbol(dbgAddr);
+
+            var addr = dbgAddr.addr;    // we snap dbgAddr.addr *after* calling findSymbol(), which re-evaluates it
+
+            if (aSymbol[0] && n) {
+                if (!cLines && n || aSymbol[0].indexOf('+') < 0) {
+                    var sLabel = aSymbol[0] + ':';
+                    if (aSymbol[2]) sLabel += ' ' + aSymbol[2];
+                    this.println(sLabel);
+                }
+            }
+
+            if (aSymbol[3]) {
+                sComment = aSymbol[3];
+                nSequence = null;
+            }
+
+            sInstruction = this.getInstruction(dbgAddr, sComment, nSequence);
+
+            /*
+             * If getInstruction() reported that it did not process a complete instruction (via dbgAddr.fComplete),
+             * then bump the instruction count by one, so that we display one more line (and hopefully the complete
+             * instruction).
+             */
+            if (!dbgAddr.fComplete && !n) n++;
+
+            this.println(sInstruction);
+            this.dbgAddrNextCode = dbgAddr;
+            cb -= dbgAddr.addr - addr;
+            cLines++;
+        }
+    }
+
+    /**
+     * parseCommand(sCmd, fSave, chSep)
+     *
+     * @this {DebuggerX86}
+     * @param {string|undefined} sCmd
+     * @param {boolean} [fSave] is true to save the command, false if not
+     * @param {string} [chSep] is the command separator character (default is ';')
+     * @return {Array.<string>}
+     */
+    parseCommand(sCmd, fSave, chSep)
+    {
+        if (fSave) {
+            if (!sCmd) {
+                sCmd = this.aPrevCmds[this.iPrevCmd+1];
+            } else {
+                if (this.iPrevCmd < 0 && this.aPrevCmds.length) {
+                    this.iPrevCmd = 0;
+                }
+                if (this.iPrevCmd < 0 || sCmd != this.aPrevCmds[this.iPrevCmd]) {
+                    this.aPrevCmds.splice(0, 0, sCmd);
+                    this.iPrevCmd = 0;
+                }
+                this.iPrevCmd--;
+            }
+        }
+        var a = [];
+        if (sCmd) {
+            /*
+             * With the introduction of breakpoint commands (ie, quoted command sequences
+             * associated with a breakpoint), we can no longer perform simplistic splitting.
+             *
+             *      a = sCmd.split(chSep || ';');
+             *      for (var i = 0; i < a.length; i++) a[i] = Str.trim(a[i]);
+             *
+             * We may now split on semi-colons ONLY if they are outside a quoted sequence.
+             *
+             * Also, to allow quoted strings *inside* breakpoint commands, we first replace all
+             * DOUBLE double-quotes with single quotes.
+             */
+            sCmd = sCmd.toLowerCase().replace(/""/g, "'");
+
+            var iPrev = 0;
+            var chQuote = null;
+            chSep = chSep || ';';
+            /*
+             * NOTE: Processing charAt() up to and INCLUDING length is not a typo; we're taking
+             * advantage of the fact that charAt() with an invalid index returns an empty string,
+             * allowing us to use the same substring() call to capture the final portion of sCmd.
+             *
+             * In a sense, it allows us to pretend that the string ends with a zero terminator.
+             */
+            for (var i = 0; i <= sCmd.length; i++) {
+                var ch = sCmd.charAt(i);
+                if (ch == '"' || ch == "'") {
+                    if (!chQuote) {
+                        chQuote = ch;
+                    } else if (ch == chQuote) {
+                        chQuote = null;
+                    }
+                }
+                else if (ch == chSep && !chQuote || !ch) {
+                    /*
+                     * Recall that substring() accepts starting (inclusive) and ending (exclusive)
+                     * indexes, whereas substr() accepts a starting index and a length.  We need the former.
+                     */
+                    a.push(Str.trim(sCmd.substring(iPrev, i)));
+                    iPrev = i + 1;
+                }
+            }
+        }
+        return a;
+    }
+
+    /**
+     * shiftArgs(asArgs)
+     *
+     * Used with any command (eg, "r") that allows but doesn't require whitespace between command and first argument.
+     *
+     * @this {DebuggerX86}
+     * @param {Array.<string>} asArgs
+     * @return {Array.<string>}
+     */
+    shiftArgs(asArgs)
+    {
+        if (asArgs && asArgs.length) {
+            var s0 = asArgs[0];
+            var ch0 = s0.charAt(0);
+            for (var i = 1; i < s0.length; i++) {
+                var ch = s0.charAt(i);
+                if (ch0 == '?' || ch0 == 'r' || ch < 'a' || ch > 'z') {
+                    asArgs[0] = s0.substr(i);
+                    asArgs.unshift(s0.substr(0, i));
+                    break;
+                }
+            }
+        }
+        return asArgs;
+    }
+
+    /**
+     * doCommand(sCmd, fQuiet)
+     *
+     * @this {DebuggerX86}
+     * @param {string} sCmd
+     * @param {boolean} [fQuiet]
+     * @return {boolean} true if command processed, false if unrecognized
+     */
+    doCommand(sCmd, fQuiet)
+    {
+        var result = true;
+
+        try {
+            if (!sCmd.length || sCmd == "end") {
+                if (this.fAssemble) {
+                    this.println("ended assemble at " + this.toHexAddr(this.dbgAddrAssemble));
+                    this.dbgAddrNextCode = this.dbgAddrAssemble;
+                    this.fAssemble = false;
+                }
+                sCmd = "";
+            }
+            else if (!fQuiet) {
+                var sPrompt = ">> ";
+                if (this.cpu.regCR0 & X86.CR0.MSW.PE) {
+                    sPrompt = (this.cpu.regPS & X86.PS.VM)? "-- " : "## ";
+                }
+                this.println(sPrompt + sCmd);
+            }
+
+            var ch = sCmd.charAt(0);
+            if (ch == '"' || ch == "'") return true;
+
+            /*
+             * Zap the previous message buffer to ensure the new command's output is not tossed out as a repeat.
+             */
+            this.sMessagePrev = null;
+
+            /*
+             * I've relaxed the !isBusy() requirement, to maximize our ability to issue Debugger commands externally.
+             */
+            if (this.isReady() /* && !this.isBusy(true) */ && sCmd.length > 0) {
+
+                if (this.fAssemble) {
+                    sCmd = "a " + this.toHexAddr(this.dbgAddrAssemble) + ' ' + sCmd;
+                }
+
+                var asArgs = this.shiftArgs(sCmd.replace(/ +/g, ' ').split(' '));
+
+                switch (asArgs[0].charAt(0)) {
+                case 'a':
+                    this.doAssemble(asArgs);
+                    break;
+                case 'b':
+                    this.doBreak(asArgs[0], asArgs[1], sCmd);
+                    break;
+                case 'c':
+                    this.doClear(asArgs[0]);
+                    break;
+                case 'd':
+                    if (!PCX86.COMPILED && sCmd == "debug") {
+                        window.DEBUG = true;
+                        this.println("DEBUG checks on");
+                        break;
+                    }
+                    this.doDump(asArgs);
+                    break;
+                case 'e':
+                    if (asArgs[0] == "else") break;
+                    this.doEdit(asArgs);
+                    break;
+                case 'f':
+                    this.doFreqs(asArgs[1]);
+                    break;
+                case 'g':
+                    this.doRun(asArgs[0], asArgs[1], sCmd, fQuiet);
+                    break;
+                case 'h':
+                    this.doHalt(fQuiet);
+                    break;
+                case 'i':
+                    if (asArgs[0] == "if") {
+                        if (!this.doIf(sCmd.substr(2), fQuiet)) {
+                            result = false;
+                        }
+                        break;
+                    }
+                    if (asArgs[0] == "int") {
+                        if (!this.doInt(asArgs[1])) {
+                            result = false;
+                        }
+                        break;
+                    }
+                    this.doInput(asArgs[1]);
+                    break;
+                case 'k':
+                    this.doStackTrace(asArgs[0], asArgs[1]);
+                    break;
+                case 'l':
+                    if (asArgs[0] == "ln") {
+                        this.doList(asArgs[1], true);
+                        break;
+                    }
+                    this.doLoad(asArgs);
+                    break;
+                case 'm':
+                    if (asArgs[0] == "mouse") {
+                        this.doMouse(asArgs[1], asArgs[2]);
+                        break;
+                    }
+                    this.doMessages(asArgs);
+                    break;
+                case 'o':
+                    this.doOutput(asArgs[1], asArgs[2]);
+                    break;
+                case 'p':
+                    if (asArgs[0] == "print") {
+                        this.doPrint(sCmd.substr(5));
+                        break;
+                    }
+                    this.doStep(asArgs[0]);
+                    break;
+                case 'r':
+                    if (sCmd == "reset") {
+                        if (this.cmp) this.cmp.reset();
+                        break;
+                    }
+                    this.doRegisters(asArgs);
+                    break;
+                case 't':
+                    this.doTrace(asArgs[0], asArgs[1]);
+                    break;
+                case 'u':
+                    this.doUnassemble(asArgs[1], asArgs[2], 8);
+                    break;
+                case 'v':
+                    if (asArgs[0] == "var") {
+                        if (!this.doVar(sCmd.substr(3))) {
+                            result = false;
+                        }
+                        break;
+                    }
+                    this.println((PCX86.APPNAME || "PCx86") + " version " + (XMLVERSION || PCX86.APPVERSION) + " (" + this.cpu.model + (PCX86.COMPILED? ",RELEASE" : (PCX86.DEBUG? ",DEBUG" : ",NODEBUG")) + (PCX86.PREFETCH? ",PREFETCH" : ",NOPREFETCH") + (PCX86.TYPEDARRAYS? ",TYPEDARRAYS" : (PCX86.BYTEARRAYS? ",BYTEARRAYS" : ",LONGARRAYS")) + (PCX86.BACKTRACK? ",BACKTRACK" : ",NOBACKTRACK") + ')');
+                    this.println(Web.getUserAgent());
+                    break;
+                case 'x':
+                    this.doExecOptions(asArgs);
+                    break;
+                case '?':
+                    if (asArgs[1]) {
+                        this.doPrint(sCmd.substr(1));
+                        break;
+                    }
+                    this.doHelp();
+                    break;
+                case 'n':
+                    if (!PCX86.COMPILED && sCmd == "nodebug") {
+                        window.DEBUG = false;
+                        this.println("DEBUG checks off");
+                        break;
+                    }
+                    if (this.doInfo(asArgs)) break;
+                    /* falls through */
+                default:
+                    this.println("unknown command: " + sCmd);
+                    result = false;
+                    break;
+                }
+            }
+        } catch(e) {
+            this.println("debugger error: " + (e.stack || e.message));
+            result = false;
+        }
+        return result;
+    }
+
+    /**
+     * doCommands(sCmds, fSave)
+     *
+     * @this {DebuggerX86}
+     * @param {string} sCmds
+     * @param {boolean} [fSave]
+     * @return {boolean} true if all commands processed, false if not
+     */
+    doCommands(sCmds, fSave)
+    {
+        var a = this.parseCommand(sCmds, fSave);
+        for (var s in a) {
+            if (!this.doCommand(a[+s])) return false;
+        }
+        return true;
+    }
+
+    /**
+     * DebuggerX86.init()
+     *
+     * This function operates on every HTML element of class "debugger", extracting the
+     * JSON-encoded parameters for the Debugger constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a Debugger component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeDbg = Component.getElementsByClass(document, PCX86.APPCLASS, "debugger");
+        for (var iDbg = 0; iDbg < aeDbg.length; iDbg++) {
+            var eDbg = aeDbg[iDbg];
+            var parmsDbg = Component.getComponentParms(eDbg);
+            var dbg = new DebuggerX86(parmsDbg);
+            Component.bindComponentControls(dbg, eDbg, PCX86.APPCLASS);
+        }
+    }
+}
+
+if (DEBUGGER) {
+
+    /*
+     * NOTE: The Debugger properties below are considered "class constants"; most of them use our "all-caps"
+     * convention (and all of them SHOULD, but that wouldn't help us catch any bugs).
+     *
+     * Technically, all of them should ALSO be preceded by a "@const" annotation, but that's a lot of work and it
+     * really clutters the code.  I wish the Closure Compiler had a way to annotate every definition with a given
+     * section with a single annotation....
+     *
+     * Bugs can slip through the cracks without those annotations; for example, I unthinkingly redefined TYPE_SI
+     * at one point, and if all the definitions had been preceded by an "@const", that mistake would have been
+     * caught at compile-time.
+     */
+
+    /*
+     * Information regarding interrupts of interest (used by messageInt() and others)
+     */
+    DebuggerX86.INT_MESSAGES = {
+        0x10:       Messages.VIDEO,
+        0x13:       Messages.FDC,
+        0x15:       Messages.CHIPSET,
+        0x16:       Messages.KEYBOARD,
+     // 0x1A:       Messages.RTC,       // ChipSet contains its own custom messageInt() handler for the RTC
+        0x1C:       Messages.TIMER,
+        0x21:       Messages.DOS,
+        0x33:       Messages.MOUSE
+    };
+
+    /*
+     * Information regarding "annoying" interrupts (which aren't annoying so much as too frequent);
+     * note that some of these can still be enabled if you really want them (eg, RTC can be turned on
+     * with RTC messages, ALT_TIMER with TIMER messages, etc).
+     */
+    DebuggerX86.INT_ANNOYING = [Interrupts.RTC, Interrupts.ALT_TIMER, Interrupts.DOS_IDLE, Interrupts.DOS_NETBIOS, Interrupts.ALT_VIDEO];
+
+    DebuggerX86.COMMANDS = {
+        '?':     "help/print",
+        'a [#]': "assemble",            // TODO: Implement this command someday
+        'b [#]': "breakpoint",          // multiple variations (use b? to list them)
+        'c':     "clear output",
+        'd [#]': "dump memory",         // additional syntax: d [#] [l#], where l# is a number of bytes to dump
+        'e [#]': "edit memory",
+        'f':     "frequencies",
+        'g [#]': "go [to #]",
+        'h':     "halt",
+        'i [#]': "input port #",
+        'if':    "eval expression",
+        'k':     "stack trace",
+        'l':     "load sector(s)",
+        "ln":    "list nearest symbol(s)",
+        'm':     "messages",
+        'mouse': "mouse action",        // syntax: mouse {action} {delta} (eg, mouse x 10, mouse click 0, etc)
+        'o [#]': "output port #",
+        'p':     "step over",           // other variations: pr (step and dump registers)
+        'print': "print expression",
+        'r':     "dump/set registers",
+        'reset': "reset machine",
+        't [#]': "trace",               // other variations: tr (trace and dump registers)
+        'u [#]': "unassemble",
+        'x':     "execution options",
+        'v':     "print version",
+        'var':   "assign variable"
+    };
+
+    /*
+     * Supported address types; the type field in a DbgAddrX86 object may be one of:
+     *
+     *      NONE, REAL, PROT, V86, LINEAR or PHYSICAL
+     *
+     * REAL and V86 addresses are specified with a '&' prefix, PROT addresses with a '#' prefix,
+     * LINEAR addresses with '%', and PHYSICAL addresses with '%%'.
+     */
+    DebuggerX86.ADDRTYPE = {
+        NONE:       0x00,
+        REAL:       0x01,
+        PROT:       0x02,
+        V86:        0x03,
+        LINEAR:     0x04,
+        PHYSICAL:   0x05
+    };
+
+    /*
+     * CPU instruction ordinals
+     *
+     * Note that individual instructions end with ordinal 162 and instruction groups begin with ordinal 163;
+     * the disassembler knows it's dealing with a group whenever the ordinal is not a valid index into INS_NAMES.
+     *
+     * NOTE: While this list started alphabetical, there are a few wrinkles; eg, POPA/POPF/PUSHF/PUSHA are
+     * sequential to make it easier to detect instructions that require a D suffix when the operand size is 32 bits.
+     */
+    DebuggerX86.INS = {
+        NONE:   0,   AAA:    1,   AAD:    2,   AAM:    3,   AAS:    4,   ADC:    5,   ADD:    6,   AND:    7,
+        ARPL:   8,   AS:     9,   BOUND:  10,  BSF:    11,  BSR:    12,  BT:     13,  BTC:    14,  BTR:    15,
+        BTS:    16,  CALL:   17,  CBW:    18,  CLC:    19,  CLD:    20,  CLI:    21,  CLTS:   22,  CMC:    23,
+        CMP:    24,  CMPSB:  25,  CMPSW:  26,  CS:     27,  CWD:    28,  DAA:    29,  DAS:    30,  DEC:    31,
+        DIV:    32,  DS:     33,  ENTER:  34,  ES:     35,  ESC:    36,  FS:     37,  GS:     38,  HLT:    39,
+        IBTS:   40,  IDIV:   41,  IMUL:   42,  IN:     43,  INC:    44,  INS:    45,  INT:    46,  INT3:   47,
+        INTO:   48,  IRET:   49,  JBE:    50,  JC:     51,  JCXZ:   52,  JG:     53,  JGE:    54,  JL:     55,
+        JLE:    56,  JMP:    57,  JA:     58,  JNC:    59,  JNO:    60,  JNP:    61,  JNS:    62,  JNZ:    63,
+        JO:     64,  JP:     65,  JS:     66,  JZ:     67,  LAHF:   68,  LAR:    69,  LDS:    70,  LEA:    71,
+        LEAVE:  72,  LES:    73,  LFS:    74,  LGDT:   75,  LGS:    76,  LIDT:   77,  LLDT:   78,  LMSW:   79,
+        LOADALL:80,  LOCK:   81,  LODSB:  82,  LODSW:  83,  LOOP:   84,  LOOPNZ: 85,  LOOPZ:  86,  LSL:    87,
+        LSS:    88,  LTR:    89,  MOV:    90,  MOVSB:  91,  MOVSW:  92,  MOVSX:  93,  MOVZX:  94,  MUL:    95,
+        NEG:    96,  NOP:    97,  NOT:    98,  OR:     99,  OS:     100, OUT:    101, OUTS:   102, POP:    103,
+        POPA:   104, POPF:   105, PUSHF:  106, PUSHA:  107, PUSH:   108, RCL:    109, RCR:    110, REPNZ:  111,
+        REPZ:   112, RET:    113, RETF:   114, ROL:    115, ROR:    116, SAHF:   117, SALC:   118, SAR:    119,
+        SBB:    120, SCASB:  121, SCASW:  122, SETBE:  123, SETC:   124, SETG:   125, SETGE:  126, SETL:   127,
+        SETLE:  128, SETNBE: 129, SETNC:  130, SETNO:  131, SETNP:  132, SETNS:  133, SETNZ:  134, SETO:   135,
+        SETP:   136, SETS:   137, SETZ:   138, SGDT:   139, SHL:    140, SHLD:   141, SHR:    142, SHRD:   143,
+        SIDT:   144, SLDT:   145, SMSW:   146, SS:     147, STC:    148, STD:    149, STI:    150, STOSB:  151,
+        STOSW:  152, STR:    153, SUB:    154, TEST:   155, VERR:   156, VERW:   157, WAIT:   158, XBTS:   159,
+        XCHG:   160, XLAT:   161, XOR:    162, GRP1B:  163, GRP1W:  164, GRP1SW: 165, GRP2B:  166, GRP2W:  167,
+        GRP2B1: 168, GRP2W1: 169, GRP2BC: 170, GRP2WC: 171, GRP3B:  172, GRP3W:  173, GRP4B:  174, GRP4W:  175,
+        OP0F:   176, GRP6:   177, GRP7:   178, GRP8:   179
+    };
+
+    /*
+     * CPU instruction names (mnemonics), indexed by CPU instruction ordinal (above)
+     */
+    DebuggerX86.INS_NAMES = [
+        "INVALID","AAA",    "AAD",    "AAM",    "AAS",    "ADC",    "ADD",    "AND",
+        "ARPL",   "AS:",    "BOUND",  "BSF",    "BSR",    "BT",     "BTC",    "BTR",
+        "BTS",    "CALL",   "CBW",    "CLC",    "CLD",    "CLI",    "CLTS",   "CMC",
+        "CMP",    "CMPSB",  "CMPSW",  "CS:",    "CWD",    "DAA",    "DAS",    "DEC",
+        "DIV",    "DS:",    "ENTER",  "ES:",    "ESC",    "FS:",    "GS:",    "HLT",
+        "IBTS",   "IDIV",   "IMUL",   "IN",     "INC",    "INS",    "INT",    "INT3",
+        "INTO",   "IRET",   "JBE",    "JC",     "JCXZ",   "JG",     "JGE",    "JL",
+        "JLE",    "JMP",    "JA",     "JNC",    "JNO",    "JNP",    "JNS",    "JNZ",
+        "JO",     "JP",     "JS",     "JZ",     "LAHF",   "LAR",    "LDS",    "LEA",
+        "LEAVE",  "LES",    "LFS",    "LGDT",   "LGS",    "LIDT",   "LLDT",   "LMSW",
+        "LOADALL","LOCK",   "LODSB",  "LODSW",  "LOOP",   "LOOPNZ", "LOOPZ",  "LSL",
+        "LSS",    "LTR",    "MOV",    "MOVSB",  "MOVSW",  "MOVSX",  "MOVZX",  "MUL",
+        "NEG",    "NOP",    "NOT",    "OR",     "OS:",    "OUT",    "OUTS",   "POP",
+        "POPA",   "POPF",   "PUSHF",  "PUSHA",  "PUSH",   "RCL",    "RCR",    "REPNZ",
+        "REPZ",   "RET",    "RETF",   "ROL",    "ROR",    "SAHF",   "SALC",   "SAR",
+        "SBB",    "SCASB",  "SCASW",  "SETBE",  "SETC",   "SETG",   "SETGE",  "SETL",
+        "SETLE",  "SETNBE", "SETNC",  "SETNO",  "SETNP",  "SETNS",  "SETNZ",  "SETO",
+        "SETP",   "SETS",   "SETZ",   "SGDT",   "SHL",    "SHLD",   "SHR",    "SHRD",
+        "SIDT",   "SLDT",   "SMSW",   "SS:",    "STC",    "STD",    "STI",    "STOSB",
+        "STOSW",  "STR",    "SUB",    "TEST",   "VERR",   "VERW",   "WAIT",   "XBTS",
+        "XCHG",   "XLAT",   "XOR"
+    ];
+
+    /*
+     * FPU instruction ordinals
+     *
+     * Unlike CPU instruction ordinals, these are not organized alphabetically (which I did only for the
+     * sake of tidiness), but rather by functionality; ie:
+     *
+     *      0-3:    real transfers
+     *      4-6:    integer transfers
+     *      7-8:    packed decimal transfers
+     *      9-11:   addition
+     *      12-17:  subtraction
+     *      18-20:  multiplication
+     *      21-26:  division
+     *      27-33:  other
+     *      34-40:  comparisons
+     *      41-45:  transcendental
+     *      46-52:  constants
+     *      53-77:  coprocessor control
+     *      78---:  new for 80287 or higher
+     *
+     * Also, unlike the CPU instructions, there is no NONE ("INVALID") instruction; if an ESC instruction
+     * can't be decoded as a valid FPU instruction, then it should remain an ESC instruction.
+     */
+    DebuggerX86.FINS = {
+        FLD:    0,   FST:    1,   FSTP:   2,   FXCH:   3,   FILD:   4,   FIST:   5,   FISTP:  6,   FBLD:   7,
+        FBSTP:  8,   FADD:   9,   FADDP:  10,  FIADD:  11,  FSUB:   12,  FSUBP:  13,  FISUB:  14,  FSUBR:  15,
+        FSUBRP: 16,  FISUBR: 17,  FMUL:   18,  FMULP:  19,  FIMUL:  20,  FDIV:   21,  FDIVP:  22,  FIDIV:  23,
+        FDIVR:  24,  FDIVRP: 25,  FIDIVR: 26,  FSQRT:  27,  FSCALE: 28,  FPREM:  29,  FRNDINT:30,  FXTRACT:31,
+        FABS:   32,  FCHS:   33,  FCOM:   34,  FCOMP:  35,  FCOMPP: 36,  FICOM:  37,  FICOMP: 38,  FTST:   39,
+        FXAM:   40,  FPTAN:  41,  FPATAN: 42,  F2XM1:  43,  FYL2X:  44,  FYL2XP1:45,  FLDZ:   46,  FLD1:   47,
+        FLDPI:  48,  FLDL2T: 49,  FLDL2E: 50,  FLDLG2: 51,  FLDLN2: 52,  FINIT:  53,  FNINIT: 54,  FDISI:  55,
+        FNDISI: 56,  FENI:   57,  FNENI:  58,  FLDCW:  59,  FSTCW:  60,  FNSTCW: 61,  FSTSW:  62,  FNSTSW: 63,
+        FCLEX:  64,  FNCLEX: 65,  FSTENV: 66,  FNSTENV:67,  FLDENV: 68,  FSAVE:  69,  FNSAVE: 70,  FRSTOR: 71,
+        FINCSTP:72,  FDECSTP:73,  FFREE:  74,  FFREEP: 75,  FNOP:   76,  FWAIT:  77,  FSETPM: 78,  FSINCOS:79,
+        FSTSWAX:80
+    };
+
+    /*
+     * FPU instruction names (mnemonics), indexed by FPU instruction ordinal (above)
+     */
+    DebuggerX86.FINS_NAMES = [
+        "FLD",    "FST",    "FSTP",   "FXCH",   "FILD",   "FIST",   "FISTP",  "FBLD",
+        "FBSTP",  "FADD",   "FADDP",  "FIADD",  "FSUB",   "FSUBP",  "FISUB",  "FSUBR",
+        "FSUBRP", "FISUBR", "FMUL",   "FMULP",  "FIMUL",  "FDIV",   "FDIVP",  "FIDIV",
+        "FDIVR",  "FDIVRP", "FIDIVR", "FSQRT",  "FSCALE", "FPREM",  "FRNDINT","FXTRACT",
+        "FABS",   "FCHS",   "FCOM",   "FCOMP",  "FCOMPP", "FICOM",  "FICOMP", "FTST",
+        "FXAM",   "FPTAN",  "FPATAN", "F2XM1",  "FYL2X",  "FYL2XP1","FLDZ",   "FLD1",
+        "FLDPI",  "FLDL2T", "FLDL2E", "FLDLG2", "FLDLN2", "FINIT",  "FNINIT", "FDISI",
+        "FNDISI", "FENI",   "FNENI",  "FLDCW",  "FSTCW",  "FNSTCW", "FSTSW",  "FNSTSW",
+        "FCLEX",  "FNCLEX", "FSTENV", "FNSTENV","FLDENV", "FSAVE",  "FNSAVE", "FRSTOR",
+        "FINCSTP","FDECSTP","FFREE",  "FFREEP", "FNOP",   "FWAIT",  "FSETPM", "FSINCOS",
+        "FSTSWAX"
+    ];
+
+    DebuggerX86.FPU_TAGS = ["VALID", "ZERO ", "SPEC ", "EMPTY"];
+
+    DebuggerX86.CPU_8086  = 0;
+    DebuggerX86.CPU_80186 = 1;
+    DebuggerX86.CPU_80286 = 2;
+    DebuggerX86.CPU_80386 = 3;
+    DebuggerX86.CPUS = [8086, 80186, 80286, 80386];
+
+    /*
+     * ModRM masks and definitions
+     */
+    DebuggerX86.REG_AL         = 0x00;          // bits 0-2 are standard Reg encodings
+    DebuggerX86.REG_CL         = 0x01;
+    DebuggerX86.REG_DL         = 0x02;
+    DebuggerX86.REG_BL         = 0x03;
+    DebuggerX86.REG_AH         = 0x04;
+    DebuggerX86.REG_CH         = 0x05;
+    DebuggerX86.REG_DH         = 0x06;
+    DebuggerX86.REG_BH         = 0x07;
+    DebuggerX86.REG_AX         = 0x08;
+    DebuggerX86.REG_CX         = 0x09;
+    DebuggerX86.REG_DX         = 0x0A;
+    DebuggerX86.REG_BX         = 0x0B;
+    DebuggerX86.REG_SP         = 0x0C;
+    DebuggerX86.REG_BP         = 0x0D;
+    DebuggerX86.REG_SI         = 0x0E;
+    DebuggerX86.REG_DI         = 0x0F;
+    DebuggerX86.REG_SEG        = 0x10;
+    DebuggerX86.REG_IP         = 0x16;
+    DebuggerX86.REG_PS         = 0x17;
+    DebuggerX86.REG_EAX        = 0x18;
+    DebuggerX86.REG_ECX        = 0x19;
+    DebuggerX86.REG_EDX        = 0x1A;
+    DebuggerX86.REG_EBX        = 0x1B;
+    DebuggerX86.REG_ESP        = 0x1C;
+    DebuggerX86.REG_EBP        = 0x1D;
+    DebuggerX86.REG_ESI        = 0x1E;
+    DebuggerX86.REG_EDI        = 0x1F;
+    DebuggerX86.REG_CR0        = 0x20;
+    DebuggerX86.REG_CR1        = 0x21;
+    DebuggerX86.REG_CR2        = 0x22;
+    DebuggerX86.REG_CR3        = 0x23;
+    DebuggerX86.REG_DR0        = 0x28;
+    DebuggerX86.REG_DR1        = 0x29;
+    DebuggerX86.REG_DR2        = 0x2A;
+    DebuggerX86.REG_DR3        = 0x2B;
+    DebuggerX86.REG_DR6        = 0x2E;
+    DebuggerX86.REG_DR7        = 0x2F;
+    DebuggerX86.REG_TR0        = 0x30;
+    DebuggerX86.REG_TR6        = 0x36;
+    DebuggerX86.REG_TR7        = 0x37;
+    DebuggerX86.REG_EIP        = 0x38;
+
+    DebuggerX86.REGS = [
+        "AL",  "CL",  "DL",  "BL",  "AH",  "CH",  "DH",  "BH",
+        "AX",  "CX",  "DX",  "BX",  "SP",  "BP",  "SI",  "DI",
+        "ES",  "CS",  "SS",  "DS",  "FS",  "GS",  "IP",  "PS",
+        "EAX", "ECX", "EDX", "EBX", "ESP", "EBP", "ESI", "EDI",
+        "CR0", "CR1", "CR2", "CR3", null,  null,  null,  null,  // register names used with TYPE_CTLREG
+        "DR0", "DR1", "DR2", "DR3", null,  null,  "DR6", "DR7", // register names used with TYPE_DBGREG
+        null,  null,  null,  null,  null,  null,  "TR6", "TR7", // register names used with TYPE_TSTREG
+        "EIP"
+    ];
+
+    DebuggerX86.REG_ES         = 0x00;          // bits 0-1 are standard SegReg encodings
+    DebuggerX86.REG_CS         = 0x01;
+    DebuggerX86.REG_SS         = 0x02;
+    DebuggerX86.REG_DS         = 0x03;
+    DebuggerX86.REG_FS         = 0x04;
+    DebuggerX86.REG_GS         = 0x05;
+    DebuggerX86.REG_UNKNOWN    = 0x00;
+
+    DebuggerX86.MOD_NODISP     = 0x00;          // use RM below, no displacement
+    DebuggerX86.MOD_DISP8      = 0x01;          // use RM below + 8-bit displacement
+    DebuggerX86.MOD_DISP16     = 0x02;          // use RM below + 16-bit displacement
+    DebuggerX86.MOD_REGISTER   = 0x03;          // use REG above
+
+    DebuggerX86.RM_BXSI        = 0x00;
+    DebuggerX86.RM_BXDI        = 0x01;
+    DebuggerX86.RM_BPSI        = 0x02;
+    DebuggerX86.RM_BPDI        = 0x03;
+    DebuggerX86.RM_SI          = 0x04;
+    DebuggerX86.RM_DI          = 0x05;
+    DebuggerX86.RM_BP          = 0x06;
+    DebuggerX86.RM_IMMOFF      = DebuggerX86.RM_BP;       // only if MOD_NODISP
+    DebuggerX86.RM_BX          = 0x07;
+
+    DebuggerX86.RMS = [
+        "BX+SI", "BX+DI", "BP+SI", "BP+DI", "SI",    "DI",    "BP",    "BX",
+        "EAX",   "ECX",   "EDX",   "EBX",   "ESP",   "EBP",   "ESI",   "EDI"
+    ];
+
+    /*
+     * Operand type descriptor masks and definitions
+     *
+     * Note that the letters in () in the comments refer to Intel's
+     * nomenclature used in Appendix A of the 80386 Programmers Reference Manual.
+     */
+    DebuggerX86.TYPE_SIZE      = 0x000F;        // size field
+    DebuggerX86.TYPE_MODE      = 0x00F0;        // mode field
+    DebuggerX86.TYPE_IREG      = 0x0F00;        // implied register field
+    DebuggerX86.TYPE_OTHER     = 0xF000;        // "other" field
+
+    /*
+     * TYPE_SIZE values.  Some definitions use duplicate values when the operands are the
+     * same size and the Debugger doesn't need to make a distinction.
+     */
+    DebuggerX86.TYPE_NONE      = 0x0000;        //     (all other TYPE fields ignored)
+    DebuggerX86.TYPE_BYTE      = 0x0001;        // (b) byte, regardless of operand size
+    DebuggerX86.TYPE_SBYTE     = 0x0002;        //     byte sign-extended to word
+    DebuggerX86.TYPE_SHORT     = 0x0003;        // (w) 16-bit value
+    DebuggerX86.TYPE_WORD      = 0x0004;        // (v) 16-bit or 32-bit value
+    DebuggerX86.TYPE_LONG      = 0x0005;        // (d) 32-bit value
+    DebuggerX86.TYPE_SEGP      = 0x0006;        // (p) 32-bit or 48-bit pointer
+    DebuggerX86.TYPE_FARP      = 0x0007;        // (p) 32-bit or 48-bit pointer for JMP/CALL
+    DebuggerX86.TYPE_PREFIX    = 0x0008;        //     (treat similarly to TYPE_NONE)
+    /*
+     * The remaining TYPE_SIZE values are for the FPU.  Note that there are not enough values
+     * within this nibble for every type to have a unique value, so to differentiate between two
+     * types of the same size (eg, SINT and SREAL), we can inspect the opcode string, because only
+     * FI* instructions use INT operands.  Also, some FPU sizes are not in this list (eg, the
+     * so-called "word-integer"); since a word-integer is always 16 bits, we specify TYPE_SHORT,
+     * which the Debugger should display as "INT16" for FI* instructions.
+     */
+    DebuggerX86.TYPE_ST        = 0x0009;        //     FPU ST (implicit stack top)
+    DebuggerX86.TYPE_STREG     = 0x000A;        //     FPU ST (explicit stack register, relative to top)
+    DebuggerX86.TYPE_SINT      = 0x000B;        //     FPU SI (short-integer; 32-bit); displayed as "INT32"
+    DebuggerX86.TYPE_SREAL     = 0x000B;        //     FPU SR (short-real; 32-bit); displayed as "REAL32"
+    DebuggerX86.TYPE_LINT      = 0x000C;        //     FPU LI (long-integer; 64-bit); displayed as "INT64"
+    DebuggerX86.TYPE_LREAL     = 0x000C;        //     FPU LR (long-real; 64-bit); displayed as "REAL64"
+    DebuggerX86.TYPE_TREAL     = 0x000D;        //     FPU TR (temp-real; 80-bit); displayed as "REAL80"
+    DebuggerX86.TYPE_BCD80     = 0x000E;        //     FPU PD (packed-decimal; 18 BCD digits in 80 bits, bits 72-78 unused, sign in bit 79); displayed as "BCD80"
+    DebuggerX86.TYPE_ENV       = 0x000F;        //     FPU ENV (environment; 14 bytes in real-mode, 28 bytes in protected-mode)
+    DebuggerX86.TYPE_FPU       = 0x000F;        //     FPU SAVE (save/restore; 94 bytes in real-mode, 108 bytes in protected-mode)
+
+    /*
+     * TYPE_MODE values.  Order is somewhat important, as all values implying
+     * the presence of a ModRM byte are assumed to be >= TYPE_MODRM.
+     */
+    DebuggerX86.TYPE_IMM       = 0x0000;        // (I) immediate data
+    DebuggerX86.TYPE_ONE       = 0x0010;        //     implicit 1 (eg, shifts/rotates)
+    DebuggerX86.TYPE_IMMOFF    = 0x0020;        // (A) immediate offset
+    DebuggerX86.TYPE_IMMREL    = 0x0030;        // (J) immediate relative
+    DebuggerX86.TYPE_DSSI      = 0x0040;        // (X) memory addressed by DS:SI
+    DebuggerX86.TYPE_ESDI      = 0x0050;        // (Y) memory addressed by ES:DI
+    DebuggerX86.TYPE_IMPREG    = 0x0060;        //     implicit register in TYPE_IREG
+    DebuggerX86.TYPE_IMPSEG    = 0x0070;        //     implicit segment reg in TYPE_IREG
+    DebuggerX86.TYPE_MODRM     = 0x0080;        // (E) standard ModRM decoding
+    DebuggerX86.TYPE_MODMEM    = 0x0090;        // (M) ModRM refers to memory only
+    DebuggerX86.TYPE_MODREG    = 0x00A0;        // (R) ModRM refers to register only
+    DebuggerX86.TYPE_REG       = 0x00B0;        // (G) standard Reg decoding
+    DebuggerX86.TYPE_SEGREG    = 0x00C0;        // (S) Reg selects segment register
+    DebuggerX86.TYPE_CTLREG    = 0x00D0;        // (C) Reg selects control register
+    DebuggerX86.TYPE_DBGREG    = 0x00E0;        // (D) Reg selects debug register
+    DebuggerX86.TYPE_TSTREG    = 0x00F0;        // (T) Reg selects test register
+
+    /*
+     * TYPE_IREG values, based on the REG_* constants.
+     * For convenience, they include TYPE_IMPREG or TYPE_IMPSEG as appropriate.
+     */
+    DebuggerX86.TYPE_AL = (DebuggerX86.REG_AL << 8 | DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_BYTE);
+    DebuggerX86.TYPE_CL = (DebuggerX86.REG_CL << 8 | DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_BYTE);
+    DebuggerX86.TYPE_DL = (DebuggerX86.REG_DL << 8 | DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_BYTE);
+    DebuggerX86.TYPE_BL = (DebuggerX86.REG_BL << 8 | DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_BYTE);
+    DebuggerX86.TYPE_AH = (DebuggerX86.REG_AH << 8 | DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_BYTE);
+    DebuggerX86.TYPE_CH = (DebuggerX86.REG_CH << 8 | DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_BYTE);
+    DebuggerX86.TYPE_DH = (DebuggerX86.REG_DH << 8 | DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_BYTE);
+    DebuggerX86.TYPE_BH = (DebuggerX86.REG_BH << 8 | DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_BYTE);
+    DebuggerX86.TYPE_AX = (DebuggerX86.REG_AX << 8 | DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_WORD);
+    DebuggerX86.TYPE_CX = (DebuggerX86.REG_CX << 8 | DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_WORD);
+    DebuggerX86.TYPE_DX = (DebuggerX86.REG_DX << 8 | DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_WORD);
+    DebuggerX86.TYPE_BX = (DebuggerX86.REG_BX << 8 | DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_WORD);
+    DebuggerX86.TYPE_SP = (DebuggerX86.REG_SP << 8 | DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_WORD);
+    DebuggerX86.TYPE_BP = (DebuggerX86.REG_BP << 8 | DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_WORD);
+    DebuggerX86.TYPE_SI = (DebuggerX86.REG_SI << 8 | DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_WORD);
+    DebuggerX86.TYPE_DI = (DebuggerX86.REG_DI << 8 | DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_WORD);
+    DebuggerX86.TYPE_ES = (DebuggerX86.REG_ES << 8 | DebuggerX86.TYPE_IMPSEG | DebuggerX86.TYPE_SHORT);
+    DebuggerX86.TYPE_CS = (DebuggerX86.REG_CS << 8 | DebuggerX86.TYPE_IMPSEG | DebuggerX86.TYPE_SHORT);
+    DebuggerX86.TYPE_SS = (DebuggerX86.REG_SS << 8 | DebuggerX86.TYPE_IMPSEG | DebuggerX86.TYPE_SHORT);
+    DebuggerX86.TYPE_DS = (DebuggerX86.REG_DS << 8 | DebuggerX86.TYPE_IMPSEG | DebuggerX86.TYPE_SHORT);
+    DebuggerX86.TYPE_FS = (DebuggerX86.REG_FS << 8 | DebuggerX86.TYPE_IMPSEG | DebuggerX86.TYPE_SHORT);
+    DebuggerX86.TYPE_GS = (DebuggerX86.REG_GS << 8 | DebuggerX86.TYPE_IMPSEG | DebuggerX86.TYPE_SHORT);
+
+    /*
+     * TYPE_OTHER bit definitions
+     */
+    DebuggerX86.TYPE_IN    = 0x1000;            // operand is input
+    DebuggerX86.TYPE_OUT   = 0x2000;            // operand is output
+    DebuggerX86.TYPE_BOTH  = (DebuggerX86.TYPE_IN | DebuggerX86.TYPE_OUT);
+    DebuggerX86.TYPE_8086  = (DebuggerX86.CPU_8086 << 14);
+    DebuggerX86.TYPE_8087  = DebuggerX86.TYPE_8086;
+    DebuggerX86.TYPE_80186 = (DebuggerX86.CPU_80186 << 14);
+    DebuggerX86.TYPE_80286 = (DebuggerX86.CPU_80286 << 14);
+    DebuggerX86.TYPE_80287 = DebuggerX86.TYPE_80286;
+    DebuggerX86.TYPE_80386 = (DebuggerX86.CPU_80386 << 14);
+    DebuggerX86.TYPE_80387 = DebuggerX86.TYPE_80386;
+    DebuggerX86.TYPE_CPU_SHIFT = 14;
+
+    DebuggerX86.HISTORY_LIMIT = DEBUG? 100000 : 1000;
+
+    /*
+     * Opcode 0x0F has a distinguished history:
+     *
+     *      On the 8086, it functioned as POP CS
+     *      On the 80186, it generated an Invalid Opcode (UD_FAULT) exception
+     *      On the 80286, it introduced a new (and growing) series of two-byte opcodes
+     *
+     * Based on the active CPU model, we make every effort to execute and disassemble this (and every other)
+     * opcode appropriately, by setting the opcode's entry in aaOpDescs accordingly.  0x0F in aaOpDescs points
+     * to the 8086 table: aOpDescPopCS.
+     *
+     * Note that we must NOT modify aaOpDescs directly.  this.aaOpDescs will point to DebuggerX86.aaOpDescs
+     * if the processor is an 8086, because that's the processor that the hard-coded contents of the table
+     * represent; for all other processors, this.aaOpDescs will contain a copy of the table that we can modify.
+     */
+    DebuggerX86.aOpDescPopCS     = [DebuggerX86.INS.POP,  DebuggerX86.TYPE_CS   | DebuggerX86.TYPE_OUT];
+    DebuggerX86.aOpDescUndefined = [DebuggerX86.INS.NONE, DebuggerX86.TYPE_NONE];
+    DebuggerX86.aOpDesc0F        = [DebuggerX86.INS.OP0F, DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_BOTH];
+
+    /*
+     * The aaOpDescs array is indexed by opcode, and each element is a sub-array (aOpDesc) that describes
+     * the corresponding opcode. The sub-elements are as follows:
+     *
+     *      [0]: {number} of the opcode name (see INS.*)
+     *      [1]: {number} containing the destination operand descriptor bit(s), if any
+     *      [2]: {number} containing the source operand descriptor bit(s), if any
+     *      [3]: {number} containing the occasional third operand descriptor bit(s), if any
+     *
+     * These sub-elements are all optional. If [0] is not present, the opcode is undefined; if [1] is not
+     * present (or contains zero), the opcode has no (or only implied) operands; if [2] is not present, the
+     * opcode has only a single operand.  And so on.
+     */
+    DebuggerX86.aaOpDescs = [
+    /* 0x00 */ [DebuggerX86.INS.ADD,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_REG   | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x01 */ [DebuggerX86.INS.ADD,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_REG   | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x02 */ [DebuggerX86.INS.ADD,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x03 */ [DebuggerX86.INS.ADD,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x04 */ [DebuggerX86.INS.ADD,   DebuggerX86.TYPE_AL     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x05 */ [DebuggerX86.INS.ADD,   DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x06 */ [DebuggerX86.INS.PUSH,  DebuggerX86.TYPE_ES     | DebuggerX86.TYPE_IN],
+    /* 0x07 */ [DebuggerX86.INS.POP,   DebuggerX86.TYPE_ES     | DebuggerX86.TYPE_OUT],
+
+    /* 0x08 */ [DebuggerX86.INS.OR,    DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_REG   | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x09 */ [DebuggerX86.INS.OR,    DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_REG   | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x0A */ [DebuggerX86.INS.OR,    DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x0B */ [DebuggerX86.INS.OR,    DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x0C */ [DebuggerX86.INS.OR,    DebuggerX86.TYPE_AL     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x0D */ [DebuggerX86.INS.OR,    DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x0E */ [DebuggerX86.INS.PUSH,  DebuggerX86.TYPE_CS     | DebuggerX86.TYPE_IN],
+    /* 0x0F */ DebuggerX86.aOpDescPopCS,
+
+    /* 0x10 */ [DebuggerX86.INS.ADC,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_REG   | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x11 */ [DebuggerX86.INS.ADC,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_REG   | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x12 */ [DebuggerX86.INS.ADC,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x13 */ [DebuggerX86.INS.ADC,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x14 */ [DebuggerX86.INS.ADC,   DebuggerX86.TYPE_AL     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x15 */ [DebuggerX86.INS.ADC,   DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x16 */ [DebuggerX86.INS.PUSH,  DebuggerX86.TYPE_SS     | DebuggerX86.TYPE_IN],
+    /* 0x17 */ [DebuggerX86.INS.POP,   DebuggerX86.TYPE_SS     | DebuggerX86.TYPE_OUT],
+
+    /* 0x18 */ [DebuggerX86.INS.SBB,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_REG   | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x19 */ [DebuggerX86.INS.SBB,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_REG   | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x1A */ [DebuggerX86.INS.SBB,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x1B */ [DebuggerX86.INS.SBB,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x1C */ [DebuggerX86.INS.SBB,   DebuggerX86.TYPE_AL     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x1D */ [DebuggerX86.INS.SBB,   DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x1E */ [DebuggerX86.INS.PUSH,  DebuggerX86.TYPE_DS     | DebuggerX86.TYPE_IN],
+    /* 0x1F */ [DebuggerX86.INS.POP,   DebuggerX86.TYPE_DS     | DebuggerX86.TYPE_OUT],
+
+    /* 0x20 */ [DebuggerX86.INS.AND,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_REG   | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x21 */ [DebuggerX86.INS.AND,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_REG   | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x22 */ [DebuggerX86.INS.AND,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x23 */ [DebuggerX86.INS.AND,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x24 */ [DebuggerX86.INS.AND,   DebuggerX86.TYPE_AL     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x25 */ [DebuggerX86.INS.AND,   DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x26 */ [DebuggerX86.INS.ES,    DebuggerX86.TYPE_PREFIX],
+    /* 0x27 */ [DebuggerX86.INS.DAA],
+
+    /* 0x28 */ [DebuggerX86.INS.SUB,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_REG   | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x29 */ [DebuggerX86.INS.SUB,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_REG   | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x2A */ [DebuggerX86.INS.SUB,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x2B */ [DebuggerX86.INS.SUB,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x2C */ [DebuggerX86.INS.SUB,   DebuggerX86.TYPE_AL     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x2D */ [DebuggerX86.INS.SUB,   DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x2E */ [DebuggerX86.INS.CS,    DebuggerX86.TYPE_PREFIX],
+    /* 0x2F */ [DebuggerX86.INS.DAS],
+
+    /* 0x30 */ [DebuggerX86.INS.XOR,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_REG   | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x31 */ [DebuggerX86.INS.XOR,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_REG   | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x32 */ [DebuggerX86.INS.XOR,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x33 */ [DebuggerX86.INS.XOR,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x34 */ [DebuggerX86.INS.XOR,   DebuggerX86.TYPE_AL     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x35 */ [DebuggerX86.INS.XOR,   DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x36 */ [DebuggerX86.INS.SS,    DebuggerX86.TYPE_PREFIX],
+    /* 0x37 */ [DebuggerX86.INS.AAA],
+
+    /* 0x38 */ [DebuggerX86.INS.CMP,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN,   DebuggerX86.TYPE_REG   | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x39 */ [DebuggerX86.INS.CMP,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN,   DebuggerX86.TYPE_REG   | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x3A */ [DebuggerX86.INS.CMP,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN,   DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x3B */ [DebuggerX86.INS.CMP,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN,   DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x3C */ [DebuggerX86.INS.CMP,   DebuggerX86.TYPE_AL     | DebuggerX86.TYPE_IN,     DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x3D */ [DebuggerX86.INS.CMP,   DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_IN,     DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x3E */ [DebuggerX86.INS.DS,    DebuggerX86.TYPE_PREFIX],
+    /* 0x3F */ [DebuggerX86.INS.AAS],
+
+    /* 0x40 */ [DebuggerX86.INS.INC,   DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_BOTH],
+    /* 0x41 */ [DebuggerX86.INS.INC,   DebuggerX86.TYPE_CX     | DebuggerX86.TYPE_BOTH],
+    /* 0x42 */ [DebuggerX86.INS.INC,   DebuggerX86.TYPE_DX     | DebuggerX86.TYPE_BOTH],
+    /* 0x43 */ [DebuggerX86.INS.INC,   DebuggerX86.TYPE_BX     | DebuggerX86.TYPE_BOTH],
+    /* 0x44 */ [DebuggerX86.INS.INC,   DebuggerX86.TYPE_SP     | DebuggerX86.TYPE_BOTH],
+    /* 0x45 */ [DebuggerX86.INS.INC,   DebuggerX86.TYPE_BP     | DebuggerX86.TYPE_BOTH],
+    /* 0x46 */ [DebuggerX86.INS.INC,   DebuggerX86.TYPE_SI     | DebuggerX86.TYPE_BOTH],
+    /* 0x47 */ [DebuggerX86.INS.INC,   DebuggerX86.TYPE_DI     | DebuggerX86.TYPE_BOTH],
+
+    /* 0x48 */ [DebuggerX86.INS.DEC,   DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_BOTH],
+    /* 0x49 */ [DebuggerX86.INS.DEC,   DebuggerX86.TYPE_CX     | DebuggerX86.TYPE_BOTH],
+    /* 0x4A */ [DebuggerX86.INS.DEC,   DebuggerX86.TYPE_DX     | DebuggerX86.TYPE_BOTH],
+    /* 0x4B */ [DebuggerX86.INS.DEC,   DebuggerX86.TYPE_BX     | DebuggerX86.TYPE_BOTH],
+    /* 0x4C */ [DebuggerX86.INS.DEC,   DebuggerX86.TYPE_SP     | DebuggerX86.TYPE_BOTH],
+    /* 0x4D */ [DebuggerX86.INS.DEC,   DebuggerX86.TYPE_BP     | DebuggerX86.TYPE_BOTH],
+    /* 0x4E */ [DebuggerX86.INS.DEC,   DebuggerX86.TYPE_SI     | DebuggerX86.TYPE_BOTH],
+    /* 0x4F */ [DebuggerX86.INS.DEC,   DebuggerX86.TYPE_DI     | DebuggerX86.TYPE_BOTH],
+
+    /* 0x50 */ [DebuggerX86.INS.PUSH,  DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_IN],
+    /* 0x51 */ [DebuggerX86.INS.PUSH,  DebuggerX86.TYPE_CX     | DebuggerX86.TYPE_IN],
+    /* 0x52 */ [DebuggerX86.INS.PUSH,  DebuggerX86.TYPE_DX     | DebuggerX86.TYPE_IN],
+    /* 0x53 */ [DebuggerX86.INS.PUSH,  DebuggerX86.TYPE_BX     | DebuggerX86.TYPE_IN],
+    /* 0x54 */ [DebuggerX86.INS.PUSH,  DebuggerX86.TYPE_SP     | DebuggerX86.TYPE_IN],
+    /* 0x55 */ [DebuggerX86.INS.PUSH,  DebuggerX86.TYPE_BP     | DebuggerX86.TYPE_IN],
+    /* 0x56 */ [DebuggerX86.INS.PUSH,  DebuggerX86.TYPE_SI     | DebuggerX86.TYPE_IN],
+    /* 0x57 */ [DebuggerX86.INS.PUSH,  DebuggerX86.TYPE_DI     | DebuggerX86.TYPE_IN],
+
+    /* 0x58 */ [DebuggerX86.INS.POP,   DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_OUT],
+    /* 0x59 */ [DebuggerX86.INS.POP,   DebuggerX86.TYPE_CX     | DebuggerX86.TYPE_OUT],
+    /* 0x5A */ [DebuggerX86.INS.POP,   DebuggerX86.TYPE_DX     | DebuggerX86.TYPE_OUT],
+    /* 0x5B */ [DebuggerX86.INS.POP,   DebuggerX86.TYPE_BX     | DebuggerX86.TYPE_OUT],
+    /* 0x5C */ [DebuggerX86.INS.POP,   DebuggerX86.TYPE_SP     | DebuggerX86.TYPE_OUT],
+    /* 0x5D */ [DebuggerX86.INS.POP,   DebuggerX86.TYPE_BP     | DebuggerX86.TYPE_OUT],
+    /* 0x5E */ [DebuggerX86.INS.POP,   DebuggerX86.TYPE_SI     | DebuggerX86.TYPE_OUT],
+    /* 0x5F */ [DebuggerX86.INS.POP,   DebuggerX86.TYPE_DI     | DebuggerX86.TYPE_OUT],
+
+    /* 0x60 */ [DebuggerX86.INS.PUSHA, DebuggerX86.TYPE_NONE   | DebuggerX86.TYPE_80286],
+    /* 0x61 */ [DebuggerX86.INS.POPA,  DebuggerX86.TYPE_NONE   | DebuggerX86.TYPE_80286],
+    /* 0x62 */ [DebuggerX86.INS.BOUND, DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x63 */ [DebuggerX86.INS.ARPL,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_OUT,                           DebuggerX86.TYPE_REG   | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN],
+    /* 0x64 */ [DebuggerX86.INS.FS,    DebuggerX86.TYPE_PREFIX | DebuggerX86.TYPE_80386],
+    /* 0x65 */ [DebuggerX86.INS.GS,    DebuggerX86.TYPE_PREFIX | DebuggerX86.TYPE_80386],
+    /* 0x66 */ [DebuggerX86.INS.OS,    DebuggerX86.TYPE_PREFIX | DebuggerX86.TYPE_80386],
+    /* 0x67 */ [DebuggerX86.INS.AS,    DebuggerX86.TYPE_PREFIX | DebuggerX86.TYPE_80386],
+
+    /* 0x68 */ [DebuggerX86.INS.PUSH,  DebuggerX86.TYPE_IMM    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80286],
+    /* 0x69 */ [DebuggerX86.INS.IMUL,  DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_BOTH | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x6A */ [DebuggerX86.INS.PUSH,  DebuggerX86.TYPE_IMM    | DebuggerX86.TYPE_SBYTE | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80286],
+    /* 0x6B */ [DebuggerX86.INS.IMUL,  DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x6C */ [DebuggerX86.INS.INS,   DebuggerX86.TYPE_ESDI   | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_DX    | DebuggerX86.TYPE_IN],
+    /* 0x6D */ [DebuggerX86.INS.INS,   DebuggerX86.TYPE_ESDI   | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_DX    | DebuggerX86.TYPE_IN],
+    /* 0x6E */ [DebuggerX86.INS.OUTS,  DebuggerX86.TYPE_DX     | DebuggerX86.TYPE_IN    | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_DSSI | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x6F */ [DebuggerX86.INS.OUTS,  DebuggerX86.TYPE_DX     | DebuggerX86.TYPE_IN    | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_DSSI | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+
+    /* 0x70 */ [DebuggerX86.INS.JO,    DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x71 */ [DebuggerX86.INS.JNO,   DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x72 */ [DebuggerX86.INS.JC,    DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x73 */ [DebuggerX86.INS.JNC,   DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x74 */ [DebuggerX86.INS.JZ,    DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x75 */ [DebuggerX86.INS.JNZ,   DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x76 */ [DebuggerX86.INS.JBE,   DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x77 */ [DebuggerX86.INS.JA,    DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+
+    /* 0x78 */ [DebuggerX86.INS.JS,    DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x79 */ [DebuggerX86.INS.JNS,   DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x7A */ [DebuggerX86.INS.JP,    DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x7B */ [DebuggerX86.INS.JNP,   DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x7C */ [DebuggerX86.INS.JL,    DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x7D */ [DebuggerX86.INS.JGE,   DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x7E */ [DebuggerX86.INS.JLE,   DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x7F */ [DebuggerX86.INS.JG,    DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+
+    /* 0x80 */ [DebuggerX86.INS.GRP1B, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM   | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x81 */ [DebuggerX86.INS.GRP1W, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM   | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x82 */ [DebuggerX86.INS.GRP1B, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM   | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x83 */ [DebuggerX86.INS.GRP1SW,DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM   | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x84 */ [DebuggerX86.INS.TEST,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN,   DebuggerX86.TYPE_REG   | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x85 */ [DebuggerX86.INS.TEST,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN,   DebuggerX86.TYPE_REG   | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x86 */ [DebuggerX86.INS.XCHG,  DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH],
+    /* 0x87 */ [DebuggerX86.INS.XCHG,  DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH],
+
+    /* 0x88 */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT,  DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x89 */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT,  DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x8A */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0x8B */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x8C */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT,  DebuggerX86.TYPE_SEGREG | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN],
+    /* 0x8D */ [DebuggerX86.INS.LEA,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT,  DebuggerX86.TYPE_MODMEM | DebuggerX86.TYPE_WORD ],
+    /* 0x8E */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_SEGREG | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_OUT,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0x8F */ [DebuggerX86.INS.POP,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT],
+
+    /* 0x90 */ [DebuggerX86.INS.NOP],
+    /* 0x91 */ [DebuggerX86.INS.XCHG,  DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_CX  | DebuggerX86.TYPE_BOTH],
+    /* 0x92 */ [DebuggerX86.INS.XCHG,  DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_DX  | DebuggerX86.TYPE_BOTH],
+    /* 0x93 */ [DebuggerX86.INS.XCHG,  DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_BX  | DebuggerX86.TYPE_BOTH],
+    /* 0x94 */ [DebuggerX86.INS.XCHG,  DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_SP  | DebuggerX86.TYPE_BOTH],
+    /* 0x95 */ [DebuggerX86.INS.XCHG,  DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_BP  | DebuggerX86.TYPE_BOTH],
+    /* 0x96 */ [DebuggerX86.INS.XCHG,  DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_SI  | DebuggerX86.TYPE_BOTH],
+    /* 0x97 */ [DebuggerX86.INS.XCHG,  DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_BOTH,   DebuggerX86.TYPE_DI  | DebuggerX86.TYPE_BOTH],
+
+    /* 0x98 */ [DebuggerX86.INS.CBW],
+    /* 0x99 */ [DebuggerX86.INS.CWD],
+    /* 0x9A */ [DebuggerX86.INS.CALL,  DebuggerX86.TYPE_IMM    | DebuggerX86.TYPE_FARP |  DebuggerX86.TYPE_IN],
+    /* 0x9B */ [DebuggerX86.INS.WAIT],
+    /* 0x9C */ [DebuggerX86.INS.PUSHF],
+    /* 0x9D */ [DebuggerX86.INS.POPF],
+    /* 0x9E */ [DebuggerX86.INS.SAHF],
+    /* 0x9F */ [DebuggerX86.INS.LAHF],
+
+    /* 0xA0 */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_AL     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMMOFF | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xA1 */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMMOFF | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xA2 */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_IMMOFF | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT,     DebuggerX86.TYPE_AL    | DebuggerX86.TYPE_IN],
+    /* 0xA3 */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_IMMOFF | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT,     DebuggerX86.TYPE_AX    | DebuggerX86.TYPE_IN],
+    /* 0xA4 */ [DebuggerX86.INS.MOVSB, DebuggerX86.TYPE_ESDI   | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT,     DebuggerX86.TYPE_DSSI  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xA5 */ [DebuggerX86.INS.MOVSW, DebuggerX86.TYPE_ESDI   | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT,     DebuggerX86.TYPE_DSSI  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xA6 */ [DebuggerX86.INS.CMPSB, DebuggerX86.TYPE_ESDI   | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN,      DebuggerX86.TYPE_DSSI  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xA7 */ [DebuggerX86.INS.CMPSW, DebuggerX86.TYPE_ESDI   | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN,      DebuggerX86.TYPE_DSSI  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+
+    /* 0xA8 */ [DebuggerX86.INS.TEST,  DebuggerX86.TYPE_AL     | DebuggerX86.TYPE_IN,     DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xA9 */ [DebuggerX86.INS.TEST,  DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_IN,     DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xAA */ [DebuggerX86.INS.STOSB, DebuggerX86.TYPE_ESDI   | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT,   DebuggerX86.TYPE_AL    | DebuggerX86.TYPE_IN],
+    /* 0xAB */ [DebuggerX86.INS.STOSW, DebuggerX86.TYPE_ESDI   | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT,   DebuggerX86.TYPE_AX    | DebuggerX86.TYPE_IN],
+    /* 0xAC */ [DebuggerX86.INS.LODSB, DebuggerX86.TYPE_AL     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_DSSI | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xAD */ [DebuggerX86.INS.LODSW, DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_DSSI | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xAE */ [DebuggerX86.INS.SCASB, DebuggerX86.TYPE_AL     | DebuggerX86.TYPE_IN,     DebuggerX86.TYPE_ESDI | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xAF */ [DebuggerX86.INS.SCASW, DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_IN,     DebuggerX86.TYPE_ESDI | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+
+    /* 0xB0 */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_AL     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xB1 */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_CL     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xB2 */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_DL     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xB3 */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_BL     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xB4 */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_AH     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xB5 */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_CH     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xB6 */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_DH     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xB7 */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_BH     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+
+    /* 0xB8 */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xB9 */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_CX     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xBA */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_DX     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xBB */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_BX     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xBC */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_SP     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xBD */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_BP     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xBE */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_SI     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xBF */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_DI     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+
+    /* 0xC0 */ [DebuggerX86.INS.GRP2B, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH | DebuggerX86.TYPE_80186,  DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+    /* 0xC1 */ [DebuggerX86.INS.GRP2W, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH | DebuggerX86.TYPE_80186,  DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+    /* 0xC2 */ [DebuggerX86.INS.RET,   DebuggerX86.TYPE_IMM    | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN],
+    /* 0xC3 */ [DebuggerX86.INS.RET],
+    /* 0xC4 */ [DebuggerX86.INS.LES,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT,   DebuggerX86.TYPE_MODMEM  | DebuggerX86.TYPE_SEGP  | DebuggerX86.TYPE_IN],
+    /* 0xC5 */ [DebuggerX86.INS.LDS,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT,   DebuggerX86.TYPE_MODMEM  | DebuggerX86.TYPE_SEGP  | DebuggerX86.TYPE_IN],
+    /* 0xC6 */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT,   DebuggerX86.TYPE_IMM     | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xC7 */ [DebuggerX86.INS.MOV,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT,   DebuggerX86.TYPE_IMM     | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+
+    /* 0xC8 */ [DebuggerX86.INS.ENTER, DebuggerX86.TYPE_IMM    | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80286,    DebuggerX86.TYPE_IMM   | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+    /* 0xC9 */ [DebuggerX86.INS.LEAVE, DebuggerX86.TYPE_NONE   | DebuggerX86.TYPE_80286],
+    /* 0xCA */ [DebuggerX86.INS.RETF,  DebuggerX86.TYPE_IMM    | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN],
+    /* 0xCB */ [DebuggerX86.INS.RETF],
+    /* 0xCC */ [DebuggerX86.INS.INT3],
+    /* 0xCD */ [DebuggerX86.INS.INT,   DebuggerX86.TYPE_IMM    | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xCE */ [DebuggerX86.INS.INTO],
+    /* 0xCF */ [DebuggerX86.INS.IRET],
+
+    /* 0xD0 */ [DebuggerX86.INS.GRP2B1,DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH,  DebuggerX86.TYPE_ONE    | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+    /* 0xD1 */ [DebuggerX86.INS.GRP2W1,DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH,  DebuggerX86.TYPE_ONE    | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+    /* 0xD2 */ [DebuggerX86.INS.GRP2BC,DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH,  DebuggerX86.TYPE_CL     | DebuggerX86.TYPE_IN],
+    /* 0xD3 */ [DebuggerX86.INS.GRP2WC,DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH,  DebuggerX86.TYPE_CL     | DebuggerX86.TYPE_IN],
+    /* 0xD4 */ [DebuggerX86.INS.AAM,   DebuggerX86.TYPE_IMM    | DebuggerX86.TYPE_BYTE],
+    /* 0xD5 */ [DebuggerX86.INS.AAD,   DebuggerX86.TYPE_IMM    | DebuggerX86.TYPE_BYTE],
+    /* 0xD6 */ [DebuggerX86.INS.SALC],
+    /* 0xD7 */ [DebuggerX86.INS.XLAT],
+
+    /* 0xD8 */ [DebuggerX86.INS.ESC,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xD9 */ [DebuggerX86.INS.ESC,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xDA */ [DebuggerX86.INS.ESC,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xDB */ [DebuggerX86.INS.ESC,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xDC */ [DebuggerX86.INS.ESC,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xDD */ [DebuggerX86.INS.ESC,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xDE */ [DebuggerX86.INS.ESC,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xDF */ [DebuggerX86.INS.ESC,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+
+    /* 0xE0 */ [DebuggerX86.INS.LOOPNZ,DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xE1 */ [DebuggerX86.INS.LOOPZ, DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xE2 */ [DebuggerX86.INS.LOOP,  DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xE3 */ [DebuggerX86.INS.JCXZ,  DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xE4 */ [DebuggerX86.INS.IN,    DebuggerX86.TYPE_AL     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+    /* 0xE5 */ [DebuggerX86.INS.IN,    DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_IMM  | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+    /* 0xE6 */ [DebuggerX86.INS.OUT,   DebuggerX86.TYPE_IMM    | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN,    DebuggerX86.TYPE_AL   | DebuggerX86.TYPE_IN],
+    /* 0xE7 */ [DebuggerX86.INS.OUT,   DebuggerX86.TYPE_IMM    | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN,    DebuggerX86.TYPE_AX   | DebuggerX86.TYPE_IN],
+
+    /* 0xE8 */ [DebuggerX86.INS.CALL,  DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xE9 */ [DebuggerX86.INS.JMP,   DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+    /* 0xEA */ [DebuggerX86.INS.JMP,   DebuggerX86.TYPE_IMM    | DebuggerX86.TYPE_FARP  | DebuggerX86.TYPE_IN],
+    /* 0xEB */ [DebuggerX86.INS.JMP,   DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+    /* 0xEC */ [DebuggerX86.INS.IN,    DebuggerX86.TYPE_AL     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_DX   | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN],
+    /* 0xED */ [DebuggerX86.INS.IN,    DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_OUT,    DebuggerX86.TYPE_DX   | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN],
+    /* 0xEE */ [DebuggerX86.INS.OUT,   DebuggerX86.TYPE_DX     | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN,    DebuggerX86.TYPE_AL    | DebuggerX86.TYPE_IN],
+    /* 0xEF */ [DebuggerX86.INS.OUT,   DebuggerX86.TYPE_DX     | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN,    DebuggerX86.TYPE_AX    | DebuggerX86.TYPE_IN],
+
+    /* 0xF0 */ [DebuggerX86.INS.LOCK,  DebuggerX86.TYPE_PREFIX],
+    /* 0xF1 */ [DebuggerX86.INS.NONE],
+    /* 0xF2 */ [DebuggerX86.INS.REPNZ, DebuggerX86.TYPE_PREFIX],
+    /* 0xF3 */ [DebuggerX86.INS.REPZ,  DebuggerX86.TYPE_PREFIX],
+    /* 0xF4 */ [DebuggerX86.INS.HLT],
+    /* 0xF5 */ [DebuggerX86.INS.CMC],
+    /* 0xF6 */ [DebuggerX86.INS.GRP3B, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH],
+    /* 0xF7 */ [DebuggerX86.INS.GRP3W, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH],
+
+    /* 0xF8 */ [DebuggerX86.INS.CLC],
+    /* 0xF9 */ [DebuggerX86.INS.STC],
+    /* 0xFA */ [DebuggerX86.INS.CLI],
+    /* 0xFB */ [DebuggerX86.INS.STI],
+    /* 0xFC */ [DebuggerX86.INS.CLD],
+    /* 0xFD */ [DebuggerX86.INS.STD],
+    /* 0xFE */ [DebuggerX86.INS.GRP4B, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH],
+    /* 0xFF */ [DebuggerX86.INS.GRP4W, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH]
+    ];
+
+    DebuggerX86.aaOp0FDescs = {
+        0x00: [DebuggerX86.INS.GRP6,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_BOTH],
+        0x01: [DebuggerX86.INS.GRP7,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_BOTH],
+        0x02: [DebuggerX86.INS.LAR,    DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_MODMEM | DebuggerX86.TYPE_SHORT| DebuggerX86.TYPE_IN],
+        0x03: [DebuggerX86.INS.LSL,    DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_MODMEM | DebuggerX86.TYPE_SHORT| DebuggerX86.TYPE_IN],
+        0x05: [DebuggerX86.INS.LOADALL,DebuggerX86.TYPE_80286],
+        0x06: [DebuggerX86.INS.CLTS,   DebuggerX86.TYPE_80286],
+        0x07: [DebuggerX86.INS.LOADALL,DebuggerX86.TYPE_80386],   // TODO: implied operand is ES:[(E)DI]
+        0x20: [DebuggerX86.INS.MOV,    DebuggerX86.TYPE_MODREG | DebuggerX86.TYPE_LONG  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_CTLREG | DebuggerX86.TYPE_LONG  | DebuggerX86.TYPE_IN],
+        0x21: [DebuggerX86.INS.MOV,    DebuggerX86.TYPE_MODREG | DebuggerX86.TYPE_LONG  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_DBGREG | DebuggerX86.TYPE_LONG  | DebuggerX86.TYPE_IN],
+        0x22: [DebuggerX86.INS.MOV,    DebuggerX86.TYPE_CTLREG | DebuggerX86.TYPE_LONG  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_MODREG | DebuggerX86.TYPE_LONG  | DebuggerX86.TYPE_IN],
+        0x23: [DebuggerX86.INS.MOV,    DebuggerX86.TYPE_DBGREG | DebuggerX86.TYPE_LONG  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_MODREG | DebuggerX86.TYPE_LONG  | DebuggerX86.TYPE_IN],
+        0x24: [DebuggerX86.INS.MOV,    DebuggerX86.TYPE_MODREG | DebuggerX86.TYPE_LONG  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_TSTREG | DebuggerX86.TYPE_LONG  | DebuggerX86.TYPE_IN],
+        0x26: [DebuggerX86.INS.MOV,    DebuggerX86.TYPE_TSTREG | DebuggerX86.TYPE_LONG  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_MODREG | DebuggerX86.TYPE_LONG  | DebuggerX86.TYPE_IN],
+        0x80: [DebuggerX86.INS.JO,     DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80386],
+        0x81: [DebuggerX86.INS.JNO,    DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80386],
+        0x82: [DebuggerX86.INS.JC,     DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80386],
+        0x83: [DebuggerX86.INS.JNC,    DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80386],
+        0x84: [DebuggerX86.INS.JZ,     DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80386],
+        0x85: [DebuggerX86.INS.JNZ,    DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80386],
+        0x86: [DebuggerX86.INS.JBE,    DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80386],
+        0x87: [DebuggerX86.INS.JA,     DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80386],
+        0x88: [DebuggerX86.INS.JS,     DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80386],
+        0x89: [DebuggerX86.INS.JNS,    DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80386],
+        0x8A: [DebuggerX86.INS.JP,     DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80386],
+        0x8B: [DebuggerX86.INS.JNP,    DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80386],
+        0x8C: [DebuggerX86.INS.JL,     DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80386],
+        0x8D: [DebuggerX86.INS.JGE,    DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80386],
+        0x8E: [DebuggerX86.INS.JLE,    DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80386],
+        0x8F: [DebuggerX86.INS.JG,     DebuggerX86.TYPE_IMMREL | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80386],
+        0x90: [DebuggerX86.INS.SETO,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386],
+        0x91: [DebuggerX86.INS.SETNO,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386],
+        0x92: [DebuggerX86.INS.SETC,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386],
+        0x93: [DebuggerX86.INS.SETNC,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386],
+        0x94: [DebuggerX86.INS.SETZ,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386],
+        0x95: [DebuggerX86.INS.SETNZ,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386],
+        0x96: [DebuggerX86.INS.SETBE,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386],
+        0x97: [DebuggerX86.INS.SETNBE, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386],
+        0x98: [DebuggerX86.INS.SETS,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386],
+        0x99: [DebuggerX86.INS.SETNS,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386],
+        0x9A: [DebuggerX86.INS.SETP,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386],
+        0x9B: [DebuggerX86.INS.SETNP,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386],
+        0x9C: [DebuggerX86.INS.SETL,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386],
+        0x9D: [DebuggerX86.INS.SETGE,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386],
+        0x9E: [DebuggerX86.INS.SETLE,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386],
+        0x9F: [DebuggerX86.INS.SETG,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386],
+        0xA0: [DebuggerX86.INS.PUSH,   DebuggerX86.TYPE_FS     | DebuggerX86.TYPE_IN    | DebuggerX86.TYPE_80386],
+        0xA1: [DebuggerX86.INS.POP,    DebuggerX86.TYPE_FS     | DebuggerX86.TYPE_OUT   | DebuggerX86.TYPE_80386],
+        0xA3: [DebuggerX86.INS.BT,     DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN   | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+        0xA4: [DebuggerX86.INS.SHLD,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        0xA5: [DebuggerX86.INS.SHLD,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN, DebuggerX86.TYPE_CL  | DebuggerX86.TYPE_IN],
+        0xA6: [DebuggerX86.INS.XBTS,   DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN, DebuggerX86.TYPE_AX  | DebuggerX86.TYPE_IN,  DebuggerX86.TYPE_CL    | DebuggerX86.TYPE_IN],
+        0xA7: [DebuggerX86.INS.IBTS,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_AX     | DebuggerX86.TYPE_IN, DebuggerX86.TYPE_CL  | DebuggerX86.TYPE_IN, DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+        0xA8: [DebuggerX86.INS.PUSH,   DebuggerX86.TYPE_GS     | DebuggerX86.TYPE_IN    | DebuggerX86.TYPE_80386],
+        0xA9: [DebuggerX86.INS.POP,    DebuggerX86.TYPE_GS     | DebuggerX86.TYPE_OUT   | DebuggerX86.TYPE_80386],
+        0xAB: [DebuggerX86.INS.BTS,    DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+        0xAC: [DebuggerX86.INS.SHRD,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        0xAD: [DebuggerX86.INS.SHRD,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN, DebuggerX86.TYPE_CL  | DebuggerX86.TYPE_IN],
+        0xAF: [DebuggerX86.INS.IMUL,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+        0xB2: [DebuggerX86.INS.LSS,    DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT,                           DebuggerX86.TYPE_MODMEM | DebuggerX86.TYPE_SEGP  | DebuggerX86.TYPE_IN],
+        0xB3: [DebuggerX86.INS.BTR,    DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+        0xB4: [DebuggerX86.INS.LFS,    DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT,                           DebuggerX86.TYPE_MODMEM | DebuggerX86.TYPE_SEGP  | DebuggerX86.TYPE_IN],
+        0xB5: [DebuggerX86.INS.LGS,    DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT,                           DebuggerX86.TYPE_MODMEM | DebuggerX86.TYPE_SEGP  | DebuggerX86.TYPE_IN],
+        0xB6: [DebuggerX86.INS.MOVZX,  DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+        0xB7: [DebuggerX86.INS.MOVZX,  DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_LONG  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN],
+        0xBA: [DebuggerX86.INS.GRP8,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_IMM    | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+        0xBB: [DebuggerX86.INS.BTC,    DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+        0xBC: [DebuggerX86.INS.BSF,    DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+        0xBD: [DebuggerX86.INS.BSR,    DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+        0xBE: [DebuggerX86.INS.MOVSX,  DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+        0xBF: [DebuggerX86.INS.MOVSX,  DebuggerX86.TYPE_REG    | DebuggerX86.TYPE_LONG  | DebuggerX86.TYPE_OUT  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN]
+    };
+
+    /*
+     * Be sure to keep the following table in sync with X86FPU.aaOps
+     */
+    DebuggerX86.aaaOpFPUDescs = {
+        0xD8: {
+            0x00: [DebuggerX86.FINS.FADD,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SREAL | DebuggerX86.TYPE_IN],
+            0x01: [DebuggerX86.FINS.FMUL,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SREAL | DebuggerX86.TYPE_IN],
+            0x02: [DebuggerX86.FINS.FCOM,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SREAL | DebuggerX86.TYPE_IN],
+            0x03: [DebuggerX86.FINS.FCOMP,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SREAL | DebuggerX86.TYPE_IN],
+            0x04: [DebuggerX86.FINS.FSUB,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SREAL | DebuggerX86.TYPE_IN],
+            0x05: [DebuggerX86.FINS.FSUBR,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SREAL | DebuggerX86.TYPE_IN],
+            0x06: [DebuggerX86.FINS.FDIV,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SREAL | DebuggerX86.TYPE_IN],
+            0x07: [DebuggerX86.FINS.FDIVR,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SREAL | DebuggerX86.TYPE_IN],
+            0x30: [DebuggerX86.FINS.FADD,   DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST    | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_IN],
+            0x31: [DebuggerX86.FINS.FMUL,   DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST    | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_IN],
+            0x32: [DebuggerX86.FINS.FCOM,   DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST    | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_IN],
+            0x33: [DebuggerX86.FINS.FCOMP,  DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST    | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_IN],
+            0x34: [DebuggerX86.FINS.FSUB,   DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST    | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_IN],
+            0x35: [DebuggerX86.FINS.FSUBR,  DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST    | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_IN],
+            0x36: [DebuggerX86.FINS.FDIV,   DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST    | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_IN],
+            0x37: [DebuggerX86.FINS.FDIVR,  DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST    | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_IN]
+        },
+        0xD9: {
+            0x00: [DebuggerX86.FINS.FLD,    DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SREAL | DebuggerX86.TYPE_IN],
+            0x02: [DebuggerX86.FINS.FST,    DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SREAL | DebuggerX86.TYPE_OUT],
+            0x03: [DebuggerX86.FINS.FSTP,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SREAL | DebuggerX86.TYPE_OUT],
+            0x04: [DebuggerX86.FINS.FLDENV, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_ENV   | DebuggerX86.TYPE_IN],
+            0x05: [DebuggerX86.FINS.FLDCW,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN],
+            0x06: [DebuggerX86.FINS.FSTENV, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_ENV   | DebuggerX86.TYPE_OUT],
+            0x07: [DebuggerX86.FINS.FSTCW,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_OUT],
+            0x30: [DebuggerX86.FINS.FLD,    DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_OUT],
+            0x31: [DebuggerX86.FINS.FXCH,   DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_OUT],
+            0x32: [DebuggerX86.FINS.FNOP],
+            0x33: [DebuggerX86.FINS.FSTP,   DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_OUT],   // Obsolete encoding
+            0x40: [DebuggerX86.FINS.FCHS],
+            0x41: [DebuggerX86.FINS.FABS],
+            0x44: [DebuggerX86.FINS.FTST],
+            0x45: [DebuggerX86.FINS.FXAM],
+            0x50: [DebuggerX86.FINS.FLD1],
+            0x51: [DebuggerX86.FINS.FLDL2T],
+            0x52: [DebuggerX86.FINS.FLDL2E],
+            0x53: [DebuggerX86.FINS.FLDPI],
+            0x54: [DebuggerX86.FINS.FLDLG2],
+            0x55: [DebuggerX86.FINS.FLDLN2],
+            0x56: [DebuggerX86.FINS.FLDZ],
+            0x60: [DebuggerX86.FINS.F2XM1],
+            0x61: [DebuggerX86.FINS.FYL2X],
+            0x62: [DebuggerX86.FINS.FPTAN],
+            0x63: [DebuggerX86.FINS.FPATAN],
+            0x64: [DebuggerX86.FINS.FXTRACT],
+            0x66: [DebuggerX86.FINS.FDECSTP],
+            0x67: [DebuggerX86.FINS.FINCSTP],
+            0x70: [DebuggerX86.FINS.FPREM],
+            0x71: [DebuggerX86.FINS.FYL2XP1],
+            0x72: [DebuggerX86.FINS.FSQRT],
+            0x74: [DebuggerX86.FINS.FRNDINT],
+            0x75: [DebuggerX86.FINS.FSCALE]
+        },
+        0xDA: {
+            0x00: [DebuggerX86.FINS.FIADD,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SINT | DebuggerX86.TYPE_IN],
+            0x01: [DebuggerX86.FINS.FIMUL,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SINT | DebuggerX86.TYPE_IN],
+            0x02: [DebuggerX86.FINS.FICOM,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SINT | DebuggerX86.TYPE_IN],
+            0x03: [DebuggerX86.FINS.FICOMP, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SINT | DebuggerX86.TYPE_IN],
+            0x04: [DebuggerX86.FINS.FISUB,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SINT | DebuggerX86.TYPE_IN],
+            0x05: [DebuggerX86.FINS.FISUBR, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SINT | DebuggerX86.TYPE_IN],
+            0x06: [DebuggerX86.FINS.FIDIV,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SINT | DebuggerX86.TYPE_IN],
+            0x07: [DebuggerX86.FINS.FIDIVR, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SINT | DebuggerX86.TYPE_IN]
+        },
+        0xDB: {
+            0x00: [DebuggerX86.FINS.FILD,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SINT  | DebuggerX86.TYPE_IN],
+            0x02: [DebuggerX86.FINS.FIST,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SINT  | DebuggerX86.TYPE_OUT],
+            0x03: [DebuggerX86.FINS.FISTP,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SINT  | DebuggerX86.TYPE_OUT],
+            0x05: [DebuggerX86.FINS.FLD,    DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_TREAL | DebuggerX86.TYPE_IN],
+            0x07: [DebuggerX86.FINS.FSTP,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_TREAL | DebuggerX86.TYPE_OUT],
+            0x40: [DebuggerX86.FINS.FENI],
+            0x41: [DebuggerX86.FINS.FDISI],
+            0x42: [DebuggerX86.FINS.FCLEX],
+            0x43: [DebuggerX86.FINS.FINIT],
+            0x44: [DebuggerX86.FINS.FSETPM,  DebuggerX86.TYPE_80287],
+            0x73: [DebuggerX86.FINS.FSINCOS, DebuggerX86.TYPE_80387]
+        },
+        0xDC: {
+            0x00: [DebuggerX86.FINS.FADD,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_LREAL | DebuggerX86.TYPE_IN],
+            0x01: [DebuggerX86.FINS.FMUL,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_LREAL | DebuggerX86.TYPE_IN],
+            0x02: [DebuggerX86.FINS.FCOM,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_LREAL | DebuggerX86.TYPE_IN],
+            0x03: [DebuggerX86.FINS.FCOMP,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_LREAL | DebuggerX86.TYPE_IN],
+            0x04: [DebuggerX86.FINS.FSUB,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_LREAL | DebuggerX86.TYPE_IN],
+            0x05: [DebuggerX86.FINS.FSUBR,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_LREAL | DebuggerX86.TYPE_IN],
+            0x06: [DebuggerX86.FINS.FDIV,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_LREAL | DebuggerX86.TYPE_IN],
+            0x07: [DebuggerX86.FINS.FDIVR,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_LREAL | DebuggerX86.TYPE_IN],
+            0x30: [DebuggerX86.FINS.FADD,   DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST | DebuggerX86.TYPE_IN],
+            0x31: [DebuggerX86.FINS.FMUL,   DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST | DebuggerX86.TYPE_IN],
+            0x32: [DebuggerX86.FINS.FCOM,   DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_IN],    // Obsolete encoding
+            0x33: [DebuggerX86.FINS.FCOMP,  DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_IN],    // Obsolete encoding
+            0x34: [DebuggerX86.FINS.FSUBR,  DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST | DebuggerX86.TYPE_IN],
+            0x35: [DebuggerX86.FINS.FSUB,   DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST | DebuggerX86.TYPE_IN],
+            0x36: [DebuggerX86.FINS.FDIVR,  DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST | DebuggerX86.TYPE_IN],
+            0x37: [DebuggerX86.FINS.FDIV,   DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST | DebuggerX86.TYPE_IN]
+        },
+        0xDD: {
+            0x00: [DebuggerX86.FINS.FLD,    DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_LREAL | DebuggerX86.TYPE_IN],
+            0x02: [DebuggerX86.FINS.FST,    DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_LREAL | DebuggerX86.TYPE_OUT],
+            0x03: [DebuggerX86.FINS.FSTP,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_LREAL | DebuggerX86.TYPE_OUT],
+            0x04: [DebuggerX86.FINS.FRSTOR, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_FPU   | DebuggerX86.TYPE_IN],
+            0x06: [DebuggerX86.FINS.FSAVE,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_FPU   | DebuggerX86.TYPE_OUT],
+            0x07: [DebuggerX86.FINS.FSTSW,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_OUT],
+            0x30: [DebuggerX86.FINS.FFREE,  DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_IN],
+            0x31: [DebuggerX86.FINS.FXCH,   DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_OUT],   // Obsolete encoding
+            0x32: [DebuggerX86.FINS.FST,    DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_IN],
+            0x33: [DebuggerX86.FINS.FSTP,   DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_IN]
+        },
+        0xDE: {
+            0x00: [DebuggerX86.FINS.FIADD,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN],
+            0x01: [DebuggerX86.FINS.FIMUL,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN],
+            0x02: [DebuggerX86.FINS.FICOM,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN],
+            0x03: [DebuggerX86.FINS.FICOMP, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN],
+            0x04: [DebuggerX86.FINS.FISUB,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN],
+            0x05: [DebuggerX86.FINS.FISUBR, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN],
+            0x06: [DebuggerX86.FINS.FIDIV,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN],
+            0x07: [DebuggerX86.FINS.FIDIVR, DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN],
+            0x30: [DebuggerX86.FINS.FADDP,  DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST | DebuggerX86.TYPE_IN],
+            0x31: [DebuggerX86.FINS.FMULP,  DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST | DebuggerX86.TYPE_IN],
+            0x32: [DebuggerX86.FINS.FCOMP,  DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_IN],    // Obsolete encoding
+            0x33: [DebuggerX86.FINS.FCOMPP, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_IN],
+            0x34: [DebuggerX86.FINS.FSUBRP, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST | DebuggerX86.TYPE_IN],
+            0x35: [DebuggerX86.FINS.FSUBP,  DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST | DebuggerX86.TYPE_IN],
+            0x36: [DebuggerX86.FINS.FDIVRP, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST | DebuggerX86.TYPE_IN],
+            0x37: [DebuggerX86.FINS.FDIVP,  DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_OUT, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_ST | DebuggerX86.TYPE_IN]
+        },
+        0xDF: {
+            0x00: [DebuggerX86.FINS.FILD,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_IN],
+            0x02: [DebuggerX86.FINS.FIST,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_OUT],
+            0x03: [DebuggerX86.FINS.FISTP,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_SHORT | DebuggerX86.TYPE_OUT],
+            0x04: [DebuggerX86.FINS.FBLD,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BCD80 | DebuggerX86.TYPE_IN],
+            0x05: [DebuggerX86.FINS.FILD,   DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_LINT  | DebuggerX86.TYPE_IN],
+            0x06: [DebuggerX86.FINS.FBSTP,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_BCD80 | DebuggerX86.TYPE_OUT],
+            0x07: [DebuggerX86.FINS.FISTP,  DebuggerX86.TYPE_MODRM  | DebuggerX86.TYPE_LINT  | DebuggerX86.TYPE_OUT],
+            0x30: [DebuggerX86.FINS.FFREEP, DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_IN],    // Obsolete encoding
+            0x31: [DebuggerX86.FINS.FXCH,   DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_OUT],   // Obsolete encoding
+            0x32: [DebuggerX86.FINS.FSTP,   DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_IN],    // Obsolete encoding
+            0x33: [DebuggerX86.FINS.FSTP,   DebuggerX86.TYPE_IMPREG | DebuggerX86.TYPE_STREG | DebuggerX86.TYPE_IN],    // Obsolete encoding
+            0x34: [DebuggerX86.FINS.FSTSWAX, DebuggerX86.TYPE_80287]
+        }
+    };
+
+    DebuggerX86.aaGrpDescs = [
+      [
+        /* GRP1B */
+        [DebuggerX86.INS.ADD,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.OR,   DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.ADC,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.SBB,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.AND,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.SUB,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.XOR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.CMP,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN,   DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN]
+      ],
+      [
+        /* GRP1W */
+        [DebuggerX86.INS.ADD,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.OR,   DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.ADC,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.SBB,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.AND,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.SUB,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.XOR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.CMP,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN,   DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN]
+      ],
+      [
+        /* GRP1SW */
+        [DebuggerX86.INS.ADD,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_SBYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.OR,   DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_SBYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.ADC,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_SBYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.SBB,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_SBYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.AND,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_SBYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.SUB,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_SBYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.XOR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_SBYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.CMP,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN,   DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_SBYTE | DebuggerX86.TYPE_IN]
+      ],
+      [
+        /* GRP2B */
+        [DebuggerX86.INS.ROL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.ROR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.RCL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.RCR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.SHL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.SHR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+         DebuggerX86.aOpDescUndefined,
+        [DebuggerX86.INS.SAR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN]
+      ],
+      [
+        /* GRP2W */
+        [DebuggerX86.INS.ROL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.ROR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.RCL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.RCR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.SHL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.SHR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+         DebuggerX86.aOpDescUndefined,
+        [DebuggerX86.INS.SAR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH | DebuggerX86.TYPE_80286, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN]
+      ],
+      [
+        /* GRP2B1 */
+        [DebuggerX86.INS.ROL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_ONE | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.ROR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_ONE | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.RCL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_ONE | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.RCR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_ONE | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.SHL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_ONE | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.SHR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_ONE | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+         DebuggerX86.aOpDescUndefined,
+        [DebuggerX86.INS.SAR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_ONE | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN]
+      ],
+      [
+        /* GRP2W1 */
+        [DebuggerX86.INS.ROL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_ONE | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.ROR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_ONE | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.RCL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_ONE | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.RCR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_ONE | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.SHL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_ONE | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.SHR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_ONE | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+         DebuggerX86.aOpDescUndefined,
+        [DebuggerX86.INS.SAR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_ONE | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN]
+      ],
+      [
+        /* GRP2BC */
+        [DebuggerX86.INS.ROL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_CL | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.ROR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_CL | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.RCL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_CL | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.RCR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_CL | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.SHL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_CL | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.SHR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_CL | DebuggerX86.TYPE_IN],
+         DebuggerX86.aOpDescUndefined,
+        [DebuggerX86.INS.SAR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_CL | DebuggerX86.TYPE_IN]
+      ],
+      [
+        /* GRP2WC */
+        [DebuggerX86.INS.ROL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_CL | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.ROR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_CL | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.RCL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_CL | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.RCR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_CL | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.SHL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_CL | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.SHR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_CL | DebuggerX86.TYPE_IN],
+         DebuggerX86.aOpDescUndefined,
+        [DebuggerX86.INS.SAR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH, DebuggerX86.TYPE_CL | DebuggerX86.TYPE_IN]
+      ],
+      [
+        /* GRP3B */
+        [DebuggerX86.INS.TEST, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN,   DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+         DebuggerX86.aOpDescUndefined,
+        [DebuggerX86.INS.NOT,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH],
+        [DebuggerX86.INS.NEG,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH],
+        [DebuggerX86.INS.MUL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.IMUL, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH],
+        [DebuggerX86.INS.DIV,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.IDIV, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH]
+      ],
+      [
+        /* GRP3W */
+        [DebuggerX86.INS.TEST, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN,   DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+         DebuggerX86.aOpDescUndefined,
+        [DebuggerX86.INS.NOT,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH],
+        [DebuggerX86.INS.NEG,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH],
+        [DebuggerX86.INS.MUL,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.IMUL, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH],
+        [DebuggerX86.INS.DIV,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.IDIV, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH]
+      ],
+      [
+        /* GRP4B */
+        [DebuggerX86.INS.INC,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH],
+        [DebuggerX86.INS.DEC,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_BYTE  | DebuggerX86.TYPE_BOTH],
+         DebuggerX86.aOpDescUndefined,
+         DebuggerX86.aOpDescUndefined,
+         DebuggerX86.aOpDescUndefined,
+         DebuggerX86.aOpDescUndefined,
+         DebuggerX86.aOpDescUndefined,
+         DebuggerX86.aOpDescUndefined
+      ],
+      [
+        /* GRP4W */
+        [DebuggerX86.INS.INC,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH],
+        [DebuggerX86.INS.DEC,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_BOTH],
+        [DebuggerX86.INS.CALL, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.CALL, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_FARP  | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.JMP,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.JMP,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_FARP  | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.PUSH, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN],
+         DebuggerX86.aOpDescUndefined
+      ],
+      [ /* OP0F */ ],
+      [
+        /* GRP6 */
+        [DebuggerX86.INS.SLDT, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_SHORT| DebuggerX86.TYPE_OUT | DebuggerX86.TYPE_80286],
+        [DebuggerX86.INS.STR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_SHORT| DebuggerX86.TYPE_OUT | DebuggerX86.TYPE_80286],
+        [DebuggerX86.INS.LLDT, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_SHORT| DebuggerX86.TYPE_IN  | DebuggerX86.TYPE_80286],
+        [DebuggerX86.INS.LTR,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_SHORT| DebuggerX86.TYPE_IN  | DebuggerX86.TYPE_80286],
+        [DebuggerX86.INS.VERR, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_SHORT| DebuggerX86.TYPE_IN  | DebuggerX86.TYPE_80286],
+        [DebuggerX86.INS.VERW, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_SHORT| DebuggerX86.TYPE_IN  | DebuggerX86.TYPE_80286],
+         DebuggerX86.aOpDescUndefined,
+         DebuggerX86.aOpDescUndefined
+      ],
+      [
+        /* GRP7 */
+        [DebuggerX86.INS.SGDT, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_SHORT| DebuggerX86.TYPE_OUT | DebuggerX86.TYPE_80286],
+        [DebuggerX86.INS.SIDT, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_SHORT| DebuggerX86.TYPE_OUT | DebuggerX86.TYPE_80286],
+        [DebuggerX86.INS.LGDT, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_SHORT| DebuggerX86.TYPE_IN  | DebuggerX86.TYPE_80286],
+        [DebuggerX86.INS.LIDT, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_SHORT| DebuggerX86.TYPE_IN  | DebuggerX86.TYPE_80286],
+        [DebuggerX86.INS.SMSW, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_SHORT| DebuggerX86.TYPE_OUT | DebuggerX86.TYPE_80286],
+         DebuggerX86.aOpDescUndefined,
+        [DebuggerX86.INS.LMSW, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_SHORT| DebuggerX86.TYPE_IN  | DebuggerX86.TYPE_80286],
+         DebuggerX86.aOpDescUndefined
+      ],
+      [
+        /* GRP8 */
+         DebuggerX86.aOpDescUndefined,
+         DebuggerX86.aOpDescUndefined,
+         DebuggerX86.aOpDescUndefined,
+         DebuggerX86.aOpDescUndefined,
+        [DebuggerX86.INS.BT,  DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_IN  | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.BTS, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.BTR, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN],
+        [DebuggerX86.INS.BTC, DebuggerX86.TYPE_MODRM | DebuggerX86.TYPE_WORD  | DebuggerX86.TYPE_OUT | DebuggerX86.TYPE_80386, DebuggerX86.TYPE_IMM | DebuggerX86.TYPE_BYTE | DebuggerX86.TYPE_IN]
+      ]
+    ];
+
+    /*
+     * Table of system (non-segment) descriptors, including indicators of which ones are gates.
+     */
+    DebuggerX86.SYSDESCS = {
+        0x0100: ["tss286",       false],
+        0x0200: ["ldt",          false],
+        0x0300: ["busy tss286",  false],
+        0x0400: ["call gate",    true],
+        0x0500: ["task gate",    true],
+        0x0600: ["int gate286",  true],
+        0x0700: ["trap gate286", true],
+        0x0900: ["tss386",       false],
+        0x0B00: ["busy tss386",  false],
+        0x0C00: ["call gate386", true],
+        0x0E00: ["int gate386",  true],
+        0x0F00: ["trap gate386", true]
+    };
+
+    /*
+     * TSS field names and offsets used by dumpTSS()
+     */
+    DebuggerX86.TSS286 = {
+        "PREV_TSS":     0x00,
+        "CPL0_SP":      0x02,
+        "CPL0_SS":      0x04,
+        "CPL1_SP":      0x06,
+        "CPL1_SS":      0x08,
+        "CPL2_SP":      0x0a,
+        "CPL2_SS":      0x0c,
+        "TASK_IP":      0x0e,
+        "TASK_PS":      0x10,
+        "TASK_AX":      0x12,
+        "TASK_CX":      0x14,
+        "TASK_DX":      0x16,
+        "TASK_BX":      0x18,
+        "TASK_SP":      0x1a,
+        "TASK_BP":      0x1c,
+        "TASK_SI":      0x1e,
+        "TASK_DI":      0x20,
+        "TASK_ES":      0x22,
+        "TASK_CS":      0x24,
+        "TASK_SS":      0x26,
+        "TASK_DS":      0x28,
+        "TASK_LDT":     0x2a
+    };
+    DebuggerX86.TSS386 = {
+        "PREV_TSS":     0x00,
+        "CPL0_ESP":     0x04,
+        "CPL0_SS":      0x08,
+        "CPL1_ESP":     0x0c,
+        "CPL1_SS":      0x10,
+        "CPL2_ESP":     0x14,
+        "CPL2_SS":      0x18,
+        "TASK_CR3":     0x1C,
+        "TASK_EIP":     0x20,
+        "TASK_PS":      0x24,
+        "TASK_EAX":     0x28,
+        "TASK_ECX":     0x2C,
+        "TASK_EDX":     0x30,
+        "TASK_EBX":     0x34,
+        "TASK_ESP":     0x38,
+        "TASK_EBP":     0x3C,
+        "TASK_ESI":     0x40,
+        "TASK_EDI":     0x44,
+        "TASK_ES":      0x48,
+        "TASK_CS":      0x4C,
+        "TASK_SS":      0x50,
+        "TASK_DS":      0x54,
+        "TASK_FS":      0x58,
+        "TASK_GS":      0x5C,
+        "TASK_LDT":     0x60,
+        "TASK_IOPM":    0x64
+    };
+
+    /*
+     * Initialize every Debugger module on the page (as IF there's ever going to be more than one ;-))
+     */
+    Web.onInit(DebuggerX86.init);
+
+}   // endif DEBUGGER
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pcx86/lib/computer.js (C) Jeff Parsons 2012-2017
+ */
+
+/*
+ * BUILD INSTRUCTIONS
+ *
+ * To build PCx86 (pcx86.js), run Google's Closure Compiler, replacing "*.js" with the input file sequence defined
+ * by the "pcX86Files" property in package.json:
+ *
+ *      java -jar compiler.jar
+ *          --compilation_level ADVANCED_OPTIMIZATIONS
+ *          --define='DEBUG=false'
+ *          --warning_level=VERBOSE
+ *          --js *.js
+ *          --js_output_file pc.js
+ *
+ * Google's Closure Compiler (compiler.jar) is documented at https://developers.google.com/closure/compiler/
+ * and is available for download here:
+ *
+ *      http://closure-compiler.googlecode.com/files/compiler-latest.zip
+ *
+ * The PCx86 JavaScript files do have some initialization-order dependencies.  If you load the files individually,
+ * it's recommended that you load them in the same order that they're compiled.
+ *
+ * Generally speaking, component.js should be first, computer.js should be last (of the files based on component.js),
+ * and panel.js should be listed early so that the Control Panel is ready as soon as possible.
+ *
+ * Another recent ordering requirement is that rom.js must be loaded before ram.js; this was true before, but now
+ * it's required, because I'm starting to add ROM BIOS Data Area definitions to rom.js, and since the data area
+ * is in RAM, ram.js may want access to some of those definitions.
+ */
+
+
+
+/**
+ * TODO: The Closure Compiler treats ES6 classes as 'struct' rather than 'dict' by default,
+ * which would force us to declare all class properties in the constructor, as well as prevent
+ * us from defining any named properties.  So, for now, we mark all our classes as 'unrestricted'.
+ *
+ * @unrestricted
+ */
+class Computer extends Component {
+    /**
+     * Computer(parmsComputer, parmsMachine, fSuspended)
+     *
+     * The Computer component has no required (parmsComputer) properties, but it does
+     * support the following:
+     *
+     *      autoPower: true to automatically power the computer (default), false to wait;
+     *      false is honored only if a "power" button binding exists.
+     *
+     *      busWidth: number of memory address lines (address bits) on the computer's "bus";
+     *      20 is the minimum (and the default), which implies 8086/8088 real-mode addressing,
+     *      while 24 is required for 80286 protected-mode addressing.  This value is passed
+     *      directly through to the Bus component; see that component for more details.
+     *
+     *      resume: one of the Computer.RESUME constants, which are as follows:
+     *          '0' if resume disabled (default)
+     *          '1' if enabled without prompting
+     *          '2' if enabled with prompting
+     *          '3' if enabled with prompting and auto-delete
+     *          or a string containing the path of a predefined JSON-encoded state
+     *
+     *      state: the path to JSON-encoded state file (see details regarding 'state' below)
+     *
+     * The parmsMachine object, if provided, may contain any of:
+     *
+     *      autoMount: if set, this should override any 'autoMount' property in the FDC's
+     *      parmsFDC object.
+     *
+     *      autoPower: if set, this should override any 'autoPower' property in the Computer's
+     *      parmsComputer object.
+     *
+     *      messages: if set, this should override any 'messages' property in the Debugger's
+     *      parmsDbg object.
+     *
+     *      state: if set, this should override any 'state' property in the Computer's
+     *      parmsComputer object.
+     *
+     *      url: the location of the machine XML file
+     *
+     * If a predefined state is supplied AND it's successfully loaded, then resume behavior
+     * defaults to '1' (ie, resume enabled without prompting).
+     *
+     * This component insures that all components are ready before "powering" them.
+     *
+     * Different components become ready at different times, and initialization order (ie,
+     * the order the scripts are combined on the page) only partially determines readiness.
+     * This is because components like ROM and Video must finish loading their resource files
+     * before they are ready.  Other components become ready after we call their initBus()
+     * function, because they have a Bus or CPU dependency, such as access to memory management
+     * functions.  And other components, like CPU and Panel, are ready as soon as their
+     * constructor finishes.
+     *
+     * Once a component has indicated it's ready, we call its powerUp() notification
+     * function (if it has one--it's optional).  We call the CPU's powerUp() function last,
+     * so that the CPU is assured that all other components are ready and "powered".
+     *
+     * @this {Computer}
+     * @param {Object} parmsComputer
+     * @param {Object} [parmsMachine]
+     * @param {boolean} [fSuspended]
+     */
+    constructor(parmsComputer, parmsMachine, fSuspended)
+    {
+        super("Computer", parmsComputer, Messages.COMPUTER);
+
+        this.flags.powered = false;
+
+        this.setMachineParms(parmsMachine);
+
+        this.fAutoPower = this.getMachineParm('autoPower', parmsComputer);
+
+        /*
+         * nPowerChange is 0 while the power state is stable, 1 while power is transitioning
+         * to "on", and -1 while power is transitioning to "off".
+         */
+        this.nPowerChange = 0;
+
+        /*
+         * TODO: Deprecate 'buswidth' (it should have always used camelCase)
+         */
+        this.nBusWidth = parmsComputer['busWidth'] || parmsComputer['buswidth'];
+
+        this.resume = Computer.RESUME_NONE;
+        this.sStateData = null;
+        this.fStateData = false;            // remembers if sStateData was loaded
+        this.fServerState = false;
+
+        this.url = this.getMachineParm('url') || "";
+
+        /*
+         * Generate a random number x (where 0 <= x < 1), add 0.1 so that it's guaranteed to be
+         * non-zero, convert to base 36, and chop off the leading digit and "decimal" point.
+         */
+        this.sMachineID = (Math.random() + 0.1).toString(36).substr(2,12);
+        this.sUserID = this.queryUserID();
+
+        /*
+         * Find the appropriate CPU (and Debugger and Control Panel, if any)
+         *
+         * CLOSURE COMPILER TIP: To override the type of a right-hand expression (as we need to do here,
+         * where we know getComponentByType() will only return an X86CPU object or null), wrap the expression
+         * in parentheses.  I never knew this until I stumbled across it in "Closure: The Definitive Guide".
+         */
+        this.cpu = /** @type {X86CPU} */ (Component.getComponentByType("CPU", this.id));
+        if (!this.cpu) {
+            Component.error("Unable to find CPU component");
+            return;
+        }
+        this.dbg = /** @type {DebuggerX86} */ (Component.getComponentByType("Debugger", this.id));
+
+        /*
+         * Enumerate all Video components for future updateVideo() calls.
+         */
+        this.aVideo = [];
+        for (var video = null; (video = this.getMachineComponent("Video", video));) {
+            this.aVideo.push(video);
+        }
+
+        /*
+         * Initialize the Bus component
+         */
+        this.bus = new Bus({'id': this.idMachine + '.bus', 'busWidth': this.nBusWidth}, this.cpu, this.dbg);
+
+        /*
+         * Iterate through all the components and connect them to the Control Panel, if any
+         */
+        var iComponent, component;
+        var aComponents = Component.getComponents(this.id);
+        this.panel = /** @type {Panel} */ (Component.getComponentByType("Panel", this.id));
+
+        if (this.panel && this.panel.controlPrint) {
+            for (iComponent = 0; iComponent < aComponents.length; iComponent++) {
+                component = aComponents[iComponent];
+                /*
+                 * I can think of many "cleaner" ways for the Control Panel component to pass its
+                 * notice(), println(), etc, overrides on to all the other components, but it's just
+                 * too darn convenient to slam those overrides into the components directly.
+                 */
+                component.notice = this.panel.notice;
+                component.println = this.panel.println;
+                component.controlPrint = this.panel.controlPrint;
+            }
+        }
+
+        this.println(PCX86.APPNAME + " v" + (XMLVERSION || PCX86.APPVERSION) + "\n" + COPYRIGHT + "\n" + LICENSE);
+
+        if (DEBUG && this.messageEnabled()) this.printMessage("PREFETCH: " + PREFETCH + ", TYPEDARRAYS: " + TYPEDARRAYS);
+
+        /*
+         * Iterate through all the components again and call their initBus() handler, if any
+         */
+        for (iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            component = aComponents[iComponent];
+            if (component.initBus) component.initBus(this, this.bus, this.cpu, this.dbg);
+        }
+
+        var sStatePath = null;
+        var sResume = parmsComputer['resume'];
+        if (sResume !== undefined) {
+            /*
+             * Decide whether the 'resume' property is a number or the path of a state file to resume.
+             */
+            if (sResume.length > 1) {
+                sStatePath = this.sResumePath = sResume;
+            } else {
+                this.resume = parseInt(sResume, 10);
+            }
+        }
+
+        /*
+         * The Computer 'state' property allows a state file to be specified independent of the 'resume' feature;
+         * previously, you could only use 'resume' to load a state file -- which we still support, but loading a state
+         * file that way prevents the machine's state from being saved, since we always resume from the 'resume' file.
+         *
+         * The other wrinkle is on the restore side: we need to IGNORE the 'state' property if a saved state now exists.
+         * So we have to peek at localStorage, and unfortunately, the only way to "peek" is to actually load the data,
+         * but we're not ready to use it yet, so powerUp() has been changed to use any existing stateComputer that we've
+         * already loaded.
+         *
+         * However, there's now a wrinkle to the wrinkle: if a 'state' parameter has been passed via the URL, then that
+         * OVERRIDES everything; it overrides any 'state' Computer parameter AND it disables resume of any saved state in
+         * localStorage (in other words, it prevents fAllowResume from being true, and forcing resume off).
+         */
+        var fAllowResume;
+        var sState = this.getMachineParm('state') || (fAllowResume = true) && parmsComputer['state'];
+
+        if (sState) {
+            sStatePath = this.sStatePath = sState;
+            if (!fAllowResume) {
+                this.fServerState = true;
+                this.resume = Computer.RESUME_NONE;
+            }
+            if (this.resume) {
+                this.stateComputer = new State(this, PCX86.APPVERSION);
+                if (this.stateComputer.load()) {
+                    sStatePath = null;
+                } else {
+                    delete this.stateComputer;
+                }
+            }
+        }
+
+        /*
+         * If sStatePath is set, we must use it.  But if there's no sStatePath AND resume is set,
+         * then we have the option of resuming from a server-side state, assuming a valid USERID.
+         */
+        if (!sStatePath && this.resume) {
+            sStatePath = this.getServerStatePath();
+            if (sStatePath) this.fServerState = true;
+        }
+
+        if (!sStatePath) {
+            this.setReady();
+        } else {
+            var cmp = this;
+            Web.getResource(sStatePath, null, true, function(sURL, sResource, nErrorCode) {
+                cmp.doneLoad(sURL, sResource, nErrorCode);
+            });
+        }
+
+        if (!this.bindings["power"]) this.fAutoPower = true;
+
+        /*
+         * Power on the computer, giving every component the opportunity to reset or restore itself.
+         */
+        if (!fSuspended && this.fAutoPower) this.wait(this.powerOn);
+    }
+
+    /**
+     * getMachineID()
+     *
+     * @return {string}
+     */
+    getMachineID()
+    {
+        return this.sMachineID;
+    }
+
+    /**
+     * setMachineParms(parmsMachine)
+     *
+     * If no explicit machine parms were provided, then we check for 'parms' in the bundled resources (if any).
+     *
+     * @param {Object} [parmsMachine]
+     */
+    setMachineParms(parmsMachine)
+    {
+        if (!parmsMachine) {
+            var sParms;
+            if (typeof resources == 'object' && (sParms = resources['parms'])) {
+                try {
+                    parmsMachine = /** @type {Object} */ (eval("(" + sParms + ")"));
+                } catch(e) {
+                    Component.error(e.message + " (" + sParms + ")");
+                }
+            }
+        }
+        this.parmsMachine = parmsMachine;
+    }
+
+    /**
+     * getMachineParm(sParm, parmsComponent)
+     *
+     * If the machine parameter doesn't exist, we check for a matching component parameter (if parmsComponent is provided),
+     * and failing that, we check the bundled resources (if any).
+     *
+     * At the moment, the only bundled resource request we expect to encounter is 'state'; if it exists, then we return
+     * 'state' back to the caller (ie, the name of the resource), so that the caller will then attempt to load the 'state'
+     * resource to obtain the actual state.
+     *
+     * @param {string} sParm
+     * @param {Object} [parmsComponent]
+     * @return {string|undefined}
+     */
+    getMachineParm(sParm, parmsComponent)
+    {
+        /*
+         * When using getURLParm(), the check is allowed be a bit looser, because URL parameters are
+         * user-supplied, whereas most other parameters are developer-supplied.  Granted, a developer
+         * may also be sloppy and neglect to use correct case (eg, 'automount' instead of 'autoMount'),
+         * but there are limits to my paranoia.
+         */
+        var sParmLC = sParm.toLowerCase();
+        var value = Web.getURLParm(sParm) || Web.getURLParm(sParmLC);
+
+        if (value === undefined && this.parmsMachine) {
+            value = this.parmsMachine[sParm];
+        }
+        if (value === undefined && parmsComponent) {
+            value = parmsComponent[sParm];
+        }
+        if (value === undefined && typeof resources == 'object' && resources[sParm]) {
+            value = sParm;
+        }
+        return value;
+    }
+
+    /**
+     * saveMachineParms()
+     *
+     * @return {string|null}
+     */
+    saveMachineParms()
+    {
+        return this.parmsMachine? JSON.stringify(this.parmsMachine) : null;
+    }
+
+    /**
+     * getUserID()
+     *
+     * @return {string}
+     */
+    getUserID()
+    {
+        return this.sUserID || "";
+    }
+
+    /**
+     * doneLoad(sURL, sStateData, nErrorCode)
+     *
+     * @this {Computer}
+     * @param {string} sURL
+     * @param {string} sStateData
+     * @param {number} nErrorCode
+     */
+    doneLoad(sURL, sStateData, nErrorCode)
+    {
+        if (!nErrorCode) {
+            this.sStateData = sStateData;
+            this.fStateData = true;
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage("loaded state file " + sURL.replace(this.sUserID || "xxx", "xxx"));
+            }
+        } else {
+            this.sResumePath = null;
+            this.fServerState = false;
+            this.notice('Unable to load machine state from server (error ' + nErrorCode + (sStateData? ': ' + Str.trim(sStateData) : '') + ')');
+        }
+        this.setReady();
+    }
+
+    /**
+     * wait(fn, parms)
+     *
+     * wait() waits until every component is ready (including ourselves, the last component we check), then calls the
+     * specified Computer method.
+     *
+     * TODO: The Closure Compiler makes it difficult for us to define a function type for "fn" that works in all cases;
+     * sometimes we want to pass a function that takes only a "number", and other times we want to pass a function that
+     * takes only an "Array" (the type will mirror that of the "parms" parameter).  However, the Closure Compiler insists
+     * that both functions must be declared as accepting both types of parameters.  So once again, we must use an untyped
+     * function declaration, instead of something stricter like:
+     *
+     *      param {function(this:Computer, (number|Array|undefined)): undefined} fn
+     *
+     * @this {Computer}
+     * @param {function(...)} fn
+     * @param {number|Array} [parms] optional parameters
+     */
+    wait(fn, parms)
+    {
+        var computer = this;
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent <= aComponents.length; iComponent++) {
+            var component = (iComponent < aComponents.length ? aComponents[iComponent] : this);
+            if (!component.isReady()) {
+                component.isReady(function onComponentReady() {
+                    computer.wait(fn, parms);
+                });
+                return;
+            }
+        }
+        if (DEBUG && this.messageEnabled()) this.printMessage("Computer.wait(ready)");
+        fn.call(this, parms);
+    }
+
+    /**
+     * validateState(stateComputer)
+     *
+     * NOTE: We clear() stateValidate only when there's no stateComputer.
+     *
+     * @this {Computer}
+     * @param {State|null} [stateComputer]
+     * @return {boolean} true if state passes validation, false if not
+     */
+    validateState(stateComputer)
+    {
+        var fValid = true;
+        var stateValidate = new State(this, PCX86.APPVERSION, Computer.STATE_VALIDATE);
+        if (stateValidate.load() && stateValidate.parse()) {
+            var sTimestampValidate = stateValidate.get(Computer.STATE_TIMESTAMP);
+            var sTimestampComputer = stateComputer ? stateComputer.get(Computer.STATE_TIMESTAMP) : "unknown";
+            if (sTimestampValidate != sTimestampComputer) {
+                this.notice("Machine state may be out-of-date\n(" + sTimestampValidate + " vs. " + sTimestampComputer + ")\nCheck your browser's local storage limits");
+                fValid = false;
+                if (!stateComputer) stateValidate.clear();
+            } else {
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage("Last state: " + sTimestampComputer + " (validate: " + sTimestampValidate + ")");
+                }
+            }
+        }
+        return fValid;
+    }
+
+    /**
+     * powerOn(resume)
+     *
+     * Power every component "up", applying any previously available state information.
+     *
+     * @this {Computer}
+     * @param {number} [resume] is a valid RESUME value; default is this.resume
+     */
+    powerOn(resume)
+    {
+        if (resume === undefined) {
+            resume = this.resume || (this.sStateData? Computer.RESUME_AUTO : Computer.RESUME_NONE);
+        }
+
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("Computer.powerOn(" + (resume == Computer.RESUME_REPOWER ? "repower" : (resume ? "resume" : "")) + ")");
+        }
+
+        if (this.nPowerChange) {
+            return;
+        }
+        this.nPowerChange++;
+
+        var fRepower = false;
+        var fRestore = false;
+        this.fRestoreError = false;
+        var stateComputer = this.stateComputer || new State(this, PCX86.APPVERSION);
+
+        if (resume == Computer.RESUME_REPOWER) {
+            fRepower = true;
+        }
+        else if (resume > Computer.RESUME_NONE) {
+            if (stateComputer.load(this.sStateData)) {
+                /*
+                 * Since we're resuming something (either a predefined state or a state from localStorage), let's
+                 * create a "failsafe" checkpoint in localStorage, and destroy it at the end of a successful powerOn().
+                 * Which means, of course, that if a previous "failsafe" checkpoint already exists, something bad
+                 * may have happened the last time around.
+                 */
+                this.stateFailSafe = new State(this, PCX86.APPVERSION, Computer.STATE_FAILSAFE);
+                if (this.stateFailSafe.load()) {
+                    this.powerReport(stateComputer);
+                    /*
+                     * We already know resume is something other than RESUME_NONE, so we'll go ahead and bump it
+                     * all the way to RESUME_PROMPT, so that the user will be prompted, and if the user declines to
+                     * restore, the state will be removed.
+                     */
+                    resume = Computer.RESUME_PROMPT;
+                    /*
+                     * To ensure that the set() below succeeds, we need to call unload(), otherwise it may fail
+                     * with a "read only" error (eg, "TypeError: Cannot assign to read only property 'timestamp'").
+                     */
+                    this.stateFailSafe.unload();
+                }
+
+                this.stateFailSafe.set(Computer.STATE_TIMESTAMP, Usr.getTimestamp());
+                this.stateFailSafe.store();
+
+                var fValidate = this.resume && !this.fServerState;
+                if (resume == Computer.RESUME_AUTO || Component.confirmUser("Click OK to restore the previous " + PCX86.APPNAME + " machine state, or CANCEL to reset the machine.")) {
+                    fRestore = stateComputer.parse();
+                    if (fRestore) {
+                        var sCode = stateComputer.get(UserAPI.RES.CODE);
+                        var sData = stateComputer.get(UserAPI.RES.DATA);
+                        if (sCode) {
+                            if (sCode == UserAPI.CODE.OK) {
+                                stateComputer.load(/** @type {string} */ (sData));
+                            } else {
+                                /*
+                                 * A missing (or not yet created) state file is no cause for alarm, but other errors might be
+                                 */
+                                if (sCode == UserAPI.CODE.FAIL && sData != UserAPI.FAIL.NOSTATE) {
+                                    this.notice("Error: " + sData);
+                                    if (sData == UserAPI.FAIL.VERIFY) this.resetUserID();
+                                } else {
+                                    this.println(sCode + ": " + sData);
+                                }
+                                /*
+                                 * Try falling back to the state that we should have saved in localStorage, as a backup to the
+                                 * server-side state.
+                                 */
+                                stateComputer.unload();     // discard the invalid server-side state first
+                                if (stateComputer.load()) {
+                                    fRestore = stateComputer.parse();
+                                    fValidate = true;
+                                } else {
+                                    fRestore = false;       // hmmm, there was nothing in localStorage either
+                                }
+                            }
+                        }
+                    }
+                    /*
+                     * If the load/parse was successful, and it was from localStorage (not sStateData),
+                     * then we should to try verify that localStorage snapshot is current.  One reason it may
+                     * NOT be current is if localStorage was full and we got a quota error during the last
+                     * powerOff().
+                     */
+                    if (fValidate) this.validateState(fRestore? stateComputer : null);
+                } else {
+                    /*
+                     * RESUME_PROMPT indicates we should delete the state if they clicked Cancel to confirm() above.
+                     */
+                    if (resume == Computer.RESUME_PROMPT) stateComputer.clear();
+                }
+            } else {
+                /*
+                 * If there's no state, then there should also be no validation timestamp; if there is, then once again,
+                 * we're probably dealing with a quota error.
+                 */
+                this.validateState();
+            }
+            delete this.sStateData;
+            delete this.stateComputer;
+        }
+
+        /*
+         * Start powering all components, including any data they may need to restore their state;
+         * we restore power to the CPU last.
+         */
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component !== this && component != this.cpu) {
+                fRestore = this.powerRestore(component, stateComputer, fRepower, fRestore);
+            }
+        }
+
+        /*
+         * Assuming this is not a repower, we must perform another wait, because some components may
+         * have marked themselves as "not ready" again (eg, the FDC component, if the restore forced it
+         * to mount one or more additional disk images).
+         */
+        var aParms = [stateComputer, resume, fRestore];
+
+        if (resume != Computer.RESUME_REPOWER) {
+            this.wait(this.donePowerOn, aParms);
+            return;
+        }
+        this.donePowerOn(aParms);
+    }
+
+    /**
+     * powerRestore(component, stateComputer, fRepower, fRestore)
+     *
+     * @this {Computer}
+     * @param {Component} component
+     * @param {State} stateComputer
+     * @param {boolean} fRepower
+     * @param {boolean} fRestore
+     * @return {boolean} true if restore should continue, false if not
+     */
+    powerRestore(component, stateComputer, fRepower, fRestore)
+    {
+        if (!component.flags.powered) {
+
+            component.flags.powered = true;
+
+            if (component.powerUp) {
+
+                var data = null;
+                if (fRestore) {
+                    data = stateComputer.get(component.id);
+                    if (!data) {
+                        /*
+                         * This is a hack that makes it possible for a machine whose ID has been
+                         * supplemented with a suffix (a single letter or digit) to find object IDs
+                         * in states created from a machine without the suffix.
+                         *
+                         * For example, if a state file was created from a machine with ID "ibm5160"
+                         * but the current machine is "ibm5160a", this attempts a second lookup with
+                         * "ibm5160", enabling us to find objects that match the original machine ID
+                         * (eg, "ibm5160.romEGA").
+                         */
+                        data = stateComputer.get(component.id.replace(/[a-z0-9]\./i, '.'));
+                    }
+                }
+
+                /*
+                 * State.get() will return whatever was originally passed to State.set() (eg, an
+                 * Object or a string), but components are supposed to store only Objects, so if a
+                 * string comes back, something went wrong.  By explicitly eliminating "string" data,
+                 * the Closure Compiler stops complaining that we might be passing strings to our
+                 * powerUp() functions (even though we know we're not).
+                 *
+                 * TODO: Determine if there's some way to coerce the Closure Compiler into treating
+                 * data as Object or null, without having to include this runtime check.  An assert
+                 * would be a good idea, but this is overkill.
+                 */
+                if (typeof data === "string") data = null;
+
+                /*
+                 * If computer is null, this is simply a repower notification, which most components
+                 * don't do anything with.  Exceptions include: CPU (since it may be halted) and Video
+                 * (since its screen may be "turned off").
+                 */
+                if (!component.powerUp(data, fRepower) && data) {
+
+                    Component.error("Unable to restore state for " + component.type);
+                    /*
+                     * If this is a resume error for a machine that also has a predefined state
+                     * AND we're not restoring from that state, then throw away the current state,
+                     * prevent any new state from being created, and then force a reload, which will
+                     * hopefully restore us to the functioning predefined state.
+                     *
+                     * TODO: Considering doing this in ALL cases, not just in situations where a
+                     * 'state' exists but we're not actually resuming from it.
+                     */
+                    if (this.sStatePath && !this.fStateData) {
+                        stateComputer.clear();
+                        this.resume = Computer.RESUME_NONE;
+                        Web.reloadPage();
+                    } else {
+                        /*
+                         * In all other cases, we set fRestoreError, which should trigger a call to
+                         * powerReport() and then delete the offending state.
+                         */
+                        this.fRestoreError = true;
+                    }
+                    /*
+                     * Any failure triggers an automatic to call powerUp() again, without any state,
+                     * in the hopes that the component can recover by performing a reset.
+                     */
+                    component.powerUp(null);
+                    /*
+                     * We also disable the rest of the restore operation, because it's not clear
+                     * the remaining state information can be trusted;  the machine is already in an
+                     * inconsistent state, so we're not likely to make things worse, and the only
+                     * alternative (starting over and performing a state-less reset) isn't likely to make
+                     * the user any happier.  But, we'll see... we need some experience with the code.
+                     */
+                    fRestore = false;
+                }
+            }
+
+            if (!fRepower && component.comment) {
+                var asComments = component.comment.split("|");
+                for (var i = 0; i < asComments.length; i++) {
+                    component.status(asComments[i]);
+                }
+            }
+        }
+        return fRestore;
+    }
+
+    /**
+     * donePowerOn(aParms)
+     *
+     * This is nothing more than a continuation of powerOn(), giving us the option of calling wait() one more time.
+     *
+     * @this {Computer}
+     * @param {Array} aParms containing [stateComputer, resume, fRestore]
+     */
+    donePowerOn(aParms)
+    {
+        var stateComputer = aParms[0];
+        var fRepower = (aParms[1] < 0);
+        var fRestore = aParms[2];
+
+        if (DEBUG && this.flags.powered && this.messageEnabled()) {
+            this.printMessage("Computer.donePowerOn(): redundant");
+        }
+
+        this.fInitialized = true;
+        this.flags.powered = true;
+        var controlPower = this.bindings["power"];
+        if (controlPower) controlPower.textContent = "Shutdown";
+
+        /*
+         * Once we get to this point, we're guaranteed that all components are ready, so it's safe to power the CPU;
+         * the CPU should begin executing immediately, unless a debugger is attached.
+         */
+        if (this.cpu) {
+            /*
+             * TODO: Do we not care about the return value here? (ie, is checking fRestoreError sufficient)?
+             */
+            this.powerRestore(this.cpu, stateComputer, fRepower, fRestore);
+            this.cpu.autoStart();
+        }
+
+        /*
+         * If the state was bad, offer to report it and then delete it.  Deleting may be moot, since invariably a new
+         * state will be created on powerOff() before the next powerOn(), but it seems like good paranoia all the same.
+         */
+        if (this.fRestoreError) {
+            this.powerReport(stateComputer);
+            stateComputer.clear();
+        }
+
+        if (!fRepower && this.stateFailSafe) {
+            this.stateFailSafe.clear();
+            delete this.stateFailSafe;
+        }
+
+        this.nPowerChange = 0;
+    }
+
+    /**
+     * checkPower()
+     *
+     * @this {Computer}
+     * @return {boolean} true if the computer is fully powered, false otherwise
+     */
+    checkPower()
+    {
+        if (this.flags.powered) return true;
+
+        var component = null, iComponent;
+        var aComponents = Component.getComponents(this.id);
+        for (iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            component = aComponents[iComponent];
+            if (component !== this && !component.flags.ready) break;
+        }
+        if (iComponent == aComponents.length) {
+            for (iComponent = 0; iComponent < aComponents.length; iComponent++) {
+                component = aComponents[iComponent];
+                if (component !== this && !component.flags.powered) break;
+            }
+        }
+        if (iComponent == aComponents.length) component = this;
+        var s = "The " + component.type + " component (" + component.id + ") is not " + (!component.flags.ready? "ready yet" + (component.fnReady? " (waiting for notification)" : "") : "powered yet") + ".";
+        Component.alertUser(s);
+        return false;
+    }
+
+    /**
+     * powerReport(stateComputer)
+     *
+     * @this {Computer}
+     * @param {State} stateComputer
+     */
+    powerReport(stateComputer)
+    {
+        if (Component.confirmUser("There may be a problem with your " + PCX86.APPNAME + " machine.\n\nTo help us diagnose it, click OK to send this " + PCX86.APPNAME + " machine state to http://" + SITEHOST + ".")) {
+            Web.sendReport(PCX86.APPNAME, PCX86.APPVERSION, this.url, this.getUserID(), ReportAPI.TYPE.BUG, stateComputer.toString());
+        }
+    }
+
+    /**
+     * powerOff(fSave, fShutdown)
+     *
+     * Power every component "down" and optionally save the machine state.
+     *
+     * There's one scenario that powerOff() isn't currently able to deal with very effectively: what to do when
+     * the user switches away while it's still being restored, causing Disk getResource() calls to fail.  The
+     * Disk component calls notify() when that happens -- see Disk.mount() -- but the FDC and HDC controllers don't
+     * notify *us* of those problems, so Computer assumes that the restore was completely successful, when in fact
+     * it was only partially successful.
+     *
+     * Then we immediately arrive here to perform a save, following that incomplete restore.  It would be wrong to
+     * deal with that incomplete restore by setting fRestoreError, because we don't want to trigger a powerReport()
+     * and the deletion of the previous state, because the state itself was presumably OK.  Unfortunately, the new
+     * state we now save will no longer include manually mounted disk images whose remounts were interrupted, so future
+     * restores won't remount them either.
+     *
+     * We could perhaps solve this by having the Disk component notify us in those situations, set a new flag
+     * (fRestoreIncomplete?), and set fSave to false if that's ever set.  Be careful though: when fSave is false,
+     * that means MORE than not saving; it also means deleting any previous state, which is NOT what you'd want to
+     * do in a "fRestoreIncomplete" situation.  Also, we have to worry about Disk operations that fail for other reasons,
+     * making sure those failures don't interfere with the save process in the same way.
+     *
+     * As it stands, the worst that happens is any manually mounted disk images might have to be manually remounted,
+     * which doesn't seem like a huge problem.
+     *
+     * @this {Computer}
+     * @param {boolean} [fSave] is true to request a saved state
+     * @param {boolean} [fShutdown] is true if the machine is being shut down
+     * @return {string|null} string representing the saved state (or null if error)
+     */
+    powerOff(fSave, fShutdown)
+    {
+        var data;
+        var sState = "none";
+
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("Computer.powerOff(" + (fSave ? "save" : "nosave") + (fShutdown ? ",shutdown" : "") + ")");
+        }
+
+        if (this.nPowerChange) {
+            return null;
+        }
+        this.nPowerChange--;
+
+        var stateComputer = new State(this, PCX86.APPVERSION);
+        var stateValidate = new State(this, PCX86.APPVERSION, Computer.STATE_VALIDATE);
+
+        var sTimestamp = Usr.getTimestamp();
+        stateValidate.set(Computer.STATE_TIMESTAMP, sTimestamp);
+        stateComputer.set(Computer.STATE_TIMESTAMP, sTimestamp);
+        stateComputer.set(Computer.STATE_VERSION, APPVERSION);
+        stateComputer.set(Computer.STATE_HOSTURL, Web.getHostURL());
+        stateComputer.set(Computer.STATE_BROWSER, Web.getUserAgent());
+
+        /*
+         * Always power the CPU "down" first, just to help insure it doesn't ask other components to do anything
+         * after they're no longer ready.
+         */
+        if (this.cpu && this.cpu.powerDown) {
+            if (fShutdown) this.cpu.stopCPU();
+            data = this.cpu.powerDown(fSave, fShutdown);
+            if (typeof data === "object") stateComputer.set(this.cpu.id, data);
+            if (fShutdown) {
+                this.cpu.flags.powered = false;
+                if (data === false) sState = null;
+            }
+        }
+
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component.flags.powered) {
+                if (component.powerDown) {
+                    data = component.powerDown(fSave, fShutdown);
+                    if (typeof data === "object") stateComputer.set(component.id, data);
+                }
+                if (fShutdown) {
+                    component.flags.powered = false;
+                    if (data === false) sState = null;
+                }
+            }
+        }
+
+        if (sState) {
+            if (fShutdown) {
+                var fClear = false;
+                var fClearAll = false;
+                if (fSave) {
+                    if (this.sUserID) {
+                        this.saveServerState(this.sUserID, stateComputer.toString());
+                    }
+                    if (!stateValidate.store() || !stateComputer.store()) {
+                        sState = null;
+                        /*
+                         * New behavior as of v1.13.2:  if it appears that localStorage is full, we blow it ALL away.
+                         * Dedicated server-side storage is the only way we'll ever be able to reliably preserve a
+                         * particular machine's state.  Historically, attempting to limp along with whatever localStorage
+                         * is left just generates the same useless and annoying warnings over and over.
+                         */
+                        fClear = fClearAll = true;
+                    }
+                }
+                else {
+                    /*
+                     * I used to ALWAYS clear (ie, delete) any associated computer state, but now I do this only if the
+                     * current machine is "resumable", because there are situations where I have two configurations
+                     * for the same machine -- one resumable and one not -- and I don't want the latter throwing away the
+                     * state of the former.
+                     *
+                     * So this code is here now strictly for callers to delete the state of a "resumable" machine, not as
+                     * some paranoid clean-up operation.
+                     *
+                     * An undocumented feature of this operation is that if your configuration uses the special 'resume="3"'
+                     * value, and you click the "Reset" button, and then you click OK to reset the everything, this will
+                     * actually reset EVERYTHING (ie, all localStorage for ALL configs will be reclaimed).
+                     */
+                    if (this.resume) {
+                        fClear = true;
+                        fClearAll = (this.resume == Computer.RESUME_DELETE);
+                    }
+                }
+                if (fClear) {
+                    stateComputer.clear(fClearAll);
+                }
+            } else {
+                sState = stateComputer.toString();
+            }
+        }
+
+        if (fShutdown) {
+            this.flags.powered = false;
+            var controlPower = this.bindings["power"];
+            if (controlPower) controlPower.textContent = "Power";
+        }
+
+        this.nPowerChange = 0;
+
+        return sState;
+    }
+
+    /**
+     * reset()
+     *
+     * Notify all (other) components with a reset() method that the Computer is being reset.
+     *
+     * NOTE: We'd like to reset the Bus first (due to the importance of the A20 line), but since we
+     * allocated the Bus object ourselves, after all the other components were allocated, it ends
+     * up near the end of Component's list of components.  Hence the special case for this.bus below.
+     *
+     * @this {Computer}
+     */
+    reset()
+    {
+        if (this.bus && this.bus.reset) {
+            /*
+             * TODO: Why does WebStorm think that this.bus.type is undefined? The base class (Component)
+             * constructor defines it.
+             */
+            this.printMessage("Resetting " + this.bus.type);
+            this.bus.reset();
+        }
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component !== this && component !== this.bus && component.reset) {
+                this.printMessage("Resetting " + component.type);
+                component.reset();
+            }
+        }
+    }
+
+    /**
+     * start(ms, nCycles)
+     *
+     * Notify all (other) components with a start() method that the CPU has started.
+     *
+     * Note that we're called by runCPU(), which is why we exclude the CPU component,
+     * as well as ourselves.
+     *
+     * @this {Computer}
+     * @param {number} ms
+     * @param {number} nCycles
+     */
+    start(ms, nCycles)
+    {
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component.type == "CPU" || component === this) continue;
+            if (component.start) {
+                component.start(ms, nCycles);
+            }
+        }
+    }
+
+    /**
+     * stop(ms, nCycles)
+     *
+     * Notify all (other) components with a stop() method that the CPU has stopped.
+     *
+     * Note that we're called by runCPU(), which is why we exclude the CPU component,
+     * as well as ourselves.
+     *
+     * @this {Computer}
+     * @param {number} ms
+     * @param {number} nCycles
+     */
+    stop(ms, nCycles)
+    {
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component.type == "CPU" || component === this) continue;
+            if (component.stop) {
+                component.stop(ms, nCycles);
+            }
+        }
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * @this {Computer}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "reset")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue)
+    {
+        var computer = this;
+
+        switch (sBinding) {
+        case "power":
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickPower() {
+                computer.onPower();
+            };
+            return true;
+
+        case "reset":
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickReset() {
+                computer.onReset();
+            };
+            return true;
+
+        /*
+         * Technically, this binding should now be called "saveState", to clearly distinguish it from
+         * the "Save Machine" control that's normally bound to the savePC() function in save.js.  Saving
+         * an entire machine includes everything needed to start/restore the machine; eg, the machine
+         * XML configuration file(s) *and* the JSON-encoded machine state.
+         */
+        case "save":
+            /*
+             * Since this feature depends on the server supporting the PCjs User API (see userapi.js),
+             * and since pcjs.org is no longer running a Node web server, we disable the feature for that
+             * particular host.
+             */
+            if (Str.endsWith(Web.getHost(), "pcjs.org")) {
+                if (DEBUG) this.log("Remote user API not available");
+                /*
+                 * We could also simply hide the control; eg:
+                 *
+                 *      control.style.display = "none";
+                 *
+                 * but removing the control altogether seems better.
+                 */
+                control.parentNode.removeChild(/** @type {Node} */ (control));
+                return false;
+            }
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickSave() {
+                var sUserID = computer.queryUserID(true);
+                if (sUserID) {
+                    /*
+                     * I modified the test to include a check for sStatePath so that I could save new states
+                     * for machines with existing states; otherwise, I'd have no (easy) way of capturing and
+                     * updating their state.  Making the machine (even temporarily) resumable would have been
+                     * one work-around, but it's not appropriate for some machines, as their state is simply
+                     * too large (for localStorage anyway, which is the default storage solution).
+                     */
+                    var fSave = !!(computer.resume && !computer.sResumePath || computer.sStatePath);
+                    var sState = computer.powerOff(fSave);
+                    if (fSave) {
+                        computer.saveServerState(sUserID, sState);
+                    } else {
+                        computer.notice("Resume disabled, machine state not saved");
+                    }
+                }
+                /*
+                 * This seemed like a handy alternative, but it turned out to be a no-go, at least for large states:
+                 *
+                 *      var sState = computer.powerOff(true);
+                 *      if (sState) {
+                 *          sState = "data:text/json;charset=utf-8," + encodeURIComponent(sState);
+                 *          window.open(sState);
+                 *      }
+                 *
+                 * Perhaps if I embedded the data in a link on the current page instead; eg:
+                 *
+                 *      $('<a href="' + sState + '" download="state.json">Download</a>').appendTo('#container');
+                 */
+            };
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * resetUserID()
+     */
+    resetUserID()
+    {
+        Web.setLocalStorageItem(Computer.STATE_USERID, "");
+        this.sUserID = null;
+    }
+
+    /**
+     * queryUserID(fPrompt)
+     *
+     * @param {boolean} [fPrompt]
+     * @returns {string|null|undefined}
+     */
+    queryUserID(fPrompt)
+    {
+        var sUserID = this.sUserID;
+        if (!sUserID) {
+            sUserID = Web.getLocalStorageItem(Computer.STATE_USERID);
+            if (sUserID !== undefined) {
+                if (!sUserID && fPrompt) {
+                    /*
+                     * NOTE: Warning the user here that "Save" operations are not currently supported by pcjs.org is
+                     * merely a precaution, because ordinarily, setBinding() should have already determined if we are
+                     * running from pcjs.org and disabled any "Save" button.
+                     */
+                    sUserID = Component.promptUser("Saving machine states on the pcjs.org server is currently unsupported.\n\nIf you're running your own server, enter your user ID below.");
+                    if (sUserID) {
+                        sUserID = this.verifyUserID(sUserID);
+                        if (!sUserID) this.notice("The user ID is invalid.");
+                    }
+                }
+            } else if (fPrompt) {
+                this.notice("Browser local storage is not available");
+            }
+        }
+        return sUserID;
+    }
+
+    /**
+     * verifyUserID(sUserID)
+     *
+     * @this {Computer}
+     * @param {string} sUserID
+     * @return {string} validated user ID, or null if error
+     */
+    verifyUserID(sUserID)
+    {
+        this.sUserID = null;
+        var fMessages = DEBUG && this.messageEnabled();
+        if (fMessages) this.printMessage("verifyUserID(" + sUserID + ")");
+        var sRequest = Web.getHost() + UserAPI.ENDPOINT + '?' + UserAPI.QUERY.REQ + '=' + UserAPI.REQ.VERIFY + '&' + UserAPI.QUERY.USER + '=' + sUserID;
+        var response = Web.getResource(sRequest);
+        var nErrorCode = response[0];
+        var sResponse = response[1];
+        if (!nErrorCode && sResponse) {
+            try {
+                response = eval("(" + sResponse + ")");
+                if (response.code && response.code == UserAPI.CODE.OK) {
+                    Web.setLocalStorageItem(Computer.STATE_USERID, response.data);
+                    if (fMessages) this.printMessage(Computer.STATE_USERID + " updated: " + response.data);
+                    this.sUserID = response.data;
+                } else {
+                    if (fMessages) this.printMessage(response.code + ": " + response.data);
+                }
+            } catch (e) {
+                Component.error(e.message + " (" + sResponse + ")");
+            }
+        } else {
+            if (fMessages) this.printMessage("invalid response (error " + nErrorCode + ")");
+        }
+        return this.sUserID;
+    }
+
+    /**
+     * getServerStatePath()
+     *
+     * @this {Computer}
+     * @return {string|null} sStatePath (null if no localStorage or no USERID stored in localStorage)
+     */
+    getServerStatePath()
+    {
+        var sStatePath = null;
+        if (this.sUserID) {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage(Computer.STATE_USERID + " for load: " + this.sUserID);
+            }
+            sStatePath = Web.getHost() + UserAPI.ENDPOINT + '?' + UserAPI.QUERY.REQ + '=' + UserAPI.REQ.LOAD + '&' + UserAPI.QUERY.USER + '=' + this.sUserID + '&' + UserAPI.QUERY.STATE + '=' + State.key(this, PCX86.APPVERSION);
+        } else {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage(Computer.STATE_USERID + " unavailable");
+            }
+        }
+        return sStatePath;
+    }
+
+    /**
+     * saveServerState(sUserID, sState)
+     *
+     * @param {string} sUserID
+     * @param {string|null} sState
+     */
+    saveServerState(sUserID, sState)
+    {
+        /*
+         * We must pass fSync == true, because (as I understand it) browsers will blow off any async
+         * requests when a page is being closed.  Since our request is synchronous, storeServerState()
+         * should also return a result, but there's not much we can do with it, since browsers ALSO
+         * tend to blow off alerts() and the like when closing down.
+         */
+        if (sState) {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage("size of server state: " + sState.length + " bytes");
+            }
+            var response = this.storeServerState(sUserID, sState, true);
+            if (response && response[UserAPI.RES.CODE] == UserAPI.CODE.OK) {
+                this.notice("Machine state saved to server");
+            } else if (sState) {
+                var sError = (response && response[UserAPI.RES.DATA]) || UserAPI.FAIL.BADSTORE;
+                if (response[UserAPI.RES.CODE] == UserAPI.CODE.FAIL) {
+                    sError = "Error: " + sError;
+                } else {
+                    sError = "Error " + response[UserAPI.RES.CODE] + ": " + sError;
+                }
+                this.notice(sError);
+                this.resetUserID();
+            }
+        } else {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage("no state to store");
+            }
+        }
+    }
+
+    /**
+     * storeServerState(sUserID, sState, fSync)
+     *
+     * @this {Computer}
+     * @param {string} sUserID
+     * @param {string} sState
+     * @param {boolean} [fSync] is true if we're powering down and should perform a synchronous request (default is async)
+     * @return {*} server response if fSync is true and a response was received; otherwise null
+     */
+    storeServerState(sUserID, sState, fSync)
+    {
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage(Computer.STATE_USERID + " for store: " + sUserID);
+        }
+        /*
+         * TODO: Determine whether or not any browsers cancel our request if we're called during a browser "shutdown" event,
+         * and whether or not it matters if we do an async request (currently, we're not, to try to ensure the request goes through).
+         */
+        var dataPost = {};
+        dataPost[UserAPI.QUERY.REQ] = UserAPI.REQ.STORE;
+        dataPost[UserAPI.QUERY.USER] = sUserID;
+        dataPost[UserAPI.QUERY.STATE] = State.key(this, PCX86.APPVERSION);
+        dataPost[UserAPI.QUERY.DATA] = sState;
+        var sRequest = Web.getHost() + UserAPI.ENDPOINT;
+        if (!fSync) {
+            Web.getResource(sRequest, dataPost, true);
+        } else {
+            var response = Web.getResource(sRequest, dataPost);
+            var sResponse = response[0];
+            if (response[1]) {
+                if (sResponse) {
+                    var i = sResponse.indexOf('\n');
+                    if (i > 0) sResponse = sResponse.substr(0, i);
+                    if (!sResponse.indexOf("Error: ")) sResponse = sResponse.substr(7);
+                }
+                sResponse = '{"' + UserAPI.RES.CODE + '":' + response[1] + ',"' + UserAPI.RES.DATA + '":"' + sResponse + '"}';
+            }
+            if (DEBUG && this.messageEnabled()) this.printMessage(sResponse);
+            return JSON.parse(sResponse);
+        }
+        return null;
+    }
+
+    /**
+     * onPower()
+     *
+     * This handles UI requests to toggle the computer's power (eg, see the "power" button binding).
+     *
+     * @this {Computer}
+     */
+    onPower()
+    {
+        if (!this.nPowerChange) {
+            if (!this.flags.powered) {
+                this.wait(this.powerOn);
+            } else {
+                this.powerOff(false, true);
+            }
+        }
+    }
+
+    /**
+     * onReset()
+     *
+     * This handles UI requests to reset the computer's state (eg, see the "reset" button binding).
+     *
+     * @this {Computer}
+     */
+    onReset()
+    {
+        /*
+         * I'm going to start with the presumption that it makes little sense for an "unpowered" computer to be "reset";
+         * ditto if the power state is currently being changed.
+         */
+        if (!this.flags.powered || this.nPowerChange) return;
+
+        /*
+         * If this is a "resumable" machine (and it's not using a predefined state), then we overload the reset
+         * operation to offer an explicit "save or discard" option first.  This is currently the only UI we offer to
+         * discard a machine's state, including any disk changes.  The traditional "reset" operation is still available
+         * for non-resumable machines.
+         *
+         * TODO: Break this behavior out into a separate "discard" operation, in case the designer of the machine really
+         * wants to clutter the UI with confusing options. ;-)
+         */
+        if (this.resume && !this.sResumePath) {
+            /*
+             * I used to bypass the prompt if this.resume == Computer.RESUME_AUTO, setting fSave to true automatically,
+             * but that gives the user no means of resetting a resumable machine that contains errors in its resume state.
+             */
+            var fSave = (/* this.resume == Computer.RESUME_AUTO || */ Component.confirmUser("Click OK to save changes to this " + PCX86.APPNAME + " machine.\n\nWARNING: If you CANCEL, all disk changes will be discarded."));
+            this.powerOff(fSave, true);
+            /*
+             * Forcing the page to reload is an expedient option, but ugly. It's preferable to call powerOn()
+             * and rely on all the components to reset themselves to their default state.  The components with
+             * the greatest burden here are FDC and HDC, which must rely on the fReload flag to determine whether
+             * or not to unload/reload all their original auto-mounted disk images.
+             *
+             * However, if we started with a predefined state (ie, sStatePath is set), we take this shortcut, because
+             * we don't (yet) have code in place to gracefully reload the initial state (requires calling getResource()
+             * again); alternatively, we could avoid throwing that state away, but it seems better to save the memory.
+             *
+             * TODO: Make this more graceful, so that we can stop using the reloadPage() sledgehammer.
+             */
+            if (!fSave && this.sStatePath) {
+                Web.reloadPage();
+                return;
+            }
+            if (!fSave) this.fReload = true;
+            this.powerOn(Computer.RESUME_NONE);
+            this.fReload = false;
+        } else {
+            this.reset();
+            if (this.cpu) this.cpu.autoStart();
+        }
+    }
+
+    /**
+     * getMachineComponent(sType, componentPrev)
+     *
+     * @this {Computer}
+     * @param {string} sType
+     * @param {Component|null} [componentPrev] of previously returned component, if any
+     * @return {Component|null}
+     */
+    getMachineComponent(sType, componentPrev)
+    {
+        var componentLast = componentPrev;
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (componentPrev) {
+                if (componentPrev == component) componentPrev = null;
+                continue;
+            }
+            if (component.type == sType) return component;
+        }
+        if (!componentLast && sType != "FPU") {
+            Component.log("Machine component type '" + sType + "' not found", "warning");
+        }
+        return null;
+    }
+
+    /**
+     * updateFocus(fScroll)
+     *
+     * NOTE: When soft keyboard buttons call us to return focus to the machine (and away from the button),
+     * the browser's default behavior is to scroll the element into view, which can be annoying, especially on iOS,
+     * where the display is more constrained, so we no longer do it by default (fScroll must be true).
+     *
+     * @this {Computer}
+     * @param {boolean} [fScroll] (true if you really want the control scrolled into view)
+     */
+    updateFocus(fScroll)
+    {
+        if (this.aVideo.length) {
+            /*
+             * This seems to be recommended work-around to prevent the browser from scrolling the focused element
+             * into view.  The CPU is not a visual component, so when the CPU wants to set focus, the primary intent
+             * is to ensure that keyboard input is fielded properly.
+             */
+            var x = 0, y = 0;
+            if (!fScroll && window) {
+                x = window.scrollX;
+                y = window.scrollY;
+            }
+
+            /*
+             * TODO: We need a mechanism to determine the "active" display, instead of hard-coding this to aVideo[0].
+             */
+            this.aVideo[0].setFocus();
+
+            if (!fScroll && window) {
+                window.scrollTo(x, y);
+            }
+        }
+    }
+
+    /**
+     * updateStatus(fForce)
+     *
+     * If any DOM controls were bound to the CPU, then we need to call its updateStatus() handler; if there are no
+     * such bindings, then cpu.updateStatus() does nothing.
+     *
+     * Similarly, if there's a Panel, then we need to call its updateStatus() handler, in case it created its own canvas
+     * and implemented its own register display (eg, dumpRegisters()); if not, then panel.updateStatus() also does nothing.
+     *
+     * In practice, there will *either* be a Panel with a custom canvas *or* a set of DOM controls bound to the CPU *or*
+     * neither.  In theory, there could be BOTH, but that would be unusual.
+     *
+     * TODO: Consider alternate approaches to these largely register-oriented display updates.  Ordinarily, we like to
+     * separate logic from presentation, and currently the X86CPU contains both, since it's the component that intimately
+     * knows the names, number, sizes, etc, of all the active registers.  The Panel component is the logical candidate,
+     * but Panel is an optional component; generally, only machines that include Debugger also include Panel.
+     *
+     * @this {Computer}
+     * @param {boolean} [fForce] (true will display registers even if the CPU is running and "live" registers are not enabled)
+      */
+    updateStatus(fForce)
+    {
+        /*
+         * fForce is generally set to true whenever the CPU is transitioning to/from a running state, in which case
+         * cpu.updateStatus() will definitely want to hide/show register contents; however, at other times, when the
+         * CPU is running, constantly updating the DOM controls too frequently can adversely impact overall performance.
+         *
+         * So fForce serves as a hint to help cpu.updateStatus() make a more informed decision.  panel.updateStatus()
+         * currently doesn't care, on the theory that canvas updates should be significantly faster than DOM updates,
+         * but we still pass fForce on.
+         */
+        if (this.cpu) this.cpu.updateStatus(fForce);
+        if (this.panel) this.panel.updateStatus(fForce);
+    }
+
+    /**
+     * updateVideo(fForce)
+     *
+     * Any high-frequency updates should be performed here.  Avoid DOM updates, since updateVideo() can be called up to
+     * 60 times per second (see VIDEO_UPDATES_PER_SECOND).
+     *
+     * @this {Computer}
+     * @param {boolean} [fForce] (true to force a video update)
+     */
+    updateVideo(fForce)
+    {
+        for (var i = 0; i < this.aVideo.length; i++) {
+            this.aVideo[i].updateScreen(fForce);
+        }
+        if (this.panel) this.panel.updateAnimation();
+    }
+
+    /**
+     * Computer.init()
+     *
+     * For every machine represented by an HTML element of class "pcx86-machine", this function
+     * locates the HTML element of class "computer", extracting the JSON-encoded parameters for the
+     * Computer constructor from the element's "data-value" attribute, invoking the constructor to
+     * create a Computer component, and then binding any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        /*
+         * In non-COMPILED builds, embedMachine() may have set XMLVERSION.
+         */
+        if (!COMPILED && XMLVERSION) PCX86.APPVERSION = XMLVERSION;
+
+        var aeMachines = Component.getElementsByClass(document, PCX86.APPCLASS + "-machine");
+
+        for (var iMachine = 0; iMachine < aeMachines.length; iMachine++) {
+
+            var eMachine = aeMachines[iMachine];
+            var parmsMachine = Component.getComponentParms(eMachine);
+
+            var aeComputers = Component.getElementsByClass(eMachine, PCX86.APPCLASS, "computer");
+
+            for (var iComputer = 0; iComputer < aeComputers.length; iComputer++) {
+
+                var eComputer = aeComputers[iComputer];
+                var parmsComputer = Component.getComponentParms(eComputer);
+
+                /*
+                 * We set fSuspended in the Computer constructor because we want to "power up" the
+                 * computer ourselves, after any/all bindings are in place.
+                 */
+                var computer = new Computer(parmsComputer, parmsMachine, true);
+
+                if (DEBUG && computer.messageEnabled()) {
+                    computer.printMessage("onInit(" + computer.flags.powered + ")");
+                }
+
+                /*
+                 * Bind any "power", "reset" and "save" buttons.  An "erase" button was also considered,
+                 * but "reset" now provides a way to force the machine to start from scratch again, so "erase"
+                 * may be redundant now.
+                 */
+                Component.bindComponentControls(computer, eComputer, PCX86.APPCLASS);
+
+                /*
+                 * Power on the computer, giving every component the opportunity to reset or restore itself.
+                 */
+                if (computer.fAutoPower) computer.wait(computer.powerOn);
+            }
+        }
+    }
+
+    /**
+     * Computer.show()
+     *
+     * When exit() is using an "onbeforeunload" handler, this "onpageshow" handler allows us to repower everything,
+     * without either resetting or restoring.  We call powerOn() with a special resume value (RESUME_REPOWER) if the
+     * computer is already marked as "ready", meaning the browser didn't change anything.  This "repower" process
+     * should be very quick, essentially just marking all components as powered again (so that, for example, the Video
+     * component will start drawing again) and firing the CPU up again.
+     */
+    static show()
+    {
+        var aeComputers = Component.getElementsByClass(document, PCX86.APPCLASS, "computer");
+        for (var iComputer = 0; iComputer < aeComputers.length; iComputer++) {
+            var eComputer = aeComputers[iComputer];
+            var parmsComputer = Component.getComponentParms(eComputer);
+            var computer = /** @type {Computer} */ (Component.getComponentByType("Computer", parmsComputer['id']));
+            if (computer) {
+
+                if (DEBUG && computer.messageEnabled()) {
+                    computer.printMessage("onShow(" + computer.fInitialized + "," + computer.flags.powered + ")");
+                }
+
+                if (computer.fInitialized && !computer.flags.powered) {
+                    /**
+                     * Repower the computer, notifying every component to continue running as-is.
+                     */
+                    computer.powerOn(Computer.RESUME_REPOWER);
+                }
+            }
+        }
+    }
+
+    /**
+     * Computer.exit()
+     *
+     * The Computer is currently the only component that uses an "exit" handler, which Web.onExit() defines as
+     * either an "unload" or "onbeforeunload" handler.  This gives us the opportunity to save the machine state,
+     * using our powerOff() function, before the page goes away.
+     *
+     * It's worth noting that "onbeforeunload" offers one nice feature when used instead of "onload": the entire
+     * page (and therefore this entire application) is retained in its current state by the browser (well, some
+     * browsers), so that if you go to a new URL, either by entering a new URL in the same window/tab, or by pressing
+     * the FORWARD button, and then you press the BACK button, the page is immediately restored to its previous state.
+     *
+     * In fact, that's how some browsers operate whether you have an "onbeforeunload" handler or not; in other words,
+     * an "onbeforeunload" handler doesn't change the page retention behavior of the browser.  By contrast, the mere
+     * presence of an "onunload" handler generally causes a browser to throw the page away once the handler returns.
+     *
+     * However, in order to safely use "onbeforeunload", we must add yet another handler ("onpageshow") to repower
+     * everything, without either resetting or restoring.  Hence, the Computer.show() function, which calls powerOn()
+     * with a special resume value (RESUME_REPOWER) if the computer is already marked as "ready", meaning the browser
+     * didn't change anything.  This "repower" process should be very quick, essentially just marking all components as
+     * powered again (so that, for example, the Video component will start drawing again) and firing the CPU up again.
+     *
+     * Reportedly, some browsers (eg, Opera) don't support "onbeforeunload", in which case Component will have to use
+     * "unload" instead.  But even when the page must be rebuilt from scratch, the combination of browser cache and
+     * localStorage means the simulation should be restored and become operational almost immediately.
+     */
+    static exit()
+    {
+        var aeComputers = Component.getElementsByClass(document, PCX86.APPCLASS, "computer");
+        for (var iComputer = 0; iComputer < aeComputers.length; iComputer++) {
+            var eComputer = aeComputers[iComputer];
+            var parmsComputer = Component.getComponentParms(eComputer);
+            var computer = /** @type {Computer} */ (Component.getComponentByType("Computer", parmsComputer['id']));
+            if (computer) {
+
+                if (DEBUG && computer.messageEnabled()) {
+                    computer.printMessage("onExit(" + computer.flags.powered + ")");
+                }
+
+                if (computer.flags.powered) {
+                    /**
+                     * Power off the computer, giving every component an opportunity to save its state,
+                     * but only if 'resume' has been set AND there is no valid resume path (because if a valid resume
+                     * path exists, we'll always load our state from there, and not from whatever we save here).
+                     */
+                    computer.powerOff(!!(computer.resume && !computer.sResumePath), true);
+                }
+            }
+        }
+    }
+}
+
+Computer.STATE_FAILSAFE  = "failsafe";
+Computer.STATE_VALIDATE  = "validate";
+Computer.STATE_TIMESTAMP = "timestamp";
+Computer.STATE_VERSION   = "version";
+Computer.STATE_HOSTURL   = "url";
+Computer.STATE_BROWSER   = "browser";
+Computer.STATE_USERID    = "user";
+
+/*
+ * The following constants define all the resume options.  Negative values (eg, RESUME_REPOWER) are for
+ * internal use only, and RESUME_DELETE is not documented (it provides a way of deleting ALL saved states
+ * whenever a resume is declined).  As a result, the only "end-user" values are 0, 1 and 2.
+ */
+Computer.RESUME_REPOWER  = -1;  // resume without changing any state (for internal use only)
+Computer.RESUME_NONE     =  0;  // default (no resume)
+Computer.RESUME_AUTO     =  1;  // automatically save/restore state
+Computer.RESUME_PROMPT   =  2;  // automatically save but conditionally restore (WARNING: if restore is declined, any state is discarded)
+Computer.RESUME_DELETE   =  3;  // same as RESUME_PROMPT but discards ALL machines states whenever ANY machine restore is declined (undocumented)
+
+/*
+ * Initialize every Computer on the page.
+ */
+Web.onInit(Computer.init);
+Web.onShow(Computer.show);
+Web.onExit(Computer.exit);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/state.js (C) Jeff Parsons 2012-2017
+ */
+
+
+class State {
+    /**
+     * State(component, sVersion, sSuffix)
+     *
+     * State objects are used by components to save/restore their state.
+     *
+     * During a save operation, components add data to a State object via set(), and then return
+     * the resulting data using data().
+     *
+     * During a restore operation, the Computer component passes the results of each data() call
+     * back to the originating component.
+     *
+     * WARNING: Since State objects are low-level objects that have no UI requirements, they do not
+     * inherit from the Component class, so you should only use class methods of Component, such as
+     * Component.assert() (or Debugger methods if the Debugger is available).
+     *
+     * NOTE: 1.01 is the first version to provide limited save/restore support using localStorage.
+     * From that point on, care must be taken to insure that any new version that's incompatible with
+     * previous localStorage data be released with a version number that is at least 1 greater,
+     * since we're tagging the localStorage data with the integer portion of the version string.
+     *
+     * @param {Component} component
+     * @param {string} [sVersion] is used to append a major version number to the key
+     * @param {string} [sSuffix] is used to append any additional suffixes to the key
+     */
+    constructor(component, sVersion, sSuffix)
+    {
+        this.id = component.id;
+        this.dbg = component.dbg;
+        this.json = "";
+        this.state = {};
+        this.fLoaded = this.fParsed = false;
+        this.key = State.key(component, sVersion, sSuffix);
+        this.unload(component.parms);
+    }
+
+    /**
+     * set(id, data)
+     *
+     * @this {State}
+     * @param {number|string} id
+     * @param {Object|string} data
+     */
+    set(id, data)
+    {
+        try {
+            this.state[id] = data;
+        } catch(e) {
+            Component.log(e.message);
+        }
+    }
+
+    /**
+     * get(id)
+     *
+     * @this {State}
+     * @param {number|string} id
+     * @return {Object|string|null}
+     */
+    get(id)
+    {
+        return this.state[id] || null;
+    }
+
+    /**
+     * data()
+     *
+     * @this {State}
+     * @return {Object}
+     */
+    data()
+    {
+        return this.state;
+    }
+
+    /**
+     * load(json)
+     *
+     * WARNING: Make sure you follow this call with either a call to parse() or unload(),
+     * because any stringified data that we've loaded isn't usable until it's been parsed.
+     *
+     * @this {State}
+     * @param {string|null} [json]
+     * @return {boolean} true if state exists in localStorage, false if not
+     */
+    load(json)
+    {
+        if (json) {
+            this.json = json;
+            this.fLoaded = true;
+            this.fParsed = false;
+            return true;
+        }
+        if (this.fLoaded) {
+            /*
+             * This is assumed to be a redundant load().
+             */
+            return true;
+        }
+        if (Web.hasLocalStorage()) {
+            var s = Web.getLocalStorageItem(this.key);
+            if (s) {
+                this.json = s;
+                this.fLoaded = true;
+                if (DEBUG) Component.log("localStorage(" + this.key + "): " + s.length + " bytes loaded");
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * parse()
+     *
+     * This completes the load() operation, by parsing what was loaded, on the assumption there
+     * might be some benefit to deferring parsing until we've given the user a chance to confirm.
+     * Otherwise, load() could have just as easily done this, too.
+     *
+     * @this {State}
+     * @return {boolean} true if successful, false if error
+     */
+    parse()
+    {
+        var fSuccess = true;
+        if (!this.fParsed) {
+            try {
+                this.state = JSON.parse(this.json);
+                this.fParsed = true;
+            } catch (e) {
+                Component.error(e.message || e);
+                fSuccess = false;
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * store()
+     *
+     * @this {State}
+     * @return {boolean} true if successful, false if error
+     */
+    store()
+    {
+        var fSuccess = true;
+        if (Web.hasLocalStorage()) {
+            var s = JSON.stringify(this.state);
+            if (Web.setLocalStorageItem(this.key, s)) {
+                if (DEBUG) Component.log("localStorage(" + this.key + "): " + s.length + " bytes stored");
+            } else {
+                /*
+                 * WARNING: Because browsers tend to disable all alerts() during an "unload" operation,
+                 * it's unlikely anyone will ever see the "quota" errors that occur at this point.  Need to
+                 * think of some way to notify the user that there's a problem, and offer a way of cleaning
+                 * up old states.
+                 */
+                Component.error("Unable to store " + s.length + " bytes in browser local storage");
+                fSuccess = false;
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * toString()
+     *
+     * @this {State}
+     * @return {string} JSON-encoded state
+     */
+    toString()
+    {
+        return this.state? JSON.stringify(this.state) : this.json;
+    }
+
+    /**
+     * unload(parms)
+     *
+     * This discards any data saved via set() or loaded via load(), creating an empty State object.
+     * Note that you have to follow this call with an explicit call to store() if you want to remove
+     * the state from localStorage as well.
+     *
+     * @this {State}
+     * @param {Object} [parms]
+     */
+    unload(parms)
+    {
+        this.json = "";
+        this.state = {};
+        this.fLoaded = this.fParsed = false;
+        if (parms) this.set("parms", parms);
+    }
+
+    /**
+     * clear(fAll)
+     *
+     * This unloads the current state, and then clears ALL localStorage for the current machine,
+     * independent of version, to reduce the chance of orphaned states wasting part of our limited allocation.
+     *
+     * @this {State}
+     * @param {boolean} [fAll] true to unconditionally clear ALL localStorage for the current domain
+     */
+    clear(fAll)
+    {
+        this.unload();
+        var aKeys = Web.getLocalStorageKeys();
+        for (var i = 0; i < aKeys.length; i++) {
+            var sKey = aKeys[i];
+            if (sKey && (fAll || sKey.substr(0, this.key.length) == this.key)) {
+                Web.removeLocalStorageItem(sKey);
+                if (DEBUG) Component.log("localStorage(" + sKey + ") removed");
+                aKeys.splice(i, 1);
+                i = 0;
+            }
+        }
+    }
+
+    /**
+     * State.key(component, sVersion, sSuffix)
+     *
+     * This encapsulates the key generation code.
+     *
+     * @param {Component} component
+     * @param {string} [sVersion] is used to append a major version number to the key
+     * @param {string} [sSuffix] is used to append any additional suffixes to the key
+     * @return {string} key
+     */
+    static key(component, sVersion, sSuffix)
+    {
+        var key = component.id;
+        if (sVersion) {
+            var i = sVersion.indexOf('.');
+            if (i > 0) key += ".v" + sVersion.substr(0, i);
+        }
+        if (sSuffix) {
+            key += "." + sSuffix;
+        }
+        return key;
+    }
+
+    /**
+     * State.compress(aSrc)
+     *
+     * @param {Array.<number>|null} aSrc
+     * @return {Array.<number>|null} is either the original array (aSrc), or a smaller array of "count, value" pairs (aComp)
+     */
+    static compress(aSrc)
+    {
+        if (aSrc) {
+            var iSrc = 0;
+            var iComp = 0;
+            var aComp = [];
+            while (iSrc < aSrc.length) {
+                var n = aSrc[iSrc];
+
+                var iCompare = iSrc + 1;
+                while (iCompare < aSrc.length && aSrc[iCompare] === n) iCompare++;
+                aComp[iComp++] = iCompare - iSrc;
+                aComp[iComp++] = n;
+                iSrc = iCompare;
+            }
+            if (aComp.length < aSrc.length) return aComp;
+        }
+        return aSrc;
+    }
+
+    /**
+     * State.decompress(aComp)
+     *
+     * @param {Array.<number>} aComp
+     * @param {number} nLength is expected length of decompressed data
+     * @return {Array.<number>}
+     */
+    static decompress(aComp, nLength)
+    {
+        var iDst = 0;
+        var aDst = new Array(nLength);
+        var iComp = 0;
+        while (iComp < aComp.length - 1) {
+            var c = aComp[iComp++];
+            var n = aComp[iComp++];
+            while (c--) {
+                aDst[iDst++] = n;
+            }
+        }
+
+        return aDst;
+    }
+
+    /**
+     * State.compressEvenOdd(aSrc)
+     *
+     * This is a very simple variation on compress() that compresses all the EVEN elements of aSrc first,
+     * followed by all the ODD elements.  This tends to work better on EGA video memory, because when odd/even
+     * addressing is enabled (eg, for text modes), the DWORD values tend to alternate, which is the worst case
+     * for compress(), but the best case for compressEvenOdd().
+     *
+     * One wrinkle we support: if the first element is uninitialized, then we assume the entire array is undefined,
+     * and return an empty compressed array.  Conversely, decompressEvenOdd() will take an empty compressed array
+     * and return an uninitialized array.
+     *
+     * @param {Array.<number>|null} aSrc
+     * @return {Array.<number>|null} is either the original array (aSrc), or a smaller array of "count, value" pairs (aComp)
+     */
+    static compressEvenOdd(aSrc)
+    {
+        if (aSrc) {
+            var iComp = 0, aComp = [];
+            if (aSrc[0] !== undefined) {
+                for (var off = 0; off < 2; off++) {
+                    var iSrc = off;
+                    while (iSrc < aSrc.length) {
+                        var n = aSrc[iSrc];
+                        var iCompare = iSrc + 2;
+                        while (iCompare < aSrc.length && aSrc[iCompare] === n) iCompare += 2;
+                        aComp[iComp++] = (iCompare - iSrc) >> 1;
+                        aComp[iComp++] = n;
+                        iSrc = iCompare;
+                    }
+                }
+            }
+            if (aComp.length < aSrc.length) return aComp;
+        }
+        return aSrc;
+    }
+
+    /**
+     * State.decompressEvenOdd(aComp, nLength)
+     *
+     * This is the counterpart to compressEvenOdd().  Note that because there's nothing in the compressed sequence
+     * that differentiates a compress() sequence from a compressEvenOdd() sequence, you simply have to be consistent:
+     * if you used even/odd compression, then you must use even/odd decompression.
+     *
+     * @param {Array.<number>} aComp
+     * @param {number} nLength is expected length of decompressed data
+     * @return {Array.<number>}
+     */
+    static decompressEvenOdd(aComp, nLength)
+    {
+        var iDst = 0;
+        var aDst = new Array(nLength);
+        var iComp = 0;
+        while (iComp < aComp.length - 1) {
+            var c = aComp[iComp++];
+            var n = aComp[iComp++];
+            while (c--) {
+                aDst[iDst] = n;
+                iDst += 2;
+            }
+            /*
+             * The output of a "count,value" pair will never exceed the end of the output array, so as soon as we reach it
+             * the first time, we know it's time to switch to ODD elements, and as soon as we reach it again, we should be
+             * done.
+             */
+
+            if (iDst == nLength) iDst = 1;
+        }
+
+        return aDst;
+    }
+}
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/embed.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * We now support asynchronous XML and XSL file loads; simply set fAsync (below) to true.
+ *
+ * NOTE: For that support to work, we have to keep track of the number of machines on the page
+ * (ie, how many embedMachine() calls were issued), reduce the count as each machine XML file
+ * is fully transformed into HTML, and when the count finally returns to zero, notify all the
+ * machine component init() handlers.
+ *
+ * Also, to prevent those init() handlers from running prematurely, we must disable all page
+ * notification events at the start of the embedding process (Web.enablePageEvents(false)) and
+ * re-enable them at the end (Web.enablePageEvents(true)).
+ */
+var fAsync = true;
+var cAsyncMachines = 0;
+
+/**
+ * loadXML(sFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+ *
+ * This is the preferred way to load all XML and XSL files. It uses getResource()
+ * to load them as strings, which parseXML() can massage before parsing/transforming them.
+ *
+ * For example, since I've been unable to get the XSLT document() function to work inside any
+ * XSL document loaded by JavaScript's XSLT processor, that has prevented me from dynamically
+ * loading any XML machine file that uses the "ref" attribute to refer to and incorporate
+ * another XML document.
+ *
+ * To solve that, I've added an fResolve parameter that tells parseXML() to fetch any
+ * referenced documents ITSELF and insert them into the XML string prior to parsing, instead
+ * of relying on the XSLT template to pull them in.  That fetching is handled by resolveXML(),
+ * which iterates over the XML until all "refs" have been resolved (including any nested
+ * references).
+ *
+ * Also, XSL files with a <!DOCTYPE [...]> cause MSIE's Microsoft.XMLDOM.loadXML() function
+ * to choke, so I strip that out prior to parsing as well.
+ *
+ * TODO: Figure out why the XSLT document() function works great when the web browser loads an
+ * XML file (and the associated XSL file) itself, but does not work when loading documents via
+ * JavaScript XSLT support. Is it broken, is it a security issue, or am I just calling it wrong?
+ *
+ * @param {string} sXMLFile
+ * @param {string|null|undefined} idMachine
+ * @param {string|null|undefined} sAppName
+ * @param {string|null|undefined} sAppClass
+ * @param {string|null|undefined} sParms
+ * @param {boolean} fResolve is true to resolve any "ref" attributes
+ * @param {function(string)} display
+ * @param {function(string,Object)} done (string contains the unparsed XML string data, and Object contains a parsed XML object)
+ */
+function loadXML(sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+{
+    var doneLoadXML = function(sURLName, sXML, nErrorCode) {
+        if (nErrorCode) {
+            if (!sXML) sXML = "unable to load " + sXMLFile + " (" + nErrorCode + ")";
+            done(sXML, null);
+            return;
+        }
+        parseXML(sXML, sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done);
+    };
+    display("Loading " + sXMLFile + "...");
+    Web.getResource(sXMLFile, null, fAsync, doneLoadXML);
+}
+
+/**
+ * parseXML(sXML, sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+ *
+ * Generates an XML document from an XML string. This function also provides a work-around for XSLT's
+ * lack of support for the document() function (at least on some browsers), by replacing every reference
+ * tag (ie, a tag with a "ref" attribute) with the contents of the referenced file.
+ *
+ * @param {string} sXML
+ * @param {string|null} sXMLFile
+ * @param {string|null|undefined} idMachine
+ * @param {string|null|undefined} sAppName
+ * @param {string|null|undefined} sAppClass
+ * @param {string|null|undefined} sParms
+ * @param {boolean} fResolve is true to resolve any "ref" attributes; default is false
+ * @param {function(string)} display
+ * @param {function(string,Object)} done (string contains the unparsed XML string data, and Object contains a parsed XML object)
+ */
+function parseXML(sXML, sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+{
+    var buildXML = function(sXML, sError) {
+        if (sError) {
+            done(sError, null);
+            return;
+        }
+        if (idMachine) {
+
+            /*
+             * A more sensible place to record the machine XML would be embedMachine(), like we do for the
+             * XSL file, but since we're about to modify the original machine XML, it's best to record it now.
+             */
+            Component.addMachineResource(idMachine, sXMLFile, sXML);
+
+            var sURL = sXMLFile;
+            if (sURL && sURL.indexOf('/') < 0 && window.location.pathname.slice(-1) == '/') {
+                sURL = window.location.pathname + sURL;
+            }
+            /*
+             * We embed the URL of the XML file both as a separate "xml" attribute for easy access from the
+             * XSL file, and as part of the "parms" attribute for easy access from machines (see getMachineParm()).
+             */
+            if (!sParms) {
+                sParms = '{';
+            } else if (sParms.slice(-1) == '}') {
+                sParms = sParms.slice(0, -1);
+                if (sParms.length > 1) sParms += ',';
+            } else {            // sParms must just be a "state" file, so encode it as a "state" property
+                sParms = '{state:"' + sParms + '",';
+            }
+            sParms += 'url:"' + sURL + '"}';
+            /*
+             * Note that while we no longer generate a machine XML file with a "state" attribute (because it's
+             * encoded inside the "parms" attribute), the XSL file must still cope with "state" attributes inside
+             * other XML files; for example, manifest XML files like /apps/pc/1981/visicalc/manifest.xml contain
+             * machine elements with "state" attributes that must still be passed down to the computer element
+             * "the old fashioned way".
+             *
+             * Until/unless that changes, components.xsl cannot be simplified as much as I might have hoped.
+             */
+            if (typeof resources == 'object') sURL = null;      // turn off URL inclusion if we have embedded resources
+            sXML = sXML.replace(/(<machine[^>]*\sid=)(['"]).*?\2/, "$1$2" + idMachine + "$2" + (sParms? " parms='" + sParms + "'" : "") + (sURL? ' url="' + sURL + '"' : ''));
+        }
+
+        if (!fResolve) {
+            /*
+             * I'm trying to switch to a shared components.xsl (at least for all PC-class machines),
+             * but in the interim, that means hacking the XSL file on the fly to reflect the actual class.
+             */
+            sXML = sXML.replace(/(<xsl:variable name="APPNAME">).*?(<\/xsl:variable>)/, "$1" + sAppName + "$2");
+            sXML = sXML.replace(/(<xsl:variable name="APPCLASS">).*?(<\/xsl:variable>)/, "$1" + sAppClass + "$2");
+
+            /*
+             * Non-COMPILED kludge to replace the version number template in the XSL file (which we assume we're reading,
+             * since fResolve is false) with whatever XMLVERSION we extracted from the XML file (see corresponding kludge below).
+             *
+             * ES6 ALERT: Template strings.
+             */
+            if (!COMPILED && XMLVERSION) {
+                sXML = sXML.replace(/<xsl:variable name="APPVERSION">1.x.x<\/xsl:variable>/, `<xsl:variable name="APPVERSION">${XMLVERSION}</xsl:variable>`);
+            }
+        }
+
+        /*
+         * If the resource we requested is not really an XML file (or the file didn't exist and the server simply returned
+         * a message like "Cannot GET /devices/pc/machine/5150/cga/64kb/donkey/machine.xml"), we'd like to display a more
+         * meaningful message, because the XML DOM parsers will blithely return a document that contains nothing useful; eg:
+         *
+         *      This page contains the following errors:error on line 1 at column 1:
+         *      Document is empty Below is a rendering of the page up to the first error.
+         *
+         * Supposedly, the IE XML DOM parser will throw an exception, but I haven't tested that, and unless all other
+         * browsers do that, that's not helpful.
+         *
+         * The best I can do at this stage (assuming Web.getResource() didn't drop any error information on the floor)
+         * is verify that the requested resource "looks like" valid XML (in other words, it begins with a '<').
+         */
+        var xmlDoc = null;
+        if (sXML.charAt(0) == '<') {
+            try {
+                /*
+                 * Another hack for MSIE, which fails to load XSL documents containing a <!DOCTYPE [...]> tag.
+                 *
+                 * This is also why the XSLTProcessor 'transformToFragment' method in Microsoft Edge silently failed,
+                 * so I had pull this hack out of the "ActiveXObject" code.  And rather than add yet-another Microsoft
+                 * browser check, I'm going to try doing this across the board, and hope that none of the other XSLT
+                 * processors fail *without* the DOCTYPE tag.
+                 */
+                if (!fResolve) {
+                    sXML = sXML.replace(/<!DOCTYPE(.|[\r\n])*]>\s*/g, "");
+                }
+                /*
+                 * Beginning with Microsoft Edge and the corresponding release of Windows 10, all the
+                 * 'ActiveXObject' crud has gone away; but of course, this code must remain in place if
+                 * we want to continue supporting older Internet Explorer browsers (ie, back to IE9).
+                 */
+                /** @namespace window.ActiveXObject */
+                if (window.ActiveXObject || 'ActiveXObject' in window) {        // second test is required for IE11 on Windows 8.1
+                    xmlDoc = new window.ActiveXObject("Microsoft.XMLDOM");
+                    xmlDoc.async = false;
+                    xmlDoc['loadXML'](sXML);
+                } else {
+                    /** @namespace window.DOMParser */
+                    xmlDoc = (new window.DOMParser()).parseFromString(sXML, "text/xml");
+                }
+            } catch(e) {
+                xmlDoc = null;
+                sXML = e.message;
+            }
+        } else {
+            sXML = "unrecognized XML: " + (sXML.length > 255? sXML.substr(0, 255) + "..." : sXML);
+        }
+        done(sXML, xmlDoc);
+    };
+    if (sXML) {
+        if (PRIVATE) sXML = sXML.replace(/\/library.xml/, "/private/library.xml");
+        if (fResolve) {
+            resolveXML(sXML, display, buildXML);
+            return;
+        }
+        buildXML(sXML, null);
+        return;
+    }
+    done("no data" + (sXMLFile? " for file: " + sXMLFile : ""), null);
+}
+
+/**
+ * resolveXML(sXML, display, done)
+ *
+ * Replaces every tag with a "ref" attribute with the contents of the corresponding file.
+ *
+ * TODO: Fix some of the limitations of this code, such as: 1) requiring the "ref" attribute
+ * to appear as the tag's first attribute, 2) requiring the "ref" attribute to be double-quoted,
+ * and 3) requiring the "ref" tag to be self-closing.
+ *
+ * @param {string} sXML
+ * @param {function(string)} display
+ * @param {function(string,(string|null))} done (the first string contains the resolved XML data, the second is for any error message)
+ */
+function resolveXML(sXML, display, done)
+{
+    var matchRef;
+    var reRef = /<([a-z]+)\s+ref="(.*?)"(.*?)\/>/g;
+
+    if ((matchRef = reRef.exec(sXML))) {
+
+        var sRefFile = matchRef[2];
+
+        var doneReadXML = function(sURLName, sXMLRef, nErrorCode) {
+            if (nErrorCode || !sXMLRef) {
+                done(sXML, "unable to resolve XML reference: " + matchRef[0] + " (" + nErrorCode + ")");
+                return;
+            }
+            /*
+             * If there are additional attributes in the "referring" XML tag, we want to insert them
+             * into the "referred" XML tag; attributes that don't exist in the referred tag should be
+             * appended, and attributes that DO exist should be overwritten.
+             */
+            var sRefAttrs = matchRef[3];
+            if (sRefAttrs) {
+                var aXMLRefTag = sXMLRef.match(new RegExp("<" + matchRef[1] + "[^>]*>"));
+                if (aXMLRefTag) {
+                    var sXMLNewTag = aXMLRefTag[0];
+                    /*
+                     * Iterate over all the attributes in the "referring" XML tag (sRefAttrs)
+                     */
+                    var matchAttr;
+                    var reAttr = /( [a-z]+=)(['"])(.*?)\2/g;
+                    while ((matchAttr = reAttr.exec(sRefAttrs))) {
+                        if (sXMLNewTag.indexOf(matchAttr[1]) < 0) {
+                            /*
+                             * This is the append case
+                             */
+                            sXMLNewTag = sXMLNewTag.replace(">", matchAttr[0] + ">");
+                        } else {
+                            /*
+                             * This is the overwrite case
+                             */
+                            sXMLNewTag = sXMLNewTag.replace(new RegExp(matchAttr[1] + "(['\"])(.*?)\\1"), matchAttr[0]);
+                        }
+                    }
+                    if (aXMLRefTag[0] != sXMLNewTag) {
+                        sXMLRef = sXMLRef.replace(aXMLRefTag[0], sXMLNewTag);
+                    }
+                } else {
+                    done(sXML, "missing <" + matchRef[1] + "> in " + sRefFile);
+                    return;
+                }
+            }
+
+            /*
+             * Apparently when a Windows Azure server delivers one of my XML files, it may modify the first line:
+             *
+             *      <?xml version="1.0" encoding="UTF-8"?>\n
+             *
+             * I didn't determine exactly what it was doing at this point (probably just changing the \n to \r\n),
+             * but in any case, relaxing the following replace() solved it.
+             */
+            sXMLRef = sXMLRef.replace(/<\?xml[^>]*>[\r\n]*/, "");
+
+            sXML = sXML.replace(matchRef[0], sXMLRef);
+
+            resolveXML(sXML, display, done);
+        };
+
+        display("Loading " + sRefFile + "...");
+        Web.getResource(sRefFile, null, fAsync, doneReadXML);
+        return;
+    }
+    done(sXML, null);
+}
+
+/**
+ * embedMachine(sAppName, sAppClass, sVersion, idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * This allows to you embed a machine on a web page, by transforming the machine XML into HTML.
+ *
+ * @param {string} sAppName is the app name (eg, "PCx86")
+ * @param {string} sAppClass is the app class (eg, "pcx86"); also known as the machine class
+ * @param {string} sVersion is the app version (eg, "1.15.7")
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedMachine(sAppName, sAppClass, sVersion, idMachine, sXMLFile, sXSLFile, sParms)
+{
+    var eMachine, eWarning, fSuccess = true;
+
+    cAsyncMachines++;
+    Component.addMachine(idMachine);
+
+    var doneMachine = function() {
+
+        if (!--cAsyncMachines) {
+            if (fAsync) Web.enablePageEvents(true);
+        }
+    };
+
+    var displayError = function(sError) {
+        Component.log(sError);
+        displayMessage("Error: " + sError);
+        if (fSuccess) doneMachine();
+        fSuccess = false;
+    };
+
+    var displayMessage = function(sMessage) {
+        if (eWarning === undefined) {
+            /*
+             * Our MarkOut module (in convertMDMachineLinks()) creates machine containers that look like:
+             *
+             *      <div id="' + sMachineID + '" class="machine-placeholder"><p>Embedded PC</p><p class="machine-warning">...</p></div>
+             *
+             * with the "machine-warning" paragraph pre-populated with a warning message that the user will
+             * see if nothing at all happens.  But hopefully, in the normal case (and especially the error case),
+             * *something* will have happened.
+             *
+             * Note that it is the HTMLOut module (in processMachines()) that ultimately decides which scripts to
+             * include and then generates the embedXXX() call.
+             */
+            var aeWarning = (eMachine && Component.getElementsByClass(eMachine, "machine-warning"));
+            eWarning = (aeWarning && aeWarning[0]) || eMachine;
+        }
+        if (eWarning) eWarning.innerHTML = Str.escapeHTML(sMessage);
+    };
+
+    try {
+        eMachine = document.getElementById(idMachine);
+        if (eMachine) {
+
+            /*
+             * If we have a 'css' resource, add it to the page first.
+             */
+            var css;
+            if (typeof resources == "object" && (css = resources['css'])) {
+                var head = document.head || document.getElementsByTagName('head')[0];
+                var style = document.createElement('style');
+                style.type = 'text/css';
+                if (style.styleSheet) {
+                    style.styleSheet.cssText = css;
+                } else {
+                    style.appendChild(document.createTextNode(css));
+                }
+                head.appendChild(style);
+            }
+
+            if (!sXSLFile) {
+                /*
+                 * Now that PCjs is an open-source project, we can make the following test more flexible,
+                 * and revert to the internal template if DEBUG *or* internal version (instead of *and*).
+                 *
+                 * Third-party sites that don't use the PCjs server will ALWAYS want to specify a fully-qualified
+                 * path to the XSL file, unless they choose to mirror our folder structure.
+                 */
+                var sAppFolder = sAppClass;
+                if (DEBUG || sVersion == "1.x.x") {
+                    sXSLFile = "/modules/" + sAppFolder + "/templates/components.xsl";
+                } else {
+                    if (sAppClass.substr(0, 3) == "pdp") sAppFolder = "pdpjs";
+                    sXSLFile = "/versions/" + sAppFolder + "/" + sVersion + "/components.xsl";
+                }
+            }
+
+            var processXML = function(sXML, xml) {
+                if (!xml) {
+                    displayError(sXML);
+                    return;
+                }
+
+                /*
+                 * Non-COMPILED kludge to extract the version number from the stylesheet path in the machine XML file;
+                 * we don't need this code in COMPILED (non-DEBUG) releases, because APPVERSION is hard-coded into them.
+                 */
+                if (!COMPILED) {
+                    var aMatch = sXML.match(/<\?xml-stylesheet[^>]* href=(['"])[^'"]*?\/([0-9.]*)\/([^'"]*)\1/);
+                    if (aMatch) XMLVERSION = aMatch[2];
+                }
+
+                var transformXML = function(sXSL, xsl) {
+                    if (!xsl) {
+                        displayError(sXSL);
+                        return;
+                    }
+
+                    /*
+                     * Record the XSL file, in case someone wants to save the entire machine later.
+                     */
+                    Component.addMachineResource(idMachine, sXSLFile, sXSL);
+
+                    /*
+                     * The <machine> template in components.xsl now generates a "machine div" that makes
+                     * the div we required the caller of embedMachine() to provide redundant, so instead
+                     * of appending this fragment to the caller's node, we REPLACE the caller's node.
+                     * This works only because because we ALSO inject the caller's "machine div" ID into
+                     * the fragment's ID during parseXML().
+                     *
+                     *      eMachine.innerHTML = sFragment;
+                     *
+                     * Also, if the transform function fails, make sure you're using the appropriate
+                     * "components.xsl" and not a "machine.xsl", because the latter will not produce valid
+                     * embeddable HTML (and is the most common cause of failure at this final stage).
+                     */
+                    displayMessage("Processing " + sXMLFile + "...");
+
+                    /*
+                     * Beginning with Microsoft Edge and the corresponding release of Windows 10, all the
+                     * 'ActiveXObject' crud has gone away; but of course, this code must remain in place if
+                     * we want to continue supporting older Internet Explorer browsers (ie, back to IE9).
+                     */
+                    if (window.ActiveXObject || 'ActiveXObject' in window) {        // second test is required for IE11 on Windows 8.1
+                        var sFragment = xml['transformNode'](xsl);
+                        if (sFragment) {
+                            eMachine.outerHTML = sFragment;
+                            doneMachine();
+                        } else {
+                            displayError("transformNodeToObject failed");
+                        }
+                    }
+                    else if (document.implementation && document.implementation.createDocument) {
+                        var xsltProcessor = new XSLTProcessor();
+                        xsltProcessor['importStylesheet'](xsl);
+                        var eFragment = xsltProcessor['transformToFragment'](xml, document);
+                        if (eFragment) {
+                            /*
+                             * This fails in Microsoft Edge...
+                             *
+                            var machine = eFragment.getElementById(idMachine);
+                            if (!machine) {
+                                displayError("machine generation failed: " + idMachine);
+                            } else
+                            */
+                            if (eMachine.parentNode) {
+                                eMachine.parentNode.replaceChild(eFragment, eMachine);
+                                doneMachine();
+                            } else {
+                                /*
+                                 * NOTE: This error can occur if our Node web server, when processing a folder with
+                                 * both a manifest.xml with a machine.xml reference AND a README.md containing a
+                                 * machine link, generates duplicate embedXXX() calls for the same machine; if the
+                                 * first embedXXX() call finds its target, subsequent calls for the same target will
+                                 * fail.
+                                 *
+                                 * Technically, such a folder is in a misconfigured state, but it happens, in part
+                                 * because when we switched to the Jekyll web server, we had to add machine links to
+                                 * all README.md files where we had previously relied on manifest.xml or machine.xml
+                                 * processing.  This is because the Jekyll web server currently doesn't process XML
+                                 * files, nor is support for that likely to be added any time soon; it was a nice
+                                 * feature of the Node web server, but it's not clear that it's worth doing for Jekyll.
+                                 */
+                                displayError("invalid machine element: " + idMachine);
+                            }
+                        } else {
+                            displayError("transformToFragment failed");
+                        }
+                    } else {
+                        /*
+                         * Perhaps I should have performed this test at the outset; on the other hand, I'm
+                         * not aware of any browsers don't support one or both of the above XSLT transformation
+                         * methods, so treat this as a bug.
+                         */
+                        displayError("unable to transform XML: unsupported browser");
+                    }
+                };
+                loadXML(sXSLFile, null, sAppName, sAppClass, null, false, displayMessage, transformXML);
+            };
+
+            if (sXMLFile.charAt(0) != '<') {
+                loadXML(sXMLFile, idMachine, sAppName, sAppClass, sParms, true, displayMessage, processXML);
+            } else {
+                parseXML(sXMLFile, null, idMachine, sAppName, sAppClass, sParms, false, displayMessage, processXML);
+            }
+        } else {
+            displayError("missing machine element: " + idMachine);
+        }
+    } catch(e) {
+        displayError(e.message);
+    }
+    return fSuccess;
+}
+
+/**
+ * embedC1P(idMachine, sXMLFile, sXSLFile)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @return {boolean} true if successful, false if error
+ */
+function embedC1P(idMachine, sXMLFile, sXSLFile)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("C1Pjs", "c1pjs", APPVERSION, idMachine, sXMLFile, sXSLFile);
+}
+
+/**
+ * embedPCx86(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPCx86(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PCx86", "pcx86", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * embedPC8080(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPC8080(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PC8080", "pc8080", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * embedPDP10(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPDP10(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PDPjs", "pdp10", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * embedPDP11(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPDP11(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PDPjs", "pdp11", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * findMachineComponent(idMachine, sType)
+ *
+ * @param {string} idMachine
+ * @param {string} sType
+ * @return {Component|null}
+ */
+function findMachineComponent(idMachine, sType)
+{
+    return Component.getComponentByType(sType, idMachine + ".machine");
+}
+
+/**
+ * processMachineScript(idMachine, sScript)
+ *
+ * @param {string} idMachine
+ * @param {string} sScript
+ * @return {boolean}
+ */
+function processMachineScript(idMachine, sScript)
+{
+    return Component.processScript(idMachine, sScript);
+}
+
+/**
+ * Prevent the Closure Compiler from renaming functions we want to export, by adding them as global properties.
+ *
+ * TODO: Consider making all these functions properties on a single global object (eg, 'PCjs'), to minimize global
+ * pollution and risk of name collision.
+ */
+if (APPNAME == "C1Pjs") {
+    window['embedC1P']    = embedC1P;
+}
+if (APPNAME == "PCx86") {
+    window['embedPC']     = embedPCx86;         // WARNING: embedPC() deprecated as of v1.23.0
+    window['embedPCx86']  = embedPCx86;
+}
+if (APPNAME == "PC8080") {
+    window['embedPC8080'] = embedPC8080;
+}
+if (APPNAME == "PDPjs") {
+    window['embedPDP10']  = embedPDP10;
+    window['embedPDP11']  = embedPDP11;
+}
+
+window['findMachineComponent'] = findMachineComponent;
+window['processMachineScript'] = processMachineScript;
+
+window['enableEvents'] = Web.enablePageEvents;
+window['sendEvent']    = Web.sendPageEvent;
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/save.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * savePC(idMachine, sPCJSFile, callback)
+ *
+ * @param {string} idMachine
+ * @param {string} sPCJSFile
+ * @param {function(Object)} [callback]
+ * @return {boolean} true if successful, false if error
+ */
+function savePC(idMachine, sPCJSFile, callback)
+{
+    var cmp = /** @type {Computer} */ (Component.getComponentByType("Computer", idMachine));
+    var dbg = /** @type {Debugger} */ (Component.getComponentByType("Debugger", idMachine));
+    if (cmp) {
+        var sState = cmp.powerOff(true);
+        var sParms = cmp.saveMachineParms();
+        if (!sPCJSFile) {
+            if (DEBUG) {
+                sPCJSFile = "/tmp/pcx86/" + (XMLVERSION || APPVERSION) + "/pcx86.js"
+            } else {
+                sPCJSFile = "/versions/pcx86/" + (XMLVERSION || APPVERSION) + "/pcx86" + (dbg? "-dbg" : "") + ".js";
+            }
+        }
+        if (callback && callback({ state: sState, parms: sParms })) return true;
+        Web.getResource(sPCJSFile, null, true, function(sURL, sResponse, nErrorCode) {
+            downloadCSS(sURL, sResponse, nErrorCode, [idMachine, Str.getBaseName(sPCJSFile, true), sParms, sState]);
+        });
+        return true;
+    }
+    Component.alertUser("Unable to identify machine '" + idMachine + "'");
+    return false;
+}
+
+/**
+ * downloadCSS(sURL, sPCJS, nErrorCode, aMachineInfo)
+ *
+ * @param {string} sURL
+ * @param {string} sPCJS
+ * @param {number} nErrorCode
+ * @param {Array} aMachineInfo ([0] = idMachine, [1] = sScript, [2] = sParms, [3] = sState)
+ */
+function downloadCSS(sURL, sPCJS, nErrorCode, aMachineInfo)
+{
+    if (!nErrorCode && sPCJS) {
+        aMachineInfo.push(sPCJS);
+        var res = Component.getMachineResources(aMachineInfo[0]);
+        var sCSSFile = null;
+        for (var sName in res) {
+            if (Str.endsWith(sName, "components.xsl")) {
+                sCSSFile = sName.replace(".xsl", ".css");
+                break;
+            }
+        }
+        if (!sCSSFile) {
+            /*
+             * This is probably a bad idea (ie, allowing downloadPC() to proceed with our stylesheet)...
+             */
+            downloadPC(sURL, null, 0, aMachineInfo);
+        } else {
+            Web.getResource(sCSSFile, null, true, function(sURL, sResponse, nErrorCode) {
+                downloadPC(sURL, sResponse, nErrorCode, aMachineInfo);
+            });
+        }
+        return;
+    }
+    Component.alertUser("Error (" + nErrorCode + ") requesting " + sURL);
+}
+
+/**
+ * downloadPC(sURL, sCSS, nErrorCode, aMachineInfo)
+ *
+ * @param {string} sURL
+ * @param {string|null} sCSS
+ * @param {number} nErrorCode
+ * @param {Array} aMachineInfo ([0] = idMachine, [1] = sScript, [2] = sParms, [3] = sState, [4] = sPCJS)
+ */
+function downloadPC(sURL, sCSS, nErrorCode, aMachineInfo)
+{
+    var matchScript, sXMLFile, sXSLFile;
+    var idMachine = aMachineInfo[0], sScript = aMachineInfo[1], sPCJS = aMachineInfo[4];
+
+    /*
+     * sPCJS is supposed to contain the entire PCjs script, which has been wrapped with:
+     *
+     *      (function(){...
+     *
+     * at the top and:
+     *
+     *      ...})();
+     *
+     * at the bottom, thanks to the following Closure Compiler option:
+     *
+     *      --output_wrapper "(function(){%output%})();"
+     *
+     * Immediately inside that wrapping, we want to embed all the specified machine's resources, using:
+     *
+     *      var resources = {"xml": "...", "xsl": "...", ...};
+     *
+     * Note that the "resources" variable has been added to our externs.js, to prevent it from being renamed
+     * by the Closure Compiler.
+     */
+    matchScript = sPCJS.match(/^(\s*\(function\(\)\{)([\s\S]*)(}\)\(\);\s*)$/);
+    if (!matchScript) {
+        /*
+         * If the match failed, we assume that a DEBUG (uncompiled) script is being used,
+         * so we'll provide a fake match that should work with whatever script was provided.
+         */
+        if (DEBUG) {
+            matchScript = [sPCJS, "", sPCJS, ""];
+        } else {
+            sPCJS = "";
+        }
+    }
+
+    var resOld = Component.getMachineResources(idMachine), resNew = {};
+    for (var sName in resOld) {
+        var data = resOld[sName];
+        var sExt = Str.getExtension(sName);
+        if (sExt == "xml") {
+            /*
+             * Look through this resource for <disk> entries whose paths do not appear as one of the
+             * other machine resources, and remove those entries.
+             */
+            var matchDisk, reDisk = /[ \t]*<disk [^>]*path=(['"])(.*?)\1.*?<\/disk>\n?/g;
+            while (matchDisk = reDisk.exec(resOld[sName])) {
+                var path = matchDisk[2];
+                if (path) {
+                    if (resOld[path]) {
+                        Component.log("recording disk: '" + path + "'");
+                    } else {
+                        data = data.replace(matchDisk[0], "");
+                    }
+                }
+            }
+            sXMLFile = sName = Str.getBaseName(sName);
+        }
+        else if (sExt == "xsl") {
+            sXSLFile = sName = Str.getBaseName(sName);
+        }
+        Component.log("saving resource: '" + sName + "' (" + data.length + " bytes)");
+        resNew[sName] = data;
+    }
+
+    if (sCSS) {
+        resNew[sName = 'css'] = sCSS;
+        Component.log("saving resource: '" + sName + "' (" + sCSS.length + " bytes)");
+    }
+
+    if (aMachineInfo[2]) {
+        var sParms = resNew[sName = 'parms'] = aMachineInfo[2];
+        Component.log("saving resource: '" + sName + "' (" + sParms.length + " bytes)");
+    }
+
+    if (aMachineInfo[3]) {
+        var sState = resNew[sName = 'state'] = aMachineInfo[3];
+        Component.log("saving resource: '" + sName + "' (" + sState.length + " bytes)");
+    }
+
+    if (sXMLFile && sXSLFile) {
+        var sResources = JSON.stringify(resNew);
+
+        sScript += ".js";
+        sPCJS = matchScript[1] + "var resources=" + sResources + ";" + matchScript[2] + matchScript[3];
+        Component.log("saving machine: '" + idMachine + "' (" + sPCJS.length + " bytes)");
+
+        sPCJS = sPCJS.replace(/\u00A9/g, "&#xA9;");
+
+        var sAlert = Web.downloadFile(sPCJS, "javascript", false, sScript);
+
+        sAlert += ', copy it to your web server as "' + sScript + '", and then add the following to your web page:\n\n';
+        sAlert += '<div id="' + idMachine + '"></div>\n';
+        sAlert += '...\n';
+        sAlert += '<script type="text/javascript" src="' + sScript + '"></script>\n';
+        sAlert += '<script type="text/javascript">embedPC("' + idMachine + '","' + sXMLFile + '","' + sXSLFile + '");</script>\n\n';
+        sAlert += 'The machine should appear where the <div> is located.';
+        Component.alertUser(sAlert);
+        return;
+    }
+    Component.alertUser("Missing XML/XSL resources");
+}
+
+/**
+ * Prevent the Closure Compiler from renaming functions we want to export, by adding them
+ * as (named) properties of a global object.
+ */
+window['savePC'] = savePC;
diff --git a/versions/pcx86/1.35.0/pcx86.js b/versions/pcx86/1.35.0/pcx86.js
index 30404c49a..52bdf0708 100644
--- a/versions/pcx86/1.35.0/pcx86.js
+++ b/versions/pcx86/1.35.0/pcx86.js
@@ -696,4 +696,4 @@ window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==ty
 function pv(a,b,c,d){if(!c&&b){d.push(b);a=Wa[d[0]];b=null;for(var e in a)if(ra(e,"components.xsl")){b=e.replace(".xsl",".css");break}b?Ba(b,null,!0,function(a,b){qv(b,d)}):qv(null,d)}else r("Error ("+c+") requesting "+a)}
 function qv(a,b){var c,d,e,f=b[0],g=b[1];c=b[4];c=c.match(/^(\s*\(function\(\)\{)([\s\S]*)(}\)\(\);\s*)$/);var h=Wa[f],l={},m;for(m in h){var q=h[m],y=qa(m);if("xml"==y){for(y=/[ \t]*<disk [^>]*path=(['"])(.*?)\1.*?<\/disk>\n?/g;d=y.exec(h[m]);){var w=d[2];w&&(h[w]||(q=q.replace(d[0],"")))}d=m=pa(m)}else"xsl"==y&&(e=m=pa(m));l[m]=q}a&&(l[m="css"]=a);b[2]&&(l[m="parms"]=b[2]);b[3]&&(l[m="state"]=b[3]);d&&e?(a=JSON.stringify(l),g+=".js",c=c[1]+"var resources="+a+";"+c[2]+c[3],c=c.replace(/\u00A9/g,
 "&#xA9;"),a=Ka(c,"javascript",!1,g),a=a+(', copy it to your web server as "'+g+'", and then add the following to your web page:\n\n')+('<div id="'+f+'"></div>\n')+"...\n",a=a+('<script type="text/javascript" src="'+g+'">\x3c/script>\n')+('<script type="text/javascript">embedPC("'+f+'","'+d+'","'+e+'");\x3c/script>\n\n')+"The machine should appear where the <div> is located.",r(a)):r("Missing XML/XSL resources")}
-window.savePC=function(a,b,c){var d=ab("Computer",a),e=ab("Debugger",a);if(d){var f=bv(d,!0),g=d.I?JSON.stringify(d.I):null;b||(b="/versions/pcx86/1.35.0/pcx86"+(e?"-dbg":"")+".js");if(c&&c({state:f,Ij:g}))return!0;Ba(b,null,!0,function(c,d,e){pv(c,d,e,[a,pa(b,!0),g,f])});return!0}r("Unable to identify machine '"+a+"'");return!1};})();
+window.savePC=function(a,b,c){var d=ab("Computer",a),e=ab("Debugger",a);if(d){var f=bv(d,!0),g=d.I?JSON.stringify(d.I):null;b||(b="/versions/pcx86/1.35.0/pcx86"+(e?"-dbg":"")+".js");if(c&&c({state:f,Ij:g}))return!0;Ba(b,null,!0,function(c,d,e){pv(c,d,e,[a,pa(b,!0),g,f])});return!0}r("Unable to identify machine '"+a+"'");return!1};})();//# sourceMappingURL=/versions/pcx86/1.35.0/pcx86.map
diff --git a/versions/pdpjs/1.35.0/components.xsl b/versions/pdpjs/1.35.0/components.xsl
index 1246eb91e..942ac98d4 100644
--- a/versions/pdpjs/1.35.0/components.xsl
+++ b/versions/pdpjs/1.35.0/components.xsl
@@ -12,7 +12,7 @@
 
 	<xsl:variable name="MACHINETYPE">pc</xsl:variable>
 	<xsl:variable name="CSSCLASS">pcjs</xsl:variable>
-	<xsl:variable name="APPCLASS">pdp10</xsl:variable>
+	<xsl:variable name="APPCLASS">pdp11</xsl:variable>
 	<xsl:variable name="APPNAME">PDPjs</xsl:variable>
 	<xsl:variable name="APPVERSION">1.35.0</xsl:variable>
 	<xsl:variable name="SITEHOST">www.pcjs.org</xsl:variable>
diff --git a/versions/pdpjs/1.35.0/pdp10-dbg.js b/versions/pdpjs/1.35.0/pdp10-dbg.js
index 5b5cd8c8b..a4d2248d6 100644
--- a/versions/pdpjs/1.35.0/pdp10-dbg.js
+++ b/versions/pdpjs/1.35.0/pdp10-dbg.js
@@ -300,4 +300,4 @@ function Ni(a,b,c){var d;if(d=/<([a-z]+)\s+ref="(.*?)"(.*?)\/>/g.exec(a)){var e=
 function Oi(a,b,c,d,e){function f(a){if(void 0===k){var b=h&&w(h,"machine-warning");k=b&&b[0]||h}k&&(k.innerHTML=Ba(a))}function g(a){f("Error: "+a);l&&(--Ki||db(!0));l=!1}var h,k,l=!0;Ki++;jb[b]={};try{if(h=document.getElementById(b)){var p;if("object"==typeof resources&&(p=resources.css)){var q=document.head||document.getElementsByTagName("head")[0],D=document.createElement("style");D.type="text/css";D.styleSheet?D.styleSheet.cssText=p:D.appendChild(document.createTextNode(p));q.appendChild(D)}d||
 (p=a,"pdp"==a.substr(0,3)&&(p="pdpjs"),d="/versions/"+p+"/1.35.0/components.xsl");p=function(e,k){k?Li(d,null,a,null,!1,f,function(a,e){e?(ib(b,d,a),f("Processing "+c+"..."),window.ActiveXObject||"ActiveXObject"in window?(e=k.transformNode(e))?(h.outerHTML=e,--Ki||db(!0)):g("transformNodeToObject failed"):document.implementation&&document.implementation.createDocument?(a=new XSLTProcessor,a.importStylesheet(e),(e=a.transformToFragment(k,document))?h.parentNode?(h.parentNode.replaceChild(e,h),--Ki||
 db(!0)):g("invalid machine element: "+b):g("transformToFragment failed")):g("unable to transform XML: unsupported browser")):g(a)}):g(e)};"<"!=c.charAt(0)?Li(c,b,a,e,!0,f,p):Mi(c,null,b,a,e,!1,f,p)}else g("missing machine element: "+b)}catch(F){g(F.message)}return l}window.embedPDP10=function(a,b,c,d){db(!1);return Oi("pdp10",a,b,c,d)};window.embedPDP11=function(a,b,c,d){db(!1);return Oi("pdp11",a,b,c,d)};window.findMachineComponent=function(a,b){return tb(b,a+".machine")};
-window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==typeof b&&!wb[a]){for(var c=!0,d=wb,e=a,f=b.length,g=[],h=[],k="",l=null,p=0;p<f;p++){var q=b[p];if('"'==q||"'"==q)l&&q!=l?k+=q:(l?l=null:l=q,k&&(h.push(k),k=""));else{if(!l){if("\r"==q||"\n"==q)q=";";if(" "==q||"\t"==q||";"==q){k&&(h.push(k),k="");";"==q&&h.length&&(g.push(h),h=[]);continue}}k+=q}}k&&h.push(k);h.length&&g.push(h);d[e]=g;vb(a)||(c=!1)}return c};window.enableEvents=db;window.sendEvent=fb;})();//# sourceMappingURL=/tmp/pdpjs/1.35.0/pdp10-dbg.map
+window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==typeof b&&!wb[a]){for(var c=!0,d=wb,e=a,f=b.length,g=[],h=[],k="",l=null,p=0;p<f;p++){var q=b[p];if('"'==q||"'"==q)l&&q!=l?k+=q:(l?l=null:l=q,k&&(h.push(k),k=""));else{if(!l){if("\r"==q||"\n"==q)q=";";if(" "==q||"\t"==q||";"==q){k&&(h.push(k),k="");";"==q&&h.length&&(g.push(h),h=[]);continue}}k+=q}}k&&h.push(k);h.length&&g.push(h);d[e]=g;vb(a)||(c=!1)}return c};window.enableEvents=db;window.sendEvent=fb;})();//# sourceMappingURL=/versions/pdpjs/1.35.0/pdp10-dbg.map
diff --git a/versions/pdpjs/1.35.0/pdp10-uncompiled.js b/versions/pdpjs/1.35.0/pdp10-uncompiled.js
new file mode 100644
index 000000000..ebeeda557
--- /dev/null
+++ b/versions/pdpjs/1.35.0/pdp10-uncompiled.js
@@ -0,0 +1,27999 @@
+"use strict";
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/defines.js (C) Jeff Parsons 2012-2017
+ */
+
+/**
+ * @define {string}
+ */
+var APPVERSION = "1.x.x";       // this @define is overridden by the Closure Compiler with the version in package.json
+
+var XMLVERSION = null;          // this is set in non-COMPILED builds by embedMachine() if a version number was found in the machine XML
+
+var COPYRIGHT = "Copyright © 2012-2017 Jeff Parsons <Jeff@pcjs.org>";
+
+var LICENSE = "License: GPL version 3 or later <http://gnu.org/licenses/gpl.html>";
+
+var CSSCLASS = "pcjs";
+
+/**
+ * @define {string}
+ */
+var SITEHOST = "localhost:8088";// this @define is overridden by the Closure Compiler with "www.pcjs.org"
+
+/**
+ * @define {boolean}
+ */
+var COMPILED = false;           // this @define is overridden by the Closure Compiler (to true)
+
+/**
+ * @define {boolean}
+ */
+var DEBUG = true;               // this @define is overridden by the Closure Compiler (to false) to remove DEBUG-only code
+
+/**
+ * @define {boolean}
+ */
+var MAXDEBUG = false;           // this @define is overridden by the Closure Compiler (to false) to remove MAXDEBUG-only code
+
+/**
+ * @define {boolean}
+ */
+var PRIVATE = false;            // this @define is overridden by the Closure Compiler (to false) to enable PRIVATE code
+
+/*
+ * RS-232 DB-25 Pin Definitions, mapped to bits 1-25 in a 32-bit status value.
+ *
+ * SerialPorts in PCjs machines are considered DTE (Data Terminal Equipment), which means they should be "virtually"
+ * connected to each other via a null-modem cable, which assumes the following cross-wiring:
+ *
+ *     G       1  <->  1        G       (Ground)
+ *     TD      2  <->  3        RD      (Received Data)
+ *     RD      3  <->  2        TD      (Transmitted Data)
+ *     RTS     4  <->  5        CTS     (Clear To Send)
+ *     CTS     5  <->  4        RTS     (Request To Send)
+ *     DSR   6+8  <->  20       DTR     (Data Terminal Ready)
+ *     SG      7  <->  7        SG      (Signal Ground)
+ *     DTR    20  <->  6+8      DSR     (Data Set Ready + Carrier Detect)
+ *     RI     22  <->  22       RI      (Ring Indicator)
+ *
+ * TODO: Move these definitions to a more appropriate shared file at some point.
+ */
+var RS232 = {
+    RTS: {
+        PIN:  4,
+        MASK: 0x00000010
+    },
+    CTS: {
+        PIN:  5,
+        MASK: 0x00000020
+    },
+    DSR: {
+        PIN:  6,
+        MASK: 0x00000040
+    },
+    CD: {
+        PIN:  8,
+        MASK: 0x00000100
+    },
+    DTR: {
+        PIN:  20,
+        MASK: 0x00100000
+    },
+    RI: {
+        PIN:  22,
+        MASK: 0x00400000
+    }
+};
+
+/*
+ * NODE should be true if we're running under NodeJS (eg, command-line), false if not (eg, web browser)
+ */
+var NODE = false;
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/dumpapi.js (C) Jeff Parsons 2012-2017
+ */
+
+/*
+ * Our "DiskDump API", such as it was, used to look like:
+ *
+ *      http://jsmachines.net/bin/convdisk.php?disk=/disks/pc/dos/ibm/2.00/PCDOS200-DISK1.json&format=img
+ *
+ * To make it (a bit) more "REST-like", the above request now looks like:
+ *
+ *      http://www.pcjs.org/api/v1/dump?disk=/disks/pc/dos/ibm/2.00/PCDOS200-DISK1.json&format=img
+ *
+ * Similarly, our "FileDump API" used to look like:
+ *
+ *      http://jsmachines.net/bin/convrom.php?rom=/devices/pc/rom/5150/1981-04-24/PCBIOS-REV1.rom&format=json
+ *
+ * and that request now looks like:
+ *
+ *      http://www.pcjs.org/api/v1/dump?file=/devices/pc/rom/5150/1981-04-24/PCBIOS-REV1.rom&format=json
+ *
+ * I don't think it makes sense to avoid "query" parameters, because blending the path of a disk image with the
+ * the rest of the URL would be (a) confusing, and (b) more work to parse.
+ */
+var DumpAPI = {
+    ENDPOINT:       "/api/v1/dump",
+    QUERY: {
+        DIR:        "dir",      // value is path of a directory (DiskDump only)
+        DISK:       "disk",     // value is path of a disk image (DiskDump only)
+        FILE:       "file",     // value is path of a ROM image file (FileDump only)
+        IMG:        "img",      // alias for DISK
+        PATH:       "path",     // value is path of a one or more files (DiskDump only)
+        FORMAT:     "format",   // value is one of FORMAT values below
+        COMMENTS:   "comments", // value is either "true" or "false"
+        DECIMAL:    "decimal",  // value is either "true" to force all numbers to decimal, "false" or undefined otherwise
+        MBHD:       "mbhd",     // value is hard drive size in Mb (formerly "mbsize") (DiskDump only) (DEPRECATED)
+        SIZE:       "size"      // value is target disk size in Kb (supersedes "mbhd") (DiskDump only)
+    },
+    FORMAT: {
+        JSON:       "json",     // default
+        JSON_GZ:    "gz",       // gzip is currently used ONLY for compressed JSON
+        DATA:       "data",     // same as "json", but built without JSON.stringify() (DiskDump only)
+        HEX:        "hex",      // deprecated
+        OCTAL:      "octal",    // displays data as octal words
+        BYTES:      "bytes",    // displays data as hex bytes; normally used only when comments are enabled
+        WORDS:      "words",    // displays data as hex words; normally used only when comments are enabled
+        LONGS:      "longs",    // displays data as dwords
+        IMG:        "img",      // returns the raw disk data (ie, using a Buffer object) (DiskDump only)
+        ROM:        "rom"       // returns the raw file data (ie, using a Buffer object) (FileDump only)
+    }
+};
+
+/*
+ * Because we use an overloaded API endpoint (ie, one that's shared with the FileDump module), we must
+ * also provide a list of commands which, when combined with the endpoint, define a unique request.
+ */
+DumpAPI.asDiskCommands = [DumpAPI.QUERY.DIR, DumpAPI.QUERY.DISK, DumpAPI.QUERY.PATH];
+DumpAPI.asFileCommands = [DumpAPI.QUERY.FILE];
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/reportapi.js (C) Jeff Parsons 2012-2017
+ */
+
+var ReportAPI = {
+    ENDPOINT:       "/api/v1/report",
+    QUERY: {
+        APP:        "app",
+        VER:        "ver",
+        URL:        "url",
+        USER:       "user",
+        TYPE:       "type",
+        DATA:       "data"
+    },
+    TYPE: {
+        BUG:        "bug"
+    },
+    RES: {
+        OK:         "Thank you"
+    }
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/userapi.js (C) Jeff Parsons 2012-2017
+ */
+
+/*
+ * Examples of User API requests:
+ *
+ *      web.getHost() + UserAPI.ENDPOINT + '?' + UserAPI.QUERY.REQ + '=' + UserAPI.REQ.VERIFY + '&' + UserAPI.QUERY.USER + '=' + sUser;
+ */
+var UserAPI = {
+    ENDPOINT:       "/api/v1/user",
+    QUERY: {
+        REQ:        "req",      // specifies a request
+        USER:       "user",     // specifies a user ID
+        STATE:      "state",    // specifies a state ID
+        DATA:       "data"      // specifies state data
+    },
+    REQ: {
+        CREATE:     "create",   // creates a user ID
+        VERIFY:     "verify",   // requests verification of a user ID
+        STORE:      "store",    // stores a machine state on the server
+        LOAD:       "load"      // loads a machine state from the server
+    },
+    RES: {
+        CODE:       "code",
+        DATA:       "data"
+    },
+    CODE: {
+        OK:         "ok",
+        FAIL:       "error"
+    },
+    FAIL: {
+        DUPLICATE:  "user already exists",
+        VERIFY:     "unable to verify user",
+        BADSTATE:   "invalid state parameter",
+        NOSTATE:    "no machine state",
+        BADLOAD:    "unable to load machine state",
+        BADSTORE:   "unable to save machine state"
+    }
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/keys.js (C) Jeff Parsons 2012-2017
+ */
+
+var Keys = {
+    /*
+     * Keys and/or key combinations that generate common ASCII codes.
+     *
+     * NOTE: If you're looking for a general-purpose ASCII code table, see Str.ASCII in strlib.js;
+     * if something's missing, that's probably the more appropriate table to add it to.
+     *
+     * TODO: The Closure Compiler doesn't inline all references to these values, at least those with
+     * quoted property names, which is why I've 'unquoted' as many of them as possible.  One solution
+     * would be to add mnemonics for all of them, not just the non-printable ones (eg, SPACE instead
+     * of ' ', AMP instead of '&', etc.)
+     */
+    ASCII: {
+          BREAK:  0, CTRL_A:  1, CTRL_B:  2, CTRL_C:  3, CTRL_D:  4, CTRL_E:  5, CTRL_F:  6, CTRL_G:  7,
+         CTRL_H:  8, CTRL_I:  9, CTRL_J: 10, CTRL_K: 11, CTRL_L: 12, CTRL_M: 13, CTRL_N: 14, CTRL_O: 15,
+         CTRL_P: 16, CTRL_Q: 17, CTRL_R: 18, CTRL_S: 19, CTRL_T: 20, CTRL_U: 21, CTRL_V: 22, CTRL_W: 23,
+         CTRL_X: 24, CTRL_Y: 25, CTRL_Z: 26,
+            ' ': 32,    '!': 33,    '"': 34,    '#': 35,    '$': 36,    '%': 37,    '&': 38,    "'": 39,
+            '(': 40,    ')': 41,    '*': 42,    '+': 43,    ',': 44,    '-': 45,    '.': 46,    '/': 47,
+            '0': 48,    '1': 49,    '2': 50,    '3': 51,    '4': 52,    '5': 53,    '6': 54,    '7': 55,
+            '8': 56,    '9': 57,    ':': 58,    ';': 59,    '<': 60,    '=': 61,    '>': 62,    '?': 63,
+            '@': 64,     A:  65,     B:  66,     C:  67,     D:  68,     E:  69,     F:  70,     G:  71,
+             H:  72,     I:  73,     J:  74,     K:  75,     L:  76,     M:  77,     N:  78,     O:  79,
+             P:  80,     Q:  81,     R:  82,     S:  83,     T:  84,     U:  85,     V:  86,     W:  87,
+             X:  88,     Y:  89,     Z:  90,    '[': 91,    '\\':92,    ']': 93,    '^': 94,    '_': 95,
+            '`': 96,     a:  97,     b:  98,     c:  99,     d: 100,     e: 101,     f: 102,     g: 103,
+             h:  104,    i: 105,     j: 106,     k: 107,     l: 108,     m: 109,     n: 110,     o: 111,
+             p:  112,    q: 113,     r: 114,     s: 115,     t: 116,     u: 117,     v: 118,     w: 119,
+             x:  120,    y: 121,     z: 122,    '{':123,    '|':124,    '}':125,    '~':126,   DEL: 127
+    },
+    /*
+     * Browser keyCodes we must pay particular attention to.  For the most part, these are non-alphanumeric
+     * or function keys, some which may require special treatment (eg, preventDefault() if returning false on
+     * the initial keyDown event is insufficient).
+     *
+     * keyCodes for most common ASCII keys can simply use the appropriate ASCII code above.
+     *
+     * Most of these represent non-ASCII keys (eg, the LEFT arrow key), yet for some reason, browsers defined
+     * them using ASCII codes (eg, the LEFT arrow key uses the ASCII code for '%' or 37).
+     */
+    KEYCODE: {
+        /* 0x08 */ BS:          8,          // BACKSPACE        (ASCII.CTRL_H)
+        /* 0x09 */ TAB:         9,          // TAB              (ASCII.CTRL_I)
+        /* 0x0A */ LF:          10,         // LINE FEED        (ASCII.CTRL_J) (TODO: Determine if any key actually generates this)
+        /* 0x0D */ CR:          13,         // CARRIAGE RETURN  (ASCII.CTRL_M)
+        /* 0x10 */ SHIFT:       16,
+        /* 0x11 */ CTRL:        17,
+        /* 0x12 */ ALT:         18,
+        /* 0x13 */ PAUSE:       19,         // PAUSE/BREAK
+        /* 0x14 */ CAPS_LOCK:   20,
+        /* 0x1B */ ESC:         27,
+        /* 0x20 */ SPACE:       32,
+        /* 0x21 */ PGUP:        33,
+        /* 0x22 */ PGDN:        34,
+        /* 0x23 */ END:         35,
+        /* 0x24 */ HOME:        36,
+        /* 0x25 */ LEFT:        37,
+        /* 0x26 */ UP:          38,
+        /* 0x27 */ RIGHT:       39,
+        /* 0x27 */ FF_QUOTE:    39,
+        /* 0x28 */ DOWN:        40,
+        /* 0x2C */ FF_COMMA:    44,
+        /* 0x2C */ PRTSC:       44,
+        /* 0x2D */ INS:         45,
+        /* 0x2E */ DEL:         46,
+        /* 0x2E */ FF_PERIOD:   46,
+        /* 0x2F */ FF_SLASH:    47,
+        /* 0x30 */ ZERO:        48,
+        /* 0x31 */ ONE:         49,
+        /* 0x32 */ TWO:         50,
+        /* 0x33 */ THREE:       51,
+        /* 0x34 */ FOUR:        52,
+        /* 0x35 */ FIVE:        53,
+        /* 0x36 */ SIX:         54,
+        /* 0x37 */ SEVEN:       55,
+        /* 0x38 */ EIGHT:       56,
+        /* 0x39 */ NINE:        57,
+        /* 0x3B */ FF_SEMI:     59,
+        /* 0x3D */ FF_EQUALS:   61,
+        /* 0x5B */ CMD:         91,         // aka WIN
+        /* 0x5B */ FF_LBRACK:   91,
+        /* 0x5C */ FF_BSLASH:   92,
+        /* 0x5D */ RCMD:        93,         // aka MENU
+        /* 0x5D */ FF_RBRACK:   93,
+        /* 0x60 */ NUM_0:       96,
+        /* 0x60 */ NUM_INS:     96,
+        /* 0x60 */ FF_BQUOTE:   96,
+        /* 0x61 */ NUM_1:       97,
+        /* 0x61 */ NUM_END:     97,
+        /* 0x62 */ NUM_2:       98,
+        /* 0x62 */ NUM_DOWN:    98,
+        /* 0x63 */ NUM_3:       99,
+        /* 0x63 */ NUM_PGDN:    99,
+        /* 0x64 */ NUM_4:       100,
+        /* 0x64 */ NUM_LEFT:    100,
+        /* 0x65 */ NUM_5:       101,
+        /* 0x65 */ NUM_CENTER:  101,
+        /* 0x66 */ NUM_6:       102,
+        /* 0x66 */ NUM_RIGHT:   102,
+        /* 0x67 */ NUM_7:       103,
+        /* 0x67 */ NUM_HOME:    103,
+        /* 0x68 */ NUM_8:       104,
+        /* 0x68 */ NUM_UP:      104,
+        /* 0x69 */ NUM_9:       105,
+        /* 0x69 */ NUM_PGUP:    105,
+        /* 0x6A */ NUM_MUL:     106,
+        /* 0x6B */ NUM_ADD:     107,
+        /* 0x6D */ NUM_SUB:     109,
+        /* 0x6E */ NUM_DEL:     110,        // aka PERIOD
+        /* 0x6F */ NUM_DIV:     111,
+        /* 0x70 */ F1:          112,
+        /* 0x71 */ F2:          113,
+        /* 0x72 */ F3:          114,
+        /* 0x73 */ F4:          115,
+        /* 0x74 */ F5:          116,
+        /* 0x75 */ F6:          117,
+        /* 0x76 */ F7:          118,
+        /* 0x77 */ F8:          119,
+        /* 0x78 */ F9:          120,
+        /* 0x79 */ F10:         121,
+        /* 0x7A */ F11:         122,
+        /* 0x7B */ F12:         123,
+        /* 0x90 */ NUM_LOCK:    144,
+        /* 0x91 */ SCROLL_LOCK: 145,
+        /* 0xAD */ FF_DASH:     173,
+        /* 0xBA */ SEMI:        186,        // Firefox:  59 (FF_SEMI)
+        /* 0xBB */ EQUALS:      187,        // Firefox:  61 (FF_EQUALS)
+        /* 0xBC */ COMMA:       188,
+        /* 0xBD */ DASH:        189,        // Firefox: 173 (FF_DASH)
+        /* 0xBE */ PERIOD:      190,
+        /* 0xBF */ SLASH:       191,
+        /* 0xC0 */ BQUOTE:      192,
+        /* 0xDB */ LBRACK:      219,
+        /* 0xDC */ BSLASH:      220,
+        /* 0xDD */ RBRACK:      221,
+        /* 0xDE */ QUOTE:       222,
+        /* 0xE0 */ FF_CMD:      224,        // Firefox only (used for both CMD and RCMD)
+        //
+        // The following biases use what I'll call Decimal Coded Binary or DCB (the opposite of BCD),
+        // where the thousands digit is used to store the sum of "binary" digits 1 and/or 2 and/or 4.
+        //
+        // Technically, that makes it DCO (Decimal Coded Octal), but then again, BCD should have really
+        // been called HCD (Hexadecimal Coded Decimal), so if "they" can take liberties, so can I.
+        //
+        // ONDOWN is a bias we add to browser keyCodes that we want to handle on "down" rather than on "press".
+        //
+        ONDOWN:                 1000,
+        //
+        // ONRIGHT is a bias we add to browser keyCodes that need to check for a "right" location (default is "left")
+        //
+        ONRIGHT:                2000,
+        //
+        // FAKE is a bias we add to signal these are fake keyCodes corresponding to internal keystroke combinations.
+        // The actual values are for internal use only and merely need to be unique and used consistently.
+        //
+        FAKE:                   4000
+    },
+    /*
+     * The set of values that a browser may store in the 'location' property of a keyboard event object
+     * which we also support.
+     */
+    LOCATION: {
+        LEFT:                   1,
+        RIGHT:                  2,
+        NUMPAD:                 3
+    }
+};
+
+/*
+ * Check the event object's 'location' property for a non-zero value for the following ONRIGHT keys.
+ */
+Keys.KEYCODE.NUM_CR = Keys.KEYCODE.CR + Keys.KEYCODE.ONRIGHT;
+
+
+/*
+ * Maps Firefox keyCodes to their more common keyCode counterparts; a number of entries in this table
+ * are no longer valid (if indeed they ever were), so they've been commented out.  It's likely that I
+ * simply extended this table to resolve additional differences in other browsers (ie, Opera), but without
+ * browser-specific checks, it's not safe to perform all the mappings shown below.
+ */
+Keys.FF_KEYCODES = {};
+Keys.FF_KEYCODES[Keys.KEYCODE.FF_SEMI]   = Keys.KEYCODE.SEMI;           //  59 -> 186
+Keys.FF_KEYCODES[Keys.KEYCODE.FF_EQUALS] = Keys.KEYCODE.EQUALS;         //  61 -> 187
+Keys.FF_KEYCODES[Keys.KEYCODE.FF_DASH]   = Keys.KEYCODE.DASH;           // 173 -> 189
+Keys.FF_KEYCODES[Keys.KEYCODE.FF_CMD]    = Keys.KEYCODE.CMD;            // 224 -> 91
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_COMMA]  = Keys.KEYCODE.COMMA;       //  44 -> 188
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_PERIOD] = Keys.KEYCODE.PERIOD;      //  46 -> 190
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_SLASH]  = Keys.KEYCODE.SLASH;       //  47 -> 191
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_BQUOTE] = Keys.KEYCODE.BQUOTE;      //  96 -> 192
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_LBRACK  = Keys.KEYCODE.LBRACK;      //  91 -> 219
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_BSLASH] = Keys.KEYCODE.BSLASH;      //  92 -> 220
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_RBRACK] = Keys.KEYCODE.RBRACK;      //  93 -> 221
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_QUOTE]  = Keys.KEYCODE.QUOTE;       //  39 -> 222
+
+/*
+ * Maps non-ASCII keyCodes to their ASCII counterparts
+ */
+Keys.NONASCII_KEYCODES = {};
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.FF_DASH] = Keys.ASCII['-'];         // 173 -> 45
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.SEMI]    = Keys.ASCII[';'];         // 186 -> 59
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.EQUALS]  = Keys.ASCII['='];         // 187 -> 61
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.DASH]    = Keys.ASCII['-'];         // 189 -> 45
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.COMMA]   = Keys.ASCII[','];         // 188 -> 44
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.PERIOD]  = Keys.ASCII['.'];         // 190 -> 46
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.SLASH]   = Keys.ASCII['/'];         // 191 -> 47
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.BQUOTE]  = Keys.ASCII['`'];         // 192 -> 96
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.LBRACK]  = Keys.ASCII['['];         // 219 -> 91
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.BSLASH]  = Keys.ASCII['\\'];        // 220 -> 92
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.RBRACK]  = Keys.ASCII[']'];         // 221 -> 93
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.QUOTE]   = Keys.ASCII["'"];         // 222 -> 39
+
+/*
+ * Maps unshifted keyCodes to their shifted counterparts; to be used when a shift-key is down.
+ * Alphabetic characters are handled in code, since they must also take CAPS_LOCK into consideration.
+ */
+Keys.SHIFTED_KEYCODES = {};
+Keys.SHIFTED_KEYCODES[Keys.ASCII['1']]     = Keys.ASCII['!'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['2']]     = Keys.ASCII['@'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['3']]     = Keys.ASCII['#'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['4']]     = Keys.ASCII['$'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['5']]     = Keys.ASCII['%'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['6']]     = Keys.ASCII['^'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['7']]     = Keys.ASCII['&'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['8']]     = Keys.ASCII['*'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['9']]     = Keys.ASCII['('];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['0']]     = Keys.ASCII[')'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.SEMI]   = Keys.ASCII[':'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.EQUALS] = Keys.ASCII['+'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.COMMA]  = Keys.ASCII['<'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.DASH]   = Keys.ASCII['_'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.PERIOD] = Keys.ASCII['>'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.SLASH]  = Keys.ASCII['?'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.BQUOTE] = Keys.ASCII['~'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.LBRACK] = Keys.ASCII['{'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.BSLASH] = Keys.ASCII['|'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.RBRACK] = Keys.ASCII['}'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.QUOTE]  = Keys.ASCII['"'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.FF_DASH]   = Keys.ASCII['_'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.FF_EQUALS] = Keys.ASCII['+'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.FF_SEMI]   = Keys.ASCII[':'];
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/strlib.js (C) Jeff Parsons 2012-2017
+ */
+
+class Str {
+    /**
+     * isValidInt(s, base)
+     *
+     * The built-in parseInt() function has the annoying feature of returning a partial value (ie,
+     * up to the point where it encounters an invalid character); eg, parseInt("foo", 16) returns 0xf.
+     *
+     * So it's best to use our own Str.parseInt() function, which will in turn use this function to
+     * validate the entire string.
+     *
+     * @param {string} s is the string representation of some number
+     * @param {number} [base] is the radix to use (default is 10); only 2, 8, 10 and 16 are supported
+     * @return {boolean} true if valid, false if invalid (or the specified base isn't supported)
+     */
+    static isValidInt(s, base)
+    {
+        if (!base || base == 10) return s.match(/^-?[0-9]+$/) !== null;
+        if (base == 16) return s.match(/^-?[0-9a-f]+$/i) !== null;
+        if (base == 8) return s.match(/^-?[0-7]+$/) !== null;
+        if (base == 2) return s.match(/^-?[01]+$/) !== null;
+        return false;
+    }
+
+    /**
+     * parseInt(s, base)
+     *
+     * This is a wrapper around the built-in parseInt() function.  Our wrapper recognizes certain prefixes
+     * ('$' or "0x" for hex, '#' or "0o" for octal) and suffixes ('.' for decimal, 'h' for hex, 'y' for
+     * binary), and then calls isValidInt() to ensure we don't convert strings that contain partial values;
+     * see isValidInt() for details.
+     *
+     * The use of multiple prefix/suffix combinations is undefined (although for the record, we process
+     * prefixes first).  We do NOT support the "0b" prefix to indicate binary UNLESS one or more commas are
+     * also present (because "0b" is also a valid hex sequence), and we do NOT support a single leading zero
+     * to indicate octal (because such a number could also be decimal or hex).  Any number of commas are
+     * allowed; we remove them all before calling the built-in parseInt().
+     *
+     * More recently, we've added support for "^D", "^O", and "^B" prefixes to accommodate the base overrides
+     * that the PDP-10's MACRO-10 assembly language supports (decimal, octal, and binary, respectively).
+     * If this support turns out to adversely affect other debuggers, then it will have to be "conditionalized".
+     * Similarly, we've added support for "K", "M", and "G" MACRO-10-style suffixes that add 3, 6, or 9 zeros
+     * to the value to be parsed, respectively.
+     *
+     * @param {string} s is the string representation of some number
+     * @param {number} [base] is the radix to use (default is 10); can be overridden by prefixes/suffixes
+     * @return {number|undefined} corresponding value, or undefined if invalid
+     */
+    static parseInt(s, base)
+    {
+        var value;
+
+        if (s) {
+            if (!base) base = 10;
+
+            var ch, chPrefix, chSuffix;
+            var fCommas = (s.indexOf(',') > 0);
+            if (fCommas) s = s.replace(/,/g, '');
+
+            ch = chPrefix = s.charAt(0);
+            if (chPrefix == '#') {
+                base = 8;
+                chPrefix = '';
+            }
+            else if (chPrefix == '$') {
+                base = 16;
+                chPrefix = '';
+            }
+            if (ch != chPrefix) {
+                s = s.substr(1);
+            }
+            else {
+                ch = chPrefix = s.substr(0, 2);
+                if (chPrefix == '0b' && fCommas || chPrefix == '^B') {
+                    base = 2;
+                    chPrefix = '';
+                }
+                else if (chPrefix == '0o' || chPrefix == '^O') {
+                    base = 8;
+                    chPrefix = '';
+                }
+                else if (chPrefix == '^D') {
+                    base = 10;
+                    chPrefix = '';
+                }
+                else if (chPrefix == '0x') {
+                    base = 16;
+                    chPrefix = '';
+                }
+                if (ch != chPrefix) s = s.substr(2);
+            }
+            ch = chSuffix = s.slice(-1);
+            if (chSuffix == 'Y' || chSuffix == 'y') {
+                base = 2;
+                chSuffix = '';
+            }
+            else if (chSuffix == '.') {
+                base = 10;
+                chSuffix = '';
+            }
+            else if (chSuffix == 'H' || chSuffix == 'h') {
+                base = 16;
+                chSuffix = '';
+            }
+            else if (chSuffix == 'K') {
+                chSuffix = '000';
+            }
+            else if (chSuffix == 'M') {
+                chSuffix = '000000';
+            }
+            else if (chSuffix == 'G') {
+                chSuffix = '000000000';
+            }
+            if (ch != chSuffix) s = s.slice(0, -1) + chSuffix;
+            /*
+             * This adds support for the MACRO-10 binary shifting (Bn) suffix, which must be stripped from the
+             * number before parsing, and then applied to the value after parsing.  If n is omitted, 35 is assumed,
+             * which is a net shift of zero.  If n < 35, then a left shift of (35 - n) is required; if n > 35, then
+             * a right shift of -(35 - n) is required.
+             */
+            var v, shift = 0;
+            if (base <= 10) {
+                var match = s.match(/(-?[0-9]+)B([0-9]*)/);
+                if (match) {
+                    s = match[1];
+                    shift = 35 - ((match[2] || 35) & 0xff);
+                }
+            }
+            if (Str.isValidInt(s, base) && !isNaN(v = parseInt(s, base))) {
+                /*
+                 * With the need to support larger (eg, 36-bit) integers, truncating to 32 bits is no longer helpful.
+                 *
+                 *      value = v|0;
+                 */
+                if (shift) {
+                    /*
+                     * Since binary shifting is a logical operation, and since shifting by division only works properly
+                     * with positive numbers, we must convert a negative value to a positive value, by computing the two's
+                     * complement.
+                     */
+                    if (v < 0) v += Math.pow(2, 36);
+                    if (shift > 0) {
+                        v *= Math.pow(2, shift);
+                    } else {
+                        v = Math.trunc(v / Math.pow(2, -shift));
+                    }
+                }
+                value = v;
+            }
+        }
+        return value;
+    }
+
+    /**
+     * toBase(n, radix, cch, sPrefix, nGrouping)
+     *
+     * Displays the given number as an unsigned integer using the specified radix and number of digits.
+     *
+     * @param {number|null|undefined} n
+     * @param {number} radix (ie, the base)
+     * @param {number} cch (the desired number of digits)
+     * @param {string} [sPrefix] (default is none)
+     * @param {number} [nGrouping]
+     * @return {string}
+     */
+    static toBase(n, radix, cch, sPrefix = "", nGrouping = 0)
+    {
+        /*
+         * An initial "falsey" check for null takes care of both null and undefined;
+         * we can't rely entirely on isNaN(), because isNaN(null) returns false, oddly enough.
+         *
+         * Alternatively, we could mask and shift n regardless of whether it's null/undefined/NaN,
+         * since JavaScript coerces such operands to zero, but I think there's "value" in seeing those
+         * values displayed differently.
+         */
+        var s = "";
+        if (isNaN(n)) {
+            n = null;
+        } else if (n != null) {
+            /*
+             * Callers that produced an input by dividing by a power of two rather than shifting (in order
+             * to access more than 32 bits) may produce a fractional result, which ordinarily we would simply
+             * ignore, but if the integer portion is zero and the sign is negative, we should probably treat
+             * this value as a sign-extension.
+             */
+            if (n < 0 && n > -1) n = -1;
+            /*
+             * Negative values should be two's complemented according to the number of digits; for example,
+             * 12 octal digits implies an upper limit 8^12.
+             */
+            if (n < 0) {
+                n += Math.pow(radix, cch);
+            }
+            if (n >= Math.pow(radix, cch)) {
+                cch = Math.ceil(Math.log(n) / Math.log(radix));
+            }
+        }
+        var g = nGrouping || -1;
+        while (cch-- > 0) {
+            if (!g) {
+                s = ',' + s;
+                g = nGrouping;
+            }
+            if (n == null) {
+                s = '?' + s;
+            } else {
+                var d = n % radix;
+                d += (d >= 0 && d <= 9? 0x30 : 0x41 - 10);
+                s = String.fromCharCode(d) + s;
+                n = Math.trunc(n / radix);
+            }
+            g--;
+        }
+        return sPrefix + s;
+    }
+
+    /**
+     * toBin(n, cch, nGrouping)
+     *
+     * Converts an integer to binary, with the specified number of digits (up to a maximum of 36).
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of binary digits (0 or undefined for default of either 8, 18, or 36)
+     * @param {number} [nGrouping]
+     * @return {string} the binary representation of n
+     */
+    static toBin(n, cch, nGrouping)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.LN2) || 1;
+            var v = Math.abs(n);
+            if (v <= 0b11111111) {
+                cch = 8;
+            } else if (v <= 0b111111111111111111) {
+                cch = 18;
+            } else {
+                cch = 36;
+            }
+        } else if (cch > 36) cch = 36;
+        return Str.toBase(n, 2, cch, "", nGrouping);
+    }
+
+    /**
+     * toBinBytes(n, cb, fPrefix)
+     *
+     * Converts an integer to binary, with the specified number of bytes (up to the default of 4).
+     *
+     * @param {number|null|undefined} n (interpreted as a 32-bit value)
+     * @param {number} [cb] is the desired number of binary bytes (4 is both the default and the maximum)
+     * @param {boolean} [fPrefix]
+     * @return {string} the binary representation of n
+     */
+    static toBinBytes(n, cb, fPrefix)
+    {
+        var s = "";
+        if (!cb || cb > 4) cb = 4;
+        for (var i = 0; i < cb; i++) {
+            if (s) s = ',' + s;
+            s = Str.toBin(n & 0xff, 8) + s;
+            n >>= 8;
+        }
+        return (fPrefix? "0b" : "") + s;
+    }
+
+    /**
+     * toOct(n, cch, fPrefix)
+     *
+     * Converts an integer to octal, with the specified number of digits (default of 6; max of 12)
+     *
+     * You might be tempted to use the built-in n.toString(8) instead, but it doesn't zero-pad and it
+     * doesn't properly convert negative values.  Moreover, if n is undefined, n.toString() will throw
+     * an exception, whereas this function will return '?' characters.
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of octal digits (0 or undefined for default of either 6, 8, or 12)
+     * @param {boolean} [fPrefix]
+     * @return {string} the octal representation of n
+     */
+    static toOct(n, cch, fPrefix)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.log(8)) || 1;
+            var v = Math.abs(n);
+            if (v <= 0o777777) {
+                cch = 6;
+            } else if (v <= 0o77777777) {
+                cch = 8;
+            } else {
+                cch = 12;
+            }
+        } else if (cch > 12) cch = 12;
+        return Str.toBase(n, 8, cch, fPrefix? "0o" : "");
+    }
+
+    /**
+     * toDec(n, cch)
+     *
+     * Converts an integer to decimal, with the specified number of digits (default of 5; max of 11)
+     *
+     * You might be tempted to use the built-in n.toString(10) instead, but it doesn't zero-pad and it
+     * doesn't properly convert negative values.  Moreover, if n is undefined, n.toString() will throw
+     * an exception, whereas this function will return '?' characters.
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of decimal digits (0 or undefined for default of either 5 or 11)
+     * @return {string} the decimal representation of n
+     */
+    static toDec(n, cch)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.LN10) || 1;
+            var v = Math.abs(n);
+            if (v <= 99999) {
+                cch = 5;
+            } else {
+                cch = 11;
+            }
+        } else if (cch > 11) cch = 11;
+        return Str.toBase(n, 10, cch);
+    }
+
+    /**
+     * toHex(n, cch, fPrefix)
+     *
+     * Converts an integer to hex, with the specified number of digits (default of 4 or 8, max of 9).
+     *
+     * You might be tempted to use the built-in n.toString(16) instead, but it doesn't zero-pad and it
+     * doesn't properly convert negative values; for example, if n is -2147483647, then n.toString(16)
+     * will return "-7fffffff" instead of "80000001".  Moreover, if n is undefined, n.toString() will
+     * throw an exception, whereas this function will return '?' characters.
+     *
+     * NOTE: The following work-around (adapted from code found on StackOverflow) would be another solution,
+     * taking care of negative values, zero-padding, and upper-casing, but not null/undefined/NaN values:
+     *
+     *      s = (n < 0? n + 0x100000000 : n).toString(16);
+     *      s = "00000000".substr(0, 8 - s.length) + s;
+     *      s = s.substr(0, cch).toUpperCase();
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of hex digits (0 or undefined for default of either 4, 8, or 9)
+     * @param {boolean} [fPrefix]
+     * @return {string} the hex representation of n
+     */
+    static toHex(n, cch, fPrefix)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.log(16)) || 1;
+            var v = Math.abs(n);
+            if (v <= 0xffff) {
+                cch = 4;
+            } else if (v <= 0xffffffff) {
+                cch = 8;
+            } else {
+                cch = 9;
+            }
+        } else if (cch > 9) cch = 9;
+        return Str.toBase(n, 16, cch, fPrefix? "0x" : "");
+    }
+
+    /**
+     * toHexByte(b)
+     *
+     * Alias for Str.toHex(b, 2, true)
+     *
+     * @param {number|null|undefined} b is a byte value
+     * @return {string} the hex representation of b
+     */
+    static toHexByte(b)
+    {
+        return Str.toHex(b, 2, true);
+    }
+
+    /**
+     * toHexWord(w)
+     *
+     * Alias for Str.toHex(w, 4, true)
+     *
+     * @param {number|null|undefined} w is a word (16-bit) value
+     * @return {string} the hex representation of w
+     */
+    static toHexWord(w)
+    {
+        return Str.toHex(w, 4, true);
+    }
+
+    /**
+     * toHexLong(l)
+     *
+     * Alias for Str.toHex(l, 8, true)
+     *
+     * @param {number|null|undefined} l is a dword (32-bit) value
+     * @return {string} the hex representation of w
+     */
+    static toHexLong(l)
+    {
+        return Str.toHex(l, 8, true);
+    }
+
+    /**
+     * getBaseName(sFileName, fStripExt)
+     *
+     * This is a poor-man's version of Node's path.basename(), which Node-only components should use instead.
+     *
+     * Note that if fStripExt is true, this strips ANY extension, whereas path.basename() strips the extension only
+     * if it matches the second parameter (eg, path.basename("/foo/bar/baz/asdf/quux.html", ".html") returns "quux").
+     *
+     * @param {string} sFileName
+     * @param {boolean} [fStripExt]
+     * @return {string}
+     */
+    static getBaseName(sFileName, fStripExt)
+    {
+        var sBaseName = sFileName;
+
+        var i = sFileName.lastIndexOf('/');
+        if (i >= 0) sBaseName = sFileName.substr(i + 1);
+
+        /*
+         * This next bit is a kludge to clean up names that are part of a URL that includes unsightly query parameters.
+         */
+        i = sBaseName.indexOf('&');
+        if (i > 0) sBaseName = sBaseName.substr(0, i);
+
+        if (fStripExt) {
+            i = sBaseName.lastIndexOf(".");
+            if (i > 0) {
+                sBaseName = sBaseName.substring(0, i);
+            }
+        }
+        return sBaseName;
+    }
+
+    /**
+     * getExtension(sFileName)
+     *
+     * This is a poor-man's version of Node's path.extname(), which Node-only components should use instead.
+     *
+     * Note that we EXCLUDE the period from the returned extension, whereas path.extname() includes it.
+     *
+     * @param {string} sFileName
+     * @return {string} the filename's extension (in lower-case and EXCLUDING the "."), or an empty string
+     */
+    static getExtension(sFileName)
+    {
+        var sExtension = "";
+        var i = sFileName.lastIndexOf(".");
+        if (i >= 0) {
+            sExtension = sFileName.substr(i + 1).toLowerCase();
+        }
+        return sExtension;
+    }
+
+    /**
+     * endsWith(s, sSuffix)
+     *
+     * @param {string} s
+     * @param {string} sSuffix
+     * @return {boolean} true if s ends with sSuffix, false if not
+     */
+    static endsWith(s, sSuffix)
+    {
+        return s.indexOf(sSuffix, s.length - sSuffix.length) !== -1;
+    }
+
+    /**
+     * escapeHTML(sHTML)
+     *
+     * @param {string} sHTML
+     * @return {string} with HTML entities "escaped", similar to PHP's htmlspecialchars()
+     */
+    static escapeHTML(sHTML)
+    {
+        return sHTML.replace(/[&<>"']/g, function(m)
+        {
+            return Str.aHTMLEscapeMap[m];
+        });
+    }
+
+    /**
+     * replaceAll(sFind, sReplace, s)
+     *
+     * @param {string} sFind
+     * @param {string} sReplace
+     * @param {string} s
+     * @return {string}
+     */
+    static replaceAll(sFind, sReplace, s)
+    {
+        var a = {};
+        a[sFind] = sReplace;
+        return Str.replaceArray(a, s);
+    }
+
+    /**
+     * replaceArray(a, s)
+     *
+     * @param {Object} a
+     * @param {string} s
+     * @return {string}
+     */
+    static replaceArray(a, s)
+    {
+        var sMatch = "";
+        for (var k in a) {
+            /*
+             * As noted in:
+             *
+             *      http://www.regexguru.com/2008/04/escape-characters-only-when-necessary/
+             *
+             * inside character classes, only backslash, caret, hyphen and the closing bracket need to be
+             * escaped.  And in fact, if you ensure that the closing bracket is first, the caret is not first,
+             * and the hyphen is last, you can avoid escaping those as well.
+             */
+            k = k.replace(/([\\[\]*{}().+?])/g, "\\$1");
+            sMatch += (sMatch? '|' : '') + k;
+        }
+        return s.replace(new RegExp('(' + sMatch + ')', "g"), function(m)
+        {
+            return a[m];
+        });
+    }
+
+    /**
+     * pad(s, cch, fPadLeft)
+     *
+     * NOTE: the maximum amount of padding currently supported is 40 spaces.
+     *
+     * @param {string} s is a string
+     * @param {number} cch is desired length
+     * @param {boolean} [fPadLeft] (default is padding on the right)
+     * @return {string} the original string (s) with spaces padding it to the specified length
+     */
+    static pad(s, cch, fPadLeft)
+    {
+        var sPadding = "                                        ";
+        return fPadLeft? (sPadding + s).slice(-cch) : (s + sPadding).slice(0, cch);
+    }
+
+    /**
+     * stripLeadingZeros(s, fPad)
+     *
+     * @param {string} s
+     * @param {boolean} [fPad]
+     * @return {string}
+     */
+    static stripLeadingZeros(s, fPad)
+    {
+        var cch = s.length;
+        s = s.replace(/^0+([0-9A-F]+)$/i, "$1");
+        if (fPad) s = Str.pad(s, cch, true);
+        return s;
+    }
+
+    /**
+     * trim(s)
+     *
+     * @param {string} s
+     * @return {string}
+     */
+    static trim(s)
+    {
+        if (String.prototype.trim) {
+            return s.trim();
+        }
+        return s.replace(/^\s+|\s+$/g, "");
+    }
+
+    /**
+     * toASCIICode(b)
+     *
+     * @param {number} b
+     * @return {string}
+     */
+    static toASCIICode(b)
+    {
+        var s;
+        if (b != Str.ASCII.CR && b != Str.ASCII.LF) {
+            s = Str.aASCIICodes[b];
+        }
+        if (s) {
+            s = '<' + s + '>';
+        } else {
+            s = String.fromCharCode(b);
+        }
+        return s;
+    }
+}
+
+Str.aHTMLEscapeMap = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#039;'
+};
+
+/*
+ * Future home of a general-purpose ASCII table.  TODO: Flesh it out.
+ */
+Str.ASCII = {
+    LF:     0x0A,
+    CR:     0x0D
+};
+
+/*
+ * Table for converting "unprintable" ASCII codes into mnemonics, to more clearly see what's being printed.
+ */
+Str.aASCIICodes = {
+    0x00:   "NUL",
+    0x01:   "SOH",      // (CTRL_A) Start of Heading
+    0x02:   "STX",      // (CTRL_B) Start of Text
+    0x03:   "ETX",      // (CTRL_C) End of Text
+    0x04:   "EOT",      // (CTRL_D) End of Transmission
+    0x05:   "ENQ",      // (CTRL_E) Enquiry
+    0x06:   "ACK",      // (CTRL_F) Acknowledge
+    0x07:   "BEL",      // (CTRL_G) Bell
+    0x08:   "BS",       // (CTRL_H) Backspace
+    0x09:   "TAB",      // (CTRL_I) Horizontal Tab
+    0x0A:   "LF",       // (CTRL_J) Line Feed (New Line)
+    0x0B:   "VT",       // (CTRL_K) Vertical Tab
+    0x0C:   "FF",       // (CTRL_L) Form Feed (New Page)
+    0x0D:   "CR",       // (CTRL_M) Carriage Return
+    0x0E:   "SO",       // (CTRL_N) Shift Out
+    0x0F:   "SI",       // (CTRL_O) Shift In
+    0x10:   "DLE",      // (CTRL_P) Data Link Escape
+    0x11:   "XON",      // (CTRL_Q) Device Control 1 (aka DC1)
+    0x12:   "DC2",      // (CTRL_R) Device Control 2
+    0x13:   "XOFF",     // (CTRL_S) Device Control 3 (aka DC3)
+    0x14:   "DC4",      // (CTRL_T) Device Control 4
+    0x15:   "NAK",      // (CTRL_U) Negative Acknowledge
+    0x16:   "SYN",      // (CTRL_V) Synchronous Idle
+    0x17:   "ETB",      // (CTRL_W) End of Transmission Block
+    0x18:   "CAN",      // (CTRL_X) Cancel
+    0x19:   "EM",       // (CTRL_Y) End of Medium
+    0x1A:   "SUB",      // (CTRL_Z) Substitute
+    0x1B:   "ESC",      // Escape
+    0x1C:   "FS",       // File Separator
+    0x1D:   "GS",       // Group Separator
+    0x1E:   "RS",       // Record Separator
+    0x1F:   "US"        // Unit Separator
+};
+
+Str.TYPES = {
+    NULL:       0,
+    BYTE:       1,
+    WORD:       2,
+    DWORD:      3,
+    NUMBER:     4,
+    STRING:     5,
+    BOOLEAN:    6,
+    OBJECT:     7,
+    ARRAY:      8
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/usrlib.js (C) Jeff Parsons 2012-2017
+ */
+
+/**
+ * @typedef {{
+ *  mask:       number,
+ *  shift:      number
+ * }}
+ */
+var BitField;
+
+/**
+ * @typedef {Object.<BitField>}
+ */
+var BitFields;
+
+class Usr {
+    /**
+     * binarySearch(a, v, fnCompare)
+     *
+     * @param {Array} a is an array
+     * @param {number|string|Array|Object} v
+     * @param {function((number|string|Array|Object), (number|string|Array|Object))} [fnCompare]
+     * @return {number} the index of matching entry if non-negative, otherwise the index of the insertion point
+     */
+    static binarySearch(a, v, fnCompare)
+    {
+        var left = 0;
+        var right = a.length;
+        var found = 0;
+        if (fnCompare === undefined) {
+            fnCompare = function(a, b)
+            {
+                return a > b ? 1 : a < b ? -1 : 0;
+            };
+        }
+        while (left < right) {
+            var middle = (left + right) >> 1;
+            var compareResult;
+            compareResult = fnCompare(v, a[middle]);
+            if (compareResult > 0) {
+                left = middle + 1;
+            } else {
+                right = middle;
+                found = !compareResult;
+            }
+        }
+        return found ? left : ~left;
+    }
+
+    /**
+     * binaryInsert(a, v, fnCompare)
+     *
+     * If element v already exists in array a, the array is unchanged (we don't allow duplicates); otherwise, the
+     * element is inserted into the array at the appropriate index.
+     *
+     * @param {Array} a is an array
+     * @param {number|string|Array|Object} v is the value to insert
+     * @param {function((number|string|Array|Object), (number|string|Array|Object))} [fnCompare]
+     */
+    static binaryInsert(a, v, fnCompare)
+    {
+        var index = Usr.binarySearch(a, v, fnCompare);
+        if (index < 0) {
+            a.splice(-(index + 1), 0, v);
+        }
+    }
+
+    /**
+     * getTimestamp()
+     *
+     * @return {string} timestamp containing the current date and time ("yyyy-mm-dd hh:mm:ss")
+     */
+    static getTimestamp()
+    {
+        var date = new Date();
+        var padNum = function(n)
+        {
+            return (n < 10 ? "0" : "") + n;
+        };
+        return date.getFullYear() + "-" + padNum(date.getMonth() + 1) + "-" + padNum(date.getDate()) + " " + padNum(date.getHours()) + ":" + padNum(date.getMinutes()) + ":" + padNum(date.getSeconds());
+    }
+
+    /**
+     * getMonthDays(nMonth, nYear)
+     *
+     * Note that if we're being called on behalf of the RTC, its year is always truncated to two digits (mod 100),
+     * so we have no idea what century the year 0 might refer to.  When using the normal leap-year formula, 0 fails
+     * the mod 100 test but passes the mod 400 test, so as far as the RTC is concerned, every century year is a leap
+     * year.  Since we're most likely dealing with the year 2000, that's fine, since 2000 was also a leap year.
+     *
+     * TODO: There IS a separate CMOS byte that's supposed to be set to CMOS_ADDR.CENTURY_DATE; it's always BCD,
+     * so theoretically it will contain values like 0x19 or 0x20 (for the 20th and 21st centuries, respectively), and
+     * we could add that as another parameter to this function, to improve the accuracy, but that would go beyond what
+     * a real RTC actually does.
+     *
+     * @param {number} nMonth (1-12)
+     * @param {number} nYear (normally a 4-digit year, but it may also be mod 100)
+     * @return {number} the maximum (1-based) day allowed for the specified month and year
+     */
+    static getMonthDays(nMonth, nYear)
+    {
+        var nDays = Usr.aMonthDays[nMonth - 1];
+        if (nDays == 28) {
+            if ((nYear % 4) === 0 && ((nYear % 100) || (nYear % 400) === 0)) {
+                nDays++;
+            }
+        }
+        return nDays;
+    }
+
+    /**
+     * formatDate(sFormat, date)
+     *
+     * @param {string} sFormat (eg, "F j, Y", "Y-m-d H:i:s")
+     * @param {Date} [date] (default is the current time)
+     * @return {string}
+     *
+     * Supported identifiers in sFormat include:
+     *
+     *      a:  lowercase ante meridiem and post meridiem (am or pm)
+     *      d:  day of the month, 2 digits with leading zeros (01,...,31)
+     *      g:  hour in 12-hour format, without leading zeros (1,...,12)
+     *      i:  minutes, with leading zeros (00,...,59)
+     *      j:  day of the month, without leading zeros (1,...,31)
+     *      l:  day of the week ("Sunday",...,"Saturday")
+     *      m:  month, with leading zeros (01,...,12)
+     *      s:  seconds, with leading zeros (00,...,59)
+     *      F:  month ("January",...,"December")
+     *      H:  hour in 24-hour format, with leading zeros (00,...,23)
+     *      Y:  year (eg, 2014)
+     *
+     * For more inspiration, see: http://php.net/manual/en/function.date.php
+     */
+    static formatDate(sFormat, date)
+    {
+        var sDate = "";
+        if (!date) date = new Date();
+        var iHour = date.getHours();
+        var iDay = date.getDate();
+        var iMonth = date.getMonth() + 1;
+        for (var i = 0; i < sFormat.length; i++) {
+            var ch;
+            switch ((ch = sFormat.charAt(i))) {
+            case 'a':
+                sDate += (iHour < 12 ? "am" : "pm");
+                break;
+            case 'd':
+                sDate += ('0' + iDay).slice(-2);
+                break;
+            case 'g':
+                sDate += (!iHour ? 12 : (iHour > 12 ? iHour - 12 : iHour));
+                break;
+            case 'i':
+                sDate += ('0' + date.getMinutes()).slice(-2);
+                break;
+            case 'j':
+                sDate += iDay;
+                break;
+            case 'l':
+                sDate += Usr.asDays[date.getDay()];
+                break;
+            case 'm':
+                sDate += ('0' + iMonth).slice(-2);
+                break;
+            case 's':
+                sDate += ('0' + date.getSeconds()).slice(-2);
+                break;
+            case 'F':
+                sDate += Usr.asMonths[iMonth - 1];
+                break;
+            case 'H':
+                sDate += ('0' + iHour).slice(-2);
+                break;
+            case 'Y':
+                sDate += date.getFullYear();
+                break;
+            default:
+                sDate += ch;
+                break;
+            }
+        }
+        return sDate;
+    }
+
+    /**
+     * defineBitFields(bfs)
+     *
+     * Prepares a bit field definition for use with getBitField() and setBitField(); eg:
+     *
+     *      var bfs = Usr.defineBitFields({num:20, count:8, btmod:1, type:3});
+     *
+     * The above defines a set of bit fields containing four fields: num (bits 0-19), count (bits 20-27), btmod (bit 28), and type (bits 29-31).
+     *
+     *      Usr.setBitField(bfs.num, n, 1);
+     *
+     * The above set bit field "bfs.num" in numeric variable "n" to the value 1.
+     *
+     * @param {Object} bfs
+     * @return {BitFields}
+     */
+    static defineBitFields(bfs)
+    {
+        var bit = 0;
+        for (var f in bfs) {
+            var width = bfs[f];
+            var mask = ((1 << width) - 1) << bit;
+            bfs[f] = {mask: mask, shift: bit};
+            bit += width;
+        }
+        return bfs;
+    }
+
+    /**
+     * initBitFields(bfs, ...)
+     *
+     * @param {BitFields} bfs
+     * @param {...number} var_args
+     * @return {number} a value containing all supplied bit fields
+     */
+    static initBitFields(bfs, var_args)
+    {
+        var v = 0, i = 1;
+        for (var f in bfs) {
+            if (i >= arguments.length) break;
+            v = Usr.setBitField(bfs[f], v, arguments[i++]);
+        }
+        return v;
+    }
+
+    /**
+     * getBitField(bf, v)
+     *
+     * @param {BitField} bf
+     * @param {number} v is a value containing bit fields
+     * @return {number} the value of the bit field in v defined by bf
+     */
+    static getBitField(bf, v)
+    {
+        return (v & bf.mask) >> bf.shift;
+    }
+
+    /**
+     * setBitField(bf, v, n)
+     *
+     * @param {BitField} bf
+     * @param {number} v is a value containing bit fields
+     * @param {number} n is a value to store in v in the bit field defined by bf
+     * @return {number} updated v
+     */
+    static setBitField(bf, v, n)
+    {
+        return (v & ~bf.mask) | ((n << bf.shift) & bf.mask);
+    }
+
+    /**
+     * indexOf(a, t, i)
+     *
+     * Use this instead of Array.prototype.indexOf() if you can't be sure the browser supports it.
+     *
+     * @param {Array} a
+     * @param {*} t
+     * @param {number} [i]
+     * @returns {number}
+     */
+    static indexOf(a, t, i)
+    {
+        if (Array.prototype.indexOf) {
+            return a.indexOf(t, i);
+        }
+        i = i || 0;
+        if (i < 0) i += a.length;
+        if (i < 0) i = 0;
+        for (var n = a.length; i < n; i++) {
+            if (i in a && a[i] === t) return i;
+        }
+        return -1;
+    }
+}
+
+Usr.asDays = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
+Usr.asMonths = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
+Usr.aMonthDays = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+
+/**
+ * getTime()
+ *
+ * @return {number} the current time, in milliseconds
+ */
+Usr.getTime = Date.now || function() { return +new Date(); };
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/weblib.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * According to http://www.w3schools.com/jsref/jsref_obj_global.asp, these are the *global* properties
+ * and functions of JavaScript-in-the-Browser:
+ *
+ * Property             Description
+ * ---
+ * Infinity             A numeric value that represents positive/negative infinity
+ * NaN                  "Not-a-Number" value
+ * undefined            Indicates that a variable has not been assigned a value
+ *
+ * Function             Description
+ * ---
+ * decodeURI()          Decodes a URI
+ * decodeURIComponent() Decodes a URI component
+ * encodeURI()          Encodes a URI
+ * encodeURIComponent() Encodes a URI component
+ * escape()             Deprecated in version 1.5. Use encodeURI() or encodeURIComponent() instead
+ * eval()               Evaluates a string and executes it as if it was script code
+ * isFinite()           Determines whether a value is a finite, legal number
+ * isNaN()              Determines whether a value is an illegal number
+ * Number()             Converts an object's value to a number
+ * parseFloat()         Parses a string and returns a floating point number
+ * parseInt()           Parses a string and returns an integer
+ * String()             Converts an object's value to a string
+ * unescape()           Deprecated in version 1.5. Use decodeURI() or decodeURIComponent() instead
+ *
+ * And according to http://www.w3schools.com/jsref/obj_window.asp, these are the properties and functions
+ * of the *window* object.
+ *
+ * Property             Description
+ * ---
+ * closed               Returns a Boolean value indicating whether a window has been closed or not
+ * defaultStatus        Sets or returns the default text in the statusbar of a window
+ * document             Returns the Document object for the window (See Document object)
+ * frames               Returns an array of all the frames (including iframes) in the current window
+ * history              Returns the History object for the window (See History object)
+ * innerHeight          Returns the inner height of a window's content area
+ * innerWidth           Returns the inner width of a window's content area
+ * length               Returns the number of frames (including iframes) in a window
+ * location             Returns the Location object for the window (See Location object)
+ * name                 Sets or returns the name of a window
+ * navigator            Returns the Navigator object for the window (See Navigator object)
+ * opener               Returns a reference to the window that created the window
+ * outerHeight          Returns the outer height of a window, including toolbars/scrollbars
+ * outerWidth           Returns the outer width of a window, including toolbars/scrollbars
+ * pageXOffset          Returns the pixels the current document has been scrolled (horizontally) from the upper left corner of the window
+ * pageYOffset          Returns the pixels the current document has been scrolled (vertically) from the upper left corner of the window
+ * parent               Returns the parent window of the current window
+ * screen               Returns the Screen object for the window (See Screen object)
+ * screenLeft           Returns the x coordinate of the window relative to the screen
+ * screenTop            Returns the y coordinate of the window relative to the screen
+ * screenX              Returns the x coordinate of the window relative to the screen
+ * screenY              Returns the y coordinate of the window relative to the screen
+ * self                 Returns the current window
+ * status               Sets or returns the text in the statusbar of a window
+ * top                  Returns the topmost browser window
+ *
+ * Method               Description
+ * ---
+ * alert()              Displays an alert box with a message and an OK button
+ * atob()               Decodes a base-64 encoded string
+ * blur()               Removes focus from the current window
+ * btoa()               Encodes a string in base-64
+ * clearInterval()      Clears a timer set with setInterval()
+ * clearTimeout()       Clears a timer set with setTimeout()
+ * close()              Closes the current window
+ * confirm()            Displays a dialog box with a message and an OK and a Cancel button
+ * createPopup()        Creates a pop-up window
+ * focus()              Sets focus to the current window
+ * moveBy()             Moves a window relative to its current position
+ * moveTo()             Moves a window to the specified position
+ * open()               Opens a new browser window
+ * print()              Prints the content of the current window
+ * prompt()             Displays a dialog box that prompts the visitor for input
+ * resizeBy()           Resizes the window by the specified pixels
+ * resizeTo()           Resizes the window to the specified width and height
+ * scroll()             This method has been replaced by the scrollTo() method.
+ * scrollBy()           Scrolls the content by the specified number of pixels
+ * scrollTo()           Scrolls the content to the specified coordinates
+ * setInterval()        Calls a function or evaluates an expression at specified intervals (in milliseconds)
+ * setTimeout()         Calls a function or evaluates an expression after a specified number of milliseconds
+ * stop()               Stops the window from loading
+ */
+
+class Web {
+    /**
+     * log(s, type)
+     *
+     * For diagnostic output only.  DEBUG must be true (or "--debug" specified via the command-line)
+     * for Component.log() to display anything.
+     *
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     */
+    static log(s, type)
+    {
+        Component.log(s, type);
+    }
+
+    /**
+     * notice(s, fPrintOnly, id)
+     *
+     * @param {string} s is the message text
+     * @param {boolean} [fPrintOnly]
+     * @param {string} [id] is the caller's ID, if any
+     */
+    static notice(s, fPrintOnly, id)
+    {
+        Component.notice(s, fPrintOnly, id);
+    }
+
+    /**
+     * getResource(sURL, dataPost, fAsync, done)
+     *
+     * Request the specified resource (sURL), and once the request is complete, notify done().
+     *
+     * If fAsync is true, a done() callback should ALWAYS be supplied; otherwise, you'll have no
+     * idea when the request is complete or what the response was.  done() is passed three parameters:
+     *
+     *      done(sURL, sResource, nErrorCode)
+     *
+     * If nErrorCode is zero, sResource should contain the requested data; otherwise, an error occurred.
+     *
+     * If dataPost is set to a string, that string can be used to control the response format;
+     * by default, the response format is plain text, but you can specify "bytes" to request arbitrary
+     * binary data, which should come back as a string of bytes.
+     *
+     * TODO: The "bytes" option works by calling overrideMimeType(), which was never a best practice.
+     * Instead, we should implement supported response types ("text" and "arraybuffer", at a minimum)
+     * by setting xmlHTTP.responseType to one of those values before calling xmlHTTP.send().
+     *
+     * @param {string} sURL
+     * @param {string|Object|null} [dataPost] for a POST request (default is a GET request)
+     * @param {boolean} [fAsync] is true for an asynchronous request
+     * @param {function(string,string,number)} [done]
+     * @return {Array|null} Array containing [sResource, nErrorCode], or null if no response yet
+     */
+    static getResource(sURL, dataPost, fAsync = false, done)
+    {
+        var nErrorCode = 0, sResource = null, response = null;
+
+        if (typeof resources == 'object' && (sResource = resources[sURL])) {
+            if (done) done(sURL, sResource, nErrorCode);
+            return [sResource, nErrorCode];
+        }
+        else if (fAsync && typeof resources == 'function') {
+            resources(sURL, function(sResource, nErrorCode)
+            {
+                if (done) done(sURL, sResource, nErrorCode);
+            });
+            return response;
+        }
+
+        if (DEBUG) {
+            /*
+             * The larger resources we put on archive.pcjs.org should also be available locally...
+             */
+            sURL = sURL.replace(/^http:\/\/archive.pcjs.org(\/.*)\/([^\/]*)$/, "$1/archive/$2");
+        }
+
+
+        var xmlHTTP = (window.XMLHttpRequest? new window.XMLHttpRequest() : new window.ActiveXObject("Microsoft.XMLHTTP"));
+        if (fAsync) {
+            xmlHTTP.onreadystatechange = function()
+            {
+                if (xmlHTTP.readyState === 4) {
+                    /*
+                     * The following line was recommended for WebKit, as a work-around to prevent the handler firing multiple
+                     * times when debugging.  Unfortunately, that's not the only XMLHttpRequest problem that occurs when
+                     * debugging, so I think the WebKit problem is deeper than that.  When we have multiple XMLHttpRequests
+                     * pending, any debugging activity means most of them simply get dropped on floor, so what may actually be
+                     * happening are mis-notifications rather than redundant notifications.
+                     *
+                     *      xmlHTTP.onreadystatechange = undefined;
+                     */
+                    sResource = xmlHTTP.responseText;
+                    /*
+                     * The normal "success" case is an HTTP status code of 200, but when testing with files loaded
+                     * from the local file system (ie, when using the "file:" protocol), we have to be a bit more "flexible".
+                     */
+                    if (xmlHTTP.status == 200 || !xmlHTTP.status && sResource.length && Web.getHostProtocol() == "file:") {
+                        if (MAXDEBUG) Web.log("xmlHTTP.onreadystatechange(" + sURL + "): returned " + sResource.length + " bytes");
+                    }
+                    else {
+                        nErrorCode = xmlHTTP.status || -1;
+                        Web.log("xmlHTTP.onreadystatechange(" + sURL + "): error code " + nErrorCode);
+                    }
+                    if (done) done(sURL, sResource, nErrorCode);
+                }
+            };
+        }
+
+        if (dataPost && typeof dataPost == "object") {
+            var sDataPost = "";
+            for (var p in dataPost) {
+                if (!dataPost.hasOwnProperty(p)) continue;
+                if (sDataPost) sDataPost += "&";
+                sDataPost += p + '=' + encodeURIComponent(dataPost[p]);
+            }
+            sDataPost = sDataPost.replace(/%20/g, '+');
+            if (MAXDEBUG) Web.log("Web.getResource(POST " + sURL + "): " + sDataPost.length + " bytes");
+            xmlHTTP.open("POST", sURL, fAsync);     // ensure that fAsync is a valid boolean (Internet Explorer xmlHTTP functions insist on it)
+            xmlHTTP.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
+            xmlHTTP.send(sDataPost);
+        } else {
+            if (MAXDEBUG) Web.log("Web.getResource(GET " + sURL + ")");
+            xmlHTTP.open("GET", sURL, fAsync);      // ensure that fAsync is a valid boolean (Internet Explorer xmlHTTP functions insist on it)
+            if (dataPost == "bytes") {
+                xmlHTTP.overrideMimeType("text/plain; charset=x-user-defined");
+            }
+            xmlHTTP.send();
+        }
+
+        if (!fAsync) {
+            sResource = xmlHTTP.responseText;
+            if (xmlHTTP.status == 200) {
+                if (MAXDEBUG) Web.log("Web.getResource(" + sURL + "): returned " + sResource.length + " bytes");
+            } else {
+                nErrorCode = xmlHTTP.status || -1;
+                Web.log("Web.getResource(" + sURL + "): error code " + nErrorCode);
+            }
+            if (done) done(sURL, sResource, nErrorCode);
+            response = [sResource, nErrorCode];
+        }
+        return response;
+    }
+
+    /**
+     * parseMemoryResource(sURL, sData)
+     *
+     * This converts a variety of JSON-style data streams into an Object with the following properties:
+     *
+     *      aBytes
+     *      aSymbols
+     *      addrLoad
+     *      addrExec
+     *
+     * If the source data contains a 'bytes' array, it's passed through to 'aBytes'; alternatively, if
+     * it contains a 'words' array, the values are converted from 16-bit to 8-bit and stored in 'aBytes',
+     * and if it contains a 'longs' array, the values are converted from 32-bit longs into bytes and
+     * stored in 'aBytes'.
+     *
+     * Alternatively, if the source data contains a 'data' array, we simply pass that through to the output
+     * object as:
+     *
+     *      aData
+     *
+     * @param {string} sURL
+     * @param {string} sData
+     * @return {Object|null} (resource)
+     */
+    static parseMemoryResource(sURL, sData)
+    {
+        var i;
+        var resource = {
+            aBytes: null,
+            aSymbols: null,
+            addrLoad: null,
+            addrExec: null
+        };
+
+        if (sData.charAt(0) == "[" || sData.charAt(0) == "{") {
+            try {
+                var a, ib, data;
+
+                if (sData.substr(0, 1) == "<") {    // if the "data" begins with a "<"...
+                    /*
+                     * Early server configs reported an error (via the nErrorCode parameter) if a tape URL was invalid,
+                     * but more recent server configs now display a somewhat friendlier HTML error page.  The downside,
+                     * however, is that the original error has been buried, and we've received "data" that isn't actually
+                     * tape data.  So if the data we've received appears to be "HTML-like", we treat it as an error message.
+                     */
+                    throw new Error(sData);
+                }
+
+                /*
+                 * TODO: IE9 is rather unfriendly and restrictive with regard to how much data it's willing to
+                 * eval().  In particular, the 10Mb disk image we use for the Windows 1.01 demo config fails in
+                 * IE9 with an "Out of memory" exception.  One work-around would be to chop the data into chunks
+                 * (perhaps one track per chunk, using regular expressions) and then manually re-assemble it.
+                 *
+                 * However, it turns out that using JSON.parse(sDiskData) instead of eval("(" + sDiskData + ")")
+                 * is a much easier fix. The only drawback is that we must first quote any unquoted property names
+                 * and remove any comments, because while eval() was cool with them, JSON.parse() is more particular;
+                 * the following RegExp replacements take care of those requirements.
+                 *
+                 * The use of hex values is something else that eval() was OK with, but JSON.parse() is not, and
+                 * while I've stopped using hex values in DumpAPI responses (at least when "format=json" is specified),
+                 * I can't guarantee they won't show up in "legacy" images, and there's no simple RegExp replacement
+                 * for transforming hex values into decimal values, so I cop out and fall back to eval() if I detect
+                 * any hex prefixes ("0x") in the sequence.  Ditto for error messages, which appear like so:
+                 *
+                 *      ["unrecognized disk path: test.img"]
+                 */
+                if (sData.indexOf("0x") < 0 && sData.indexOf("0o") < 0 && sData.substr(0, 2) != '["') {
+                    data = JSON.parse(sData.replace(/([a-z]+):/gm, '"$1":').replace(/\/\/[^\n]*/gm, ""));
+                } else {
+                    data = eval("(" + sData + ")");
+                }
+
+                resource.addrLoad = data['load'];
+                resource.addrExec = data['exec'];
+
+                if (a = data['bytes']) {
+                    resource.aBytes = a;
+                }
+                else if (a = data['words']) {
+                    /*
+                     * Convert all words into bytes
+                     */
+                    resource.aBytes = new Array(a.length * 2);
+                    for (i = 0, ib = 0; i < a.length; i++) {
+                        resource.aBytes[ib++] = a[i] & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 8) & 0xff;
+
+                    }
+                }
+                else if (a = data['longs']) {
+                    /*
+                     * Convert all dwords (longs) into bytes
+                     */
+                    resource.aBytes = new Array(a.length * 4);
+                    for (i = 0, ib = 0; i < a.length; i++) {
+                        resource.aBytes[ib++] = a[i] & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 8) & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 16) & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 24) & 0xff;
+                    }
+                }
+                else if (a = data['data']) {
+                    resource.aData = a;
+                }
+                else {
+                    resource.aBytes = data;
+                }
+
+                if (resource.aBytes) {
+                    if (!resource.aBytes.length) {
+                        Component.error("Empty resource: " + sURL);
+                        resource = null;
+                    }
+                    else if (resource.aBytes.length == 1) {
+                        Component.error(resource.aBytes[0]);
+                        resource = null;
+                    }
+                }
+                resource.aSymbols = data['symbols'];
+
+            } catch (e) {
+                Component.error("Resource data error (" + sURL + "): " + e.message);
+                resource = null;
+            }
+        }
+        else {
+            /*
+             * Parse the data manually; we assume it's a series of hex byte-values separated by whitespace.
+             */
+            var ab = [];
+            var sHexData = sData.replace(/\n/gm, " ").replace(/ +$/, "");
+            var asHexData = sHexData.split(" ");
+            for (i = 0; i < asHexData.length; i++) {
+                var n = parseInt(asHexData[i], 16);
+                if (isNaN(n)) {
+                    Component.error("Resource data error (" + sURL + "): invalid hex byte (" + asHexData[i] + ")");
+                    break;
+                }
+                ab.push(n & 0xff);
+            }
+            if (i == asHexData.length) resource.aBytes = ab;
+        }
+        return resource;
+    }
+
+    /**
+     * sendReport(sApp, sVer, sURL, sUser, sType, sReport, sHostName)
+     *
+     * Send a report (eg, bug report) to the server.
+     *
+     * @param {string} sApp (eg, "PCjs")
+     * @param {string} sVer (eg, "1.02")
+     * @param {string} sURL (eg, "/devices/pc/machine/5150/mda/64kb/machine.xml")
+     * @param {string} sUser (ie, the user key, if any)
+     * @param {string} sType (eg, "bug"); one of ReportAPI.TYPE.*
+     * @param {string} sReport (eg, unparsed state data)
+     * @param {string} [sHostName] (default is http://SITEHOST)
+     */
+    static sendReport(sApp, sVer, sURL, sUser, sType, sReport, sHostName)
+    {
+        var dataPost = {};
+        dataPost[ReportAPI.QUERY.APP] = sApp;
+        dataPost[ReportAPI.QUERY.VER] = sVer;
+        dataPost[ReportAPI.QUERY.URL] = sURL;
+        dataPost[ReportAPI.QUERY.USER] = sUser;
+        dataPost[ReportAPI.QUERY.TYPE] = sType;
+        dataPost[ReportAPI.QUERY.DATA] = sReport;
+        var sReportURL = (sHostName? sHostName : "http://" + SITEHOST) + ReportAPI.ENDPOINT;
+        Web.getResource(sReportURL, dataPost, true);
+    }
+
+    /**
+     * getHost()
+     *
+     * @return {string}
+     */
+    static getHost()
+    {
+        return ("http://" + (window? window.location.host : SITEHOST));
+    }
+
+    /**
+     * getHostURL()
+     *
+     * @return {string|null}
+     */
+    static getHostURL()
+    {
+        return (window? window.location.href : null);
+    }
+
+    /**
+     * getHostProtocol()
+     *
+     * @return {string}
+     */
+    static getHostProtocol()
+    {
+        return (window? window.location.protocol : "file:");
+    }
+
+    /**
+     * getUserAgent()
+     *
+     * @return {string}
+     */
+    static getUserAgent()
+    {
+        return (window? window.navigator.userAgent : "");
+    }
+
+    /**
+     * hasLocalStorage
+     *
+     * true if localStorage support exists, is enabled, and works; false otherwise
+     *
+     * @return {boolean}
+     */
+    static hasLocalStorage()
+    {
+        if (Web.fLocalStorage == null) {
+            var f = false;
+            if (window) {
+                try {
+                    window.localStorage.setItem(Web.sLocalStorageTest, Web.sLocalStorageTest);
+                    f = (window.localStorage.getItem(Web.sLocalStorageTest) == Web.sLocalStorageTest);
+                    window.localStorage.removeItem(Web.sLocalStorageTest);
+                } catch (e) {
+                    Web.logLocalStorageError(e);
+                    f = false;
+                }
+            }
+            Web.fLocalStorage = f;
+        }
+        return Web.fLocalStorage;
+    }
+
+    /**
+     * logLocalStorageError(e)
+     *
+     * @param {Error} e is an exception
+     */
+    static logLocalStorageError(e)
+    {
+        Web.log(e.message, "localStorage error");
+    }
+
+    /**
+     * getLocalStorageItem(sKey)
+     *
+     * Returns the requested key value, or null if the key does not exist, or undefined if localStorage is not available
+     *
+     * @param {string} sKey
+     * @return {string|null|undefined} sValue
+     */
+    static getLocalStorageItem(sKey)
+    {
+        var sValue;
+        if (window) {
+            try {
+                sValue = window.localStorage.getItem(sKey);
+            } catch (e) {
+                Web.logLocalStorageError(e);
+            }
+        }
+        return sValue;
+    }
+
+    /**
+     * setLocalStorageItem(sKey, sValue)
+     *
+     * @param {string} sKey
+     * @param {string} sValue
+     * @return {boolean} true if localStorage is available, false if not
+     */
+    static setLocalStorageItem(sKey, sValue)
+    {
+        try {
+            window.localStorage.setItem(sKey, sValue);
+            return true;
+        } catch (e) {
+            Web.logLocalStorageError(e);
+        }
+        return false;
+    }
+
+    /**
+     * removeLocalStorageItem(sKey)
+     *
+     * @param {string} sKey
+     */
+    static removeLocalStorageItem(sKey)
+    {
+        try {
+            window.localStorage.removeItem(sKey);
+        } catch (e) {
+            Web.logLocalStorageError(e);
+        }
+    }
+
+    /**
+     * getLocalStorageKeys()
+     *
+     * @return {Array}
+     */
+    static getLocalStorageKeys()
+    {
+        var a = [];
+        try {
+            for (var i = 0, c = window.localStorage.length; i < c; i++) {
+                a.push(window.localStorage.key(i));
+            }
+        } catch (e) {
+            Web.logLocalStorageError(e);
+        }
+        return a;
+    }
+
+    /**
+     * reloadPage()
+     */
+    static reloadPage()
+    {
+        if (window) window.location.reload();
+    }
+
+    /**
+     * isUserAgent(s)
+     *
+     * Check the browser's user-agent string for the given substring; "iOS" and "MSIE" are special values you can
+     * use that will match any iOS or MSIE browser, respectively (even IE11, in the case of "MSIE").
+     *
+     * 2013-11-06: In a questionable move, MSFT changed the user-agent reported by IE11 on Windows 8.1, eliminating
+     * the "MSIE" string (which MSDN calls a "version token"; see http://msdn.microsoft.com/library/ms537503.aspx);
+     * they say "public websites should rely on feature detection, rather than browser detection, in order to design
+     * their sites for browsers that don't support the features used by the website." So, in IE11, we get a user-agent
+     * that tries to fool apps into thinking the browser is more like WebKit or Gecko:
+     *
+     *      Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
+     *
+     * That's a nice idea, but in the meantime, they hosed the XSL transform code in embed.js, which contained
+     * some very critical browser-specific code; turning on IE's "Compatibility Mode" didn't help either, because
+     * that's a sledgehammer solution which restores the old user-agent string but also disables other features like
+     * HTML5 canvas support. As an interim solution, I'm treating any "MSIE" check as a check for either "MSIE" or
+     * "Trident".
+     *
+     * UPDATE: I've since found ways to make the code in embed.js more browser-agnostic, so for now, there's isn't
+     * any code that cares about "MSIE", but I've left the change in place, because I wouldn't be surprised if I'll
+     * need more IE-specific code in the future, perhaps for things like copy/paste functionality, or mouse capture.
+     *
+     * @param {string} s is a substring to search for in the user-agent; as noted above, "iOS" and "MSIE" are special values
+     * @return {boolean} is true if the string was found, false if not
+     */
+    static isUserAgent(s)
+    {
+        if (window) {
+            var userAgent = Web.getUserAgent();
+            /*
+             * Here's one case where we have to be careful with Component, because when isUserAgent() is called by
+             * the init code below, component.js hasn't been loaded yet.  The simple solution for now is to remove the call.
+             *
+             *      Web.log("agent: " + userAgent);
+             *
+             * And yes, it would be pointless to use the conditional (?) operator below, if not for the Google Closure
+             * Compiler (v20130823) failing to detect the entire expression as a boolean.
+             */
+            return s == "iOS" && !!userAgent.match(/(iPod|iPhone|iPad)/) && !!userAgent.match(/AppleWebKit/) || s == "MSIE" && !!userAgent.match(/(MSIE|Trident)/) || (userAgent.indexOf(s) >= 0);
+        }
+        return false;
+    }
+
+    /**
+     * isMobile()
+     *
+     * Check the browser's user-agent string for the substring "Mobi", as per Mozilla recommendation:
+     *
+     *      https://developer.mozilla.org/en-US/docs/Browser_detection_using_the_user_agent
+     *
+     * @return {boolean} is true if the browser appears to be a mobile (ie, non-desktop) web browser, false if not
+     */
+    static isMobile()
+    {
+        return Web.isUserAgent("Mobi");
+    }
+
+    /**
+     * getURLParm(sParm)
+     *
+     * @param {string} sParm
+     * @return {string|undefined}
+     */
+    static getURLParm(sParm)
+    {
+        if (!Web.parmsURL) {
+            Web.parmsURL = Web.parseURLParms();
+        }
+        return Web.parmsURL[sParm];
+    }
+
+    /**
+     * parseURLParms(sParms)
+     *
+     * @param {string} [sParms] containing the parameter portion of a URL (ie, after the '?')
+     * @return {Object} containing properties for each parameter found
+     */
+    static parseURLParms(sParms)
+    {
+        var aParms = {};
+        if (window) {       // an alternative to "if (typeof module === 'undefined')" if require("defines") was used
+            if (!sParms) {
+                /*
+                 * Note that window.location.href returns the entire URL, whereas window.location.search
+                 * returns only the parameters, if any (starting with the '?', which we skip over with a substr() call).
+                 */
+                sParms = window.location.search.substr(1);
+            }
+            var match;
+            var pl = /\+/g; // RegExp for replacing addition symbol with a space
+            var search = /([^&=]+)=?([^&]*)/g;
+            var decode = function(s)
+            {
+                return decodeURIComponent(s.replace(pl, " "));
+            };
+
+            while ((match = search.exec(sParms))) {
+                aParms[decode(match[1])] = decode(match[2]);
+            }
+        }
+        return aParms;
+    }
+
+    /**
+     * downloadFile(sData, sType, fBase64, sFileName)
+     *
+     * @param {string} sData
+     * @param {string} sType
+     * @param {boolean} [fBase64]
+     * @param {string} [sFileName]
+     */
+    static downloadFile(sData, sType, fBase64, sFileName)
+    {
+        var link = null, sAlert;
+        var sURI = "data:application/" + sType + (fBase64? ";base64" : "") + ",";
+
+        if (!Web.isUserAgent("Firefox")) {
+            sURI += (fBase64? sData : encodeURI(sData));
+        } else {
+            sURI += (fBase64? sData : encodeURIComponent(sData));
+        }
+        if (sFileName) {
+            link = document.createElement('a');
+            if (typeof link.download != 'string') link = null;
+        }
+        if (link) {
+            link.href = sURI;
+            link.download = sFileName;
+            document.body.appendChild(link);    // Firefox allegedly requires the link to be in the body
+            link.click();
+            document.body.removeChild(link);
+            sAlert = 'Check your Downloads folder for ' + sFileName + '.';
+        } else {
+            window.open(sURI);
+            sAlert = 'Check your browser for a new window/tab containing the requested data' + (sFileName? (' (' + sFileName + ')') : '') + '.';
+        }
+        return sAlert;
+    }
+
+    /**
+     * onCountRepeat(n, fnRepeat, fnComplete, msDelay)
+     *
+     * Call fnRepeat() n times with an msDelay millisecond delay between calls,
+     * then call fnComplete() when n has been exhausted OR fnRepeat() returns false.
+     *
+     * @param {number} n
+     * @param {function()} fnRepeat
+     * @param {function()} fnComplete
+     * @param {number} [msDelay]
+     */
+    static onCountRepeat(n, fnRepeat, fnComplete, msDelay)
+    {
+        var fnTimeout = function doCountRepeat()
+        {
+            n -= 1;
+            if (n >= 0) {
+                if (!fnRepeat()) n = 0;
+            }
+            if (n > 0) {
+                setTimeout(fnTimeout, msDelay || 0);
+                return;
+            }
+            fnComplete();
+        };
+        fnTimeout();
+    }
+
+    /**
+     * onClickRepeat(e, msDelay, msRepeat, fn)
+     *
+     * Repeatedly call fn() with an initial msDelay, and an msRepeat delay thereafter,
+     * as long as HTML control Object e has an active "down" event and fn() returns true.
+     *
+     * @param {Object} e
+     * @param {number} msDelay
+     * @param {number} msRepeat
+     * @param {function(boolean)} fn is passed false on the first call, true on all repeated calls
+     */
+    static onClickRepeat(e, msDelay, msRepeat, fn)
+    {
+        var ms = 0, timer = null, fIgnoreMouseEvents = false;
+
+        var fnRepeat = function doClickRepeat()
+        {
+            if (fn(ms === msRepeat)) {
+                timer = setTimeout(fnRepeat, ms);
+                ms = msRepeat;
+            }
+        };
+        e.onmousedown = function()
+        {
+            // Web.log("onMouseDown()");
+            if (!fIgnoreMouseEvents) {
+                if (!timer) {
+                    ms = msDelay;
+                    fnRepeat();
+                }
+            }
+        };
+        e.ontouchstart = function()
+        {
+            // Web.log("onTouchStart()");
+            if (!timer) {
+                ms = msDelay;
+                fnRepeat();
+            }
+        };
+        e.onmouseup = e.onmouseout = function()
+        {
+            // Web.log("onMouseUp()/onMouseOut()");
+            if (timer) {
+                clearTimeout(timer);
+                timer = null;
+            }
+        };
+        e.ontouchend = e.ontouchcancel = function()
+        {
+            // Web.log("onTouchEnd()/onTouchCancel()");
+            if (timer) {
+                clearTimeout(timer);
+                timer = null;
+            }
+            /*
+             * Devices that generate ontouch* events ALSO generate onmouse* events,
+             * and generally do so immediately after all the touch events are complete,
+             * so unless we want double the action, we need to ignore mouse events.
+             */
+            fIgnoreMouseEvents = true;
+        };
+    }
+
+    /**
+     * onPageEvent(sName, fn)
+     *
+     * For 'onload', 'onunload', and 'onpageshow' events, most callers should NOT use this function, but
+     * instead use Web.onInit(), Web.onShow(), and Web.onExit(), respectively.
+     *
+     * The only components that should still use onPageEvent() are THIS component (see the bottom of this file)
+     * and components that need to capture other events (eg, the 'onresize' event in the Video component).
+     *
+     * This function creates a chain of callbacks, allowing multiple JavaScript modules to define handlers
+     * for the same event, which wouldn't be possible if everyone modified window['onload'], window['onunload'],
+     * etc, themselves.  However, that's less of a concern now, because assuming everyone else is now using
+     * onInit(), onExit(), etc, then there really IS only one component setting the window callback: this one.
+     *
+     * NOTE: It's risky to refer to obscure event handlers with "dot" names, because the Closure Compiler may
+     * erroneously replace them (eg, window.onpageshow is a good example).
+     *
+     * @param {string} sFunc
+     * @param {function()} fn
+     */
+    static onPageEvent(sFunc, fn)
+    {
+        if (window) {
+            var fnPrev = window[sFunc];
+            if (typeof fnPrev !== 'function') {
+                window[sFunc] = fn;
+            } else {
+                /*
+                 * TODO: Determine whether there's any value in receiving/sending the Event object that the
+                 * browser provides when it generates the original event.
+                 */
+                window[sFunc] = function onWindowEvent()
+                {
+                    if (fnPrev) fnPrev();
+                    fn();
+                };
+            }
+        }
+    };
+
+    /**
+     * onInit(fn)
+     *
+     * Use this instead of setting window.onload.  Allows multiple JavaScript modules to define their own 'onload' event handler.
+     *
+     * @param {function()} fn
+     */
+    static onInit(fn)
+    {
+        Web.aPageEventHandlers['init'].push(fn);
+    };
+
+    /**
+     * onShow(fn)
+     *
+     * @param {function()} fn
+     *
+     * Use this instead of setting window.onpageshow.  Allows multiple JavaScript modules to define their own 'onpageshow' event handler.
+     */
+    static onShow(fn)
+    {
+        Web.aPageEventHandlers['show'].push(fn);
+    };
+
+    /**
+     * onExit(fn)
+     *
+     * @param {function()} fn
+     *
+     * Use this instead of setting window.onunload.  Allows multiple JavaScript modules to define their own 'onunload' event handler.
+     */
+    static onExit(fn)
+    {
+        Web.aPageEventHandlers['exit'].push(fn);
+    };
+
+    /**
+     * doPageEvent(afn)
+     *
+     * @param {Array.<function()>} afn
+     */
+    static doPageEvent(afn)
+    {
+        if (Web.fPageEventsEnabled) {
+            try {
+                for (var i = 0; i < afn.length; i++) {
+                    afn[i]();
+                }
+            } catch (e) {
+                Web.notice("An unexpected exception occurred:\n\n" + e.message + "\n\nPlease send this information to support@pcjs.org. Thanks.");
+            }
+        }
+    };
+
+    /**
+     * enablePageEvents(fEnable)
+     *
+     * @param {boolean} fEnable is true to enable page events, false to disable (they're enabled by default)
+     */
+    static enablePageEvents(fEnable)
+    {
+        if (!Web.fPageEventsEnabled && fEnable) {
+            Web.fPageEventsEnabled = true;
+            if (Web.fPageLoaded) Web.sendPageEvent('init');
+            if (Web.fPageShowed) Web.sendPageEvent('show');
+            return;
+        }
+        Web.fPageEventsEnabled = fEnable;
+    }
+
+    /**
+     * sendPageEvent(sEvent)
+     *
+     * This allows us to manually trigger page events.
+     *
+     * @param {string} sEvent (one of 'init', 'show' or 'exit')
+     */
+    static sendPageEvent(sEvent)
+    {
+        if (Web.aPageEventHandlers[sEvent]) {
+            Web.doPageEvent(Web.aPageEventHandlers[sEvent]);
+        }
+    }
+}
+
+Web.parmsURL = null;            // initialized on first call to parseURLParms()
+
+Web.aPageEventHandlers = {
+    'init': [],                 // list of window 'onload' handlers
+    'show': [],                 // list of window 'onpageshow' handlers
+    'exit': []                  // list of window 'onunload' handlers (although we prefer to use 'onbeforeunload' if possible)
+};
+
+Web.fPageLoaded = false;        // set once the page's first 'onload' event has occurred
+Web.fPageShowed = false;        // set once the page's first 'onpageshow' event has occurred
+Web.fPageEventsEnabled = true;  // default is true, set to false (or true) by enablePageEvents()
+
+/**
+ * fLocalStorage
+ *
+ * true if localStorage support exists, is enabled, and works; "falsey" otherwise
+ *
+ * @type {boolean|null}
+ */
+Web.fLocalStorage = null;
+
+/**
+ * TODO: Is there any way to get the Closure Compiler to stop inlining this string?  This isn't cutting it.
+ *
+ * @const {string}
+ */
+Web.sLocalStorageTest = "PCjs.localStorage";
+
+Web.onPageEvent('onload', function onPageLoad() {
+    Web.fPageLoaded = true;
+    Web.doPageEvent(Web.aPageEventHandlers['init']);
+});
+
+Web.onPageEvent('onpageshow', function onPageShow() {
+    Web.fPageShowed = true;
+    Web.doPageEvent(Web.aPageEventHandlers['show']);
+});
+
+Web.onPageEvent(Web.isUserAgent("Opera") || Web.isUserAgent("iOS")? 'onunload' : 'onbeforeunload', function onPageUnload() {
+    Web.doPageEvent(Web.aPageEventHandlers['exit']);
+});
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/component.js (C) Jeff Parsons 2012-2017
+ */
+
+/*
+ * All PCjs components now use JSDoc types, primarily so that Google's Closure Compiler will compile
+ * everything with zero warnings when ADVANCED_OPTIMIZATIONS are enabled.  For more information about
+ * the JSDoc types supported by the Closure Compiler:
+ *
+ *      https://developers.google.com/closure/compiler/docs/js-for-compiler#types
+ *
+ * I also attempted to validate this code with JSLint, but it complained too much; eg, it didn't like
+ * "while (true)", a tried and "true" programming convention for decades, and it wanted me to replace
+ * all "++" and "--" operators with "+= 1" and "-= 1", use "(s || '')" instead of "(s? s : '')", etc.
+ *
+ * I prefer sticking with traditional C-style idioms, in part because they are more portable.  That
+ * does NOT mean I'm trying to write "portable JavaScript," but some of this code was ported from C code
+ * I'd written long ago, so portability is good, and I'm not going to throw that away if there's no need.
+ *
+ * UPDATE: I've since switched from JSLint to JSHint, which seems to have more reasonable defaults.
+ * And for new code, I have adopted some popular JavaScript idioms, like "(s || '')", although the need
+ * for those kinds of expressions will be reduced as I also start adopting some ES6 features, like
+ * default parameters.
+ */
+
+
+/**
+ * Since the Closure Compiler treats ES6 classes as @struct rather than @dict by default,
+ * it deters us from defining named properties on our components; eg:
+ *
+ *      this['exports'] = {...}
+ *
+ * results in an error:
+ *
+ *      Cannot do '[]' access on a struct
+ *
+ * So, in order to define 'exports', we must override the @struct assumption by annotating
+ * the class as @unrestricted (or @dict).  Note that this must be done both here and in the
+ * subclass (eg, SerialPort), because otherwise the Compiler won't allow us to *reference*
+ * the named property either.
+ *
+ * TODO: Consider marking ALL our classes unrestricted, because otherwise it forces us to
+ * define every single property the class uses in its constructor, which results in a fair
+ * bit of redundant initialization, since many properties aren't (and don't need to be) fully
+ * initialized until the appropriate init(), reset(), restore(), etc. function is called.
+ *
+ * The upside, however, may be that since the structure of the class is completely defined by
+ * the constructor, JavaScript engines may be able to optimize and run more efficiently.
+ *
+ * @unrestricted
+ */
+class Component {
+    /**
+     * Component(type, parms, bitsMessage)
+     *
+     * A Component object requires:
+     *
+     *      type: a user-defined type name (eg, "CPU")
+     *
+     * and accepts any or all of the following (parms) properties:
+     *
+     *      id: component ID (default is "")
+     *      name: component name (default is ""; if blank, toString() will use the type name only)
+     *      comment: component comment string (default is undefined)
+     *
+     * Component subclasses will usually have additional (parms) properties.
+     *
+     * @param {string} type
+     * @param {Object} [parms]
+     * @param {number} [bitsMessage] selects message(s) that the component wants to enable (default is 0)
+     */
+    constructor(type, parms, bitsMessage)
+    {
+        this.type = type;
+
+        if (!parms) parms = {'id': "", 'name': ""};
+
+        this.id = parms['id'] || "";
+        this.name = parms['name'];
+        this.comment = parms['comment'];
+        this.parms = parms;
+
+        /*
+         * The following Component properties need to be accessible by other machines and/or command scripts;
+         * well, OK, or we could have exported some new functions to walk the contents of these properties, as we
+         * did with findMachineComponent(), but this works just as well.
+         *
+         * Also, while the double-assignment looks silly (ie, using both dot and bracket property notation), it
+         * resolves a complaint from the Closure Compiler, because if we use ONLY bracket notation here, then the
+         * Compiler wants us to change all the other references to bracket notation as well.
+         */
+        this.exports = this['exports'] = {};
+        this.bindings = this['bindings'] = {};
+
+        var i = this.id.indexOf('.');
+        if (i < 0) {
+            this.idComponent = this.id;
+        } else {
+            this.idMachine = this.id.substr(0, i);
+            this.idComponent = this.id.substr(i + 1);
+        }
+
+        /*
+         * Gather all the various component flags (booleans) into a single "flags" object, and encourage
+         * subclasses to do the same, to reduce the property clutter we have to wade through while debugging.
+         */
+        this.flags = {
+            ready:      false,
+            busy:       false,
+            busyCancel: false,
+            powered:    false,
+            error:      false
+        };
+
+        this.fnReady = null;
+        this.clearError();
+        this.bitsMessage = bitsMessage || 0;
+
+        /** @type {Object|null} controlPrint is the HTML control, if any, that we can print to */
+        this.controlPrint = null;
+
+        this.cmp = null;
+        this.bus = null;
+        this.cpu = null;
+        this.dbg = null;
+
+        /*
+         * TODO: Consider adding another parameter to the Component() constructor that allows components to tell
+         * us if they support single or multiple instances per machine.  For example, there can be multiple SerialPort
+         * components per machine, but only one CPU component (some machines also support an FPU, but that component
+         * is considered separate from the CPU).
+         *
+         * It's not critical, but it would help catch machine configuration errors; for example, a machine that mistakenly
+         * includes two CPU components may, aside from wasting memory, end up with odd side-effects, like unresponsive
+         * CPU controls.
+         */
+        Component.add(this);
+    }
+
+    /**
+     * Component.add(component)
+     *
+     * @param {Component} component
+     */
+    static add(component)
+    {
+        /*
+         * This just generates a lot of useless noise, handy in the early days, not so much these days....
+         *
+         *      if (DEBUG) Component.log("Component.add(" + component.type + "," + component.id + ")");
+         */
+        Component.components.push(component);
+    }
+
+    /**
+     * Component.addMachine(idMachine)
+     *
+     * @param {string} idMachine
+     */
+    static addMachine(idMachine)
+    {
+        Component.machines[idMachine] = {};
+    }
+
+    /**
+     * Component.addMachineResource(idMachine, sName, data)
+     *
+     * @param {string} idMachine
+     * @param {string|null} sName (name of the resource)
+     * @param {*} data
+     */
+    static addMachineResource(idMachine, sName, data)
+    {
+        /*
+         * I used to assert(Component.machines[idMachine]), but when we're running as a Node app, embed.js is not used,
+         * so addMachine() is never called, so resources do not need to be recorded.
+         */
+        if (Component.machines[idMachine] && sName) {
+            Component.machines[idMachine][sName] = data;
+        }
+    }
+
+    /**
+     * Component.getMachineResources(idMachine)
+     *
+     * @param {string} idMachine
+     * @return {Object|undefined}
+     */
+    static getMachineResources(idMachine)
+    {
+        return Component.machines[idMachine];
+    }
+
+    /**
+     * Component.getTime()
+     *
+     * @return {number} the current time, in milliseconds
+     */
+    static getTime()
+    {
+        return Date.now() || +new Date();
+    }
+
+    /**
+     * Component.log(s, type)
+     *
+     * For diagnostic output only.
+     *
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     */
+    static log(s, type)
+    {
+        if (!COMPILED) {
+            if (s) {
+                var sElapsed = "", sMsg = (type? (type + ": ") : "") + s;
+                if (typeof Usr != "undefined") {
+                    if (Component.msStart === undefined) {
+                        Component.msStart = Component.getTime();
+                    }
+                    sElapsed = (Component.getTime() - Component.msStart) + "ms: ";
+                }
+                if (window && window.console) console.log(sElapsed + sMsg.replace(/\n/g, " "));
+            }
+        }
+    }
+
+    /**
+     * Component.assert(f, s)
+     *
+     * Verifies conditions that must be true (for DEBUG builds only).
+     *
+     * The Closure Compiler should automatically remove all references to Component.assert() in non-DEBUG builds.
+     * TODO: Add a task to the build process that "asserts" there are no instances of "assertion failure" in RELEASE builds.
+     *
+     * @param {boolean} f is the expression we are asserting to be true
+     * @param {string} [s] is description of the assertion on failure
+     */
+    static assert(f, s)
+    {
+        if (DEBUG) {
+            if (!f) {
+                if (!s) s = "assertion failure";
+                Component.log(s);
+                throw new Error(s);
+            }
+        }
+    }
+
+    /**
+     * Component.println(s, type, id)
+     *
+     * For non-diagnostic messages, which components may override to control the destination/appearance of their output.
+     *
+     * Components that inherit from this class should use the instance method, this.println(), rather than Component.println(),
+     * because if a Control Panel is loaded, it will override only the instance method, not the class method (overriding the class
+     * method would improperly affect any other machines loaded on the same page).
+     *
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     * @param {string} [id] is the caller's ID, if any
+     */
+    static println(s, type, id)
+    {
+        if (!COMPILED) {
+            Component.log((id? (id + ": ") : "") + (s? ("\"" + s + "\"") : ""), type);
+        }
+    }
+
+    /**
+     * Component.notice(s, fPrintOnly, id)
+     *
+     * notice() is like println() but implies a need for user notification, so we alert() as well.
+     *
+     * @param {string} s is the message text
+     * @param {boolean} [fPrintOnly]
+     * @param {string} [id] is the caller's ID, if any
+     */
+    static notice(s, fPrintOnly, id)
+    {
+        if (!COMPILED) {
+            Component.println(s, "notice", id);
+        }
+        if (!fPrintOnly) Component.alertUser((id? (id + ": ") : "") + s);
+    }
+
+    /**
+     * Component.warning(s)
+     *
+     * @param {string} s describes the warning
+     */
+    static warning(s)
+    {
+        if (!COMPILED) {
+            Component.println(s, "warning");
+        }
+        Component.alertUser(s);
+    }
+
+    /**
+     * Component.error(s)
+     *
+     * @param {string} s describes the error; an alert() is displayed as well
+     */
+    static error(s)
+    {
+        if (!COMPILED) {
+            Component.println(s, "error");
+        }
+        Component.alertUser(s);
+    }
+
+    /**
+     * Component.alertUser(sMessage)
+     *
+     * @param {string} sMessage
+     */
+    static alertUser(sMessage)
+    {
+        if (window) {
+            window.alert(sMessage);
+        } else {
+            Component.log(sMessage);
+        }
+    };
+
+    /**
+     * Component.confirmUser(sPrompt)
+     *
+     * @param {string} sPrompt
+     * @returns {boolean} true if the user clicked OK, false if Cancel/Close
+     */
+    static confirmUser(sPrompt)
+    {
+        var fResponse = false;
+        if (window) {
+            fResponse = window.confirm(sPrompt);
+        }
+        return fResponse;
+    }
+
+    /**
+     * Component.promptUser()
+     *
+     * @param {string} sPrompt
+     * @param {string} [sDefault]
+     * @returns {string|null}
+     */
+    static promptUser(sPrompt, sDefault)
+    {
+        var sResponse = null;
+        if (window) {
+            sResponse = window.prompt(sPrompt, sDefault === undefined? "" : sDefault);
+        }
+        return sResponse;
+    }
+
+    /**
+     * Component.getComponents(idRelated)
+     *
+     * We could store components as properties, using the component's ID, and change
+     * this linear lookup into a property lookup, but some components may have no ID.
+     *
+     * @param {string} [idRelated] of related component
+     * @return {Array} of components
+     */
+    static getComponents(idRelated)
+    {
+        var i;
+        var aComponents = [];
+        /*
+         * getComponentByID(id, idRelated)
+         *
+         * If idRelated is provided, we check it for a machine prefix, and use any
+         * existing prefix to constrain matches to IDs with the same prefix, in order to
+         * avoid matching components belonging to other machines.
+         */
+        if (idRelated) {
+            if ((i = idRelated.indexOf('.')) > 0)
+                idRelated = idRelated.substr(0, i + 1);
+            else
+                idRelated = "";
+        }
+        for (i = 0; i < Component.components.length; i++) {
+            var component = Component.components[i];
+            if (!idRelated || !component.id.indexOf(idRelated)) {
+                aComponents.push(component);
+            }
+        }
+        return aComponents;
+    }
+
+    /**
+     * Component.getComponentByID(id, idRelated)
+     *
+     * We could store components as properties, using the component's ID, and change
+     * this linear lookup into a property lookup, but some components may have no ID.
+     *
+     * @param {string} id of the desired component
+     * @param {string} [idRelated] of related component
+     * @return {Component|null}
+     */
+    static getComponentByID(id, idRelated)
+    {
+        if (id !== undefined) {
+            var i;
+            /*
+             * If idRelated is provided, we check it for a machine prefix, and use any
+             * existing prefix to constrain matches to IDs with the same prefix, in order to
+             * avoid matching components belonging to other machines.
+             */
+            if (idRelated && (i = idRelated.indexOf('.')) > 0) {
+                id = idRelated.substr(0, i + 1) + id;
+            }
+            for (i = 0; i < Component.components.length; i++) {
+                if (Component.components[i].id === id) {
+                    return Component.components[i];
+                }
+            }
+            if (Component.components.length) {
+                Component.log("Component ID '" + id + "' not found", "warning");
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Component.getComponentByType(sType, idRelated, componentPrev)
+     *
+     * @param {string} sType of the desired component
+     * @param {string} [idRelated] of related component
+     * @param {Component|null} [componentPrev] of previously returned component, if any
+     * @return {Component|null}
+     */
+    static getComponentByType(sType, idRelated, componentPrev)
+    {
+        if (sType !== undefined) {
+            var i;
+            /*
+             * If idRelated is provided, we check it for a machine prefix, and use any
+             * existing prefix to constrain matches to IDs with the same prefix, in order to
+             * avoid matching components belonging to other machines.
+             */
+            if (idRelated) {
+                if ((i = idRelated.indexOf('.')) > 0) {
+                    idRelated = idRelated.substr(0, i + 1);
+                } else {
+                    idRelated = "";
+                }
+            }
+            for (i = 0; i < Component.components.length; i++) {
+                if (componentPrev) {
+                    if (componentPrev == Component.components[i]) componentPrev = null;
+                    continue;
+                }
+                if (sType == Component.components[i].type && (!idRelated || !Component.components[i].id.indexOf(idRelated))) {
+                    return Component.components[i];
+                }
+            }
+            Component.log("Component type '" + sType + "' not found", "warning");
+        }
+        return null;
+    }
+
+    /**
+     * Component.getComponentParms(element)
+     *
+     * @param {Object} element from the DOM
+     */
+    static getComponentParms(element)
+    {
+        var parms = null;
+        var sParms = element.getAttribute("data-value");
+        if (sParms) {
+            try {
+                parms = eval("(" + sParms + ")");   // jshint ignore:line
+                /*
+                 * We can no longer invoke removeAttribute() because some components (eg, Panel) need
+                 * to run their initXXX() code more than once, to avoid initialization-order dependencies.
+                 *
+                 *      if (!DEBUG) {
+                 *          element.removeAttribute("data-value");
+                 *      }
+                 */
+            } catch(e) {
+                Component.error(e.message + " (" + sParms + ")");
+            }
+        }
+        return parms;
+    }
+
+    /**
+     * Component.bindExternalControl(component, sControl, sBinding, sType)
+     *
+     * @param {Component} component
+     * @param {string} sControl
+     * @param {string} sBinding
+     * @param {string} [sType] is the external component type
+     */
+    static bindExternalControl(component, sControl, sBinding, sType)
+    {
+        if (sControl) {
+            if (sType === undefined) sType = "Panel";
+            var target = Component.getComponentByType(sType, component.id);
+            if (target) {
+                var eBinding = target.bindings[sControl];
+                if (eBinding) {
+                    component.setBinding(null, sBinding, eBinding);
+                }
+            }
+        }
+    }
+
+    /**
+     * Component.bindComponentControls(component, element, sAppClass)
+     *
+     * @param {Component} component
+     * @param {Object} element from the DOM
+     * @param {string} sAppClass
+     */
+    static bindComponentControls(component, element, sAppClass)
+    {
+        var aeControls = Component.getElementsByClass(element.parentNode, sAppClass + "-control");
+
+        for (var iControl = 0; iControl < aeControls.length; iControl++) {
+
+            var aeChildNodes = aeControls[iControl].childNodes;
+
+            for (var iNode = 0; iNode < aeChildNodes.length; iNode++) {
+                var control = aeChildNodes[iNode];
+                if (control.nodeType !== 1 /* document.ELEMENT_NODE */) {
+                    continue;
+                }
+                var sClass = control.getAttribute("class");
+                if (!sClass) continue;
+                var aClasses = sClass.split(" ");
+                for (var iClass = 0; iClass < aClasses.length; iClass++) {
+                    var parms;
+                    sClass = aClasses[iClass];
+                    switch (sClass) {
+                        case sAppClass + "-binding":
+                            parms = Component.getComponentParms(control);
+                            if (parms && parms['binding']) {
+                                component.setBinding(parms['type'], parms['binding'], control, parms['value']);
+                            } else if (!parms || parms['type'] != "description") {
+                                Component.log("Component '" + component.toString() + "' missing binding" + (parms? " for " + parms['type'] : ""), "warning");
+                            }
+                            iClass = aClasses.length;
+                            break;
+                        default:
+                            // if (DEBUG) Component.log("Component.bindComponentControls(" + component.toString() + "): unrecognized control class \"" + sClass + "\"", "warning");
+                            break;
+                    }
+                }
+            }
+        }
+    }
+
+    /**
+     * Component.getElementsByClass(element, sClass, sObjClass)
+     *
+     * This is a cross-browser helper function, since not all browser's support getElementsByClassName()
+     *
+     * TODO: This should probably be moved into weblib.js at some point, along with the control binding functions above,
+     * to keep all the browser-related code together.
+     *
+     * @param {Object} element from the DOM
+     * @param {string} sClass
+     * @param {string} [sObjClass]
+     * @return {Array|NodeList}
+     */
+    static getElementsByClass(element, sClass, sObjClass)
+    {
+        if (sObjClass) sClass += '-' + sObjClass + "-object";
+        /*
+         * Use the browser's built-in getElementsByClassName() if it appears to be available
+         * (for example, it's not available in IE8, but it should be available in IE9 and up)
+         */
+        if (element.getElementsByClassName) {
+            return element.getElementsByClassName(sClass);
+        }
+        var i, j, ae = [];
+        var aeAll = element.getElementsByTagName("*");
+        var re = new RegExp('(^| )' + sClass + '( |$)');
+        for (i = 0, j = aeAll.length; i < j; i++) {
+            if (re.test(aeAll[i].className)) {
+                ae.push(aeAll[i]);
+            }
+        }
+        if (!ae.length) {
+            Component.log('No elements of class "' + sClass + '" found');
+        }
+        return ae;
+    }
+
+    /**
+     * Component.getScriptCommands(sScript)
+     *
+     * This is a simple parser that breaks sScript into an array of commands, where each command
+     * is an array of tokens, where tokens are sequences of characters separated by any of: tab, space,
+     * carriage-return (CR), line-feed (LF), semicolon, single-quote, or double-quote;  if a quote is
+     * used, all characters up to the next matching quote become part of the token, allowing any of the
+     * other separators to be part of the token.  CR, LF and semicolon also serve to terminate a command,
+     * with semicolon being preferred, because it's 1) more visible, and 2) essential when the entire
+     * script is a multi-line string where all CR/LF were replaced by spaces (which is what Jekyll does,
+     * and since we can't change Jekyll, it's what our own MarkDown Front Matter parser does as well;
+     * see convertMD() in markout.js, where the aCommandDefs array is built).
+     *
+     * Backslash sequences like \n, \r, and \\ have already been converted to LF, CR and backslash
+     * characters, since the entire script string is injected into a JavaScript function call, so any
+     * backslash sequence that JavaScript supports is automatically converted:
+     *
+     *      \0  \'  \"  \\  \n  \r  \v  \t  \b  \f  \uXXXX \xXX
+     *                      ^J  ^M  ^K  ^I  ^H  ^L
+     *
+     * To support any other non-printable 8-bit character, such as ESC, you should use \xXX, where XX
+     * is the ASCII code in hex.  For ESC, that would \x1B.
+     *
+     * @param {string} sScript
+     * @return {Array}
+     */
+    static getScriptCommands(sScript)
+    {
+        var cch = sScript.length;
+        var aCommands = [], aTokens = [], sToken = "", chQuote = null;
+        for (var i = 0; i < cch; i++) {
+            var ch = sScript[i];
+            if (ch == '"' || ch == "'") {
+                if (chQuote && ch != chQuote) {
+                    sToken += ch;
+                    continue;
+                }
+                if (!chQuote) {
+                    chQuote = ch;
+                } else {
+                    chQuote = null;
+                }
+                if (sToken) {
+                    aTokens.push(sToken);
+                    sToken = "";
+                }
+                continue;
+            }
+            if (!chQuote) {
+                if (ch == '\r' || ch == '\n') {
+                    ch = ';';
+                }
+                if (ch == ' ' || ch == '\t' || ch == ';') {
+                    if (sToken) {
+                        aTokens.push(sToken);
+                        sToken = "";
+                    }
+                    if (ch == ';' && aTokens.length) {
+                        aCommands.push(aTokens);
+                        aTokens = [];
+                    }
+                    continue;
+                }
+            }
+            sToken += ch;
+        }
+        if (sToken) {
+            aTokens.push(sToken);
+        }
+        if (aTokens.length) {
+            aCommands.push(aTokens);
+        }
+        return aCommands;
+    }
+
+    /**
+     * Component.processScript(idMachine, sScript)
+     *
+     * @param {string} idMachine
+     * @param {string} sScript
+     * @return {boolean}
+     */
+    static processScript(idMachine, sScript)
+    {
+        var fSuccess = false;
+        idMachine += ".machine";
+        if (typeof sScript == "string" && !Component.commands[idMachine]) {
+            fSuccess = true;
+            Component.commands[idMachine] = Component.getScriptCommands(sScript);
+            if (!Component.processCommands(idMachine)) {
+                fSuccess = false;
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * Component.processCommands(idMachine)
+     *
+     * @param {string} idMachine
+     * @return {boolean}
+     */
+    static processCommands(idMachine)
+    {
+        var fSuccess = true;
+        var aCommands = Component.commands[idMachine];
+
+     // var dbg = Component.getComponentByType("Debugger", idMachine);
+
+        while (aCommands && aCommands.length) {
+
+            var aTokens = aCommands.splice(0, 1)[0];
+            var sCommand = aTokens[0];
+
+            /*
+             * It's possible to route this output to the Debugger window with dbg.println()
+             * instead, but it's a bit too confusing mingling script output in a window that
+             * already mingles Debugger and machine output.
+             */
+            Component.println('script: ' + aTokens.join(' '));
+
+            var fnCallReady = null;
+            if (Component.asyncCommands.indexOf(sCommand) >= 0) {
+                fnCallReady = function processNextCommand() {
+                    return function() {
+                        Component.processCommands(idMachine);
+                    }
+                }();
+            }
+
+            var fnCommand = Component.globalCommands[sCommand];
+            if (fnCommand) {
+                if (!fnCallReady) {
+                    fSuccess = fnCommand(aTokens[1], aTokens[2], aTokens[3]);
+                } else {
+                    if (!fnCommand(fnCallReady, aTokens[1], aTokens[2], aTokens[3])) break;
+                }
+            }
+            else {
+                fSuccess = false;
+                var component = Component.getComponentByType(aTokens[1], idMachine);
+                if (component) {
+                    fnCommand = Component.componentCommands[sCommand];
+                    if (fnCommand) {
+                        fSuccess = fnCommand(component, aTokens[2], aTokens[3]);
+                    }
+                    else {
+                        var exports = component['exports'];
+                        if (exports) {
+                            fnCommand = exports[sCommand];
+                            if (fnCommand) {
+                                fSuccess = true;
+                                if (!fnCallReady) {
+                                    fSuccess = fnCommand.call(component, aTokens[2], aTokens[3]);
+                                } else {
+                                    if (!fnCommand.call(component, fnCallReady, aTokens[2], aTokens[3])) break;
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+
+            if (!fSuccess) {
+                Component.alertUser("Script error: " + sCommand + (fnCommand? " failed" : " unrecognized"));
+                break;
+            }
+        }
+
+        if (aCommands && !aCommands.length) {
+            delete Component.commands[idMachine];
+        }
+
+        return fSuccess;
+    }
+
+    /**
+     * Component.scriptAlert(sMessage)
+     *
+     * @param {string} sMessage
+     * @return {boolean}
+     */
+    static scriptAlert(sMessage)
+    {
+        Component.alertUser(sMessage);
+        return true;
+    }
+
+    /**
+     * Component.scriptSelect(component, sBinding, sValue)
+     *
+     * @param {Component} component
+     * @param {string} sBinding
+     * @param {string} sValue
+     * @return {boolean}
+     */
+    static scriptSelect(component, sBinding, sValue)
+    {
+        var fSuccess = false;
+        var aBindings = component['bindings'];
+        var control = aBindings[sBinding];
+        if (control) {
+            for (var i = 0; i < control.options.length; i++) {
+                if (control.options[i].textContent == sValue) {
+                    if (control.selectedIndex != i) {
+                        control.selectedIndex = i;
+                    }
+                    fSuccess = true;
+                    break;
+                }
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * Component.scriptSleep(fnCallback, sDelay)
+     *
+     * @param {function()} fnCallback
+     * @param {string} sDelay (in milliseconds)
+     * @return {boolean}
+     */
+    static scriptSleep(fnCallback, sDelay)
+    {
+        setTimeout(fnCallback, +sDelay);
+        return false;
+    }
+
+    /**
+     * toString()
+     *
+     * @this {Component}
+     * @return {string}
+     */
+    toString() {
+        return (this.name? this.name : (this.id || this.type));
+    }
+
+    /**
+     * getMachineNum()
+     *
+     * @this {Component}
+     * @return {number} unique machine number
+     */
+    getMachineNum() {
+        var nMachine = 1;
+        if (this.idMachine) {
+            var aDigits = this.idMachine.match(/\d+/);
+            if (aDigits !== null)
+                nMachine = parseInt(aDigits[0], 10);
+        }
+        return nMachine;
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * Component's setBinding() method is intended to be overridden by subclasses.
+     *
+     * @this {Component}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "reset")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue) {
+        switch (sBinding) {
+        case "clear":
+            if (!this.bindings[sBinding]) {
+                this.bindings[sBinding] = control;
+                control.onclick = (function(component) {
+                    return function clearPanel() {
+                        if (component.bindings['print']) {
+                            component.bindings['print'].value = "";
+                        }
+                    };
+                }(this));
+            }
+            return true;
+        case "print":
+            if (!this.bindings[sBinding]) {
+                this.bindings[sBinding] = control;
+                /*
+                 * HACK: Save this particular HTML element so that the Debugger can access it, too
+                 */
+                this.controlPrint = control;
+                /*
+                 * This was added for Firefox (Safari automatically clears the <textarea> on a page reload,
+                 * but Firefox does not).
+                 */
+                control.value = "";
+                this.println = (function(control) {
+                    return function printPanel(s, type) {
+                        s = (type !== undefined? (type + ": ") : "") + (s || "");
+                        /*
+                         * Prevent the <textarea> from getting too large; otherwise, printing becomes slower and slower.
+                         */
+                        if (COMPILED) {
+                            if (control.value.length > 8192) {
+                                control.value = control.value.substr(control.value.length - 4096);
+                            }
+                        }
+                        control.value += s + "\n";
+                        control.scrollTop = control.scrollHeight;
+                        if (!COMPILED && window && window.console) console.log(s);
+                    };
+                }(control));
+                /**
+                 * Override this.notice() with a replacement function that eliminates the Component.alertUser() call
+                 *
+                 * @this {Component}
+                 * @param {string} s
+                 * @param {boolean} [fPrintOnly]
+                 * @param {string} [id]
+                 */
+                this.notice = function noticePanel(s, fPrintOnly, id) {
+                    this.println(s, this.idComponent);
+                };
+            }
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    /**
+     * log(s, type)
+     *
+     * For diagnostic output only.
+     *
+     * WARNING: Even though this function's body is completely wrapped in DEBUG, that won't prevent the Closure Compiler
+     * from including it, so all calls must still be prefixed with "if (DEBUG) ....".  For this reason, the class method,
+     * Component.log(), is preferred, because the compiler IS smart enough to remove those calls.
+     *
+     * @this {Component}
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     */
+    log(s, type) {
+        if (!COMPILED) {
+            Component.log(s, type || this.id || this.type);
+        }
+    }
+
+    /**
+     * assert(f, s)
+     *
+     * Verifies conditions that must be true (for DEBUG builds only).
+     *
+     * WARNING: Make sure you preface all calls to this.assert() with "if (DEBUG)", because unlike Component.assert(),
+     * the Closure Compiler can't be sure that this instance method hasn't been overridden, so it refuses to treat it as
+     * dead code in non-DEBUG builds.
+     *
+     * TODO: Add a task to the build process that "asserts" there are no instances of "assertion failure" in RELEASE builds.
+     *
+     * @this {Component}
+     * @param {boolean|number} f is the expression asserted to be true
+     * @param {string} [s] is a description of the assertion to be displayed or logged on failure
+     */
+    assert(f, s) {
+        if (DEBUG) {
+            if (!f) {
+                s = "assertion failure in " + (this.id || this.type) + (s? ": " + s : "");
+                if (DEBUGGER && this.dbg) {
+                    this.dbg.stopCPU();
+                    /*
+                     * Why do we throw an Error only to immediately catch and ignore it?  Simply to give
+                     * any IDE the opportunity to inspect the application's state.  Even when the IDE has
+                     * control, you should still be able to invoke Debugger commands from the IDE's REPL,
+                     * using the '$' global function that the Debugger constructor defines; eg:
+                     *
+                     *      $('r')
+                     *      $('dw 0:0')
+                     *      $('h')
+                     *      ...
+                     *
+                     * If you have no desire to stop on assertions, consider this a no-op.  However, another
+                     * potential benefit of creating an Error object is that, for browsers like Chrome, we get
+                     * a stack trace, too.
+                     */
+                    try {
+                        throw new Error(s);
+                    } catch(e) {
+                        this.println(e.stack || e.message);
+                    }
+                    return;
+                }
+                this.log(s);
+                throw new Error(s);
+            }
+        }
+    }
+
+    /**
+     * println(s, type)
+     *
+     * For non-diagnostic messages, which components may override to control the destination/appearance of their output.
+     *
+     * Components using this.println() should wait until after their constructor has run to display any messages, because
+     * if a Control Panel has been loaded, its override will not take effect until its own constructor has run.
+     *
+     * @this {Component}
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     * @param {string} [id] is the caller's ID, if any
+     */
+    println(s, type, id) {
+        Component.println(s, type, id || this.id);
+    }
+
+    /**
+     * status(s)
+     *
+     * status() is like println() but it also includes information about the component (ie, the component ID),
+     * which is why there is no corresponding Component.status() function.
+     *
+     * @param {string} s is the message text
+     */
+    status(s) {
+        this.println(this.idComponent + ": " + s);
+    }
+
+    /**
+     * notice(s, fPrintOnly)
+     *
+     * notice() is like println() but implies a need for user notification, so we alert() as well; however, if this.println()
+     * is overridden, this.notice will be replaced with a similar override, on the assumption that the override is taking care
+     * of alerting the user.
+     *
+     * @this {Component}
+     * @param {string} s is the message text
+     * @param {boolean} [fPrintOnly]
+     * @param {string} [id] is the caller's ID, if any
+     */
+    notice(s, fPrintOnly, id) {
+        Component.notice(s, fPrintOnly, id || this.type);
+    }
+
+    /**
+     * setError(s)
+     *
+     * Set a fatal error condition
+     *
+     * @this {Component}
+     * @param {string} s describes a fatal error condition
+     */
+    setError(s) {
+        this.flags.error = true;
+        this.notice(s);         // TODO: Any cases where we should still prefix this string with "Fatal error: "?
+    }
+
+    /**
+     * clearError()
+     *
+     * Clear any fatal error condition
+     *
+     * @this {Component}
+     */
+    clearError() {
+        this.flags.error = false;
+    }
+
+    /**
+     * isError()
+     *
+     * Report any fatal error condition
+     *
+     * @this {Component}
+     * @return {boolean} true if a fatal error condition exists, false if not
+     */
+    isError() {
+        if (this.flags.error) {
+            this.println(this.toString() + " error");
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * isReady(fnReady)
+     *
+     * Return the "ready" state of the component; if the component is not ready, it will queue the optional
+     * notification function, otherwise it will immediately call the notification function, if any, without queuing it.
+     *
+     * NOTE: Since only the Computer component actually cares about the "readiness" of other components, the so-called
+     * "queue" of notification functions supports exactly one function.  This keeps things nice and simple.
+     *
+     * @this {Component}
+     * @param {function()} [fnReady]
+     * @return {boolean} true if the component is in a "ready" state, false if not
+     */
+    isReady(fnReady) {
+        if (fnReady) {
+            if (this.flags.ready) {
+                fnReady();
+            } else {
+                if (MAXDEBUG) this.log("NOT ready");
+                this.fnReady = fnReady;
+            }
+        }
+        return this.flags.ready;
+    }
+
+    /**
+     * setReady(fReady)
+     *
+     * Set the "ready" state of the component to true, and call any queued notification functions.
+     *
+     * @this {Component}
+     * @param {boolean} [fReady] is assumed to indicate "ready" unless EXPLICITLY set to false
+     */
+    setReady(fReady) {
+        if (!this.flags.error) {
+            this.flags.ready = (fReady !== false);
+            if (this.flags.ready) {
+                if (MAXDEBUG /* || this.name */) this.log("ready");
+                var fnReady = this.fnReady;
+                this.fnReady = null;
+                if (fnReady) fnReady();
+            }
+        }
+    }
+
+    /**
+     * isBusy(fCancel)
+     *
+     * Return the "busy" state of the component
+     *
+     * @this {Component}
+     * @param {boolean} [fCancel] is set to true to cancel a "busy" state
+     * @return {boolean} true if "busy", false if not
+     */
+    isBusy(fCancel) {
+        if (this.flags.busy) {
+            if (fCancel) {
+                this.flags.busyCancel = true;
+            } else if (fCancel === undefined) {
+                this.println(this.toString() + " busy");
+            }
+        }
+        return this.flags.busy;
+    }
+
+    /**
+     * setBusy(fBusy)
+     *
+     * Update the current busy state; if a busyCancel request is pending, it will be honored now.
+     *
+     * @this {Component}
+     * @param {boolean} fBusy
+     * @return {boolean}
+     */
+    setBusy(fBusy) {
+        if (this.flags.busyCancel) {
+            this.flags.busy = false;
+            this.flags.busyCancel = false;
+            return false;
+        }
+        if (this.flags.error) {
+            this.println(this.toString() + " error");
+            return false;
+        }
+        this.flags.busy = fBusy;
+        return this.flags.busy;
+    }
+
+    /**
+     * powerUp(fSave)
+     *
+     * @this {Component}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower] is true if this is "repower" notification
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower) {
+        this.flags.powered = true;
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {Component}
+     * @param {boolean} fSave
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown) {
+        if (fShutdown) this.flags.powered = false;
+        return true;
+    }
+
+    /**
+     * messageEnabled(bitsMessage)
+     *
+     * If bitsMessage is not specified, the component's MESSAGE category is used.
+     *
+     * @this {Component}
+     * @param {number} [bitsMessage] is zero or more MESSAGE_* category flag(s)
+     * @return {boolean} true if all specified message enabled, false if not
+     */
+    messageEnabled(bitsMessage) {
+        if (DEBUGGER && this.dbg) {
+            if (this === this.dbg) {
+                bitsMessage |= 0;
+            } else {
+                bitsMessage = bitsMessage || this.bitsMessage;
+            }
+            var bitsEnabled = this.dbg.bitsMessage & bitsMessage;
+            return (!!bitsMessage && bitsEnabled === bitsMessage || !!(bitsEnabled & this.dbg.bitsWarning));
+        }
+        return false;
+    }
+
+    /**
+     * printMessage(sMessage, bitsMessage, fAddress)
+     *
+     * If bitsMessage is not specified, the component's MESSAGE category is used.
+     * If bitsMessage is true, the message is displayed regardless.
+     *
+     * @this {Component}
+     * @param {string} sMessage is any caller-defined message string
+     * @param {number|boolean} [bitsMessage] is zero or more MESSAGE_* category flag(s)
+     * @param {boolean} [fAddress] is true to display the current address
+     */
+    printMessage(sMessage, bitsMessage, fAddress) {
+        if (DEBUGGER && this.dbg) {
+            if (bitsMessage === true || this.messageEnabled(bitsMessage | 0)) {
+                this.dbg.message(sMessage, fAddress);
+            }
+        }
+    }
+
+    /**
+     * printMessageIO(port, bOut, addrFrom, name, bIn, bitsMessage)
+     *
+     * If bitsMessage is not specified, the component's MESSAGE category is used.
+     * If bitsMessage is true, the message is displayed as long as MESSAGE.PORT is enabled.
+     *
+     * @this {Component}
+     * @param {number} port
+     * @param {number|null} bOut if an output operation
+     * @param {number|null} [addrFrom]
+     * @param {string|null} [name] of the port, if any
+     * @param {number|null} [bIn] is the input value, if known, on an input operation
+     * @param {number|boolean} [bitsMessage] is zero or more MESSAGE_* category flag(s)
+     */
+    printMessageIO(port, bOut, addrFrom, name, bIn, bitsMessage) {
+        if (DEBUGGER && this.dbg) {
+            if (bitsMessage === true) {
+                bitsMessage = 0;
+            } else if (bitsMessage == null) {
+                bitsMessage = this.bitsMessage;
+            }
+            this.dbg.messageIO(this, port, bOut, addrFrom, name, bIn, bitsMessage);
+        }
+    }
+}
+
+/*
+ * Every component created on the current page is recorded in this array (see Component.add()),
+ * enabling any component to locate another component by ID (see Component.getComponentByID())
+ * or by type (see Component.getComponentByType()).
+ *
+ * Every machine on the page are now recorded as well, by their machine ID.  We then record the
+ * various resources used by that machine.
+ *
+ * Includes a fallback for non-browser-based environments (ie, Node).  TODO: This will need to be
+ * tailored to Node, probably using the global object instead of the window object, if we ever want
+ * to support multi-machine configs in that environment.
+ */
+if (window) {
+    if (!window['PCjs']) window['PCjs'] = {};
+    if (!window['PCjs']['Machines']) window['PCjs']['Machines'] = {};
+    if (!window['PCjs']['Components']) window['PCjs']['Components'] = [];
+    if (!window['PCjs']['Commands']) window['PCjs']['Commands'] = {};
+}
+Component.machines = window? window['PCjs']['Machines'] : {};
+Component.components = window? window['PCjs']['Components'] : [];
+Component.commands = window? window['PCjs']['Commands'] : {};
+
+Component.asyncCommands = [
+    'hold', 'sleep', 'wait'
+];
+Component.globalCommands = {
+    'alert': Component.scriptAlert,
+    'sleep': Component.scriptSleep
+};
+Component.componentCommands = {
+    'select':   Component.scriptSelect
+};
+
+/*
+ * The following polyfills provide ES5 functionality that's missing in older browsers (eg, IE8),
+ * allowing PCjs apps to run without slamming into exceptions; however, due to the lack of HTML5 canvas
+ * support in those browsers, all you're likely to see are "soft" errors (eg, "Missing <canvas> support").
+ *
+ * Perhaps we can implement a text-only faux video display for a fun retro-browser experience someday.
+ *
+ * TODO: Come up with a better place to put these polyfills.  We will likely have more if we decide to
+ * make the leap from ES5 to ES6 features.
+ */
+
+/*
+ * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/indexOf
+ */
+if (!Array.prototype.indexOf) {
+    Array.prototype.indexOf = function(obj, start) {
+        for (var i = (start || 0), j = this.length; i < j; i++) {
+            if (this[i] === obj) { return i; }
+        }
+        return -1;
+    }
+}
+
+/*
+ * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/isArray
+ */
+if (!Array.isArray) {
+    Array.isArray = function(arg) {
+        return Object.prototype.toString.call(arg) === '[object Array]';
+    };
+}
+
+/*
+ * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/bind
+ */
+if (!Function.prototype.bind) {
+    Function.prototype.bind = function(obj) {
+        if (typeof this != "function") {
+            // Closest thing possible to the ECMAScript 5 internal IsCallable function
+            throw new TypeError("Function.prototype.bind: non-callable object");
+        }
+        var args = Array.prototype.slice.call(arguments, 1);
+        var fToBind = this;
+        var fnNOP = /** @constructor */ (function() {});
+        var fnBound = function() {
+            return fToBind.apply(this instanceof fnNOP && obj? this : obj, args.concat(Array.prototype.slice.call(arguments)));
+        };
+        fnNOP.prototype = this.prototype;
+        fnBound.prototype = new fnNOP();
+        return fnBound;
+    };
+}
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp10/lib/defines.js (C) Jeff Parsons 2012-2017
+ */
+
+/**
+ * @define {string}
+ */
+var APPCLASS = "pdp10";         // this @define is the default application class (eg, "pcx86", "c1pjs")
+
+/**
+ * APPNAME is used more for display purposes than anything else now.  APPCLASS is what matters in terms
+ * of folder and file names, CSS styles, etc.
+ *
+ * @define {string}
+ */
+var APPNAME = "PDPjs";          // this @define is the default application name (eg, "PCx86", "C1Pjs")
+
+/**
+ * WARNING: DEBUGGER needs to accurately reflect whether or not the Debugger component is (or will be) loaded.
+ * In the compiled case, we rely on the Closure Compiler to override DEBUGGER as appropriate.  When it's *false*,
+ * nearly all of debugger.js will be conditionally removed by the compiler, reducing it to little more than a
+ * "type skeleton", which also solves some type-related warnings we would otherwise have if we tried to remove
+ * debugger.js from the compilation process altogether.
+ *
+ * However, when we're in "development mode" and running uncompiled code in debugger-less configurations,
+ * I would like to skip loading debugger.js altogether.  When doing that, we must ALSO arrange for an additional file
+ * (nodebugger.js) to be loaded immediately after this file, which *explicitly* overrides DEBUGGER with *false*.
+ *
+ * @define {boolean}
+ */
+var DEBUGGER = true;            // this @define is overridden by the Closure Compiler to remove Debugger-related support
+
+/*
+ * Set this to true to enable behavior compatible with SIMH.
+ */
+var SIMH = false;
+
+/*
+ * Combine all the shared globals and machine-specific globals into one machine-specific global object,
+ * which all machine components should start using; eg: "if (PDP10.DEBUG) ..." instead of "if (DEBUG) ...".
+ */
+var PDP10 = {
+    APPCLASS:   APPCLASS,
+    APPNAME:    APPNAME,
+    APPVERSION: APPVERSION,     // shared
+    COMPILED:   COMPILED,       // shared
+    CSSCLASS:   CSSCLASS,       // shared
+    DEBUG:      DEBUG,          // shared
+    DEBUGGER:   DEBUGGER,
+    MAXDEBUG:   MAXDEBUG,       // shared
+    PRIVATE:    PRIVATE,        // shared
+    SITEHOST:   SITEHOST,       // shared
+    XMLVERSION: XMLVERSION,     // shared
+
+    /*
+     * CPU model numbers (supported)
+     */
+    MODEL_KA10: 1001,
+
+    /*
+     * ADDR_INVALID is used to mark points in the code where the physical address being returned
+     * is invalid and should not be used.
+     *
+     * In a 32-bit CPU, -1 (ie, 0xffffffff) could actually be a valid address, so consider changing
+     * ADDR_INVALID to NaN or null (which is also why all ADDR_INVALID tests should use strict equality
+     * operators).
+     *
+     * The main reason I'm NOT using NaN or null now is my concern that, by mixing non-numbers
+     * (specifically, values outside the range of signed 32-bit integers), performance may suffer.
+     *
+     * WARNING: Like many of the properties defined here, ADDR_INVALID is a common constant, which the
+     * Closure Compiler will happily inline (with or without @const annotations; in fact, I've yet to
+     * see a @const annotation EVER improve automatic inlining).  However, if you don't make ABSOLUTELY
+     * certain that this file is included BEFORE the first reference to any of these properties, that
+     * automatic inlining will no longer occur.
+     */
+    ADDR_INVALID:   -1,
+    ADDR_MASK:      Math.pow(2, 18) - 1,
+    ADDR_LIMIT:     Math.pow(2, 18),
+
+    /*
+     * 18-bit and 36-bit largest positive (and smallest negative) values; however, since we store all
+     * values as unsigned quantities, these are the unsigned equivalents.
+     */
+    WORD_INVALID:   -1,
+    HINT_MASK:      Math.pow(2, 17) - 1,        //         131,071          (377777)  signed half-word (half-int) mask
+    HINT_LIMIT:     Math.pow(2, 17),            //         131,072          (400000)  signed half-word (half-int) limit
+    HALF_MASK:      Math.pow(2, 18) - 1,        //         262,143   (000000 777777): unsigned half-word mask
+    HALF_SHIFT:     Math.pow(2, 18),            //         262,144   (000001 000000): unsigned half-word shift
+    INT_MASK:       Math.pow(2, 35) - 1,        //  34,359,738,367   (377777 777777): signed word (magnitude) mask
+    INT_LIMIT:      Math.pow(2, 35),            //  34,359,738,368   (400000 000000): signed word (magnitude) limit
+    WORD_MASK:      Math.pow(2, 36) - 1,        //  68,719,476,735   (777777 777777): unsigned word mask
+    WORD_LIMIT:     Math.pow(2, 36),            //  68,719,476,736 (1 000000 000000): unsigned word limit
+
+    TWO_POW32:      Math.pow(2, 32),
+    TWO_POW34:      Math.pow(2, 34),
+    TWO_POW36:      Math.pow(2, 36),            // the two's complement of a 36-bit value is (value? TWO_POW36 - value : 0)
+
+    /*
+     * PDP-10 opcodes are 36-bit values, most of which use the following layout:
+     *
+     *                          1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3 3 3 3 3
+     *      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+     *      O O O O O O O M M A A A A I X X X X Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y
+     *
+     * or using modern bit-numbering:
+     *
+     *      3 3 3 3 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
+     *      5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
+     *      O O O O O O O M M A A A A I X X X X Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y
+     *
+     * where OOOOOOOMM represents the operation, and MM (if used) represents the mode:
+     *
+     *      Mode        Suffix      Source  Destination
+     *      ----        ------      -----   -----------
+     *  0:  Basic       None        E       AC
+     *  1:  Immediate   I           0,E     AC
+     *  2:  Memory      M           AC      E
+     *  3:  Self/Both   S or B      E       E (and AC if A is non-zero)
+     *
+     * Input-output instructions look like:
+     *
+     *      3 3 3 3 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
+     *      5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
+     *      1 1 1 D D D D D D D O O O I X X X X Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y
+     *
+     * Bits 0-22 (I,X,Y) contain what we call a "reference address" (R), which is used to calculate the
+     * "effective address" (E).  To determine E from R, we must extract I, X, and Y from R, set E to Y,
+     * then add [X] to E if X is non-zero.  If I is zero, then we're done; otherwise, we must set R to [E]
+     * and repeat the process.
+     */
+    OPCODE: {
+        OPMASK:     0o77700,            // operation mask
+        OPMODE:     0o77400,            // operation with mode
+        OPCOMP:     0o77000,            // operation with compare
+        OPTEST:     0o71100,            // operation with test
+        OPIO:       0o70034,            // input-output operation
+        OPUUO:      0o70000,            // unimplemented user operation (UUO) mask
+        OP_SCALE:   Math.pow(2, 21),    // operation scale
+        IO_SCALE:   Math.pow(2, 26),    // input-output device code scale
+        IO_MASK:    0o177,              // input-output device code mask (after descale)
+        A_SCALE:    Math.pow(2, 23),    // used to shift down the high 13 bits, with A starting at bit 0
+        P_SCALE:    Math.pow(2, 30),    // P scale
+        P_MASK:     0o77,               // P mask (after descale)
+        S_SHIFT:    24,                 // S shift
+        S_MASK:     0o77,               // S mask (after shift)
+        A_SHIFT:    23,                 // A shift
+        A_MASK:     0o17,               // A mask (after shift)
+        A_FIELD:    0o740000000,        // A field mask
+        I_FIELD:    0o20000000,         // indirect bit mask
+        X_SHIFT:    18,                 // X shift
+        X_MASK:     0o17,               // X mask (after shift)
+        X_FIELD:    0o17000000,         // X field mask
+        Y_SHIFT:    0,                  // Y shift
+        Y_MASK:     0o777777,           // Y mask (after shift)
+        Y_FIELD:    0o777777,           // Y field mask
+        R_MASK:     0o37777777,         // used to isolate the low 23 bits (I,X,Y)
+        PTR_MASK:   0o77777777,         // used to isolate the low 24 bits (?,I,X,Y) of a byte pointer
+        HALT:       0o5304              // operation code for HALT
+    },
+
+    /*
+     * Internal operation state flags
+     */
+    OPFLAG: {
+        IRQ_DELAY:  0x0001,             // incremented until it becomes IRQ
+        IRQ:        0x0002,             // time to call checkInterrupts()
+        IRQ_MASK:   0x0003,
+        DEBUGGER:   0x0004,             // set if the Debugger wants to perform checks
+        WAIT:       0x0008,             // WAIT operation in progress
+        PRESERVE:   0x000F              // OPFLAG bits to preserve prior to the next instruction
+    },
+
+    /*
+     * Flags returned by getPS() for various program control operations.
+     *
+     * NOTE: I see SIMH setting PS bits like 0o000200 and 0o000400, which are not documented for the KA10.
+     * The SIMH docs only refer to the KS10 ("KS10 CPU with 1MW of memory"), so I'm guessing it doesn't have
+     * a KA10 emulation option.  The `pdp10` SIMH binary does have some SET CPU options, but unlike the `pdp11`
+     * binary, the only options you can set relate to the operating system to be run -- which seems very hacky.
+     */
+    PSFLAG: {
+        AROV:       0o400000,           // Arithmetic Overflow
+        CRY0:       0o200000,           // Carry 0
+        CRY1:       0o100000,           // Carry 1
+        FOV:        0o040000,           // Floating-Point Overflow
+        BIS:        0o020000,           // Byte Interrupt
+        USERF:      0o010000,           // User Mode Flag
+        EXIOT:      0o004000,           // User Privileged I/O Flag
+        FXU:        0o000100,           // Floating-Point Underflow
+        DCK:        0o000040,           // Divide Check (aka No Divide)
+        /*
+         * Only the low 18 bits (above) are returned by getPS(); the following (bits 18 to 31)
+         * are defined for internal use only.
+         */
+        PDOV:      0o1000000,           // Pushdown Overflow
+        SET_MASK:  0o0760140            // flags that are always settable/clearable
+    },
+
+    /*
+     * Readable CPU (or APR for "Arithmetic Processor") flags provided by the "CONI APR," instruction; see opCONI().
+     */
+    RFLAG: {
+        PIA:        0o000007,           // Priority Interrupt Assignment
+        AROV:       0o000010,           // Arithmetic Overflow
+        AROV_IE:    0o000020,           // Arithmetic Overflow Interrupt Enabled
+        TRAP_OFF:   0o000040,           // Trap Offset
+        FOV:        0o000100,           // Floating-Point Overflow
+        FOV_IE:     0o000200,           // Floating-Point Overflow Interrupt Enabled
+        CLK:        0o001000,           // Clock Flag
+        CLK_IE:     0o002000,           // Clock Interrupt Enabled
+        NXM:        0o010000,           // Non-Existent Memory
+        PRM:        0o020000,           // Memory Protection
+        ADB:        0o040000,           // Address Break
+        UIO:        0o100000,           // User In-Out
+        PDOV:       0o200000            // Pushdown Overflow (TODO: Verify this is correct; the May 1968 doc may have a typo)
+    },
+
+    /*
+     * Writable CPU (or APR for "Arithmetic Processor") flags provided by the "CONO APR," instruction; see opCONO().
+     *
+     * A set bit performs the function shown below, a clear bit does nothing.
+     */
+    WFLAG: {
+        PIA:        0o000007,           // Priority Interrupt Assignment
+        AROV_CL:    0o000010,           // Clear Overflow
+        AROV_IE:    0o000020,           // Enable Overflow Interrupt
+        AROV_ID:    0o000040,           // Disable Overflow Interrupt
+        FOV_CL:     0o000100,           // Clear Floating-Point Overflow
+        FOV_IE:     0o000200,           // Enable Floating-Point Overflow Interrupt
+        FOV_ID:     0o000400,           // Disable Floating-Point Overflow Interrupt
+        CLK_CL:     0o001000,           // Clear Clock Flag
+        CLK_IE:     0o002000,           // Enable Clock Interrupt
+        CLK_ID:     0o004000,           // Disable Clock Interrupt
+        NXM_CL:     0o010000,           // Clear Non-Existent Memory
+        PRM_CL:     0o020000,           // Clear Memory Protection
+        ADB_CL:     0o040000,           // Clear Address Break
+        UIO_CL:     0o200000,           // Clear All In-Out Devices
+        PDOV_CL:    0o400000            // Clear Pushdown Overflow
+    },
+
+    /*
+     * 7-bit device codes used by Input-Output instructions; see opIO().
+     */
+    DEVICES: {
+        APR:        0o000,              // Arithmetic Processor
+        PI:         0o001               // Priority Interrupt
+    }
+};
+
+/*
+ * Combine all the shared globals and machine-specific globals into one machine-specific global object,
+ * which all machine components should start using; eg: "if (PDP10.DEBUGGER)" instead of "if (DEBUGGER)".
+ */
+PDP10.APPCLASS          = APPCLASS;
+PDP10.APPNAME           = APPNAME;
+PDP10.DEBUGGER          = DEBUGGER;
+PDP10.SIMH              = SIMH;
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp10/lib/messages.js (C) Jeff Parsons 2012-2017
+ */
+
+var MessagesPDP10 = {
+    CPU:        0x00000001,
+    TRAP:       0x00000002,
+    FAULT:      0x00000004,
+    INT:        0x00000008,
+    BUS:        0x00000010,
+    MEMORY:     0x00000020,
+    MMU:        0x00000040,
+    ROM:        0x00000080,
+    DEVICE:     0x00000100,
+    PANEL:      0x00000200,
+    KEYBOARD:   0x00000400,
+    KEYS:       0x00000800,
+    PAPER:      0x00001000,
+    READ:       0x00004000,
+    WRITE:      0x00008000,
+    SERIAL:     0x00100000,
+    TIMER:      0x00200000,
+    SPEAKER:    0x01000000,
+    COMPUTER:   0x02000000,
+    LOG:        0x10000000,
+    WARN:       0x20000000,
+    BUFFER:     0x40000000,
+    HALT:       0x80000000|0
+};
+
+/*
+ * Message categories supported by the messageEnabled() function and other assorted message
+ * functions. Each category has a corresponding bit value that can be combined (ie, OR'ed) as
+ * needed.  The Debugger's message command ("m") is used to turn message categories on and off,
+ * like so:
+ *
+ *      m port on
+ *      m port off
+ *      ...
+ *
+ * NOTE: The order of these categories can be rearranged, alphabetized, etc, as desired; just be
+ * aware that changing the bit values could break saved Debugger states (not a huge concern, just
+ * something to be aware of).
+ */
+MessagesPDP10.CATEGORIES = {
+    "cpu":      MessagesPDP10.CPU,
+    "trap":     MessagesPDP10.TRAP,
+    "fault":    MessagesPDP10.FAULT,
+    "int":      MessagesPDP10.INT,
+    "bus":      MessagesPDP10.BUS,
+    "memory":   MessagesPDP10.MEMORY,
+    "mmu":      MessagesPDP10.MMU,
+    "rom":      MessagesPDP10.ROM,
+    "device":   MessagesPDP10.DEVICE,
+    "panel":    MessagesPDP10.PANEL,
+    "keyboard": MessagesPDP10.KEYBOARD, // "kbd" is also allowed as shorthand for "keyboard"; see doMessages()
+    "key":      MessagesPDP10.KEYS,     // using "key" instead of "keys", since the latter is a method on JavasScript objects
+    "paper":    MessagesPDP10.PAPER,
+    "read":     MessagesPDP10.READ,
+    "write":    MessagesPDP10.WRITE,
+    "serial":   MessagesPDP10.SERIAL,
+    "timer":    MessagesPDP10.TIMER,
+    "speaker":  MessagesPDP10.SPEAKER,
+    "computer": MessagesPDP10.COMPUTER,
+    "log":      MessagesPDP10.LOG,
+    "warn":     MessagesPDP10.WARN,
+    /*
+     * Now we turn to message actions rather than message types; for example, setting "halt"
+     * on or off doesn't enable "halt" messages, but rather halts the CPU on any message above.
+     *
+     * Similarly, "m buffer on" turns on message buffering, deferring the display of all messages
+     * until "m buffer off" is issued.
+     */
+    "buffer":   MessagesPDP10.BUFFER,
+    "halt":     MessagesPDP10.HALT
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp10/lib/panel.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * Since the Closure Compiler treats ES6 classes as @struct rather than @dict by default,
+ * it deters us from defining named properties on our components; eg:
+ *
+ *      this['exports'] = {...}
+ *
+ * results in an error:
+ *
+ *      Cannot do '[]' access on a struct
+ *
+ * So, in order to define 'exports', we must override the @struct assumption by annotating
+ * the class as @unrestricted (or @dict).  Note that this must be done both here and in the
+ * Component class, because otherwise the Compiler won't allow us to *reference* the named
+ * property either.
+ *
+ * TODO: Consider marking ALL our classes unrestricted, because otherwise it forces us to
+ * define every single property the class uses in its constructor, which results in a fair
+ * bit of redundant initialization, since many properties aren't (and don't need to be) fully
+ * initialized until the appropriate init(), reset(), restore(), etc. function is called.
+ *
+ * The upside, however, may be that since the structure of the class is completely defined by
+ * the constructor, JavaScript engines may be able to optimize and run more efficiently.
+ *
+ * @unrestricted
+ */
+class PanelPDP10 extends Component {
+    /**
+     * PanelPDP10(parmsPanel)
+     *
+     * The PanelPDP10 component has no required (parmsPanel) properties.
+     *
+     * @param {Object} parmsPanel
+     * @param {boolean} fBindings (true if panel may have bindings, otherwise not)
+     */
+    constructor(parmsPanel, fBindings)
+    {
+        super("Panel", parmsPanel, MessagesPDP10.PANEL);
+
+        /*
+         * If there are any live registers, LEDs, etc, to display, this will provide a count.
+         * TODO: Add some UI for fDisplayLiveRegs (either an XML property, or a UI checkbox, or both).
+         */
+        this.cLiveRegs = 0;
+        this.nDisplayCount = 0;
+        this.nDisplayLimit = 60;
+        this.fDisplayLiveRegs = true;
+        this.fBindings = fBindings;
+
+        /*
+         * regSwitches contains the Front Panel (aka Console) SWITCH register, which is also available
+         * as a read-only register at 177570 (but only the low 16 bits).  regDisplay contains the DISPLAY
+         * register, a write-only register at the same address.
+         *
+         * regAddr is an internal register containing the contents of the Front Panel's ADDRESS display,
+         * and regData corresponds to the DATA display.  They are updated by updateAddr() and updateData(),
+         * which in turn take care of calling updateLEDArray().
+         *
+         * The state of ALL switches is maintained in this.switches, and likewise all LED states are
+         * maintained in this.leds, but for convenience, we also mirror some of those states in dedicated
+         * variables (eg, regSwitches for the SWITCH register, fLEDTest for the 'TEST' switch, etc).
+         */
+        this.regDisplay = 0;
+        this.regSwitches = 0;
+        this.regAddr = this.regData = 0;
+        this.ledAddr = this.ledData = -1;
+
+        /*
+         * The panel hardware has the following additional (supported) state; note that there are several
+         * settings on a real Front Panel that we don't support (eg, stepping one cycle vs. one instruction).
+         *
+         * While my initial intent is to eventually support all the ADDRSEL switch settings, I probably
+         * won't bother with any DATASEL switch settings; instead, I will automatically display the DISPLAY
+         * register (regDisplay) [the equivalent of selecting 'DISPLAY REGISTER'] except when data is being
+         * examined or deposited [the equivalent of selecting 'DATA PATHS'].
+         */
+        this.fLEDTest = false;              // LED (lamp) test in progress
+        this.fExamine = false;              // true if the previously pressed switch was the 'EXAM' switch
+        this.fDeposit = false;              // true if the previously pressed switch was the 'DEP' switch
+        this.nAddrSel = PanelPDP10.ADDRSEL.CONS_PHY;
+
+        /*
+         * Every LED has a simple numeric value, assigned when setBinding() is called:
+         *
+         *      zero if "off", non-zero if "on"
+         *
+         * initBus() will call displayLEDs() to ensure that every LED is set to its initial value.
+         */
+        this.leds = {};
+
+        /*
+         * Every switch has an array associated with it:
+         *
+         *      [0]: initial value of switch (0 if "down", 1 if "up")
+         *      [1]: current value of switch
+         *      [2]: true if the switch is momentary, false if not
+         *      [3]: true if the switch is currently pressed, false if released
+         *      [4]: optional handler to call whenever the switch is pressed or released
+         *      [5]: optional switch index (used with CNSW switches 'S0' through 'S21')
+         *
+         * initBus() will call displaySwitches() to ensure that every switch is the position represented below.
+         *
+         * NOTE: Not all switches have the same "process" criteria.  For example, 'TEST' will perform a LED test
+         * when it is momentarily pressed "up", whereas 'LOAD [ADRS]' will load the ADDRESS register from the
+         * SWITCH register when it is momentarily pressed "down".
+         *
+         * This means that processLEDTest(value) must act when value == 1 ("up"), whereas processLoadAddr(value)
+         * must act when value == 0 ("down").  You can infer all this from the table below, because the initial value
+         * of any momentary switch is its "inactive" value, so the opposite is its "active" value.
+         */
+        this.switches = {
+            'START':    [1, 1, true,  false, this.processStart],
+            'STEP':     [1, 1, false, false, this.processStep],
+            'ENABLE':   [1, 1, false, false, this.processEnable],
+            'CONT':     [1, 1, true,  false, this.processContinue],
+            'DEP':      [0, 0, true,  false, this.processDeposit],
+            'EXAM':     [1, 1, true,  false, this.processExamine],
+            'LOAD':     [1, 1, true,  false, this.processLoadAddr],
+            'TEST':     [0, 0, true,  false, this.processLEDTest]
+        };
+        for (var i = 0; i < 22; i++) {
+            this.switches['S'+i] = [0, 0, false, false, this.processSRSwitch, i];
+        }
+
+        /** @type {ComputerPDP10} */
+        this.cmp = null;
+
+        /** @type {BusPDP10} */
+        this.bus = null;
+
+        /** @type {CPUStatePDP10} */
+        this.cpu = null;
+
+        /** @type {DebuggerPDP10} */
+        this.dbg = null;
+
+        /*
+         * The 'hold' and 'toggle' exports, which map to holdSwitch() and toggleSwitch(), both press and release
+         * the specified switch, but processCommands() considers a 'hold' function to be asynchronous, which means
+         * that holdSwitch() will be passed a callback function that can be used to implement a delay between the
+         * press and the release, whereas toggleSwitch() will not.
+         *
+         * holdSwitch() only makes sense for momentary switches (eg, 'TEST'), where a visual delay might be nice.
+         * If the switch isn't momentary, or no delay is desired, then use toggleSwitch(); it will be more efficient.
+         *
+         * Finally, for switches that are toggles (eg, 'ENABLE'), you can use setSwitch() to set it to a specific
+         * state: zero for "off" and non-zero for "on".  setSwitch() also supports meta-switches like "SR", using
+         * the entire value to set a series of switches at once; the value is assumed to be octal unless overridden
+         * by a prefix (eg, "0x") or suffix (eg, ".").
+         */
+        this['exports'] = {
+            'hold': this.holdSwitch,
+            'toggle': this.toggleSwitch,
+            'reset': this.resetSwitches,
+            'set': this.setSwitch
+        };
+
+        this.setReady();
+    }
+
+    /**
+     * getAR()
+     *
+     * @this {PanelPDP10}
+     * @return {number} (current ADDRESS register)
+     */
+    getAR()
+    {
+        return this.regAddr;
+    }
+
+    /**
+     * setAR(value)
+     *
+     * @this {PanelPDP10}
+     * @param {number} value (new ADDRESS register)
+     */
+    setAR(value)
+    {
+        this.updateAddr(this.regAddr = value);
+    }
+
+    /**
+     * getDR()
+     *
+     * @this {PanelPDP10}
+     * @return {number} (current DISPLAY register)
+     */
+    getDR()
+    {
+        return this.regDisplay;
+    }
+
+    /**
+     * setDR(value)
+     *
+     * @this {PanelPDP10}
+     * @param {number} value (new DISPLAY register)
+     * @return {number}
+     */
+    setDR(value)
+    {
+        return this.updateData(this.regDisplay = value);
+    }
+
+    /**
+     * getSR()
+     *
+     * @this {PanelPDP10}
+     * @return {number} (current SWITCH register)
+     */
+    getSR()
+    {
+        return this.regSwitches;
+    }
+
+    /**
+     * setSR(value)
+     *
+     * @this {PanelPDP10}
+     * @param {number} value (new SWITCH register)
+     */
+    setSR(value)
+    {
+        this.setSRSwitches(value);
+    }
+
+    /**
+     * getSwitch(name)
+     *
+     * @this {PanelPDP10}
+     * @param {string} name
+     * @return {number|undefined} 0 if switch is off ("down"), 1 if on ("up"), or undefined if unrecognized
+     */
+    getSwitch(name)
+    {
+        return this.switches[name] && this.switches[name][1];
+    }
+
+    /**
+     * reset(fPowerUp)
+     *
+     * NOTE: Since we've registered our handler with the Bus component, we will be called twice whenever
+     * the entire machine is reset: once when the Computer's reset() handler calls the Bus's reset() handler,
+     * and again when the Computer's reset() handler calls us directly.  Multiple resets should be harmless.
+     *
+     * @this {PanelPDP10}
+     * @param {boolean} [fPowerUp]
+     */
+    reset(fPowerUp)
+    {
+        /*
+         * Simulate a call to our stop() handler, to update the panel's ADDRESS register with the current PC.
+         */
+        this.stop();
+        if (fPowerUp) this.setDR(0);
+    }
+
+    /**
+     * setBinding(sType, sBinding, control, sValue)
+     *
+     * Some panel layouts don't have bindings of their own, and even when they do, there may still be some
+     * components (eg, the CPU) that prefer to update their own bindings, so we pass along all binding requests
+     * to the Computer, CPU, Keyboard and Debugger components first.  The order shouldn't matter, since any
+     * component that doesn't recognize the specified binding should simply ignore it.
+     *
+     * @this {PanelPDP10}
+     * @param {string|null} sType is the type of the HTML control (eg, "button", "textarea", "register", "flag", "rled", etc)
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "reset")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sType, sBinding, control, sValue)
+    {
+        if (this.cmp && this.cmp.setBinding(sType, sBinding, control, sValue)) {
+            return true;
+        }
+        if (this.cpu && this.cpu.setBinding(sType, sBinding, control, sValue)) {
+            return true;
+        }
+        if (DEBUGGER && this.dbg && this.dbg.setBinding(sType, sBinding, control, sValue)) {
+            return true;
+        }
+
+        switch (sBinding) {
+        case 'PC':
+            this.bindings[sBinding] = control;
+            this.cLiveRegs++;
+            return true;
+
+        default:
+            /*
+             * Square ("led") or round ("rled") LEDs are defined in machine XML files like so:
+             *
+             *      <control type="rled" binding="A3" value="1" width="100%" container="center"/>
+             *
+             * Only *type* and *binding* attributes are required; if *value* is omitted, the default value is 0 ("off").
+             */
+            if (sType == "led" || sType == "rled") {
+                this.bindings[sBinding] = control;
+                this.leds[sBinding] = sValue? 1 : 0;
+                this.cLiveRegs++;
+                return true;
+            }
+            /*
+             * Switches are defined in machine XML files like so:
+             *
+             *      <control type="switch" binding="S3" value="1" width="100%" container="center"/>
+             *
+             * Only *type* and *binding* attributes are required; if *value* is omitted, the default value is 0 ("down").
+             *
+             * Currently, there is no XML attribute to indicate whether a switch is "momentary"; only recognized switches
+             * in our internal table can have that attribute.
+             */
+            if (sType == "switch") {
+                /*
+                 * Like LEDs, we allow unrecognized switches to be defined as well, but they won't do anything useful,
+                 * since only recognized switches will have handlers that perform the appropriate operations.
+                 */
+                if (this.switches[sBinding] === undefined) {
+                    this.switches[sBinding] = [sValue? 1 : 0, sValue? 1 : 0];
+                }
+                this.bindings[sBinding] = control;
+                var parent = control.parentElement || control;
+                parent = parent.parentElement || parent;
+                parent.onmousedown = function(panel, sBinding) {
+                    return function onPressSwitch() {
+                        panel.pressSwitch(sBinding);
+                    };
+                }(this, sBinding);
+                parent.onmouseup = parent.onmouseout = function(panel, sBinding) {
+                    return function onReleaseSwitch() {
+                        panel.releaseSwitch(sBinding);
+                    };
+                }(this, sBinding);
+                parent.ontouchstart = function(panel, sBinding) {
+                    return function onPressSwitch(event) {
+                        panel.pressSwitch(sBinding);
+                        event.preventDefault();
+                    };
+                }(this, sBinding);
+                parent.ontouchend = function(panel, sBinding) {
+                    return function onReleaseSwitch() {
+                        panel.releaseSwitch(sBinding);
+                    };
+                }(this, sBinding);
+                return true;
+            }
+            return super.setBinding(sType, sBinding, control, sValue);
+        }
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {PanelPDP10}
+     * @param {ComputerPDP10} cmp
+     * @param {BusPDP10} bus
+     * @param {CPUStatePDP10} cpu
+     * @param {DebuggerPDP10} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cmp = cmp;
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+
+        this.displayLEDs();
+        this.displaySwitches();
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {PanelPDP10}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            /*
+             * As noted in init(), our powerUp() method gives us a second opportunity to notify any
+             * components that that might care (eg, CPU, Keyboard, and Debugger) that we have some controls
+             * (ie, bindings) they might want to use.
+             */
+            if (this.fBindings) PanelPDP10.init();
+
+            if (!data) {
+                this.reset(true);
+            } else {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {PanelPDP10}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the PanelPDP10 component.
+     *
+     * @this {PanelPDP10}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, [
+            this.getAR(),
+            this.getDR(),
+            this.getSR()
+        ]);
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the PanelPDP10 component.
+     *
+     * @this {PanelPDP10}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        var a = data[0];
+        if (a) {
+            this.setAR(a[0]);
+            this.setDR(a[1]);
+            this.setSR(a[2]);
+        }
+        return true;
+    }
+
+    /**
+     * resetSwitches()
+     *
+     * @this {PanelPDP10}
+     * @return {boolean}
+     */
+    resetSwitches()
+    {
+        for (var sBinding in this.switches) {
+            var sw = this.switches[sBinding];
+            sw[1] = sw[0];
+        }
+        this.displaySwitches();
+        return true;
+    }
+
+    /**
+     * displayLED(sBinding, value)
+     *
+     * @this {PanelPDP10}
+     * @param {string} sBinding
+     * @param {boolean|number} value (true or non-zero if the LED should be on, false or zero if off)
+     */
+    displayLED(sBinding, value)
+    {
+        var control = this.bindings[sBinding];
+        if (control) {
+            /*
+             * TODO: Add support for user-definable LED colors?
+             */
+            control.style.backgroundColor = (value? "#ff0000" : "#000000");
+        }
+    }
+
+    /**
+     * displayLEDs(override)
+     *
+     * @this {PanelPDP10}
+     * @param {boolean|number|null} [override] (true turn on all LEDs, false to turn off all LEDs, null or undefined for normal LED activity)
+     */
+    displayLEDs(override)
+    {
+        for (var sBinding in this.leds) {
+            this.displayLED(sBinding, override != null? override : this.leds[sBinding]);
+        }
+    }
+
+    /**
+     * displaySwitch(sBinding, value)
+     *
+     * @this {PanelPDP10}
+     * @param {string} sBinding
+     * @param {boolean|number} value (true if the switch should be "up" (on), false if "down" (off))
+     */
+    displaySwitch(sBinding, value)
+    {
+        var control = this.bindings[sBinding];
+        if (control) {
+            control.style.marginTop = (value? "0px" : "20px");
+            control.style.backgroundColor = (value? "#00ff00" : "#228B22");
+        }
+    }
+
+    /**
+     * displaySwitches()
+     *
+     * @this {PanelPDP10}
+     */
+    displaySwitches()
+    {
+        for (var sBinding in this.switches) {
+            this.displaySwitch(sBinding, this.switches[sBinding][1]);
+        }
+    }
+
+    /**
+     * displayValue(sLabel, nValue, cch)
+     *
+     * This is principally for displaying register values, but in reality, it can be used to display any
+     * numeric value bound to the given label.
+     *
+     * @this {PanelPDP10}
+     * @param {string} sLabel
+     * @param {number} nValue
+     * @param {number} [cch]
+     */
+    displayValue(sLabel, nValue, cch)
+    {
+        if (this.bindings[sLabel]) {
+            var sVal;
+            var nBase = this.dbg && this.dbg.nBase || 8;
+            nValue = nValue || 0;
+            if (!this.cpu.isRunning() || this.fDisplayLiveRegs) {
+                sVal = nBase == 8? Str.toOct(nValue, cch) : Str.toHex(nValue, cch);
+            } else {
+                sVal = "--------".substr(0, cch || 4);
+            }
+            /*
+             * TODO: Determine if this test actually avoids any redrawing when a register hasn't changed, and/or if
+             * we should maintain our own (numeric) cache of displayed register values (to avoid creating these temporary
+             * string values that will have to garbage-collected), and/or if this is actually slower, and/or if I'm being
+             * too obsessive.
+             */
+            if (this.bindings[sLabel].textContent != sVal) this.bindings[sLabel].textContent = sVal;
+        }
+    }
+
+    /**
+     * holdSwitch(fnCallback, sBinding, sDelay)
+     *
+     * @this {PanelPDP10}
+     * @param {function()|null} fnCallback
+     * @param {string} sBinding
+     * @param {string} [sDelay]
+     * @return {boolean} false if wait required, true otherwise
+     */
+    holdSwitch(fnCallback, sBinding, sDelay)
+    {
+        if (this.pressSwitch(sBinding)) {
+            if (sDelay) {
+                var panel = this;
+                setTimeout(function() {
+                    panel.releaseSwitch(sBinding);
+                    if (fnCallback) fnCallback();
+                }, +sDelay);
+                return false;
+            } else {
+                this.releaseSwitch(sBinding);
+            }
+        }
+        return true;
+    }
+
+    /**
+     * setSwitch(sBinding, sValue)
+     *
+     * @this {PanelPDP10}
+     * @param {string} sBinding
+     * @param {string} sValue
+     * @return {boolean}
+     */
+    setSwitch(sBinding, sValue)
+    {
+        if (sBinding == "SR") {
+            return this.setSRSwitches(Str.parseInt(sValue, 8))
+        }
+        var sw = this.switches[sBinding];
+        if (sw) {
+            sw[1] = +sValue? 1 : 0;
+            this.displaySwitch(sBinding, sw[1]);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * toggleSwitch(sBinding)
+     *
+     * @this {PanelPDP10}
+     * @param {string} sBinding
+     * @return {boolean}
+     */
+    toggleSwitch(sBinding)
+    {
+        if (this.pressSwitch(sBinding)) {
+            this.releaseSwitch(sBinding);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * pressSwitch(sBinding)
+     *
+     * @this {PanelPDP10}
+     * @param {string} sBinding
+     * @return {boolean}
+     */
+    pressSwitch(sBinding)
+    {
+        var sw = this.switches[sBinding];
+        if (sw) {
+            /*
+             * Set the new switch value in sw[1] and then immediately display it
+             */
+            this.displaySwitch(sBinding, (sw[1] = 1 - sw[1]));
+
+            /*
+             * Mark the switch as "pressed"
+             */
+            sw[3] = true;
+
+            /*
+             * Call the appropriate process handler with the current switch value (sw[1])
+             */
+            if (sw[4]) sw[4].call(this, sw[1], sw[5]);
+
+            /*
+             * This helps the next 'DEP' or 'EXAM' press determine if the previous press was the same,
+             * while also ignoring any intervening 'STEP' presses (see processStep() for why we do that).
+             */
+            if (sBinding != PanelPDP10.SWITCH.STEP) {
+                this.fDeposit = (sBinding == PanelPDP10.SWITCH.DEP);
+                this.fExamine = (sBinding == PanelPDP10.SWITCH.EXAM);
+            }
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * releaseSwitch(sBinding)
+     *
+     * @this {PanelPDP10}
+     * @param {string} sBinding
+     * @return {boolean}
+     */
+    releaseSwitch(sBinding)
+    {
+        /*
+         * pressSwitch() is simple: flip the switch's current value in sw[1] and marked it "pressed" in sw[3].
+         *
+         * releaseSwitch() is more complicated, because we must handle both mouseUp and mouseOut events.  The first time
+         * we receive EITHER of those events AND the switch is marked momentary (sw[2]) AND the switch is pressed (sw[3]),
+         * then we must flip the switch back to its original value.
+         *
+         * Otherwise, the only thing we have to do is mark the switch as "released" (ie, set sw[3] to false).
+         */
+        var sw = this.switches[sBinding];
+        if (sw) {
+            if (sw[2] && sw[3]) {
+                /*
+                 * Set the new switch value in sw[1] and then immediately display it
+                 */
+                this.displaySwitch(sBinding, (sw[1] = sw[0]));
+
+                /*
+                 * Call the appropriate process handler with the current switch value (sw[1])
+                 */
+                if (sw[4]) sw[4].call(this, sw[1], sw[5]);
+            }
+            /*
+             * Mark the switch as "released"
+             */
+            sw[3] = false;
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * processStart(value, index)
+     *
+     * @this {PanelPDP10}
+     * @param {number} value
+     * @param {number} [index]
+     */
+    processStart(value, index)
+    {
+        if (!value && !this.cpu.isRunning()) {
+
+            this.cpu.setPC(this.regAddr);
+
+            /*
+             * The PDP-11/70 Handbook goes on to say: "If the system needs to be initialized but execution
+             * is not wanted, the START switch should be depressed while the HALT/ENABLE switch is in the HALT
+             * position."
+             */
+            if (this.getSwitch(PanelPDP10.SWITCH.ENABLE)) {
+                this.cpu.startCPU();
+            }
+        }
+    }
+
+    /**
+     * processStep(value, index)
+     *
+     * If value == 1 (our initial value), then the 'STEP' switch is set to "S INST" (step one instruction);
+     * otherwise, it's set to "S BUS CYCLE" (step one bus cycle).
+     *
+     * However, since we can't currently support cycle-stepping, I've decided to innovate a little and
+     * change the meaning of this switch: the normal ("up") position means that successive 'EXAM' and 'DEP'
+     * operations will first add 2 to the ADDRESS register, while the opposite ("down") position means
+     * they will first subtract 2.
+     *
+     * See processLEDTest() for more of these exciting "innovations".  ;-)
+     *
+     * @this {PanelPDP10}
+     * @param {number} value
+     * @param {number} [index]
+     */
+    processStep(value, index)
+    {
+        /*
+         * There's really nothing for us to do here, because the normal press and release handlers
+         * already record the state of this switch, so it can be queried as needed, using getSwitch().
+         */
+    }
+
+    /**
+     * processEnable(value, index)
+     *
+     * If value == 1 (our initial value), then the 'ENABLE'/'HALT' switch is set to 'ENABLE', otherwise 'HALT'.
+     *
+     * @this {PanelPDP10}
+     * @param {number} value
+     * @param {number} [index]
+     */
+    processEnable(value, index)
+    {
+        /*
+         * The "down" (0) position is 'HALT', which stops the CPU; however, the "up" (1) position ('ENABLE')
+         * does NOT start the CPU.  You must press 'CONT' to continue execution, which will either continue for
+         * one instruction if this switch to set to 'HALT' or indefinitely if it is set to 'ENABLE'.
+         */
+        if (!value) {
+            this.cpu.stopCPU();
+        }
+    }
+
+    /**
+     * processContinue(value, index)
+     *
+     * @this {PanelPDP10}
+     * @param {number} value
+     * @param {number} [index]
+     */
+    processContinue(value, index)
+    {
+        if (!value && !this.cpu.isRunning()) {
+            /*
+             * TODO: Technically, we're also supposed to check the 'STEP' switch to determine if we should
+             * step one instruction or just one cycle, but we don't currently have the ability to do the latter.
+             */
+            if (!this.getSwitch(PanelPDP10.SWITCH.ENABLE)) {
+                /*
+                 * Using the Debugger's stepCPU() function is more convenient, and has the pleasant side-effect
+                 * of updating the debugger's display; however, not all machines with a Front Panel will necessarily
+                 * also have the Debugger loaded.
+                 */
+                var dbg = this.dbg;
+                if (dbg && !dbg.isBusy(true)) {
+                    dbg.setBusy(true);
+                    dbg.stepCPU(0, null);
+                    dbg.setBusy(false);
+                }
+                else {
+                    /*
+                     * For this tiny single-instruction burst, mimic what runCPU() does.
+                     */
+                    try {
+                        var nCyclesStep = this.cpu.stepCPU(1);
+                        if (nCyclesStep > 0) {
+                            this.cpu.updateTimers(nCyclesStep);
+                            this.cpu.addCycles(nCyclesStep, true);
+                            this.cpu.updateChecksum(nCyclesStep);
+                        }
+                    }
+                    catch(exception) {
+                        /*
+                         * We assume that any numeric exception was explicitly thrown by the CPU to interrupt the
+                         * current instruction.  For all other exceptions, we attempt a stack dump.
+                         */
+                        if (typeof exception != "number") {
+                            var e = exception;
+                            this.cpu.setError(e.stack || e.message);
+                        }
+                    }
+                }
+
+                /*
+                 * Simulate a call to our stop() handler, to update the panel's ADDRESS register with the new PC.
+                 */
+                this.stop();
+
+                /*
+                 * Going through the normal channels (ie, the Computer's updateDisplays() interface) ensures that
+                 * ALL updateDisplay() handlers will be called, including ours.
+                 *
+                 * NOTE: If we used the Debugger's stepCPU() function, then that includes a call to updateDisplay();
+                 * unfortunately, it will have happened BEFORE we called stop() to update the ADDRESS register, so
+                 * we still need to call it again.
+                 */
+                if (this.cmp) this.cmp.updateDisplays();
+            }
+            else {
+                this.cpu.startCPU();
+            }
+        }
+    }
+
+    /**
+     * processDeposit(value, index)
+     *
+     * @this {PanelPDP10}
+     * @param {number} value
+     * @param {number} [index]
+     */
+    processDeposit(value, index)
+    {
+        if (value && !this.cpu.isRunning()) {
+            if (this.fDeposit) this.advanceAddr();
+            /*
+             * This used to be updateData(), but that only updates regData, whereas setDR() updates both regData and regDisplay,
+             * and for these kinds of explicit Front Panel operations, I'm assuming the values should be synced.
+             */
+            var w = this.setDR(this.regSwitches);
+
+            if (this.nAddrSel == PanelPDP10.ADDRSEL.CONS_PHY) {
+                /*
+                 * TODO: Determine if this needs to take the UNIBUS map into consideration.
+                 */
+                this.bus.setWordDirect(this.regAddr, w);
+            } else {
+                /*
+                 * TODO: This code is obviously incomplete, since it doesn't take into account the precise ADDRSEL mode.
+                 */
+                this.cpu.writeWord(this.regAddr, w);
+            }
+        }
+    }
+
+    /**
+     * processExamine(value, index)
+     *
+     * @this {PanelPDP10}
+     * @param {number} value
+     * @param {number} [index]
+     */
+    processExamine(value, index)
+    {
+        if (!value && !this.cpu.isRunning()) {
+            var w;
+            if (this.fExamine) this.advanceAddr();
+            if (this.nAddrSel == PanelPDP10.ADDRSEL.CONS_PHY) {
+                /*
+                 * TODO: Determine if this needs to take the UNIBUS map into consideration.
+                 */
+                w = this.bus.getWordDirect(this.regAddr);
+            } else {
+                /*
+                 * TODO: This code is obviously incomplete, since it doesn't take into account the precise ADDRSEL mode.
+                 */
+                w = this.cpu.readWord(this.regAddr);
+            }
+            /*
+             * This used to be updateData(), but that only updates regData, whereas setDR() updates both regData and regDisplay,
+             * and for these kinds of explicit Front Panel operations, I'm assuming the values should be synced.
+             */
+            this.setDR(w);
+        }
+    }
+
+    /**
+     * processLoadAddr(value, index)
+     *
+     * @this {PanelPDP10}
+     * @param {number} value
+     * @param {number} [index]
+     */
+    processLoadAddr(value, index)
+    {
+        if (!value && !this.cpu.isRunning()) {
+            this.updateAddr(this.regSwitches);
+        }
+    }
+
+    /**
+     * processLEDTest(value, index)
+     *
+     * @this {PanelPDP10}
+     * @param {number} value
+     * @param {number} [index]
+     */
+    processLEDTest(value, index)
+    {
+        if (value) {
+            this.fLEDTest = true;
+            this.displayLEDs(true);
+        } else {
+            this.fLEDTest = false;
+            this.displayLEDs();
+            /*
+             * This is another one of my "innovations": when you're done testing the LEDs, all the switches reset as well.
+             */
+            this.setSRSwitches(0);
+        }
+    }
+
+    /**
+     * processSRSwitch(value, index)
+     *
+     * @this {PanelPDP10}
+     * @param {number} value (normally 0 or 1, but we only depend on it being zero or non-zero)
+     * @param {number} index
+     */
+    processSRSwitch(value, index)
+    {
+        if (value) {
+            this.regSwitches |= 1 << index;
+        } else {
+            this.regSwitches &= ~(1 << index);
+        }
+    }
+
+    /**
+     * advanceAddr()
+     *
+     * This should also take care of the following Front Panel behaviors when the accessing the general-purpose
+     * registers:
+     *
+     *      1) ADDRESS display incremented by 1 (instead of 2)
+     *      2) The STEP after the last register is 177700, such that the addresses are looped
+     *
+     * A third behavior is NOT emulated: preventing the ADDRESS from stepping to the first General Register (177700)
+     * from 177676.
+     *
+     * @this {PanelPDP10}
+     * @return {number}
+     */
+    advanceAddr()
+    {
+        var inc = 1;
+        var mask = this.bus.nBusMask;
+        if (!this.getSwitch(PanelPDP10.SWITCH.STEP)) inc = -inc;
+        return this.updateAddr((this.regAddr & ~mask) | ((this.regAddr + inc) & mask));
+    }
+
+    /**
+     * updateAddr(value)
+     *
+     * @this {PanelPDP10}
+     * @param {number} value
+     * @return {number}
+     */
+    updateAddr(value)
+    {
+        this.regAddr = value & this.bus.nBusMask;
+        if (this.ledAddr !== this.regAddr) {
+            this.ledAddr = this.regAddr;
+            this.updateLEDArray("A", this.ledAddr, 22);
+        }
+        return this.regAddr;
+    }
+
+    /**
+     * updateData(value)
+     *
+     * @this {PanelPDP10}
+     * @param {number} value
+     * @return {number}
+     */
+    updateData(value)
+    {
+        this.regData = value % PDP10.WORD_LIMIT;
+        if (this.ledData !== this.regData) {
+            this.ledData = this.regData;
+            this.updateLEDArray("D", this.ledData, 16);
+        }
+        return this.regData;
+    }
+
+    /**
+     * updateLED(sBinding, value)
+     *
+     * @this {PanelPDP10}
+     * @param {string} sBinding
+     * @param {number} value
+     * @return {number}
+     */
+    updateLED(sBinding, value)
+    {
+        this.leds[sBinding] = value;
+        if (!this.fLEDTest) this.displayLED(sBinding, value);
+        return value;
+    }
+
+    /**
+     * updateLEDArray(sPrefix, value, nLEDs)
+     *
+     * @this {PanelPDP10}
+     * @param {string} sPrefix
+     * @param {number} value
+     * @param {number} nLEDs
+     */
+    updateLEDArray(sPrefix, value, nLEDs)
+    {
+        for (var i = 0; i < nLEDs; i++) {
+            var sBinding = sPrefix + i;
+            this.updateLED(sBinding, value & (1 << i));
+        }
+    }
+
+    /**
+     * setSRSwitches(value)
+     *
+     * @this {PanelPDP10}
+     * @param {number|undefined} value
+     * @return {boolean}
+     */
+    setSRSwitches(value)
+    {
+        this.regSwitches = value | 0;
+        for (var i = 0; i < 22; i++) {
+            this.switches['S'+i][1] = (this.regSwitches & (1 << i))? 1 : 0;
+        }
+        /*
+         * This (re)displays ALL switches, not merely the SR switches, but that's OK.
+         */
+        this.displaySwitches();
+        return true;
+    }
+
+    /**
+     * stop(ms, nCycles)
+     *
+     * This is a notification handler, called by the Computer, to inform us the CPU has now stopped.
+     *
+     * @this {PanelPDP10}
+     * @param {number} [ms]
+     * @param {number} [nCycles]
+     */
+    stop(ms, nCycles)
+    {
+        this.updateAddr(this.cpu.getPC());
+    }
+
+    /**
+     * setAddr(value, fActive)
+     *
+     * This interface is for passing new addresses to the Front Panel.  However, whether or not this will become the
+     * ADDRESS actually displayed will depend on other settings (see updateStatus() for details).
+     *
+     * @this {PanelPDP10}
+     * @param {number} value
+     * @param {boolean} [fActive] (true if this should become the "active" ADDRESS regardless of other settings)
+     */
+    setAddr(value, fActive)
+    {
+        this.regAddr = value;
+    }
+
+    /**
+     * setData(value, fActive)
+     *
+     * This interface is for passing new data to the Front Panel.  However, whether or not this will become the
+     * DATA actually displayed will depend on the Front Panel's DATASEL switch setting, as well as the fActive flag.
+     *
+     * @this {PanelPDP10}
+     * @param {number} value
+     * @param {boolean} [fActive] (true if this should become the "active" DATA regardless of the DATASEL switch setting)
+     */
+    setData(value, fActive)
+    {
+        if (!fActive) {
+            this.regData = value;
+        } else {
+            this.regDisplay = value;
+        }
+    }
+
+    /**
+     * updateDisplay(nUpdate)
+     *
+     * Called by the Computer component at intervals to update registers, LEDs, etc.
+     *
+     * @this {PanelPDP10}
+     * @param {number} [nUpdate] (-2 for power on, -1 for forced, > 0 for periodic, 0 or undefined otherwise)
+     */
+    updateDisplay(nUpdate)
+    {
+        if (this.cLiveRegs) {
+
+            var fRunning = this.cpu.isRunning();
+            var fWaiting = this.cpu.isWaiting();
+
+            if (nUpdate < 0 || !fRunning || this.fDisplayLiveRegs) {
+
+                /*
+                 * We arbitrarily separate the display elements into two categories: cheap and expensive.
+                 *
+                 * LEDs are considered cheap, register displays are not.  So we'll skip the latter if this
+                 * is a periodic update AND our periodic update counter hasn't reached the periodic update limit.
+                 */
+                if (nUpdate <= 0 || (this.nDisplayCount += nUpdate) >= this.nDisplayLimit) {
+                    this.displayValue("PC", this.cpu.getPC());
+                    this.nDisplayCount = 0;
+                }
+
+                /*
+                 * Update the ADDRESS and DATA LEDs by selecting the appropriate values.
+                 *
+                 * TODO: There is currently no mechanism for selecting regData over regDisplay;
+                 * we are acting as if the DATASEL switch setting is locked to "DISPLAY REGISTER".
+                 */
+                if (nUpdate < -1) {
+                    this.regAddr = this.cpu.getPC();
+                } else if (nUpdate > 0 && fRunning && !fWaiting) {
+                    this.regAddr = this.cpu.getLastAddr();
+                }
+
+                this.updateAddr(this.regAddr);
+                this.updateData(this.regDisplay);
+            }
+        }
+    }
+
+    /**
+     * PanelPDP10.init()
+     *
+     * This function operates on every HTML element of class "panel", extracting the
+     * JSON-encoded parameters for the PanelPDP10 constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a PanelPDP10 component, and then binding
+     * any associated HTML controls to the new component.
+     *
+     * NOTE: Unlike most other component init() functions, this one is designed to be
+     * called multiple times: once at load time, so that we can bind our print()
+     * function to the panel's output control ASAP, and again when the Computer component
+     * is verifying that all components are ready and invoking their powerUp() functions.
+     *
+     * Our powerUp() method gives us a second opportunity to notify any components that
+     * that might care (eg, CPU, Keyboard, and Debugger) that we have some controls they
+     * might want to use.
+     */
+    static init()
+    {
+        var aePanels = Component.getElementsByClass(document, PDP10.APPCLASS, "panel");
+        for (var iPanel=0; iPanel < aePanels.length; iPanel++) {
+            var ePanel = aePanels[iPanel];
+            var parmsPanel = Component.getComponentParms(ePanel);
+            var panel = Component.getComponentByID(parmsPanel['id']);
+            if (!panel) panel = new PanelPDP10(parmsPanel, true);
+            Component.bindComponentControls(panel, ePanel, PDP10.APPCLASS);
+        }
+    }
+}
+
+PanelPDP10.ADDRSEL = {
+    CONS_PHY:   7       // use a physical address to perform console operations (e.g., LOAD ADRS, EXAM, & DEP)
+};
+
+/*
+ * To get the current state of a switch; eg::
+ *
+ *      this.getSwitch(PanelPDP10.SWITCH.ENABLE)
+ *
+ * I haven't filled out this table, primarily it only needs to list switches we actually query
+ * (eg, non-momentary ones like 'ENABLE' and 'STEP', and 'EXAM' and 'DEP' since they have special
+ * "step" behavior when pressed more than once in a row).  Ditto for the LED table.
+ */
+PanelPDP10.SWITCH = {
+    DEP:    'DEP',
+    ENABLE: 'ENABLE',
+    EXAM:   'EXAM',
+    STEP:   'STEP'
+};
+
+/*
+ * Initialize every Panel module on the page.
+ */
+Web.onInit(PanelPDP10.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp10/lib/bus.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * Data types used by scanMemory()
+ */
+
+/**
+ * This defines the BlockInfo bit fields used by scanMemory() when it creates the aBlocks array.
+ *
+ * @typedef {{
+ *  num:    BitField,
+ *  count:  BitField,
+ *  btmod:  BitField,
+ *  type:   BitField
+ * }}
+ */
+var BlockInfoPDP10 = Usr.defineBitFields({num:20, count:8, btmod:1, type:3});
+
+/**
+ * BusInfoPDP10 object definition (returned by scanMemory())
+ *
+ *  cbTotal:    total bytes allocated
+ *  cBlocks:    total Memory blocks allocated
+ *  aBlocks:    array of allocated Memory block numbers
+ *
+ * @typedef {{
+ *  cbTotal:    number,
+ *  cBlocks:    number,
+ *  aBlocks:    Array.<BlockInfoPDP10>
+ * }}
+ */
+var BusInfoPDP10;
+
+class BusPDP10 extends Component {
+    /**
+     * BusPDP10(parmsBus, cpu, dbg)
+     *
+     * The BusPDP10 component manages physical memory and I/O address spaces.
+     *
+     * The BusPDP10 component has no UI elements, so it does not require an init() handler,
+     * but it still inherits from the Component class and must be allocated like any
+     * other device component.  It's currently allocated by the Computer's init() handler,
+     * which then calls the initBus() method of all the other components.
+     *
+     * For memory beyond the simple needs of the ROM and RAM components (ie, memory-mapped
+     * devices), the address space must still be allocated through the BusPDP10 component via
+     * addMemory().  If the component needs something more than simple read/write storage,
+     * it must provide a custom controller.
+     *
+     * @param {Object} parmsBus
+     * @param {CPUStatePDP10} cpu
+     * @param {DebuggerPDP10} dbg
+     */
+    constructor(parmsBus, cpu, dbg)
+    {
+        super("Bus", parmsBus, MessagesPDP10.BUS);
+
+        this.cpu = cpu;
+        this.dbg = dbg;
+
+        /*
+         * Supported values for nBusWidth: 18 (default).  This represents the maximum size of the bus for the
+         * life of the machine, regardless what memory management mode the CPU has enabled.
+         */
+        this.nBusWidth = +parmsBus['busWidth'] || 18;
+
+        /*
+         * Compute all BusPDP10 memory block parameters now, based on the width of the bus.
+         *
+         * Note that all PCjs machines divide their address space into blocks, using a block size appropriate for
+         * the machine's bus width.  This allows us to efficiently allocate the entire address space, by reusing blocks
+         * as appropriate, and to define to different address behaviors on a block-granular level.
+         */
+        this.addrTotal = 1 << this.nBusWidth;
+        this.nBusMask = (this.addrTotal - 1);
+        this.nBlockSize = 16384;
+        this.nBlockShift = Math.log2(this.nBlockSize);      // ES6 ALERT (alternatively: Math.log(this.nBlockSize) / Math.LN2)
+        this.nBlockLen = this.nBlockSize >> 2;
+        this.nBlockLimit = this.nBlockSize - 1;
+        this.nBlockTotal = (this.addrTotal / this.nBlockSize) | 0;
+        this.nBlockMask = this.nBlockTotal - 1;
+
+
+        this.nDisableFaults = 0;
+        this.fFault = false;
+
+        /*
+         * Define all the properties to be initialized by initMemory()
+         */
+        this.aBusBlocks = [];
+
+        /*
+         * We're ready to allocate empty Memory blocks to span the entire physical address space.
+         */
+        this.initMemory();
+
+        this.setReady();
+    }
+
+    /**
+     * initMemory()
+     *
+     * Allocate enough (empty) Memory blocks to span the entire physical address space.
+     *
+     * @this {BusPDP10}
+     */
+    initMemory()
+    {
+        var block = new MemoryPDP10(this);
+        block.copyBreakpoints(this.dbg);
+
+        this.aBusBlocks = new Array(this.nBlockTotal);
+        for (var iBlock = 0; iBlock < this.nBlockTotal; iBlock++) {
+            this.aBusBlocks[iBlock] = block;
+        }
+    }
+
+    /**
+     * reset()
+     *
+     * @this {BusPDP10}
+     */
+    reset()
+    {
+    }
+
+    /**
+     * getWidth()
+     *
+     * @this {BusPDP10}
+     * @return {number}
+     */
+    getWidth()
+    {
+        return this.nBusWidth;
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {BusPDP10}
+     * @param {Object|null} data (always null because we supply no powerDown() handler)
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            if (!data) {
+                this.reset();
+            } else {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {BusPDP10}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * save()
+     *
+     * @this {BusPDP10}
+     * @return {Object|null}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, this.saveMemory());
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * @this {BusPDP10}
+     * @param {Object} data
+     * @return {boolean} true if restore successful, false if not
+     */
+    restore(data)
+    {
+        return this.restoreMemory(data[0]);
+    }
+
+    /**
+     * addMemory(addr, size, type)
+     *
+     * Adds new Memory blocks to the specified address range.  Any Memory blocks previously
+     * added to that range must first be removed via removeMemory(); otherwise, you'll get
+     * an allocation conflict error.  This helps prevent address calculation errors, redundant
+     * allocations, etc.
+     *
+     * We've relaxed some of the original requirements (ie, that addresses must start at a
+     * block-granular address, or that sizes must be equal to exactly one or more blocks),
+     * because machines with large block sizes can make it impossible to load certain ROMs at
+     * their required addresses.  Every allocation still allocates a whole number of blocks.
+     *
+     * Even so, BusPDP10 memory management does NOT provide a general-purpose heap.  Most memory
+     * allocations occur during machine initialization and never change.  In particular, there
+     * is NO support for removing partial-block allocations.
+     *
+     * Each Memory block keeps track of a start address (addr) and length (used), indicating
+     * the used space within the block; any free space that precedes or follows that used space
+     * can be allocated later, by simply extending the beginning or ending of the previously used
+     * space.  However, any holes that might have existed between the original allocation and an
+     * extension are subsumed by the extension.
+     *
+     * @this {BusPDP10}
+     * @param {number} addr is the starting physical address of the request
+     * @param {number} size of the request, in bytes
+     * @param {number} type is one of the MemoryPDP10.TYPE constants
+     * @return {boolean} true if successful, false if not
+     */
+    addMemory(addr, size, type)
+    {
+        var addrNext = addr;
+        var sizeLeft = size;
+        var iBlock = addrNext >>> this.nBlockShift;
+
+        while (sizeLeft > 0 && iBlock < this.aBusBlocks.length) {
+
+            var block = this.aBusBlocks[iBlock];
+            var addrBlock = iBlock * this.nBlockSize;
+            var sizeBlock = this.nBlockSize - (addrNext - addrBlock);
+            if (sizeBlock > sizeLeft) sizeBlock = sizeLeft;
+
+            if (block && block.size) {
+                if (block.type == type) {
+                    /*
+                     * Where there is already a similar block with a non-zero size, we allow the allocation only if:
+                     *
+                     *   1) addrNext + sizeLeft <= block.addr (the request precedes the used portion of the current block), or
+                     *   2) addrNext >= block.addr + block.used (the request follows the used portion of the current block)
+                     */
+                    if (addrNext + sizeLeft <= block.addr) {
+                        block.used += (block.addr - addrNext);
+                        block.addr = addrNext;
+                        return true;
+                    }
+                    if (addrNext >= block.addr + block.used) {
+                        var sizeAvail = block.size - (addrNext - addrBlock);
+                        if (sizeAvail > sizeLeft) sizeAvail = sizeLeft;
+                        block.used = addrNext - block.addr + sizeAvail;
+                        addrNext = addrBlock + this.nBlockSize;
+                        sizeLeft -= sizeAvail;
+                        iBlock++;
+                        continue;
+                    }
+                }
+                return this.reportError(BusPDP10.ERROR.RANGE_INUSE, addrNext, sizeLeft);
+            }
+
+            var blockNew = new MemoryPDP10(this, addrNext, sizeBlock, this.nBlockSize, type);
+            blockNew.copyBreakpoints(this.dbg, block);
+            this.aBusBlocks[iBlock++] = blockNew;
+
+            addrNext = addrBlock + this.nBlockSize;
+            sizeLeft -= sizeBlock;
+        }
+
+        if (sizeLeft <= 0) {
+            this.status("Added " + (size >> 10) + "Kb " + MemoryPDP10.TYPE_NAMES[type] + " at " + Str.toOct(addr));
+            return true;
+        }
+
+        return this.reportError(BusPDP10.ERROR.RANGE_INVALID, addr, size);
+    }
+
+    /**
+     * cleanMemory(addr, size)
+     *
+     * @this {BusPDP10}
+     * @param {number} addr
+     * @param {number} size
+     * @return {boolean} true if all blocks were clean, false if dirty; all blocks are cleaned in the process
+     */
+    cleanMemory(addr, size)
+    {
+        var fClean = true;
+        var iBlock = addr >>> this.nBlockShift;
+        while (size > 0 && iBlock < this.aBusBlocks.length) {
+            if (this.aBusBlocks[iBlock].fDirty) {
+                this.aBusBlocks[iBlock].fDirty = fClean = false;
+                this.aBusBlocks[iBlock].fDirtyEver = true;
+            }
+            size -= this.nBlockSize;
+            iBlock++;
+        }
+        return fClean;
+    }
+
+    /**
+     * zeroMemory(addr, size, pattern)
+     *
+     * @this {BusPDP10}
+     * @param {number} addr
+     * @param {number} size
+     * @param {number} [pattern]
+     */
+    zeroMemory(addr, size, pattern)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = addr >>> this.nBlockShift;
+        while (size > 0 && iBlock < this.aBusBlocks.length) {
+            this.aBusBlocks[iBlock].zero(off, size, pattern);
+            size -= this.nBlockSize;
+            iBlock++;
+            off = 0;
+        }
+    }
+
+    /**
+     * scanMemory(info, addr, size)
+     *
+     * Returns a BusInfoPDP10 object for the specified address range.
+     *
+     * @this {BusPDP10}
+     * @param {BusInfoPDP10} [info] previous BusInfoPDP10, if any
+     * @param {number} [addr] starting address of range (0 if none provided)
+     * @param {number} [size] size of range, in bytes (up to end of address space if none provided)
+     * @return {BusInfoPDP10} updated info (or new info if no previous info provided)
+     */
+    scanMemory(info, addr, size)
+    {
+        if (addr == null) addr = 0;
+        if (size == null) size = (this.addrTotal - addr) | 0;
+        if (info == null) info = {cbTotal: 0, cBlocks: 0, aBlocks: []};
+
+        var iBlock = addr >>> this.nBlockShift;
+        var iBlockMax = ((addr + size - 1) >>> this.nBlockShift);
+
+        info.cbTotal = 0;
+        info.cBlocks = 0;
+        while (iBlock <= iBlockMax) {
+            var block = this.aBusBlocks[iBlock];
+            info.cbTotal += block.size;
+            if (block.size) {
+                info.aBlocks.push(/** @type {BlockInfoPDP10} */ (Usr.initBitFields(BlockInfoPDP10, iBlock, 0, 0, block.type)));
+                info.cBlocks++
+            }
+            iBlock++;
+        }
+        return info;
+    }
+
+    /**
+     * removeMemory(addr, size)
+     *
+     * Replaces every block in the specified address range with empty Memory blocks that ignore all reads/writes.
+     *
+     * TODO: Update the removeMemory() interface to reflect the relaxed requirements of the addMemory() interface.
+     *
+     * @this {BusPDP10}
+     * @param {number} addr
+     * @param {number} size
+     * @return {boolean} true if successful, false if not
+     */
+    removeMemory(addr, size)
+    {
+        if (!(addr & this.nBlockLimit) && size && !(size & this.nBlockLimit)) {
+            var iBlock = addr >>> this.nBlockShift;
+            while (size > 0) {
+                var blockOld = this.aBusBlocks[iBlock];
+                var blockNew = new MemoryPDP10(this, addr);
+                blockNew.copyBreakpoints(this.dbg, blockOld);
+                this.aBusBlocks[iBlock++] = blockNew;
+                addr = iBlock * this.nBlockSize;
+                size -= this.nBlockSize;
+            }
+            return true;
+        }
+        return this.reportError(BusPDP10.ERROR.RANGE_INVALID, addr, size);
+    }
+
+    /**
+     * getMemoryBlocks(addr, size)
+     *
+     * @this {BusPDP10}
+     * @param {number} addr is the starting physical address
+     * @param {number} size of the request, in bytes
+     * @return {Array} of Memory blocks
+     */
+    getMemoryBlocks(addr, size)
+    {
+        var aBlocks = [];
+        var iBlock = addr >>> this.nBlockShift;
+        while (size > 0 && iBlock < this.aBusBlocks.length) {
+            aBlocks.push(this.aBusBlocks[iBlock++]);
+            size -= this.nBlockSize;
+        }
+        return aBlocks;
+    }
+
+    /**
+     * setMemoryBlocks(addr, size, aBlocks, type)
+     *
+     * If no type is specified, then specified address range uses all the provided blocks as-is;
+     * this form of setMemoryBlocks() is used for complete physical aliases.
+     *
+     * Otherwise, new blocks are allocated with the specified type; the underlying memory from the
+     * provided blocks is still used, but the new blocks may have different access to that memory.
+     *
+     * @this {BusPDP10}
+     * @param {number} addr is the starting physical address
+     * @param {number} size of the request, in bytes
+     * @param {Array} aBlocks as returned by getMemoryBlocks()
+     * @param {number} [type] is one of the MemoryPDP10.TYPE constants
+     */
+    setMemoryBlocks(addr, size, aBlocks, type)
+    {
+        var i = 0;
+        var iBlock = addr >>> this.nBlockShift;
+        while (size > 0 && iBlock < this.aBusBlocks.length) {
+            var block = aBlocks[i++];
+
+            if (!block) break;
+            if (type !== undefined) {
+                var blockNew = new MemoryPDP10(this, addr);
+                blockNew.clone(block, type, this.dbg);
+                block = blockNew;
+            }
+            this.aBusBlocks[iBlock++] = block;
+            size -= this.nBlockSize;
+        }
+    }
+
+    /**
+     * getWord(addr)
+     *
+     * @this {BusPDP10}
+     * @param {number} addr is a physical address
+     * @return {number} word (36-bit) value at that address
+     */
+    getWord(addr)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = (addr & this.nBusMask) >>> this.nBlockShift;
+        return this.aBusBlocks[iBlock].readWord(off, addr);
+    }
+
+    /**
+     * setWord(addr, w)
+     *
+     * @this {BusPDP10}
+     * @param {number} addr is a physical address
+     * @param {number} w is the word (36-bit) value to write
+     */
+    setWord(addr, w)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = (addr & this.nBusMask) >>> this.nBlockShift;
+        this.aBusBlocks[iBlock].writeWord(w, off, addr);
+    }
+
+    /**
+     * getBlockDirect(addr)
+     *
+     * @this {BusPDP10}
+     * @param {number} addr is a physical address
+     * @return {MemoryPDP10}
+     */
+    getBlockDirect(addr)
+    {
+        return this.aBusBlocks[(addr & this.nBusMask) >>> this.nBlockShift];
+    }
+
+    /**
+     * getWordDirect(addr)
+     *
+     * This is used for device I/O and Debugger physical memory requests, not the CPU.
+     *
+     * @this {BusPDP10}
+     * @param {number} addr is a physical address
+     * @return {number} word (36-bit) value at that address
+     */
+    getWordDirect(addr)
+    {
+        var w;
+        var off = addr & this.nBlockLimit;
+        var block = this.getBlockDirect(addr);
+        this.nDisableFaults++;
+        w = block.readWordDirect(off, addr);
+        this.nDisableFaults--;
+        return w;
+    }
+
+    /**
+     * setWordDirect(addr, w)
+     *
+     * This is used for device I/O and Debugger physical memory requests, not the CPU.
+     *
+     * @this {BusPDP10}
+     * @param {number} addr is a physical address
+     * @param {number} w is the word (36-bit) value to write
+     */
+    setWordDirect(addr, w)
+    {
+        var off = addr & this.nBlockLimit;
+        var block = this.getBlockDirect(addr);
+        this.nDisableFaults++;
+        block.writeWordDirect(w, off, addr);
+        this.nDisableFaults--;
+    }
+
+    /**
+     * addMemBreak(addr, fWrite)
+     *
+     * @this {BusPDP10}
+     * @param {number} addr
+     * @param {boolean} fWrite is true for a memory write breakpoint, false for a memory read breakpoint
+     */
+    addMemBreak(addr, fWrite)
+    {
+        if (DEBUGGER) {
+            var iBlock = addr >>> this.nBlockShift;
+            this.aBusBlocks[iBlock].addBreakpoint(addr & this.nBlockLimit, fWrite);
+        }
+    }
+
+    /**
+     * removeMemBreak(addr, fWrite)
+     *
+     * @this {BusPDP10}
+     * @param {number} addr
+     * @param {boolean} fWrite is true for a memory write breakpoint, false for a memory read breakpoint
+     */
+    removeMemBreak(addr, fWrite)
+    {
+        if (DEBUGGER) {
+            var iBlock = addr >>> this.nBlockShift;
+            this.aBusBlocks[iBlock].removeBreakpoint(addr & this.nBlockLimit, fWrite);
+        }
+    }
+
+    /**
+     * saveMemory(fAll)
+     *
+     * The only memory blocks we save are those marked as dirty, but most likely all of RAM will have been marked dirty,
+     * and even if our dirty-memory flags were as smart as our dirty-sector flags (ie, were set only when a write changed
+     * what was already there), it's unlikely that would reduce the number of RAM blocks we must save/restore.  At least
+     * all the ROM blocks should be clean (except in the unlikely event that the Debugger was used to modify them).
+     *
+     * All dirty blocks will be stored in a single array, as pairs of block numbers and data arrays, like so:
+     *
+     *      [iBlock0, [dw0, dw1, ...], iBlock1, [dw0, dw1, ...], ...]
+     *
+     * In a normal 4Kb block, there will be 1K DWORD values in the data array.  Remember that each DWORD is a signed 32-bit
+     * integer (because they are formed using bitwise operator rather than floating-point math operators), so don't be
+     * surprised to see negative numbers in the data.
+     *
+     * The above example assumes "uncompressed" data arrays.  If we choose to use "compressed" data arrays, the data arrays
+     * will look like:
+     *
+     *      [count0, dw0, count1, dw1, ...]
+     *
+     * where each count indicates how many times the following DWORD value occurs.  A data array length less than 1K indicates
+     * that it's compressed, since we'll only store them in compressed form if they actually shrank, and we'll use State
+     * helper methods compress() and decompress() to create and expand the compressed data arrays.
+     *
+     * @this {BusPDP10}
+     * @param {boolean} [fAll] (true to save all non-ROM memory blocks, regardless of their dirty flags)
+     * @return {Array} a
+     */
+    saveMemory(fAll)
+    {
+        var i = 0;
+        var a = [];
+
+        for (var iBlock = 0; iBlock < this.nBlockTotal; iBlock++) {
+            var block = this.aBusBlocks[iBlock];
+            /*
+             * We have to check both fDirty and fDirtyEver, because we may have called cleanMemory() on some of
+             * the memory blocks (eg, video memory), and while cleanMemory() will clear a dirty block's fDirty flag,
+             * it also sets the dirty block's fDirtyEver flag, which is left set for the lifetime of the machine.
+             */
+            if (fAll && block.type != MemoryPDP10.TYPE.ROM || block.fDirty || block.fDirtyEver) {
+                a[i++] = iBlock;
+                a[i++] = State.compress(block.save());
+            }
+        }
+
+        return a;
+    }
+
+    /**
+     * restoreMemory(a)
+     *
+     * This restores the contents of all Memory blocks; called by CPUState.restore().
+     *
+     * In theory, we ONLY have to save/restore block contents.  Other block attributes,
+     * like the type, the memory controller (if any), and the active memory access functions,
+     * should already be restored, since every component (re)allocates all the memory blocks
+     * it was using when it's restored.  And since the CPU is guaranteed to be the last
+     * component to be restored, all those blocks (and their attributes) should be in place now.
+     *
+     * See saveMemory() for more information on how the memory block contents are saved.
+     *
+     * @this {BusPDP10}
+     * @param {Array} a
+     * @return {boolean} true if successful, false if not
+     */
+    restoreMemory(a)
+    {
+        var i;
+        for (i = 0; i < a.length - 1; i += 2) {
+            var iBlock = a[i];
+            var adw = a[i+1];
+            if (adw && adw.length < this.nBlockLen) {
+                adw = State.decompress(adw, this.nBlockLen);
+            }
+            var block = this.aBusBlocks[iBlock];
+            if (!block || !block.restore(adw)) {
+                /*
+                 * Either the block to restore hasn't been allocated, indicating a change in the machine
+                 * configuration since it was last saved (the most likely explanation) or there's some internal
+                 * inconsistency (eg, the block size is wrong).
+                 */
+                Component.error("Unable to restore memory block " + iBlock);
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * getMemoryLimit(type)
+     *
+     * @this {BusPDP10}
+     * @param {number} type is one of the MemoryPDP10.TYPE constants
+     * @return {number} (the limiting address of the specified memory type, zero if none)
+     */
+    getMemoryLimit(type)
+    {
+        var addr = 0;
+        for (var iBlock = 0; iBlock < this.aBusBlocks.length; iBlock++) {
+            var block = this.aBusBlocks[iBlock];
+            if (block.type == type) {
+                addr = block.addr + block.used;
+            }
+        }
+        return addr;
+    }
+
+    /**
+     * fault(addr, err, access)
+     *
+     * Bus interface for signaling alignment errors, invalid memory, etc.
+     *
+     * @this {BusPDP10}
+     * @param {number} addr
+     * @param {number} [err]
+     * @param {number} [access] (for diagnostic purposes only)
+     */
+    fault(addr, err, access)
+    {
+        this.fFault = true;
+        if (!this.nDisableFaults) {
+            if (DEBUGGER && this.dbg && this.dbg.messageEnabled(MessagesPDP10.FAULT)) {
+                this.dbg.printMessage("memory fault on " + this.dbg.toStrBase(addr), true, true);
+            }
+            this.cpu.haltCPU();
+        }
+    }
+
+    /**
+     * checkFault()
+     *
+     * This also serves as a clearFault() function.
+     *
+     * @this {BusPDP10}
+     * @return {boolean}
+     */
+    checkFault()
+    {
+        var f = this.fFault;
+        this.fFault = false;
+        return f;
+    }
+
+    /**
+     * reportError(errNum, addr, size, fQuiet)
+     *
+     * @this {BusPDP10}
+     * @param {number} errNum
+     * @param {number} addr
+     * @param {number} size
+     * @param {boolean} [fQuiet] (true if any error should be quietly logged)
+     * @return {boolean} false
+     */
+    reportError(errNum, addr, size, fQuiet)
+    {
+        var sError = "Memory block error (" + errNum + ": " + Str.toHex(addr) + "," + Str.toHex(size) + ")";
+        if (fQuiet) {
+            if (this.dbg) {
+                this.dbg.message(sError);
+            } else {
+                this.log(sError);
+            }
+        } else {
+            Component.error(sError);
+        }
+        return false;
+    }
+}
+
+BusPDP10.ERROR = {
+    RANGE_INUSE:        1,
+    RANGE_INVALID:      2
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp10/lib/device.js (C) Jeff Parsons 2012-2017
+ */
+
+
+class DevicePDP10 extends Component {
+    /**
+     * DevicePDP10(parmsDevice)
+     *
+     * @param {Object} parmsDevice
+     */
+    constructor(parmsDevice)
+    {
+        super("Device", parmsDevice, MessagesPDP10.DEVICE);
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {DevicePDP10}
+     * @param {ComputerPDP10} cmp
+     * @param {BusPDP10} bus
+     * @param {CPUStatePDP10} cpu
+     * @param {DebuggerPDP10} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cmp = cmp;
+        this.cpu = cpu;
+        this.dbg = dbg;
+
+        this.setReady();
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {DevicePDP10}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            if (!data) {
+                this.reset();
+            } else {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {DevicePDP10}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * reset()
+     *
+     * @this {DevicePDP10}
+     */
+    reset()
+    {
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the DevicePDP10 component.
+     *
+     * @this {DevicePDP10}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the DevicePDP10 component.
+     *
+     * @this {DevicePDP10}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        return true;
+    }
+
+    /**
+     * DevicePDP10.init()
+     *
+     * This function operates on every HTML element of class "device", extracting the
+     * JSON-encoded parameters for the DevicePDP10 constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a DevicePDP10 component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeDevice = Component.getElementsByClass(document, PDP10.APPCLASS, "device");
+        for (var iDevice = 0; iDevice < aeDevice.length; iDevice++) {
+            var device;
+            var eDevice = aeDevice[iDevice];
+            var parmsDevice = Component.getComponentParms(eDevice);
+            switch(parmsDevice['type']) {
+            case 'default':
+                device = new DevicePDP10(parmsDevice);
+                Component.bindComponentControls(device, eDevice, PDP10.APPCLASS);
+                break;
+            }
+        }
+    }
+}
+
+/*
+ * Initialize all the DevicePDP10 modules on the page.
+ */
+Web.onInit(DevicePDP10.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp10/lib/memory.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * @class DataView
+ * @property {function(number,boolean):number} getUint8
+ * @property {function(number,number,boolean)} setUint8
+ * @property {function(number,boolean):number} getUint16
+ * @property {function(number,number,boolean)} setUint16
+ * @property {function(number,boolean):number} getInt32
+ * @property {function(number,number,boolean)} setInt32
+ */
+class MemoryPDP10 {
+    /**
+     * MemoryPDP10(bus, addr, used, size, type)
+     *
+     * The Bus component allocates Memory objects so that each has a memory buffer with a
+     * block-granular starting address and an address range equal to bus.nBlockSize; however,
+     * the size of any given Memory object's underlying buffer can be either zero or bus.nBlockSize;
+     * memory read/write functions for empty (buffer-less) blocks are mapped to readNone/writeNone.
+     *
+     * The Bus allocates empty blocks for the entire address space during initialization, so that
+     * any reads/writes to undefined addresses will have no effect.  Later, the ROM and RAM
+     * components will ask the Bus to allocate memory for specific ranges, and the Bus will allocate
+     * as many new blockSize Memory objects as the ranges require.  Partial Memory blocks could
+     * also be supported in theory, but in practice, they're not.
+     *
+     * WARNING: Since Memory blocks are low-level objects that have no UI requirements, they
+     * do not inherit from the Component class, so if you want to use any Component class methods,
+     * such as Component.assert(), use the corresponding Debugger methods instead (assuming a debugger
+     * is available).
+     *
+     * @param {BusPDP10} bus
+     * @param {number|null} [addr] of lowest used address in block
+     * @param {number} [used] portion of block in words (0 for none)
+     * @param {number} [size] of block's buffer in words (0 for none)
+     * @param {number} [type] is one of the MemoryPDP10.TYPE constants (default is MemoryPDP10.TYPE.NONE)
+     */
+    constructor(bus, addr, used, size, type)
+    {
+        var a, i;
+        this.bus = bus;
+        this.id = (MemoryPDP10.idBlock += 2);
+        this.adw = null;
+        this.offset = 0;
+        this.addr = addr;
+        this.used = used;
+        this.size = size || 0;
+        this.type = type || MemoryPDP10.TYPE.NONE;
+        this.fReadOnly = (type == MemoryPDP10.TYPE.ROM);
+        this.dbg = null;
+        this.readWord = this.readWordDirect = this.readNone;
+        this.writeWord = this.writeWordDirect = this.writeNone;
+        this.cReadBreakpoints = this.cWriteBreakpoints = 0;
+        this.copyBreakpoints();     // initialize the block's Debugger info; the caller will reinitialize
+
+        /*
+         * TODO: Study the impact of dirty block tracking.  The original purposes were to allow saveMemory()
+         * to save only dirty blocks, and to enable the Video component to quickly detect changes to the video buffer.
+         *
+         * However, a quick test with dirty block tracking disabled didn't yield a noticeable improvement in performance,
+         * so I think the overhead of our block-based architecture is swamping the impact of these micro-updates.
+         */
+        this.fDirty = this.fDirtyEver = false;
+
+        /*
+         * For empty memory blocks, all we need to do is ensure all access functions are mapped to "none" handlers.
+         */
+        if (!this.size) {
+            this.setAccess();
+            return;
+        }
+
+        /*
+         * This is the normal case: allocate a buffer that provides a word of data per address;
+         * no controller is required because our default memory access functions (see afnMemory)
+         * know how to deal with this simple 1-1 mapping of addresses to words.
+         *
+         * TODO: Consider initializing the memory array to random (or pseudo-random) values in DEBUG
+         * mode; pseudo-random might be best, to help make any bugs reproducible.
+         */
+        a = this.aw = new Array(this.size);
+        for (i = 0; i < a.length; i++) a[i] = 0;
+        this.setAccess(MemoryPDP10.afnMemory);
+    }
+
+    /**
+     * init(addr)
+     *
+     * Quick reinitializer when reusing a Memory block.
+     *
+     * @this {MemoryPDP10}
+     * @param {number} addr
+     */
+    init(addr)
+    {
+        this.addr = addr;
+    }
+
+    /**
+     * clone(mem, type, dbg)
+     *
+     * Converts the current Memory block (this) into a clone of the given Memory block (mem),
+     * and optionally overrides the current block's type with the specified type.
+     *
+     * @this {MemoryPDP10}
+     * @param {MemoryPDP10} mem
+     * @param {number} [type]
+     * @param {DebuggerPDP10} [dbg]
+     */
+    clone(mem, type, dbg)
+    {
+        /*
+         * Original memory block IDs are even; cloned memory block IDs are odd;
+         * the original ID of the current block is lost, but that's OK, since it was presumably
+         * produced merely to become a clone.
+         */
+        this.id = mem.id | 0x1;
+        this.used = mem.used;
+        this.size = mem.size;
+        if (type) {
+            this.type = type;
+            this.fReadOnly = (type == MemoryPDP10.TYPE.ROM);
+        }
+        this.aw = mem.aw;
+        this.setAccess(MemoryPDP10.afnMemory);
+        this.copyBreakpoints(dbg, mem);
+    }
+
+    /**
+     * save()
+     *
+     * This gets the contents of a Memory block as an array of numeric values; used by Bus.saveMemory(),
+     * which in turn is called by CPUState.save().
+     *
+     * @this {MemoryPDP10}
+     * @return {Array.<number>|null}
+     */
+    save()
+    {
+        return this.aw;
+    }
+
+    /**
+     * restore(aw)
+     *
+     * This restores the contents of a Memory block from an array of numeric values; used by Bus.restoreMemory(),
+     * which is called by CPUState.restore(), after all other components have been restored and thus all Memory
+     * blocks have been allocated by their respective components.
+     *
+     * @this {MemoryPDP10}
+     * @param {Array.<number>|null} aw
+     * @return {boolean} true if successful, false if block size mismatch
+     */
+    restore(aw)
+    {
+        if (aw && this.size == aw.length) {
+            this.aw = aw;
+            this.fDirty = true;
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * zero(off, len, pattern)
+     *
+     * @this {MemoryPDP10}
+     * @param {number} [off] (optional starting word offset within block)
+     * @param {number} [len] (optional maximum number of words; default is the entire block)
+     * @param {number} [pattern] (default is zero)
+     */
+    zero(off, len, pattern = 0)
+    {
+        /*
+         * NOTE: If len is larger than the block, that's OK, because we also bounds-check the index.
+         */
+        off = off || 0;
+        if (len === undefined) len = this.size;
+
+
+        /*
+         * Although it's expected that most callers will supply unsigned 36-bit values, we're nice about
+         * converting any signed values to their unsigned (two's complement) counterpart, provided they are
+         * within the acceptable range.  Any values outside that range will be dealt with afterward.
+         */
+        if (pattern < 0 && pattern >= -PDP10.INT_LIMIT) {
+            pattern += PDP10.WORD_LIMIT;
+        }
+        pattern = Math.trunc(Math.abs(pattern)) % PDP10.WORD_LIMIT;
+
+        for (var i = off; len-- && i < this.size; i++) this.writeWordDirect(pattern, off, this.addr + off);
+    }
+
+    /**
+     * setAccess(afn, fDirect)
+     *
+     * The afn parameter should be a 2-entry function table containing word read and write handlers.
+     * See the static afnMemory table for an example.
+     *
+     * If no function table is specified, a default is selected based on the Memory type; similarly,
+     * any undefined entries in the table are filled with default handlers.
+     *
+     * fDirect indicates that both the default AND the direct handlers should be updated.  Direct
+     * handlers normally match the default handlers, except when "checked" handlers are installed;
+     * this allows "checked" handlers to know where to dispatch the call after performing checks.
+     * Examples of checks are read/write breakpoints, but it's really up to the Debugger to decide
+     * what the check consists of.
+     *
+     * @this {MemoryPDP10}
+     * @param {Array.<function()>} [afn] function table
+     * @param {boolean} [fDirect] (true to update direct access functions as well; default is true)
+     */
+    setAccess(afn, fDirect)
+    {
+        if (!afn) {
+
+            afn = MemoryPDP10.afnNone;
+        }
+        this.setReadAccess(afn, fDirect);
+        this.setWriteAccess(afn, fDirect);
+    }
+
+    /**
+     * setReadAccess(afn, fDirect)
+     *
+     * @this {MemoryPDP10}
+     * @param {Array.<function()>} afn
+     * @param {boolean} [fDirect]
+     */
+    setReadAccess(afn, fDirect)
+    {
+        if (!fDirect || !this.cReadBreakpoints) {
+            this.readWord = afn[0] || this.readNone;
+        }
+        if (fDirect || fDirect === undefined) {
+            this.readWordDirect = afn[0] || this.readNone;
+        }
+    }
+
+    /**
+     * setWriteAccess(afn, fDirect)
+     *
+     * @this {MemoryPDP10}
+     * @param {Array.<function()>} afn
+     * @param {boolean} [fDirect]
+     */
+    setWriteAccess(afn, fDirect)
+    {
+        if (!fDirect || !this.cWriteBreakpoints) {
+            this.writeWord = !this.fReadOnly && afn[1] || this.writeNone;
+        }
+        if (fDirect || fDirect === undefined) {
+            this.writeWordDirect = afn[1] || this.writeNone;
+        }
+    }
+
+    /**
+     * resetReadAccess()
+     *
+     * @this {MemoryPDP10}
+     */
+    resetReadAccess()
+    {
+        this.readWord = this.readWordDirect;
+    }
+
+    /**
+     * resetWriteAccess()
+     *
+     * @this {MemoryPDP10}
+     */
+    resetWriteAccess()
+    {
+        this.writeWord = this.fReadOnly? this.writeNone : this.writeWordDirect;
+    }
+
+    /**
+     * printAddr(sMessage)
+     *
+     * @this {MemoryPDP10}
+     * @param {string} sMessage
+     */
+    printAddr(sMessage)
+    {
+        if (DEBUG && this.dbg && this.dbg.messageEnabled(MessagesPDP10.MEMORY)) {
+            this.dbg.printMessage(sMessage + ' ' + (this.addr != null? ('@' + this.dbg.toStrBase(this.addr)) : '#' + this.id), true);
+        }
+    }
+
+    /**
+     * addBreakpoint(off, fWrite)
+     *
+     * @this {MemoryPDP10}
+     * @param {number} off
+     * @param {boolean} fWrite
+     */
+    addBreakpoint(off, fWrite)
+    {
+        if (!fWrite) {
+            if (this.cReadBreakpoints++ === 0) {
+                this.setReadAccess(MemoryPDP10.afnChecked, false);
+            }
+            if (DEBUG) this.printAddr("read breakpoint added to memory block");
+        }
+        else {
+            if (this.cWriteBreakpoints++ === 0) {
+                this.setWriteAccess(MemoryPDP10.afnChecked, false);
+            }
+            if (DEBUG) this.printAddr("write breakpoint added to memory block");
+        }
+    }
+
+    /**
+     * removeBreakpoint(off, fWrite)
+     *
+     * @this {MemoryPDP10}
+     * @param {number} off
+     * @param {boolean} fWrite
+     */
+    removeBreakpoint(off, fWrite)
+    {
+        if (!fWrite) {
+            if (--this.cReadBreakpoints === 0) {
+                this.resetReadAccess();
+                if (DEBUG) this.printAddr("all read breakpoints removed from memory block");
+            }
+
+        }
+        else {
+            if (--this.cWriteBreakpoints === 0) {
+                this.resetWriteAccess();
+                if (DEBUG) this.printAddr("all write breakpoints removed from memory block");
+            }
+
+        }
+    }
+
+    /**
+     * copyBreakpoints(dbg, mem)
+     *
+     * @this {MemoryPDP10}
+     * @param {DebuggerPDP10} [dbg]
+     * @param {MemoryPDP10} [mem] (outgoing MemoryPDP10 block to copy breakpoints from, if any)
+     */
+    copyBreakpoints(dbg, mem)
+    {
+        this.dbg = dbg;
+        this.cReadBreakpoints = this.cWriteBreakpoints = 0;
+        if (mem) {
+            if ((this.cReadBreakpoints = mem.cReadBreakpoints)) {
+                this.setReadAccess(MemoryPDP10.afnChecked, false);
+            }
+            if ((this.cWriteBreakpoints = mem.cWriteBreakpoints)) {
+                this.setWriteAccess(MemoryPDP10.afnChecked, false);
+            }
+        }
+    }
+
+    /**
+     * readNone(off, addr)
+     *
+     * @this {MemoryPDP10}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readNone(off, addr)
+    {
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(MessagesPDP10.MEMORY) /* && !off */) {
+            this.dbg.printMessage("attempt to read invalid address " + this.dbg.toStrBase(addr), true);
+        }
+        this.bus.fault(addr);
+        return PDP10.WORD_INVALID;
+    }
+
+    /**
+     * writeNone(v, off, addr)
+     *
+     * @this {MemoryPDP10}
+     * @param {number} v
+     * @param {number} off
+     * @param {number} addr
+     */
+    writeNone(v, off, addr)
+    {
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(MessagesPDP10.MEMORY) /* && !off */) {
+            this.dbg.printMessage("attempt to write " + this.dbg.toStrBase(v) + " to invalid addresses " + this.dbg.toStrBase(addr), true);
+        }
+        this.bus.fault(addr);
+    }
+
+    /**
+     * readWordMemory(off, addr)
+     *
+     * @this {MemoryPDP10}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readWordMemory(off, addr)
+    {
+        var w = this.aw[off];
+
+        return w;
+    }
+
+    /**
+     * writeWordMemory(w, off, addr)
+     *
+     * @this {MemoryPDP10}
+     * @param {number} w
+     * @param {number} off
+     * @param {number} addr
+     */
+    writeWordMemory(w, off, addr)
+    {
+
+        if (this.aw[off] != w) {
+            this.aw[off] = w;
+            this.fDirty = true;
+        }
+    }
+
+    /**
+     * readWordChecked(off, addr)
+     *
+     * @this {MemoryPDP10}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readWordChecked(off, addr)
+    {
+        if (DEBUGGER && this.dbg && this.addr != null) {
+            this.dbg.checkMemoryRead(this.addr + off, 2);
+        }
+        return this.readWordDirect(off, addr);
+    }
+
+    /**
+     * writeWordChecked(w, off, addr)
+     *
+     * @this {MemoryPDP10}
+     * @param {number} w
+     * @param {number} off
+     * @param {number} addr
+     */
+    writeWordChecked(w, off, addr)
+    {
+        if (DEBUGGER && this.dbg && this.addr != null) {
+            this.dbg.checkMemoryWrite(this.addr + off, 2)
+        }
+        if (this.fReadOnly) this.writeNone(w, off, addr); else this.writeWordDirect(w, off, addr);
+    }
+}
+
+/*
+ * Basic memory types
+ *
+ * RAM is the most conventional memory type, providing full read/write capability.  ROM is equally
+ * conventional, except that the fReadOnly property is set.  ROM can be written using the Bus setWordDirect()
+ * interface (which in turn uses the Memory writeWordDirect() interface), allowing the ROM component to
+ * initialize its own memory.
+ */
+MemoryPDP10.TYPE = {
+    NONE:       0,
+    RAM:        1,
+    ROM:        2
+};
+MemoryPDP10.TYPE_COLORS = ["black", "blue", "green"];
+MemoryPDP10.TYPE_NAMES  = ["NONE",  "RAM",  "ROM"];
+
+/*
+ * Last used block ID (used for debugging only)
+ */
+MemoryPDP10.idBlock = 0;
+
+/*
+ * This is the effective definition of afnNone, but we need not fully define it, because setAccess()
+ * uses these defaults when any of the handlers are undefined.
+ *
+MemoryPDP10.afnNone = [
+    MemoryPDP10.prototype.readNone,
+    MemoryPDP10.prototype.writeNone
+];
+ */
+MemoryPDP10.afnNone = [];
+
+MemoryPDP10.afnMemory = [
+    MemoryPDP10.prototype.readWordMemory,
+    MemoryPDP10.prototype.writeWordMemory
+];
+
+MemoryPDP10.afnChecked = [
+    MemoryPDP10.prototype.readWordChecked,
+    MemoryPDP10.prototype.writeWordChecked
+];
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp10/lib/cpu.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * @class CPUPDP10
+ * @unrestricted
+ */
+class CPUPDP10 extends Component {
+    /**
+     * CPUPDP10(parmsCPU, nCyclesDefault)
+     *
+     * The CPUPDP10 class supports the following (parmsCPU) properties:
+     *
+     *      cycles: the machine's base cycles per second; the CPUStatePDP10 constructor
+     *      will provide us with a default (based on the CPU model) to use as a fallback.
+     *
+     *      multiplier: base cycle multiplier; default is 1.
+     *
+     *      autoStart: true to automatically start, false to not, or null if "it depends";
+     *      null is the default, which means do not autostart UNLESS there is no Debugger
+     *      and no "Run" button (ie, no way to manually start the machine).
+     *
+     *      csStart: the number of cycles that runCPU() must wait before generating
+     *      checksum records; -1 if disabled. checksum records are a diagnostic aid
+     *      used to help compare one CPU run to another.
+     *
+     *      csInterval: the number of cycles that runCPU() must execute before generating
+     *      a checksum record; -1 if disabled.
+     *
+     *      csStop: the number of cycles to stop generating checksum records.
+     *
+     * This component is primarily responsible for interfacing the CPU with the outside
+     * world (eg, Panel and Debugger components), and managing overall CPU operation.
+     *
+     * It is extended by the CPUStatePDP10 component, where the simulation control logic resides.
+     *
+     * @param {Object} parmsCPU
+     * @param {number} nCyclesDefault
+     */
+    constructor(parmsCPU, nCyclesDefault)
+    {
+        super("CPU", parmsCPU, MessagesPDP10.CPU);
+
+        var nCycles = +parmsCPU['cycles'] || nCyclesDefault;
+
+        var nMultiplier = +parmsCPU['multiplier'] || 1;
+
+        this.nDisplayCount = 0;
+        this.nDisplayLimit = 30;
+        this.nCyclesPerSecond = nCycles;
+
+        /*
+         * nCyclesMultiplier replaces the old "speed" variable (0, 1, 2) and eliminates the need for
+         * the constants (SPEED_SLOW, SPEED_FAST and SPEED_MAX).  The UI simply doubles the multiplier
+         * until we've exceeded the host's speed limit and then starts the multiplier over at 1.
+         */
+        this.nCyclesMultiplier = nMultiplier;
+        this.mhzDefault = Math.round(this.nCyclesPerSecond / 10000) / 100;
+        this.mhzTarget = this.mhzDefault * this.nCyclesMultiplier;
+        this.msPerYield = this.nCyclesPerYield = this.nCyclesNextYield = this.nCyclesRecalc = 0;
+
+        /*
+         * We add a number of flags to the set initialized by Component
+         */
+        this.flags.running = this.flags.starting = false;
+        this.flags.autoStart = parmsCPU['autoStart'];
+        if (typeof this.flags.autoStart == "string") this.flags.autoStart = (this.flags.autoStart == "true");
+
+        /*
+         * Get checksum parameters, if any. runCPU() behavior is not affected until fChecksum
+         * is true, which won't happen until resetChecksum() is called with nCyclesChecksumInterval
+         * ("csInterval") set to a positive value.
+         *
+         * As above, any of these parameters can also be set with the Debugger's execution options
+         * command ("x"); for example, "x cs int 5000" will set nCyclesChecksumInterval to 5000
+         * and call resetChecksum().
+         */
+        this.flags.checksum = false;
+        this.nChecksum = this.nCyclesChecksumNext = 0;
+        this.nCyclesChecksumStart = +parmsCPU["csStart"];
+        this.nCyclesChecksumInterval = +parmsCPU["csInterval"];
+        this.nCyclesChecksumStop = +parmsCPU["csStop"];
+
+        /*
+         * Array of countdown timers managed by addTimer() and setTimer().
+         */
+        this.aTimers = [];
+
+        this.onRunTimeout = this.runCPU.bind(this); // function onRunTimeout() { cpu.runCPU(); };
+
+        /*
+         * Define the rest of the properties used by the class
+         */
+        this.mhz = 0;
+        this.nYieldsSinceStatusUpdate = 0;
+        this.msStartRun = this.msStartThisRun = this.msEndThisRun = this.nCyclesThisRun = 0;
+        this.nTotalCycles = this.nRunCycles = this.nBurstCycles = this.nStepCycles = this.nSnapCycles = 0;
+        this.panel = null;
+
+        this.setReady();
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {CPUPDP10}
+     * @param {ComputerPDP10} cmp
+     * @param {BusPDP10} bus
+     * @param {CPUPDP10} cpu
+     * @param {DebuggerPDP10} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cmp = cmp;
+        this.bus = bus;
+        this.dbg = dbg;
+        this.panel = cmp.panel;
+        for (var i = 0; i < CPUPDP10.BUTTONS.length; i++) {
+            var control = this.bindings[CPUPDP10.BUTTONS[i]];
+            if (control) this.cmp.setBinding(null, CPUPDP10.BUTTONS[i], control);
+        }
+        this.setReady();
+    }
+
+    /**
+     * reset()
+     *
+     * Stub for reset notification (overridden by the CPUStatePDP10 component).
+     *
+     * @this {CPUPDP10}
+     */
+    reset()
+    {
+    }
+
+    /**
+     * save()
+     *
+     * Stub for save support (overridden by the CPUStatePDP10 component).
+     *
+     * @this {CPUPDP10}
+     * @return {Object|null}
+     */
+    save()
+    {
+        return null;
+    }
+
+    /**
+     * restore(data)
+     *
+     * Stub for restore support (overridden by the CPUStatePDP10 component).
+     *
+     * @this {CPUPDP10}
+     * @param {Object} data
+     * @return {boolean} true if restore successful, false if not
+     */
+    restore(data)
+    {
+        return false;
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {CPUPDP10}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        /*
+         * We've already saved the parmsCPU 'autoStart' setting, but there may be a machine (or URL) override.
+         */
+        var sAutoStart = this.cmp.getMachineParm('autoStart');
+        if (sAutoStart != null) {
+            this.flags.autoStart = (sAutoStart == "true"? true : (sAutoStart  == "false"? false : !!sAutoStart));
+        }
+        else if (this.flags.autoStart == null) {
+            /*
+             * If there's no explicit parmsCPU setting either, then we will autoStart if there's no Debugger and
+             * no "Run" button.
+             */
+            this.flags.autoStart = ((!DEBUGGER || !this.dbg) && this.bindings["run"] === undefined);
+        }
+
+        if (!fRepower) {
+            if (!data) {
+                this.reset();
+            } else {
+                this.resetCycles();
+                if (!this.restore(data)) return false;
+                this.resetChecksum();
+            }
+            /*
+             * Give the Debugger a chance to do/print something once we've powered up.
+             */
+            if (DEBUGGER && this.dbg) {
+                this.dbg.init(this.flags.autoStart);
+            } else {
+                /*
+                 * The Computer (this.cmp) knows if there's a Control Panel (this.panel), and the Control Panel
+                 * knows if there's a "print" control (this.panel.controlPrint), and if there IS a "print" control
+                 * but no debugger, the machine is probably misconfigured (most likely, the page simply neglected to
+                 * load the Debugger component).
+                 *
+                 * However, we don't actually need to check all that; it's always safe use println(), regardless whether
+                 * a Control Panel with a "print" control is present or not.
+                 */
+                this.status("No debugger detected");
+            }
+            if (!this.flags.autoStart) {
+                this.println("CPU will not be auto-started " + (this.panel? "(click Run to start)" : "(type 'go' to start)"));
+            }
+        }
+        /*
+         * The Computer component (which is responsible for all powerDown and powerUp notifications)
+         * is now responsible for managing a component's fPowered flag, not us.
+         *
+         *      this.flags.powered = true;
+         */
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {CPUPDP10}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * autoStart()
+     *
+     * @this {CPUPDP10}
+     * @return {boolean} true if started, false if not
+     */
+    autoStart()
+    {
+        if (this.flags.running) {
+            return true;
+        }
+        if (this.flags.autoStart) {
+            /*
+             * We used to also set fUpdateFocus when calling startCPU(), on the assumption that in the "auto-starting"
+             * context, a machine without focus is like a day without sunshine, but in reality, focus should only be
+             * forced when the user takes some other machine-related action.
+             */
+            this.startCPU();
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * isPowered()
+     *
+     * @this {CPUPDP10}
+     * @return {boolean}
+     */
+    isPowered()
+    {
+        if (!this.flags.powered) {
+            this.println(this.toString() + " not powered");
+            return false;
+        }
+        return true;
+    }
+
+    /**
+     * isRunning()
+     *
+     * @this {CPUPDP10}
+     * @return {boolean}
+     */
+    isRunning()
+    {
+        return this.flags.running;
+    }
+
+    /**
+     * getChecksum()
+     *
+     * This will be implemented by the CPUStatePDP10 component.
+     *
+     * @this {CPUPDP10}
+     * @return {number} a 32-bit summation of key elements of the current CPU state (used by the CPU checksum code)
+     */
+    getChecksum()
+    {
+        return 0;
+    }
+
+    /**
+     * resetChecksum()
+     *
+     * If checksum generation is enabled (fChecksum is true), this resets the running 32-bit checksum and the
+     * cycle counter that will trigger the next displayChecksum(); called by resetCycles(), which is called whenever
+     * the CPU is reset or restored.
+     *
+     * @this {CPUPDP10}
+     * @return {boolean} true if checksum generation enabled, false if not
+     */
+    resetChecksum()
+    {
+        if (this.nCyclesChecksumStart === undefined) this.nCyclesChecksumStart = 0;
+        if (this.nCyclesChecksumInterval === undefined) this.nCyclesChecksumInterval = -1;
+        if (this.nCyclesChecksumStop === undefined) this.nCyclesChecksumStop = -1;
+        this.flags.checksum = (this.nCyclesChecksumStart >= 0 && this.nCyclesChecksumInterval > 0);
+        if (this.flags.checksum) {
+            this.nChecksum = 0;
+            this.nCyclesChecksumNext = this.nCyclesChecksumStart - this.nTotalCycles;
+            /*
+             *  this.nCyclesChecksumNext = this.nCyclesChecksumStart + this.nCyclesChecksumInterval -
+             *      (this.nTotalCycles % this.nCyclesChecksumInterval);
+             */
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * updateChecksum(nCycles)
+     *
+     * When checksum generation is enabled (fChecksum is true), runCPU() asks stepCPU() to execute a minimum
+     * number of cycles (1), effectively limiting execution to a single instruction, and then we're called with
+     * the exact number cycles that were actually executed.  This should give us instruction-granular checksums
+     * at precise intervals that are 100% repeatable.
+     *
+     * @this {CPUPDP10}
+     * @param {number} nCycles
+     */
+    updateChecksum(nCycles)
+    {
+        if (this.flags.checksum) {
+            /*
+             * Get a 32-bit summation of the current CPU state and add it to our running 32-bit checksum
+             */
+            var fDisplay = false;
+            this.nChecksum = (this.nChecksum + this.getChecksum())|0;
+            this.nCyclesChecksumNext -= nCycles;
+            if (this.nCyclesChecksumNext <= 0) {
+                this.nCyclesChecksumNext += this.nCyclesChecksumInterval;
+                fDisplay = true;
+            }
+            if (this.nCyclesChecksumStop >= 0) {
+                if (this.nCyclesChecksumStop <= this.getCycles()) {
+                    this.nCyclesChecksumInterval = this.nCyclesChecksumStop = -1;
+                    this.resetChecksum();
+                    this.stopCPU();
+                    fDisplay = true;
+                }
+            }
+            if (fDisplay) this.displayChecksum();
+        }
+    }
+
+    /**
+     * displayChecksum()
+     *
+     * When checksum generation is enabled (fChecksum is true), this is called to provide a crude log of all
+     * checksums generated at the specified cycle intervals, as specified by the "csStart" and "csInterval" parmsCPU
+     * properties).
+     *
+     * @this {CPUPDP10}
+     */
+    displayChecksum()
+    {
+        this.println(this.getCycles() + " cycles: " + "checksum=" + Str.toHex(this.nChecksum));
+    }
+
+    /**
+     * setBinding(sType, sBinding, control, sValue)
+     *
+     * @this {CPUPDP10}
+     * @param {string|null} sType is the type of the HTML control (eg, "button", "textarea", "register", "flag", "rled", etc)
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "run")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sType, sBinding, control, sValue)
+    {
+        var cpu = this;
+
+        switch (sBinding) {
+        case "power":
+        case "reset":
+            /*
+             * The "power" and "reset" buttons are functions of the entire computer, not just the CPU,
+             * but it's not always convenient to stick a power button in the Computer component definition,
+             * so we record those bindings here and pass them on to the Computer component in initBus().
+             */
+            this.bindings[sBinding] = control;
+            return true;
+
+        case "run":
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickRun() {
+                if (!cpu.cmp || !cpu.cmp.checkPower()) return;
+                /*
+                 * We no longer pass true to these startCPU()/stopCPU() calls, on the theory that if the "run"
+                 * control is visible, then the computer is probably sufficiently visible as well; the problem
+                 * with setting fUpdateFocus to true is that it can jerk the web page around in annoying ways.
+                 */
+                if (!cpu.flags.running)
+                    cpu.startCPU();
+                else
+                    cpu.stopCPU();
+            };
+            return true;
+
+        case "speed":
+            this.bindings[sBinding] = control;
+            return true;
+
+        case "setSpeed":
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickSetSpeed() {
+                cpu.setSpeed(cpu.nCyclesMultiplier << 1, true);
+            };
+            control.textContent = this.getSpeedTarget();
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * updateDisplays(nUpdate)
+     *
+     * Simpler wrapper around the Computer's updateDisplays() method.
+     *
+     * @this {CPUPDP10}
+     * @param {number} [nUpdate] (1 for periodic, -1 for forced, 0 or undefined otherwise)
+     */
+    updateDisplays(nUpdate)
+    {
+        if (this.cmp) this.cmp.updateDisplays(nUpdate);
+    }
+
+    /**
+     * updateDisplay(nUpdate)
+     *
+     * Some of the CPU bindings provide feedback and therefore need to be updated periodically.
+     * However, this should be called via the Computer's updateDisplays() interface, not directly.
+     *
+     * @this {CPUPDP10}
+     * @param {number} [nUpdate] (1 for periodic, -1 for forced, 0 otherwise)
+     */
+    updateDisplay(nUpdate)
+    {
+        var controlSpeed = this.bindings["speed"];
+        if (controlSpeed) {
+            if (nUpdate <= 0 || (this.nDisplayCount += nUpdate) >= this.nDisplayLimit) {
+                controlSpeed.textContent = this.getSpeedCurrent();
+                this.nDisplayCount = 0;
+            }
+        }
+    }
+
+    /**
+     * addCycles(nCycles, fEndStep)
+     *
+     * @this {CPUPDP10}
+     * @param {number} nCycles
+     * @param {boolean} [fEndStep]
+     */
+    addCycles(nCycles, fEndStep)
+    {
+        this.nTotalCycles += nCycles;
+        if (fEndStep) {
+            this.nBurstCycles = this.nStepCycles = this.nSnapCycles = 0;
+        }
+    }
+
+    /**
+     * calcCycles(fRecalc)
+     *
+     * Calculate the number of cycles to process for each "burst" of CPU activity.  The size of a burst
+     * is driven by YIELDS_PER_SECOND (eg, 30).
+     *
+     * At the end of each burst, we subtract burst cycles from the yield cycle "threshold" counter.
+     * Whenever the "next yield" cycle counter goes to (or below) zero, we compare elapsed time to the time
+     * we expected the virtual hardware to take (eg, 1000ms/50 or 20ms), and if we still have time remaining,
+     * we sleep the remaining time (or 0ms if there's no remaining time), and then restart runCPU().
+     *
+     * @this {CPUPDP10}
+     * @param {boolean} [fRecalc] is true if the caller wants to recalculate thresholds based on the most recent
+     * speed calculation (see calcSpeed).
+     */
+    calcCycles(fRecalc)
+    {
+        /*
+         * Calculate "per" yield values.
+         */
+        var vMultiplier = 1;
+        if (fRecalc) {
+            if (this.nCyclesMultiplier > 1 && this.mhz) {
+                vMultiplier = (this.mhz / this.mhzDefault);
+            }
+        }
+
+        this.msPerYield = Math.round(1000 / CPUPDP10.YIELDS_PER_SECOND);
+        this.nCyclesPerYield = Math.floor(this.nCyclesPerSecond / CPUPDP10.YIELDS_PER_SECOND * vMultiplier);
+
+        /*
+         * And initialize "next" yield values to the "per" values.
+         */
+        if (!fRecalc) this.nCyclesNextYield = this.nCyclesPerYield;
+        this.nCyclesRecalc = 0;
+    }
+
+    /**
+     * getCycles(fScaled)
+     *
+     * getCycles() returns the number of cycles executed so far.  Note that we can be called after
+     * runCPU() OR during runCPU(), perhaps from a handler triggered during the current run's stepCPU(),
+     * so nRunCycles must always be adjusted by number of cycles stepCPU() was asked to run (nBurstCycles),
+     * less the number of cycles it has yet to run (nStepCycles).
+     *
+     * nRunCycles is zeroed whenever the CPU is halted or the CPU speed is changed, which is why we also
+     * have nTotalCycles, which accumulates all nRunCycles before we zero it.  However, nRunCycles and
+     * nTotalCycles eventually get reset by calcSpeed(), to avoid overflow, so components that rely on
+     * getCycles() returning steadily increasing values should also be prepared for a reset at any time.
+     *
+     * @this {CPUPDP10}
+     * @param {boolean} [fScaled] is true if the caller wants a cycle count relative to a multiplier of 1
+     * @return {number}
+     */
+    getCycles(fScaled)
+    {
+        var nCycles = this.nTotalCycles + this.nRunCycles + this.nBurstCycles - this.nStepCycles;
+        if (fScaled && this.nCyclesMultiplier > 1 && this.mhz > this.mhzDefault) {
+            /*
+             * We could scale the current cycle count by the current effective speed (this.mhz); eg:
+             *
+             *      nCycles = Math.round(nCycles / (this.mhz / this.mhzDefault));
+             *
+             * but that speed will fluctuate somewhat: large fluctuations at first, but increasingly smaller
+             * fluctuations after each burst of instructions that runCPU() executes.
+             *
+             * Alternatively, we can scale the cycle count by the multiplier, which is good in that the
+             * multiplier doesn't vary once the user changes it, but a potential downside is that the
+             * multiplier might be set too high, resulting in a target speed that's higher than the effective
+             * speed is able to reach.
+             *
+             * Also, if multipliers were always limited to a power-of-two, then this could be calculated
+             * with a simple shift.  However, only the "setSpeed" UI binding limits it that way; the Debugger
+             * interface allows any value, as does the CPU "multiplier" parmsCPU property (from the machine's
+             * XML file).
+             */
+            nCycles = Math.round(nCycles / this.nCyclesMultiplier);
+        }
+        return nCycles;
+    }
+
+    /**
+     * getCyclesPerSecond()
+     *
+     * This returns the CPU's "base" speed (ie, the original cycles per second defined for the machine)
+     *
+     * @this {CPUPDP10}
+     * @return {number}
+     */
+    getCyclesPerSecond()
+    {
+        return this.nCyclesPerSecond;
+    }
+
+    /**
+     * resetCycles()
+     *
+     * Resets speed and cycle information as part of any reset() or restore(); this typically occurs during powerUp().
+     * It's important that this be called BEFORE the actual restore() call, because restore() may want to call setSpeed(),
+     * which in turn assumes that all the cycle counts have been initialized to sensible values.
+     *
+     * @this {CPUPDP10}
+     */
+    resetCycles()
+    {
+        this.mhz = 0;
+        this.nYieldsSinceStatusUpdate = 0;
+        this.nTotalCycles = this.nRunCycles = this.nBurstCycles = this.nStepCycles = this.nSnapCycles = 0;
+        this.resetChecksum();
+        this.setSpeed(1);
+    }
+
+    /**
+     * getSpeed()
+     *
+     * @this {CPUPDP10}
+     * @return {number} the current speed multiplier
+     */
+    getSpeed()
+    {
+        return this.nCyclesMultiplier;
+    }
+
+    /**
+     * getSpeedCurrent()
+     *
+     * @this {CPUPDP10}
+     * @return {string} the current speed, in mhz, as a string formatted to two decimal places
+     */
+    getSpeedCurrent()
+    {
+        /*
+         * TODO: Has toFixed() been "fixed" in all browsers (eg, IE) to return a rounded value now?
+         */
+        return ((this.flags.running)? (this.mhz.toFixed(2) + "Mhz") : "Stopped");
+    }
+
+    /**
+     * getSpeedTarget()
+     *
+     * @this {CPUPDP10}
+     * @return {string} the target speed, in mhz, as a string formatted to two decimal places
+     */
+    getSpeedTarget()
+    {
+        /*
+         * TODO: Has toFixed() been "fixed" in all browsers (eg, IE) to return a rounded value now?
+         */
+        return this.mhzTarget.toFixed(2) + "Mhz";
+    }
+
+    /**
+     * setSpeed(nMultiplier, fUpdateFocus)
+     *
+     * NOTE: This used to return the target speed, in mhz, but no callers appear to care at this point.
+     *
+     * @desc Whenever the speed is changed, the running cycle count and corresponding start time must be reset,
+     * so that the next effective speed calculation obtains sensible results.  In fact, when runCPU() initially calls
+     * setSpeed() with no parameters, that's all this function does (it doesn't change the current speed setting).
+     *
+     * @this {CPUPDP10}
+     * @param {number} [nMultiplier] is the new proposed multiplier (reverts to 1 if the target was too high)
+     * @param {boolean} [fUpdateFocus] is true to update Computer focus
+     * @return {boolean} true if successful, false if not
+     */
+    setSpeed(nMultiplier, fUpdateFocus)
+    {
+        var fSuccess = false;
+        if (nMultiplier !== undefined) {
+            /*
+             * If we haven't reached 80% (0.8) of the current target speed, revert to a multiplier of one (1).
+             */
+            if (this.mhz / this.mhzTarget < 0.8) {
+                nMultiplier = 1;
+            } else {
+                fSuccess = true;
+            }
+            this.nCyclesMultiplier = nMultiplier;
+            var mhz = this.mhzDefault * this.nCyclesMultiplier;
+            if (this.mhzTarget != mhz) {
+                this.mhzTarget = mhz;
+                var sSpeed = this.getSpeedTarget();
+                var controlSpeed = this.bindings["setSpeed"];
+                if (controlSpeed) controlSpeed.textContent = sSpeed;
+                this.println("target speed: " + sSpeed);
+            }
+            if (fUpdateFocus && this.cmp) this.cmp.setFocus();
+        }
+        this.addCycles(this.nRunCycles);
+        this.nRunCycles = 0;
+        this.msStartRun = Component.getTime();
+        this.msEndThisRun = 0;
+        this.calcCycles();
+        return fSuccess;
+    }
+
+    /**
+     * calcSpeed(nCycles, msElapsed)
+     *
+     * @this {CPUPDP10}
+     * @param {number} nCycles
+     * @param {number} msElapsed
+     */
+    calcSpeed(nCycles, msElapsed)
+    {
+        if (msElapsed) {
+            this.mhz = Math.round(nCycles / (msElapsed * 10)) / 100;
+            if (msElapsed >= 86400000) {
+                this.nTotalCycles = 0;
+                this.setSpeed();        // reset all counters once per day so that we never have to worry about overflow
+            }
+        }
+    }
+
+    /**
+     * calcStartTime()
+     *
+     * @this {CPUPDP10}
+     */
+    calcStartTime()
+    {
+        if (this.nCyclesRecalc >= this.nCyclesPerSecond) {
+            this.calcCycles(true);
+        }
+        this.nCyclesThisRun = 0;
+        this.msStartThisRun = Component.getTime();
+
+        /*
+         * Try to detect situations where the browser may have throttled us, such as when the user switches
+         * to a different tab; in those situations, Chrome and Safari may restrict setTimeout() callbacks
+         * to roughly one per second.
+         *
+         * Another scenario: the user resizes the browser window.  setTimeout() callbacks are not throttled,
+         * but there can still be enough of a lag between the callbacks that CPU speed will be noticeably
+         * erratic if we don't compensate for it here.
+         *
+         * We can detect throttling/lagging by verifying that msEndThisRun (which was set at the end of the
+         * previous run and includes any requested sleep time) is comparable to the current msStartThisRun;
+         * if the delta is significant, we compensate by bumping msStartRun forward by that delta.
+         *
+         * This shouldn't be triggered when the Debugger halts the CPU, because setSpeed() -- which is called
+         * whenever the CPU starts running again -- zeroes msEndThisRun.
+         *
+         * This also won't do anything about other internal delays; for example, Debugger message() calls.
+         * By the time the message() function has called yieldCPU(), the cost of the message has already been
+         * incurred, so it will be end up being charged against the instruction(s) that triggered it.
+         *
+         * TODO: Consider calling yieldCPU() sooner from message(), so that it can arrange for the msEndThisRun
+         * "snapshot" to occur sooner; it's unclear, however, whether that will really improve the CPU's ability
+         * to hit its target speed, since you would expect any instruction that displays a message to be an
+         * EXTREMELY slow instruction.
+         */
+        if (this.msEndThisRun) {
+            var msDelta = this.msStartThisRun - this.msEndThisRun;
+            if (msDelta > this.msPerYield) {
+                if (MAXDEBUG) this.println("large time delay: " + msDelta + "ms");
+                this.msStartRun += msDelta;
+                /*
+                 * Bumping msStartRun forward should NEVER cause it to exceed msStartThisRun; however, just
+                 * in case, I make absolutely sure it cannot happen, since doing so could result in negative
+                 * speed calculations.
+                 */
+
+                if (this.msStartRun > this.msStartThisRun) {
+                    this.msStartRun = this.msStartThisRun;
+                }
+            }
+        }
+    }
+
+    /**
+     * calcRemainingTime()
+     *
+     * @this {CPUPDP10}
+     * @return {number}
+     */
+    calcRemainingTime()
+    {
+        this.msEndThisRun = Component.getTime();
+
+        var msYield = this.msPerYield;
+        if (this.nCyclesThisRun) {
+            /*
+             * Normally, we would assume we executed a full quota of work over msPerYield, but since the CPU
+             * now has the option of calling yieldCPU(), that might not be true.  If nCyclesThisRun is correct, then
+             * the ratio of nCyclesThisRun/nCyclesPerYield should represent the percentage of work we performed,
+             * and so applying that percentage to msPerYield should give us a better estimate of work vs. time.
+             */
+            msYield = Math.round(msYield * this.nCyclesThisRun / this.nCyclesPerYield);
+        }
+
+        var msElapsedThisRun = this.msEndThisRun - this.msStartThisRun;
+        var msRemainsThisRun = msYield - msElapsedThisRun;
+
+        /*
+         * We could pass only "this run" results to calcSpeed():
+         *
+         *      nCycles = this.nCyclesThisRun;
+         *      msElapsed = msElapsedThisRun;
+         *
+         * but it seems preferable to use longer time periods and hopefully get a more accurate speed.
+         *
+         * Also, if msRemainsThisRun >= 0 && this.nCyclesMultiplier == 1, we could pass these results instead:
+         *
+         *      nCycles = this.nCyclesThisRun;
+         *      msElapsed = this.msPerYield;
+         *
+         * to insure that we display a smooth, constant N Mhz.  But for now, I prefer seeing any fluctuations.
+         */
+        var nCycles = this.nRunCycles;
+        var msElapsed = this.msEndThisRun - this.msStartRun;
+
+        if (MAXDEBUG && msRemainsThisRun < 0 && this.nCyclesMultiplier > 1) {
+            this.println("warning: updates @" + msElapsedThisRun + "ms (prefer " + Math.round(msYield) + "ms)");
+        }
+
+        this.calcSpeed(nCycles, msElapsed);
+
+        if (msRemainsThisRun < 0 || this.mhz < this.mhzTarget) {
+            /*
+             * Try "throwing out" the effects of large anomalies, by moving the overall run start time up;
+             * ordinarily, this should only happen when the someone is using an external Debugger or some other
+             * tool or feature that is interfering with our overall execution.
+             */
+            if (msRemainsThisRun < -1000) {
+                this.msStartRun -= msRemainsThisRun;
+            }
+            /*
+             * If the last burst took MORE time than we allotted (ie, it's taking more than 1 second to simulate
+             * nCyclesPerSecond), all we can do is yield for as little time as possible (ie, 0ms) and hope that the
+             * simulation is at least usable.
+             */
+            msRemainsThisRun = 0;
+        }
+
+        /*
+         * Last but not least, update nCyclesRecalc, so that when runCPU() starts up again and calls calcStartTime(),
+         * it'll be ready to decide if calcCycles() should be called again.
+         */
+        this.nCyclesRecalc += this.nCyclesThisRun;
+
+        if (DEBUG && this.messageEnabled(MessagesPDP10.LOG) && msRemainsThisRun) {
+            this.log("calcRemainingTime: " + msRemainsThisRun + "ms to sleep after " + this.msEndThisRun + "ms");
+        }
+
+        this.msEndThisRun += msRemainsThisRun;
+        return msRemainsThisRun;
+    }
+
+    /**
+     * addTimer(callBack)
+     *
+     * Components that want to have timers that periodically fire after some number of milliseconds call
+     * addTimer() to create the timer, and then setTimer() every time they want to arm it.  There is currently
+     * no removeTimer() because these are generally used for the entire lifetime of a component.
+     *
+     * Internally, each timer entry is a preallocated Array with two entries: a cycle countdown in element [0]
+     * and a callback function in element [1].  A timer is initially dormant; dormant timers have a countdown
+     * value of -1 (although any negative number will suffice) and active timers have a non-negative value.
+     *
+     * Why not use JavaScript's setTimeout() instead?  Good question.  For a good answer, see setTimer() below.
+     *
+     * TODO: Consider making the addTimer() and setTimer() interfaces more like the addIRQ() and setIRQ()
+     * interfaces (which return the underlying object instead of an array index) and maintaining a separate list
+     * of active timers, in order of highest to lowest cycle countdown values, as this could speed up
+     * getBurstCycles() and updateTimers() functions ever so slightly.
+     *
+     * @this {CPUPDP10}
+     * @param {function()} callBack
+     * @return {number} timer index
+     */
+    addTimer(callBack)
+    {
+        var iTimer = this.aTimers.length;
+        this.aTimers.push([-1, callBack]);
+        return iTimer;
+    }
+
+    /**
+     * setTimer(iTimer, ms, fReset)
+     *
+     * Using the timer index from a previous addTimer() call, this sets that timer to fire after the
+     * specified number of milliseconds.
+     *
+     * This is preferred over JavaScript's setTimeout(), because all our timers are effectively paused when
+     * the CPU is paused (eg, when the Debugger halts execution).  Moreover, setTimeout() handlers only run after
+     * runCPU() yields, which is far too granular for some components (eg, when the SerialPort tries to simulate
+     * interrupts at 9600 baud).
+     *
+     * Ideally, the only function that would use setTimeout() is runCPU(), while the rest of the components
+     * use setTimer(); however, due to legacy code (ie, code that predates these functions) and/or laziness,
+     * that may not be the case.
+     *
+     * @this {CPUPDP10}
+     * @param {number} iTimer
+     * @param {number} ms (converted into a cycle countdown internally)
+     * @param {boolean} [fReset] (true if the timer should be reset even if already armed)
+     * @return {number} (number of cycles used to arm timer, or -1 if error)
+     */
+    setTimer(iTimer, ms, fReset)
+    {
+        var nCycles = -1;
+        if (iTimer >= 0 && iTimer < this.aTimers.length) {
+            if (fReset || this.aTimers[iTimer][0] < 0) {
+                nCycles = this.getMSCycles(ms);
+                /*
+                 * We must now confront the following problem: if the CPU is currently executing a burst of cycles,
+                 * the number of cycles it has executed in that burst so far must NOT be charged against the cycle
+                 * timeout we're about to set.  The simplest way to resolve that is to immediately call endBurst()
+                 * and bias the cycle timeout by the number of cycles that the burst executed.
+                 */
+                if (this.flags.running) {
+                    nCycles += this.endBurst();
+                }
+                this.aTimers[iTimer][0] = nCycles;
+            }
+        }
+        return nCycles;
+    }
+
+    /**
+     * getMSCycles(ms)
+     *
+     * @this {CPUPDP10}
+     * @param {number} ms
+     * @return {number} number of corresponding cycles
+     */
+    getMSCycles(ms)
+    {
+        return ((this.nCyclesPerSecond * this.nCyclesMultiplier) / 1000 * ms)|0;
+    }
+
+    /**
+     * getBurstCycles(nCycles)
+     *
+     * Used by runCPU() to get min(nCycles,[timer cycle counts])
+     *
+     * @this {CPUPDP10}
+     * @param {number} nCycles (number of cycles about to execute)
+     * @return {number} (either nCycles or less if a timer needs to fire)
+     */
+    getBurstCycles(nCycles)
+    {
+        for (var i = this.aTimers.length - 1; i >= 0; i--) {
+            var timer = this.aTimers[i];
+
+            if (timer[0] < 0) continue;
+            if (nCycles > timer[0]) {
+                nCycles = timer[0];
+            }
+        }
+        return nCycles;
+    }
+
+    /**
+     * saveTimers()
+     *
+     * @this {CPUPDP10}
+     * @return {Array.<number>}
+     */
+    saveTimers()
+    {
+        var aTimerCycles = [];
+        for (var i = 0; i < this.aTimers.length; i++) {
+            var timer = this.aTimers[i];
+            aTimerCycles.push(timer[0]);
+        }
+        return aTimerCycles;
+    }
+
+    /**
+     * restoreTimers(aTimerCycles)
+     *
+     * @this {CPUPDP10}
+     * @param {Array.<number>} aTimerCycles
+     */
+    restoreTimers(aTimerCycles)
+    {
+
+        for (var i = 0; i < this.aTimers.length && i < aTimerCycles.length; i++) {
+            var timer = this.aTimers[i];
+            timer[0] = aTimerCycles[i];
+        }
+    }
+
+    /**
+     * updateTimers(nCycles)
+     *
+     * Used by runCPU() to reduce all active timer countdown values by the number of cycles just executed;
+     * this is the function that actually "fires" any timer(s) whose countdown has reached (or dropped below)
+     * zero, invoking their callback function.
+     *
+     * @this {CPUPDP10}
+     * @param {number} nCycles (number of cycles actually executed)
+     */
+    updateTimers(nCycles)
+    {
+        for (var i = this.aTimers.length - 1; i >= 0; i--) {
+            var timer = this.aTimers[i];
+
+            if (timer[0] < 0) continue;
+            timer[0] -= nCycles;
+            if (timer[0] <= 0) {
+                timer[0] = -1;      // zero is technically an "active" value, so ensure the timer is dormant now
+                timer[1]();         // safe to invoke the callback function now
+            }
+        }
+    }
+
+    /**
+     * endBurst(fReset)
+     *
+     * @this {CPUPDP10}
+     * @param {boolean} [fReset]
+     * @return {number} (number of cycles executed in the most recent burst)
+     */
+    endBurst(fReset)
+    {
+        var nCycles = this.nBurstCycles -= this.nStepCycles;
+        /*
+         * In addition to zeroing nStepCycles, it's important that we also zero nSnapCycles, because if a CPU
+         * burst is being ended after nStepCycles has been "snapped" (because a certain opcode has an unusual timing
+         * calculation that must be based on a "snapped" cycle count rather the opcode's starting cycle count), we
+         * could inadvertently undo the endBurst() if the original "snapped" value was used to update nStepCycles.
+         */
+        this.nStepCycles = this.nSnapCycles = 0;
+        if (fReset) this.nBurstCycles = 0;
+        return nCycles;
+    }
+
+    /**
+     * runCPU()
+     *
+     * @this {CPUPDP10}
+     */
+    runCPU()
+    {
+        if (!this.flags.running) return;
+
+        /*
+         *  calcStartTime() initializes the cycle counter and timestamp for this runCPU() invocation, and optionally
+         *  recalculates the the maximum number of cycles for each burst if the nCyclesRecalc threshold has been reached.
+         */
+        this.calcStartTime();
+
+        try {
+            do {
+                /*
+                 * nCycles is how many cycles we WANT to run on each iteration of stepCPU(), and may be as
+                 * HIGH as nCyclesPerYield, but it may be significantly less.  getBurstCycles() will adjust
+                 * nCycles downward if any CPU timers need to fire during the next burst.
+                 */
+                var nCycles = this.getBurstCycles(this.flags.checksum? 1 : this.nCyclesPerYield);
+
+                /*
+                 * Execute the burst.
+                 */
+                try {
+                    this.stepCPU(nCycles);
+                }
+                catch(exception) {
+                    /*
+                     * We assume that any numeric exception was explicitly thrown by the CPU to interrupt the
+                     * current instruction (and by extension, the current burst, but not the current run).  All
+                     * other exceptions are re-thrown to the catch below, which will attempt a stack dump.
+                     */
+                    if (typeof exception != "number") throw exception;
+                }
+
+                /*
+                 * Terminate the burst, returning the number of cycles that stepCPU() actually ran.
+                 */
+                nCycles = this.endBurst(true);
+
+                /*
+                 * Add nCycles to nCyclesThisRun, as well as nRunCycles (the cycle count since the CPU started).
+                 */
+                this.nCyclesThisRun += nCycles;
+                this.nRunCycles += nCycles;
+                this.updateChecksum(nCycles);
+
+                /*
+                 * Update any/all timers, firing those whose cycle countdowns have reached (or dropped below) zero.
+                 */
+                this.updateTimers(nCycles);
+
+                this.nCyclesNextYield -= nCycles;
+                if (this.nCyclesNextYield <= 0) {
+                    this.nCyclesNextYield += this.nCyclesPerYield;
+                    if (++this.nYieldsSinceStatusUpdate >= CPUPDP10.YIELDS_PER_STATUS) {
+                        this.updateDisplays();
+                        this.nYieldsSinceStatusUpdate = 0;
+                    }
+                    break;
+                }
+            } while (this.flags.running);
+        }
+        catch (e) {
+            this.stopCPU();
+            if (this.cmp) this.cmp.stop(Component.getTime(), this.getCycles());
+            this.setError(e.stack || e.message);
+            return;
+        }
+
+        if (this.flags.running) setTimeout(this.onRunTimeout, this.calcRemainingTime());
+    }
+
+    /**
+     * startCPU(fUpdateFocus)
+     *
+     * For use by any component that wants to start the CPU.
+     *
+     * @param {boolean} [fUpdateFocus]
+     * @return {boolean}
+     */
+    startCPU(fUpdateFocus)
+    {
+        if (this.isError()) {
+            return false;
+        }
+        if (this.flags.running) {
+            this.println(this.toString() + " busy");
+            return false;
+        }
+        /*
+         * setSpeed() without a speed parameter leaves the selected speed in place, but also resets the
+         * cycle counter and timestamp for the current series of runCPU() calls, calculates the maximum number
+         * of cycles for each burst based on the last known effective CPU speed, and resets the nCyclesRecalc
+         * threshold counter.
+         */
+        this.setSpeed();
+        this.flags.running = true;
+        this.flags.starting = true;
+        var controlRun = this.bindings["run"];
+        if (controlRun) controlRun.textContent = "Halt";
+        if (this.cmp) {
+            if (fUpdateFocus) this.cmp.setFocus(true);
+            this.cmp.start(this.msStartRun, this.getCycles());
+        }
+        if (!this.dbg) this.status("Started");
+        setTimeout(this.onRunTimeout, 0);
+        return true;
+    }
+
+    /**
+     * stepCPU(nMinCycles)
+     *
+     * This will be implemented by the CPUStatePDP10 component.
+     *
+     * @this {CPUPDP10}
+     * @param {number} nMinCycles (0 implies a single-step, and therefore breakpoints should be ignored)
+     * @return {number} of cycles executed; 0 indicates that the last instruction was not executed
+     */
+    stepCPU(nMinCycles)
+    {
+        return 0;
+    }
+
+    /**
+     * stopCPU(fComplete)
+     *
+     * For use by any component that wants to stop the CPU.
+     *
+     * This similar to yieldCPU(), but it doesn't need to zero nCyclesNextYield to break out of runCPU();
+     * it simply needs to clear fRunning (well, "simply" may be oversimplifying a bit....)
+     *
+     * @this {CPUPDP10}
+     * @param {boolean} [fComplete]
+     * @return {boolean} true if the CPU was stopped, false if it was already stopped
+     */
+    stopCPU(fComplete)
+    {
+        var fStopped = false;
+        if (this.flags.running) {
+            this.endBurst();
+            this.addCycles(this.nRunCycles);
+            this.nRunCycles = 0;
+            this.flags.running = false;
+            var controlRun = this.bindings["run"];
+            if (controlRun) controlRun.textContent = "Run";
+            if (this.cmp) {
+                this.cmp.stop(Component.getTime(), this.getCycles());
+            }
+            fStopped = true;
+            if (!this.dbg) this.status("Stopped");
+        }
+        this.flags.complete = fComplete;
+        return fStopped;
+    }
+
+    /**
+     * yieldCPU()
+     *
+     * Similar to stopCPU() with regard to how it resets various cycle countdown values, but the CPU
+     * remains in a "running" state.
+     *
+     * @this {CPUPDP10}
+     */
+    yieldCPU()
+    {
+        this.endBurst();                    // this will break us out of stepCPU()
+        this.nCyclesNextYield = 0;          // this will break us out of runCPU(), once we break out of stepCPU()
+        /*
+         * The Debugger calls yieldCPU() after every message() to ensure browser responsiveness, but it looks
+         * odd for those messages to show CPU state changes if the Control Panel, Video display, etc, does not,
+         * so I've added this call to try to keep things looking synchronized.
+         */
+        this.updateDisplays();
+    }
+}
+
+/*
+ * Constants that control the frequency at which various updates should occur.
+ *
+ * These values do NOT control the simulation directly.  Instead, they are used by
+ * calcCycles(), which uses the nCyclesPerSecond passed to the constructor as a starting
+ * point and computes the following variables:
+ *
+ *      this.nCyclesPerYield:    (this.nCyclesPerSecond / CPUPDP10.YIELDS_PER_SECOND)
+ *
+ * The above variables are also multiplied by any cycle multiplier in effect, via setSpeed(),
+ * and then they're used to initialize another set of variables for each runCPU() iteration:
+ *
+ *      this.nCyclesNextYield:   this.nCyclesPerYield
+ */
+CPUPDP10.YIELDS_PER_SECOND      = 30;           // just a gut feeling for the MINIMUM number of yields per second
+CPUPDP10.YIELDS_PER_STATUS      = 15;           // every 15 yields (ie, twice per second), perform CPU status updates
+
+CPUPDP10.BUTTONS = ["power", "reset"];
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp10/lib/cpustate.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * Overview of Device Interrupt Support
+ *
+ * Originally, the CPU maintained a queue of requested interrupts.  Entries in this queue recorded a device's
+ * priority, vector, and delay (ie, a number of instructions to execute before dispatching the interrupt).  This
+ * queue would constantly grow and shrink as requests were issued and dispatched, and as long as there was something
+ * in the queue, the CPU was constantly examining it.
+ *
+ * Now we are trying something more efficient.  First, for devices that require delays (like the SerialPort's receiver
+ * and transmitter buffer registers, which are supposed to "clock" the data in and out at a specific baud rate), the
+ * CPU offers timer services that will "fire" a callback after a specified delay, which are much more efficient than
+ * requiring the CPU to dive into an interrupt queue and decrement delay counts on every instruction.
+ *
+ * Second, devices that generate interrupts will allocate an IRQ object during initialization; we will no longer
+ * be creating and destroying interrupt event objects and inserting/deleting them in a constantly changing queue.
+ * Each IRQ contains properties that never change (eg, the vector and priority), along with a "next" pointer that's
+ * only used when the IRQ is active.
+ *
+ * When a device decides it's time to interrupt (either at the end of some I/O operation or when a timer has fired),
+ * it will simply set the IRQ, which basically means that the IRQ will be linked onto a list of active IRQs, in
+ * priority order, so that when the CPU is ready to acknowledge interrupts, it need only check the top of the active
+ * IRQ list.
+ */
+
+/**
+ * @typedef {{
+ *  vector: number,
+ *  priority: number,
+ *  message: number,
+ *  name: (string|null),
+ *  next: (IRQ|null)
+ * }}
+ */
+var IRQ;
+
+/**
+ * @class CPUStatePDP10
+ * @unrestricted
+ */
+class CPUStatePDP10 extends CPUPDP10 {
+    /**
+     * CPUStatePDP10(parmsCPU)
+     *
+     * The CPUStatePDP10 class uses the following (parmsCPU) properties:
+     *
+     *      model: a number (eg, 1001) that should match one of the PDP10.MODEL_* values
+     *      addrReset: reset address (default is 0)
+     *
+     * This extends the CPU class and passes any remaining parmsCPU properties to the CPU class
+     * constructor, along with a default speed (cycles per second) based on the specified (or default)
+     * CPU model number.
+     *
+     * Speeds are highly instruction-specific and are not broken down into cycles; DEC documents them
+     * as a number of microseconds, with two decimal places of accuracy.  The simplest instructions
+     * execute in 1-3us, a number of others require 5-6us, and the most time-consuming take anywhere
+     * from 10us (MUL) to 17us (DIV).  Of course, instructions that perform multiple indirect memory
+     * accesses take even longer.
+     *
+     * I think we'll just say that the original PDP-10 was roughly a 1Mhz machine, and pretend that all
+     * instructions completed in 1 or more multiples of a microsecond.  I'm not sure that trying to be
+     * accurate to the nearest 1/100 of a microsecond would have much observable benefit.
+     *
+     * @param {Object} parmsCPU
+     */
+    constructor(parmsCPU)
+    {
+        var nCyclesDefault = 0;
+        var model = +parmsCPU['model'] || PDP10.MODEL_KA10;
+
+        switch(model) {
+        case PDP10.MODEL_KA10:
+        default:
+            nCyclesDefault = 1000000;
+            break;
+        }
+
+        /*
+         * ES6 ALERT: Classes cannot access "this" until all superclasses have been initialized as well.
+         */
+        super(parmsCPU, nCyclesDefault);
+
+        this.model = model;
+        this.addrReset = +parmsCPU['addrReset'] || 0;
+
+        this.opDecode = PDP10.opKA10.bind(this);
+        this.opUndefined = PDP10.opUndefined.bind(this);
+
+        /** @type {IRQ|null} */
+        this.irqNext = null;        // the head of the active IRQ list, in priority order
+
+        /** @type {Array.<IRQ>} */
+        this.aIRQs = [];            // list of all IRQs, active or not (to be used for auto-configuration)
+
+        this.flags.complete = false;
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * Called once the Bus has been initialized.
+     *
+     * @this {CPUStatePDP10}
+     * @param {ComputerPDP10} cmp
+     * @param {BusPDP10} bus
+     * @param {CPUPDP10} cpu
+     * @param {DebuggerPDP10} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        super.initBus(cmp, bus, cpu, dbg);
+    }
+
+    /**
+     * reset()
+     *
+     * @this {CPUStatePDP10}
+     */
+    reset()
+    {
+        this.status("Model " + this.model);
+        if (this.flags.running) this.stopCPU();
+        this.initCPU();
+        this.resetCycles();
+        this.clearError();      // clear any fatal error/exception that setError() may have flagged
+        super.reset();
+    }
+
+    /**
+     * initCPU()
+     *
+     * @this {CPUStatePDP10}
+     */
+    initCPU()
+    {
+        /*
+         * regEA is the last effective address, while regLA is the last fetch from an effective address
+         * calculation.  regRA is the last reference address used to calculate the last effective address.
+         */
+        this.regEA  = this.regRA = 0;
+        this.regLA  = this.regOP = 0;
+        this.regPC  = this.lastPC = this.addrReset;
+        this.regXC  = -1;       // if >= 0 this supersedes regPC (refers to an opcode from XCT)
+        this.regBP  = -1;       // active byte pointer (-1 if none)
+        this.regPS  =  0;       // assorted processor flags (see PSFLAG bit definitions)
+        this.regEX  =  0;       // internal "extension" register used for 72-bit MUL and DIV calculations
+
+        this.regRes = [0, 0];   // four internal "double-length" registers used for 72-bit DIV calculations
+        this.regPow = [0, 0];
+        this.regDiv = [0, 0];
+        this.regRem = [0, 0];
+
+        /*
+         * This is queried and displayed by the Panel when it's not displaying its own ADDRESS register
+         * (which takes precedence when, for example, you've manually halted the CPU and are independently
+         * examining the contents of other addresses).
+         *
+         * We initialize it to the current PC.
+         */
+        this.addrLast = this.regPC;
+
+        /*
+         * opFlags contains various conditions that stepCPU() needs to be aware of.
+         */
+        this.opFlags = 0;
+
+        this.setMemoryAccess();
+
+        this.resetIRQs();
+    }
+
+    /**
+     * setMemoryAccess()
+     *
+     * @this {CPUStatePDP10}
+     */
+    setMemoryAccess()
+    {
+        this.readWord = this.readWordFromPhysical;
+        this.writeWord = this.writeWordToPhysical;
+    }
+
+    /**
+     * setReset(addr, fStart, bUnit, addrStack)
+     *
+     * @this {CPUStatePDP10}
+     * @param {number} addr
+     * @param {boolean} [fStart] (true if a "startable" image was just loaded, false if not)
+     * @param {number} [bUnit] (boot unit #)
+     * @param {number} [addrStack]
+     */
+    setReset(addr, fStart, bUnit, addrStack)
+    {
+        this.addrReset = addr;
+
+        this.setPC(addr);
+
+        if (fStart) {
+            if (!this.flags.powered) {
+                this.flags.autoStart = true;
+            }
+            else if (!this.flags.running) {
+                this.startCPU();
+            }
+        }
+        else {
+            if (this.dbg && this.flags.powered) {
+                /*
+                 * TODO: Review the decision to always stop the CPU if the Debugger is loaded.  Note that
+                 * when stopCPU() stops a running CPU, the Debugger gets notified, so no need to notify it again.
+                 *
+                 * TODO: There are more serious problems to deal with if another component is slamming a new PC down
+                 * the CPU's throat (presumably while also dropping some new code into RAM) while the CPU is running;
+                 * we should probably force a complete reset, but for now, it's up to the user to hit the reset button
+                 * themselves.
+                 */
+                if (!this.stopCPU() && !this.cmp.flags.reset) {
+                    this.dbg.updateStatus();
+                    this.cmp.updateDisplays(-1);
+                }
+            }
+            else if (fStart === false) {
+                this.stopCPU();
+            }
+        }
+        if (!this.isRunning() && this.panel) this.panel.stop();
+    }
+
+    /**
+     * getChecksum()
+     *
+     * TODO: Implement
+     *
+     * @this {CPUStatePDP10}
+     * @return {number} a 32-bit summation of key elements of the current CPU state (used by the CPU checksum code)
+     */
+    getChecksum()
+    {
+        return 0;
+    }
+
+    /**
+     * save()
+     *
+     * @this {CPUStatePDP10}
+     * @return {Object|null}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, [
+            this.regEA,
+            this.regRA,
+            this.regLA,
+            this.regOP,
+            this.regPC,
+            this.regXC,
+            this.regBP,
+            this.regPS,
+            this.opFlags,
+            this.lastPC,
+            this.addrLast,
+            this.addrReset
+        ]);
+        state.set(1, []);
+        state.set(2, [this.nTotalCycles, this.getSpeed(), this.flags.autoStart]);
+        state.set(3, this.saveIRQs());
+        state.set(4, this.saveTimers());
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * @this {CPUStatePDP10}
+     * @param {Object} data
+     * @return {boolean} true if restore successful, false if not
+     */
+    restore(data)
+    {
+        /*
+         * ES6 ALERT: A handy destructuring assignment, which makes it easy to perform the inverse
+         * of what save() does when it collects a bunch of object properties into an array.
+         */
+        [
+            this.regEA,
+            this.regRA,
+            this.regLA,
+            this.regOP,
+            this.regPC,
+            this.regXC,
+            this.regBP,
+            this.regPS,
+            this.opFlags,
+            this.lastPC,
+            this.addrLast,
+            this.addrReset
+        ] = data[0];
+
+        var a = data[2];
+        this.nTotalCycles = a[0];
+        this.setSpeed(a[1]);
+        this.flags.autoStart = a[2];
+
+        this.restoreIRQs(data[3]);
+        this.restoreTimers(data[4]);
+        return true;
+    }
+
+    /**
+     * getPS()
+     *
+     * Gets the processor state flags in the format required by various program control operations (eg, JSP).
+     *
+     * @this {CPUStatePDP10}
+     * @return {number}
+     */
+    getPS()
+    {
+        return (this.regPS & PDP10.HALF_MASK);
+    }
+
+    /**
+     * setPS(w)
+     *
+     * Sets the processor state flags in the format required by various program control operations (eg, JRST).
+     *
+     * @this {CPUStatePDP10}
+     * @param {number} w
+     */
+    setPS(w)
+    {
+        this.regPS = (this.regPS & ~PDP10.PSFLAG.SET_MASK) | (w & PDP10.PSFLAG.SET_MASK);
+        this.regPS |= (w & PDP10.PSFLAG.USERF);
+        if (!(w & PDP10.PSFLAG.EXIOT)) {
+            this.regPS &= ~PDP10.PSFLAG.EXIOT;
+        } else {
+            if (!(this.regPS & PDP10.PSFLAG.USERF)) this.regPS |= PDP10.PSFLAG.EXIOT;
+        }
+    }
+
+    /**
+     * setUserMode()
+     *
+     * Sets the processor's USER_MODE flag.
+     *
+     * @this {CPUStatePDP10}
+     */
+    setUserMode()
+    {
+        this.regPS |= PDP10.PSFLAG.USERF;
+    }
+
+    /**
+     * readFlags()
+     *
+     * Used to implement the ""CONI APR," instruction; see opCONI().
+     *
+     * @this {CPUStatePDP10}
+     * @return {number}
+     */
+    readFlags()
+    {
+        var flags = 0;
+        if (this.regPS & PDP10.PSFLAG.AROV) flags |= PDP10.RFLAG.AROV;
+        if (this.regPS & PDP10.PSFLAG.PDOV) flags |= PDP10.RFLAG.PDOV;
+        return flags;
+    }
+
+    /**
+     * writeFlags(w)
+     *
+     * Used to implement the ""CONO APR," instruction; see opCONO().
+     *
+     * @this {CPUStatePDP10}
+     * @param {number} w
+     */
+    writeFlags(w)
+    {
+        if (w & PDP10.WFLAG.AROV_CL) this.regPS &= ~PDP10.PSFLAG.AROV;
+        if (w & PDP10.WFLAG.PDOV_CL) this.regPS &= ~PDP10.PSFLAG.PDOV;
+    }
+
+    /**
+     * getOpcode()
+     *
+     * Normally, this fetches the next opcode in regOP, decodes the low 23 bits (I,X,Y), records
+     * the effective address (E) in regEA, updates regPC, and returns the high 13 bits of the opcode
+     * for further decoding.
+     *
+     * However, if a reference address (R) in regRA still needs to be decoded (due to indirection),
+     * we take care of that first.
+     *
+     * @this {CPUStatePDP10}
+     * @return {number} (-1 if the reference address in regRA has not yet been fully decoded)
+     */
+    getOpcode()
+    {
+        if ((this.regRA & PDP10.OPCODE.I_FIELD)) {
+            this.regRA = this.regLA = this.readWord(this.regEA);
+        } else if (this.regXC >= 0) {
+            this.regRA = this.regOP = this.readWord(this.regXC);
+            this.regXC = -1;
+        } else {
+            this.regRA = this.regOP = this.readWord(this.lastPC = this.regPC);
+            this.regPC = (this.regPC + 1) % PDP10.ADDR_LIMIT;
+        }
+
+        /*
+         * Technically, we don't REALLY need to mask regRA with R_MASK, because all regRA accesses
+         * ignore any higher bits, but let's keep things tidy.
+         */
+        this.regRA &= PDP10.OPCODE.R_MASK;
+
+        /*
+         * Bits 0-22 (I,X,Y) contain what we call a "reference address" (R), which is used to calculate an
+         * 18-bit "effective address" (E).  To determine E from R, we must extract I, X, and Y from R, set E
+         * to Y, then add [X] to E if X is non-zero.  If I is zero, then we're done; otherwise, we must set R
+         * to [E] and repeat the process.
+         *
+         * However, we don't actually repeat the process immediately; we need to treat each indirection as a
+         * separate decoding step, to ensure that the emulator can "breathe" periodically.  So instead, we
+         * return -1, indicating that the opcode is not fully decoded, and then on the next call, instead of
+         * fetching another opcode, we fetch [E], update R, and decode R again.
+         */
+        this.regEA = this.regRA & PDP10.OPCODE.Y_MASK;
+        var x = (this.regRA >> PDP10.OPCODE.X_SHIFT) & PDP10.OPCODE.X_MASK;
+        if (x) this.regEA = (this.regEA + (this.regLA = this.readWord(x))) & PDP10.ADDR_MASK;
+
+        return (this.regRA & PDP10.OPCODE.I_FIELD)? -1 : ((this.regOP / PDP10.OPCODE.A_SCALE)|0);
+    }
+
+    /**
+     * advancePC(off)
+     *
+     * NOTE: This function is nothing more than a convenience, and we fully expect it to be inlined at runtime.
+     *
+     * @this {CPUStatePDP10}
+     * @param {number} off
+     * @return {number} (original PC)
+     */
+    advancePC(off)
+    {
+        var pc = this.regPC;
+        this.regPC = (pc + off) % PDP10.ADDR_LIMIT;
+        return pc;
+    }
+
+    /**
+     * getPC()
+     *
+     * NOTE: This function is nothing more than a convenience, and we fully expect it to be inlined at runtime.
+     *
+     * @this {CPUStatePDP10}
+     * @return {number}
+     */
+    getPC()
+    {
+        return this.regPC;
+    }
+
+    /**
+     * getXC()
+     *
+     * NOTE: This function is nothing more than a convenience, and we fully expect it to be inlined at runtime.
+     *
+     * @this {CPUStatePDP10}
+     * @return {number}
+     */
+    getXC()
+    {
+        return this.regXC >= 0? this.regXC : ((this.regRA & PDP10.OPCODE.I_FIELD)? this.lastPC : this.regPC);
+    }
+
+    /**
+     * getLastAddr()
+     *
+     * @this {CPUStatePDP10}
+     * @return {number}
+     */
+    getLastAddr()
+    {
+        return this.addrLast;
+    }
+
+    /**
+     * getLastPC()
+     *
+     * @this {CPUStatePDP10}
+     * @return {number}
+     */
+    getLastPC()
+    {
+        return this.lastPC;
+    }
+
+    /**
+     * setPC(addr)
+     *
+     * Updates the PC register with the new address after masking it with ADDR_LIMIT (in case the
+     * new address was the result of an unchecked calculation).
+     *
+     * @this {CPUStatePDP10}
+     * @param {number} addr
+     */
+    setPC(addr)
+    {
+        this.regRA = 0;
+        this.regXC = -1;
+        this.regPC = addr % PDP10.ADDR_LIMIT;
+    }
+
+    /**
+     * addIRQ(vector, priority, message)
+     *
+     * @this {CPUStatePDP10}
+     * @param {number} vector (-1 for floating vector)
+     * @param {number} priority
+     * @param {number} [message]
+     * @return {IRQ}
+     */
+    addIRQ(vector, priority, message)
+    {
+        var irq = {vector: vector, priority: priority, message: message || 0, name: null, next: null};
+        this.aIRQs.push(irq);
+        return irq;
+    }
+
+    /**
+     * insertIRQ(irq)
+     *
+     * @this {CPUStatePDP10}
+     * @param {IRQ} irq
+     */
+    insertIRQ(irq)
+    {
+        if (irq != this.irqNext) {
+            var irqPrev = this.irqNext;
+            if (!irqPrev || irqPrev.priority <= irq.priority) {
+                irq.next = irqPrev;
+                this.irqNext = irq;
+            } else {
+                do {
+                    var irqNext = irqPrev.next;
+                    if (!irqNext || irqNext.priority <= irq.priority) {
+                        irq.next = irqNext;
+                        irqPrev.next = irq;
+                        break;
+                    }
+                    irqPrev = irqNext;
+                } while (irqPrev);
+            }
+        }
+        /*
+         * See the writeXCSR() function for an explanation of why signalling an IRQ hardware interrupt
+         * should be done using IRQ_DELAY rather than setting IRQ directly.
+         */
+        this.opFlags |= PDP10.OPFLAG.IRQ_DELAY;
+    }
+
+    /**
+     * removeIRQ(irq)
+     *
+     * @this {CPUStatePDP10}
+     * @param {IRQ} irq
+     */
+    removeIRQ(irq)
+    {
+        var irqPrev = this.irqNext;
+        if (irqPrev == irq) {
+            this.irqNext = irq.next;
+        } else {
+            while (irqPrev) {
+                var irqNext = irqPrev.next;
+                if (irqNext == irq) {
+                    irqPrev.next = irqNext.next;
+                    break;
+                }
+                irqPrev = irqNext;
+            }
+        }
+        /*
+         * We could also set irq.next to null now, but strictly speaking, that shouldn't be necessary.
+         *
+         * Last but not least, if there's still an IRQ on the active IRQ list, we need to make sure IRQ_DELAY
+         * is still set.
+         */
+        if (this.irqNext) {
+            this.opFlags |= PDP10.OPFLAG.IRQ_DELAY;
+        }
+    }
+
+    /**
+     * setIRQ(irq)
+     *
+     * @this {CPUStatePDP10}
+     * @param {IRQ|null} irq
+     */
+    setIRQ(irq)
+    {
+        if (irq) {
+            this.insertIRQ(irq);
+            if (irq.message && this.messageEnabled(irq.message | MessagesPDP10.INT)) {
+                this.printMessage("setIRQ(vector=" + Str.toOct(irq.vector) + ",priority=" + irq.priority + ")", true, true);
+            }
+        }
+    }
+
+    /**
+     * clearIRQ(irq)
+     *
+     * @this {CPUStatePDP10}
+     * @param {IRQ|null} irq
+     */
+    clearIRQ(irq)
+    {
+        if (irq) {
+            this.removeIRQ(irq);
+            if (irq.message && this.messageEnabled(irq.message | MessagesPDP10.INT)) {
+                this.printMessage("clearIRQ(vector=" + Str.toOct(irq.vector) + ",priority=" + irq.priority + ")", true, true);
+            }
+        }
+    }
+
+    /**
+     * findIRQ(vector)
+     *
+     * @this {CPUStatePDP10}
+     * @param {number} vector
+     * @return {IRQ|null}
+     */
+    findIRQ(vector)
+    {
+        for (var i = 0; i < this.aIRQs.length; i++) {
+            var irq = this.aIRQs[i];
+            if (irq.vector === vector) return irq;
+        }
+        return null;
+    }
+
+    /**
+     * checkIRQs(priority)
+     *
+     * @this {CPUStatePDP10}
+     * @param {number} priority
+     * @return {IRQ|null}
+     */
+    checkIRQs(priority)
+    {
+        return (this.irqNext && this.irqNext.priority > priority)? this.irqNext : null;
+    }
+
+    /**
+     * resetIRQs(priority)
+     *
+     * @this {CPUStatePDP10}
+     */
+    resetIRQs()
+    {
+        this.irqNext = null;
+    }
+
+    /**
+     * saveIRQs()
+     *
+     * @this {CPUStatePDP10}
+     * @return {Array.<number>}
+     */
+    saveIRQs()
+    {
+        var aIRQVectors = [];
+        var irq = this.irqNext;
+        while (irq) {
+            aIRQVectors.push(irq.vector);
+            irq = irq.next;
+        }
+        return aIRQVectors;
+    }
+
+    /**
+     * restoreIRQs(aIRQVectors)
+     *
+     * @this {CPUStatePDP10}
+     * @param {Array.<number>} aIRQVectors
+     */
+    restoreIRQs(aIRQVectors)
+    {
+        for (var i = aIRQVectors.length - 1; i >= 0; i--) {
+            var irq = this.findIRQ(aIRQVectors[i]);
+
+            if (irq) {
+                irq.next = this.irqNext;
+                this.irqNext = irq;
+            }
+        }
+    }
+
+    /**
+     * checkInterrupts()
+     *
+     * @this {CPUStatePDP10}
+     * @return {boolean} true if an interrupt was dispatched, false if not
+     */
+    checkInterrupts()
+    {
+        var fInterrupt = false;
+
+        if (this.opFlags & PDP10.OPFLAG.IRQ) {
+
+            // var vector = PDP10.TRAP.PIRQ;
+            // var priority = (this.regPIR & PDP10.PSW.PRI) >> PDP10.PSW.SHIFT.PRI;
+            //
+            // var irq = this.checkIRQs(priority);
+            // if (irq) {
+            //     vector = irq.vector;
+            //     priority = irq.priority;
+            // }
+            //
+            // if (this.dispatchInterrupt(vector, priority)) {
+            //     if (irq) this.removeIRQ(irq);
+            //     fInterrupt = true;
+            // }
+
+            if (!this.irqNext) {
+                this.opFlags &= ~PDP10.OPFLAG.IRQ;
+            }
+        }
+        else if (this.opFlags & PDP10.OPFLAG.IRQ_DELAY) {
+            /*
+             * We know that IRQ (bit 2) is clear, so since IRQ_DELAY (bit 0) is set, incrementing opFlags
+             * will eventually transform IRQ_DELAY into IRQ, without affecting any other (higher) bits.
+             */
+            this.opFlags++;
+        }
+        return fInterrupt;
+    }
+
+    /**
+     * dispatchInterrupt(vector, priority)
+     *
+     * TODO: The process of dispatching an interrupt MUST cost some cycles; either trap() needs to assess
+     * that cost, or we do.
+     *
+     * @this {CPUStatePDP10}
+     * @param {number} vector
+     * @param {number} priority
+     * @return {boolean} (true if dispatched, false if not)
+     */
+    dispatchInterrupt(vector, priority)
+    {
+        return false;
+    }
+
+    /**
+     * isWaiting()
+     *
+     * @this {CPUStatePDP10}
+     * @return {boolean} (true if OPFLAG.WAIT is set, false otherwise)
+     */
+    isWaiting()
+    {
+        return !!(this.opFlags & PDP10.OPFLAG.WAIT);
+    }
+
+    /**
+     * readWordFromPhysical(addr)
+     *
+     * This is a handler set up by setMemoryAccess().  All calls should go through readWord().
+     *
+     * @this {CPUStatePDP10}
+     * @param {number} addr
+     * @return {number}
+     */
+    readWordFromPhysical(addr)
+    {
+        return this.bus.getWord(this.addrLast = addr);
+    }
+
+    /**
+     * writeWordToPhysical(addr, data)
+     *
+     * This is a handler set up by setMemoryAccess().  All calls should go through writeWord().
+     *
+     * @this {CPUStatePDP10}
+     * @param {number} addr
+     * @param {number} data
+     * @return {number} (we return the data back to the caller to permit nested writes)
+     */
+    writeWordToPhysical(addr, data)
+    {
+        this.bus.setWord(this.addrLast = addr, data);
+        return data;
+    }
+
+    /**
+     * haltCPU()
+     *
+     * This is a temporary helper function for the Bus component, to force the CPU to stop executing the
+     * current instruction.
+     *
+     * @this {CPUStatePDP10}
+     */
+    haltCPU()
+    {
+        this.stopCPU();
+        throw -1;
+    }
+
+    /**
+     * stepCPU(nMinCycles)
+     *
+     * NOTE: Single-stepping should not be confused with the Trap flag; single-stepping is a Debugger
+     * operation that's completely independent of Trap status.  The CPU can go in and out of Trap mode,
+     * in and out of h/w interrupt service routines (ISRs), etc, but from the Debugger's perspective,
+     * they're all one continuous stream of instructions that can be stepped or run at will.  Moreover,
+     * stepping vs. running should never change the behavior of the simulation.
+     *
+     * @this {CPUStatePDP10}
+     * @param {number} nMinCycles (0 implies a single-step, and therefore breakpoints should be ignored)
+     * @return {number} of cycles executed; 0 indicates a pre-execution condition (ie, an execution breakpoint
+     * was hit), -1 indicates a post-execution condition (eg, a read or write breakpoint was hit), and a positive
+     * number indicates successful completion of that many cycles (which should always be >= nMinCycles).
+     */
+    stepCPU(nMinCycles)
+    {
+        /*
+         * The Debugger uses complete to determine if the instruction completed (true) or was interrupted
+         * by a breakpoint or some other exceptional condition (false).  NOTE: this does NOT include JavaScript
+         * exceptions, which stepCPU() expects the caller to catch using its own exception handler.
+         *
+         * The CPU relies on the use of stopCPU() rather than complete, because the CPU never single-steps
+         * (ie, nMinCycles is always some large number), whereas the Debugger does.  And conversely, when the
+         * Debugger is single-stepping (even when performing multiple single-steps), fRunning is never set,
+         * so stopCPU() would have no effect as far as the Debugger is concerned.
+         */
+        this.flags.complete = true;
+
+        /*
+         * nDebugCheck is 1 if we want the Debugger's checkInstruction() to check every instruction,
+         * -1 if we want it to check just the first instruction, and 0 if there's no need for any checks.
+         */
+        var nDebugCheck = (DEBUGGER && this.dbg)? (this.dbg.checksEnabled()? 1 : (this.flags.starting? -1 : 0)) : 0;
+
+        /*
+         * nDebugState is needed only when nDebugCheck is non-zero; it is -1 if this is a single-step, 0 if
+         * this is the start of a new run, and 1 if this is a continuation of a previous run.  It is used by
+         * checkInstruction() to determine if it should skip breakpoint checks and/or HALT instructions (ie,
+         * if nDebugState is <= zero).
+         */
+        var nDebugState = (!nMinCycles)? -1 : (this.flags.starting? 0 : 1);
+        this.flags.starting = false;        // we've moved beyond "starting" and have officially "started" now
+
+        /*
+         * We move the minimum cycle count to nStepCycles (the number of cycles left to step), so that other
+         * functions have the ability to force that number to zero (eg, stopCPU()), and thus we don't have to check
+         * any other criteria to determine whether we should continue stepping or not.
+         */
+        this.nBurstCycles = this.nStepCycles = nMinCycles;
+
+        /*
+         * And finally, move the nDebugCheck state to an OPFLAG bit, so that the loop need check only one variable.
+         */
+        this.opFlags = (this.opFlags & ~PDP10.OPFLAG.DEBUGGER) | (nDebugCheck? PDP10.OPFLAG.DEBUGGER : 0);
+
+        do {
+            if (this.opFlags) {
+                /*
+                 * NOTE: We still check DEBUGGER to ensure that this code will be compiled out of existence in
+                 * non-DEBUGGER builds.
+                 */
+                if (DEBUGGER && (this.opFlags & PDP10.OPFLAG.DEBUGGER)) {
+                    if (this.dbg.checkInstruction(this.getXC(), nDebugState)) {
+                        this.stopCPU();
+                        break;
+                    }
+                    if (!++nDebugCheck) this.opFlags &= ~PDP10.OPFLAG.DEBUGGER;
+                    if (!nDebugState) nDebugState++;
+                }
+                /*
+                 * If we're in the IRQ or WAIT state, check for any pending interrupts.
+                 *
+                 * NOTE: It's no coincidence that we're checking this BEFORE any pending traps, because in rare
+                 * cases (including some presented by those pesky "TRAP TEST" diagnostics), the process of dispatching
+                 * an interrupt can trigger a TRAP_SP stack overflow condition, which must be dealt with BEFORE we
+                 * execute the first instruction of the interrupt handler.
+                 */
+                if ((this.opFlags & (PDP10.OPFLAG.IRQ_MASK | PDP10.OPFLAG.WAIT)) /* && nDebugState >= 0 */) {
+                    if (this.checkInterrupts()) {
+                        if ((this.opFlags & PDP10.OPFLAG.DEBUGGER) && this.dbg.checkInstruction(this.getXC(), nDebugState)) {
+                            this.stopCPU();
+                            break;
+                        }
+                        /*
+                         * Since an interrupt was just dispatched, altering the normal flow of time and changing
+                         * the future as we knew it, let's break out immediately if we're single-stepping, so that
+                         * the Debugger gets to see the first instruction of the interrupt handler.  NOTE: This
+                         * assumes that we've still commented out the nDebugState check above that used to bypass
+                         * checkInterrupts() when single-stepping.
+                         */
+                        if (nDebugState < 0) break;
+                    }
+                }
+            }
+
+            this.opFlags &= PDP10.OPFLAG.PRESERVE;
+
+            var op = this.getOpcode();
+            if (op >= 0) {
+                this.opDecode(op);
+            }
+            /*
+             * TODO: This is a temporary cycle charge, required for CPU operational bookkeeping until we add
+             * correct cycle counts for all instructions.
+             */
+            this.nStepCycles--;
+
+        } while (this.nStepCycles > 0);
+
+        return (this.flags.complete? this.nBurstCycles - this.nStepCycles : (this.flags.complete === false? -1 : 0));
+    }
+
+    /**
+     * CPUStatePDP10.init()
+     *
+     * This function operates on every HTML element of class "cpu", extracting the
+     * JSON-encoded parameters for the CPUStatePDP10 constructor from the element's "data-value"
+     * attribute, invoking the constructor (which in turn invokes the CPU constructor)
+     * to create a CPUStatePDP10 component, and then binding any associated HTML controls to the
+     * new component.
+     */
+    static init()
+    {
+        var aeCPUs = Component.getElementsByClass(document, PDP10.APPCLASS, "cpu");
+        for (var iCPU = 0; iCPU < aeCPUs.length; iCPU++) {
+            var eCPU = aeCPUs[iCPU];
+            var parmsCPU = Component.getComponentParms(eCPU);
+            var cpu = new CPUStatePDP10(parmsCPU);
+            Component.bindComponentControls(cpu, eCPU, PDP10.APPCLASS);
+        }
+    }
+}
+
+/*
+ * Initialize every CPU module on the page
+ */
+Web.onInit(CPUStatePDP10.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp10/lib/cpuops.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+    From the "PDP-10 System Reference Manual", May 1968, p. 1-4:
+
+    1.1 NUMBER SYSTEM
+
+    The program can interpret a data word as a 36-digit, unsigned binary number, or the left and right
+    halves of a word can be taken as separate 18-bit numbers.  The PDP-10 repertoire includes instructions
+    that effectively add or subtract one from both halves of a word, so the right half can be used for
+    address modification when the word is addressed as an index register, while the left half is used to
+    keep a control count.
+
+    The standard arithmetic instructions in the PDP-10 use twos complement, fixed point conventions to do
+    binary arithmetic.  In a word used as a number, bit 0 (the leftmost bit) represents the sign, 0 for positive,
+    1 for negative.  In a positive number the remaining 35 bits are the magnitude in ordinary binary notation.
+    The negative of a number is obtained by taking its twos complement. If x is an n-digit binary number, its
+    twos complement is 2^n - x, and its ones complement is (2^n - 1) - x, or equivalently (2^n - x) - 1.
+
+    Subtracting a number from 2^n - 1 (ie, from all 1s) is equivalent to performing the logical complement,
+    ie changing all 0s to 1s and all 1s to 0s.  Therefore, to form the twos complement one takes the logical
+    complement (usually referred to merely as the complement) of the entire word including the sign, and adds
+    1 to the result.  In a negative number the sign bit is 1, and the remaining bits are the twos complement
+    of the magnitude.
+
+    Zero is represented by a word containing all 0s.  Complementing this number produces all 1s, and adding
+    1 to that produces all 0s again.  Hence there is only one zero representation and its sign is positive.
+    Since the numbers are symmetrical in magnitude about a single zero representation, all even numbers both
+    positive and negative end in 0, all odd numbers in 1 (a number all 1s represents -1).  But since there are
+    the same number of positive and negative numbers and zero is positive, there is one more negative number
+    than there are nonzero positive numbers.  This is the most negative number and it cannot be produced by
+    negating any positive number (its octal representation is 400000 000000 and its magnitude is one greater
+    than the largest positive number).
+
+    If ones complements were used for negatives one could read a negative number by attaching significance
+    to the as instead of the 1s.  In twos complement notation each negative number is one greater than the
+    complement of the positive number of the same magnitude, so one can read a negative number by attaching
+    significance to the rightmost 1 and attaching significance to the 0s at the left of it (the negative number
+    of largest magnitude has a 1 in only the sign position).  In a negative integer, 1s may be discarded at the
+    left, just as leading 0s may be dropped in a positive integer.  In a negative fraction, 0s may be discarded
+    at the right.  So long as only 0s are discarded, the number remains in twos complement form because it
+    still has a 1 that possesses significance; but if a portion including the rightmost 1 is discarded, the
+    remaining part of the fraction is now a ones complement.
+
+    The computer does not keep track of a binary point - the programmer must adopt a point convention and shift
+    the magnitude of the result to conform to the convention used.  Two common conventions are to regard a number
+    as an integer (binary point at the right) or as a proper fraction (binary point at the left); in these two
+    cases the range of numbers represented by a single word is -2^35 to 2^35 - 1, or -1 to 1 - 2^35.  Since
+    multiplication and division make use of double length numbers, there are special instructions for performing
+    these operations with integral operands.
+
+    SIDEBAR: Multiplication produces a double length product, and the programmer must remember that discarding
+    the low order part of a double length negative leaves the high order part in correct twos complement form
+    only if the low order part is null.
+
+    ...
+
+    2.5 FIXED POINT ARITHMETIC
+
+    For fixed point arithmetic the PDP-10 has instructions for arithmetic shifting (which is essentially
+    multiplication by a power of 2) as well as for performing addition, subtraction, multiplication and division
+    of numbers in fixed point format [§ 1.1].  In such numbers the position of the binary point is arbitrary
+    (the programmer may adopt any point convention).  The add and subtract instructions involve only single length
+    numbers, whereas multiply supplies a double length product, and divide uses a double length dividend.  The high
+    and low order words respectively of a double length fixed point number are in accumulators A and A+1 (mod 20),
+    where the magnitude is the 70-bit string in bits 1-35 of the two words and the signs of the two are identical.
+    There are also integer multiply and divide instructions that involve only single length numbers and are
+    especially suited for handling smaller integers, particularly those of eighteen bits or less such as addresses
+    (of course they can be used for small fractions as well provided the programmer keeps track of the binary point).
+    For convenience in the following, all operands are assumed to be integers (binary point at the right).
+
+    The processor has four flags, Overflow, Carry 0, Carry 1 and No Divide, that indicate when the magnitude of a
+    number is or would be larger than can be accommodated.  Carry 0 and Carry 1 actually detect carries out of bits
+    0 and 1 in certain instructions that employ fixed point arithmetic operations: the add and subtract instructions
+    treated here, the move instructions that produce the negative or magnitude of the word moved [§ 2.2], and the
+    arithmetic test instructions that increment or decrement the test word [§ 2.7].  In these instructions an
+    incorrect result is indicated - and the Overflow flag set - if the carries are different, ie if there is a carry
+    into the sign but not out of it, or vice versa.  The Overflow flag is also set by No Divide being set, which
+    means the processor has failed to perform a division because the magnitude of the dividend is greater than or
+    equal to that of the divisor, or in integer divide, simply that the divisor is zero.  In other overflow cases
+    only Overflow itself is set: these include too large a product in multiplication, and loss of significant bits
+    in left arithmetic shifting.
+
+    SIDEBAR: Overflow is determined directly from the carries, not from the carry flags, as their states may reflect
+    events in previous instructions.
+
+ */
+
+/**
+ * opKA10(op)
+ *
+ * Originally, we received the full opcode (36 bits), then only the upper half-word (18 bits),
+ * and now we receive only the upper 13 bits.  However, the octal values shown in the table and
+ * function comments below still include all 18 bits of the original upper half-word, so that
+ * you don't have to mentally un-shift them 5 bits.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op (the top 13 bits of the original opcode, shifted right to bit 0)
+ */
+PDP10.opKA10 = function(op)
+{
+    /*
+     * We shift op right 4 more bits, leaving only the 9 bits required for the table index.  Those
+     * 4 bits are normally an accumulator index, which we also mask and pass along, since most instructions
+     * will use an accumulator, and those that don't simply ignore it.
+     */
+    PDP10.aOpXXX_KA10[op >> 4].call(this, op, op & PDP10.OPCODE.A_MASK);
+};
+
+/**
+ * opUUO(0o0NN000): Unimplemented User Operation
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-64:
+ *
+ *      Store the instruction code, A and the effective address E in bits 0-8, 9-12 and 18-35 respectively of
+ *      location 40; clear bits 13-17.  Execute the instruction contained in location 41.  The original contents
+ *      of location 40 are lost.
+ *
+ *      All of these codes are equivalent when they occur in the Monitor or when time sharing is not in effect.
+ *      But when a UUO appears in a user program, a code in the range 001-037 uses relocated locations 40 and 41
+ *      (ie 40 and 41 in the user's block) and is thus entirely a part of and under control of the user program.
+ *
+ *      A code in the range 040-077 on the other hand uses unrelocated 40 and 41, and the instruction in the latter
+ *      location is under control of the Monitor; these codes are thus specifically for user communication with
+ *      the Monitor, which interprets them (refer to the Monitor manual for the meanings of the various codes).
+ *
+ *      The code 000 executes in the same way as 040-077 but is not a standard communication code: it is included
+ *      so that control returns to the Monitor should a user program wipe itself out.
+ *
+ *      For a second processor connected to the same memory, the UUO trap is locations 140-141 instead of 40-41.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opUUO = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opUFA(0o130000): Unnormalized Floating Add
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-37:
+ *
+ *      Floating add the contents of location E to AC.  If the double length fraction in the sum is zero, clear
+ *      accumulator A+1.  Otherwise normalize the sum only if the magnitude of its fractional part is >= 1, and place
+ *      the high order part of the result in AC A+1.  The original contents of AC and E are unaffected.
+ *
+ *      NOTE: The result is placed in accumulator A+1. T his is the only arithmetic instruction that stores the result
+ *      in a second accumulator, leaving the original operands intact.
+ *
+ *      If the exponent of the sum following the one-step normalization is > 127, set Overflow and Floating Overflow;
+ *      the result stored has an exponent 256 less than the correct one.
+ *
+ *      SIDEBAR: The exponent of the sum is equal to that of the larger summand unless addition of the fractions
+ *      overflows, in which case it is greater by 1.  Exponent overflow can occur only in the latter case.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opUFA = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opDFN(0o131000): Double Floating Negate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-37:
+ *
+ *      Negate the double length floating point number composed of the contents of AC and location E with AC on the left.
+ *      Do this by taking the twos complement of the number whose sign is AC bit 0, whose exponent is in AC bits 1-8, and
+ *      whose fraction is the 54-bit string in bits 9-35 of AC and location E.  Place the high order word of the result
+ *      in AC; place the low order part of the fraction in bits 9-35 of location E without altering the original contents
+ *      of bits 0-8 of that location.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opDFN = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFSC(0o132000): Floating Scale
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-34:
+ *
+ *      If the fractional part of AC is zero, clear AC.  Otherwise add the scale factor given by E to the exponent part
+ *      of AC (thus multiplying AC by 2^E), normalize the resulting word bringing 0s into bit positions vacated at the
+ *      right, and place the result back in AC.
+ *
+ *      NOTE: A negative E is represented in standard twos complement notation, but the hardware compensates for this
+ *      when scaling the exponent.
+ *
+ *      If the exponent after normalization is > 127, set Overflow and Floating Overflow; the result stored has an
+ *      exponent 256 less than the correct one.  If < -128, set Overflow, Floating Overflow and Floating Underflow;
+ *      the result stored has an exponent 256 greater than the correct one.
+ *
+ *      SIDEBAR: This instruction can be used to float a fixed number with 27 or fewer significant bits.  To float an
+ *      integer contained within AC bits 9-35,
+ *
+ *          FSC AC,233
+ *
+ *      inserts the correct exponent to move the binary point from the right end to the left of bit 9 and then normalizes
+ *      (233 [base 8] = 155 [base 10] = 128 + 27).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFSC = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opIBP(0o133000): Increment Byte Pointer
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-16:
+ *
+ *      Increment the byte pointer in location E as explained [below].  The pointer has the format:
+ *
+ *                          1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3 3 3 3 3
+ *      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+ *      P P P P P P S S S S S S - I X X X X Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y
+ *
+ *      where S is the size of the byte as a number of bits, and P is its position as the number of bits
+ *      remaining at the right of the byte in the word (eg if P is 3 the rightmost bit of the byte is bit 32
+ *      of the word).  The rest of the pointer is interpreted in the same way as in an instruction: I, X and Y
+ *      are used to calculate the address of the location that is the source or destination of the byte.
+ *
+ *      To facilitate processing a series of bytes, several of the byte instructions increment the
+ *      pointer, ie, modify it so that it points to the next byte position in a set of memory locations.
+ *      Bytes are processed from left to right in a word, so incrementing merely replaces the current value
+ *      of P by P - S, unless there is insufficient space in the present location for another byte of the
+ *      specified size (P - S < 0).  In this case Y is increased by one to point to the next consecutive
+ *      location, and P is set to 36 - S to point to the first byte at the left in the new location.
+ *
+ *      CAUTION: Do not allow Y to reach maximum value.  The whole pointer is incremented, so if Y is 2^18 - 1
+ *      it becomes zero and X is also incremented.  The address calculation for the pointer uses the original X,
+ *      but if a priority interrupt should occur before the calculation is complete, the incremented X is used
+ *      when the instruction is repeated.
+ *
+ *      SPECIAL CONSIDERATIONS: If S is greater than P and also greater than 36, incrementing produces a new
+ *      P equal to 100 - S rather than 36 - S.  For S > 36 the byte is at most the entire word; for P >= 36 no
+ *      byte is processed (loading merely clears AC).  If both P and S are less than 36 but P + S > 36,
+ *      a byte of size 36 - P is loaded from position P, or the right 36 - P bits of the byte are deposited
+ *      in position P.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opIBP = function(op, ac)
+{
+    var inc = 0;
+    var w = this.readWord(this.regEA);
+    var p = (w / PDP10.OPCODE.P_SCALE) & PDP10.OPCODE.P_MASK;
+    var s = (w >> PDP10.OPCODE.S_SHIFT) & PDP10.OPCODE.S_MASK;
+    p -= s;
+    if (p < 0) {
+        inc++;
+        p = 36 - s;
+        if (p < 0) p = 100 - s; // see SPECIAL CONSIDERATIONS and NOTE above
+    }
+    /*
+     * Since the documentation above makes clear that the effect of the increment (of w) extends past the Y
+     * bits and into (at least) the X bits, we first re-assemble a new pointer with updated P bits (along with
+     * the original S bits and the remaining bits covered by PTR_MASK) and then increment as needed.
+     *
+     * Yes, PTR_MASK could have included the S bits as well and made the following expression a TINY bit simpler,
+     * but I would like to keep PTR_MASK distinct from both the P and S fields.
+     */
+    w = (p * PDP10.OPCODE.P_SCALE) + (s << PDP10.OPCODE.S_SHIFT) + (w & PDP10.OPCODE.PTR_MASK);
+    if (inc) w = (w + inc) % PDP10.WORD_LIMIT;
+    this.writeWord(this.regEA, w);
+};
+
+/**
+ * opILDB(0o134000): Increment Pointer and Load Byte
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-16:
+ *
+ *      Increment the byte pointer in location E as explained above. Then retrieve a byte of S bits from the
+ *      location and position specified by the newly incremented pointer, load it into the right end of AC,
+ *      and clear the remaining AC bits.  The location containing the byte is unaffected, the original contents
+ *      of AC are lost.
+ *
+ *      SPECIAL CONSIDERATIONS: If S is greater than P and also greater than 36, incrementing produces a new
+ *      P equal to 100 - S rather than 36 - S.  For S > 36 the byte is at most the entire word; for P >= 36 no
+ *      byte is processed (loading merely clears AC).  If both P and S are less than 36 but P + S > 36,
+ *      a byte of size 36 - P is loaded from position P, or the right 36 - P bits of the byte are deposited
+ *      in position P.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opILDB = function(op, ac)
+{
+    /*
+     * We're called in two phases: phase 1 is with regEA containing the address of the pointer, and phase 2
+     * is with regEA containing the address of the bits to be loaded.
+     *
+     * We can implement this as a simple combination of opIBP() and opLDB(), but taking care that we only call
+     * opIBP() on phase 1 (and only if the BIS flag is not set).
+     */
+    if (!(this.regPS & PDP10.PSFLAG.BIS)) {
+        PDP10.opIBP.call(this, op, ac);
+        this.regPS |= PDP10.PSFLAG.BIS;
+    }
+    PDP10.opLDB.call(this, op, ac);
+};
+
+/**
+ * opLDB(0o135000): Load Byte
+ *z
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-16:
+ *
+ *      Retrieve a byte of S bits from the location and position specified by the pointer contained in location E,
+ *      load it into the right end of AC, and clear the remaining AC bits.  The location containing the byte is
+ *      unaffected, the original contents of AC are lost.
+ *
+ *      SPECIAL CONSIDERATIONS: If S is greater than P and also greater than 36, incrementing produces a new
+ *      P equal to 100 - S rather than 36 - S.  For S > 36 the byte is at most the entire word; for P >= 36 no
+ *      byte is processed (loading merely clears AC).  If both P and S are less than 36 but P + S > 36,
+ *      a byte of size 36 - P is loaded from position P, or the right 36 - P bits of the byte are deposited
+ *      in position P.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opLDB = function(op, ac)
+{
+    /*
+     * We're called in two phases: phase 1 is with regEA containing the address of the pointer, and phase 2
+     * is with regEA containing the address of the bits to be loaded.
+     */
+    var w = this.readWord(this.regEA);
+    if (this.regBP < 0) {
+        this.regBP = w;
+        this.regRA = this.regEA | PDP10.OPCODE.I_FIELD;
+        return;
+    }
+    var p = (this.regBP / PDP10.OPCODE.P_SCALE) & PDP10.OPCODE.P_MASK;
+    var s = (this.regBP >> PDP10.OPCODE.S_SHIFT) & PDP10.OPCODE.S_MASK;
+    if (p + s < 32) {
+        /*
+         * WARNING: When using JavaScript's 32-bit operators with values that could set bit 31 and produce a
+         * negative value, it's critical to perform a final right-shift of 0, ensuring that the final result is
+         * positive.
+         */
+        w = ((w >> p) & ((1 << s) - 1)) >>> 0;
+    } else {
+        /*
+         * Regarding the SPECIAL CONSIDERATIONS above, even if the P ("shift") and/or S ("mask") values are
+         * over-large, that should be fine, because nothing but additional zero bits will be included (provided
+         * our memory is working properly and didn't give us more than 36 bits of unsigned data).
+         */
+        w = Math.trunc(w / Math.pow(2, p)) % Math.pow(2, s);
+    }
+    this.writeWord(ac, w);
+    this.regPS &= ~PDP10.PSFLAG.BIS;
+    this.regBP = -1;
+};
+
+/**
+ * opIDPB(0o136000): Increment Pointer and Deposit Byte
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-16:
+ *
+ *      Increment the byte pointer in location E as explained above.  Then deposit the right S bits of AC into
+ *      the location and position specified by the newly incremented pointer.  The original contents of the bits
+ *      that receive the byte are lost, AC and the remaining bits of the deposit location are unaffected.
+ *
+ *      SPECIAL CONSIDERATIONS: If S is greater than P and also greater than 36, incrementing produces a new
+ *      P equal to 100 - S rather than 36 - S.  For S > 36 the byte is at most the entire word; for P >= 36 no
+ *      byte is processed (loading merely clears AC).  If both P and S are less than 36 but P + S > 36,
+ *      a byte of size 36 - P is loaded from position P, or the right 36 - P bits of the byte are deposited
+ *      in position P.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opIDPB = function(op, ac)
+{
+    /*
+     * We're called in two phases: phase 1 is with regEA containing the address of the pointer, and phase 2
+     * is with regEA containing the address of the bits to be stored.
+     *
+     * We can implement this as a simple combination of opIBP() and opDDB(), but taking care that we only call
+     * opIBP() on phase 1 (and only if the BIS flag is not set).
+     */
+    if (!(this.regPS & PDP10.PSFLAG.BIS)) {
+        PDP10.opIBP.call(this, op, ac);
+        this.regPS |= PDP10.PSFLAG.BIS;
+    }
+    PDP10.opDPB.call(this, op, ac);
+};
+
+/**
+ * opDPB(0o137000): Deposit Byte
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-16:
+ *
+ *      Deposit the right S bits of AC into the location and position specified by the pointer contained
+ *      in location E.  The original contents of the bits that receive the byte are lost, AC and the remaining
+ *      bits of the deposit location are unaffected.
+ *
+ *      SPECIAL CONSIDERATIONS: If S is greater than P and also greater than 36, incrementing produces a new
+ *      P equal to 100 - S rather than 36 - S.  For S > 36 the byte is at most the entire word; for P >= 36 no
+ *      byte is processed (loading merely clears AC).  If both P and S are less than 36 but P + S > 36,
+ *      a byte of size 36 - P is loaded from position P, or the right 36 - P bits of the byte are deposited
+ *      in position P.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opDPB = function(op, ac)
+{
+    /*
+     * We're called in two phases: phase 1 is with regEA containing the address of the pointer, and phase 2
+     * is with regEA containing the address of the bits to be stored.
+     */
+    var w = this.readWord(this.regEA);
+    if (this.regBP < 0) {
+        this.regBP = w;
+        this.regRA = this.regEA | PDP10.OPCODE.I_FIELD;
+        return;
+    }
+    var p = (this.regBP / PDP10.OPCODE.P_SCALE) & PDP10.OPCODE.P_MASK;
+    var s = (this.regBP >> PDP10.OPCODE.S_SHIFT) & PDP10.OPCODE.S_MASK;
+    /*
+     * Regarding the SPECIAL CONSIDERATIONS above, even if the P ("shift") and/or S ("mask") values are
+     * over-large, we "mask" the resulting byte value (b) to 36 bits, so that when we re-assemble the final
+     * result (w), there shouldn't be any overlap or overflow.
+     */
+    var b = ((this.readWord(ac) % Math.pow(2, s)) * Math.pow(2, p)) % PDP10.WORD_LIMIT;
+    w = (w - (w % Math.pow(2, p + s))) + b + (w % Math.pow(2, p));
+    this.writeWord(this.regEA, w);
+    this.regPS &= ~PDP10.PSFLAG.BIS;
+    this.regBP = -1;
+};
+
+/**
+ * opFAD(0o140000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFAD = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFADI(0o141000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFADI = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFADM(0o142000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFADM = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFADB(0o143000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFADB = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFADR(0o144000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFADR = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFADRI(0o145000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFADRI = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFADRM(0o146000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFADRM = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFADRB(0o147000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFADRB = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFSB(0o150000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFSB = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFSBI(0o151000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFSBI = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFSBM(0o152000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFSBM = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFSBB(0o153000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFSBB = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFSBR(0o154000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFSBR = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFSBRI(0o155000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFSBRI = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFSBRM(0o156000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFSBRM = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFSBRB(0o157000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFSBRB = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFMP(0o160000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFMP = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFMPI(0o161000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFMPI = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFMPM(0o162000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFMPM = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFMPB(0o163000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFMPB = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFMPR(0o164000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFMPR = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFMPRI(0o165000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFMPRI = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFMPRM(0o166000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFMPRM = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFMPRB(0o167000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFMPRB = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFDV(0o170000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFDV = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFDVI(0o171000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFDVI = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFDVM(0o172000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFDVM = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFDVB(0o173000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFDVB = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFDVR(0o174000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFDVR = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFDVRI(0o175000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFDVRI = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFDVRM(0o176000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFDVRM = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opFDVRB(0o177000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opFDVRB = function(op, ac)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opMOVE(0o200000): Move
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-11:
+ *
+ *      Move one word from the source to the destination specified by M.  The source is unaffected,
+ *      the original contents of the destination are lost.
+ *
+ * NOTE: This is a "Basic" mode instruction: the source is [E] and the destination is [A] (opposite of "Memory").
+ *
+ * Equivalents: opSETM(0o414000) and opSETMB(0o417000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMOVE = function(op, ac)
+{
+    this.writeWord(ac, this.readWord(this.regEA));
+};
+
+/**
+ * opMOVEI(0o201000): Move Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-11:
+ *
+ *      Move one word from the source to the destination specified by M.  The source is unaffected,
+ *      the original contents of the destination are lost.
+ *
+ *      SIDEBAR: MOVEI loads the word 0,E into AC and is thus equivalent to HRRZI.
+ *
+ * NOTE: This is an "Immediate" mode instruction: the source is the word 0,E and the destination is [A].
+ *
+ * Equivalents: opSETMI(0o415000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMOVEI = function(op, ac)
+{
+    this.writeWord(ac, this.regEA);
+};
+
+/**
+ * opMOVEM(0o202000): Move to Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-11:
+ *
+ *      Move one word from the source to the destination specified by M.  The source is unaffected,
+ *      the original contents of the destination are lost.
+ *
+ * NOTE: This is a "Memory" mode instruction: the source is [A] and the destination is [E] (opposite of "Basic").
+ *
+ * Equivalents: opSETAM(0o426000) and opSETAB(0o427000).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMOVEM = function(op, ac)
+{
+    this.writeWord(this.regEA, this.readWord(ac));
+};
+
+/**
+ * opMOVES(0o203000): Move to Self
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-11:
+ *
+ *      Move one word from the source to the destination specified by M.  The source is unaffected,
+ *      the original contents of the destination are lost.
+ *
+ *      SIDEBAR: If A is zero, MOVES is a no-op; otherwise it is equivalent to MOVE.
+ *
+ * NOTE: This is a "Self" mode instruction: the source AND destination is [E] (and also [A] if A is non-zero).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMOVES = function(op, ac)
+{
+    if (ac) this.writeWord(ac, this.readWord(this.regEA));
+};
+
+/**
+ * opMOVS(0o204000): Move Swapped
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-11:
+ *
+ *      Interchange the left and right halves of the word from the source specified by M and move it to the
+ *      specified destination.  The source is unaffected, the original contents of the destination are lost.
+ *
+ * NOTE: This is a "Basic" mode instruction: the source is [E] and the destination is [A] (opposite of "Memory").
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMOVS = function(op, ac)
+{
+    var src = this.readWord(this.regEA);
+    src = ((src / PDP10.HALF_SHIFT)|0) + ((src & PDP10.HALF_MASK) * PDP10.HALF_SHIFT);
+    this.writeWord(ac, src);
+};
+
+/**
+ * opMOVSI(0o205000): Move Swapped Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-11:
+ *
+ *      Interchange the left and right halves of the word from the source specified by M and move it to the
+ *      specified destination.  The source is unaffected, the original contents of the destination are lost.
+ *
+ *      SIDEBAR: Swapping halves in immediate mode loads the word E,0 into AC.  MOVSI is thus equivalent to HRLZI.
+ *
+ * NOTE: This is an "Immediate" mode instruction: the source is the word 0,E and the destination is [A].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMOVSI = function(op, ac)
+{
+    this.writeWord(ac, this.regEA * PDP10.HALF_SHIFT);
+};
+
+/**
+ * opMOVSM(0o206000): Move Swapped to Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-11:
+ *
+ *      Interchange the left and right halves of the word from the source specified by M and move it to the
+ *      specified destination.  The source is unaffected, the original contents of the destination are lost.
+ *
+ * NOTE: This is a "Memory" mode instruction: the source is [A] and the destination is [E] (opposite of "Basic").
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMOVSM = function(op, ac)
+{
+    var src = this.readWord(ac);
+    src = ((src / PDP10.HALF_SHIFT)|0) + ((src & PDP10.HALF_MASK) * PDP10.HALF_SHIFT);
+    this.writeWord(this.regEA, src);
+};
+
+/**
+ * opMOVSS(0o207000): Move Swapped to Self
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-11:
+ *
+ *      Interchange the left and right halves of the word from the source specified by M and move it to the
+ *      specified destination.  The source is unaffected, the original contents of the destination are lost.
+ *
+ * NOTE: This is a "Self" mode instruction: the source AND destination is [E] (and also [A] if A is non-zero).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMOVSS = function(op, ac)
+{
+    var src = this.readWord(this.regEA);
+    src = ((src / PDP10.HALF_SHIFT)|0) + ((src & PDP10.HALF_MASK) * PDP10.HALF_SHIFT);
+    this.writeWord(this.regEA, src);
+    if (ac) this.writeWord(ac, src)
+};
+
+/**
+ * opMOVN(0o210000): Move Negative
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-11:
+ *
+ *      Negate the word from the source specified by M and move it to the specified destination.
+ *      If the source word is fixed point -2^35 (400000 000000) set the Overflow and Carry 1 flags.
+ *
+ *      (Negating the equivalent floating point -1 * 2^127 sets the flags, but this is not a normalized
+ *      number).
+ *
+ *      If the source word is zero, set Carry 0 and Carry 1.  The source is unaffected, the original
+ *      contents of the destination are lost.
+ *
+ * NOTE: This is a "Basic" mode instruction: the source is [E] and the destination is [A] (opposite of "Memory").
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMOVN = function(op, ac)
+{
+    this.writeWord(ac, PDP10.doNEG.call(this, this.readWord(this.regEA)));
+};
+
+/**
+ * opMOVNI(0o211000): Move Negative Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-11:
+ *
+ *      Negate the word from the source specified by M and move it to the specified destination.
+ *      If the source word is fixed point -2^35 (400000 000000) set the Overflow and Carry 1 flags.
+ *
+ *      (Negating the equivalent floating point -1 * 2^127 sets the flags, but this is not a normalized
+ *      number).
+ *
+ *      If the source word is zero, set Carry 0 and Carry 1.  The source is unaffected, the original
+ *      contents of the destination are lost.
+ *
+ *      SIDEBAR: MOVNI loads AC with the negative of the word 0,E and can set no flags.
+ *
+ * NOTE: This is an "Immediate" mode instruction: the source is the word 0,E and the destination is [A].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMOVNI = function(op, ac)
+{
+    /*
+     * We used to perform an in-line two's complement of regEA, since doNEG() updates the flags, and the
+     * documentation above claimed that MOVNI must "set no flags."  It's certainly true that regEA, being an
+     * 18-bit value, could never be -2^35, but it COULD be zero.  However, SIMH doesn't treat zero any
+     * differently for MOVNI, so we currently don't either.
+     *
+     * TODO: Verify the "set no flags" assertion on *real* (KA10) hardware.
+     */
+    this.writeWord(ac, PDP10.doNEG.call(this, this.regEA) /* this.regEA? PDP10.TWO_POW36 - this.regEA : 0 */);
+};
+
+/**
+ * opMOVNM(0o212000): Move Negative to Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-11:
+ *
+ *      Negate the word from the source specified by M and move it to the specified destination.
+ *      If the source word is fixed point -2^35 (400000 000000) set the Overflow and Carry 1 flags.
+ *
+ *      (Negating the equivalent floating point -1 * 2^127 sets the flags, but this is not a normalized
+ *      number).
+ *
+ *      If the source word is zero, set Carry 0 and Carry 1.  The source is unaffected, the original
+ *      contents of the destination are lost.
+ *
+ * NOTE: This is a "Memory" mode instruction: the source is [A] and the destination is [E] (opposite of "Basic").
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMOVNM = function(op, ac)
+{
+    this.writeWord(this.regEA, PDP10.doNEG.call(this, this.readWord(ac)));
+};
+
+/**
+ * opMOVNS(0o213000): Move Negative to Self
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-11:
+ *
+ *      Negate the word from the source specified by M and move it to the specified destination.
+ *      If the source word is fixed point -2^35 (400000 000000) set the Overflow and Carry 1 flags.
+ *
+ *      (Negating the equivalent floating point -1 * 2^127 sets the flags, but this is not a normalized
+ *      number).
+ *
+ *      If the source word is zero, set Carry 0 and Carry 1.  The source is unaffected, the original
+ *      contents of the destination are lost.
+ *
+ * NOTE: This is a "Self" mode instruction: the source AND destination is [E] (and also [A] if A is non-zero).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMOVNS = function(op, ac)
+{
+    var dst = PDP10.doNEG.call(this, this.readWord(this.regEA));
+    this.writeWord(this.regEA, dst);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opMOVM(0o214000): Move Magnitude
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-12:
+ *
+ *      Take the magnitude of the word contained in the source specified by M and move it to the
+ *      specified destination.  If the source word is fixed point -2^35 (400000 000000) set the
+ *      Overflow and Carry 1 flags.
+ *
+ *      (Negating the equivalent floating point -1 * 2^27 sets the flags, but this is not a normalized
+ *      number).
+ *
+ *      The source is unaffected, the original contents of the destination are lost.
+ *
+ * NOTE: This is a "Basic" mode instruction: the source is [E] and the destination is [A] (opposite of "Memory").
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMOVM = function(op, ac)
+{
+    this.writeWord(ac, PDP10.doABS.call(this, this.readWord(this.regEA)));
+};
+
+/**
+ * opMOVMI(0o215000): Move Magnitude Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-12:
+ *
+ *      Take the magnitude of the word contained in the source specified by M and move it to the
+ *      specified destination.  If the source word is fixed point -2^35 (400000 000000) set the
+ *      Overflow and Carry 1 flags.
+ *
+ *      (Negating the equivalent floating point -1 * 2^27 sets the flags, but this is not a normalized
+ *      number).
+ *
+ *      The source is unaffected, the original contents of the destination are lost.
+ *
+ *      SIDEBAR: The word 0,E is equivalent to its magnitude, so MOVMI is equivalent to MOVEI.
+ *
+ * NOTE: This is an "Immediate" mode instruction: the source is the word 0,E and the destination is [A].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMOVMI = function(op, ac)
+{
+    this.writeWord(ac, this.regEA);    // src is an 18-bit immediate value, so there's no need to call doABS()
+};
+
+/**
+ * opMOVMM(0o216000): Move Magnitude to Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-12:
+ *
+ *      Take the magnitude of the word contained in the source specified by M and move it to the
+ *      specified destination.  If the source word is fixed point -2^35 (400000 000000) set the
+ *      Overflow and Carry 1 flags.
+ *
+ *      (Negating the equivalent floating point -1 * 2^27 sets the flags, but this is not a normalized
+ *      number).
+ *
+ *      The source is unaffected, the original contents of the destination are lost.
+ *
+ * NOTE: This is a "Memory" mode instruction: the source is [A] and the destination is [E] (opposite of "Basic").
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMOVMM = function(op, ac)
+{
+    this.writeWord(this.regEA, PDP10.doABS.call(this, this.readWord(ac)));
+};
+
+/**
+ * opMOVMS(0o217000): Move Magnitude to Self
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-12:
+ *
+ *      Take the magnitude of the word contained in the source specified by M and move it to the
+ *      specified destination.  If the source word is fixed point -2^35 (400000 000000) set the
+ *      Overflow and Carry 1 flags.
+ *
+ *      (Negating the equivalent floating point -1 * 2^27 sets the flags, but this is not a normalized
+ *      number).
+ *
+ *      The source is unaffected, the original contents of the destination are lost.
+ *
+ * NOTE: This is a "Self" mode instruction: the source AND destination is [E] (and also [A] if A is non-zero).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMOVMS = function(op, ac)
+{
+    var dst = PDP10.doABS.call(this, this.readWord(this.regEA));
+    this.writeWord(this.regEA, dst);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opIMUL(0o220000): Integer Multiply
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-28:
+ *
+ *      Multiply AC by the operand specified by M, and place the sign and the 35 low order magnitude bits of the
+ *      product in the specified destination.  Set Overflow if the product is >= 2^35 or < -2^35 (ie if the high order
+ *      word of the double length product is not null); the high order word is lost.
+ *
+ * NOTE: This is a "Basic" mode instruction: the source is [E] and the destination is [A] (opposite of "Memory").
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opIMUL = function(op, ac)
+{
+    this.writeWord(ac, PDP10.doMUL.call(this, this.readWord(ac), this.readWord(this.regEA), true));
+};
+
+/**
+ * opIMULI(0o221000): Integer Multiply Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-28:
+ *
+ *      Multiply AC by the operand specified by M, and place the sign and the 35 low order magnitude bits of the
+ *      product in the specified destination.  Set Overflow if the product is >= 2^35 or < -2^35 (ie if the high order
+ *      word of the double length product is not null); the high order word is lost.
+ *
+ * NOTE: This is an "Immediate" mode instruction: the source is the word 0,E and the destination is [A].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opIMULI = function(op, ac)
+{
+    this.writeWord(ac, PDP10.doMUL.call(this, this.readWord(ac), this.regEA, true));
+};
+
+/**
+ * opIMULM(0o222000): Integer Multiply to Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-28:
+ *
+ *      Multiply AC by the operand specified by M, and place the sign and the 35 low order magnitude bits of the
+ *      product in the specified destination.  Set Overflow if the product is >= 2^35 or < -2^35 (ie if the high order
+ *      word of the double length product is not null); the high order word is lost.
+ *
+ * NOTE: This is a "Memory" mode instruction: the source is [E] and the destination is [E] (opposite of "Basic").
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opIMULM = function(op, ac)
+{
+    this.writeWord(this.regEA, PDP10.doMUL.call(this, this.readWord(ac), this.readWord(this.regEA), true));
+};
+
+/**
+ * opIMULB(0o223000): Integer Multiply to Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-28:
+ *
+ *      Multiply AC by the operand specified by M, and place the sign and the 35 low order magnitude bits of the
+ *      product in the specified destination.  Set Overflow if the product is >= 2^35 or < -2^35 (ie if the high order
+ *      word of the double length product is not null); the high order word is lost.
+ *
+ * NOTE: This is a "Both" mode instruction: the source is [E] and the destination is [E] and [A].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opIMULB = function(op, ac)
+{
+    this.writeWord(this.regEA, this.writeWord(ac, PDP10.doMUL.call(this, this.readWord(ac), this.readWord(this.regEA), true)));
+};
+
+/**
+ * opMUL(0o224000): Multiply
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-28:
+ *
+ *      Multiply AC by the operand specified by M, and place the high order word of the double length result
+ *      in the specified destination.  If M specifies AC as a destination, place the low order word in accumulator
+ *      A+1.  If both operands are -2^35 set Overflow; the double length result stored is -2^70.
+ *
+ * NOTE: This is a "Basic" mode instruction: the source is [E] and the destination is [A],[A+1] (opposite of "Memory").
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMUL = function(op, ac)
+{
+    this.writeWord(ac, PDP10.doMUL.call(this, this.readWord(ac), this.readWord(this.regEA)));
+    this.writeWord((ac + 1) & 0o17, this.regEX);
+};
+
+/**
+ * opMULI(0o225000): Multiply Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-28:
+ *
+ *      Multiply AC by the operand specified by M, and place the high order word of the double length result
+ *      in the specified destination.  If M specifies AC as a destination, place the low order word in accumulator
+ *      A+1.  If both operands are -2^35 set Overflow; the double length result stored is -2^70.
+ *
+ * NOTE: This is an "Immediate" mode instruction: the source is the word 0,E and the destination is [A],[A+1].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMULI = function(op, ac)
+{
+    this.writeWord(ac, PDP10.doMUL.call(this, this.readWord(ac), this.regEA));
+    this.writeWord((ac + 1) & 0o17, this.regEX);
+};
+
+/**
+ * opMULM(0o226000): Multiply to Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-28:
+ *
+ *      Multiply AC by the operand specified by M, and place the high order word of the double length result
+ *      in the specified destination.  If M specifies AC as a destination, place the low order word in accumulator
+ *      A+1.  If both operands are -2^35 set Overflow; the double length result stored is -2^70.
+ *
+ * NOTE: This is a "Memory" mode instruction: the source is [E] and the destination is [E] (opposite of "Basic").
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMULM = function(op, ac)
+{
+    this.writeWord(this.regEA, PDP10.doMUL.call(this, this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opMULB(0o227000): Multiply to Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-28:
+ *
+ *      Multiply AC by the operand specified by M, and place the high order word of the double length result
+ *      in the specified destination.  If M specifies AC as a destination, place the low order word in accumulator
+ *      A+1.  If both operands are -2^35 set Overflow; the double length result stored is -2^70.
+ *
+ * NOTE: This is a "Both" mode instruction: the source is [E] and the destination is [E] and [A],[A+1].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opMULB = function(op, ac)
+{
+    this.writeWord(this.regEA, this.writeWord(ac, PDP10.doMUL.call(this, this.readWord(ac), this.readWord(this.regEA))));
+    this.writeWord((ac + 1) & 0o17, this.regEX);
+};
+
+/**
+ * opIDIV(0o230000): Integer Divide
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-29:
+ *
+ *      If the operand specified by M is zero, set Overflow and No Divide, and go immediately to the next instruction
+ *      without affecting the original AC or memory operand in any way.  Otherwise divide AC by the specified operand,
+ *      calculating a quotient of 35 magnitude bits including leading zeros.  Place the unrounded quotient in the
+ *      specified destination.  If M specifies AC as the destination, place the remainder, with the same sign as the
+ *      dividend, in accumulator A+1.
+ *
+ * NOTE: This is a "Basic" mode instruction: the source is [E] and the destination is [A],[A+1] (opposite of "Memory").
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opIDIV = function(op, ac)
+{
+    var dst = PDP10.doDIV.call(this, this.readWord(this.regEA), this.readWord(ac));
+    if (dst < 0) return;
+    this.writeWord(ac, dst);
+    this.writeWord((ac + 1) & 0o17, this.regEX);
+};
+
+/**
+ * opIDIVI(0o231000): Integer Divide Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-29:
+ *
+ *      If the operand specified by M is zero, set Overflow and No Divide, and go immediately to the next instruction
+ *      without affecting the original AC or memory operand in any way.  Otherwise divide AC by the specified operand,
+ *      calculating a quotient of 35 magnitude bits including leading zeros.  Place the unrounded quotient in the
+ *      specified destination.  If M specifies AC as the destination, place the remainder, with the same sign as the
+ *      dividend, in accumulator A+1.
+ *
+ * NOTE: This is an "Immediate" mode instruction: the source is the word 0,E and the destination is [A],[A+1].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opIDIVI = function(op, ac)
+{
+    var dst = PDP10.doDIV.call(this, this.regEA, this.readWord(ac));
+    if (dst < 0) return;
+    this.writeWord(ac, dst);
+    this.writeWord((ac + 1) & 0o17, this.regEX);
+};
+
+/**
+ * opIDIVM(0o232000): Integer Divide to Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-29:
+ *
+ *      If the operand specified by M is zero, set Overflow and No Divide, and go immediately to the next instruction
+ *      without affecting the original AC or memory operand in any way.  Otherwise divide AC by the specified operand,
+ *      calculating a quotient of 35 magnitude bits including leading zeros.  Place the unrounded quotient in the
+ *      specified destination.  If M specifies AC as the destination, place the remainder, with the same sign as the
+ *      dividend, in accumulator A+1.
+ *
+ * NOTE: This is a "Memory" mode instruction: the source is [E] and the destination is [E] (opposite of "Basic").
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opIDIVM = function(op, ac)
+{
+    var dst = PDP10.doDIV.call(this, this.readWord(this.regEA), this.readWord(ac));
+    if (dst < 0) return;
+    this.writeWord(this.regEA, dst);
+};
+
+/**
+ * opIDIVB(0o233000): Integer Divide to Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-29:
+ *
+ *      If the operand specified by M is zero, set Overflow and No Divide, and go immediately to the next instruction
+ *      without affecting the original AC or memory operand in any way.  Otherwise divide AC by the specified operand,
+ *      calculating a quotient of 35 magnitude bits including leading zeros.  Place the unrounded quotient in the
+ *      specified destination.  If M specifies AC as the destination, place the remainder, with the same sign as the
+ *      dividend, in accumulator A+1.
+ *
+ * NOTE: This is a "Both" mode instruction: the source is [E] and the destination is [E] and [A],[A+1].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opIDIVB = function(op, ac)
+{
+    var dst = PDP10.doDIV.call(this, this.readWord(this.regEA), this.readWord(ac));
+    if (dst < 0) return;
+    this.writeWord(this.regEA, this.writeWord(ac, dst));
+    this.writeWord((ac + 1) & 0o17, this.regEX);
+};
+
+/**
+ * opDIV(0o234000): Divide
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-29:
+ *
+ *      If the magnitude of the number in AC is greater than or equal to that of the operand specified by M,
+ *      set Overflow and No Divide, and go immediately to the next instruction without affecting the original AC
+ *      or memory operand in any way.  Otherwise divide the double length number contained in accumulators A and A+1
+ *      by the specified operand, calculating a quotient of 35 magnitude bits including leading zeros.  Place the
+ *      unrounded quotient in the specified destination.  If M specifies AC as a destination, place the remainder,
+ *      with the same sign as the dividend, in accumulator A+1.
+ *
+ * NOTE: This is a "Basic" mode instruction: the source is [E] and the destination is [A],[A+1] (opposite of "Memory").
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opDIV = function(op, ac)
+{
+    var ext = this.readWord(ac);
+    var dst = this.readWord((ac + 1) & 0o17);
+    dst = PDP10.doDIV.call(this, this.readWord(this.regEA), dst, ext);
+    if (dst < 0) return;
+    this.writeWord(ac, dst);
+    this.writeWord((ac + 1) & 0o17, this.regEX);
+};
+
+/**
+ * opDIVI(0o235000): Divide Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-29:
+ *
+ *      If the magnitude of the number in AC is greater than or equal to that of the operand specified by M,
+ *      set Overflow and No Divide, and go immediately to the next instruction without affecting the original AC
+ *      or memory operand in any way.  Otherwise divide the double length number contained in accumulators A and A+1
+ *      by the specified operand, calculating a quotient of 35 magnitude bits including leading zeros.  Place the
+ *      unrounded quotient in the specified destination.  If M specifies AC as a destination, place the remainder,
+ *      with the same sign as the dividend, in accumulator A+1.
+ *
+ * NOTE: This is an "Immediate" mode instruction: the source is the word 0,E and the destination is [A],[A+1].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opDIVI = function(op, ac)
+{
+    var ext = this.readWord(ac);
+    var dst = this.readWord((ac + 1) & 0o17);
+    dst = PDP10.doDIV.call(this, this.regEA, dst, ext);
+    if (dst < 0) return;
+    this.writeWord(ac, dst);
+    this.writeWord((ac + 1) & 0o17, this.regEX);
+};
+
+/**
+ * opDIVM(0o236000): Divide to Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-29:
+ *
+ *      If the magnitude of the number in AC is greater than or equal to that of the operand specified by M,
+ *      set Overflow and No Divide, and go immediately to the next instruction without affecting the original AC
+ *      or memory operand in any way.  Otherwise divide the double length number contained in accumulators A and A+1
+ *      by the specified operand, calculating a quotient of 35 magnitude bits including leading zeros.  Place the
+ *      unrounded quotient in the specified destination.  If M specifies AC as a destination, place the remainder,
+ *      with the same sign as the dividend, in accumulator A+1.
+ *
+ * NOTE: This is a "Memory" mode instruction: the source is [E] and the destination is [E] (opposite of "Basic").
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opDIVM = function(op, ac)
+{
+    var ext = this.readWord(ac);
+    var dst = this.readWord((ac + 1) & 0o17);
+    dst = PDP10.doDIV.call(this, this.readWord(this.regEA), dst, ext);
+    if (dst < 0) return;
+    this.writeWord(this.regEA, dst);
+};
+
+/**
+ * opDIVB(0o237000): Divide to Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-29:
+ *
+ *      If the magnitude of the number in AC is greater than or equal to that of the operand specified by M,
+ *      set Overflow and No Divide, and go immediately to the next instruction without affecting the original AC
+ *      or memory operand in any way.  Otherwise divide the double length number contained in accumulators A and A+1
+ *      by the specified operand, calculating a quotient of 35 magnitude bits including leading zeros.  Place the
+ *      unrounded quotient in the specified destination.  If M specifies AC as a destination, place the remainder,
+ *      with the same sign as the dividend, in accumulator A+1.
+ *
+ * NOTE: This is a "Both" mode instruction: the source is [E] and the destination is [E] and [A],[A+1].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opDIVB = function(op, ac)
+{
+    var ext = this.readWord(ac);
+    var dst = this.readWord((ac + 1) & 0o17);
+    dst = PDP10.doDIV.call(this, this.readWord(this.regEA), dst, ext);
+    if (dst < 0) return;
+    this.writeWord(ac, this.writeWord(this.regEA, dst));
+    this.writeWord((ac + 1) & 0o17, this.regEX);
+};
+
+/**
+ * opASH(0o240000): Arithmetic Shift
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-31:
+ *
+ *      Arithmetic Shifting
+ *
+ *      These two instructions [ASH, ASHC] produce an arithmetic shift right or left of the number in AC
+ *      or the double length number in accumulators A and A+1.  Shifting is the movement of the contents
+ *      of a register bit-to-bit.  The operation discussed here is similar to logical shifting [see §2.4
+ *      and the illustration on page 2-24], but in an arithmetic shift only the magnitude part is
+ *      shifted - the sign is unaffected.  In a double length number the 70-bit string made up of the
+ *      magnitude parts of the two words is shifted, but the sign of the low order word is made equal
+ *      to the sign of the high order word.
+ *
+ *      Null bits are brought in at the end being vacated: a left shift brings in 0s at the right,
+ *      whereas a right shift brings in the equivalent of the sign bit at the left.  In either case,
+ *      information shifted out at the other end is lost.  A single shift left is equivalent to multiplying
+ *      the number by 2 (provided no bit of significance is shifted out); a shift right divides the number
+ *      by 2.
+ *
+ *      The number of places shifted is specified by the result of the effective address calculation
+ *      taken as a signed number (in twos complement notation) modulo 2^8 in magnitude.  In other words
+ *      the effective shift E is the number composed of bit 18 (which is the sign) and bits 28-35 of the
+ *      calculation result.  Hence the programmer may specify the shift directly in the instruction
+ *      (perhaps indexed) or give an indirect address to be used in calculating the shift.  A positive E
+ *      produces motion to the left, a negative E to the right; E is thus the power of 2 by which the
+ *      number is multiplied.  Maximum movement is 255 places.
+ *
+ *      ASH: Arithmetic Shift
+ *
+ *      Shift AC arithmetically the number of places specified by E.  Do not shift bit 0.  If E is positive,
+ *      shift left bringing 0s into bit 35; data shifted out of bit 1 is lost; set Overflow if any bit of
+ *      significance is lost (a 1 in a positive number, a 0 in a negative one).  If E is negative, shift right
+ *      bringing 0s into bit 1 if AC is positive, 1s if negative; data shifted out of bit 35 is lost.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opASH = function(op, ac)
+{
+    /*
+     * Convert the unsigned 18-bit value in regEA to a signed 8-bit value (-256 to 255).
+     */
+    var s = (((this.regEA & PDP10.HINT_LIMIT) << 14) >> 23) | (this.regEA & 0xff);
+    if (s) {
+        var v , bits;
+        var w = this.readWord(ac);
+        if (s > 0) {
+            bits = PDP10.INT_MASK;
+            v = (w < PDP10.INT_LIMIT)? 0 : PDP10.INT_LIMIT;
+            if (s < 35) {
+                v += (w * Math.pow(2, s)) % PDP10.INT_LIMIT;
+                /*
+                 * bits must be set to the mask of all magnitude bits shifted out of
+                 * the original word.  Using 8-bit signed words as an example, this table shows
+                 * the bits values that would correspond to shifting 1-7 bits left:
+                 *
+                 *    shifts    bits            value       calculation
+                 *    ------    -----------     ------      -----------
+                 *      1       0b01000000      128-64      128-Math.pow(2, 7-1)
+                 *      2       0b01100000      128-32      128-Math.pow(2, 7-2)
+                 *      3       0b01110000      128-16      128-Math.pow(2, 7-3)
+                 *     ...
+                 *      7       0b01111111      128-1       128-Math.pow(2, 7-7)
+                 */
+                bits = PDP10.INT_LIMIT - Math.pow(2, 35 - s);
+            }
+            if (w < PDP10.INT_LIMIT) {
+                /*
+                 * Since w was positive, overflow occurs ONLY if any of the bits we shifted out were 1s.
+                 * If all those bits in the original value (w) were 0s, then adding bits to it could NOT
+                 * produce a value > INT_MASK.
+                 */
+                if (w + bits > PDP10.INT_MASK) {
+                    this.regPS |= PDP10.PSFLAG.AROV;
+                }
+            } else {
+                /*
+                 * Since w was negative, overflow occurs ONLY if any of the bits we shifted out were 0s.
+                 * If all those bits in the original value (w) were 1s, subtracting bits from it could NOT
+                 * produce a value <= INT_MASK.
+                 */
+                if (w - bits < PDP10.INT_LIMIT) {
+                    this.regPS |= PDP10.PSFLAG.AROV;
+                }
+            }
+        } else {
+            if (s <= -35) {
+                v = (w < PDP10.INT_LIMIT)? 0 : PDP10.INT_MASK;
+            } else {
+                v = Math.trunc(w / Math.pow(2, -s));
+                if (w > PDP10.INT_MASK) {
+                    bits = PDP10.WORD_LIMIT - Math.pow(2, 36 + s);
+                    v += bits;
+                }
+            }
+        }
+
+        this.writeWord(ac, v);
+    }
+};
+
+/**
+ * opROT(0o241000): Rotate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-25:
+ *
+ *      Rotate AC the number of places specified by E.  If E is positive, rotate left; bit 0 is rotated
+ *      into bit 35.  If E is negative, rotate right; bit 35 is rotated into bit O.
+ *
+ *      The number of places moved is specified by the result of the effective address calculation taken as
+ *      a signed number (in twos complement notation) modulo 2^8 in magnitude.  In other words the effective
+ *      shift E is the number composed of bit 18 (which is the sign) and bits 28-35 of the calculation result.
+ *      Hence the programmer may specify the shift directly in the instruction (perhaps indexed) or give an
+ *      indirect address to be used in calculating the shift.  A positive E produces motion to the left,
+ *      a negative E to the right; maximum movement is 255 places.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opROT = function(op, ac)
+{
+    /*
+     * Convert the unsigned 18-bit value in regEA to a signed 8-bit value, modulo 36 (+/-35).
+     */
+    var s = ((((this.regEA & PDP10.HINT_LIMIT) << 14) >> 23) | (this.regEA & 0xff)) % 36;
+    if (s) {
+        var w = this.readWord(ac);
+        /*
+         * Note that a right rotation (s < 0) of s bits is equivalent to a left rotation (s > 0) of 36 + s bits.
+         */
+        if (s < 0) s = 36 + s;
+        w = ((w * Math.pow(2, s)) % PDP10.WORD_LIMIT) + Math.trunc(w / Math.pow(2, 36 - s));
+        this.writeWord(ac, w);
+    }
+};
+
+/**
+ * opLSH(0o242000): Logical Shift
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-24:
+ *
+ *      Shift and Rotate
+ *
+ *      The remaining logical instructions shift or rotate right or left the contents of AC or the contents
+ *      of two accumulators, A and A+1 (mod 20 [base 8]), concatenated into a 72-bit register with A on the
+ *      left.  The illustration below shows the movement of information these instructions produce in the
+ *      accumulators.  In a (logical) shift the contents of a register are moved bit-to-bit with 0s brought
+ *      in at the end being vacated; information shifted out at the other end is lost.  [For a discussion of
+ *      arithmetic shifting see § 2.5.]  In rotation the contents are moved cyclically such that information
+ *      rotated out at one end is put in at the other.
+ *
+ *      The number of places moved is specified by the result of the effective address calculation taken as a
+ *      signed number (in twos complement notation) modulo 2^8 in magnitude.  In other words the effective shift
+ *      E is the number composed of bit 18 (which is the sign) and bits 28-35 of the calculation result.  Hence
+ *      the programmer may specify the shift directly in the instruction (perhaps indexed) or give an indirect
+ *      address to be used in calculating the shift.  A positive E produces motion to the left, a negative E to
+ *      the right; maximum movement is 255 places.
+ *
+ *      LSH: Logical Shift
+ *
+ *      Shift AC the number of places specified by E.  If E is positive, shift left bringing 0s into bit 35;
+ *      data shifted out of bit 0 is lost.  If E is negative, shift right bringing 0s into bit 0; data shifted
+ *      out of bit 35 is lost.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opLSH = function(op, ac)
+{
+    /*
+     * Convert the unsigned 18-bit value in regEA to a signed 8-bit value (-256 to 255).
+     */
+    var s = (((this.regEA & PDP10.HINT_LIMIT) << 14) >> 23) | (this.regEA & 0xff);
+    if (s) {
+        var w = this.readWord(ac);
+        if (s > 0) {
+            if (s >= 36) {
+                w = 0;
+            } else {
+                w = (w * Math.pow(2, s)) % PDP10.WORD_LIMIT;
+            }
+        } else {
+            if (s <= -36) {
+                w = 0;
+            } else {
+                w = Math.trunc(w / Math.pow(2, -s));
+            }
+        }
+        this.writeWord(ac, w);
+    }
+};
+
+/**
+ * opJFFO(0o243000): Jump if Find First One
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-56:
+ *
+ *      If AC contains zero, clear AC A+1 and go on to the next instruction in sequence.
+ *
+ *      If AC is not zero, count the number of leading 0s in it (0s to the left of the leftmost 1),
+ *      and place the count in AC A+1.  Take the next instruction from location E and continue sequential
+ *      operation from there.  In either case AC is unaffected, the original contents of AC A +1 are lost.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opJFFO = function(op, ac)
+{
+    var dst = 0;
+    var src = this.readWord(ac);
+    if (src) {
+        while (src < PDP10.INT_LIMIT) {
+            dst++;
+            src *= 2;
+        }
+        this.setPC(this.regEA);
+    }
+    this.writeWord((ac + 1) & 0o17, dst);
+};
+
+/**
+ * opASHC(0o244000): Arithmetic Shift
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-32:
+ *
+ *      Concatenate the magnitude portions of accumulators A and A+1 with A on the left, and shift
+ *      the 70-bit combination in bits 1-35 and 37-71 the number of places specified by E.  Do not shift
+ *      AC bit 0, but make bit 0 of AC A+1 equal to it if at least one shift occurs (ie if E is nonzero).
+ *
+ *      If E is positive, shift left bringing 0s into bit 71 (bit 35 of AC A+1); bit 37 (bit 1 of AC A+1)
+ *      is shifted into bit 35; data shifted out of bit 1 is lost; set Overflow if any bit of significance
+ *      is lost (a 1 in a positive number, a 0 in a negative one).  If E is negative, shift right bringing 0s
+ *      into bit 1 if AC is positive, 1s if negative; bit 35 is shifted into bit 37; data shifted out of
+ *      bit 71 is lost.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opASHC = function(op, ac)
+{
+    /*
+     * Convert the unsigned 18-bit value in regEA to a signed 8-bit value (-256 to 255).
+     */
+    var s = (((this.regEA & PDP10.HINT_LIMIT) << 14) >> 23) | (this.regEA & 0xff);
+    if (s) {
+        var bits;
+        var wLeft = this.readWord(ac);
+        var wRight = this.readWord((ac + 1) & 0o17);
+        if (s > 0) {
+            /*
+             * Handle all the left shift cases below, which don't need to worry about sign-extension
+             * but DO need to worry about overflow.
+             */
+            var wLeftOrig = wLeft;
+            if (s >= 36) {
+                /*
+                 * Since all wLeft bits are being shifted out, any positive value other than zero OR any negative value
+                 * other than WORD_MASK indicates an overflow.
+                 */
+                if (wLeft > 0 && wLeft < PDP10.INT_LIMIT || wLeft > PDP10.INT_MASK && wLeft < PDP10.WORD_MASK) {
+                    this.regPS |= PDP10.PSFLAG.AROV;
+                }
+                if (s >= 71) {
+                    /*
+                     * Since all wRight bits are being shifted out, any positive value other than zero OR any negative value
+                     * other than WORD_MASK indicates an overflow.
+                     */
+                    if (wRight > 0 && wRight < PDP10.INT_LIMIT || wRight > PDP10.INT_MASK && wRight < PDP10.WORD_MASK) {
+                        this.regPS |= PDP10.PSFLAG.AROV;
+                    }
+                    wLeft = 0;
+                } else {
+                    /*
+                     * Left shift 36-70 bits.
+                     */
+                    wLeft = (wRight * Math.pow(2, s - 35)) % PDP10.INT_LIMIT;
+                    bits = PDP10.INT_LIMIT - Math.pow(2, 70 - s);
+                    if (wLeftOrig <= PDP10.INT_MASK) {
+                        /*
+                         * Since wLeft was positive, overflow occurs ONLY if any of the bits we shifted out were 1s.
+                         * If all those bits in the original value were 0s, then adding bits to it could NOT produce
+                         * a value > INT_MASK.
+                         */
+                        if (wRight + bits > PDP10.INT_MASK) {
+                            this.regPS |= PDP10.PSFLAG.AROV;
+                        }
+                    } else {
+                        /*
+                         * Since wLeft was negative, overflow occurs ONLY if any of the bits we shifted out were 0s.
+                         * If all those bits in the original value were 1s, subtracting bits from it could NOT produce
+                         * a value <= INT_MASK.
+                         */
+                        if (wRight - bits <= PDP10.INT_MASK) {
+                            this.regPS |= PDP10.PSFLAG.AROV;
+                        }
+                    }
+                }
+                wRight = 0;
+                if (wLeftOrig > PDP10.INT_MASK) {
+                    wLeft += PDP10.INT_LIMIT;
+                    wRight += PDP10.INT_LIMIT;
+                }
+            } else {
+                /*
+                 * Left shift 1-35 bits.
+                 */
+                wLeft = ((wLeft * Math.pow(2, s)) % PDP10.INT_LIMIT) + Math.trunc((wRight % PDP10.INT_LIMIT) / Math.pow(2, 35 - s));
+                wRight = (wRight * Math.pow(2, s)) % PDP10.INT_LIMIT;
+                /*
+                 * Determine overflow and update the sign bits.
+                 */
+                bits = PDP10.INT_LIMIT - Math.pow(2, 35 - s);
+                if (wLeftOrig <= PDP10.INT_MASK) {
+                    /*
+                     * Since wLeft was positive, overflow occurs ONLY if any of the bits we shifted out were 1s.
+                     * If all those bits in the original value were 0s, then adding bits to it could NOT produce
+                     * a value > INT_MASK.
+                     */
+                    if (wLeftOrig + bits > PDP10.INT_MASK) {
+                        this.regPS |= PDP10.PSFLAG.AROV;
+                    }
+                } else {
+                    /*
+                     * Since wLeft was negative, overflow occurs ONLY if any of the bits we shifted out were 0s.
+                     * If all those bits in the original value were 1s, subtracting bits from it could NOT produce
+                     * a value <= INT_MASK.
+                     */
+                    if (wLeftOrig - bits <= PDP10.INT_MASK) {
+                        this.regPS |= PDP10.PSFLAG.AROV;
+                    }
+                    /*
+                     * Last but not least, update the sign bits of wLeft and wRight to indicate negative values.
+                     */
+                    wLeft += PDP10.INT_LIMIT;
+                    wRight += PDP10.INT_LIMIT;
+                }
+            }
+        } else {
+            /*
+             * Handle all the right shift cases below, which don't need to worry about overflow but DO
+             * need to worry about sign-extension.
+             */
+            if (s <= -36) {
+                if (s <= -72) {
+                    wRight = (wLeft > PDP10.INT_MASK? PDP10.WORD_MASK : 0);
+                } else {
+                    wRight = Math.trunc((wLeft % PDP10.INT_LIMIT) / Math.pow(2, -s - 35));
+                }
+                if (wLeft <= PDP10.INT_MASK) {
+                    wLeft = 0;
+                } else {
+                    wLeft = PDP10.WORD_MASK;
+                    wRight += PDP10.INT_LIMIT;
+                }
+            } else {
+                /*
+                 * For this right shift of 1-35 bits, determine the value of bits shifted in from the left.
+                 */
+                bits = (wLeft > PDP10.INT_MASK? PDP10.WORD_LIMIT - Math.pow(2, 36 + s) : 0);
+                /*
+                 * The bits that we add to wRight from wLeft must be shifted right one additional bit, because
+                 * they must "skip over" the sign bit of wRight.  This means we must zero the sign bit of wRight,
+                 * which can be done by performing a "mod" with INT_LIMIT.
+                 */
+                wRight = Math.trunc((wRight % PDP10.INT_LIMIT) / Math.pow(2, -s)) + (((wLeft % PDP10.INT_LIMIT) * Math.pow(2, 35 + s)) % PDP10.INT_LIMIT);
+                wLeft = Math.trunc(wLeft / Math.pow(2, -s)) + bits;
+                /*
+                 * Last but not least, we must set the sign of wRight to the sign of wLeft.
+                 */
+                if (wLeft > PDP10.INT_MASK) wRight += PDP10.INT_LIMIT;
+            }
+        }
+        this.writeWord(ac, wLeft);
+        this.writeWord((ac + 1) & 0o17, wRight);
+    }
+};
+
+/**
+ * opROTC(0o245000): Rotate Combined
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-26:
+ *
+ *      Concatenate accumulators A and A+1 with A on the left, and rotate the 72-bit combination the
+ *      number of places specified by E.  If E is positive, rotate left; bit 0 is rotated into bit 71
+ *      (bit 35 of AC A+1) and bit 36 into bit 35.  If E is negative, rotate right; bit 35 is rotated
+ *      into bit 36 and bit 71 into bit 0.
+ *
+ *      The number of places moved is specified by the result of the effective address calculation taken as
+ *      a signed number (in twos complement notation) modulo 2^8 in magnitude.  In other words the effective
+ *      shift E is the number composed of bit 18 (which is the sign) and bits 28-35 of the calculation result.
+ *      Hence the programmer may specify the shift directly in the instruction (perhaps indexed) or give an
+ *      indirect address to be used in calculating the shift.  A positive E produces motion to the left,
+ *      a negative E to the right; maximum movement is 255 places.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opROTC = function(op, ac)
+{
+    /*
+     * Convert the unsigned 18-bit value in regEA to a signed 8-bit value, modulo 72 (+/-71).
+     */
+    var s = ((((this.regEA & PDP10.HINT_LIMIT) << 14) >> 23) | (this.regEA & 0xff)) % 72;
+    if (s) {
+        var wLeft = this.readWord(ac);
+        var wRight = this.readWord((ac + 1) & 0o17);
+        var wLeftOrig = wLeft;
+        /*
+         * Note that a right rotation (s < 0) of s bits is equivalent to a left rotation (s > 0) of 72 + s bits.
+         */
+        if (s < 0) s = 72 + s;
+        if (s < 36) {
+            wLeft = ((wLeft * Math.pow(2, s)) % PDP10.WORD_LIMIT) + Math.trunc(wRight / Math.pow(2, 36 - s));
+            wRight = ((wRight * Math.pow(2, s)) % PDP10.WORD_LIMIT) + Math.trunc(wLeftOrig / Math.pow(2, 36 - s));
+        } else {
+            wLeft = ((wRight * Math.pow(2, s - 36)) % PDP10.WORD_LIMIT) + Math.trunc(wLeft / Math.pow(2, 72 - s));
+            wRight = ((wLeftOrig * Math.pow(2, s - 36)) % PDP10.WORD_LIMIT) + Math.trunc(wRight / Math.pow(2, 72 - s));
+        }
+        this.writeWord(ac, wLeft);
+        this.writeWord((ac + 1) & 0o17, wRight);
+    }
+};
+
+/**
+ * opLSHC(0o246000): Logical Shift Combined
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-25:
+ *
+ *      Concatenate accumulators A and A+1 with A on the left, and shift the 72-bit combination the number
+ *      of places specified by E.  If E is positive, shift left bringing 0s into bit 71 (bit 35 of AC A+1);
+ *      bit 36 is shifted into bit 35; data shifted out of bit 0 is lost.  If E is negative, shift right
+ *      bringing 0s into bit 0; bit 35 is shifted into bit 36; data shifted out of bit 71 is lost.
+ *
+ *      The number of places moved is specified by the result of the effective address calculation taken as
+ *      a signed number (in twos complement notation) modulo 2^8 in magnitude.  In other words the effective
+ *      shift E is the number composed of bit 18 (which is the sign) and bits 28-35 of the calculation result.
+ *      Hence the programmer may specify the shift directly in the instruction (perhaps indexed) or give an
+ *      indirect address to be used in calculating the shift.  A positive E produces motion to the left,
+ *      a negative E to the right; maximum movement is 255 places.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opLSHC = function(op, ac)
+{
+    /*
+     * Convert the unsigned 18-bit value in regEA to a signed 8-bit value (-256 to 255).
+     */
+    var s = (((this.regEA & PDP10.HINT_LIMIT) << 14) >> 23) | (this.regEA & 0xff);
+    if (s) {
+        var wLeft = this.readWord(ac);
+        var wRight = this.readWord((ac + 1) & 0o17);
+        if (s > 0) {
+            if (s >= 36) {
+                if (s >= 72) {
+                    wLeft = 0;
+                } else {
+                    wLeft = (wRight * Math.pow(2, s - 36)) % PDP10.WORD_LIMIT;
+                }
+                wRight = 0;
+            } else {
+                wLeft = ((wLeft * Math.pow(2, s)) % PDP10.WORD_LIMIT) + Math.trunc(wRight / Math.pow(2, 36 - s));
+                wRight = (wRight * Math.pow(2, s)) % PDP10.WORD_LIMIT;
+            }
+        } else {
+            if (s <= -36) {
+                if (s <= -72) {
+                    wRight = 0;
+                } else {
+                    wRight = Math.trunc(wLeft / Math.pow(2, -s - 36));
+                }
+                wLeft = 0;
+            } else {
+                wRight = Math.trunc(wRight / Math.pow(2, -s)) + ((wLeft * Math.pow(2, 36 + s)) % PDP10.WORD_LIMIT);
+                wLeft = Math.trunc(wLeft / Math.pow(2, -s));
+            }
+        }
+        this.writeWord(ac, wLeft);
+        this.writeWord((ac + 1) & 0o17, wRight);
+    }
+};
+
+/**
+ * opEXCH(0o250000): Exchange
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-9:
+ *
+ *      Move the contents of location E to AC and move AC to location E.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opEXCH = function(op, ac)
+{
+    var tmp = this.readWord(ac);
+    this.writeWord(ac, this.readWord(this.regEA));
+    this.writeWord(this.regEA, tmp);
+};
+
+/**
+ * opBLT(0o251000): Block Transfer
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-10:
+ *
+ *      Beginning at the location addressed by AC left, move words to another area of memory beginning at the
+ *      location addressed by AC right.  Continue until a word is moved to location E.  The total number of words
+ *      in the block is thus E - AC(right) + 1.
+ *
+ *      CAUTION: Priority interrupts are allowed during the execution of this instruction, following the processing
+ *      of each word.  If an interrupt occurs, the BLT stores the source and destination addresses for the next word
+ *      in AC, so when the processor restarts upon the return to the interrupted program, it actually resumes at
+ *      the correct point within the BLT.  Therefore, unless the interrupt system is inactive, A and X must not address
+ *      the same register as this would produce a different effective address calculation upon resumption should an
+ *      interrupt occur; and the program must not attempt to load an accumulator addressed either by A or X unless it
+ *      is the final location being loaded.  Furthermore, the program cannot assume that AC is the same after the BLT
+ *      as it was before.
+ *
+ * TODO: Determine the logic behind SIMH's treatment of the AC register when it's part of the memory being transferred.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opBLT = function(op, ac)
+{
+    var fDone = false, fUpdate = false;
+    var addrDst = this.readWord(ac);
+    var addrSrc = (addrDst / PDP10.HALF_SHIFT)|0;
+    addrDst &= PDP10.HALF_MASK;
+    while (!fDone) {
+        this.writeWord(addrDst, this.readWord(addrSrc));
+        /*
+         * NOTE: The PDP-10 specs (especially the KA10 Reference Manual) are not very clear on the exit criteria:
+         * the transfer stops once AC left >= E, not AC left == E.  They are also not very clear on whether the addresses
+         * are incremented before or after the exit criteria is checked; however, the KA10 "DAKAM" diagnostic seems
+         * pretty adamant that, at least after a one-word BLT operation, the addresses should NOT be incremented.
+         */
+        if (!(fDone = (addrDst >= this.regEA))) {
+            addrSrc = (addrSrc + 1) & PDP10.HALF_MASK;
+            addrDst = (addrDst + 1) & PDP10.HALF_MASK;
+            fUpdate = true;
+        }
+        if (fDone || !this.isRunning()) {
+            /*
+             * If the CPU isn't currently running, the CPU is presumably being stepped, so we'll treat that the
+             * same as the "priority interrupt" condition described above, update the addresses, rewind the PC, and leave.
+             */
+            if (fUpdate) this.writeWord(ac, addrSrc * PDP10.HALF_SHIFT + addrDst);
+            if (!fDone) this.advancePC(-1);
+            break;
+        }
+    }
+};
+
+/**
+ * opAOBJP(0o252000): Add One to Both Halves of AC and Jump if Positive
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-41:
+ *
+ *      Add 1000001 [base 8] to AC and place the result back in AC.  If the result is greater than or equal
+ *      to zero (ie if bit 0 is 0, and hence a negative count in the left half has reached zero or a positive
+ *      count has not yet reached 2^17), take the next instruction from location E and continue sequential
+ *      operation from there.
+ *
+ *      The incrementing of both halves of AC simultaneously is effected by adding 1000001 [base 8].  A count
+ *      of -2 in AC left is therefore increased to zero if 2^18 - 1 is incremented in AC right.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opAOBJP = function(op, ac)
+{
+    var dst = (this.readWord(ac) + 0o000001000001) % PDP10.WORD_LIMIT;
+    this.writeWord(ac, dst);
+    if (dst < PDP10.INT_LIMIT) this.setPC(this.regEA);
+};
+
+/**
+ * opAOBJN(0o253000): Add One to Both Halves of AC and Jump if Negative
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-41:
+ *
+ *      Add 1000001 [base 8] to AC and place the result back in AC.  If the result is less than zero
+ *      (ie if bit 0 is 1, and hence a negative count in the left half has not yet reached zero or a positive
+ *      count has reached 2^17), take the next instruction from location E and continue sequential operation
+ *      from there.
+ *
+ *      The incrementing of both halves of AC simultaneously is effected by adding 1000001 [base 8].  A count
+ *      of -2 in AC left is therefore increased to zero if 2^18 - 1 is incremented in AC right.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opAOBJN = function(op, ac)
+{
+    var dst = (this.readWord(ac) + 0o000001000001) % PDP10.WORD_LIMIT;
+    this.writeWord(ac, dst);
+    if (dst >= PDP10.INT_LIMIT) this.setPC(this.regEA);
+};
+
+/**
+ * opJRST(0o254000): Jump and Restore
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-57:
+ *
+ *      Perform the functions specified by F, then take the next instruction from location E and continue sequential
+ *      operation from there. Bits 9-12 are programmed as follows.
+ *
+ *        9     Restore the channel on which the highest priority interrupt is currently being held [§ 2.13].
+ *
+ *              Unless the User In-out flag is set, this function cannot be executed in a user program.  Instead
+ *              of restoring the channel, it stores its own instruction code, F and effective address E in bits 0-8,
+ *              9-12 and 18-35 respectively of unrelocated location 40 (clearing bits 13-17), and then executes the
+ *              instruction contained in location 41, which is under control of the monitor [§ 2.15].
+ *
+ *       10     Halt the processor.  When it stops, the MA lights on the console display an address one greater
+ *              than that of the location containing the instruction that caused the halt, and PC displays the jump
+ *              address (the location from which the next instruction will be taken if the operator causes the processor
+ *              to resume operation without changing PC).
+ *
+ *              Unless the User In-out flag is set, this function cannot be executed in a user program.  Instead of
+ *              halting the processor, it stores its own instruction code, F and effective address E in Bits 0-8, 9-12
+ *              and 18-35 respectively of unrelocated location 40 (clearing bits 13-17), and then executes the
+ *              instruction contained in location 41, which is under control of the monitor [§ 2.15].
+ *
+ *       11     Restore the flags listed above from the left half of the word in the last location referenced in the
+ *              effective address calculation.  Hence to restore flags requires that the JRST instruction use indexing
+ *              or indirect addressing.
+ *
+ *              Restoration of all but the user flags is directly according to the contents of the corresponding bits
+ *              as given above: a flag is set by a 1 in the bit, cleared by a 0.  A 1 in bit 5 sets User but a 0 has no
+ *              effect, so the Monitor can restart a user program by restoring flags but the user cannot leave user
+ *              mode by this method.  A 0 in bit 6 clears User In-out, but a 1 sets it only if the JRST is being
+ *              executed by the Monitor, ie if User is clear.
+ *
+ *       12     Enter user mode.  The user program starts at relocated location E.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opJRST = function(op, ac)
+{
+    if (ac & 0b0001) {
+        /*
+         * Enter user mode.
+         */
+        this.setUserMode();
+    }
+    if (ac & 0b0010) {
+        /*
+         * Restore the flags.
+         */
+        this.setPS((this.regLA / PDP10.HALF_SHIFT)|0);
+    }
+    if (ac & 0b0100) {
+        /*
+         * Halt the processor.
+         */
+        this.stopCPU();
+    }
+    if (ac & 0b1000) {
+        /*
+         * Restore interrupt channel.
+         */
+        this.opUndefined(op);
+    }
+    this.setPC(this.regEA);
+};
+
+/**
+ * opJFCL(0o255000): Jump on Flag and Clear
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-57:
+ *
+ *      If any flag specified by F [ac] is set, clear it and take the next instruction from location E,
+ *      continuing sequential operation from there.
+ *
+ *      To select one or a combination of these flags (which are among those described above) the programmer can specify
+ *      the equivalent of an AC address that places 1s in the appropriate bits, but MACRO recognizes mnemonics for some of
+ *      the 13-bit instruction codes (bits 0-12).
+ *
+ *          JFCL        JFCL    0,      No-op                       25500
+ *          JOV         JFCL    10,     Jump on Overflow            25540
+ *          JCRY0       JFCL    4,      Jump on Carry 0             25520
+ *          JCRY1       JFCL    2,      Jump on Carry 1             25510
+ *          JCRY        JFCL    6,      Jump on Carry 0 or 1        25530
+ *          JFOV        JFCL    1,      Jump on Floating Overflow   25504
+ *
+ *      SIDEBAR: This instruction can be used simply to clear the selected flags by having the jump address point to the
+ *      next consecutive location, as in:
+ *
+ *          JFCL 17,.+1
+ *
+ *      which clears all four flags without disrupting the normal program sequence.  A JFCL that selects no flag is the fastest
+ *      no-op as it neither fetches nor stores an operand, and bits 18-35 of the instruction word can be used to store information.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opJFCL = function(op, ac)
+{
+    /*
+     * The ac (F) bits from the opcode align perfectly with the top 4 bits of regPS; all we have to do is shift ac left 14.
+     */
+    var bitsPS = ac << 14;
+    if (this.regPS & bitsPS) {
+        this.regPS &= ~bitsPS;
+        this.setPC(this.regEA);
+    }
+};
+
+/**
+ * opXCT(0o256000): Execute
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-56:
+ *
+ *      Execute the contents of location E as an instruction.  Any instruction may be executed, including another XCT.
+ *      If an XCT executes a skip instruction, the skip is relative to the location of the XCT (the first XCT if there
+ *      are several in a chain).  If an XCT executes a jump, program flow is altered as specified by the jump (no matter
+ *      how many XCTs precede a jump instruction, when PC is saved it contains an address one greater than the location
+ *      of the first XCT in the chain).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opXCT = function(op, ac)
+{
+    this.regXC = this.regEA;
+};
+
+/**
+ * opPUSHJ(0o260000): Push Down and Jump
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-62:
+ *
+ *      Add 1000001 [base 8] to AC to increment both halves by one and place the result back in AC.  If the addition
+ *      causes the count in AC left to reach zero, set the Pushdown Overflow flag.  Then place the current contents of
+ *      the flags (as described above) in the left half of the location now addressed by AC right and the contents of
+ *      PC in the right half of that location (at this time PC contains an address one greater than the location of
+ *      the PUSHJ instruction).  Take the next instruction from location E and continue sequential operation from there.
+ *
+ *      The flags are unaffected except Byte Interrupt, which is cleared.  The original contents of the location added
+ *      to the list are lost.  If this instruction is executed as a result of a priority interrupt or in unrelocated
+ *      41 or 61 while the processor is in user mode, bit 5 of the PC word stored is 1 and the processor leaves user mode.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opPUSHJ = function(op, ac)
+{
+    var p = (this.readWord(ac) + 0o000001000001) % PDP10.WORD_LIMIT;
+    this.writeWord(ac, p);
+    if (!((p / PDP10.HALF_SHIFT)|0)) {
+        this.regPS |= PDP10.PSFLAG.PDOV;
+    }
+    this.writeWord(p & PDP10.ADDR_MASK, this.getPS() * PDP10.HALF_SHIFT + this.getPC());
+    this.regPS &= ~PDP10.PSFLAG.BIS;            // TODO: Verify that BIS is cleared AFTER calling getPS()
+    this.setPC(this.regEA);
+};
+
+/**
+ * opPUSH(0o261000): Push Down
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-13:
+ *
+ *      Add 000001 000001 to AC to increment both halves by one, then move the contents of location E to the
+ *      location now addressed by AC right.  If the addition causes the count in AC left to reach zero, set the
+ *      Pushdown Overflow flag.  The contents of E are unaffected, the original contents of the location added
+ *      to the list are lost.
+ *
+ * If we trusted SIMH, then we could not literally interpret this instruction as adding 000001 000001 to AC,
+ * because if AC contained 777777 777777, adding 000001 000001 would result in 000001 000000, not 000000 000000,
+ * and yet 000000 000000 is EXACTLY what we get in SIMH.
+ *
+ * And yet, DEC's documentation clearly contradicts what SIMH is doing:
+ *
+ *      The incrementing and decrementing of both halves of AC simultaneously is effected by adding and subtracting
+ *      000001 000001.  Hence a count of -2 in AC left is increased to zero if 2^18 - 1 is incremented in AC right,
+ *      and conversely, 1 in AC left is decreased to -1 if zero is decremented in AC right.
+ *
+ * Perhaps SIMH is simply emulating the behavior of some later PDP-10 model, which performed independent increments?
+ *
+ * TODO: Investigate.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opPUSH = function(op, ac)
+{
+    var p = this.readWord(ac);
+    if (!PDP10.SIMH) {
+        /*
+         * This is the behavior that is clearly documented by DEC.
+         */
+        p += 0o000001000001;
+        this.writeWord(p & PDP10.ADDR_MASK, this.readWord(this.regEA));
+        if (p >= PDP10.WORD_LIMIT) p -= PDP10.WORD_LIMIT;
+        if (!((p / PDP10.HALF_SHIFT)|0)) {
+            this.regPS |= PDP10.PSFLAG.PDOV;
+        }
+    } else {
+        /*
+         * This is the SIMH behavior, which appears to increment each half of AC independently.
+         */
+        var addr = (p + 1) & PDP10.ADDR_MASK;
+        this.writeWord(addr, this.readWord(this.regEA));
+        p = (p + 0o000001000000) - (p & PDP10.ADDR_MASK) + addr;
+        if (p >= PDP10.WORD_LIMIT) {
+            p -= PDP10.WORD_LIMIT;
+            this.regPS |= PDP10.PSFLAG.PDOV;
+        }
+    }
+    this.writeWord(ac, p);
+};
+
+/**
+ * opPOP(0o262000): Pop Up
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-13:
+ *
+ *      Move the contents of the location addressed by AC right to location E, then subtract 000001 000001
+ *      from AC to decrement both halves by one.  If the subtraction causes the count in AC left to reach -1,
+ *      set the Pushdown Overflow flag.  The original contents of E are lost.
+ *
+ *      NOTE: Because of the order in which the operands are stored, the instruction POP AC,AC would load the
+ *      contents of the location addressed by AC right into AC on top of the pushdown count, destroying it.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opPOP = function(op, ac)
+{
+    var p = this.readWord(ac);
+    var src = this.readWord(p & PDP10.ADDR_MASK);
+    this.writeWord(this.regEA, src);
+    if (this.regEA == ac) p = src;     // this avoids re-reading the accumulator if the write just overwrote it
+    p -= 0o000001000001;
+    if (p < 0) p += PDP10.WORD_LIMIT;
+    if (((p / PDP10.HALF_SHIFT)|0) == PDP10.HALF_MASK) {
+        this.regPS |= PDP10.PSFLAG.PDOV;
+    }
+    this.writeWord(ac, p);
+};
+
+/**
+ * opPOPJ(0o263000): Pop Up and Jump
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-63:
+ *
+ *      Subtract 1000001 [base 8] from AC to decrement both halves by one and place the result back in AC.
+ *      If the subtraction causes the count in AC left to reach -1, set the Pushdown Overflow flag.  Take the
+ *      next instruction from the location addressed by the right half of the location that was addressed by
+ *      AC right prior to the decrementing, and continue sequential operation from there.
+ *
+ *      SIDEBAR: The effective address E is ignored.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opPOPJ = function(op, ac)
+{
+    var p = this.readWord(ac);
+    var pc = this.readWord(p & PDP10.ADDR_MASK);
+    p -= 0o000001000001;
+    if (p < 0) p += PDP10.WORD_LIMIT;
+    if (((p / PDP10.HALF_SHIFT)|0) == PDP10.HALF_MASK) {
+        this.regPS |= PDP10.PSFLAG.PDOV;
+    }
+    this.writeWord(ac, p);
+    this.setPC(pc & PDP10.ADDR_MASK);
+};
+
+/**
+ * opJSR(0o264000): Jump to Subroutine
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-57:
+ *
+ *      Place the current contents of the flags (as described above) in the left half of location E and the
+ *      contents of PC in the right half (at this time PC contains an address one greater than the location of
+ *      the JSR instruction).  Take the next instruction from location E + 1 and continue sequential operation
+ *      from there.  The flags are unaffected except Byte Interrupt, which is cleared.
+ *
+ *      If this instruction is executed as a result of a priority interrupt or in un-relocated 41 or 61 while
+ *      the processor is in user mode, bit 5 of the PC word stored is 1 and the processor leaves user mode.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opJSR = function(op, ac)
+{
+    this.writeWord(this.regEA, this.getPS() * PDP10.HALF_SHIFT + this.getPC());
+    this.regPS &= ~PDP10.PSFLAG.BIS;            // TODO: Verify that BIS is cleared AFTER calling getPS()
+    this.setPC(this.regEA + 1);
+};
+
+/**
+ * opJSP(0o265000): Jump and Save PC
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-58:
+ *
+ *      Place the current contents of the flags (as described above) in AC left and the contents of PC in AC right
+ *      (at this time PC contains an address one greater than the location of the JSP instruction).  Take the next
+ *      instruction from location E and continue sequential operation from there.  The flags are unaffected except
+ *      Byte Interrupt, which is cleared.
+ *
+ *      If this instruction is executed as a result of a priority interrupt or in un-relocated 41 or 61 while the
+ *      processor is in user mode, bit 5 of the PC word stored is 1 and the processor leaves user mode.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opJSP = function(op, ac)
+{
+    this.writeWord(ac, this.getPS() * PDP10.HALF_SHIFT + this.getPC());
+    this.regPS &= ~PDP10.PSFLAG.BIS;            // TODO: Verify that BIS is cleared AFTER calling getPS()
+    this.setPC(this.regEA);
+};
+
+/**
+ * opJSA(0o266000): Jump and Save AC
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-61:
+ *
+ *      Place AC in location E, the effective address E in AC left, and the contents of PC in AC right (at this time
+ *      PC contains an address one greater than the location of the JSA instruction).  Take the next instruction from
+ *      location E + 1 and continue sequential operation from there.  The original contents of E are lost.
+ *
+ *      If this instruction is executed as a result of a priority interrupt or in unrelocated 41 or 61 while the processor
+ *      is in user mode, bit 5 of the PC word stored is 1 and the processor leaves user mode.
+ *
+ * Regarding JSA and JRA:
+ *
+ *      A JSA combines advantages of the JSR and JSP.  JSA does modify memory, but it saves PC in an accumulator
+ *      without losing its previous contents (at a cost of not saving the flags).  It is thus convenient for multiple-entry
+ *      subroutines.  In a subroutine called by a JSR, the returning JRST must refer to the (single) entry point.
+ *      Since a JRA can retrieve the original PC by addressing AC as an index register, it is independent of any entry point
+ *      without tying up an accumulator to the extent a JSP would.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opJSA = function(op, ac)
+{
+    this.writeWord(this.regEA, this.readWord(ac));
+    this.writeWord(ac, this.regEA * PDP10.HALF_SHIFT + this.getPC());
+    this.setPC(this.regEA + 1);
+};
+
+/**
+ * opJRA(0o267000): Jump and Restore AC
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-61:
+ *
+ *      Place the contents of the location addressed by AC left into AC.  Take the next instruction from location E and
+ *      continue sequential operation from there.
+ *
+ * This opcode functions as the counterpart to JSA, but ONLY if location E (the effective address calculated by the JRA) indexes
+ * with the same AC that was used with the JSA.
+ *
+ *              JSA     17,F1
+ *      R1:     ...
+ *              ...
+ *      F1:     0                       ; location to save AC 17, as specified by the A field of "JSA 17,F1"
+ *      F2:     ...                     ; first instruction executed after "JSA 17,F1"
+ *              JRA     17,(17)         ; return to R1, after restoring AC 17
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opJRA = function(op, ac)
+{
+    var acc = this.readWord(ac);
+    this.writeWord(ac, this.readWord((acc / PDP10.HALF_SHIFT)|0));
+    this.setPC(this.regEA);
+};
+
+/**
+ * opADD(0o270000): Add
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-27:
+ *
+ *      Add the operand specified by M to AC and place the result in the specified destination.  If the sum is >= 2^35
+ *      set Overflow and Carry 1; the result stored has a minus sign but a magnitude in positive form equal to the sum less 2^35.
+ *      If the sum is < -2^35 set Overflow and Carry 0; the result stored has a plus sign but a magnitude in negative form equal
+ *      to the sum plus 2^35.  Set both carry flags if both summands are negative, or their signs differ and their magnitudes
+ *      are equal or the positive one is the greater in magnitude.
+ *
+ * NOTE: This is a "Basic" mode instruction: the source is [E] and the destination is [A] (opposite of "Memory").
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opADD = function(op, ac)
+{
+    this.writeWord(ac, PDP10.doADD.call(this, this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opADDI(0o271000): Add Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-27:
+ *
+ *      Add the operand specified by M to AC and place the result in the specified destination.  If the sum is >= 2^35
+ *      set Overflow and Carry 1; the result stored has a minus sign but a magnitude in positive form equal to the sum less 2^35.
+ *      If the sum is < -2^35 set Overflow and Carry 0; the result stored has a plus sign but a magnitude in negative form equal
+ *      to the sum plus 2^35.  Set both carry flags if both summands are negative, or their signs differ and their magnitudes
+ *      are equal or the positive one is the greater in magnitude.
+ *
+ * NOTE: This is an "Immediate" mode instruction: the source is the word 0,E and the destination is [A].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opADDI = function(op, ac)
+{
+    this.writeWord(ac, PDP10.doADD.call(this, this.readWord(ac), this.regEA));
+};
+
+/**
+ * opADDM(0o272000): Add to Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-27:
+ *
+ *      Add the operand specified by M to AC and place the result in the specified destination.  If the sum is >= 2^35
+ *      set Overflow and Carry 1; the result stored has a minus sign but a magnitude in positive form equal to the sum less 2^35.
+ *      If the sum is < -2^35 set Overflow and Carry 0; the result stored has a plus sign but a magnitude in negative form equal
+ *      to the sum plus 2^35.  Set both carry flags if both summands are negative, or their signs differ and their magnitudes
+ *      are equal or the positive one is the greater in magnitude.
+ *
+ * NOTE: This is a "Memory" mode instruction: the source is [E] and the destination is [E] (opposite of "Basic").
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opADDM = function(op, ac)
+{
+    this.writeWord(this.regEA, PDP10.doADD.call(this, this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opADDB(0o273000): Add to Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-27:
+ *
+ *      Add the operand specified by M to AC and place the result in the specified destination.  If the sum is >= 2^35
+ *      set Overflow and Carry 1; the result stored has a minus sign but a magnitude in positive form equal to the sum less 2^35.
+ *      If the sum is < -2^35 set Overflow and Carry 0; the result stored has a plus sign but a magnitude in negative form equal
+ *      to the sum plus 2^35.  Set both carry flags if both summands are negative, or their signs differ and their magnitudes
+ *      are equal or the positive one is the greater in magnitude.
+ *
+ * NOTE: This is a "Both" mode instruction: the source is [E] and the destination is [E] and [A].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opADDB = function(op, ac)
+{
+    this.writeWord(this.regEA, this.writeWord(ac, PDP10.doADD.call(this, this.readWord(ac), this.readWord(this.regEA))));
+};
+
+/**
+ * opSUB(0o274000): Subtract
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-27:
+ *
+ *      Subtract the operand specified by M from AC and place the result in the specified destination.  If the difference
+ *      is >= 2^35 set Overflow and Carry 1; the result stored has a minus sign but a magnitude in positive form equal to the
+ *      difference less 2^35.  If the difference is < -2^35 set Overflow and Carry 0; the result stored has a plus sign but
+ *      a magnitude in negative form equal to the difference plus 2^35.  Set both carry flags if the signs of the operands are
+ *      the same and AC is the greater or the two are equal, or the signs of the operands differ and AC is negative.
+ *
+ * NOTE: This is a "Basic" mode instruction: the source is [E] and the destination is [A] (opposite of "Memory").
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSUB = function(op, ac)
+{
+    this.writeWord(ac, PDP10.doSUB.call(this, this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opSUBI(0o275000): Subtract Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-27:
+ *
+ *      Subtract the operand specified by M from AC and place the result in the specified destination.  If the difference
+ *      is >= 2^35 set Overflow and Carry 1; the result stored has a minus sign but a magnitude in positive form equal to the
+ *      difference less 2^35.  If the difference is < -2^35 set Overflow and Carry 0; the result stored has a plus sign but
+ *      a magnitude in negative form equal to the difference plus 2^35.  Set both carry flags if the signs of the operands are
+ *      the same and AC is the greater or the two are equal, or the signs of the operands differ and AC is negative.
+ *
+ * NOTE: This is an "Immediate" mode instruction: the source is the word 0,E and the destination is [A].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSUBI = function(op, ac)
+{
+    this.writeWord(ac, PDP10.doSUB.call(this, this.readWord(ac), this.regEA));
+};
+
+/**
+ * opSUBM(0o276000): Subtract to Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-27:
+ *
+ *      Subtract the operand specified by M from AC and place the result in the specified destination.  If the difference
+ *      is >= 2^35 set Overflow and Carry 1; the result stored has a minus sign but a magnitude in positive form equal to the
+ *      difference less 2^35.  If the difference is < -2^35 set Overflow and Carry 0; the result stored has a plus sign but
+ *      a magnitude in negative form equal to the difference plus 2^35.  Set both carry flags if the signs of the operands are
+ *      the same and AC is the greater or the two are equal, or the signs of the operands differ and AC is negative.
+ *
+ * NOTE: This is a "Memory" mode instruction: the source is [E] and the destination is [E] (opposite of "Basic").
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSUBM = function(op, ac)
+{
+    this.writeWord(this.regEA, PDP10.doSUB.call(this, this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opSUBB(0o277000): Subtract to Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-27:
+ *
+ *      Subtract the operand specified by M from AC and place the result in the specified destination.  If the difference
+ *      is >= 2^35 set Overflow and Carry 1; the result stored has a minus sign but a magnitude in positive form equal to the
+ *      difference less 2^35.  If the difference is < -2^35 set Overflow and Carry 0; the result stored has a plus sign but
+ *      a magnitude in negative form equal to the difference plus 2^35.  Set both carry flags if the signs of the operands are
+ *      the same and AC is the greater or the two are equal, or the signs of the operands differ and AC is negative.
+ *
+ * NOTE: This is a "Both" mode instruction: the source is [E] and the destination is [E] and [A].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSUBB = function(op, ac)
+{
+    this.writeWord(this.regEA, this.writeWord(ac, PDP10.doSUB.call(this, this.readWord(ac), this.readWord(this.regEA))));
+};
+
+/**
+ * opCAIL(0o301000): Compare AC Immediate and Skip if AC Less than E
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-42:
+ *
+ *      Compare AC with E (ie with the word 0,E) and skip the next instruction in sequence if the condition
+ *      specified by M is satisfied.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opCAIL = function(op, ac)
+{
+    if (PDP10.CMP(this.readWord(ac), this.regEA) < 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opCAIE(0o302000): Compare AC Immediate and Skip if Equal
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-42:
+ *
+ *      Compare AC with E (ie with the word 0,E) and skip the next instruction in sequence if the condition
+ *      specified by M is satisfied.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opCAIE = function(op, ac)
+{
+    if (PDP10.CMP(this.readWord(ac), this.regEA) == 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opCAILE(0o303000): Compare AC Immediate and Skip if AC Less than or Equal to E
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-42:
+ *
+ *      Compare AC with E (ie with the word 0,E) and skip the next instruction in sequence if the condition
+ *      specified by M is satisfied.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opCAILE = function(op, ac)
+{
+    if (PDP10.CMP(this.readWord(ac), this.regEA) <= 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opCAIA(0o304000): Compare AC Immediate but Always Skip
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-42:
+ *
+ *      Compare AC with E (ie with the word 0,E) and skip the next instruction in sequence if the condition
+ *      specified by M is satisfied.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opCAIA = function(op, ac)
+{
+    // TODO: Determine if there's any need to actually perform the comparison.
+    this.setPC(this.regPC + 1);
+};
+
+/**
+ * opCAIGE(0o305000): Compare AC Immediate and Skip if AC Greater than or Equal to E
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-42:
+ *
+ *      Compare AC with E (ie with the word 0,E) and skip the next instruction in sequence if the condition
+ *      specified by M is satisfied.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opCAIGE = function(op, ac)
+{
+    if (PDP10.CMP(this.readWord(ac), this.regEA) >= 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opCAIN(0o306000): Compare AC Immediate and Skip if Not Equal
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-42:
+ *
+ *      Compare AC with E (ie with the word 0,E) and skip the next instruction in sequence if the condition
+ *      specified by M is satisfied.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opCAIN = function(op, ac)
+{
+    if (PDP10.CMP(this.readWord(ac), this.regEA) != 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opCAIG(0o307000): Compare AC Immediate and Skip if AC Greater than E
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-42:
+ *
+ *      Compare AC with E (ie with the word 0,E) and skip the next instruction in sequence if the condition
+ *      specified by M is satisfied.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opCAIG = function(op, ac)
+{
+    if (PDP10.CMP(this.readWord(ac), this.regEA) > 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opCAML(0o311000): Compare AC with Memory and Skip if AC Less
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-43:
+ *
+ *      Compare AC with the contents of location E and skip the next instruction in sequence if the condition
+ *      specified by M is satisfied.  The pair of numbers compared may be either both fixed or both normalized
+ *      floating point.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opCAML = function(op, ac)
+{
+    if (PDP10.CMP(this.readWord(ac), this.readWord(this.regEA)) < 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opCAME(0o312000): Compare AC with Memory and Skip if Equal
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-43:
+ *
+ *      Compare AC with the contents of location E and skip the next instruction in sequence if the condition
+ *      specified by M is satisfied.  The pair of numbers compared may be either both fixed or both normalized
+ *      floating point.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opCAME = function(op, ac)
+{
+    if (PDP10.CMP(this.readWord(ac), this.readWord(this.regEA)) == 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opCAMLE(0o313000): Compare AC with Memory and Skip if AC Less or Equal
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-43:
+ *
+ *      Compare AC with the contents of location E and skip the next instruction in sequence if the condition
+ *      specified by M is satisfied.  The pair of numbers compared may be either both fixed or both normalized
+ *      floating point.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opCAMLE = function(op, ac)
+{
+    if (PDP10.CMP(this.readWord(ac), this.readWord(this.regEA)) <= 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opCAMA(0o314000): Compare AC with Memory but Always Skip
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-43:
+ *
+ *      Compare AC with the contents of location E and skip the next instruction in sequence if the condition
+ *      specified by M is satisfied.  The pair of numbers compared may be either both fixed or both normalized
+ *      floating point.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opCAMA = function(op, ac)
+{
+    // TODO: Determine if there's any need to actually perform the comparison.
+    this.setPC(this.regPC + 1);
+};
+
+/**
+ * opCAMGE(0o315000): Compare AC with Memory and Skip if AC Greater or Equal
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-43:
+ *
+ *      Compare AC with the contents of location E and skip the next instruction in sequence if the condition
+ *      specified by M is satisfied.  The pair of numbers compared may be either both fixed or both normalized
+ *      floating point.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opCAMGE = function(op, ac)
+{
+    if (PDP10.CMP(this.readWord(ac), this.readWord(this.regEA)) >= 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opCAMN(0o316000): Compare AC with Memory and Skip if Not Equal
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-43:
+ *
+ *      Compare AC with the contents of location E and skip the next instruction in sequence if the condition
+ *      specified by M is satisfied.  The pair of numbers compared may be either both fixed or both normalized
+ *      floating point.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opCAMN = function(op, ac)
+{
+    if (PDP10.CMP(this.readWord(ac), this.readWord(this.regEA)) != 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opCAMG(0o317000): Compare AC with Memory and Skip if AC Greater
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-43:
+ *
+ *      Compare AC with the contents of location E and skip the next instruction in sequence if the condition
+ *      specified by M is satisfied.  The pair of numbers compared may be either both fixed or both normalized
+ *      floating point.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opCAMG = function(op, ac)
+{
+    if (PDP10.CMP(this.readWord(ac), this.readWord(this.regEA)) > 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opJUMPL(0o321000): Jump if AC Less than Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-43:
+ *
+ *      Compare AC (fixed or floating) with zero, and if the condition specified by M is satisfied,
+ *      take the next instruction from location E and continue sequential operation from there.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opJUMPL = function(op, ac)
+{
+    if (PDP10.SIGN(this.readWord(ac)) < 0) this.setPC(this.regEA);
+};
+
+/**
+ * opJUMPE(0o322000): Jump if AC Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-43:
+ *
+ *      Compare AC (fixed or floating) with zero, and if the condition specified by M is satisfied,
+ *      take the next instruction from location E and continue sequential operation from there.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opJUMPE = function(op, ac)
+{
+    if (PDP10.SIGN(this.readWord(ac)) == 0) this.setPC(this.regEA);
+};
+
+/**
+ * opJUMPLE(0o323000): Jump if AC Less than or Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-43:
+ *
+ *      Compare AC (fixed or floating) with zero, and if the condition specified by M is satisfied,
+ *      take the next instruction from location E and continue sequential operation from there.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opJUMPLE = function(op, ac)
+{
+    if (PDP10.SIGN(this.readWord(ac)) <= 0) this.setPC(this.regEA);
+};
+
+/**
+ * opJUMPA(0o324000): Jump Always
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-43:
+ *
+ *      Compare AC (fixed or floating) with zero, and if the condition specified by M is satisfied,
+ *      take the next instruction from location E and continue sequential operation from there.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opJUMPA = function(op, ac)
+{
+    this.setPC(this.regEA);
+};
+
+/**
+ * opJUMPGE(0o325000): Jump if AC Greater than or Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-43:
+ *
+ *      Compare AC (fixed or floating) with zero, and if the condition specified by M is satisfied,
+ *      take the next instruction from location E and continue sequential operation from there.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opJUMPGE = function(op, ac)
+{
+    if (PDP10.SIGN(this.readWord(ac)) >= 0) this.setPC(this.regEA);
+};
+
+/**
+ * opJUMPN(0o326000): Jump if AC Not Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-43:
+ *
+ *      Compare AC (fixed or floating) with zero, and if the condition specified by M is satisfied,
+ *      take the next instruction from location E and continue sequential operation from there.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opJUMPN = function(op, ac)
+{
+    if (PDP10.SIGN(this.readWord(ac)) != 0) this.setPC(this.regEA);
+};
+
+/**
+ * opJUMPG(0o327000): Jump if AC Greater than Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-43:
+ *
+ *      Compare AC (fixed or floating) with zero, and if the condition specified by M is satisfied,
+ *      take the next instruction from location E and continue sequential operation from there.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opJUMPG = function(op, ac)
+{
+    if (PDP10.SIGN(this.readWord(ac)) > 0) this.setPC(this.regEA);
+};
+
+/**
+ * opSKIP(0o330000): Do Not Skip
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-44:
+ *
+ *      Compare the contents (fixed or floating) of location E with zero, and skip the next instruction
+ *      in sequence if the condition specified by M is satisfied.  If A is nonzero also place the contents
+ *      of location E in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSKIP = function(op, ac)
+{
+    if (ac) this.writeWord(ac, this.readWord(this.regEA));
+};
+
+/**
+ * opSKIPL(0o331000): Skip if Memory Less than Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-44:
+ *
+ *      Compare the contents (fixed or floating) of location E with zero, and skip the next instruction
+ *      in sequence if the condition specified by M is satisfied.  If A is nonzero also place the contents
+ *      of location E in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSKIPL = function(op, ac)
+{
+    var dst = this.readWord(this.regEA);
+    if (PDP10.SIGN(dst) < 0) this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opSKIPE(0o332000): Skip if Memory Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-44:
+ *
+ *      Compare the contents (fixed or floating) of location E with zero, and skip the next instruction
+ *      in sequence if the condition specified by M is satisfied.  If A is nonzero also place the contents
+ *      of location E in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSKIPE = function(op, ac)
+{
+    var dst = this.readWord(this.regEA);
+    if (PDP10.SIGN(dst) == 0) this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opSKIPLE(0o333000): Skip if Memory Less than or Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-44:
+ *
+ *      Compare the contents (fixed or floating) of location E with zero, and skip the next instruction
+ *      in sequence if the condition specified by M is satisfied.  If A is nonzero also place the contents
+ *      of location E in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSKIPLE = function(op, ac)
+{
+    var dst = this.readWord(this.regEA);
+    if (PDP10.SIGN(dst) <= 0) this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opSKIPA(0o334000): Skip Always
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-44:
+ *
+ *      Compare the contents (fixed or floating) of location E with zero, and skip the next instruction
+ *      in sequence if the condition specified by M is satisfied.  If A is nonzero also place the contents
+ *      of location E in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSKIPA = function(op, ac)
+{
+    this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, this.readWord(this.regEA));
+};
+
+/**
+ * opSKIPGE(0o335000): Skip if Memory Greater than or Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-44:
+ *
+ *      Compare the contents (fixed or floating) of location E with zero, and skip the next instruction
+ *      in sequence if the condition specified by M is satisfied.  If A is nonzero also place the contents
+ *      of location E in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSKIPGE = function(op, ac)
+{
+    var dst = this.readWord(this.regEA);
+    if (PDP10.SIGN(dst) >= 0) this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opSKIPN(0o336000): Skip if Memory Not Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-44:
+ *
+ *      Compare the contents (fixed or floating) of location E with zero, and skip the next instruction
+ *      in sequence if the condition specified by M is satisfied.  If A is nonzero also place the contents
+ *      of location E in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSKIPN = function(op, ac)
+{
+    var dst = this.readWord(this.regEA);
+    if (PDP10.SIGN(dst) != 0) this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opSKIPG(0o337000): Skip if Memory Greater than Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-44:
+ *
+ *      Compare the contents (fixed or floating) of location E with zero, and skip the next instruction
+ *      in sequence if the condition specified by M is satisfied.  If A is nonzero also place the contents
+ *      of location E in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSKIPG = function(op, ac)
+{
+    var dst = this.readWord(this.regEA);
+    if (PDP10.SIGN(dst) > 0) this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opAOJ(0o340000): Add One to AC but Do Not Jump
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-44:
+ *
+ *      Increment AC by one and place the result back in AC.  Compare the result with zero, and if the
+ *      condition specified by M is satisfied, take the next instruction from location E and continue
+ *      sequential operation from there.  If AC originally contained 2^35 - 1, set the Overflow and Carry 1
+ *      flags; if -1, set Carry 0 and Carry 1.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opAOJ = function(op, ac)
+{
+    this.writeWord(ac, PDP10.doADD.call(this, this.readWord(ac), 1));
+};
+
+/**
+ * opAOJL(0o341000): Add One to AC and Jump if Less than Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-44:
+ *
+ *      Increment AC by one and place the result back in AC.  Compare the result with zero, and if the
+ *      condition specified by M is satisfied, take the next instruction from location E and continue
+ *      sequential operation from there.  If AC originally contained 2^35 - 1, set the Overflow and Carry 1
+ *      flags; if -1, set Carry 0 and Carry 1.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opAOJL = function(op, ac)
+{
+    var dst = this.writeWord(ac, PDP10.doADD.call(this, this.readWord(ac), 1));
+    if (PDP10.SIGN(dst) < 0) this.setPC(this.regEA);
+};
+
+/**
+ * opAOJE(0o342000): Add One to AC and Jump if Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-44:
+ *
+ *      Increment AC by one and place the result back in AC.  Compare the result with zero, and if the
+ *      condition specified by M is satisfied, take the next instruction from location E and continue
+ *      sequential operation from there.  If AC originally contained 2^35 - 1, set the Overflow and Carry 1
+ *      flags; if -1, set Carry 0 and Carry 1.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opAOJE = function(op, ac)
+{
+    var dst = this.writeWord(ac, PDP10.doADD.call(this, this.readWord(ac), 1));
+    if (PDP10.SIGN(dst) == 0) this.setPC(this.regEA);
+};
+
+/**
+ * opAOJLE(0o343000): Add One to AC and Jump if Less than or Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-44:
+ *
+ *      Increment AC by one and place the result back in AC.  Compare the result with zero, and if the
+ *      condition specified by M is satisfied, take the next instruction from location E and continue
+ *      sequential operation from there.  If AC originally contained 2^35 - 1, set the Overflow and Carry 1
+ *      flags; if -1, set Carry 0 and Carry 1.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opAOJLE = function(op, ac)
+{
+    var dst = this.writeWord(ac, PDP10.doADD.call(this, this.readWord(ac), 1));
+    if (PDP10.SIGN(dst) <= 0) this.setPC(this.regEA);
+};
+
+/**
+ * opAOJA(0o344000): Add One to AC and Jump Always
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-44:
+ *
+ *      Increment AC by one and place the result back in AC.  Compare the result with zero, and if the
+ *      condition specified by M is satisfied, take the next instruction from location E and continue
+ *      sequential operation from there.  If AC originally contained 2^35 - 1, set the Overflow and Carry 1
+ *      flags; if -1, set Carry 0 and Carry 1.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opAOJA = function(op, ac)
+{
+    var dst = this.writeWord(ac, PDP10.doADD.call(this, this.readWord(ac), 1));
+    this.setPC(this.regEA);
+};
+
+/**
+ * opAOJGE(0o345000): Add One to AC and Jump if Greater than or Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-44:
+ *
+ *      Increment AC by one and place the result back in AC.  Compare the result with zero, and if the
+ *      condition specified by M is satisfied, take the next instruction from location E and continue
+ *      sequential operation from there.  If AC originally contained 2^35 - 1, set the Overflow and Carry 1
+ *      flags; if -1, set Carry 0 and Carry 1.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opAOJGE = function(op, ac)
+{
+    var dst = this.writeWord(ac, PDP10.doADD.call(this, this.readWord(ac), 1));
+    if (PDP10.SIGN(dst) >= 0) this.setPC(this.regEA);
+};
+
+/**
+ * opAOJN(0o346000): Add One to AC and Jump if Not Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-44:
+ *
+ *      Increment AC by one and place the result back in AC.  Compare the result with zero, and if the
+ *      condition specified by M is satisfied, take the next instruction from location E and continue
+ *      sequential operation from there.  If AC originally contained 2^35 - 1, set the Overflow and Carry 1
+ *      flags; if -1, set Carry 0 and Carry 1.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opAOJN = function(op, ac)
+{
+    var dst = this.writeWord(ac, PDP10.doADD.call(this, this.readWord(ac), 1));
+    if (PDP10.SIGN(dst) != 0) this.setPC(this.regEA);
+};
+
+/**
+ * opAOJG(0o347000): Add One to AC and Jump if Greater than Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-44:
+ *
+ *      Increment AC by one and place the result back in AC.  Compare the result with zero, and if the
+ *      condition specified by M is satisfied, take the next instruction from location E and continue
+ *      sequential operation from there.  If AC originally contained 2^35 - 1, set the Overflow and Carry 1
+ *      flags; if -1, set Carry 0 and Carry 1.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opAOJG = function(op, ac)
+{
+    var dst = this.writeWord(ac, PDP10.doADD.call(this, this.readWord(ac), 1));
+    if (PDP10.SIGN(dst) > 0) this.setPC(this.regEA);
+};
+
+/**
+ * opAOS(0o350000): Add One to Memory but Do Not Skip
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-45:
+ *
+ *      Increment the contents of location E by one and place the result back in E.  Compare the result
+ *      with zero, and skip the next instruction in sequence if the condition specified by M is satisfied.
+ *      If location E originally contained 2^35 - 1, set the Overflow and Carry 1 flags; if -1, set Carry 0
+ *      and Carry 1.  If A is nonzero also place the result in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opAOS = function(op, ac)
+{
+    var dst = this.writeWord(this.regEA, PDP10.doADD.call(this, this.readWord(this.regEA), 1));
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opAOSL(0o351000): Add One to Memory and Skip if Less than Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-45:
+ *
+ *      Increment the contents of location E by one and place the result back in E.  Compare the result
+ *      with zero, and skip the next instruction in sequence if the condition specified by M is satisfied.
+ *      If location E originally contained 2^35 - 1, set the Overflow and Carry 1 flags; if -1, set Carry 0
+ *      and Carry 1.  If A is nonzero also place the result in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opAOSL = function(op, ac)
+{
+    var dst = this.writeWord(this.regEA, PDP10.doADD.call(this, this.readWord(this.regEA), 1));
+    if (PDP10.SIGN(dst) < 0) this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opAOSE(0o352000): Add One to Memory and Skip if Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-45:
+ *
+ *      Increment the contents of location E by one and place the result back in E.  Compare the result
+ *      with zero, and skip the next instruction in sequence if the condition specified by M is satisfied.
+ *      If location E originally contained 2^35 - 1, set the Overflow and Carry 1 flags; if -1, set Carry 0
+ *      and Carry 1.  If A is nonzero also place the result in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opAOSE = function(op, ac)
+{
+    var dst = this.writeWord(this.regEA, PDP10.doADD.call(this, this.readWord(this.regEA), 1));
+    if (PDP10.SIGN(dst) == 0) this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opAOSLE(0o353000): Add One to Memory and Skip if Less than to Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-45:
+ *
+ *      Increment the contents of location E by one and place the result back in E.  Compare the result
+ *      with zero, and skip the next instruction in sequence if the condition specified by M is satisfied.
+ *      If location E originally contained 2^35 - 1, set the Overflow and Carry 1 flags; if -1, set Carry 0
+ *      and Carry 1.  If A is nonzero also place the result in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opAOSLE = function(op, ac)
+{
+    var dst = this.writeWord(this.regEA, PDP10.doADD.call(this, this.readWord(this.regEA), 1));
+    if (PDP10.SIGN(dst) <= 0) this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opAOSA(0o354000): Add One to Memory and Skip Always
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-45:
+ *
+ *      Increment the contents of location E by one and place the result back in E.  Compare the result
+ *      with zero, and skip the next instruction in sequence if the condition specified by M is satisfied.
+ *      If location E originally contained 2^35 - 1, set the Overflow and Carry 1 flags; if -1, set Carry 0
+ *      and Carry 1.  If A is nonzero also place the result in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opAOSA = function(op, ac)
+{
+    var dst = this.writeWord(this.regEA, PDP10.doADD.call(this, this.readWord(this.regEA), 1));
+    this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opAOSGE(0o355000): Add One to Memory and Skip if Greater than or Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-45:
+ *
+ *      Increment the contents of location E by one and place the result back in E.  Compare the result
+ *      with zero, and skip the next instruction in sequence if the condition specified by M is satisfied.
+ *      If location E originally contained 2^35 - 1, set the Overflow and Carry 1 flags; if -1, set Carry 0
+ *      and Carry 1.  If A is nonzero also place the result in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opAOSGE = function(op, ac)
+{
+    var dst = this.writeWord(this.regEA, PDP10.doADD.call(this, this.readWord(this.regEA), 1));
+    if (PDP10.SIGN(dst) >= 0) this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opAOSN(0o356000): Add One to Memory and Skip if Not Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-45:
+ *
+ *      Increment the contents of location E by one and place the result back in E.  Compare the result
+ *      with zero, and skip the next instruction in sequence if the condition specified by M is satisfied.
+ *      If location E originally contained 2^35 - 1, set the Overflow and Carry 1 flags; if -1, set Carry 0
+ *      and Carry 1.  If A is nonzero also place the result in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opAOSN = function(op, ac)
+{
+    var dst = this.writeWord(this.regEA, PDP10.doADD.call(this, this.readWord(this.regEA), 1));
+    if (PDP10.SIGN(dst) != 0) this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opAOSG(0o357000): Add One to Memory and Skip if Greater than Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-45:
+ *
+ *      Increment the contents of location E by one and place the result back in E.  Compare the result
+ *      with zero, and skip the next instruction in sequence if the condition specified by M is satisfied.
+ *      If location E originally contained 2^35 - 1, set the Overflow and Carry 1 flags; if -1, set Carry 0
+ *      and Carry 1.  If A is nonzero also place the result in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opAOSG = function(op, ac)
+{
+    var dst = this.writeWord(this.regEA, PDP10.doADD.call(this, this.readWord(this.regEA), 1));
+    if (PDP10.SIGN(dst) > 0) this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opSOJ(0o360000): Subtract One from AC but Do Not Jump
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-45:
+ *
+ *      Decrement AC by one and place the result back in AC.  Compare the result with zero, and if the
+ *      condition specified by M is satisfied, take the next instruction from location E and continue sequential
+ *      operation from there.  If AC originally contained - 2^35 , set the Overflow and Carry 0 flags; if any
+ *      other nonzero number, set Carry 0 and Carry 1.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSOJ = function(op, ac)
+{
+    this.writeWord(ac, PDP10.doADD.call(this, this.readWord(ac), PDP10.WORD_MASK));
+};
+
+/**
+ * opSOJL(0o361000): Subtract One from AC and Jump if Less than Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-45:
+ *
+ *      Decrement AC by one and place the result back in AC.  Compare the result with zero, and if the
+ *      condition specified by M is satisfied, take the next instruction from location E and continue sequential
+ *      operation from there.  If AC originally contained - 2^35 , set the Overflow and Carry 0 flags; if any
+ *      other nonzero number, set Carry 0 and Carry 1.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSOJL = function(op, ac)
+{
+    var dst = this.writeWord(ac, PDP10.doADD.call(this, this.readWord(ac), PDP10.WORD_MASK));
+    if (PDP10.SIGN(dst) < 0) this.setPC(this.regEA);
+};
+
+/**
+ * opSOJE(0o362000): Subtract One from AC and Jump if Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-45:
+ *
+ *      Decrement AC by one and place the result back in AC.  Compare the result with zero, and if the
+ *      condition specified by M is satisfied, take the next instruction from location E and continue sequential
+ *      operation from there.  If AC originally contained - 2^35 , set the Overflow and Carry 0 flags; if any
+ *      other nonzero number, set Carry 0 and Carry 1.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSOJE = function(op, ac)
+{
+    var dst = this.writeWord(ac, PDP10.doADD.call(this, this.readWord(ac), PDP10.WORD_MASK));
+    if (PDP10.SIGN(dst) == 0) this.setPC(this.regEA);
+};
+
+/**
+ * opSOJLE(0o363000): Subtract One from AC and Jump if Less than or Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-45:
+ *
+ *      Decrement AC by one and place the result back in AC.  Compare the result with zero, and if the
+ *      condition specified by M is satisfied, take the next instruction from location E and continue sequential
+ *      operation from there.  If AC originally contained - 2^35 , set the Overflow and Carry 0 flags; if any
+ *      other nonzero number, set Carry 0 and Carry 1.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSOJLE = function(op, ac)
+{
+    var dst = this.writeWord(ac, PDP10.doADD.call(this, this.readWord(ac), PDP10.WORD_MASK));
+    if (PDP10.SIGN(dst) <= 0) this.setPC(this.regEA);
+};
+
+/**
+ * opSOJA(0o364000): Subtract One from AC and Jump Always
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-45:
+ *
+ *      Decrement AC by one and place the result back in AC.  Compare the result with zero, and if the
+ *      condition specified by M is satisfied, take the next instruction from location E and continue sequential
+ *      operation from there.  If AC originally contained - 2^35 , set the Overflow and Carry 0 flags; if any
+ *      other nonzero number, set Carry 0 and Carry 1.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSOJA = function(op, ac)
+{
+    this.writeWord(ac, PDP10.doADD.call(this, this.readWord(ac), PDP10.WORD_MASK));
+    this.setPC(this.regEA);
+};
+
+/**
+ * opSOJGE(0o365000): Subtract One from AC and Jump if Greater than or Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-45:
+ *
+ *      Decrement AC by one and place the result back in AC.  Compare the result with zero, and if the
+ *      condition specified by M is satisfied, take the next instruction from location E and continue sequential
+ *      operation from there.  If AC originally contained - 2^35 , set the Overflow and Carry 0 flags; if any
+ *      other nonzero number, set Carry 0 and Carry 1.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSOJGE = function(op, ac)
+{
+    var dst = this.writeWord(ac, PDP10.doADD.call(this, this.readWord(ac), PDP10.WORD_MASK));
+    if (PDP10.SIGN(dst) >= 0) this.setPC(this.regEA);
+};
+
+/**
+ * opSOJN(0o366000): Subtract One from AC and Jump if Not Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-45:
+ *
+ *      Decrement AC by one and place the result back in AC.  Compare the result with zero, and if the
+ *      condition specified by M is satisfied, take the next instruction from location E and continue sequential
+ *      operation from there.  If AC originally contained - 2^35 , set the Overflow and Carry 0 flags; if any
+ *      other nonzero number, set Carry 0 and Carry 1.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSOJN = function(op, ac)
+{
+    var dst = this.writeWord(ac, PDP10.doADD.call(this, this.readWord(ac), PDP10.WORD_MASK));
+    if (PDP10.SIGN(dst) != 0) this.setPC(this.regEA);
+};
+
+/**
+ * opSOJG(0o367000): Subtract One from AC and Jump if Greater than Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-45:
+ *
+ *      Decrement AC by one and place the result back in AC.  Compare the result with zero, and if the
+ *      condition specified by M is satisfied, take the next instruction from location E and continue sequential
+ *      operation from there.  If AC originally contained - 2^35 , set the Overflow and Carry 0 flags; if any
+ *      other nonzero number, set Carry 0 and Carry 1.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSOJG = function(op, ac)
+{
+    var dst = this.writeWord(ac, PDP10.doADD.call(this, this.readWord(ac), PDP10.WORD_MASK));
+    if (PDP10.SIGN(dst) > 0) this.setPC(this.regEA);
+};
+
+/**
+ * opSOS(0o370000): Subtract One from Memory but Do Not Skip
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-46:
+ *
+ *      Decrement the contents of location E by one and place the result back in E.  Compare the result with zero,
+ *      and skip the next instruction in sequence if the condition specified by M is satisfied.  If location E originally
+ *      contained -2^35 , set the Overflow and Carry 0 flags; if any other nonzero number, set Carry 0 and Carry 1.
+ *      If A is nonzero also place the result in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSOS = function(op, ac)
+{
+    var dst = this.writeWord(this.regEA, PDP10.doADD.call(this, this.readWord(this.regEA), PDP10.WORD_MASK));
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opSOSL(0o371000): Subtract One from Memory and Skip if Less than Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-46:
+ *
+ *      Decrement the contents of location E by one and place the result back in E.  Compare the result with zero,
+ *      and skip the next instruction in sequence if the condition specified by M is satisfied.  If location E originally
+ *      contained -2^35 , set the Overflow and Carry 0 flags; if any other nonzero number, set Carry 0 and Carry 1.
+ *      If A is nonzero also place the result in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSOSL = function(op, ac)
+{
+    var dst = this.writeWord(this.regEA, PDP10.doADD.call(this, this.readWord(this.regEA), PDP10.WORD_MASK));
+    if (PDP10.SIGN(dst) < 0) this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opSOSE(0o372000): Subtract One from Memory and Skip if Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-46:
+ *
+ *      Decrement the contents of location E by one and place the result back in E.  Compare the result with zero,
+ *      and skip the next instruction in sequence if the condition specified by M is satisfied.  If location E originally
+ *      contained -2^35 , set the Overflow and Carry 0 flags; if any other nonzero number, set Carry 0 and Carry 1.
+ *      If A is nonzero also place the result in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSOSE = function(op, ac)
+{
+    var dst = this.writeWord(this.regEA, PDP10.doADD.call(this, this.readWord(this.regEA), PDP10.WORD_MASK));
+    if (PDP10.SIGN(dst) == 0) this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opSOSLE(0o373000): Subtract One from Memory and Skip if Less than or Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-46:
+ *
+ *      Decrement the contents of location E by one and place the result back in E.  Compare the result with zero,
+ *      and skip the next instruction in sequence if the condition specified by M is satisfied.  If location E originally
+ *      contained -2^35 , set the Overflow and Carry 0 flags; if any other nonzero number, set Carry 0 and Carry 1.
+ *      If A is nonzero also place the result in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSOSLE = function(op, ac)
+{
+    var dst = this.writeWord(this.regEA, PDP10.doADD.call(this, this.readWord(this.regEA), PDP10.WORD_MASK));
+    if (PDP10.SIGN(dst) <= 0) this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opSOSA(0o374000): Subtract One from Memory and Skip Always
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-46:
+ *
+ *      Decrement the contents of location E by one and place the result back in E.  Compare the result with zero,
+ *      and skip the next instruction in sequence if the condition specified by M is satisfied.  If location E originally
+ *      contained -2^35 , set the Overflow and Carry 0 flags; if any other nonzero number, set Carry 0 and Carry 1.
+ *      If A is nonzero also place the result in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSOSA = function(op, ac)
+{
+    var dst = this.writeWord(this.regEA, PDP10.doADD.call(this, this.readWord(this.regEA), PDP10.WORD_MASK));
+    this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opSOSGE(0o375000): Subtract One from Memory and Skip if Greater than or Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-46:
+ *
+ *      Decrement the contents of location E by one and place the result back in E.  Compare the result with zero,
+ *      and skip the next instruction in sequence if the condition specified by M is satisfied.  If location E originally
+ *      contained -2^35 , set the Overflow and Carry 0 flags; if any other nonzero number, set Carry 0 and Carry 1.
+ *      If A is nonzero also place the result in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSOSGE = function(op, ac)
+{
+    var dst = this.writeWord(this.regEA, PDP10.doADD.call(this, this.readWord(this.regEA), PDP10.WORD_MASK));
+    if (PDP10.SIGN(dst) >= 0) this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opSOSN(0o376000): Subtract One from Memory and Skip if Not Equal to Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-46:
+ *
+ *      Decrement the contents of location E by one and place the result back in E.  Compare the result with zero,
+ *      and skip the next instruction in sequence if the condition specified by M is satisfied.  If location E originally
+ *      contained -2^35 , set the Overflow and Carry 0 flags; if any other nonzero number, set Carry 0 and Carry 1.
+ *      If A is nonzero also place the result in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSOSN = function(op, ac)
+{
+    var dst = this.writeWord(this.regEA, PDP10.doADD.call(this, this.readWord(this.regEA), PDP10.WORD_MASK));
+    if (PDP10.SIGN(dst) != 0) this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opSOSG(0o377000): Subtract One from Memory and Skip if Greater than Zero
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-46:
+ *
+ *      Decrement the contents of location E by one and place the result back in E.  Compare the result with zero,
+ *      and skip the next instruction in sequence if the condition specified by M is satisfied.  If location E originally
+ *      contained -2^35 , set the Overflow and Carry 0 flags; if any other nonzero number, set Carry 0 and Carry 1.
+ *      If A is nonzero also place the result in AC.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSOSG = function(op, ac)
+{
+    var dst = this.writeWord(this.regEA, PDP10.doADD.call(this, this.readWord(this.regEA), PDP10.WORD_MASK));
+    if (PDP10.SIGN(dst) > 0) this.setPC(this.regPC + 1);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opSETZ(0o400000): Set to Zeros
+ * opSETZI(0o401000): Set to Zeros Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-18:
+ *
+ *      Change the contents of the destination specified by M to all 0s.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSETZ = function(op, ac)
+{
+    this.writeWord(ac, 0);
+};
+
+/**
+ * opSETZM(0o402000): Set to Zeros Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-18:
+ *
+ *      Change the contents of the destination specified by M to all 0s.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSETZM = function(op, ac)
+{
+    this.writeWord(this.regEA, 0);
+};
+
+/**
+ * opSETZB(0o403000): Set to Zeros Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-18:
+ *
+ *      Change the contents of the destination specified by M to all 0s.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSETZB = function(op, ac)
+{
+    this.writeWord(this.regEA, this.writeWord(ac, 0));
+};
+
+/**
+ * opAND(0o404000): And with AC
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-20:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the AND function of the specified operand ([E]) and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opAND = function(op, ac)
+{
+    this.writeWord(ac, PDP10.AND(this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opANDI(0o405000): And with AC Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-20:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the AND function of the specified operand (E) and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opANDI = function(op, ac)
+{
+    this.writeWord(ac, PDP10.AND(this.readWord(ac), this.regEA));
+};
+
+/**
+ * opANDM(0o406000): And with AC to Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-20:
+ *
+ *      Change the contents of the destination specified by M ([E]) to the AND function of the specified operand ([E]) and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opANDM = function(op, ac)
+{
+    this.writeWord(this.regEA, PDP10.AND(this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opANDB(0o407000): And with AC to Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-20:
+ *
+ *      Change the contents of the destination specified by M ([E] and [AC]) to the AND function of the specified operand ([E])
+ *      and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opANDB = function(op, ac)
+{
+    this.writeWord(this.regEA, this.writeWord(ac, PDP10.AND(this.readWord(ac), this.readWord(this.regEA))));
+};
+
+/**
+ * opANDCA(0o410000): And with Complement of AC
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-20:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the AND function of the specified operand ([E])
+ *      and the complement of [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opANDCA = function(op, ac)
+{
+    this.writeWord(ac, PDP10.AND(PDP10.WORD_MASK - this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opANDCAI(0o411000): And with Complement of AC Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-20:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the AND function of the specified operand (E)
+ *      and the complement of [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opANDCAI = function(op, ac)
+{
+    this.writeWord(ac, PDP10.AND(PDP10.WORD_MASK - this.readWord(ac), this.regEA));
+};
+
+/**
+ * opANDCAM(0o412000): And with Complement of AC to Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-20:
+ *
+ *      Change the contents of the destination specified by M ([E]) to the AND function of the specified operand ([E])
+ *      and the complement of [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opANDCAM = function(op, ac)
+{
+    this.writeWord(this.regEA, PDP10.AND(PDP10.WORD_MASK - this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opANDCAB(0o413000): And with Complement of AC to Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-20:
+ *
+ *      Change the contents of the destination specified by M ([E] and [AC]) to the AND function of the specified operand ([E])
+ *      and the complement of [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opANDCAB = function(op, ac)
+{
+    this.writeWord(this.regEA, this.writeWord(ac, PDP10.AND(PDP10.WORD_MASK - this.readWord(ac), this.readWord(this.regEA))));
+};
+
+/**
+ * opANDCM(0o420000): And Complement of Memory with AC
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-20:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the AND function of the complement of the specified
+ *      operand ([E]) and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opANDCM = function(op, ac)
+{
+    this.writeWord(ac, PDP10.AND(this.readWord(ac), PDP10.WORD_MASK - this.readWord(this.regEA)));
+};
+
+/**
+ * opANDCMI(0o421000): And Complement of Memory Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-20:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the AND function of the complement of the specified
+ *      operand (E) and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opANDCMI = function(op, ac)
+{
+    this.writeWord(ac, PDP10.AND(this.readWord(ac), PDP10.WORD_MASK - this.regEA));
+};
+
+/**
+ * opANDCMM(0o422000): And Complement of Memory to Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-20:
+ *
+ *      Change the contents of the destination specified by M ([E]) to the AND function of the complement of the specified
+ *      operand ([E]) and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opANDCMM = function(op, ac)
+{
+    this.writeWord(this.regEA, PDP10.AND(this.readWord(ac), PDP10.WORD_MASK - this.readWord(this.regEA)));
+};
+
+/**
+ * opANDCMB(0o423000): And Complement of Memory to Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-20:
+ *
+ *      Change the contents of the destination specified by M ([E] and [AC]) to the AND function of the complement of the specified
+ *      operand ([E]) and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opANDCMB = function(op, ac)
+{
+    this.writeWord(this.regEA, this.writeWord(ac, PDP10.AND(this.readWord(ac), PDP10.WORD_MASK - this.readWord(this.regEA))));
+};
+
+/**
+ * opXOR(0o430000): Exclusive Or with AC
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-22:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the exclusive OR function of the specified
+ *      operand ([E]) and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opXOR = function(op, ac)
+{
+    this.writeWord(ac, PDP10.XOR(this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opXORI(0o431000): Exclusive Or Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-22:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the exclusive OR function of the specified
+ *      operand (E) and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opXORI = function(op, ac)
+{
+    this.writeWord(ac, PDP10.XOR(this.readWord(ac), this.regEA));
+};
+
+/**
+ * opXORM(0o432000): Exclusive Or to Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-22:
+ *
+ *      Change the contents of the destination specified by M ([E]) to the exclusive OR function of the specified
+ *      operand ([E]) and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opXORM = function(op, ac)
+{
+    this.writeWord(this.regEA, PDP10.XOR(this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opXORB(0o433000): Exclusive Or to Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-22:
+ *
+ *      Change the contents of the destination specified by M ([E] and [AC]) to the exclusive OR function of the specified
+ *      operand ([E]) and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opXORB = function(op, ac)
+{
+    this.writeWord(this.regEA, this.writeWord(ac, PDP10.XOR(this.readWord(ac), this.readWord(this.regEA))));
+};
+
+/**
+ * opIOR(0o434000): Inclusive Or with AC
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-21:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the inclusive OR function of the specified
+ *      operand ([E]) and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opIOR = function(op, ac)
+{
+    this.writeWord(ac, PDP10.IOR(this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opIORI(0o435000): Inclusive Or with AC Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-21:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the inclusive OR function of the specified
+ *      operand (E) and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opIORI = function(op, ac)
+{
+    this.writeWord(ac, PDP10.IOR(this.readWord(ac), this.regEA));
+};
+
+/**
+ * opIORM(0o436000): Inclusive Or with AC to Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-21:
+ *
+ *      Change the contents of the destination specified by M ([E]) to the inclusive OR function of the specified
+ *      operand ([E]) and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opIORM = function(op, ac)
+{
+    this.writeWord(this.regEA, PDP10.IOR(this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opIORB(0o437000): Inclusive Or with AC to Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-21:
+ *
+ *      Change the contents of the destination specified by M ([E] and [AC]) to the inclusive OR function of the specified
+ *      operand ([E]) and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opIORB = function(op, ac)
+{
+    this.writeWord(this.regEA, this.writeWord(ac, PDP10.IOR(this.readWord(ac), this.readWord(this.regEA))));
+};
+
+/**
+ * opANDCB(0o440000): And Complements of Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-21:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the AND function of the complements of both
+ *      the specified operand ([E]) and [AC].  The result is the NOR function of the operands.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opANDCB = function(op, ac)
+{
+    this.writeWord(ac, PDP10.AND(PDP10.WORD_MASK - this.readWord(ac), PDP10.WORD_MASK - this.readWord(this.regEA)));
+};
+
+/**
+ * opANDCBI(0o441000): And Complements of Both Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-21:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the AND function of the complements of both
+ *      the specified operand (E) and [AC].  The result is the NOR function of the operands.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opANDCBI = function(op, ac)
+{
+    this.writeWord(ac, PDP10.AND(PDP10.WORD_MASK - this.readWord(ac), PDP10.WORD_MASK - this.regEA));
+};
+
+/**
+ * opANDCBM(0o442000): And Complements of Both to Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-21:
+ *
+ *      Change the contents of the destination specified by M ([E]) to the AND function of the complements of both
+ *      the specified operand ([E]) and [AC].  The result is the NOR function of the operands.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opANDCBM = function(op, ac)
+{
+    this.writeWord(this.regEA, PDP10.AND(PDP10.WORD_MASK - this.readWord(ac), PDP10.WORD_MASK - this.readWord(this.regEA)));
+};
+
+/**
+ * opANDCBB(0o443000): And Complements of Both to Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-21:
+ *
+ *      Change the contents of the destination specified by M ([E] and [AC]) to the AND function of the complements of both
+ *      the specified operand ([E]) and [AC].  The result is the NOR function of the operands.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opANDCBB = function(op, ac)
+{
+    this.writeWord(this.regEA, this.writeWord(ac, PDP10.AND(PDP10.WORD_MASK - this.readWord(ac), PDP10.WORD_MASK - this.readWord(this.regEA))));
+};
+
+/**
+ * opEQV(0o444000): Equivalence with AC
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-23:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the complement of the exclusive OR function of the
+ *      specified operand ([E]) and [AC] (the result has 1s wherever the corresponding bits of the operands are the same).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opEQV = function(op, ac)
+{
+    this.writeWord(ac, PDP10.EQV(this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opEQVI(0o445000): Equivalence Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-23:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the complement of the exclusive OR function of the
+ *      specified operand (E) and [AC] (the result has 1s wherever the corresponding bits of the operands are the same).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opEQVI = function(op, ac)
+{
+    this.writeWord(ac, PDP10.EQV(this.readWord(ac), this.regEA));
+};
+
+/**
+ * opEQVM(0o446000): Equivalence to Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-23:
+ *
+ *      Change the contents of the destination specified by M ([E]) to the complement of the exclusive OR function of the
+ *      specified operand ([E]) and [AC] (the result has 1s wherever the corresponding bits of the operands are the same).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opEQVM = function(op, ac)
+{
+    this.writeWord(this.regEA, PDP10.EQV(this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opEQVB(0o447000): Equivalence to Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-23:
+ *
+ *      Change the contents of the destination specified by M ([E] and [AC]) to the complement of the exclusive OR function of the
+ *      specified operand ([E]) and [AC] (the result has 1s wherever the corresponding bits of the operands are the same).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opEQVB = function(op, ac)
+{
+    this.writeWord(this.regEA, this.writeWord(ac, PDP10.EQV(this.readWord(ac), this.readWord(this.regEA))));
+};
+
+/**
+ * opSETCA(0o450000): Set to Complement of AC
+ * opSETCAI(0o451000): Set to Complement of AC Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-19:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the complement of [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSETCA = function(op, ac)
+{
+    this.writeWord(ac, PDP10.WORD_MASK - this.readWord(ac));
+};
+
+/**
+ * opSETCAM(0o452000): Set to Complement of AC Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-19:
+ *
+ *      Change the contents of the destination specified by M ([E]) to the complement of [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSETCAM = function(op, ac)
+{
+    this.writeWord(this.regEA, PDP10.WORD_MASK - this.readWord(ac));
+};
+
+/**
+ * opSETCAB(0o453000): Set to Complement of AC Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-19:
+ *
+ *      Change the contents of the destination specified by M ([E] and [AC]) to the complement of [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSETCAB = function(op, ac)
+{
+    this.writeWord(this.regEA, this.writeWord(ac, PDP10.WORD_MASK - this.readWord(ac)));
+};
+
+/**
+ * opORCA(0o454000): Inclusive Or with Complement of AC
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-21:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the inclusive OR function of the specified
+ *      operand ([E]) and the complement of [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opORCA = function(op, ac)
+{
+    this.writeWord(ac, PDP10.IOR(PDP10.WORD_MASK - this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opORCAI(0o455000): Inclusive Or with Complement of AC Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-21:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the inclusive OR function of the specified
+ *      operand (E) and the complement of [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opORCAI = function(op, ac)
+{
+    this.writeWord(ac, PDP10.IOR(PDP10.WORD_MASK - this.readWord(ac), this.regEA));
+};
+
+/**
+ * opORCAM(0o456000): Inclusive Or with Complement of AC to Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-21:
+ *
+ *      Change the contents of the destination specified by M ([E]) to the inclusive OR function of the specified
+ *      operand ([E]) and the complement of [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opORCAM = function(op, ac)
+{
+    this.writeWord(this.regEA, PDP10.IOR(PDP10.WORD_MASK - this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opORCAB(0o457000): Inclusive Or with Complement of AC to Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-21:
+ *
+ *      Change the contents of the destination specified by M ([E] and [AC]) to the inclusive OR function of the specified
+ *      operand ([E]) and the complement of [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opORCAB = function(op, ac)
+{
+    this.writeWord(this.regEA, this.writeWord(ac, PDP10.IOR(PDP10.WORD_MASK - this.readWord(ac), this.readWord(this.regEA))));
+};
+
+/**
+ * opSETCM(0o460000): Set to Complement of Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-19:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the complement of the specified source
+ *      operand ([E]).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSETCM = function(op, ac)
+{
+    this.writeWord(ac, PDP10.WORD_MASK - this.readWord(this.regEA));
+};
+
+/**
+ * opSETCMI(0o461000): Set to Complement of Memory Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-19:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the complement of the specified source
+ *      operand (E).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSETCMI = function(op, ac)
+{
+    this.writeWord(ac, PDP10.WORD_MASK - this.regEA);
+};
+
+/**
+ * opSETCMM(0o462000): Set to Complement of Memory Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-19:
+ *
+ *      Change the contents of the destination specified by M ([E]) to the complement of the specified source
+ *      operand ([E]).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSETCMM = function(op, ac)
+{
+    this.writeWord(this.regEA, PDP10.WORD_MASK - this.readWord(this.regEA));
+};
+
+/**
+ * opSETCMB(0o463000): Set to Complement of Memory Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-19:
+ *
+ *      Change the contents of the destination specified by M ([E] and [AC]) to the complement of the specified source
+ *      operand ([E]).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSETCMB = function(op, ac)
+{
+    this.writeWord(this.regEA, this.writeWord(ac, PDP10.WORD_MASK - this.readWord(this.regEA)));
+};
+
+/**
+ * opORCM(0o464000): Inclusive Or Complement of Memory with AC
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-22:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the inclusive OR function of the complement of the
+ *      specified operand ([E]) and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opORCM = function(op, ac)
+{
+    this.writeWord(ac, PDP10.IOR(this.readWord(ac), PDP10.WORD_MASK - this.readWord(this.regEA)));
+};
+
+/**
+ * opORCMI(0o465000): Inclusive Or Complement of Memory Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-22:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the inclusive OR function of the complement of the
+ *      specified operand (E) and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opORCMI = function(op, ac)
+{
+    this.writeWord(ac, PDP10.IOR(this.readWord(ac), PDP10.WORD_MASK - this.regEA));
+};
+
+/**
+ * opORCMM(0o466000): Inclusive Or Complement of Memory to Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-22:
+ *
+ *      Change the contents of the destination specified by M ([E]) to the inclusive OR function of the complement of the
+ *      specified operand ([E]) and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opORCMM = function(op, ac)
+{
+    this.writeWord(this.regEA, PDP10.IOR(this.readWord(ac), PDP10.WORD_MASK - this.readWord(this.regEA)));
+};
+
+/**
+ * opORCMB(0o467000): Inclusive Or Complement of Memory to Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-22:
+ *
+ *      Change the contents of the destination specified by M ([E] and [AC]) to the inclusive OR function of the complement of the
+ *      specified operand ([E]) and [AC].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opORCMB = function(op, ac)
+{
+    this.writeWord(this.regEA, this.writeWord(ac, PDP10.IOR(this.readWord(ac), PDP10.WORD_MASK - this.readWord(this.regEA))));
+};
+
+/**
+ * opORCB(0o470000): Inclusive Or Complements of Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-22:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the inclusive OR function of the complements of both
+ *      the specified operand ([E]) and [AC].  The result is the NAND function of the operands.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opORCB = function(op, ac)
+{
+    this.writeWord(ac, PDP10.IOR(PDP10.WORD_MASK - this.readWord(ac), PDP10.WORD_MASK - this.readWord(this.regEA)));
+};
+
+/**
+ * opORCBI(0o471000): Inclusive Or Complements of Both Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-22:
+ *
+ *      Change the contents of the destination specified by M ([AC]) to the inclusive OR function of the complements of both
+ *      the specified operand (E) and [AC].  The result is the NAND function of the operands.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opORCBI = function(op, ac)
+{
+    this.writeWord(ac, PDP10.IOR(PDP10.WORD_MASK - this.readWord(ac), PDP10.WORD_MASK - this.regEA));
+};
+
+/**
+ * opORCBM(0o472000): Inclusive Or Complements of Both To Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-22:
+ *
+ *      Change the contents of the destination specified by M ([E]) to the inclusive OR function of the complements of both
+ *      the specified operand ([E]) and [AC].  The result is the NAND function of the operands.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opORCBM = function(op, ac)
+{
+    this.writeWord(this.regEA, PDP10.IOR(PDP10.WORD_MASK - this.readWord(ac), PDP10.WORD_MASK - this.readWord(this.regEA)));
+};
+
+/**
+ * opORCBB(0o473000): Inclusive Or Complements of Both to Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-22:
+ *
+ *      Change the contents of the destination specified by M ([E] and [AC]) to the inclusive OR function of the complements of both
+ *      the specified operand ([E]) and [AC].  The result is the NAND function of the operands.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opORCBB = function(op, ac)
+{
+    this.writeWord(this.regEA, this.writeWord(ac, PDP10.IOR(PDP10.WORD_MASK - this.readWord(ac), PDP10.WORD_MASK - this.readWord(this.regEA))));
+};
+
+/**
+ * opSETO(0o474000): Set to Ones
+ * opSETOI(0o475000): Set to Ones Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-18:
+ *
+ *      Change the contents of the destination specified by M (AC) to all 1s.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSETO = function(op, ac)
+{
+    this.writeWord(ac, PDP10.WORD_MASK);
+};
+
+/**
+ * opSETOM(0o476000): Set to Ones Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-18:
+ *
+ *      Change the contents of the destination specified by M ([E]) to all 1s.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSETOM = function(op, ac)
+{
+    this.writeWord(this.regEA, PDP10.WORD_MASK);
+};
+
+/**
+ * opSETOB(0o477000): Set to Ones Both
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-18:
+ *
+ *      Change the contents of the destination specified by M ([E] and [AC]) to all 1s.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opSETOB = function(op, ac)
+{
+    this.writeWord(this.regEA, this.writeWord(ac, PDP10.WORD_MASK));
+};
+
+/**
+ * opHLL(0o5N0000): Half Word Left to Left
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-3:
+ *
+ *      Move the left half of the source word specified by M to the left half of the specified destination.
+ *      The source and the destination right half are unaffected; the original contents of the destination are lost.
+ *
+ * For HLL, the source is [E] and the destination is [A].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opHLL = function(op, ac)
+{
+    var src = this.readWord(this.regEA);
+    var dst = this.readWord(ac);
+    this.writeWord(ac, PDP10.GETHR(op, dst, src) + (src - (src & PDP10.HALF_MASK)));
+};
+
+/**
+ * opHLLI(0o5N1000): Half Word Left to Left, Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-3:
+ *
+ *      Move the left half of the source word specified by M to the left half of the specified destination.
+ *      The source and the destination right half are unaffected; the original contents of the destination are lost.
+ *
+ *      SIDEBAR: HLLI merely clears AC left.
+ *
+ * For HLLI, the source is 0,E and the destination is [A].  But since this is a left-half-only operation, src is
+ * effectively 0.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opHLLI = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    this.writeWord(ac, PDP10.GETHR(op, dst, 0));
+};
+
+/**
+ * opHLLM(0o5N2000): Half Word Left to Left, Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-3:
+ *
+ *      Move the left half of the source word specified by M to the left half of the specified destination.
+ *      The source and the destination right half are unaffected; the original contents of the destination are lost.
+ *
+ * For HLLM, the source is [A] and the destination is [E].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opHLLM = function(op, ac)
+{
+    var src = this.readWord(ac);
+    var dst = this.readWord(this.regEA);
+    this.writeWord(this.regEA, PDP10.GETHR(op, dst, src) + (src - (src & PDP10.HALF_MASK)));
+};
+
+/**
+ * opHLLS(0o5N3000): Half Word Left to Left, Self
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-3:
+ *
+ *      Move the left half of the source word specified by M to the left half of the specified destination.
+ *      The source and the destination right half are unaffected; the original contents of the destination are lost.
+ *
+ *      SIDEBAR: If A is zero, HLLS is a no-op, otherwise it is equivalent to HLL.
+ *
+ * For HLLS, the source AND destination is [E] (and also [A] if A is non-zero).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opHLLS = function(op, ac)
+{
+    var dst = this.readWord(this.regEA);
+    dst = PDP10.SETHR(op, dst, dst);
+    this.writeWord(this.regEA, dst);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opHRL(0o504000): Half Word Right to Left
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-4:
+ *
+ *      Move the right half of the source word specified by M to the left half of the specified destination.
+ *      The source and the destination right half are unaffected; the original contents of the destination left
+ *      half are lost.
+ *
+ * For HRL, the source is [E] and the destination is [A].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opHRL = function(op, ac)
+{
+    var src = (this.readWord(this.regEA) & PDP10.HALF_MASK) * PDP10.HALF_SHIFT;
+    var dst = this.readWord(ac);
+    this.writeWord(ac, PDP10.GETHR(op, dst, src) + src);
+};
+
+/**
+ * opHRLI(0o505000): Half Word Right to Left, Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-4:
+ *
+ *      Move the right half of the source word specified by M to the left half of the specified destination.
+ *      The source and the destination right half are unaffected; the original contents of the destination left
+ *      half are lost.
+ *
+ * For HRLI, the source is 0,E and the destination is [A].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opHRLI = function(op, ac)
+{
+    var src = this.regEA * PDP10.HALF_SHIFT;
+    var dst = this.readWord(ac);
+    this.writeWord(ac, PDP10.GETHR(op, dst, src) + src);
+};
+
+/**
+ * opHRLM(0o506000): Half Word Right to Left, Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-4:
+ *
+ *      Move the right half of the source word specified by M to the left half of the specified destination.
+ *      The source and the destination right half are unaffected; the original contents of the destination left
+ *      half are lost.
+ *
+ * For HRLM, the source is [A] and the destination is [E].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opHRLM = function(op, ac)
+{
+    var src = (this.readWord(ac) & PDP10.HALF_MASK) * PDP10.HALF_SHIFT;
+    var dst = this.readWord(this.regEA);
+    this.writeWord(this.regEA, PDP10.GETHR(op, dst, src) + src);
+};
+
+/**
+ * opHRLS(0o507000): Half Word Right to Left, Self
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-4:
+ *
+ *      Move the right half of the source word specified by M to the left half of the specified destination.
+ *      The source and the destination right half are unaffected; the original contents of the destination left
+ *      half are lost.
+ *
+ * For HRLS, the source AND destination is [E] (and also [A] if A is non-zero).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opHRLS = function(op, ac)
+{
+    var dst = this.readWord(this.regEA);
+    var src = (dst & PDP10.HALF_MASK) * PDP10.HALF_SHIFT;
+    dst = PDP10.GETHR(op, dst, src) + src;
+    this.writeWord(this.regEA, dst);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opHRR(0o540000): Half Word Right to Right
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-6:
+ *
+ *      Move the right half of the source word specified by M to the right half of the specified destination.
+ *      The source and the destination left half are unaffected; the original contents of the destination right
+ *      half are lost.
+ *
+ * For HRR, the source is [E] and the destination is [A].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opHRR = function(op, ac)
+{
+    var src = this.readWord(this.regEA) & PDP10.HALF_MASK;
+    var dst = this.readWord(ac);
+    this.writeWord(ac, PDP10.GETHL(op, dst, src) + src);
+};
+
+/**
+ * opHRRI(0o541000): Half Word Right to Right, Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-6:
+ *
+ *      Move the right half of the source word specified by M to the right half of the specified destination.
+ *      The source and the destination left half are unaffected; the original contents of the destination right
+ *      half are lost.
+ *
+ * For HRRI, the source is 0,E and the destination is [A].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opHRRI = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    this.writeWord(ac, PDP10.GETHL(op, dst, this.regEA) + this.regEA);
+};
+
+/**
+ * opHRRM(0o542000): Half Word Right to Right, Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-6:
+ *
+ *      Move the right half of the source word specified by M to the right half of the specified destination.
+ *      The source and the destination left half are unaffected; the original contents of the destination right
+ *      half are lost.
+ *
+ * For HRRM, the source is [A] and the destination is [E].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opHRRM = function(op, ac)
+{
+    var src = this.readWord(ac) & PDP10.HALF_MASK;
+    var dst = this.readWord(this.regEA);
+    this.writeWord(this.regEA, PDP10.GETHL(op, dst, src) + src);
+};
+
+/**
+ * opHRRS(0o543000): Half Word Right to Right, Self
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-6:
+ *
+ *      Move the right half of the source word specified by M to the right half of the specified destination.
+ *      The source and the destination left half are unaffected; the original contents of the destination right
+ *      half are lost.
+ *
+ *      SIDEBAR: If A is zero, HRRS is a no-op; otherwise it is equivalent to HRR.
+ *
+ * For HRRS, the source AND destination is [E] (and also [A] if A is non-zero).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opHRRS = function(op, ac)
+{
+    var dst = this.readWord(this.regEA);
+    dst = PDP10.SETHL(op, dst, dst);
+    this.writeWord(this.regEA, dst);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opHLR(0o544000): Half Word Left to Right
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-7:
+ *
+ *      Move the left half of the source word specified by M to the right half of the specified destination.
+ *      The source and the destination left half are unaffected; the original contents of the destination right half are lost.
+ *
+ * For HLR, the source is [E] and the destination is [A].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opHLR = function(op, ac)
+{
+    var src = (this.readWord(this.regEA) / PDP10.HALF_SHIFT)|0;
+    var dst = this.readWord(ac);
+    this.writeWord(ac, PDP10.GETHL(op, dst, src) + src);
+};
+
+/**
+ * opHLRI(0o545000): Half Word Left to Right, Immediate
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-7:
+ *
+ *      Move the left half of the source word specified by M to the right half of the specified destination.
+ *      The source and the destination left half are unaffected; the original contents of the destination right half are lost.
+ *
+ *      SIDEBAR: HLRI merely clears AC right.
+ *
+ * For HLRI, the source is 0,E and the destination is [A].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opHLRI = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    this.writeWord(ac, PDP10.GETHL(op, dst, 0));
+};
+
+/**
+ * opHLRM(0o546000): Half Word Left to Right, Memory
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-7:
+ *
+ *      Move the left half of the source word specified by M to the right half of the specified destination.
+ *      The source and the destination left half are unaffected; the original contents of the destination right half are lost.
+ *
+ * For HLRM, the source is [A] and the destination is [E].
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opHLRM = function(op, ac)
+{
+    var src = (this.readWord(ac) / PDP10.HALF_SHIFT)|0;
+    var dst = this.readWord(this.regEA);
+    this.writeWord(this.regEA, PDP10.GETHL(op, dst, src) + src);
+};
+
+/**
+ * opHLRS(0o547000): Half Word Left to Right, Self
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-7:
+ *
+ *      Move the left half of the source word specified by M to the right half of the specified destination.
+ *      The source and the destination left half are unaffected; the original contents of the destination right half are lost.
+ *
+ * For HLRS, the source AND destination is [E] (and also [A] if A is non-zero).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opHLRS = function(op, ac)
+{
+    var dst = this.readWord(this.regEA);
+    var src = (dst / PDP10.HALF_SHIFT)|0;
+    dst = PDP10.GETHL(op, dst, src) + src;
+    this.writeWord(this.regEA, dst);
+    if (ac) this.writeWord(ac, dst);
+};
+
+/**
+ * opTRNE(0o602000): Test Right, No Modification, and Skip if All Masked Bits Equal 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTRNE = function(op, ac)
+{
+    if (PDP10.AND(this.readWord(ac), this.regEA) == 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opTLNE(0o603000): Test Left, No Modification, and Skip if All Masked Bits Equal 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTLNE = function(op, ac)
+{
+    if (PDP10.AND(this.readWord(ac), this.regEA * PDP10.HALF_SHIFT) == 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opTRNA(0o604000): Test Right, No Modification, but Always Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTRNA = function(op, ac)
+{
+    this.setPC(this.regPC + 1);
+};
+
+/**
+ * opTLNA(0o605000): Test Left, No Modification, but Always Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTLNA = function(op, ac)
+{
+    this.setPC(this.regPC + 1);
+};
+
+/**
+ * opTRNN(0o606000): Test Right, No Modification, and Skip if Not All Masked Bits Equal 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTRNN = function(op, ac)
+{
+    if (PDP10.AND(this.readWord(ac), this.regEA) != 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opTLNN(0o607000): Test Left, No Modification, and Skip if Not All Masked Bits Equal 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTLNN = function(op, ac)
+{
+    if (PDP10.AND(this.readWord(ac), this.regEA * PDP10.HALF_SHIFT) != 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opTDNE(0o612000): Test Direct, No Modification, and Skip if All Masked Bits Equal 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTDNE = function(op, ac)
+{
+    if (PDP10.AND(this.readWord(ac), this.readWord(this.regEA)) == 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opTSNE(0o613000): Test Swapped, No Modification, and Skip if All Masked Bits Equal 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTSNE = function(op, ac)
+{
+    if (PDP10.AND(this.readWord(ac), PDP10.SWAP(this.readWord(this.regEA))) == 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opTDNA(0o614000): Test Direct, No Modification, but Always Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTDNA = function(op, ac)
+{
+    this.setPC(this.regPC + 1);
+};
+
+/**
+ * opTSNA(0o615000): Test Swapped, No Modification, but Always Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTSNA = function(op, ac)
+{
+    this.setPC(this.regPC + 1);
+};
+
+/**
+ * opTDNN(0o616000): Test Direct, No Modification, and Skip if Not All Masked Bits Equal 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTDNN = function(op, ac)
+{
+    if (PDP10.AND(this.readWord(ac), this.readWord(this.regEA)) != 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opTSNN(0o617000): Test Swapped, No Modification, and Skip if Not All Masked Bits Equal 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTSNN = function(op, ac)
+{
+    if (PDP10.AND(this.readWord(ac), PDP10.SWAP(this.readWord(this.regEA))) != 0) this.setPC(this.regPC + 1);
+};
+
+/**
+ * opTRZ(0o620000): Test Right, Zeros, but Do Not Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTRZ = function(op, ac)
+{
+    this.writeWord(ac, PDP10.CLR(this.readWord(ac), this.regEA));
+};
+
+/**
+ * opTLZ(0o621000): Test Left, Zeros, but Do Not Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTLZ = function(op, ac)
+{
+    this.writeWord(ac, PDP10.CLR(this.readWord(ac), this.regEA * PDP10.HALF_SHIFT));
+};
+
+/**
+ * opTRZE(0o622000): Test Right, Zeros, and Skip if All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTRZE = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    if (PDP10.AND(dst, this.regEA) == 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.CLR(dst, this.regEA));
+};
+
+/**
+ * opTLZE(0o623000): Test Left, Zeros, and Skip if All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTLZE = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    var src = this.regEA * PDP10.HALF_SHIFT;
+    if (PDP10.AND(dst, src) == 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.CLR(dst, src));
+};
+
+/**
+ * opTRZA(0o624000): Test Right, Zeros, but Always Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTRZA = function(op, ac)
+{
+    this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.CLR(this.readWord(ac), this.regEA));
+};
+
+/**
+ * opTLZA(0o625000): Test Left, Zeros, but Always Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTLZA = function(op, ac)
+{
+    this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.CLR(this.readWord(ac), this.regEA * PDP10.HALF_SHIFT));
+};
+
+/**
+ * opTRZN(0o626000): Test Right, Zeros, and Skip if Not All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTRZN = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    if (PDP10.AND(dst, this.regEA) != 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.CLR(dst, this.regEA));
+};
+
+/**
+ * opTLZN(0o627000): Test Left, Zeros, and Skip if Not All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTLZN = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    var src = this.regEA * PDP10.HALF_SHIFT;
+    if (PDP10.AND(dst, src) != 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.CLR(dst, src));
+};
+
+/**
+ * opTDZ(0o630000): Test Direct, Zeros, but Do Not Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTDZ = function(op, ac)
+{
+    this.writeWord(ac, PDP10.CLR(this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opTSZ(0o631000): Test Swapped, Zeros, but Do Not Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTSZ = function(op, ac)
+{
+    this.writeWord(ac, PDP10.CLR(this.readWord(ac), PDP10.SWAP(this.readWord(this.regEA))));
+};
+
+/**
+ * opTDZE(0o632000): Test Direct, Zeros, and Skip if All Masked Bits Equaled a
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTDZE = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    var src = this.readWord(this.regEA);
+    if (PDP10.AND(dst, src) == 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.CLR(dst, src));
+};
+
+/**
+ * opTSZE(0o633000): Test Swapped, Zeros, and Skip if All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTSZE = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    var src = PDP10.SWAP(this.readWord(this.regEA));
+    if (PDP10.AND(dst, src) == 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.CLR(dst, src));
+};
+
+/**
+ * opTDZA(0o634000): Test Direct, Zeros, but Always Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTDZA = function(op, ac)
+{
+    this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.CLR(this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opTSZA(0o635000): Test Swapped, Zeros, but Always Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTSZA = function(op, ac)
+{
+    this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.CLR(this.readWord(ac), PDP10.SWAP(this.readWord(this.regEA))));
+};
+
+/**
+ * opTDZN(0o636000): Test Direct, Zeros, and Skip if Not All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTDZN = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    var src = this.readWord(this.regEA);
+    if (PDP10.AND(dst, src) != 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.CLR(dst, src));
+};
+
+/**
+ * opTSZN(0o637000): Test Swapped, Zeros, and Skip if Not All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTSZN = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    var src = PDP10.SWAP(this.readWord(this.regEA));
+    if (PDP10.AND(dst, src) != 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.CLR(dst, src));
+};
+
+/**
+ * opTRC(0o640000): Test Right, Complement, but Do Not Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTRC = function(op, ac)
+{
+    this.writeWord(ac, PDP10.XOR(this.readWord(ac), this.regEA));
+};
+
+/**
+ * opTLC(0o641000): Test Left, Complement, but Do Not Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTLC = function(op, ac)
+{
+    this.writeWord(ac, PDP10.XOR(this.readWord(ac), this.regEA * PDP10.HALF_SHIFT));
+};
+
+/**
+ * opTRCE(0o642000): Test Right, Complement, and Skip if All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTRCE = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    if (PDP10.AND(dst, this.regEA) == 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.XOR(dst, this.regEA));
+};
+
+/**
+ * opTLCE(0o643000): Test Left, Complement, and Skip if All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTLCE = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    var src = this.regEA * PDP10.HALF_SHIFT;
+    if (PDP10.AND(dst, src) == 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.XOR(dst, src));
+};
+
+/**
+ * opTRCA(0o644000): Test Right, Complement, but Always Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTRCA = function(op, ac)
+{
+    this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.XOR(this.readWord(ac), this.regEA));
+};
+
+/**
+ * opTLCA(0o645000): Test Left, Complement, but Always Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTLCA = function(op, ac)
+{
+    this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.XOR(this.readWord(ac), this.regEA * PDP10.HALF_SHIFT));
+};
+
+/**
+ * opTRCN(0o646000): Test Right, Complement, and Skip if Not All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTRCN = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    if (PDP10.AND(dst, this.regEA) != 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.XOR(dst, this.regEA));
+};
+
+/**
+ * opTLCN(0o647000): Test Left, Complement, and Skip if Not All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTLCN = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    var src = this.regEA * PDP10.HALF_SHIFT;
+    if (PDP10.AND(dst, src) != 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.XOR(dst, src));
+};
+
+/**
+ * opTDC(0o650000): Test Direct, Complement, but Do Not Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTDC = function(op, ac)
+{
+    this.writeWord(ac, PDP10.XOR(this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opTSC(0o651000): Test Swapped, Complement, but Do Not Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTSC = function(op, ac)
+{
+    this.writeWord(ac, PDP10.XOR(this.readWord(ac), PDP10.SWAP(this.readWord(this.regEA))));
+};
+
+/**
+ * opTDCE(0o652000): Test Direct, Complement, and Skip if All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTDCE = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    var src = this.readWord(this.regEA);
+    if (PDP10.AND(dst, src) == 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.XOR(dst, src));
+};
+
+/**
+ * opTSCE(0o653000): Test Swapped, Complement, and Skip if All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTSCE = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    var src = PDP10.SWAP(this.readWord(this.regEA));
+    if (PDP10.AND(dst, src) == 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.XOR(dst, src));
+};
+
+/**
+ * opTDCA(0o654000): Test Direct, Complement, but Always Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTDCA = function(op, ac)
+{
+    this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.XOR(this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opTSCA(0o655000): Test Swapped, Complement, but Always Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTSCA = function(op, ac)
+{
+    this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.XOR(this.readWord(ac), PDP10.SWAP(this.readWord(this.regEA))));
+};
+
+/**
+ * opTDCN(0o656000): Test Direct, Complement, and Skip if Not All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTDCN = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    var src = this.readWord(this.regEA);
+    if (PDP10.AND(dst, src) != 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.XOR(dst, src));
+};
+
+/**
+ * opTSCN(0o657000): Test Swapped, Complement, and Skip if Not All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTSCN = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    var src = PDP10.SWAP(this.readWord(this.regEA));
+    if (PDP10.AND(dst, src) != 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.XOR(dst, src));
+};
+
+/**
+ * opTRO(0o660000): Test Right, Ones, but Do Not Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTRO = function(op, ac)
+{
+    this.writeWord(ac, PDP10.IOR(this.readWord(ac), this.regEA));
+};
+
+/**
+ * opTLO(0o661000): Test Left, Ones, but Do Not Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTLO = function(op, ac)
+{
+    this.writeWord(ac, PDP10.IOR(this.readWord(ac), this.regEA * PDP10.HALF_SHIFT));
+};
+
+/**
+ * opTROE(0o662000): Test Right, Ones, and Skip if All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTROE = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    if (PDP10.AND(dst, this.regEA) == 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.IOR(dst, this.regEA));
+};
+
+/**
+ * opTLOE(0o663000): Test Left, Ones, and Skip if All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTLOE = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    if (PDP10.AND(dst, this.regEA * PDP10.HALF_SHIFT) == 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.IOR(dst, this.regEA * PDP10.HALF_SHIFT));
+};
+
+/**
+ * opTROA(0o664000): Test Right, Ones, but Always Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTROA = function(op, ac)
+{
+    this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.IOR(this.readWord(ac), this.regEA));
+};
+
+/**
+ * opTLOA(0o665000): Test Left, Ones, but Always Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTLOA = function(op, ac)
+{
+    this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.IOR(this.readWord(ac), this.regEA * PDP10.HALF_SHIFT));
+};
+
+/**
+ * opTRON(0o666000): Test Right, Ones, and Skip if Not All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTRON = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    if (PDP10.AND(dst, this.regEA) != 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.IOR(dst, this.regEA));
+};
+
+/**
+ * opTLON(0o667000): Test Left, Ones, and Skip if Not All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTLON = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    var src = this.regEA * PDP10.HALF_SHIFT;
+    if (PDP10.AND(dst, src) != 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.IOR(dst, src));
+};
+
+/**
+ * opTDO(0o670000): Test Direct, Ones, but Do Not Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTDO = function(op, ac)
+{
+    this.writeWord(ac, PDP10.IOR(this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opTSO(0o671000): Test Swapped, Ones, but Do Not Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTSO = function(op, ac)
+{
+    this.writeWord(ac, PDP10.IOR(this.readWord(ac), PDP10.SWAP(this.readWord(this.regEA))));
+};
+
+/**
+ * opTDOE(0o672000): Test Direct, Ones, and Skip if All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTDOE = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    var src = this.readWord(this.regEA);
+    if (PDP10.AND(dst, src) == 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.IOR(dst, src));
+};
+
+/**
+ * opTSOE(0o673000): Test Swapped, Ones, and Skip if All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTSOE = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    var src = PDP10.SWAP(this.readWord(this.regEA));
+    if (PDP10.AND(dst, src) == 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.IOR(dst, src));
+};
+
+/**
+ * opTDOA(0o674000): Test Direct, Ones, but Always Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTDOA = function(op, ac)
+{
+    this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.IOR(this.readWord(ac), this.readWord(this.regEA)));
+};
+
+/**
+ * opTSOA(0o675000): Test Swapped, Ones, but Always Skip
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTSOA = function(op, ac)
+{
+    this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.IOR(this.readWord(ac), PDP10.SWAP(this.readWord(this.regEA))));
+};
+
+/**
+ * opTDON(0o676000): Test Direct, Ones, and Skip if Not All Masked Bits Equaled 0
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTDON = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    var src = this.readWord(this.regEA);
+    if (PDP10.AND(dst, src) != 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.IOR(dst, src));
+};
+
+/**
+ * opTSON(0o677000): Test Swapped, Ones, and Skip if Not All Masked Bits Equaled a
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opTSON = function(op, ac)
+{
+    var dst = this.readWord(ac);
+    var src = PDP10.SWAP(this.readWord(this.regEA));
+    if (PDP10.AND(dst, src) != 0) this.setPC(this.regPC + 1);
+    this.writeWord(ac, PDP10.IOR(dst, src));
+};
+
+/**
+ * opBLKI(0o700000)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} dev
+ */
+PDP10.opBLKI = function(op, dev)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opDATAI(0o700040)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} dev
+ */
+PDP10.opDATAI = function(op, dev)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opBLKO(0o700100)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} dev
+ */
+PDP10.opBLKO = function(op, dev)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opDATAO(0o700140)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} dev
+ */
+PDP10.opDATAO = function(op, dev)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opCONO(0o700200)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} dev
+ */
+PDP10.opCONO = function(op, dev)
+{
+    switch(dev) {
+    case PDP10.DEVICES.APR:
+        this.writeFlags(this.readWord(this.regEA));
+        break;
+    default:
+        this.opUndefined(op);
+        break;
+    }
+};
+
+/**
+ * opCONI(0o700240)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} dev
+ */
+PDP10.opCONI = function(op, dev)
+{
+    switch(dev) {
+    case PDP10.DEVICES.APR:
+        this.writeWord(this.regEA, this.readFlags());
+        break;
+    default:
+        this.opUndefined(op);
+        break;
+    }
+};
+
+/**
+ * opCONSZ(0o700300)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} dev
+ */
+PDP10.opCONSZ = function(op, dev)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opCONSO(0o700340)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} dev
+ */
+PDP10.opCONSO = function(op, dev)
+{
+    this.opUndefined(op);
+};
+
+/**
+ * opIO(0o700xxx-0o777xxx): Input-Output Instructions
+ *
+ * From the DEC PDP-10 System Reference Manual (May 1968), p. 2-68:
+ *
+ *      The input-output instructions govern all transfers of data to and from the peripheral equipment, and also
+ *      perform many operations within the processor.  An instruction in the in-out class is designated by 111 in
+ *      bits 0-2, ie its left octal digit is 7.  Bits 3-9 address the device that is to respond to the instruction.
+ *      The format thus allows for 128 codes, two of which, 000 and 004 respectively, address the processor and
+ *      priority interrupt, and are used for the console and time share hardware as well.  A chart in Appendix A
+ *      lists all devices for which codes have been assigned, and gives their mnemonics and DEC option numbers.
+ *
+ *      Bits 13-35 are the same as in all other instructions: they are the I, X, and Y parts, which are used to
+ *      calculate an effective address, set of conditions, or mask to be used in the execution of the instruction.
+ *      The remaining bits, 10-12, select one of the following eight 10 instructions.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ */
+PDP10.opIO = function(op)
+{
+    PDP10.aOpIO_KA10[op & 7].call(this, op, (op >> 3) & 0o177);
+};
+
+/**
+ * opNOP(op, ac)
+ *
+ * Used for all "defined" operations that, in fact, do nothing (eg, SETA, SETAI, CAI, JUMP).
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opNOP = function(op, ac)
+{
+};
+
+/**
+ * opNOPM(op, ac)
+ *
+ * Used for all "defined" operations that, in fact, do nothing (eg, SETMM, CAM) EXCEPT reference memory.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} ac
+ */
+PDP10.opNOPM = function(op, ac)
+{
+};
+
+/**
+ * opUndefined(op, ac)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} op
+ * @param {number} [ac]
+ */
+PDP10.opUndefined = function(op, ac)
+{
+    this.println("undefined opcode: " + Str.toOct(op));
+    this.advancePC(-1);
+    this.stopCPU();
+};
+
+/**
+ * doABS(src)
+ *
+ * Returns the absolute value (ABS) of the 36-bit operand; used by the MOVM* (Move Magnitude) instructions.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} src (36-bit)
+ * @return {number} (absolute value of src)
+ */
+PDP10.doABS = function(src)
+{
+    if (src > PDP10.INT_MASK) {
+        if (src != PDP10.INT_LIMIT) {
+            src = PDP10.TWO_POW36 - src;
+        } else {
+            this.regPS |= (PDP10.PSFLAG.AROV | PDP10.PSFLAG.CRY1);
+        }
+    }
+    return src;
+};
+
+/**
+ * doADD(dst, src)
+ *
+ * Performs the addition (ADD) of two signed 36-bit operands.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} dst (36-bit value)
+ * @param {number} src (36-bit value)
+ * @return {number} (dst + src)
+ */
+PDP10.doADD = function(dst, src)
+{
+    /*
+     * Since, in our happy little world, 36-bit values are always unsigned, the
+     * only possible out-of-bounds value is a result >= WORD_LIMIT, which the mod cures.
+     */
+    var res = (dst + src) % PDP10.WORD_LIMIT;
+    PDP10.setAddFlags.call(this, dst, src, res);
+    return res;
+};
+
+/**
+ * doDIV(src, dst, ext)
+ *
+ * Performs the division (DIV) of a 72-bit operand by a 36-bit operand.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} src (36-bit divisor)
+ * @param {number} dst (36-bit value)
+ * @param {number} [ext] (36-bit value extension)
+ * @return {number} (dst / src) (the remainder is stored in regEX); -1 if error (no division performed)
+ */
+PDP10.doDIV = function(src, dst, ext)
+{
+    var fNegQ = false, fNegR = false;
+
+    /*
+     * Perform all the same up-front checks that the PDP-10 performs; if we do our job correctly, then it
+     * will be impossible for the actual division operation to overflow (the asserts below should never fire).
+     */
+    if (ext === undefined) {
+        if (!src) {
+            this.regPS |= PDP10.PSFLAG.DCK | PDP10.PSFLAG.AROV;
+            return -1;
+        }
+        ext = (dst > PDP10.INT_MASK)? PDP10.WORD_MASK : 0;
+    } else {
+        var srcAbs = (src < PDP10.INT_LIMIT? src : PDP10.TWO_POW36 - src);
+        var extAbs = (ext < PDP10.INT_LIMIT? ext : PDP10.TWO_POW36 - ext - (dst? 1 : 0));
+        if (extAbs >= srcAbs) {
+            this.regPS |= PDP10.PSFLAG.DCK | PDP10.PSFLAG.AROV;
+            return -1;
+        }
+    }
+
+    /*
+     * We're done with the PDP-10's "dual sign" operands now; produce a (unified) signed 72-bit dividend.
+     */
+    dst = PDP10.merge72.call(this, dst, ext);
+    ext = this.regEX;
+
+    /*
+     * Make all the inputs positive now, to keep the division simple.  Fix up the results when we're done.
+     */
+    if (src > PDP10.INT_MASK) {
+        src = PDP10.WORD_LIMIT - src;
+        fNegQ = !fNegQ;
+    }
+    if (ext > PDP10.INT_MASK) {
+        if (dst) {
+            ext = PDP10.WORD_MASK - ext;
+            dst = PDP10.WORD_LIMIT - dst;
+        }
+        else {
+            if (ext) ext = PDP10.WORD_LIMIT - ext;
+        }
+        fNegR = true; fNegQ = !fNegQ;
+    }
+
+    /*
+     * Initialize the four double-length 72-bit values we need for the division process.
+     *
+     * The process involves shifting the divisor left 1 bit (ie, doubling it) until it equals
+     * or exceeds the dividend, and then repeatedly subtracting the divisor from the dividend and
+     * shifting the divisor right 1 bit until the divisor is "exhausted" (no bits left), with an
+     * "early out" if the dividend gets "exhausted" first.
+     *
+     * Note that each element of these double arrays is a 36-bit value, so it's rarely a good idea
+     * to use bitwise operators on them, because those would operate on only the low 32 bits.
+     * Stick with the double worker functions I've created, and trust your JavaScript engine to
+     * inline/optimize the code.
+     */
+    PDP10.INITD(this.regRes, 0, 0);
+    PDP10.INITD(this.regPow, 1, 0);
+    PDP10.INITD(this.regDiv, src, 0);
+    PDP10.INITD(this.regRem, dst, ext);
+
+    while (PDP10.CMPD(this.regRem, this.regDiv) > 0) {
+        PDP10.ADDD(this.regDiv, this.regDiv);
+        PDP10.ADDD(this.regPow, this.regPow);
+    }
+    do {
+        if (PDP10.CMPD(this.regRem, this.regDiv) >= 0) {
+            PDP10.SUBD(this.regRem, this.regDiv);
+            PDP10.ADDD(this.regRes, this.regPow);
+            if (PDP10.ZEROD(this.regRem)) break;
+        }
+        PDP10.SHRD(this.regDiv);
+        PDP10.SHRD(this.regPow);
+    } while (!PDP10.ZEROD(this.regPow));
+
+
+
+
+    dst = this.regRes[0];
+    this.regEX = this.regRem[0];
+
+    if (fNegQ && dst) {
+        dst = PDP10.WORD_LIMIT - dst;
+    }
+
+    if (fNegR && this.regEX) {
+        this.regEX = PDP10.WORD_LIMIT - this.regEX;
+    }
+
+    return dst;
+};
+
+/**
+ * doMUL(dst, src, fTruncate, fExternal)
+ *
+ * Performs the multiplication (MUL) of two signed 36-bit operands.
+ *
+ * To support 72-bit results, we perform the multiplication process as you would "by hand",
+ * treating the operands to be multiplied as two 2-digit numbers, where each "digit" is an 18-bit
+ * number (base 2^18).  Each individual multiplication of these 18-bit "digits" will produce
+ * a result within 2^36, well within JavaScript integer accuracy.
+ *
+ * PDP-10 Diagnostic Notes
+ * -----------------------
+ *
+ * The "DAKAK" diagnostic contains the following code:
+ *
+ *      036174: 200240 043643  MOVE    5,43643      ; [43643] = 400000000000
+ *      036175: 200300 043603  MOVE    6,43603      ; [43603] = 777777777777
+ *      036176: 200140 043604  MOVE    3,43604      ; [43604] = 000000000001
+ *      036177: 224240 000003  MUL     5,3          ; Multiply 400000000000 by 000000000001
+ *      036200: 312240 043604  CAME    5,43604      ; high order result in AC should be: 000000000001
+ *      036201: 003240 033721  UUO     5,33721      ;
+ *      036202: 312300 043602  CAME    6,43602      ; low order result in AC+1 should be: 000000000000
+ *
+ * The "natural" result is:
+ *
+ *      05=777777777777 06=400000000000
+ *
+ * And SIMH seems to agree.  So why does the DEC diagnostic expect:
+ *
+ *      05=000000000001 06=000000000000
+ *
+ * The answer can be found in the June 1982 "DECSYSTEM-10 and DECSYSTEM-20 Processor Reference Manual",
+ * in the description of the MUL instruction:
+ *
+ *      CAUTION: In the KA10, an AC operand of 2^35 is treated as though it were +2^35, producing the
+ *      incorrect sign in the product.
+ *
+ * This behavior is now simulated below for MODEL_KA10, at least to the extent that the diagnostic is happy.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} dst (36-bit value)
+ * @param {number} src (36-bit value)
+ * @param {boolean} [fTruncate] (true to truncate the result to 36 bits; used by IMUL instructions)
+ * @param {boolean} [fExternal] (true if external caller; avoids modifying the CPU state)
+ * @return {number} (dst * src) (the high 36 bits of the result; the low 36 bits are stored in regEX)
+ */
+PDP10.doMUL = function(dst, src, fTruncate, fExternal)
+{
+    var n1 = dst, n2 = src;
+    var fNeg = false, res, ext;
+
+    /*
+     * If either input is in the negative range, record the sign and make it positive;
+     * we'll negate the result afterward if necessary.
+     */
+    if (n1 > PDP10.INT_MASK) {
+        if (fExternal || this.model != PDP10.MODEL_KA10 || n1 != PDP10.INT_LIMIT) {
+            n1 = PDP10.WORD_LIMIT - n1;
+            fNeg = !fNeg;
+        }
+    }
+
+    if (n2 > PDP10.INT_MASK) {
+        n2 = PDP10.WORD_LIMIT - n2;
+        fNeg = !fNeg;
+    }
+
+    if (n1 < PDP10.HALF_SHIFT && n2 < PDP10.HALF_SHIFT) {
+        res = n1 * n2;
+        ext = 0;
+    }
+    else {
+        var n1d1 = (n1 & PDP10.HALF_MASK);
+        var n1d2 = Math.trunc(n1 / PDP10.HALF_SHIFT);
+        var n2d1 = (n2 & PDP10.HALF_MASK);
+        var n2d2 = Math.trunc(n2 / PDP10.HALF_SHIFT);
+        var m1d1 = n1d1 * n2d1;
+        var m1d2 = (n1d2 * n2d1) + Math.trunc(m1d1 / PDP10.HALF_SHIFT);
+        ext = Math.trunc(m1d2 / PDP10.HALF_SHIFT);
+        m1d2 = (m1d2 & PDP10.HALF_MASK) + (n1d1 * n2d2);
+        res = ((m1d2 * PDP10.HALF_SHIFT) + (m1d1 & PDP10.HALF_MASK)) % PDP10.WORD_LIMIT;
+        ext += Math.trunc(m1d2 / PDP10.HALF_SHIFT) + (n1d2 * n2d2);
+    }
+
+    if (fNeg) {
+        if (res) {
+            ext = PDP10.WORD_MASK - ext;
+            res = PDP10.WORD_LIMIT - res;
+        }
+        else {
+            if (ext) ext = PDP10.WORD_LIMIT - ext;
+        }
+    }
+
+    ext = PDP10.split72.call(this, res, ext, fExternal);
+
+    if (fTruncate) {
+        /*
+         * Special code for IMUL.  I originally tried to avoid calling split72() in this case, but the PDP-10
+         * still appears to be splitting the result of the multiplication into separately signed 36-bit values,
+         * so the simplest solution is to call split72() in all cases.
+         */
+        res = this.regEX;
+        if (!fExternal) {
+            /*
+             * Regarding IMUL overflows, the original spec says:
+             *
+             *      Set Overflow if the product is >= 2^35 or < -2^35 (ie, if the high order word of the double
+             *      length product is not null); the high order word is lost.
+             *
+             * However, when the "DAKAL" diagnostic performs a sequence like this:
+             *
+             *      00=000000000000 01=000000000000 02=000000000000 03=400000036755
+             *      04=400000000000 05=000000000003 06=400000000000 07=000000000004
+             *      10=000000000000 11=000000000011 12=777777400000 13=777777777776
+             *      14=000000200000 15=400000037134 16=000000000016 17=000000000000
+             *      PC=037145 RA=00400000 EA=400000 PS=000000 OV=0 C0=0 C1=0 ND=0 PD=0
+             *      037145: 220600 000013  IMUL    14,13            ;cycles=1
+             *
+             * it sets 14=777777400000 and leaves overflow clear; since the 'high order word" would be 777777777777,
+             * not null, I think the spec over-simplifies.  So our check is more exhaustive: it verifies that ext is
+             * nothing more than an extension of the sign bit of res (ie, 0 if res is positive, -1 if res is negative).
+             * Any other combination of values implies an overflow.
+             */
+            if ((ext || res > PDP10.INT_MASK) && (ext != PDP10.WORD_MASK || res <= PDP10.INT_MASK)) {
+                this.regPS |= PDP10.PSFLAG.AROV;
+            }
+        }
+        ext = res;
+    }
+    return ext;
+};
+
+/**
+ * doNEG(src)
+ *
+ * Returns the negation (NEG) of the 36-bit operand; used by the MOVN* (Move Negative) instructions.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} src (36-bit)
+ * @return {number} (src negated, but as an unsigned 36-bit result)
+ */
+PDP10.doNEG = function(src)
+{
+    if (!src) {
+        this.regPS |= (PDP10.PSFLAG.CRY0 | PDP10.PSFLAG.CRY1);
+    }
+    else {
+        /*
+         * In the non-zero case, it's always safe to subtract src from TWO_POW36, but since we have to check for
+         * the INT_LIMIT case anyway, and since subtraction in that case doesn't alter src, we skip the subtraction.
+         */
+        if (src == PDP10.INT_LIMIT) {
+            this.regPS |= (PDP10.PSFLAG.AROV | PDP10.PSFLAG.CRY1);
+        } else {
+            src = PDP10.TWO_POW36 - src;
+        }
+    }
+    return src;
+};
+
+/**
+ * doSUB(dst, src)
+ *
+ * Performs the subtraction (SUB) of two signed 36-bit operands.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} dst (36-bit value)
+ * @param {number} src (36-bit value)
+ * @return {number} (dst - src)
+ */
+PDP10.doSUB = function(dst, src)
+{
+    /*
+     * Since, in our happy little world, 36-bit values are always unsigned, the
+     * only possible out-of-bounds value is a result < 0, which adding WORD_LIMIT cures.
+     */
+    var res = (dst - src);
+    if (res < 0) res += PDP10.WORD_LIMIT;
+    /*
+     * We can leverage setAddFlags() by treating the subtraction as addition;
+     * since res = dst - src, it is also true that dst = res + src.
+     */
+    PDP10.setAddFlags.call(this, res, src, dst);
+    return res;
+};
+
+/**
+ * merge72(dst, ext)
+ *
+ * Returns a unified 72-bit result from two independently-signed 36-bit values.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} dst (36-bit value)
+ * @param {number} ext (36-bit value)
+ * @return {number} (returns the lower 36 bits; the upper 36 bits  are stored in regEX)
+ */
+PDP10.merge72 = function(dst, ext)
+{
+    var sign = (ext - (ext % PDP10.INT_LIMIT));
+
+    /*
+     * For 72-bit inputs, the PDP-10 doesn't care whether or not the low word's sign
+     * matches the high word's sign.  The high word's sign bit is the controlling bit.
+     *
+     *
+     *
+     * Compute value without the sign bit and add the low bit of extended in its place.
+     */
+    dst = (dst % PDP10.INT_LIMIT) + ((ext & 1) * PDP10.INT_LIMIT);
+    this.regEX = sign + Math.trunc(ext / 2);
+    return dst;
+};
+
+/**
+ * split72(res, ext, fExternal)
+ *
+ * Returns two 36-bit values with matching sign bits from a unified 72-bit result.
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} res (36-bit value)
+ * @param {number} ext (36-bit value)
+ * @param {boolean} [fExternal] (true if external caller; avoids modifying the CPU state)
+ * @return {number} (returns the upper 36 bits; the lower 36 bits are stored in regEX)
+ */
+PDP10.split72 = function(res, ext, fExternal)
+{
+    /*
+     * We just produced a signed 72-bit result, whereas the PDP-10 stores 72-bit arithmetic values as two
+     * signed 36-bit results with matching signs.  Since that's effectively only 70 bits of magnitude (with
+     * two sign bits), we lose one bit of magnitude.
+     *
+     * The conversion requires shifting ext left one bit so that we can move the high bit of res into the
+     * low bit of ext, and then set the sign bit of res to match the sign bit of ext.
+     */
+    var sign = ext - (ext % PDP10.INT_LIMIT);
+    ext = ((ext * 2) % PDP10.WORD_LIMIT) + Math.trunc(res / PDP10.INT_LIMIT);
+    res = sign + (res % PDP10.INT_LIMIT);
+
+    var signNew = ext - (ext % PDP10.INT_LIMIT);
+    if (signNew != sign) {
+        /*
+         * I used to restore ext's original sign (ext = sign + (ext - signNew)), but the PDP-10's defined
+         * behavior for multiplication overflow (ie, whenever both operands are 0o400000000000) is to set both
+         * res and ext to 0o400000000000.
+         *
+         * To quote the original spec for the MUL instruction:
+         *
+         *      If both operands are -2^35 set Overflow; the double length result stored is -2^70.
+         */
+        res = ext;
+    }
+
+    if (fExternal) return res;
+
+    if (res == PDP10.INT_LIMIT && ext == PDP10.INT_LIMIT) {
+        this.regPS |= PDP10.PSFLAG.AROV;
+    }
+    this.regEX = res;
+    return ext;
+};
+
+/**
+ * setAddFlags(dst, src, res)
+ *
+ * @this {CPUStatePDP10}
+ * @param {number} dst (36-bit value)
+ * @param {number} src (36-bit value)
+ * @param {number} res (36-bit value)
+ */
+PDP10.setAddFlags = function(dst, src, res)
+{
+    /*
+     * Isolate the top two bits of dst, src, and res by "shifting" them into bits 0 and 1 of the
+     * following variables.  Note that shifting with division only works when the values are unsigned
+     * (which they MUST be).
+     */
+
+    var dst01 = Math.trunc(dst / PDP10.TWO_POW34);
+    var src01 = Math.trunc(src / PDP10.TWO_POW34);
+    var res01 = Math.trunc(res / PDP10.TWO_POW34);
+
+    /*
+     * Transform bits 0 and 1 into carry flags, based on the following truth table:
+     *
+     *      D   S   R   C   Carry?
+     *      -   -   -   -   ------
+     *      0   0   0   0   no
+     *      0   0   1   0   no (there must have been a carry out of the preceding bit, but it was "absorbed")
+     *      0   1   0   1   yes (there must have been a carry out of the preceding bit, but it was NOT "absorbed")
+     *      0   1   1   0   no
+     *      1   0   0   1   yes (same as the preceding "yes" case)
+     *      1   0   1   0   no
+     *      1   1   0   1   yes (since the addition of two ones must always produce a carry)
+     *      1   1   1   1   yes (since the addition of two ones must always produce a carry)
+     */
+    var bitsCarry = (dst01 ^ ((dst01 ^ src01) & (src01 ^ res01)));
+    var fCarry0 = bitsCarry & 0b10;
+    var fCarry1 = bitsCarry & 0b01;
+
+    /*
+     * Similarly, we transform bit 1 into an overflow flag, based on the following truth table;
+     * note that X is (D ^ R) and Y is (S ^ R):
+     *
+     *      D   S   R   X   Y   O   Overflow?
+     *      -   -   -   -   -   -   ---------
+     *      0   0   0   0   0   0   no
+     *      0   0   1   1   1   1   yes (adding two positive values yielded a negative value)
+     *      0   1   0   0   1   0   no
+     *      0   1   1   1   0   0   no
+     *      1   0   0   1   0   0   no
+     *      1   0   1   0   1   0   no
+     *      1   1   0   1   1   1   yes (adding two negative values yielded a positive value)
+     *      1   1   1   0   0   0   no
+     */
+    var fOverflow = ((dst01 ^ res01) & (src01 ^ res01)) & 0b10;
+    this.regPS |= (fCarry0? PDP10.PSFLAG.CRY0 : 0) | (fCarry1? PDP10.PSFLAG.CRY1 : 0) | (fOverflow? PDP10.PSFLAG.AROV : 0);
+};
+
+/**
+ * AND(dst, src)
+ *
+ * Performs the logical "and" (AND) of two 36-bit operands.
+ *
+ * @param {number} dst (36-bit value)
+ * @param {number} src (36-bit value)
+ * @return {number} (dst & src)
+ */
+PDP10.AND = function(dst, src)
+{
+    /*
+     * Since dst and src are 36-bit values, we must AND the low 32 bits separately from the higher bits,
+     * and then combine them with addition.  Since all bits above 36 will be zero, and since 0 AND 0 is 0,
+     * no special masking for the higher bits is required.
+     *
+     * WARNING: When using JavaScript's 32-bit operators with values that could set bit 31 and produce a
+     * negative value, it's critical to perform a final right-shift of 0, ensuring that the final result is
+     * positive.
+     *
+     * Finally, all 36-bit data within a PDP-10 machine should ALWAYS be unsigned, which we now assert,
+     * because the divisions below would not yield correct results with negative inputs.
+     */
+
+    return ((((dst / PDP10.TWO_POW32)|0) & ((src / PDP10.TWO_POW32)|0)) * PDP10.TWO_POW32) + ((dst & src) >>> 0);
+};
+
+/**
+ * CLR(dst, src)
+ *
+ * Performs the logical "and" (AND) of a 36-bit operand and its complement.
+ *
+ * @param {number} dst (36-bit value)
+ * @param {number} src (36-bit value)
+ * @return {number} (dst & ~src)
+ */
+PDP10.CLR = function(dst, src)
+{
+    return PDP10.AND(dst, PDP10.NOT(src));
+};
+
+/**
+ * CMP(dst, src)
+ *
+ * Performs the SIGNED comparison (CMP) of two 36-bit operands.
+ *
+ * @param {number} dst (36-bit value)
+ * @param {number} src (36-bit value)
+ * @return {number} (dst - src)
+ */
+PDP10.CMP = function(dst, src)
+{
+    return (dst < PDP10.INT_LIMIT? dst : dst - PDP10.WORD_LIMIT) - (src < PDP10.INT_LIMIT? src : src - PDP10.WORD_LIMIT);
+};
+
+/**
+ * EQV(dst, src)
+ *
+ * Performs the logical "equivalence" (EQV) of two 36-bit operands (ie, NOT XOR)
+ *
+ * @param {number} dst (36-bit value)
+ * @param {number} src (36-bit value)
+ * @return {number} (~(dst ^ src))
+ */
+PDP10.EQV = function(dst, src)
+{
+    /*
+     * Since dst and src are 36-bit values, we must EQV the low 32 bits separately from the higher bits,
+     * and then combine them with addition.  Since all bits above 36 will be zero, and since 0 EQV 0 is 1,
+     * we must mask the higher 4 bits with 0o17.
+     *
+     * WARNING: When using JavaScript's 32-bit operators with values that could set bit 31 and produce a
+     * negative value, it's critical to perform a final right-shift of 0, ensuring that the final result is
+     * positive.
+     *
+     * Finally, all 36-bit data within a PDP-10 machine should ALWAYS be unsigned, which we now assert,
+     * because the divisions below would not yield correct results with negative inputs.
+     */
+
+    return ((~(((dst / PDP10.TWO_POW32)|0) ^ ((src / PDP10.TWO_POW32)|0)) & 0o17) * PDP10.TWO_POW32) + (~(dst ^ src) >>> 0);
+};
+
+/**
+ * IOR(dst, src)
+ *
+ * Performs the logical "inclusive-or" (OR) of two 36-bit operands.
+ *
+ * @param {number} dst (36-bit value)
+ * @param {number} src (36-bit value)
+ * @return {number} (dst | src)
+ */
+PDP10.IOR = function(dst, src)
+{
+    /*
+     * Since dst and src are 36-bit values, we must OR the low 32 bits separately from the higher bits,
+     * and then combine them with addition.  Since all bits above 36 will be zero, and since 0 OR 0 is 0,
+     * no special masking for the higher bits is required.
+     *
+     * WARNING: When using JavaScript's 32-bit operators with values that could set bit 31 and produce a
+     * negative value, it's critical to perform a final right-shift of 0, ensuring that the final result is
+     * positive.
+     *
+     * Finally, all 36-bit data within a PDP-10 machine should ALWAYS be unsigned, which we now assert,
+     * because the divisions below would not yield correct results with negative inputs.
+     */
+
+    return ((((dst / PDP10.TWO_POW32)|0) | ((src / PDP10.TWO_POW32)|0)) * PDP10.TWO_POW32) + ((dst | src) >>> 0);
+};
+
+/**
+ * NOT(src)
+ *
+ * Performs the one's complement (NOT) of a 36-bit operand.
+ *
+ * @param {number} src (36-bit value)
+ * @return {number} (~src)
+ */
+PDP10.NOT = function(src)
+{
+    /*
+     * Since src is a 36-bit value, we must NOT the low 32 bits separately from the higher bits,
+     * and then combine them with addition.  Since all bits above 36 will be zero, and since ~0 is 1,
+     * we must mask the higher 4 bits with 0o17.
+     *
+     * WARNING: When using JavaScript's 32-bit operators with values that could set bit 31 and produce a
+     * negative value, it's critical to perform a final right-shift of 0, ensuring that the final result is
+     * positive.
+     *
+     * Finally, all 36-bit data within a PDP-10 machine should ALWAYS be unsigned, which we now assert,
+     * because the divisions below would not yield correct results with negative inputs.
+     */
+
+    return ((~((src / PDP10.TWO_POW32)|0) & 0o17) * PDP10.TWO_POW32) + (~src >>> 0);
+};
+
+/**
+ * SIGN(dst)
+ *
+ * Returns the signed form of the 36-bit operand; more efficient than doCMP(dst, 0).
+ *
+ * @param {number} dst (36-bit value)
+ * @return {number}
+ */
+PDP10.SIGN = function(dst)
+{
+    return (dst < PDP10.INT_LIMIT? dst : dst - PDP10.WORD_LIMIT);
+};
+
+/**
+ * XOR(dst, src)
+ *
+ * Performs the logical "exclusive-or" (XOR) of two 36-bit operands.
+ *
+ * @param {number} dst (36-bit value)
+ * @param {number} src (36-bit value)
+ * @return {number} (dst ^ src)
+ */
+PDP10.XOR = function(dst, src)
+{
+    /*
+     * Since dst and src are 36-bit values, we must XOR the low 32 bits separately from the higher bits,
+     * and then combine them with addition.  Since all bits above 36 will be zero, and since 0 XOR 0 is 0,
+     * no special masking for the higher bits is required.
+     *
+     * WARNING: When using JavaScript's 32-bit operators with values that could set bit 31 and produce a
+     * negative value, it's critical to perform a final right-shift of 0, ensuring that the final result is
+     * positive.
+     *
+     * Finally, all 36-bit data within a PDP-10 machine should ALWAYS be unsigned, which we now assert,
+     * because the divisions below would not yield correct results with negative inputs.
+     */
+
+    return ((((dst / PDP10.TWO_POW32)|0) ^ ((src / PDP10.TWO_POW32)|0)) * PDP10.TWO_POW32) + ((dst ^ src) >>> 0);
+};
+
+/**
+ * SWAP(src)
+ *
+ * Used by callers to "swap" the left and right half-words of a 36-bit operand.
+ *
+ * NOTE: Since HALF_MASK is an 18-bit value, it's safe to use "&" with HALF_MASK (equivalent to "%" with HALF_SHIFT).
+ *
+ * @param {number} src
+ * @return {number} (updated src)
+ */
+PDP10.SWAP = function(src)
+{
+    return ((src / PDP10.HALF_SHIFT)|0) + ((src & PDP10.HALF_MASK) * PDP10.HALF_SHIFT);
+};
+
+/**
+ * GETHL(op, dst, src)
+ *
+ * Used by callers to obtain HL (half-word left) with HR (half-word right) zeroed.
+ *
+ * @param {number} op
+ * @param {number} dst (36-bit value whose 18-bit left half is either preserved or modified)
+ * @param {number} src (18-bit value used to determine the sign extension, if any, for the left half of dst)
+ * @return {number} (updated dst)
+ */
+PDP10.GETHL = function(op, dst, src)
+{
+    switch(op & 0o600) {
+    case 0o000:
+        dst -= (dst & PDP10.HALF_MASK);
+        break;
+    case 0o200:
+        dst = 0;
+        break;
+    case 0o400:
+        dst = (PDP10.HALF_MASK * PDP10.HALF_SHIFT);
+        break;
+    case 0o600:
+        dst = (src > PDP10.HINT_MASK? (PDP10.HALF_MASK * PDP10.HALF_SHIFT) : 0);
+        break;
+    }
+    return dst;
+};
+
+/**
+ * SETHL(op, dst, src)
+ *
+ * Used by callers to obtain HL (half-word left) with HR (half-word right) preserved.
+ *
+ * @param {number} op
+ * @param {number} dst (36-bit value whose 18-bit left half is either preserved or modified)
+ * @param {number} src (18-bit value used to determine the sign extension, if any, for the left half of dst)
+ * @return {number} (updated dst)
+ */
+PDP10.SETHL = function(op, dst, src)
+{
+    if (op &= 0o600) {
+        dst &= PDP10.HALF_MASK;
+        switch(op) {
+        case 0o400:
+            dst += (PDP10.HALF_MASK * PDP10.HALF_SHIFT);
+            break;
+        case 0o600:
+            dst += (src > PDP10.HINT_MASK? (PDP10.HALF_MASK * PDP10.HALF_SHIFT) : 0);
+            break;
+        }
+    }
+    return dst;
+};
+
+/**
+ * GETHR(op, dst, src)
+ *
+ * Used by callers to obtain HR (half-word right) with HL (half-word left) zeroed.
+ *
+ * @param {number} op
+ * @param {number} dst (36-bit value whose 18-bit right half is either preserved or modified)
+ * @param {number} src (36-bit value used to determine the sign extension, if any, for the right half of dst)
+ * @return {number} (updated dst)
+ */
+PDP10.GETHR = function(op, dst, src)
+{
+    switch(op & 0o600) {
+    case 0o000:
+        dst = (dst & PDP10.HALF_MASK);
+        break;
+    case 0o200:
+        dst = 0;
+        break;
+    case 0o400:
+        dst = PDP10.HALF_MASK;
+        break;
+    case 0o600:
+        dst = (src > PDP10.INT_MASK? PDP10.HALF_MASK : 0);
+        break;
+    }
+    return dst;
+};
+
+/**
+ * SETHR(op, dst, src)
+ *
+ * Used by callers to obtain HR (half-word right) with HL (half-word left) preserved.
+ *
+ * @param {number} op
+ * @param {number} dst (36-bit value whose 18-bit right half is either preserved or modified)
+ * @param {number} src (36-bit value used to determine the sign extension, if any, for the right half of dst)
+ * @return {number} (updated dst)
+ */
+PDP10.SETHR = function(op, dst, src)
+{
+    if (op &= 0o600) {
+        dst -= (dst & PDP10.HALF_MASK);
+        switch(op) {
+        case 0o400:
+            dst += PDP10.HALF_MASK;
+            break;
+        case 0o600:
+            dst += (src > PDP10.INT_MASK? PDP10.HALF_MASK : 0);
+            break;
+        }
+    }
+    return dst;
+};
+
+/**
+ * ADDD(dDst, dSrc)
+ *
+ * Adds a double-length value (dSrc) to another (dDst).
+ *
+ * @param {Array.<number>} dDst
+ * @param {Array.<number>} dSrc
+ */
+PDP10.ADDD = function(dDst, dSrc)
+{
+    dDst[0] += dSrc[0];
+    dDst[1] += dSrc[1];
+    if (dDst[0] >= PDP10.WORD_LIMIT) {
+        dDst[0] %= PDP10.WORD_LIMIT;
+        dDst[1]++;
+    }
+};
+
+/**
+ * CMPD(dDst, dSrc)
+ *
+ * Compares double-length values (dDst and dSrc) by computing dDst - dSrc.
+ *
+ * @param {Array.<number>} dDst
+ * @param {Array.<number>} dSrc
+ * @return {number} > 0 if dDst > dSrc, == 0 if dDst == dSrc, < 0 if dDst < dSrc
+ */
+PDP10.CMPD = function(dDst, dSrc)
+{
+    var result = dDst[1] - dSrc[1];
+    if (!result) result = dDst[0] - dSrc[0];
+    return result;
+};
+
+/**
+ * INITD(dDst, lo, hi)
+ *
+ * Initializes a double-length value (dDst).
+ *
+ * @param {Array.<number>} dDst
+ * @param {number} lo
+ * @param {number} hi
+ */
+PDP10.INITD = function(dDst, lo, hi)
+{
+    dDst[0] = lo;
+    dDst[1] = hi;
+};
+
+/**
+ * SHRD(dDst)
+ *
+ * Shifts a double-length value (dDst) right one bit.
+ *
+ * @param {Array.<number>} dDst
+ */
+PDP10.SHRD = function(dDst)
+{
+    if (dDst[1] % 2) {
+        dDst[0] += PDP10.WORD_LIMIT;
+    }
+    dDst[0] = Math.trunc(dDst[0] / 2);
+    dDst[1] = Math.trunc(dDst[1] / 2);
+};
+
+/**
+ * SUBD(dDst, dSrc)
+ *
+ * Subtracts a double-length value (dSrc) from another (dDst).
+ *
+ * @param {Array.<number>} dDst
+ * @param {Array.<number>} dSrc
+ */
+PDP10.SUBD = function(dDst, dSrc)
+{
+    dDst[0] -= dSrc[0];
+    dDst[1] -= dSrc[1];
+    if (dDst[0] < 0) {
+        dDst[0] += PDP10.WORD_LIMIT;
+        dDst[1]--;
+    }
+};
+
+/**
+ * ZEROD(d)
+ *
+ * True if all bits in the double-length value (d) are zero, false otherwise.
+ *
+ * @param {Array.<number>} d
+ * @return {boolean}
+ */
+PDP10.ZEROD = function(d)
+{
+    return !d[0] && !d[1];
+};
+
+/*
+ * If we want the basic half-word operations to handle all the sub-operations; ie:
+ *
+ *      None
+ *      Zero-extend
+ *      One-extend
+ *      Sign-extend
+ *
+ * then we need to alias all the sub-functions to the corresponding primary functions.
+ */
+PDP10.opHLLZ    = PDP10.opHLL;
+PDP10.opHLLZI   = PDP10.opHLLI;
+PDP10.opHLLZM   = PDP10.opHLLM;
+PDP10.opHLLZS   = PDP10.opHLLS;
+PDP10.opHLLO    = PDP10.opHLL;
+PDP10.opHLLOI   = PDP10.opHLLI;
+PDP10.opHLLOM   = PDP10.opHLLM;
+PDP10.opHLLOS   = PDP10.opHLLS;
+PDP10.opHLLE    = PDP10.opHLL;
+PDP10.opHLLEI   = PDP10.opHLLI;
+PDP10.opHLLEM   = PDP10.opHLLM;
+PDP10.opHLLES   = PDP10.opHLLS;
+PDP10.opHRLZ    = PDP10.opHRL;
+PDP10.opHRLZI   = PDP10.opHRLI;
+PDP10.opHRLZM   = PDP10.opHRLM;
+PDP10.opHRLZS   = PDP10.opHRLS;
+PDP10.opHRLO    = PDP10.opHRL;
+PDP10.opHRLOI   = PDP10.opHRLI;
+PDP10.opHRLOM   = PDP10.opHRLM;
+PDP10.opHRLOS   = PDP10.opHRLS;
+PDP10.opHRLE    = PDP10.opHRL;
+PDP10.opHRLEI   = PDP10.opHRLI;
+PDP10.opHRLEM   = PDP10.opHRLM;
+PDP10.opHRLES   = PDP10.opHRLS;
+PDP10.opHRRZ    = PDP10.opHRR;
+PDP10.opHRRZI   = PDP10.opHRRI;
+PDP10.opHRRZM   = PDP10.opHRRM;
+PDP10.opHRRZS   = PDP10.opHRRS;
+PDP10.opHRRO    = PDP10.opHRR;
+PDP10.opHRROI   = PDP10.opHRRI;
+PDP10.opHRROM   = PDP10.opHRRM;
+PDP10.opHRROS   = PDP10.opHRRS;
+PDP10.opHRRE    = PDP10.opHRR;
+PDP10.opHRREI   = PDP10.opHRRI;
+PDP10.opHRREM   = PDP10.opHRRM;
+PDP10.opHRRES   = PDP10.opHRRS;
+PDP10.opHLRZ    = PDP10.opHLR;
+PDP10.opHLRZI   = PDP10.opHLRI;
+PDP10.opHLRZM   = PDP10.opHLRM;
+PDP10.opHLRZS   = PDP10.opHLRS;
+PDP10.opHLRO    = PDP10.opHLR;
+PDP10.opHLROI   = PDP10.opHLRI;
+PDP10.opHLROM   = PDP10.opHLRM;
+PDP10.opHLROS   = PDP10.opHLRS;
+PDP10.opHLRE    = PDP10.opHLR;
+PDP10.opHLREI   = PDP10.opHLRI;
+PDP10.opHLREM   = PDP10.opHLRM;
+PDP10.opHLRES   = PDP10.opHLRS;
+
+PDP10.opSETZI   = PDP10.opSETZ;
+PDP10.opSETOI   = PDP10.opSETO;
+PDP10.opSETCAI  = PDP10.opSETCA;
+PDP10.opSETA    = PDP10.opNOP;
+PDP10.opSETAI   = PDP10.opNOP;
+PDP10.opSETAM   = PDP10.opMOVEM;
+PDP10.opSETAB   = PDP10.opMOVEM;
+PDP10.opSETM    = PDP10.opMOVE;
+PDP10.opSETMI   = PDP10.opMOVEI;
+PDP10.opSETMM   = PDP10.opNOPM;
+PDP10.opSETMB   = PDP10.opMOVE;
+PDP10.opCAI     = PDP10.opNOP;
+PDP10.opCAM     = PDP10.opNOPM;
+PDP10.opJUMP    = PDP10.opNOP;
+PDP10.opTRN     = PDP10.opNOP;
+PDP10.opTLN     = PDP10.opNOP;
+PDP10.opTDN     = PDP10.opNOPM;
+PDP10.opTSN     = PDP10.opNOPM;
+
+PDP10.aOpXXX_KA10 = [
+    PDP10.opUUO,                // 0o000xxx
+    PDP10.opUUO,                // 0o001xxx
+    PDP10.opUUO,                // 0o002xxx
+    PDP10.opUUO,                // 0o003xxx
+    PDP10.opUUO,                // 0o004xxx
+    PDP10.opUUO,                // 0o005xxx
+    PDP10.opUUO,                // 0o006xxx
+    PDP10.opUUO,                // 0o007xxx
+    PDP10.opUUO,                // 0o010xxx
+    PDP10.opUUO,                // 0o011xxx
+    PDP10.opUUO,                // 0o012xxx
+    PDP10.opUUO,                // 0o013xxx
+    PDP10.opUUO,                // 0o014xxx
+    PDP10.opUUO,                // 0o015xxx
+    PDP10.opUUO,                // 0o016xxx
+    PDP10.opUUO,                // 0o017xxx
+    PDP10.opUUO,                // 0o020xxx
+    PDP10.opUUO,                // 0o021xxx
+    PDP10.opUUO,                // 0o022xxx
+    PDP10.opUUO,                // 0o023xxx
+    PDP10.opUUO,                // 0o024xxx
+    PDP10.opUUO,                // 0o025xxx
+    PDP10.opUUO,                // 0o026xxx
+    PDP10.opUUO,                // 0o027xxx
+    PDP10.opUUO,                // 0o030xxx
+    PDP10.opUUO,                // 0o031xxx
+    PDP10.opUUO,                // 0o032xxx
+    PDP10.opUUO,                // 0o033xxx
+    PDP10.opUUO,                // 0o034xxx
+    PDP10.opUUO,                // 0o035xxx
+    PDP10.opUUO,                // 0o036xxx
+    PDP10.opUUO,                // 0o037xxx
+    PDP10.opUUO,                // 0o040xxx
+    PDP10.opUUO,                // 0o041xxx
+    PDP10.opUUO,                // 0o042xxx
+    PDP10.opUUO,                // 0o043xxx
+    PDP10.opUUO,                // 0o044xxx
+    PDP10.opUUO,                // 0o045xxx
+    PDP10.opUUO,                // 0o046xxx
+    PDP10.opUUO,                // 0o047xxx
+    PDP10.opUUO,                // 0o050xxx
+    PDP10.opUUO,                // 0o051xxx
+    PDP10.opUUO,                // 0o052xxx
+    PDP10.opUUO,                // 0o053xxx
+    PDP10.opUUO,                // 0o054xxx
+    PDP10.opUUO,                // 0o055xxx
+    PDP10.opUUO,                // 0o056xxx
+    PDP10.opUUO,                // 0o057xxx
+    PDP10.opUUO,                // 0o060xxx
+    PDP10.opUUO,                // 0o061xxx
+    PDP10.opUUO,                // 0o062xxx
+    PDP10.opUUO,                // 0o063xxx
+    PDP10.opUUO,                // 0o064xxx
+    PDP10.opUUO,                // 0o065xxx
+    PDP10.opUUO,                // 0o066xxx
+    PDP10.opUUO,                // 0o067xxx
+    PDP10.opUUO,                // 0o070xxx
+    PDP10.opUUO,                // 0o071xxx
+    PDP10.opUUO,                // 0o072xxx
+    PDP10.opUUO,                // 0o073xxx
+    PDP10.opUUO,                // 0o074xxx
+    PDP10.opUUO,                // 0o075xxx
+    PDP10.opUUO,                // 0o076xxx
+    PDP10.opUUO,                // 0o077xxx
+    PDP10.opUndefined,          // 0o100xxx
+    PDP10.opUndefined,          // 0o101xxx
+    PDP10.opUndefined,          // 0o102xxx
+    PDP10.opUndefined,          // 0o103xxx
+    PDP10.opUndefined,          // 0o104xxx
+    PDP10.opUndefined,          // 0o105xxx
+    PDP10.opUndefined,          // 0o106xxx
+    PDP10.opUndefined,          // 0o107xxx
+    PDP10.opUndefined,          // 0o110xxx
+    PDP10.opUndefined,          // 0o111xxx
+    PDP10.opUndefined,          // 0o112xxx
+    PDP10.opUndefined,          // 0o113xxx
+    PDP10.opUndefined,          // 0o114xxx
+    PDP10.opUndefined,          // 0o115xxx
+    PDP10.opUndefined,          // 0o116xxx
+    PDP10.opUndefined,          // 0o117xxx
+    PDP10.opUndefined,          // 0o120xxx
+    PDP10.opUndefined,          // 0o121xxx
+    PDP10.opUndefined,          // 0o122xxx
+    PDP10.opUndefined,          // 0o123xxx
+    PDP10.opUndefined,          // 0o124xxx
+    PDP10.opUndefined,          // 0o125xxx
+    PDP10.opUndefined,          // 0o126xxx
+    PDP10.opUndefined,          // 0o127xxx
+    PDP10.opUFA,                // 0o130xxx
+    PDP10.opDFN,                // 0o131xxx
+    PDP10.opFSC,                // 0o132xxx
+    PDP10.opIBP,                // 0o133xxx
+    PDP10.opILDB,               // 0o134xxx
+    PDP10.opLDB,                // 0o135xxx
+    PDP10.opIDPB,               // 0o136xxx
+    PDP10.opDPB,                // 0o137xxx
+    PDP10.opFAD,                // 0o140xxx
+    PDP10.opFADI,               // 0o141xxx
+    PDP10.opFADM,               // 0o142xxx
+    PDP10.opFADB,               // 0o143xxx
+    PDP10.opFADR,               // 0o144xxx
+    PDP10.opFADRI,              // 0o145xxx
+    PDP10.opFADRM,              // 0o146xxx
+    PDP10.opFADRB,              // 0o147xxx
+    PDP10.opFSB,                // 0o150xxx
+    PDP10.opFSBI,               // 0o151xxx
+    PDP10.opFSBM,               // 0o152xxx
+    PDP10.opFSBB,               // 0o153xxx
+    PDP10.opFSBR,               // 0o154xxx
+    PDP10.opFSBRI,              // 0o155xxx
+    PDP10.opFSBRM,              // 0o156xxx
+    PDP10.opFSBRB,              // 0o157xxx
+    PDP10.opFMP,                // 0o160xxx
+    PDP10.opFMPI,               // 0o161xxx
+    PDP10.opFMPM,               // 0o162xxx
+    PDP10.opFMPB,               // 0o163xxx
+    PDP10.opFMPR,               // 0o164xxx
+    PDP10.opFMPRI,              // 0o165xxx
+    PDP10.opFMPRM,              // 0o166xxx
+    PDP10.opFMPRB,              // 0o167xxx
+    PDP10.opFDV,                // 0o170xxx
+    PDP10.opFDVI,               // 0o171xxx
+    PDP10.opFDVM,               // 0o172xxx
+    PDP10.opFDVB,               // 0o173xxx
+    PDP10.opFDVR,               // 0o174xxx
+    PDP10.opFDVRI,              // 0o175xxx
+    PDP10.opFDVRM,              // 0o176xxx
+    PDP10.opFDVRB,              // 0o177xxx
+    PDP10.opMOVE,               // 0o200xxx
+    PDP10.opMOVEI,              // 0o201xxx
+    PDP10.opMOVEM,              // 0o202xxx
+    PDP10.opMOVES,              // 0o203xxx
+    PDP10.opMOVS,               // 0o204xxx
+    PDP10.opMOVSI,              // 0o205xxx
+    PDP10.opMOVSM,              // 0o206xxx
+    PDP10.opMOVSS,              // 0o207xxx
+    PDP10.opMOVN,               // 0o210xxx
+    PDP10.opMOVNI,              // 0o211xxx
+    PDP10.opMOVNM,              // 0o212xxx
+    PDP10.opMOVNS,              // 0o213xxx
+    PDP10.opMOVM,               // 0o214xxx
+    PDP10.opMOVMI,              // 0o215xxx
+    PDP10.opMOVMM,              // 0o216xxx
+    PDP10.opMOVMS,              // 0o217xxx
+    PDP10.opIMUL,               // 0o220xxx
+    PDP10.opIMULI,              // 0o221xxx
+    PDP10.opIMULM,              // 0o222xxx
+    PDP10.opIMULB,              // 0o223xxx
+    PDP10.opMUL,                // 0o224xxx
+    PDP10.opMULI,               // 0o225xxx
+    PDP10.opMULM,               // 0o226xxx
+    PDP10.opMULB,               // 0o227xxx
+    PDP10.opIDIV,               // 0o230xxx
+    PDP10.opIDIVI,              // 0o231xxx
+    PDP10.opIDIVM,              // 0o232xxx
+    PDP10.opIDIVB,              // 0o233xxx
+    PDP10.opDIV,                // 0o234xxx
+    PDP10.opDIVI,               // 0o235xxx
+    PDP10.opDIVM,               // 0o236xxx
+    PDP10.opDIVB,               // 0o237xxx
+    PDP10.opASH,                // 0o240xxx
+    PDP10.opROT,                // 0o241xxx
+    PDP10.opLSH,                // 0o242xxx
+    PDP10.opJFFO,               // 0o243xxx
+    PDP10.opASHC,               // 0o244xxx
+    PDP10.opROTC,               // 0o245xxx
+    PDP10.opLSHC,               // 0o246xxx
+    PDP10.opUndefined,          // 0o247xxx
+    PDP10.opEXCH,               // 0o250xxx
+    PDP10.opBLT,                // 0o251xxx
+    PDP10.opAOBJP,              // 0o252xxx
+    PDP10.opAOBJN,              // 0o253xxx
+    PDP10.opJRST,               // 0o254xxx
+    PDP10.opJFCL,               // 0o255xxx
+    PDP10.opXCT,                // 0o256xxx
+    PDP10.opUndefined,          // 0o257xxx
+    PDP10.opPUSHJ,              // 0o260xxx
+    PDP10.opPUSH,               // 0o261xxx
+    PDP10.opPOP,                // 0o262xxx
+    PDP10.opPOPJ,               // 0o263xxx
+    PDP10.opJSR,                // 0o264xxx
+    PDP10.opJSP,                // 0o265xxx
+    PDP10.opJSA,                // 0o266xxx
+    PDP10.opJRA,                // 0o267xxx
+    PDP10.opADD,                // 0o270xxx
+    PDP10.opADDI,               // 0o271xxx
+    PDP10.opADDM,               // 0o272xxx
+    PDP10.opADDB,               // 0o273xxx
+    PDP10.opSUB,                // 0o274xxx
+    PDP10.opSUBI,               // 0o275xxx
+    PDP10.opSUBM,               // 0o276xxx
+    PDP10.opSUBB,               // 0o277xxx
+    PDP10.opCAI,                // 0o300xxx
+    PDP10.opCAIL,               // 0o301xxx
+    PDP10.opCAIE,               // 0o302xxx
+    PDP10.opCAILE,              // 0o303xxx
+    PDP10.opCAIA,               // 0o304xxx
+    PDP10.opCAIGE,              // 0o305xxx
+    PDP10.opCAIN,               // 0o306xxx
+    PDP10.opCAIG,               // 0o307xxx
+    PDP10.opCAM,                // 0o310xxx
+    PDP10.opCAML,               // 0o311xxx
+    PDP10.opCAME,               // 0o312xxx
+    PDP10.opCAMLE,              // 0o313xxx
+    PDP10.opCAMA,               // 0o314xxx
+    PDP10.opCAMGE,              // 0o315xxx
+    PDP10.opCAMN,               // 0o316xxx
+    PDP10.opCAMG,               // 0o317xxx
+    PDP10.opJUMP,               // 0o320xxx
+    PDP10.opJUMPL,              // 0o321xxx
+    PDP10.opJUMPE,              // 0o322xxx
+    PDP10.opJUMPLE,             // 0o323xxx
+    PDP10.opJUMPA,              // 0o324xxx
+    PDP10.opJUMPGE,             // 0o325xxx
+    PDP10.opJUMPN,              // 0o326xxx
+    PDP10.opJUMPG,              // 0o327xxx
+    PDP10.opSKIP,               // 0o330xxx
+    PDP10.opSKIPL,              // 0o331xxx
+    PDP10.opSKIPE,              // 0o332xxx
+    PDP10.opSKIPLE,             // 0o333xxx
+    PDP10.opSKIPA,              // 0o334xxx
+    PDP10.opSKIPGE,             // 0o335xxx
+    PDP10.opSKIPN,              // 0o336xxx
+    PDP10.opSKIPG,              // 0o337xxx
+    PDP10.opAOJ,                // 0o340xxx
+    PDP10.opAOJL,               // 0o341xxx
+    PDP10.opAOJE,               // 0o342xxx
+    PDP10.opAOJLE,              // 0o343xxx
+    PDP10.opAOJA,               // 0o344xxx
+    PDP10.opAOJGE,              // 0o345xxx
+    PDP10.opAOJN,               // 0o346xxx
+    PDP10.opAOJG,               // 0o347xxx
+    PDP10.opAOS,                // 0o350xxx
+    PDP10.opAOSL,               // 0o351xxx
+    PDP10.opAOSE,               // 0o352xxx
+    PDP10.opAOSLE,              // 0o353xxx
+    PDP10.opAOSA,               // 0o354xxx
+    PDP10.opAOSGE,              // 0o355xxx
+    PDP10.opAOSN,               // 0o356xxx
+    PDP10.opAOSG,               // 0o357xxx
+    PDP10.opSOJ,                // 0o360xxx
+    PDP10.opSOJL,               // 0o361xxx
+    PDP10.opSOJE,               // 0o362xxx
+    PDP10.opSOJLE,              // 0o363xxx
+    PDP10.opSOJA,               // 0o364xxx
+    PDP10.opSOJGE,              // 0o365xxx
+    PDP10.opSOJN,               // 0o366xxx
+    PDP10.opSOJG,               // 0o367xxx
+    PDP10.opSOS,                // 0o370xxx
+    PDP10.opSOSL,               // 0o371xxx
+    PDP10.opSOSE,               // 0o372xxx
+    PDP10.opSOSLE,              // 0o373xxx
+    PDP10.opSOSA,               // 0o374xxx
+    PDP10.opSOSGE,              // 0o375xxx
+    PDP10.opSOSN,               // 0o376xxx
+    PDP10.opSOSG,               // 0o377xxx
+    PDP10.opSETZ,               // 0o400xxx
+    PDP10.opSETZI,              // 0o401xxx
+    PDP10.opSETZM,              // 0o402xxx
+    PDP10.opSETZB,              // 0o403xxx
+    PDP10.opAND,                // 0o404xxx
+    PDP10.opANDI,               // 0o405xxx
+    PDP10.opANDM,               // 0o406xxx
+    PDP10.opANDB,               // 0o407xxx
+    PDP10.opANDCA,              // 0o410xxx
+    PDP10.opANDCAI,             // 0o411xxx
+    PDP10.opANDCAM,             // 0o412xxx
+    PDP10.opANDCAB,             // 0o413xxx
+    PDP10.opSETM,               // 0o414xxx
+    PDP10.opSETMI,              // 0o415xxx
+    PDP10.opSETMM,              // 0o416xxx
+    PDP10.opSETMB,              // 0o417xxx
+    PDP10.opANDCM,              // 0o420xxx
+    PDP10.opANDCMI,             // 0o421xxx
+    PDP10.opANDCMM,             // 0o422xxx
+    PDP10.opANDCMB,             // 0o423xxx
+    PDP10.opSETA,               // 0o424xxx
+    PDP10.opSETAI,              // 0o425xxx
+    PDP10.opSETAM,              // 0o426xxx
+    PDP10.opSETAB,              // 0o427xxx
+    PDP10.opXOR,                // 0o430xxx
+    PDP10.opXORI,               // 0o431xxx
+    PDP10.opXORM,               // 0o432xxx
+    PDP10.opXORB,               // 0o433xxx
+    PDP10.opIOR,                // 0o434xxx
+    PDP10.opIORI,               // 0o435xxx
+    PDP10.opIORM,               // 0o436xxx
+    PDP10.opIORB,               // 0o437xxx
+    PDP10.opANDCB,              // 0o440xxx
+    PDP10.opANDCBI,             // 0o441xxx
+    PDP10.opANDCBM,             // 0o442xxx
+    PDP10.opANDCBB,             // 0o443xxx
+    PDP10.opEQV,                // 0o444xxx
+    PDP10.opEQVI,               // 0o445xxx
+    PDP10.opEQVM,               // 0o446xxx
+    PDP10.opEQVB,               // 0o447xxx
+    PDP10.opSETCA,              // 0o450xxx
+    PDP10.opSETCAI,             // 0o451xxx
+    PDP10.opSETCAM,             // 0o452xxx
+    PDP10.opSETCAB,             // 0o453xxx
+    PDP10.opORCA,               // 0o454xxx
+    PDP10.opORCAI,              // 0o455xxx
+    PDP10.opORCAM,              // 0o456xxx
+    PDP10.opORCAB,              // 0o457xxx
+    PDP10.opSETCM,              // 0o460xxx
+    PDP10.opSETCMI,             // 0o461xxx
+    PDP10.opSETCMM,             // 0o462xxx
+    PDP10.opSETCMB,             // 0o463xxx
+    PDP10.opORCM,               // 0o464xxx
+    PDP10.opORCMI,              // 0o465xxx
+    PDP10.opORCMM,              // 0o466xxx
+    PDP10.opORCMB,              // 0o467xxx
+    PDP10.opORCB,               // 0o470xxx
+    PDP10.opORCBI,              // 0o471xxx
+    PDP10.opORCBM,              // 0o472xxx
+    PDP10.opORCBB,              // 0o473xxx
+    PDP10.opSETO,               // 0o474xxx
+    PDP10.opSETOI,              // 0o475xxx
+    PDP10.opSETOM,              // 0o476xxx
+    PDP10.opSETOB,              // 0o477xxx
+    PDP10.opHLL,                // 0o500xxx
+    PDP10.opHLLI,               // 0o501xxx
+    PDP10.opHLLM,               // 0o502xxx
+    PDP10.opHLLS,               // 0o503xxx
+    PDP10.opHRL,                // 0o504xxx
+    PDP10.opHRLI,               // 0o505xxx
+    PDP10.opHRLM,               // 0o506xxx
+    PDP10.opHRLS,               // 0o507xxx
+    PDP10.opHLLZ,               // 0o510xxx
+    PDP10.opHLLZI,              // 0o511xxx
+    PDP10.opHLLZM,              // 0o512xxx
+    PDP10.opHLLZS,              // 0o513xxx
+    PDP10.opHRLZ,               // 0o514xxx
+    PDP10.opHRLZI,              // 0o515xxx
+    PDP10.opHRLZM,              // 0o516xxx
+    PDP10.opHRLZS,              // 0o517xxx
+    PDP10.opHLLO,               // 0o520xxx
+    PDP10.opHLLOI,              // 0o521xxx
+    PDP10.opHLLOM,              // 0o522xxx
+    PDP10.opHLLOS,              // 0o523xxx
+    PDP10.opHRLO,               // 0o524xxx
+    PDP10.opHRLOI,              // 0o525xxx
+    PDP10.opHRLOM,              // 0o526xxx
+    PDP10.opHRLOS,              // 0o527xxx
+    PDP10.opHLLE,               // 0o530xxx
+    PDP10.opHLLEI,              // 0o531xxx
+    PDP10.opHLLEM,              // 0o532xxx
+    PDP10.opHLLES,              // 0o533xxx
+    PDP10.opHRLE,               // 0o534xxx
+    PDP10.opHRLEI,              // 0o535xxx
+    PDP10.opHRLEM,              // 0o536xxx
+    PDP10.opHRLES,              // 0o537xxx
+    PDP10.opHRR,                // 0o540xxx
+    PDP10.opHRRI,               // 0o541xxx
+    PDP10.opHRRM,               // 0o542xxx
+    PDP10.opHRRS,               // 0o543xxx
+    PDP10.opHLR,                // 0o544xxx
+    PDP10.opHLRI,               // 0o545xxx
+    PDP10.opHLRM,               // 0o546xxx
+    PDP10.opHLRS,               // 0o547xxx
+    PDP10.opHRRZ,               // 0o550xxx
+    PDP10.opHRRZI,              // 0o551xxx
+    PDP10.opHRRZM,              // 0o552xxx
+    PDP10.opHRRZS,              // 0o553xxx
+    PDP10.opHLRZ,               // 0o554xxx
+    PDP10.opHLRZI,              // 0o555xxx
+    PDP10.opHLRZM,              // 0o556xxx
+    PDP10.opHLRZS,              // 0o557xxx
+    PDP10.opHRRO,               // 0o560xxx
+    PDP10.opHRROI,              // 0o561xxx
+    PDP10.opHRROM,              // 0o562xxx
+    PDP10.opHRROS,              // 0o563xxx
+    PDP10.opHLRO,               // 0o564xxx
+    PDP10.opHLROI,              // 0o565xxx
+    PDP10.opHLROM,              // 0o566xxx
+    PDP10.opHLROS,              // 0o567xxx
+    PDP10.opHRRE,               // 0o570xxx
+    PDP10.opHRREI,              // 0o571xxx
+    PDP10.opHRREM,              // 0o572xxx
+    PDP10.opHRRES,              // 0o573xxx
+    PDP10.opHLRE,               // 0o574xxx
+    PDP10.opHLREI,              // 0o575xxx
+    PDP10.opHLREM,              // 0o576xxx
+    PDP10.opHLRES,              // 0o577xxx
+    PDP10.opTRN,                // 0o600xxx
+    PDP10.opTLN,                // 0o601xxx
+    PDP10.opTRNE,               // 0o602xxx
+    PDP10.opTLNE,               // 0o603xxx
+    PDP10.opTRNA,               // 0o604xxx
+    PDP10.opTLNA,               // 0o605xxx
+    PDP10.opTRNN,               // 0o606xxx
+    PDP10.opTLNN,               // 0o607xxx
+    PDP10.opTDN,                // 0o610xxx
+    PDP10.opTSN,                // 0o611xxx
+    PDP10.opTDNE,               // 0o612xxx
+    PDP10.opTSNE,               // 0o613xxx
+    PDP10.opTDNA,               // 0o614xxx
+    PDP10.opTSNA,               // 0o615xxx
+    PDP10.opTDNN,               // 0o616xxx
+    PDP10.opTSNN,               // 0o617xxx
+    PDP10.opTRZ,                // 0o620xxx
+    PDP10.opTLZ,                // 0o621xxx
+    PDP10.opTRZE,               // 0o622xxx
+    PDP10.opTLZE,               // 0o623xxx
+    PDP10.opTRZA,               // 0o624xxx
+    PDP10.opTLZA,               // 0o625xxx
+    PDP10.opTRZN,               // 0o626xxx
+    PDP10.opTLZN,               // 0o627xxx
+    PDP10.opTDZ,                // 0o630xxx
+    PDP10.opTSZ,                // 0o631xxx
+    PDP10.opTDZE,               // 0o632xxx
+    PDP10.opTSZE,               // 0o633xxx
+    PDP10.opTDZA,               // 0o634xxx
+    PDP10.opTSZA,               // 0o635xxx
+    PDP10.opTDZN,               // 0o636xxx
+    PDP10.opTSZN,               // 0o637xxx
+    PDP10.opTRC,                // 0o640xxx
+    PDP10.opTLC,                // 0o641xxx
+    PDP10.opTRCE,               // 0o642xxx
+    PDP10.opTLCE,               // 0o643xxx
+    PDP10.opTRCA,               // 0o644xxx
+    PDP10.opTLCA,               // 0o645xxx
+    PDP10.opTRCN,               // 0o646xxx
+    PDP10.opTLCN,               // 0o647xxx
+    PDP10.opTDC,                // 0o650xxx
+    PDP10.opTSC,                // 0o651xxx
+    PDP10.opTDCE,               // 0o652xxx
+    PDP10.opTSCE,               // 0o653xxx
+    PDP10.opTDCA,               // 0o654xxx
+    PDP10.opTSCA,               // 0o655xxx
+    PDP10.opTDCN,               // 0o656xxx
+    PDP10.opTSCN,               // 0o657xxx
+    PDP10.opTRO,                // 0o660xxx
+    PDP10.opTLO,                // 0o661xxx
+    PDP10.opTROE,               // 0o662xxx
+    PDP10.opTLOE,               // 0o663xxx
+    PDP10.opTROA,               // 0o664xxx
+    PDP10.opTLOA,               // 0o665xxx
+    PDP10.opTRON,               // 0o666xxx
+    PDP10.opTLON,               // 0o667xxx
+    PDP10.opTDO,                // 0o670xxx
+    PDP10.opTSO,                // 0o671xxx
+    PDP10.opTDOE,               // 0o672xxx
+    PDP10.opTSOE,               // 0o673xxx
+    PDP10.opTDOA,               // 0o674xxx
+    PDP10.opTSOA,               // 0o675xxx
+    PDP10.opTDON,               // 0o676xxx
+    PDP10.opTSON,               // 0o677xxx
+    PDP10.opIO,                 // 0o700xxx
+    PDP10.opIO,                 // 0o701xxx
+    PDP10.opIO,                 // 0o702xxx
+    PDP10.opIO,                 // 0o703xxx
+    PDP10.opIO,                 // 0o704xxx
+    PDP10.opIO,                 // 0o705xxx
+    PDP10.opIO,                 // 0o706xxx
+    PDP10.opIO,                 // 0o707xxx
+    PDP10.opIO,                 // 0o710xxx
+    PDP10.opIO,                 // 0o711xxx
+    PDP10.opIO,                 // 0o712xxx
+    PDP10.opIO,                 // 0o713xxx
+    PDP10.opIO,                 // 0o714xxx
+    PDP10.opIO,                 // 0o715xxx
+    PDP10.opIO,                 // 0o716xxx
+    PDP10.opIO,                 // 0o717xxx
+    PDP10.opIO,                 // 0o720xxx
+    PDP10.opIO,                 // 0o721xxx
+    PDP10.opIO,                 // 0o722xxx
+    PDP10.opIO,                 // 0o723xxx
+    PDP10.opIO,                 // 0o724xxx
+    PDP10.opIO,                 // 0o725xxx
+    PDP10.opIO,                 // 0o726xxx
+    PDP10.opIO,                 // 0o727xxx
+    PDP10.opIO,                 // 0o730xxx
+    PDP10.opIO,                 // 0o731xxx
+    PDP10.opIO,                 // 0o732xxx
+    PDP10.opIO,                 // 0o733xxx
+    PDP10.opIO,                 // 0o734xxx
+    PDP10.opIO,                 // 0o735xxx
+    PDP10.opIO,                 // 0o736xxx
+    PDP10.opIO,                 // 0o737xxx
+    PDP10.opIO,                 // 0o740xxx
+    PDP10.opIO,                 // 0o741xxx
+    PDP10.opIO,                 // 0o742xxx
+    PDP10.opIO,                 // 0o743xxx
+    PDP10.opIO,                 // 0o744xxx
+    PDP10.opIO,                 // 0o745xxx
+    PDP10.opIO,                 // 0o746xxx
+    PDP10.opIO,                 // 0o747xxx
+    PDP10.opIO,                 // 0o750xxx
+    PDP10.opIO,                 // 0o751xxx
+    PDP10.opIO,                 // 0o752xxx
+    PDP10.opIO,                 // 0o753xxx
+    PDP10.opIO,                 // 0o754xxx
+    PDP10.opIO,                 // 0o755xxx
+    PDP10.opIO,                 // 0o756xxx
+    PDP10.opIO,                 // 0o757xxx
+    PDP10.opIO,                 // 0o760xxx
+    PDP10.opIO,                 // 0o761xxx
+    PDP10.opIO,                 // 0o762xxx
+    PDP10.opIO,                 // 0o763xxx
+    PDP10.opIO,                 // 0o764xxx
+    PDP10.opIO,                 // 0o765xxx
+    PDP10.opIO,                 // 0o766xxx
+    PDP10.opIO,                 // 0o767xxx
+    PDP10.opIO,                 // 0o770xxx
+    PDP10.opIO,                 // 0o771xxx
+    PDP10.opIO,                 // 0o772xxx
+    PDP10.opIO,                 // 0o773xxx
+    PDP10.opIO,                 // 0o774xxx
+    PDP10.opIO,                 // 0o775xxx
+    PDP10.opIO,                 // 0o776xxx
+    PDP10.opIO                  // 0o777xxx
+];
+
+PDP10.aOpIO_KA10 = [
+    PDP10.opBLKI,               // 0o70000x
+    PDP10.opDATAI,              // 0o70004x
+    PDP10.opBLKO,               // 0o70010x
+    PDP10.opDATAO,              // 0o70014x
+    PDP10.opCONO,               // 0o70020x
+    PDP10.opCONI,               // 0o70024x
+    PDP10.opCONSZ,              // 0o70030x
+    PDP10.opCONSO               // 0o70034x
+];
+
+/**
+ * @copyright http://pcjs.org/modules/pdp10/lib/rom.js (C) Jeff Parsons 2012-2017
+ */
+
+
+class ROMPDP10 extends Component {
+    /**
+     * ROMPDP10(parmsROM)
+     *
+     * The ROMPDP10 component expects the following (parmsROM) properties:
+     *
+     *      addr: physical address of ROM
+     *      size: amount of ROM, in bytes
+     *      alias: physical alias address (null if none)
+     *      file: name of ROM data file
+     *
+     * NOTE: The ROM data will not be copied into place until the Bus is ready (see initBus()) AND
+     * the ROM data file has finished loading (see finishLoad()).
+     *
+     * Also, while the size parameter may seem redundant, I consider it useful to confirm that the ROM
+     * you received is the ROM you expected.
+     *
+     * @param {Object} parmsROM
+     */
+    constructor(parmsROM)
+    {
+        super("ROM", parmsROM, MessagesPDP10.ROM);
+
+        this.abInit = null;
+        this.aSymbols = null;
+
+        this.addrROM = +parmsROM['addr'];
+        this.sizeROM = +parmsROM['size'];
+        this.fRetainROM = false;
+
+        /*
+         * The new 'alias' property can now be EITHER a single physical address (like 'addr') OR an array of
+         * physical addresses; eg:
+         *
+         *      [0xf0000,0xffff0000,0xffff8000]
+         *
+         * We could have overloaded 'addr' to accomplish the same thing, but I think it's better to have any
+         * aliased locations listed under a separate property.
+         *
+         * Most ROMs are not aliased, in which case the 'alias' property should have the default value of null.
+         */
+        this.addrAlias = parmsROM['alias'];
+        if (typeof this.addrAlias == "string") {
+            this.addrAlias = eval(this.addrAlias);
+        }
+
+        this.sFilePath = parmsROM['file'];
+        this.sFileName = Str.getBaseName(this.sFilePath);
+
+        if (this.sFilePath) {
+            var sFileURL = this.sFilePath;
+            if (DEBUG) this.log('load("' + sFileURL + '")');
+            /*
+             * If the selected ROM file has a ".json" extension, then we assume it's pre-converted
+             * JSON-encoded ROM data, so we load it as-is; ditto for ROM files with a ".hex" extension.
+             * Otherwise, we ask our server-side ROM converter to return the file in a JSON-compatible format.
+             */
+            var sFileExt = Str.getExtension(this.sFileName);
+            if (sFileExt != DumpAPI.FORMAT.JSON && sFileExt != DumpAPI.FORMAT.HEX) {
+                sFileURL = Web.getHost() + DumpAPI.ENDPOINT + '?' + DumpAPI.QUERY.FILE + '=' + this.sFilePath + '&' + DumpAPI.QUERY.FORMAT + '=' + DumpAPI.FORMAT.BYTES + '&' + DumpAPI.QUERY.DECIMAL + '=true';
+            }
+            var rom = this;
+            Web.getResource(sFileURL, null, true, function doneLoad(sURL, sResponse, nErrorCode) {
+                rom.finishLoad(sURL, sResponse, nErrorCode);
+            });
+        }
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {ROMPDP10}
+     * @param {ComputerPDP10} cmp
+     * @param {BusPDP10} bus
+     * @param {CPUStatePDP10} cpu
+     * @param {DebuggerPDP10} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+        this.initROM();
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {ROMPDP10}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (this.aSymbols) {
+            if (this.dbg) {
+                this.dbg.addSymbols(this.id, this.addrROM, this.sizeROM, this.aSymbols);
+            }
+            /*
+             * Our only role in the handling of symbols is to hand them off to the Debugger at our
+             * first opportunity. Now that we've done that, our copy of the symbols, if any, are toast.
+             */
+            delete this.aSymbols;
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * Since we have nothing to do on powerDown(), and no state to return, we could simply omit
+     * this function.  But it doesn't hurt anything, and maybe we'll use our state to save something
+     * useful down the road, like user-defined symbols (ie, symbols that the Debugger may have
+     * created, above and beyond those symbols we automatically loaded, if any, along with the ROM).
+     *
+     * @this {ROMPDP10}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return true;
+    }
+
+    /**
+     * finishLoad(sURL, sData, nErrorCode)
+     *
+     * @this {ROMPDP10}
+     * @param {string} sURL
+     * @param {string} sData
+     * @param {number} nErrorCode (response from server if anything other than 200)
+     */
+    finishLoad(sURL, sData, nErrorCode)
+    {
+        if (nErrorCode) {
+            this.notice("Unable to load ROM resource (error " + nErrorCode + ": " + sURL + ")");
+            this.sFilePath = null;
+        }
+        else {
+            Component.addMachineResource(this.idMachine, sURL, sData);
+            var resource = Web.parseMemoryResource(sURL, sData);
+            if (resource) {
+                this.abInit = resource.aBytes;
+                this.aSymbols = resource.aSymbols;
+            } else {
+                this.sFilePath = null;
+            }
+        }
+        this.initROM();
+    }
+
+    /**
+     * initROM()
+     *
+     * This function is called by both initBus() and finishLoad(), but it cannot copy the initial data into place
+     * until after initBus() has received the Bus component AND finishLoad() has received the data.  When both those
+     * criteria are satisfied, the component becomes "ready".
+     *
+     * @this {ROMPDP10}
+     */
+    initROM()
+    {
+        if (!this.isReady()) {
+            if (this.sFilePath) {
+                /*
+                 * Too early...
+                 */
+                if (!this.abInit || !this.bus) return;
+
+                /*
+                 * If no explicit size was specified, then use whatever the actual size is.
+                 */
+                if (!this.sizeROM) {
+                    this.sizeROM = this.abInit.length;
+                }
+                if (this.abInit.length != this.sizeROM) {
+                    /*
+                     * Note that setError() sets the component's fError flag, which in turn prevents setReady() from
+                     * marking the component ready.  TODO: Revisit this decision.  On the one hand, it sounds like a
+                     * good idea to stop the machine in its tracks whenever a setError() occurs, but there may also be
+                     * times when we'd like to forge ahead anyway.
+                     */
+                    this.setError("ROM size (" + Str.toHexLong(this.abInit.length) + ") does not match specified size (" + Str.toHexLong(this.sizeROM) + ")");
+                }
+                else if (this.addROM(this.addrROM)) {
+
+                    var aliases = [];
+                    if (typeof this.addrAlias == "number") {
+                        aliases.push(this.addrAlias);
+                    } else if (this.addrAlias != null && this.addrAlias.length) {
+                        aliases = this.addrAlias;
+                    }
+                    for (var i = 0; i < aliases.length; i++) {
+                        this.cloneROM(aliases[i]);
+                    }
+                    /*
+                     * We used to hang onto the initial ROM data so that we could restore any bytes the CPU overwrote,
+                     * using memory write-notification handlers, but with the introduction of read-only memory blocks, that's
+                     * no longer necessary.
+                     *
+                     * TODO: Consider an option to retain the ROM data, and give the user some way of restoring ROMs.
+                     * That may be useful for "resumable" machines that save/restore all dirty block of memory, regardless
+                     * whether they're ROM or RAM.  However, the only way to modify a machine's ROM is with the Debugger,
+                     * and Debugger users should know better.
+                     */
+                    if (!this.fRetainROM) {
+                        delete this.abInit;
+                    }
+                }
+            }
+            this.setReady();
+        }
+    }
+
+    /**
+     * addROM(addr)
+     *
+     * @this {ROMPDP10}
+     * @param {number} addr
+     * @return {boolean}
+     */
+    addROM(addr)
+    {
+        if (this.bus.addMemory(addr, this.sizeROM, MemoryPDP10.TYPE.ROM)) {
+            if (DEBUG) this.log("addROM(): copying ROM to " + Str.toHexLong(addr) + " (" + Str.toHexLong(this.abInit.length) + " bytes)");
+            var i;
+            for (i = 0; i < this.abInit.length; i++) {
+                this.bus.setWordDirect(addr + i, this.abInit[i]);
+            }
+            return true;
+        }
+
+        /*
+         * We don't need to report an error here, because addMemory() already takes care of that.
+         */
+        return false;
+    }
+
+    /**
+     * cloneROM(addr)
+     *
+     * For ROMs with one or more alias addresses, we used to call addROM() for each address.  However,
+     * that obviously wasted memory, since each alias was an independent copy, and if you used the
+     * Debugger to edit the ROM in one location, the changes would not appear in the other location(s).
+     *
+     * Now that the Bus component provides low-level getMemoryBlocks() and setMemoryBlocks() methods
+     * to manually get and set the blocks of any memory range, it is now possible to create true aliases.
+     *
+     * @this {ROMPDP10}
+     * @param {number} addr
+     */
+    cloneROM(addr)
+    {
+        var aBlocks = this.bus.getMemoryBlocks(this.addrROM, this.sizeROM);
+        this.bus.setMemoryBlocks(addr, this.sizeROM, aBlocks);
+    }
+
+    /**
+     * ROMPDP10.init()
+     *
+     * This function operates on every HTML element of class "rom", extracting the
+     * JSON-encoded parameters for the ROMPDP10 constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a ROMPDP10 component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeROM = Component.getElementsByClass(document, PDP10.APPCLASS, "rom");
+        for (var iROM = 0; iROM < aeROM.length; iROM++) {
+            var eROM = aeROM[iROM];
+            var parmsROM = Component.getComponentParms(eROM);
+            var rom = new ROMPDP10(parmsROM);
+            Component.bindComponentControls(rom, eROM, PDP10.APPCLASS);
+        }
+    }
+}
+
+/*
+ * NOTE: There's currently no need for this component to have a reset() function, since
+ * once the ROM data is loaded, it can't be changed, so there's nothing to reinitialize.
+ *
+ * OK, well, I take that back, because the Debugger, if installed, has the ability to modify
+ * ROM contents, so in that case, having a reset() function that restores the original ROM data
+ * might be useful; then again, it might not, depending on what you're trying to debug.
+ *
+ * If we do add reset(), then we'll want to change initROM() to hang onto the original
+ * ROM data; currently, we release it after copying it into the read-only memory allocated
+ * via bus.addMemory().
+ */
+
+/*
+ * Initialize all the ROMPDP10 modules on the page.
+ */
+Web.onInit(ROMPDP10.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp10/lib/ram.js (C) Jeff Parsons 2012-2017
+ */
+
+
+class RAMPDP10 extends Component {
+    /**
+     * RAMPDP10(parmsRAM)
+     *
+     * The RAMPDP10 component expects the following (parmsRAM) properties:
+     *
+     *      addr: starting physical address of RAM (default is 0)
+     *      size: amount of RAM, in bytes (default is 0, which means defer to motherboard switch settings)
+     *      file: name of optional data file to load into RAM (default is "")
+     *      load: optional file load address (overrides any load address specified in the data file; default is null)
+     *      exec: optional file exec address (overrides any exec address specified in the data file; default is null)
+     *
+     * NOTE: We make a note of the specified size, but no memory is initially allocated for the RAM until the
+     * Computer component calls powerUp().
+     *
+     * @param {Object} parmsRAM
+     */
+    constructor(parmsRAM)
+    {
+        super("RAM", parmsRAM);
+
+        this.aData = null;
+        this.aSymbols = null;
+
+        this.addrRAM = +parmsRAM['addr'];
+        this.sizeRAM = +parmsRAM['size'];
+
+        this.addrLoad = parmsRAM['load'];
+        this.addrExec = parmsRAM['exec'];
+        if (this.addrLoad != null) this.addrLoad = +this.addrLoad;
+        if (this.addrExec != null) this.addrExec = +this.addrExec;
+
+        this.fInstalled = (!!this.sizeRAM); // 0 is the default value for 'size' when none is specified
+        this.fAllocated = this.fReset = false;
+
+        this.sFilePath = parmsRAM['file'];
+        this.sFileName = Str.getBaseName(this.sFilePath);
+
+        if (this.sFilePath) {
+            var sFileURL = this.sFilePath;
+            if (DEBUG) this.log('load("' + sFileURL + '")');
+            /*
+             * If the selected data file has a ".json" extension, then we assume it's pre-converted
+             * JSON-encoded data, so we load it as-is; ditto for ROM files with a ".hex" extension.
+             * Otherwise, we ask our server-side converter to return the file in a JSON-compatible format.
+             */
+            var sFileExt = Str.getExtension(this.sFileName);
+            if (sFileExt != DumpAPI.FORMAT.JSON && sFileExt != DumpAPI.FORMAT.HEX) {
+                sFileURL = Web.getHost() + DumpAPI.ENDPOINT + '?' + DumpAPI.QUERY.FILE + '=' + this.sFilePath + '&' + DumpAPI.QUERY.FORMAT + '=' + DumpAPI.FORMAT.BYTES + '&' + DumpAPI.QUERY.DECIMAL + '=true';
+            }
+            var ram = this;
+            Web.getResource(sFileURL, null, true, function doneLoad(sURL, sResponse, nErrorCode) {
+                ram.finishLoad(sURL, sResponse, nErrorCode);
+            });
+        }
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {RAMPDP10}
+     * @param {ComputerPDP10} cmp
+     * @param {BusPDP10} bus
+     * @param {CPUStatePDP10} cpu
+     * @param {DebuggerPDP10} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+        this.initRAM();
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {RAMPDP10}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (this.aSymbols) {
+            if (this.dbg) {
+                this.dbg.addSymbols(this.id, this.addrRAM, this.sizeRAM, this.aSymbols);
+            }
+            /*
+             * Our only role in the handling of symbols is to hand them off to the Debugger at our
+             * first opportunity. Now that we've done that, our copy of the symbols, if any, are toast.
+             */
+            delete this.aSymbols;
+        }
+        if (!fRepower) {
+            /*
+             * Since we use the Bus to allocate all our memory, memory contents are already restored for us,
+             * so we don't save any state, and therefore no state should be restored.  Just do a reset().
+             */
+
+            this.reset();
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {RAMPDP10}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        /*
+         * The Computer powers down the CPU first, at which point CPUState state is saved,
+         * which includes the Bus state, and since we use the Bus component to allocate all
+         * our memory, memory contents are already saved for us, so we don't need the usual
+         * save logic.
+         */
+        return true;
+    }
+
+    /**
+     * finishLoad(sURL, sData, nErrorCode)
+     *
+     * @this {RAMPDP10}
+     * @param {string} sURL
+     * @param {string} sData
+     * @param {number} nErrorCode (response from server if anything other than 200)
+     */
+    finishLoad(sURL, sData, nErrorCode)
+    {
+        if (nErrorCode) {
+            this.notice("Unable to load RAM resource (error " + nErrorCode + ": " + sURL + ")");
+            this.sFilePath = null;
+        }
+        else {
+            Component.addMachineResource(this.idMachine, sURL, sData);
+            var resource = Web.parseMemoryResource(sURL, sData);
+            if (resource) {
+                this.aData = resource.aData;
+                this.aSymbols = resource.aSymbols;
+                if (this.addrLoad == null) this.addrLoad = resource.addrLoad;
+                if (this.addrExec == null) this.addrExec = resource.addrExec;
+            } else {
+                this.sFilePath = null;
+            }
+        }
+        this.initRAM();
+    }
+
+    /**
+     * initRAM()
+     *
+     * This function is called by both initBus() and finishLoad(), but it cannot copy the initial data into place
+     * until after initBus() has received the Bus component AND finishLoad() has received the data.  When both those
+     * criteria are satisfied, the component becomes "ready".
+     *
+     * @this {RAMPDP10}
+     */
+    initRAM()
+    {
+        if (!this.bus) return;
+
+        if (!this.fAllocated && this.sizeRAM) {
+            if (this.bus.addMemory(this.addrRAM, this.sizeRAM, MemoryPDP10.TYPE.RAM)) {
+                this.fAllocated = true;
+            } else {
+                this.sizeRAM = 0;           // don't bother trying again (it just results in redundant error messages)
+            }
+        }
+        if (!this.isReady()) {
+            if (!this.fAllocated) {
+                Component.error("No RAM allocated");
+            }
+            else if (this.sFilePath) {
+                /*
+                 * Too early...
+                 */
+                if (!this.aData) return;
+
+                if (this.loadImage(this.aData, this.addrLoad, this.addrExec, this.addrRAM)) {
+                    this.status('Loaded image "' + this.sFileName + '"');
+                } else {
+                    this.notice('Error loading image "' + this.sFileName + '"');
+                }
+
+                /*
+                 * NOTE: We now retain this data, so that reset() can return the RAM to its predefined state.
+                 *
+                 *      delete this.aData;
+                 */
+            }
+            this.fReset = true;
+            this.setReady();
+        }
+    }
+
+    /**
+     * reset()
+     *
+     * @this {RAMPDP10}
+     */
+    reset()
+    {
+        if (this.fAllocated && !this.fReset) {
+            /*
+             * TODO: Add a configuration parameter for selecting the byte pattern on reset?
+             * Note that when memory blocks are originally created, they are currently always
+             * zero-initialized, so this would only affect resets.
+             */
+            this.bus.zeroMemory(this.addrRAM, this.sizeRAM, 0);
+            if (this.aData) {
+                this.loadImage(this.aData, this.addrLoad, this.addrExec, this.addrRAM, !this.dbg);
+            }
+        }
+        this.fReset = false;
+    }
+
+    /**
+     * loadImage(aData, addrLoad, addrExec, addrInit, fStart)
+     *
+     * If the array contains a PAPER tape image in the "Absolute Format," load it as specified
+     * by the format; otherwise, load it as-is using the address(es) supplied.
+     *
+     * @this {RAMPDP10}
+     * @param {Array} aData
+     * @param {number|null} [addrLoad]
+     * @param {number|null} [addrExec] (this CAN override any starting address INSIDE the image)
+     * @param {number|null} [addrInit]
+     * @param {boolean} [fStart]
+     * @return {boolean} (true if loaded, false if not)
+     */
+    loadImage(aData, addrLoad, addrExec, addrInit, fStart)
+    {
+        var fLoaded = false;
+
+        if (addrLoad == null) {
+            addrLoad = addrInit;
+        }
+        if (addrLoad != null) {
+            for (var i = 0; i < aData.length; i++) {
+                this.bus.setWordDirect(addrLoad + i, aData[i]);
+            }
+            fLoaded = true;
+        }
+        if (fLoaded) {
+            /*
+             * Set the start address to whatever the caller provided, or failing that, whatever start
+             * address was specified inside the image.
+             *
+             * For example, the diagnostic "MAINDEC-11-D0AA-PB" doesn't include a start address inside the
+             * image, but we know that the directions for that diagnostic say to "Start and Restart at 200",
+             * so we have manually inserted an "exec":128 in the JSON containing the image.
+             */
+            if (addrExec == null) {
+                this.cpu.stopCPU();
+                fStart = false;
+            }
+            if (addrExec != null) {
+                this.cpu.setReset(addrExec, fStart);
+            }
+        }
+        return fLoaded;
+    }
+
+    /**
+     * RAMPDP10.init()
+     *
+     * This function operates on every HTML element of class "ram", extracting the
+     * JSON-encoded parameters for the RAMPDP10 constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a RAMPDP10 component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeRAM = Component.getElementsByClass(document, PDP10.APPCLASS, "ram");
+        for (var iRAM = 0; iRAM < aeRAM.length; iRAM++) {
+            var eRAM = aeRAM[iRAM];
+            var parmsRAM = Component.getComponentParms(eRAM);
+            var ram = new RAMPDP10(parmsRAM);
+            Component.bindComponentControls(ram, eRAM, PDP10.APPCLASS);
+        }
+    }
+}
+
+/*
+ * Initialize all the RAMPDP10 modules on the page.
+ */
+Web.onInit(RAMPDP10.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp10/lib/serial.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * Since the Closure Compiler treats ES6 classes as @struct rather than @dict by default,
+ * it deters us from defining named properties on our components; eg:
+ *
+ *      this['exports'] = {...}
+ *
+ * results in an error:
+ *
+ *      Cannot do '[]' access on a struct
+ *
+ * So, in order to define 'exports', we must override the @struct assumption by annotating
+ * the class as @unrestricted (or @dict).  Note that this must be done both here and in the
+ * Component class, because otherwise the Compiler won't allow us to *reference* the named
+ * property either.
+ *
+ * TODO: Consider marking ALL our classes unrestricted, because otherwise it forces us to
+ * define every single property the class uses in its constructor, which results in a fair
+ * bit of redundant initialization, since many properties aren't (and don't need to be) fully
+ * initialized until the appropriate init(), reset(), restore(), etc. function is called.
+ *
+ * The upside, however, may be that since the structure of the class is completely defined by
+ * the constructor, JavaScript engines may be able to optimize and run more efficiently.
+ *
+ * @unrestricted
+ */
+class SerialPortPDP10 extends Component {
+    /**
+     * SerialPortPDP10(parmsSerial)
+     *
+     * The SerialPort component has the following component-specific (parmsSerial) properties:
+     *
+     *      adapter: adapter number; 0 if not defined (the PCx86 SerialPort component uses this
+     *      value to set the device's internal COM number, which in turn determines other properties,
+     *      such as I/O ports and IRQ; for the PDP-10, this currently has no defined use)
+     *
+     *      binding: name of a control (based on its "binding" attribute) to bind to this port's I/O
+     *
+     *      tabSize: set to a non-zero number to convert tabs to spaces (applies only to output to
+     *      the above binding); default is 0 (no conversion)
+     *
+     *      upperCase: if true, all received input is upper-cased; it is normally the responsibility
+     *      of the sending device to ensure this, but sometimes it's more convenient to enforce
+     *      on the receiving end.
+     *
+     * @param {Object} parmsSerial
+     */
+    constructor(parmsSerial)
+    {
+        super("SerialPort", parmsSerial, MessagesPDP10.SERIAL);
+
+        this.iAdapter = +parmsSerial['adapter'];
+        this.fUpperCase = parmsSerial['upperCase'];
+        if (typeof this.fUpperCase == "string") this.fUpperCase = (this.fUpperCase == "true");
+        /**
+         * consoleOutput becomes a string that records serial port output if the 'binding' property is set to the
+         * reserved name "console".  Nothing is written to the console, however, until a linefeed (0x0A) is output
+         * or the string length reaches a threshold (currently, 1024 characters).
+         *
+         * @type {string|null}
+         */
+        this.consoleOutput = null;
+
+        /**
+         * controlIOBuffer is a DOM element bound to the port (currently used for output only; see transmitByte()).
+         *
+         * Example: CTTY COM2
+         *
+         * The CTTY DOS command redirects all CON I/O to the specified serial port (eg, COM2), which it assumes is
+         * connected to a serial terminal, and therefore anything it *transmits* via COM2 will be displayed by the
+         * terminal.  It further assumes that anything typed on such a terminal is NOT displayed, so as DOS *receives*
+         * serial input, DOS *transmits* the appropriate characters back to the terminal via COM2.
+         *
+         * As a result, controlIOBuffer only needs to be updated by the transmitByte() function.
+         *
+         * @type {Object}
+         */
+        this.controlIOBuffer = null;
+
+        /*
+         * If controlIOBuffer is being used AND 'tabSize' is set, then we make an attempt to monitor the characters
+         * being echoed via transmitByte(), maintain a logical column position, and convert any tabs into the appropriate
+         * number of spaces.
+         *
+         * charBOL, if nonzero, is a character to automatically output at the beginning of every line.  This probably
+         * isn't generally useful; I use it internally to preformat serial output.
+         */
+        this.tabSize = +parmsSerial['tabSize'];
+        this.charBOL = +parmsSerial['charBOL'];
+        this.iLogicalCol = 0;
+        this.fNullModem = true;
+
+        this.abReceive = [];
+
+        var sBinding = parmsSerial['binding'];
+        if (sBinding == "console") {
+            this.consoleOutput = "";
+        } else {
+            /*
+             * NOTE: If sBinding is not the name of a valid Control Panel DOM element, this call does nothing.
+             */
+            Component.bindExternalControl(this, sBinding, SerialPortPDP10.sIOBuffer);
+        }
+
+        /*
+         * No connection until initConnection() is called.
+         */
+        this.sDataReceived = "";
+        this.connection = this.sendData = this.updateStatus = null;
+
+        /*
+         * Export all functions required by initConnection().
+         */
+        this['exports'] = {
+            'connect': this.initConnection,
+            'receiveData': this.receiveData,
+            'receiveStatus': this.receiveStatus,
+            'setConnection': this.setConnection
+        };
+    }
+
+    /**
+     * setBinding(sType, sBinding, control, sValue)
+     *
+     * @this {SerialPortPDP10}
+     * @param {string|null} sType is the type of the HTML control (eg, "button", "textarea", "register", "flag", "rled", etc)
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "buffer")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sType, sBinding, control, sValue)
+    {
+        var serial = this;
+
+        switch (sBinding) {
+        case SerialPortPDP10.sIOBuffer:
+            this.bindings[sBinding] = this.controlIOBuffer = control;
+
+            /*
+             * An onkeydown handler is required for certain keys that browsers tend to consume themselves;
+             * for example, BACKSPACE is often defined as going back to the previous web page, and certain
+             * CTRL keys are often used for browser shortcuts (usually on Windows-based browsers).
+             *
+             * NOTE: We don't bother with a keyUp handler, because for the most part, we're only intercepting
+             * keys that require special treatment; in general, we're content with keyPress events.
+             */
+            control.onkeydown = function onKeyDown(event) {
+                event = event || window.event;
+                var bASCII = 0;
+                var keyCode = event.keyCode;
+                /*
+                 * Perform the same remapping of BACKSPACE and DELETE that our VT100 emulation performs,
+                 * for PCjs-wide consistency; see the KEYMAP table in /modules/pc8080/lib/keyboard.js for
+                 * the rationale.  Ditto for ALT-DELETE; see onKeyDown() in /modules/pc8080/lib/keyboard.js
+                 * for details.
+                 *
+                 * NOTE: keyDown (and keyUp) events supply us with KEYCODE values, which are NOT the same as
+                 * ASCII values, which is why we are comparing with KEYCODE values but assigning ASCII values,
+                 * because receiveData() requires ASCII values.
+                 */
+                if (keyCode == Keys.KEYCODE.BS) {
+                    bASCII = event.altKey? Keys.ASCII.CTRL_H : Keys.ASCII.DEL;
+                }
+                else if (keyCode == Keys.KEYCODE.DEL) {
+                    bASCII = Keys.ASCII.CTRL_H;
+                }
+                else if (event.ctrlKey && keyCode >= Keys.ASCII.A && keyCode <= Keys.ASCII.Z) {
+                    bASCII = keyCode - (Keys.ASCII.A - Keys.ASCII.CTRL_A);
+                }
+                if (bASCII) {
+                    if (event.preventDefault) event.preventDefault();
+                    serial.receiveData(bASCII);
+                }
+                return true;
+            };
+
+            control.onkeypress = function onKeyPress(event) {
+                /*
+                 * NOTE: Unlike keyDown events, keyPress events generally supply us with ASCII values,
+                 * despite the fact that, as above, they come to us via the keyCode property.  Yes, it's
+                 * brilliant (or rather, the opposite of brilliant), but that's life.
+                 */
+                event = event || window.event;
+                /*
+                 * Not sure why COMMAND-key combinations are coming through here (on Safari at least),
+                 * but in any case, let's make sure we don't act on them.
+                 */
+                if (!event.metaKey) {
+                    var bASCII = event.which || event.keyCode;
+                    /*
+                     * Perform the same remapping of ALT-ENTER (to LINE-FEED) that our VT100 emulation performs,
+                     * for PCjs-wide consistency; see onKeyDown() in /modules/pc8080/lib/keyboard.js for details.
+                     */
+                    if (event.altKey) {
+                        if (bASCII == Keys.ASCII.CTRL_M) {
+                            bASCII = Keys.ASCII.CTRL_J;
+                        }
+                    }
+                    serial.receiveData(bASCII);
+                    /*
+                     * Since we're going to remove the "readonly" attribute from the <textarea> control
+                     * (so that the soft keyboard activates on iOS), instead of calling preventDefault() for
+                     * selected keys (eg, the SPACE key, whose default behavior is to scroll the page), we must
+                     * now call it for *all* keys, so that the keyCode isn't added to the control immediately,
+                     * on top of whatever the machine is echoing back, resulting in double characters.
+                     */
+                    if (event.preventDefault) event.preventDefault();
+                }
+                return true;
+            };
+
+            control.onpaste = function onKeyPress(event) {
+                if (event.stopPropagation) event.stopPropagation();
+                if (event.preventDefault) event.preventDefault();
+                var clipboardData = event.clipboardData || window.clipboardData;
+                if (clipboardData) {
+                    /*
+                     * NOTE: Multiple lines of pasted text will (at least on macOS) contain LFs instead of CRs;
+                     * this is dealt with in receiveData() whenever it receives a string of characters.
+                     */
+                    serial.receiveData(clipboardData.getData('Text'));
+                }
+            };
+
+            /*
+             * Now that we've added an onkeypress handler that calls preventDefault() for ALL keys, the control
+             * itself no longer needs the "readonly" attribute; we primarily need to remove it for iOS browsers,
+             * so that the soft keyboard will activate, but it shouldn't hurt to remove the attribute for all browsers.
+             */
+            control.removeAttribute("readonly");
+
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {SerialPortPDP10}
+     * @param {ComputerPDP10} cmp
+     * @param {BusPDP10} bus
+     * @param {CPUStatePDP10} cpu
+     * @param {DebuggerPDP10} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cmp = cmp;
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+
+        this.setReady();
+    }
+
+    /**
+     * initConnection(fNullModem)
+     *
+     * If a machine 'connection' parameter exists of the form "{sourcePort}->{targetMachine}.{targetPort}",
+     * and "{sourcePort}" matches our idComponent, then look for a component with id "{targetMachine}.{targetPort}".
+     *
+     * If the target component is found, then verify that it has exported functions with the following names:
+     *
+     *      receiveData(data): called when we have data to transmit; aliased internally to sendData(data)
+     *      receiveStatus(pins): called when our control signals have changed; aliased internally to updateStatus(pins)
+     *
+     * For now, we're not going to worry about communication in the other direction, because when the target component
+     * performs its own initConnection(), it will find our receiveData() and receiveStatus() functions, at which point
+     * communication in both directions should be established, and the circle of life complete.
+     *
+     * For added robustness, if the target machine initializes much more slowly than we do, and our connection attempt
+     * fails, that's OK, because when it finally initializes, its initConnection() will call our initConnection();
+     * if we've already initialized, no harm done.
+     *
+     * @this {SerialPortPDP10}
+     * @param {boolean} [fNullModem] (caller's null-modem setting, to ensure our settings are in agreement)
+     */
+    initConnection(fNullModem)
+    {
+        if (!this.connection) {
+            var sConnection = this.cmp.getMachineParm("connection");
+            if (sConnection) {
+                var asParts = sConnection.split('->');
+                if (asParts.length == 2) {
+                    var sSourceID = Str.trim(asParts[0]);
+                    if (sSourceID != this.idComponent) return;  // this connection string is intended for another instance
+                    var sTargetID = Str.trim(asParts[1]);
+                    this.connection = Component.getComponentByID(sTargetID);
+                    if (this.connection) {
+                        var exports = this.connection['exports'];
+                        if (exports) {
+                            var fnConnect = exports['connect'];
+                            if (fnConnect) fnConnect.call(this.connection, this.fNullModem);
+                            this.sendData = exports['receiveData'];
+                            if (this.sendData) {
+                                this.fNullModem = fNullModem;
+                                this.updateStatus = exports['receiveStatus'];
+                                this.status("Connected " + this.idMachine + '.' + sSourceID + " to " + sTargetID);
+                                return;
+                            }
+                        }
+                    }
+                }
+                /*
+                 * Changed from notice() to status() because sometimes a connection fails simply because one of us is a laggard.
+                 */
+                this.status("Unable to establish connection: " + sConnection);
+            }
+        }
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {SerialPortPDP10}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+
+            /*
+             * This is as late as we can currently wait to make our first inter-machine connection attempt;
+             * even so, the target machine's initialization process may still be ongoing, so any connection
+             * may be not fully resolved until the target machine performs its own initConnection(), which will
+             * in turn invoke our initConnection() again.
+             */
+            this.initConnection(this.fNullModem);
+
+            if (!data) {
+                this.reset();
+            } else {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {SerialPortPDP10}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * reset()
+     *
+     * @this {SerialPortPDP10}
+     */
+    reset()
+    {
+        this.initState();
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the SerialPort component.
+     *
+     * @this {SerialPortPDP10}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, this.saveRegisters());
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the SerialPort component.
+     *
+     * @this {SerialPortPDP10}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        return this.initState(data[0]);
+    }
+
+    /**
+     * initState(a)
+     *
+     * @this {SerialPortPDP10}
+     * @param {Array} [a]
+     * @return {boolean} true if successful, false if failure
+     */
+    initState(a)
+    {
+        return true;
+    }
+
+    /**
+     * saveRegisters()
+     *
+     * Basically, the inverse of initState().
+     *
+     * @this {SerialPortPDP10}
+     * @return {Array}
+     */
+    saveRegisters()
+    {
+        return [];
+    }
+
+    /**
+     * receiveData(data)
+     *
+     * This replaces the old sendRBR() function, which expected an Array of bytes.  We still support that,
+     * but in order to support connections with other SerialPort components (ie, the PC8080 SerialPort), we
+     * have added support for numbers and strings as well.
+     *
+     * @this {SerialPortPDP10}
+     * @param {number|string|Array} data
+     * @return {boolean} true if received, false if not
+     */
+    receiveData(data)
+    {
+        if (typeof data == "number") {
+            this.abReceive.push(data);
+        }
+        else if (typeof data == "string") {
+            var bASCII = 0, bASCIIPrev;
+            for (var i = 0; i < data.length; i++) {
+                bASCIIPrev = bASCII;
+                bASCII = data.charCodeAt(i);
+                /*
+                 * NOTE: Multiple lines of pasted text will (at least on macOS) contain LFs instead of CRs;
+                 * we convert them to CRs below.  Windows may do something different, but in the worst case,
+                 * even if we receive CR/LF pairs, this code should keep the CRs and lose the LFs.
+                 */
+                if (bASCII == Str.ASCII.LF) {
+                    if (bASCIIPrev == Str.ASCII.CR) continue;
+                    bASCII = Str.ASCII.CR;
+                }
+                this.abReceive.push(bASCII);
+            }
+        }
+        else {
+            this.abReceive = this.abReceive.concat(data);
+        }
+
+        return true;                // for now, return true regardless, since we're buffering everything anyway
+    }
+
+    /**
+     * receiveByte()
+     *
+     * @this {SerialPortPDP10}
+     * @return {number} (0x00-0xff if byte available, -1 if not)
+     */
+    receiveByte()
+    {
+        var b = -1;
+        if (this.abReceive.length) {
+            /*
+             * Here, as elsewhere (eg, the PC11 component), even if I trusted all incoming data
+             * to be byte values (which I don't), there's also the risk that it could be signed data
+             * (eg, -128 to 127, instead of 0 to 255).  Both risks are good reasons to always mask
+             * the data assigned to RBUF with 0xff.
+             */
+            b = this.abReceive.shift() & 0xff;
+            this.printMessage("receiveByte(" + Str.toHexByte(b) + ")");
+            if (this.fUpperCase) {
+                /*
+                 * Automatically transform lower-case ASCII codes to upper-case; fUpperCase should
+                 * only be set when a terminal or some sort of pseudo-display is being used and we don't
+                 * trust it to have its CAPS-LOCK setting correct.
+                 */
+                if (b >= 0x61 && b < 0x7A) b -= 0x20;
+            }
+        }
+        return b;
+    }
+
+    /**
+     * receiveStatus(pins)
+     *
+     * @this {SerialPortPDP10}
+     * @param {number} pins
+     */
+    receiveStatus(pins)
+    {
+    }
+
+    /**
+     * setConnection(component, fn)
+     *
+     * @this {SerialPortPDP10}
+     * @param {Object|null} component
+     * @param {function(number)} fn
+     * @return {boolean}
+     */
+    setConnection(component, fn)
+    {
+        if (!this.connection) {
+            this.connection = component;
+            this.sendData = fn;
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * transmitByte(b)
+     *
+     * @this {SerialPortPDP10}
+     * @param {number} b
+     * @return {boolean} true if transmitted, false if not
+     */
+    transmitByte(b)
+    {
+        var fTransmitted = false;
+
+        if (MAXDEBUG) this.printMessage("transmitByte(" + Str.toHexByte(b) + ")");
+
+        if (this.sendData) {
+            if (this.sendData.call(this.connection, b)) {
+                fTransmitted = true;
+            }
+        }
+
+        /*
+         * TODO: Why do DEC diagnostics like to output bytes with bit 7 set?
+         */
+        b &= 0x7F;
+
+        if (this.controlIOBuffer) {
+            if (b == 0x0D) {
+                this.iLogicalCol = 0;
+            }
+            else if (b == 0x08) {
+                this.controlIOBuffer.value = this.controlIOBuffer.value.slice(0, -1);
+                /*
+                 * TODO: Back up the correct number of columns if the character erased was a tab.
+                 */
+                if (this.iLogicalCol > 0) this.iLogicalCol--;
+            }
+            else if (b) {
+                /*
+                 * RT-11 outputs lots of NULL characters, at least after a "D 56=5015" (0x0A0D) command has
+                 * been issued, hence the "if (b)" check above.
+                 *
+                 * TODO: Also consider a check for Keys.ASCII.CTRL_C, because by default, RT-11 outputs "raw"
+                 * CTRL_C characters, which we capture below and render as <ETX>.  RT-11 does this for other keys
+                 * as well, such as CTRL_K (<VT>) and CTRL_L (<FF>).
+                 */
+                var s = Str.toASCIICode(b); // formerly: String.fromCharCode(b);
+                var nChars = s.length;      // formerly: (b >= 0x20? 1 : 0);
+                if (b < 0x20 && nChars == 1) nChars = 0;
+                if (b == 0x09) {
+                    var tabSize = this.tabSize || 8;
+                    nChars = tabSize - (this.iLogicalCol % tabSize);
+                    if (this.tabSize) s = Str.pad("", nChars);
+                }
+                if (this.charBOL && !this.iLogicalCol && nChars) s = String.fromCharCode(this.charBOL) + s;
+                this.controlIOBuffer.value += s;
+                this.controlIOBuffer.scrollTop = this.controlIOBuffer.scrollHeight;
+                this.iLogicalCol += nChars;
+            }
+            fTransmitted = true;
+        }
+        else if (this.consoleOutput != null) {
+            if (b == 0x0A || this.consoleOutput.length >= 1024) {
+                this.println(this.consoleOutput);
+                this.consoleOutput = "";
+            }
+            if (b != 0x0A) {
+                this.consoleOutput += String.fromCharCode(b);
+            }
+            fTransmitted = true;
+        }
+
+        return fTransmitted;
+    }
+
+    /**
+     * SerialPortPDP10.init()
+     *
+     * This function operates on every HTML element of class "serial", extracting the
+     * JSON-encoded parameters for the SerialPort constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a SerialPort component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeSerial = Component.getElementsByClass(document, PDP10.APPCLASS, "serial");
+        for (var iSerial = 0; iSerial < aeSerial.length; iSerial++) {
+            var eSerial = aeSerial[iSerial];
+            var parmsSerial = Component.getComponentParms(eSerial);
+            var serial = new SerialPortPDP10(parmsSerial);
+            Component.bindComponentControls(serial, eSerial, PDP10.APPCLASS);
+        }
+    }
+}
+
+/*
+ * Internal name used for the I/O buffer control, if any, that we bind to the SerialPort.
+ *
+ * Alternatively, if SerialPort wants to use another component's control (eg, the Panel's
+ * "print" control), it can specify the name of that control with the 'binding' property.
+ *
+ * For that binding to succeed, we also need to know the target component; for now, that's
+ * been hard-coded to "Panel", in part because that's one of the few components we can rely
+ * upon initializing before we do, but it would be a simple matter to include a component type
+ * or ID as part of the 'binding' property as well, if we need more flexibility later.
+ */
+SerialPortPDP10.sIOBuffer = "buffer";
+
+/*
+ * Initialize every SerialPort module on the page.
+ */
+Web.onInit(SerialPortPDP10.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/debugger.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * Debugger Address Object
+ *
+ * This is the basic structure; other debuggers may extend it.
+ *
+ *      addr            address
+ *      fTemporary      true if this is a temporary breakpoint address
+ *      sCmd            set for breakpoint addresses if there's an associated command string
+ *      aCmds           preprocessed commands (from sCmd)
+ *
+ * @typedef {{
+ *      addr:(number|undefined),
+ *      fTemporary:(boolean|undefined),
+ *      sCmd:(string|undefined),
+ *      aCmds:(Array.<string>|undefined)
+ * }}
+ */
+var DbgAddr;
+
+/**
+ * Since the Closure Compiler treats ES6 classes as @struct rather than @dict by default,
+ * it deters us from defining named properties on our components; eg:
+ *
+ *      this['exports'] = {...}
+ *
+ * results in an error:
+ *
+ *      Cannot do '[]' access on a struct
+ *
+ * So, in order to define 'exports', we must override the @struct assumption by annotating
+ * the class as @unrestricted (or @dict).  Note that this must be done both here and in the
+ * subclass (eg, SerialPort), because otherwise the Compiler won't allow us to *reference*
+ * the named property either.
+ *
+ * TODO: Consider marking ALL our classes unrestricted, because otherwise it forces us to
+ * define every single property the class uses in its constructor, which results in a fair
+ * bit of redundant initialization, since many properties aren't (and don't need to be) fully
+ * initialized until the appropriate init(), reset(), restore(), etc. function is called.
+ *
+ * The upside, however, may be that since the structure of the class is completely defined by
+ * the constructor, JavaScript engines may be able to optimize and run more efficiently.
+ *
+ * @unrestricted
+ */
+class Debugger extends Component
+{
+    /**
+     * Debugger(parmsDbg)
+     *
+     * The Debugger component supports the following optional (parmsDbg) properties:
+     *
+     *      base: the base to use for most numeric input/output (default is 16)
+     *
+     * The Debugger component is a shared component containing a subset of functionality used by
+     * the other CPU-specific Debuggers (eg, DebuggerX86).  Over time, the goal is to factor out as
+     * much common debugging support as possible from those components into this one.
+     *
+     * @param {Object} parmsDbg
+     */
+    constructor(parmsDbg)
+    {
+        if (DEBUGGER) {
+
+            super("Debugger", parmsDbg);
+
+            /*
+             * Default base used to display all values; modified with the "s base" command.
+             */
+            this.nBase = +parmsDbg['base'] || 16;
+
+            /*
+             * Default number of bits of integer precision; it can be overridden by the Debugger
+             * but there is no command to adjust it.
+             */
+            this.nBits = 32;
+
+            this.achGroup = ['{','}'];
+            this.achAddress = ['[',']'];
+
+            /*
+             * These keep track of instruction activity, but only when tracing or when Debugger checks
+             * have been enabled (eg, one or more breakpoints have been set).
+             *
+             * They are zeroed by the reset() notification handler.  cInstructions is advanced by
+             * stepCPU() and checkInstruction() calls.  nCycles is updated by every stepCPU() or stop()
+             * call and simply represents the number of cycles performed by the last run of instructions.
+             */
+            this.nCycles = 0;
+            this.cOpcodes = this.cOpcodesStart = 0;
+
+            /*
+             * fAssemble is true when "assemble mode" is active, false when not.
+             */
+            this.fAssemble = false;
+
+            /*
+             * This maintains command history.  New commands are inserted at index 0 of the array.
+             * When Enter is pressed on an empty input buffer, we default to the command at aPrevCmds[0].
+             */
+            this.iPrevCmd = -1;
+            this.aPrevCmds = [];
+
+            /*
+             * aVariables is an object with properties that grow as setVariable() assigns more variables;
+             * each property corresponds to one variable, where the property name is the variable name (ie,
+             * a string beginning with a non-digit, followed by zero or more symbol characters and/or digits)
+             * and the property value is the variable's numeric value.  See doVar() and setVariable() for
+             * details.
+             *
+             * Note that parseValue() parses variables before numbers, so any variable that looks like a
+             * unprefixed hex value (eg, "a5" as opposed to "0xa5") will trump the numeric value.  Unprefixed
+             * hex values are a convenience of parseValue(), which always calls Str.parseInt() with a default
+             * base of 16; however, that default be overridden with a variety of explicit prefixes or suffixes
+             * (eg, a leading "0o" to indicate octal, a trailing period to indicate decimal, etc.)
+             *
+             * See Str.parseInt() for more details about supported numbers.
+             */
+            this.aVariables = {};
+
+        }   // endif DEBUGGER
+    }
+
+    /**
+     * getRegIndex(sReg, off)
+     *
+     * NOTE: This must be implemented by the individual debuggers.
+     *
+     * @this {Debugger}
+     * @param {string} sReg
+     * @param {number} [off] optional offset into sReg
+     * @return {number} register index, or -1 if not found
+     */
+    getRegIndex(sReg, off)
+    {
+        return -1;
+    }
+
+    /**
+     * getRegValue(iReg)
+     *
+     * NOTE: This must be implemented by the individual debuggers.
+     *
+     * @this {Debugger}
+     * @param {number} iReg
+     * @return {number|undefined}
+     */
+    getRegValue(iReg)
+    {
+        return undefined;
+    }
+
+    /**
+     * parseAddrReference(s, sAddr)
+     *
+     * Returns the given string with the given address reference replaced with the contents of that address.
+     *
+     * NOTE: This must be implemented by the individual debuggers.
+     *
+     * @this {Debugger}
+     * @param {string} s
+     * @param {string} sAddr
+     * @return {string}
+     */
+    parseAddrReference(s, sAddr)
+    {
+        return s.replace('[' + sAddr + ']', "unimplemented");
+    }
+
+    /**
+     * getNextCommand()
+     *
+     * @this {Debugger}
+     * @return {string}
+     */
+    getNextCommand()
+    {
+        var sCmd;
+        if (this.iPrevCmd > 0) {
+            sCmd = this.aPrevCmds[--this.iPrevCmd];
+        } else {
+            sCmd = "";
+            this.iPrevCmd = -1;
+        }
+        return sCmd;
+    }
+
+    /**
+     * getPrevCommand()
+     *
+     * @this {Debugger}
+     * @return {string|null}
+     */
+    getPrevCommand()
+    {
+        var sCmd = null;
+        if (this.iPrevCmd < this.aPrevCmds.length - 1) {
+            sCmd = this.aPrevCmds[++this.iPrevCmd];
+        }
+        return sCmd;
+    }
+
+    /**
+     * parseCommand(sCmd, fSave, chSep)
+     *
+     * @this {Debugger}
+     * @param {string|undefined} sCmd
+     * @param {boolean} [fSave] is true to save the command, false if not
+     * @param {string} [chSep] is the command separator character (default is ';')
+     * @return {Array.<string>}
+     */
+    parseCommand(sCmd, fSave, chSep)
+    {
+        if (fSave) {
+            if (!sCmd) {
+                if (this.fAssemble) {
+                    sCmd = "end";
+                } else {
+                    sCmd = this.aPrevCmds[this.iPrevCmd+1];
+                }
+            } else {
+                if (this.iPrevCmd < 0 && this.aPrevCmds.length) {
+                    this.iPrevCmd = 0;
+                }
+                if (this.iPrevCmd < 0 || sCmd != this.aPrevCmds[this.iPrevCmd]) {
+                    this.aPrevCmds.splice(0, 0, sCmd);
+                    this.iPrevCmd = 0;
+                }
+                this.iPrevCmd--;
+            }
+        }
+        var a = [];
+        if (sCmd) {
+            /*
+             * With the introduction of breakpoint commands (ie, quoted command sequences
+             * associated with a breakpoint), we can no longer perform simplistic splitting.
+             *
+             *      a = sCmd.split(chSep || ';');
+             *      for (var i = 0; i < a.length; i++) a[i] = Str.trim(a[i]);
+             *
+             * We may now split on semi-colons ONLY if they are outside a quoted sequence.
+             *
+             * Also, to allow quoted strings *inside* breakpoint commands, we first replace all
+             * DOUBLE double-quotes with single quotes.
+             */
+            sCmd = sCmd.replace(/""/g, "'");
+
+            var iPrev = 0;
+            var chQuote = null;
+            chSep = chSep || ';';
+            /*
+             * NOTE: Processing charAt() up to and INCLUDING length is not a typo; we're taking
+             * advantage of the fact that charAt() with an invalid index returns an empty string,
+             * allowing us to use the same substring() call to capture the final portion of sCmd.
+             *
+             * In a sense, it allows us to pretend that the string ends with a zero terminator.
+             */
+            for (var i = 0; i <= sCmd.length; i++) {
+                var ch = sCmd.charAt(i);
+                if (ch == '"' || ch == "'") {
+                    if (!chQuote) {
+                        chQuote = ch;
+                    } else if (ch == chQuote) {
+                        chQuote = null;
+                    }
+                }
+                else if (ch == chSep && !chQuote || !ch) {
+                    /*
+                     * Recall that substring() accepts starting (inclusive) and ending (exclusive)
+                     * indexes, whereas substr() accepts a starting index and a length.  We need the former.
+                     */
+                    a.push(Str.trim(sCmd.substring(iPrev, i)));
+                    iPrev = i + 1;
+                }
+            }
+        }
+        return a;
+    }
+
+    /**
+     * evalAND(dst, src)
+     *
+     * Adapted from /modules/pdp10/lib/cpuops.js:PDP10.AND().
+     *
+     * Performs the bitwise "and" (AND) of two operands > 32 bits.
+     *
+     * @this {Debugger}
+     * @param {number} dst
+     * @param {number} src
+     * @return {number} (dst & src)
+     */
+    evalAND(dst, src)
+    {
+        /*
+         * We AND the low 32 bits separately from the higher bits, and then combine them with addition.
+         * Since all bits above 32 will be zero, and since 0 AND 0 is 0, no special masking for the higher
+         * bits is required.
+         *
+         * WARNING: When using JavaScript's 32-bit operators with values that could set bit 31 and produce a
+         * negative value, it's critical to perform a final right-shift of 0, ensuring that the final result is
+         * positive.
+         */
+        if (this.nBits <= 32) {
+            return dst & src;
+        }
+        /*
+         * Negative values don't yield correct results when dividing, so pass them through an unsigned truncate().
+         */
+        dst = this.truncate(dst, 0, true);
+        src = this.truncate(src, 0, true);
+        return ((((dst / Debugger.TWO_POW32)|0) & ((src / Debugger.TWO_POW32)|0)) * Debugger.TWO_POW32) + ((dst & src) >>> 0);
+    }
+
+    /**
+     * evalIOR(dst, src)
+     *
+     * Adapted from /modules/pdp10/lib/cpuops.js:PDP10.IOR().
+     *
+     * Performs the logical "inclusive-or" (OR) of two operands > 32 bits.
+     *
+     * @this {Debugger}
+     * @param {number} dst
+     * @param {number} src
+     * @return {number} (dst | src)
+     */
+    evalIOR(dst, src)
+    {
+        /*
+         * We OR the low 32 bits separately from the higher bits, and then combine them with addition.
+         * Since all bits above 32 will be zero, and since 0 OR 0 is 0, no special masking for the higher
+         * bits is required.
+         *
+         * WARNING: When using JavaScript's 32-bit operators with values that could set bit 31 and produce a
+         * negative value, it's critical to perform a final right-shift of 0, ensuring that the final result is
+         * positive.
+         */
+        if (this.nBits <= 32) {
+            return dst | src;
+        }
+        /*
+         * Negative values don't yield correct results when dividing, so pass them through an unsigned truncate().
+         */
+        dst = this.truncate(dst, 0, true);
+        src = this.truncate(src, 0, true);
+        return ((((dst / Debugger.TWO_POW32)|0) | ((src / Debugger.TWO_POW32)|0)) * Debugger.TWO_POW32) + ((dst | src) >>> 0);
+    }
+
+    /**
+     * evalXOR(dst, src)
+     *
+     * Adapted from /modules/pdp10/lib/cpuops.js:PDP10.XOR().
+     *
+     * Performs the logical "exclusive-or" (XOR) of two operands > 32 bits.
+     *
+     * @this {Debugger}
+     * @param {number} dst
+     * @param {number} src
+     * @return {number} (dst ^ src)
+     */
+    evalXOR(dst, src)
+    {
+        /*
+         * We XOR the low 32 bits separately from the higher bits, and then combine them with addition.
+         * Since all bits above 32 will be zero, and since 0 XOR 0 is 0, no special masking for the higher
+         * bits is required.
+         *
+         * WARNING: When using JavaScript's 32-bit operators with values that could set bit 31 and produce a
+         * negative value, it's critical to perform a final right-shift of 0, ensuring that the final result is
+         * positive.
+         */
+        if (this.nBits <= 32) {
+            return dst | src;
+        }
+        /*
+         * Negative values don't yield correct results when dividing, so pass them through an unsigned truncate().
+         */
+        dst = this.truncate(dst, 0, true);
+        src = this.truncate(src, 0, true);
+        return ((((dst / Debugger.TWO_POW32)|0) ^ ((src / Debugger.TWO_POW32)|0)) * Debugger.TWO_POW32) + ((dst ^ src) >>> 0);
+    }
+
+    /**
+     * evalMUL(dst, src)
+     *
+     * I could have adapted the code from /modules/pdp10/lib/cpuops.js:PDP10.doMUL(), but it was simpler to
+     * write this base method and let the PDP-10 Debugger override it with a call to the *actual* doMUL() method.
+     *
+     * @this {Debugger}
+     * @param {number} dst
+     * @param {number} src
+     * @return {number} (dst * src)
+     */
+    evalMUL(dst, src)
+    {
+        return dst * src;
+    }
+
+    /**
+     * truncate(v, nBits, fUnsigned)
+     *
+     * @this {Debugger}
+     * @param {number} v
+     * @param {number} [nBits]
+     * @param {boolean} [fUnsigned]
+     * @return {number}
+     */
+    truncate(v, nBits, fUnsigned)
+    {
+        var limit, vNew = v;
+        nBits = nBits || this.nBits;
+
+        if (fUnsigned) {
+            if (nBits == 32) {
+                vNew = v >>> 0;
+            }
+            else if (nBits < 32) {
+                vNew = v & ((1 << nBits) - 1);
+            }
+            else {
+                limit = Math.pow(2, nBits);
+                if (v < 0 || v >= limit) {
+                    vNew = v % limit;
+                    if (vNew < 0) vNew += limit;
+                }
+            }
+        }
+        else {
+            if (nBits <= 32) {
+                vNew = (v << (32 - nBits)) >> (32 - nBits);
+            }
+            else {
+                limit = Math.pow(2, nBits - 1);
+                if (v >= limit) {
+                    vNew = (v % limit);
+                    if (((v / limit)|0) & 1) vNew -= limit;
+                } else if (v < -limit) {
+                    vNew = (v % limit);
+                    if ((((-v - 1) / limit) | 0) & 1) {
+                        if (vNew) vNew += limit;
+                    }
+                    else {
+                        if (!vNew) vNew -= limit;
+                    }
+                }
+            }
+        }
+        if (v != vNew) {
+            if (MAXDEBUG) this.println("warning: value " + v + " truncated to " + vNew);
+            v = vNew;
+        }
+        return v;
+    }
+
+    /**
+     * evalOps(aVals, aOps, cOps)
+     *
+     * Some of our clients want a specific number of bits of integer precision.  If that precision is
+     * greater than 32, some of the operations below will fail; for example, JavaScript bitwise operators
+     * always truncate the result to 32 bits, so beware when using shift operations.  Similarly, it would
+     * be wrong to always "|0" the final result, which is why we rely on truncate() now.
+     *
+     * Note that JavaScript integer precision is limited to 52 bits.  For example, in Node, if you set a
+     * variable to 0x80000001:
+     *
+     *      foo=0x80000001|0
+     *
+     * then calculate foo*foo and display the result in binary using "(foo*foo).toString(2)":
+     *
+     *      '11111111111111111111111111111100000000000000000000000000000000'
+     *
+     * which is slightly incorrect because it has overflowed JavaScript's floating-point precision.
+     *
+     * 0x80000001 in decimal is -2147483647, so the product is 4611686014132420609, which is 0x3FFFFFFF00000001.
+     *
+     * @this {Debugger}
+     * @param {Array.<number>} aVals
+     * @param {Array.<string>} aOps
+     * @param {number} [cOps] (default is -1 for all)
+     * @return {boolean} true if successful, false if error
+     */
+    evalOps(aVals, aOps, cOps = -1)
+    {
+        while (cOps-- && aOps.length) {
+            var chOp = aOps.pop();
+            if (aVals.length < 2) return false;
+            var valNew;
+            var val2 = aVals.pop();
+            var val1 = aVals.pop();
+            switch(chOp) {
+            case '*':
+                valNew = this.evalMUL(val1, val2);
+                break;
+            case '/':
+                if (!val2) return false;
+                valNew = Math.trunc(val1 / val2);
+                break;
+            case '^/':
+                if (!val2) return false;
+                valNew = val1 % val2;
+                break;
+            case '+':
+                valNew = val1 + val2;
+                break;
+            case '-':
+                valNew = val1 - val2;
+                break;
+            case '<<':
+                valNew = val1 << val2;
+                break;
+            case '>>':
+                valNew = val1 >> val2;
+                break;
+            case '>>>':
+                valNew = val1 >>> val2;
+                break;
+            case '<':
+                valNew = (val1 < val2? 1 : 0);
+                break;
+            case '<=':
+                valNew = (val1 <= val2? 1 : 0);
+                break;
+            case '>':
+                valNew = (val1 > val2? 1 : 0);
+                break;
+            case '>=':
+                valNew = (val1 >= val2? 1 : 0);
+                break;
+            case '==':
+                valNew = (val1 == val2? 1 : 0);
+                break;
+            case '!=':
+                valNew = (val1 != val2? 1 : 0);
+                break;
+            case '&':
+                valNew = this.evalAND(val1, val2);
+                break;
+            case '!':           // alias for MACRO-10 to perform a bitwise inclusive-or (OR)
+            case '|':
+                valNew = this.evalIOR(val1, val2);
+                break;
+            case '^!':          // since MACRO-10 uses '^' for base overrides, '^!' is used for bitwise exclusive-or (XOR)
+                valNew = this.evalXOR(val1, val2);
+                break;
+            case '&&':
+                valNew = (val1 && val2? 1 : 0);
+                break;
+            case '||':
+                valNew = (val1 || val2? 1 : 0);
+                break;
+            case ',,':
+                valNew = this.truncate(val1, 18, true) * Math.pow(2, 18) + this.truncate(val2, 18, true);
+                break;
+            case '_':
+            case '^_':
+                valNew = val1;
+                /*
+                 * While we always try to avoid assuming any particular number of bits of precision, the 'B' shift
+                 * operator (which we've converted to '^_') is unique to the MACRO-10 environment, which imposes the
+                 * following restrictions on the shift count.
+                 */
+                if (chOp == '^_') val2 = 35 - (val2 & 0xff);
+                if (val2) {
+                    /*
+                     * Since binary shifting is a logical (not arithmetic) operation, and since shifting by division only
+                     * works properly with positive numbers, we call truncate() to produce an unsigned value.
+                     */
+                    valNew = this.truncate(valNew, 0, true);
+                    if (val2 > 0) {
+                        valNew *= Math.pow(2, val2);
+                    } else {
+                        valNew = Math.trunc(valNew / Math.pow(2, -val2));
+                    }
+                }
+                break;
+            default:
+                return false;
+            }
+            aVals.push(this.truncate(valNew));
+        }
+        return true;
+    }
+
+    /**
+     * parseArray(asValues, iValue, iLimit, nBase, aUndefined)
+     *
+     * parseExpression() takes a complete expression and divides it into array elements, where even elements
+     * are values (which may be empty if two or more operators appear consecutively) and odd elements are operators.
+     *
+     * For example, if the original expression was "2*{3+{4/2}}", parseExpression() would call parseArray() with:
+     *
+     *      0   1   2   3   4   5   6   7   8   9  10  11  12  13  14
+     *      -   -   -   -   -   -   -   -   -   -  --  --  --  --  --
+     *      2   *       {   3   +       {   4   /   2   }       }
+     *
+     * This function takes care of recursively processing grouped expressions, by processing subsets of the array,
+     * as well as handling certain base overrides (eg, temporarily switching to base-10 for binary shift suffixes).
+     *
+     * @param {Array.<string>} asValues
+     * @param {number} iValue
+     * @param {number} iLimit
+     * @param {number} nBase
+     * @param {Array|undefined} [aUndefined]
+     * @return {number|undefined}
+     */
+    parseArray(asValues, iValue, iLimit, nBase, aUndefined)
+    {
+        var value;
+        var sValue, sOp;
+        var fError = false;
+        var nUnary = 0;
+        var aVals = [], aOps = [];
+
+        var nBasePrev = this.nBase;
+        this.nBase = nBase;
+
+        while (iValue < iLimit) {
+            var v;
+            sValue = asValues[iValue++].trim();
+            sOp = (iValue < iLimit? asValues[iValue++] : "");
+
+            if (sValue) {
+                v = this.parseValue(sValue, null, aUndefined, nUnary);
+            } else {
+                if (sOp == '{') {
+                    var cOpen = 1;
+                    var iStart = iValue;
+                    while (iValue < iLimit) {
+                        sValue = asValues[iValue++].trim();
+                        sOp = (iValue < asValues.length? asValues[iValue++] : "");
+                        if (sOp == '{') {
+                            cOpen++;
+                        } else if (sOp == '}') {
+                            if (!--cOpen) break;
+                        }
+                    }
+                    v = this.parseArray(asValues, iStart, iValue-1, this.nBase, aUndefined);
+                    if (v != null && nUnary) {
+                        v = this.parseUnary(v, nUnary);
+                    }
+                    sValue = (iValue < iLimit? asValues[iValue++].trim() : "");
+                    sOp = (iValue < iLimit? asValues[iValue++] : "");
+                }
+                else {
+                    /*
+                     * When parseExpression() calls us, it has collapsed all runs of whitespace into single spaces,
+                     * and although it allows single spaces to divide the elements of the expression, a space is neither
+                     * a unary nor binary operator.  It's essentially a no-op.  If we encounter it here, then it followed
+                     * another operator and is easily ignored (although perhaps it should still trigger a reset of nBase
+                     * and nUnary -- TBD).
+                     */
+                    if (sOp == ' ') {
+                        continue;
+                    }
+                    if (sOp == '^B') {
+                        this.nBase = 2;
+                        continue;
+                    }
+                    if (sOp == '^O') {
+                        this.nBase = 8;
+                        continue;
+                    }
+                    if (sOp == '^D') {
+                        this.nBase = 10;
+                        continue;
+                    }
+                    if (!(nUnary & (0xC0000000|0))) {
+                        if (sOp == '+') {
+                            continue;
+                        }
+                        if (sOp == '-') {
+                            nUnary = (nUnary << 2) | 1;
+                            continue;
+                        }
+                        if (sOp == '~' || sOp == '^-') {
+                            nUnary = (nUnary << 2) | 2;
+                            continue;
+                        }
+                        if (sOp == '^L') {
+                            nUnary = (nUnary << 2) | 3;
+                            continue;
+                        }
+                    }
+                    fError = true;
+                    break;
+                }
+            }
+
+            if (v === undefined) {
+                if (aUndefined) {
+                    aUndefined.push(sValue);
+                    v = 0;
+                } else {
+                    fError = true;
+                    aUndefined = [];
+                    break;
+                }
+            }
+
+            aVals.push(this.truncate(v));
+
+            /*
+             * When parseExpression() calls us, it has collapsed all runs of whitespace into single spaces,
+             * and although it allows single spaces to divide the elements of the expression, a space is neither
+             * a unary nor binary operator.  It's essentially a no-op.  If we encounter it here, then it followed
+             * a value, and since we don't want to misinterpret the next operator as a unary operator, we look
+             * ahead and grab the next operator if it's not preceded by a value.
+             */
+            if (sOp == ' ') {
+                if (iValue < asValues.length - 1 && !asValues[iValue]) {
+                    iValue++;
+                    sOp = asValues[iValue++]
+                } else {
+                    fError = true;
+                    break;
+                }
+            }
+
+            if (!sOp) break;
+
+            var aBinOp = (this.achGroup[0] == '<'? Debugger.aDECOpPrecedence : Debugger.aBinOpPrecedence);
+            if (!aBinOp[sOp]) {
+                fError = true;
+                break;
+            }
+            if (aOps.length && aBinOp[sOp] <= aBinOp[aOps[aOps.length - 1]]) {
+                this.evalOps(aVals, aOps, 1);
+            }
+            aOps.push(sOp);
+
+            /*
+             * The MACRO-10 binary shifting operator assumes a base-10 shift count, regardless of the current
+             * base, so we must override the current base to ensure the count is parsed correctly.
+             */
+            this.nBase = (sOp == '^_')? 10 : nBase;
+            nUnary = 0;
+        }
+
+        if (fError || !this.evalOps(aVals, aOps) || aVals.length != 1) {
+            fError = true;
+        }
+
+        if (!fError) {
+            value = aVals.pop();
+
+        } else if (!aUndefined) {
+            this.println("parse error (" + (sValue || sOp) + ")");
+        }
+
+        this.nBase = nBasePrev;
+        return value;
+    }
+
+    /**
+     * parseASCII(sExp, chDelim, nBits, cchMax)
+     *
+     * @this {Debugger}
+     * @param {string} sExp
+     * @param {string} chDelim
+     * @param {number} nBits
+     * @param {number} cchMax
+     * @return {string|undefined}
+     */
+    parseASCII(sExp, chDelim, nBits, cchMax)
+    {
+        var i;
+        while ((i = sExp.indexOf(chDelim)) >= 0) {
+            var v = 0;
+            var j = i + 1;
+            var cch = cchMax;
+            while (j < sExp.length) {
+                var ch = sExp[j++];
+                if (ch == chDelim) {
+                    cch = -1;
+                    break;
+                }
+                if (!cch) break;
+                cch--;
+                var c = ch.charCodeAt(0);
+                if (nBits == 7) {
+                    c &= 0x7F;
+                } else {
+                    c = (c - 0x20) & 0x3F;
+                }
+                v = this.truncate(v * Math.pow(2, nBits) + c, nBits * cchMax, true);
+            }
+            if (cch >= 0) {
+                this.println("parse error (" + chDelim + sExp + chDelim + ")");
+                return undefined;
+            } else {
+                sExp = sExp.substr(0, i) + this.toStrBase(v, -1) + sExp.substr(j);
+            }
+        }
+        return sExp;
+    }
+
+    /**
+     * parseExpression(sExp, fQuiet)
+     *
+     * A quick-and-dirty expression parser.  It takes an expression like:
+     *
+     *      EDX+EDX*4+12345678
+     *
+     * and builds a value stack in aVals and a "binop" (binary operator) stack in aOps:
+     *
+     *      aVals       aOps
+     *      -----       ----
+     *      EDX         +
+     *      EDX         *
+     *      4           +
+     *      ...
+     *
+     * We pop 1 "binop" from aOps and 2 values from aVals whenever a "binop" of lower priority than its
+     * predecessor is encountered, evaluate, and push the result back onto aVals.  Only selected unary
+     * operators are supported (eg, negate and complement); no ternary operators like '?:' are supported.
+     *
+     * fQuiet can be used to pass an array that collects any undefined variables that parseExpression()
+     * encounters; the value of an undefined variable is zero.  This mode was added for components that need
+     * to support expressions containing "fixups" (ie, values that must be determined later).
+     *
+     * @this {Debugger}
+     * @param {string|undefined} sExp
+     * @param {Array|undefined|boolean} [fQuiet]
+     * @return {number|undefined} numeric value, or undefined if sExp contains any undefined or invalid values
+     */
+    parseExpression(sExp, fQuiet)
+    {
+        var value = undefined;
+        var fPrint = (fQuiet === false);
+        var aUndefined = Array.isArray(fQuiet)? fQuiet : undefined;
+
+        if (sExp) {
+
+            /*
+             * The default delimiting characters for grouped expressions are braces; they can be changed by altering
+             * achGroup, but when that happens, instead of changing our regular expressions and operator tables,
+             * we simply replace all achGroup characters with braces in the given expression.
+             *
+             * Why not use parentheses for grouped expressions?  Because some debuggers use parseReference() to perform
+             * parenthetical value replacements in message strings, and they don't want parentheses taking on a different
+             * meaning.  And for some machines, like the PDP-10, the convention is to use parentheses for other things,
+             * like indexed addressing, and to use angle brackets for grouped expressions.
+             */
+            if (this.achGroup[0] != '{') {
+                sExp = sExp.split(this.achGroup[0]).join('{').split(this.achGroup[1]).join('}');
+            }
+
+            /*
+             * Quoted ASCII characters can have a numeric value, too, which must be converted now, to avoid any
+             * conflicts with the operators below.
+             */
+            sExp = this.parseASCII(sExp, '"', 7, 5);    // MACRO-10 packs up to 5 7-bit ASCII codes into a value
+            if (!sExp) return value;
+            sExp = this.parseASCII(sExp, "'", 6, 6);    // MACRO-10 packs up to 6 6-bit ASCII (SIXBIT) codes into a value
+            if (!sExp) return value;
+
+            /*
+             * All browsers (including, I believe, IE9 and up) support the following idiosyncrasy of a RegExp split():
+             * when the RegExp uses a capturing pattern, the resulting array will include entries for all the pattern
+             * matches along with the non-matches.  This effectively means that, in the set of expressions that we
+             * support, all even entries in asValues will contain "values" and all odd entries will contain "operators".
+             *
+             * Although I started listing the operators in the RegExp in "precedential" order, that's not important;
+             * what IS important is listing operators than contain shorter operators first.  For example, bitwise
+             * shift operators must be listed BEFORE the logical less-than or greater-than operators.  The aBinOp tables
+             * (aBinOpPrecedence and aDECOpPrecedence) are what determine precedence, not the RegExp.
+             *
+             * Also, to better accommodate MACRO-10 syntax, I've replaced the single '^' for XOR with '^!', and I've
+             * added '!' as an alias for '|' (bitwise inclusive-or), '^-' as an alias for '~' (one's complement operator),
+             * and '_' as a shift operator (+/- values specify a left/right shift, and the count is not limited to 32).
+             *
+             * And to avoid conflicts with MACRO-10 syntax, I've replaced the original mod operator ('%') with '^/'.
+             *
+             * The MACRO-10 binary shifting suffix ('B') is a bit more problematic, since a capital B can also appear
+             * inside symbols, or inside hex values.  So if the default base is NOT 16, then I pre-scan for that suffix
+             * and replace all non-symbolic occurrences with an internal shift operator ('^_').
+             *
+             * Note that Str.parseInt(), which parseValue() relies on, supports both the MACRO-10 base prefix overrides
+             * and the binary shifting suffix ('B'), but since that suffix can also be a bracketed expression, we have to
+             * support it here as well.
+             *
+             * MACRO-10 supports only a subset of all the PCjs operators; for example, MACRO-10 doesn't support any of
+             * the boolean logical/compare operators.  But unless we run into conflicts, I prefer sticking with this
+             * common set of operators.
+             *
+             * All whitespace in the expression is collapsed to single spaces, and space has been added to the list
+             * of "operators", but its sole function is as a separator, not as an operator.  parseArray() will ignore
+             * single spaces as long as they are preceded and/or followed by a "real" operator.  It would be dangerous
+             * to remove spaces entirely, because if an operator-less expression like "A B" was passed in, we would want
+             * that to generate an error; if we converted it to "AB", evaluation might inadvertently succeed.
+             */
+            var regExp = /({|}|\|\||&&|\||\^!|\^B|\^O|\^D|\^L|\^-|~|\^_|_|&|!=|!|==|>=|>>>|>>|>|<=|<<|<|-|\+|\^\/|\/|\*|,,| )/;
+            if (this.nBase != 16) {
+                sExp = sExp.replace(/(^|[^A-Z0-9$%.])([0-9]+)B/, "$1$2^_").replace(/\s+/g, ' ');
+            }
+            var asValues = sExp.split(regExp);
+            value = this.parseArray(asValues, 0, asValues.length, this.nBase, aUndefined);
+            if (value !== undefined && fPrint) {
+                this.printValue(null, value);
+            }
+        }
+        return value;
+    }
+
+    /**
+     * parseReference(s)
+     *
+     * Returns the given string with any "{expression}" sequences replaced with the value of the expression,
+     * and any "[address]" references replaced with the contents of the address.  Expressions are parsed BEFORE
+     * addresses.
+     *
+     * @this {Debugger}
+     * @param {string} s
+     * @return {string|undefined}
+     */
+    parseReference(s)
+    {
+        var a;
+        var chOpen = this.achGroup[0];
+        var chClose = this.achGroup[1];
+        var chEscape = (chOpen == '(' || chOpen == '{' || chOpen == '[')? '\\' : '';
+        var chInnerEscape = (chOpen == '['? '\\' : '');
+        var reSubExp = new RegExp(chEscape + chOpen + "([^" + chInnerEscape + chOpen + chInnerEscape + chClose + "]+)" + chEscape + chClose);
+        while (a = s.match(reSubExp)) {
+            var value = this.parseExpression(a[1]);
+            if (value === undefined) return undefined;
+            var sSearch = chOpen + a[1] + chClose;
+            var sReplace = value != null? this.toStrBase(value) : "undefined";
+            /*
+             * Note that by default, the String replace() method only replaces the FIRST occurrence,
+             * and there MIGHT be more than one occurrence of the expression we just parsed, so we could
+             * do this instead:
+             *
+             *      s = s.split(sSearch).join(sReplace);
+             *
+             * However, that's knd of an expensive (slow) solution, and it's not strictly necessary, since
+             * any additional identical expressions will be picked up on a subsequent iteration through this loop.
+             */
+            s = s.replace(sSearch, sReplace);
+        }
+        if (this.achAddress.length) {
+            chOpen = this.achAddress[0];
+            chClose = this.achAddress[1];
+            chEscape = (chOpen == '(' || chOpen == '{' || chOpen == '[')? '\\' : '';
+            chInnerEscape = (chOpen == '['? '\\' : '');
+            reSubExp = new RegExp(chEscape + chOpen + "([^" + chInnerEscape + chOpen + chInnerEscape + chClose + "]+)" + chEscape + chClose);
+            while (a = s.match(reSubExp)) {
+                s = this.parseAddrReference(s, a[1]);
+            }
+        }
+        return this.parseSysVars(s);
+    }
+
+    /**
+     * parseSysVars(s)
+     *
+     * Returns the given string with any recognized "$var" replaced with its value; eg:
+     *
+     *      $ops: the number of opcodes executed since the last time it was displayed (or reset)
+     *
+     * @this {Debugger}
+     * @param {string} s
+     * @return {string}
+     */
+    parseSysVars(s)
+    {
+        var a;
+        while (a = s.match(/\$([a-z]+)/i)) {
+            var v = null;
+            switch(a[1].toLowerCase()) {
+            case "ops":
+                v = this.cOpcodes - this.cOpcodesStart;
+                break;
+            }
+            if (v == null) break;
+            s = s.replace(a[0], v.toString());
+        }
+        return s;
+    }
+
+    /**
+     * parseUnary(value, nUnary)
+     *
+     * nUnary is actually a small "stack" of unary operations encoded in successive pairs of bits.
+     * As parseExpression() encounters each unary operator, nUnary is shifted left 2 bits, and the
+     * new unary operator is encoded in bits 0 and 1 (0b00 is none, 0b01 is negate, 0b10 is complement,
+     * and 0b11 is reserved).  Here, we process the bits in reverse order (hence the stack-like nature),
+     * ensuring that we process the unary operators associated with this value right-to-left.
+     *
+     * Since bitwise operators see only 32 bits, more than 16 unary operators cannot be supported
+     * using this method.  We'll let parseExpression() worry about that; if it ever happens in practice,
+     * then we'll have to switch to a more "expensive" approach (eg, an actual array of unary operators).
+     *
+     * @this {Debugger}
+     * @param {number} value
+     * @param {number} nUnary
+     * @return {number}
+     */
+    parseUnary(value, nUnary)
+    {
+        while (nUnary) {
+            switch(nUnary & 0o3) {
+            case 1:
+                value = -this.truncate(value);
+                break;
+            case 2:
+                value = this.evalXOR(value, -1);        // this is easier than adding an evalNOT()...
+                break;
+            case 3:
+                var bit = 35;                           // simple left-to-right zero-bit-counting loop...
+                while (bit >= 0 && !this.evalAND(value, Math.pow(2, bit))) bit--;
+                value = 35 - bit;
+                break;
+            }
+            nUnary >>>= 2;
+        }
+        return value;
+    }
+
+    /**
+     * parseValue(sValue, sName, fQuiet, nUnary)
+     *
+     * @this {Debugger}
+     * @param {string|undefined} sValue
+     * @param {string|null} [sName] is the name of the value, if any
+     * @param {Array|undefined|boolean} [fQuiet]
+     * @param {number} [nUnary] (0 for none, 1 for negate, 2 for complement, 3 for leading zeros)
+     * @return {number|undefined} numeric value, or undefined if sValue is either undefined or invalid
+     */
+    parseValue(sValue, sName, fQuiet, nUnary = 0)
+    {
+        var value;
+        var aUndefined = Array.isArray(fQuiet)? fQuiet : undefined;
+
+        if (sValue != null) {
+            var iReg = this.getRegIndex(sValue);
+            if (iReg >= 0) {
+                value = this.getRegValue(iReg);
+            } else {
+                value = this.getVariable(sValue);
+                if (value != null) {
+                    var sUndefined = this.getVariableFixup(sValue);
+                    if (sUndefined) {
+                        if (aUndefined) {
+                            aUndefined.push(sUndefined);
+                        } else {
+                            var valueUndefined = this.parseExpression(sUndefined, fQuiet);
+                            if (valueUndefined !== undefined) {
+                                value += valueUndefined;
+                            } else {
+                                if (!fQuiet) {
+                                    this.println("undefined " + (sName || "value") + ": " + sValue + " (" + sUndefined + ")");
+                                }
+                                value = undefined;
+                            }
+                        }
+                    }
+                } else {
+                    /*
+                     * A feature of MACRO-10 is that any single-digit number is automatically interpreted as base-10.
+                     */
+                    value = Str.parseInt(sValue, sValue.length > 1 || this.nBase > 10? this.nBase : 10);
+                }
+            }
+            if (value != null) {
+                value = this.truncate(this.parseUnary(value, nUnary));
+            } else {
+                if (!fQuiet) {
+                    this.println("invalid " + (sName || "value") + ": " + sValue);
+                }
+            }
+        } else {
+            if (!fQuiet) {
+                this.println("missing " + (sName || "value"));
+            }
+        }
+        return value;
+    }
+
+    /**
+     * printValue(sVar, value)
+     *
+     * @this {Debugger}
+     * @param {string|null} sVar
+     * @param {number|undefined} value
+     * @return {boolean} true if value defined, false if not
+     */
+    printValue(sVar, value)
+    {
+        var sValue;
+        var fDefined = false;
+        if (value !== undefined) {
+            fDefined = true;
+            if (this.nBase == 8) {
+                sValue = this.toStrBase(value, this.nBits, 8, 1) + "  " + value + '.';
+            } else {
+                sValue = this.toStrBase(value, this.nBits, 16, 1) + "  " + this.toStrBase(value, this.nBits, 8, 1) + "  " + this.toStrBase(value, this.nBits, 2, this.nBits <= 32? 8 : 6) + "  " + value + '.';
+            }
+            if (value >= 0x20 && value < 0x7F) {
+                sValue += " '" + String.fromCharCode(value) + "'";
+            }
+        }
+        sVar = (sVar != null? (sVar + ": ") : "");
+        this.println(sVar + sValue);
+        return fDefined;
+    }
+
+    /**
+     * resetVariables()
+     *
+     * @this {Debugger}
+     * @return {Object}
+     */
+    resetVariables()
+    {
+        var a = this.aVariables;
+        this.aVariables = {};
+        return a;
+    }
+
+    /**
+     * restoreVariables(a)
+     *
+     * @this {Debugger}
+     * @param {Object} a (from previous resetVariables() call)
+     */
+    restoreVariables(a)
+    {
+        this.aVariables = a;
+    }
+
+    /**
+     * printVariable(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} [sVar]
+     * @return {boolean} true if all value(s) defined, false if not
+     */
+    printVariable(sVar)
+    {
+        var cVariables = 0;
+        if (this.aVariables) {
+            if (sVar) {
+                return this.printValue(sVar, this.aVariables[sVar] && this.aVariables[sVar].value);
+            }
+            var aVars = Object.keys(this.aVariables);
+            aVars.sort();
+            for (var i = 0; i < aVars.length; i++) {
+                this.printValue(aVars[i], this.aVariables[aVars[i]].value);
+                cVariables++;
+            }
+        }
+        return cVariables > 0;
+    }
+
+    /**
+     * delVariable(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     */
+    delVariable(sVar)
+    {
+        delete this.aVariables[sVar];
+    }
+
+    /**
+     * getVariable(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     * @return {number|undefined}
+     */
+    getVariable(sVar)
+    {
+        if (this.aVariables[sVar]) {
+            return this.aVariables[sVar].value;
+        }
+        sVar = sVar.substr(0, 6);
+        return this.aVariables[sVar] && this.aVariables[sVar].value;
+    }
+
+    /**
+     * getVariableFixup(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     * @return {string|undefined}
+     */
+    getVariableFixup(sVar)
+    {
+        return this.aVariables[sVar] && this.aVariables[sVar].sUndefined;
+    }
+
+    /**
+     * isVariable(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     * @return {boolean}
+     */
+    isVariable(sVar)
+    {
+        return this.aVariables[sVar] !== undefined;
+    }
+
+    /**
+     * setVariable(sVar, value, sUndefined)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     * @param {number} value
+     * @param {string|undefined} [sUndefined]
+     */
+    setVariable(sVar, value, sUndefined)
+    {
+        this.aVariables[sVar] = {value, sUndefined};
+    }
+
+    /**
+     * toStrBase(n, nBits, nBase, nGrouping)
+     *
+     * Use this instead of Str's toOct()/toDec()/toHex() to convert numbers to the Debugger's default base.
+     *
+     * @this {Debugger}
+     * @param {number|null|undefined} n
+     * @param {number} [nBits] (-1 to strip leading zeros, 0 to allow a variable number of digits)
+     * @param {number} [nBase]
+     * @param {number} [nGrouping] (if nBase is 2, this is a grouping; otherwise, it's a prefix condition)
+     * @return {string}
+     */
+    toStrBase(n, nBits = 0, nBase = 0, nGrouping = 0)
+    {
+        var s;
+        switch(nBase || this.nBase) {
+        case 2:
+            s = Str.toBin(n, nBits > 0? nBits : 0, nGrouping);
+            break;
+        case 8:
+            s = Str.toOct(n, nBits > 0? ((nBits + 2)/3)|0 : 0, !!nGrouping);
+            break;
+        case 10:
+            /*
+             * The multiplier is actually Math.log(2)/Math.log(10), but an approximation is more than adequate.
+             */
+            s = Str.toDec(n, nBits > 0? Math.ceil(nBits * 0.3) : 0);
+            break;
+        case 16:
+        default:
+            s = Str.toHex(n, nBits > 0? ((nBits + 3) >> 2) : 0, !!nGrouping);
+            break;
+        }
+        return (nBits < 0? Str.stripLeadingZeros(s) : s);
+    }
+}
+
+if (DEBUGGER) {
+
+    /*
+     * These are our operator precedence tables.  Operators toward the bottom (with higher values) have
+     * higher precedence.  aBinOpPrecedence was our original table; we had to add aDECOpPrecedence because
+     * the precedence of operators in DEC's MACRO-10 expressions differ.  Having separate tables also allows
+     * us to remove operators that shouldn't be supported, but unless some operator creates a problem,
+     * I prefer to keep as much commonality between the tables as possible.
+     *
+     * Missing from these tables are the (limited) set of unary operators we support (negate and complement),
+     * since this is only a BINARY operator precedence, not a general-purpose precedence table.  Assume that
+     * all unary operators take precedence over all binary operators.
+     */
+    Debugger.aBinOpPrecedence = {
+        '||':   5,      // logical OR
+        '&&':   6,      // logical AND
+        '!':    7,      // bitwise OR (conflicts with logical NOT, but we never supported that)
+        '|':    7,      // bitwise OR
+        '^!':   8,      // bitwise XOR (added by MACRO-10 sometime between the 1972 and 1978 versions)
+        '&':    9,      // bitwise AND
+        '!=':   10,     // inequality
+        '==':   10,     // equality
+        '>=':   11,     // greater than or equal to
+        '>':    11,     // greater than
+        '<=':   11,     // less than or equal to
+        '<':    11,     // less than
+        '>>>':  12,     // unsigned bitwise right shift
+        '>>':   12,     // bitwise right shift
+        '<<':   12,     // bitwise left shift
+        '-':    13,     // subtraction
+        '+':    13,     // addition
+        '^/':   14,     // remainder
+        '/':    14,     // division
+        '*':    14,     // multiplication
+        '_':    19,     // MACRO-10 shift operator
+        '^_':   19,     // MACRO-10 internal shift operator (converted from 'B' suffix form that MACRO-10 uses)
+        '{':    20,     // open grouped expression (converted from achGroup[0])
+        '}':    20      // close grouped expression (converted from achGroup[1])
+    };
+    Debugger.aDECOpPrecedence = {
+        ',,':   1,      // high-word,,low-word
+        '||':   5,      // logical OR
+        '&&':   6,      // logical AND
+        '!=':   10,     // inequality
+        '==':   10,     // equality
+        '>=':   11,     // greater than or equal to
+        '>':    11,     // greater than
+        '<=':   11,     // less than or equal to
+        '<':    11,     // less than
+        '>>>':  12,     // unsigned bitwise right shift
+        '>>':   12,     // bitwise right shift
+        '<<':   12,     // bitwise left shift
+        '-':    13,     // subtraction
+        '+':    13,     // addition
+        '^/':   14,     // remainder
+        '/':    14,     // division
+        '*':    14,     // multiplication
+        '!':    15,     // bitwise OR (conflicts with logical NOT, but we never supported that)
+        '|':    15,     // bitwise OR
+        '^!':   15,     // bitwise XOR (added by MACRO-10 sometime between the 1972 and 1978 versions)
+        '&':    15,     // bitwise AND
+        '_':    19,     // MACRO-10 shift operator
+        '^_':   19,     // MACRO-10 internal shift operator (converted from 'B' suffix form that MACRO-10 uses)
+        '{':    20,     // open grouped expression (converted from achGroup[0])
+        '}':    20      // close grouped expression (converted from achGroup[1])
+    };
+
+    /*
+     * Assorted constants
+     */
+    Debugger.TWO_POW32 = Math.pow(2, 32);
+
+}   // endif DEBUGGER
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp10/lib/debugger.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * DebuggerPDP10 Address Object
+ *
+ *      addr            address
+ *      fPhysical       true if this is a physical address
+ *      fTemporary      true if this is a temporary breakpoint address
+ *      nBase           set if the address contained an explicit base (eg, 16, 10, 8, etc)
+ *      sCmd            set for breakpoint addresses if there's an associated command string
+ *      aCmds           preprocessed commands (from sCmd)
+ *
+ * @typedef {{
+ *      addr:(number|null),
+ *      fPhysical:(boolean),
+ *      fTemporary:(boolean),
+ *      nBase:(number|undefined),
+ *      sCmd:(string|undefined),
+ *      aCmds:(Array.<string>|undefined)
+ * }}
+ */
+var DbgAddrPDP10;
+
+class DebuggerPDP10 extends Debugger {
+    /**
+     * DebuggerPDP10(parmsDbg)
+     *
+     * The DebuggerPDP10 component supports the following optional (parmsDbg) properties:
+     *
+     *      commands: string containing zero or more commands, separated by ';'
+     *
+     *      messages: string containing zero or more message categories to enable;
+     *      multiple categories must be separated by '|' or ';'.  Parsed by messageInit().
+     *
+     * The DebuggerPDP10 component is an optional component that implements a variety of user
+     * commands for controlling the CPU, dumping and editing memory, etc.
+     *
+     * @this {DebuggerPDP10}
+     * @param {Object} parmsDbg
+     */
+    constructor(parmsDbg)
+    {
+        if (DEBUGGER) {
+
+            super(parmsDbg);
+
+            /*
+             * Since this Debugger doesn't use replaceRegs(), we can use parentheses instead of braces.
+             */
+            this.fInit = false;
+            this.nBusWidth = 18;        // default value, updated by initBus()
+
+            this.nBits = 36;            // default integer precision
+            this.achGroup = ['<','>'];
+            this.achAddress = [];
+
+            /*
+             * Most commands that require an address call parseAddr(), and if a dbgAddr parameter is supplied
+             * as as well (eg, dbgAddrCode, dbgAddrData), then that address will be used as the default.
+             *
+             * For TEMPORARY breakpoint addresses, we set fTemporary to true, so that they can be automatically
+             * cleared when they're hit.
+             */
+            this.dbgAddrAcc = this.newAddr();
+            this.dbgAddrCode = this.newAddr(0);
+            this.dbgAddrData = this.newAddr(0);
+            this.dbgAddrAssemble = this.newAddr(0);
+
+            /*
+             * aSymbolTable is an array of SymbolTable objects, one per ROM or other chunk of address space,
+             * where each object contains the following properties:
+             *
+             *      sModule
+             *      addr (physical address, if any; eg, symbols for a ROM)
+             *      len
+             *      aSymbols
+             *      aOffsets
+             *
+             * See addSymbols() for more details, since that's how callers add sets of symbols to the table.
+             */
+            this.aSymbolTable = [];
+
+            /*
+             * clearBreakpoints() initializes the breakpoints lists: aBreakExec is a list of addresses
+             * to halt on whenever attempting to execute an instruction at the corresponding address,
+             * and aBreakRead and aBreakWrite are lists of addresses to halt on whenever a read or write,
+             * respectively, occurs at the corresponding address.
+             *
+             * NOTE: Curiously, after upgrading the Google Closure Compiler from v20141215 to v20150609,
+             * the resulting compiled code would crash in clearBreakpoints(), because the (renamed) aBreakRead
+             * property was already defined.  To eliminate whatever was confusing the Closure Compiler, I've
+             * explicitly initialized all the properties that clearBreakpoints() (re)initializes.
+             */
+            this.aBreakExec = this.aBreakRead = this.aBreakWrite = [];
+            this.clearBreakpoints();
+
+            /*
+             * The new "bn" command allows you to specify a number of instructions to execute and then stop;
+             * "bn 0" disables any outstanding count.
+             */
+            this.nBreakInstructions = 0;
+
+            /*
+             * Execution history is allocated by historyInit() whenever checksEnabled() conditions change.
+             * Execution history is updated whenever the CPU calls checkInstruction(), which will happen
+             * only when checksEnabled() returns true (eg, whenever one or more breakpoints have been set).
+             * This ensures that, by default, the CPU runs as fast as possible.
+             */
+            this.iInstructionHistory = 0;
+            this.aInstructionHistory = [];
+            this.nextHistory = undefined;
+            this.historyInit();
+
+            /*
+             * Initialize DebuggerPDP10 message support.
+             */
+            this.dbg = this;
+            this.afnDumpers = {};
+            this.bitsMessage = this.bitsWarning = 0;
+            this.sMessagePrev = null;
+            this.aMessageBuffer = [];
+            this.messageInit(parmsDbg['messages']);
+            this.sInitCommands = parmsDbg['commands'];
+            this.aCommands = [];
+
+            /*
+             * Define remaining miscellaneous DebuggerPDP10 properties.
+             */
+            this.aOpReserved = [];
+            this.nStep = 0;
+            this.sCmdTracePrev = null;
+            this.sCmdDumpPrev = null;
+            this.nSuppressBreaks = 0;
+            this.cInstructions = this.cInstructionsStart = 0;
+            this.nCycles = this.nCyclesStart = this.msStart = 0;
+            this.controlDebug = null;
+            this.panel = null;
+
+            /**
+             * This records any active Macro10 assembler object.
+             *
+             * @type {Macro10|null}
+             */
+            this.macro10 = null;
+
+            /*
+             * Make it easier to access DebuggerPDP10 commands from an external REPL;
+             * eg, the WebStorm "live" console window:
+             *
+             *      pdp10('r')
+             *      pdp10('dw 0:0')
+             *      pdp10('h')
+             *      ...
+             */
+            var dbg = this;
+            if (window) {
+                if (window[PDP10.APPCLASS] === undefined) {
+                    window[PDP10.APPCLASS] = function(s) { return dbg.doCommands(s); };
+                }
+            } else {
+                if (global[PDP10.APPCLASS] === undefined) {
+                    global[PDP10.APPCLASS] = function(s) { return dbg.doCommands(s); };
+                }
+            }
+
+        }   // endif DEBUGGER
+    }
+
+    /**
+     * getAddr(dbgAddr, fWrite)
+     *
+     * @this {DebuggerPDP10}
+     * @param {DbgAddrPDP10|null} [dbgAddr]
+     * @param {boolean} [fWrite]
+     * @return {number} is the corresponding linear address, or PDP10.ADDR_INVALID
+     */
+    getAddr(dbgAddr, fWrite)
+    {
+        var addr = dbgAddr && dbgAddr.addr;
+        if (addr == null) addr = PDP10.ADDR_INVALID;
+        return addr;
+    }
+
+    /**
+     * newAddr(addr, fPhysical, nBase)
+     *
+     * Returns a NEW DbgAddrPDP10 object, initialized with specified values and/or defaults.
+     *
+     * @this {DebuggerPDP10}
+     * @param {number|null} [addr]
+     * @param {boolean} [fPhysical]
+     * @param {number} [nBase]
+     * @return {DbgAddrPDP10}
+     */
+    newAddr(addr = null, fPhysical = false, nBase)
+    {
+        return {addr: addr, fPhysical: fPhysical, fTemporary: false, nBase: nBase};
+    }
+
+    /**
+     * copyAddr(dbgAddr, dbgCopy)
+     *
+     * Updates an EXISTING DbgAddrPDP10 object, initialized with specified values and/or defaults.
+     *
+     * @this {DebuggerPDP10}
+     * @param {DbgAddrPDP10} dbgAddr
+     * @param {DbgAddrPDP10} dbgCopy
+     * @return {DbgAddrPDP10}
+     */
+    copyAddr(dbgAddr, dbgCopy)
+    {
+        dbgAddr.addr = dbgCopy.addr;
+        dbgAddr.fPhysical = dbgCopy.fPhysical;
+        dbgAddr.fTemporary = dbgCopy.fTemporary;
+        dbgAddr.nBase = dbgCopy.nBase;
+        return dbgAddr;
+    }
+
+    /**
+     * setAddr(dbgAddr, addr, fPhysical, nBase)
+     *
+     * Updates an EXISTING DbgAddrPDP10 object, initialized with specified values and/or defaults.
+     *
+     * @this {DebuggerPDP10}
+     * @param {DbgAddrPDP10} dbgAddr
+     * @param {number} addr
+     * @param {boolean} [fPhysical]
+     * @param {number} [nBase]
+     * @return {DbgAddrPDP10}
+     */
+    setAddr(dbgAddr, addr, fPhysical, nBase)
+    {
+        dbgAddr.addr = addr;
+        dbgAddr.fPhysical = fPhysical || false;
+        dbgAddr.fTemporary = false;
+        dbgAddr.nBase = nBase;
+        return dbgAddr;
+    }
+
+    /**
+     * packAddr(dbgAddr)
+     *
+     * Packs a DbgAddrPDP10 object into an Array suitable for saving in a machine state object.
+     *
+     * @this {DebuggerPDP10}
+     * @param {DbgAddrPDP10} dbgAddr
+     * @return {Array}
+     */
+    packAddr(dbgAddr)
+    {
+        return [dbgAddr.addr, dbgAddr.fPhysical, dbgAddr.fTemporary, dbgAddr.nBase, dbgAddr.sCmd];
+    }
+
+    /**
+     * unpackAddr(aAddr)
+     *
+     * Unpacks a DbgAddrPDP10 object from an Array created by packAddr() and restored from a saved machine state.
+     *
+     * @this {DebuggerPDP10}
+     * @param {Array} aAddr
+     * @return {DbgAddrPDP10}
+     */
+    unpackAddr(aAddr)
+    {
+        var dbgAddr = this.newAddr(aAddr[0], aAddr[1], aAddr[2]);
+        dbgAddr.fTemporary = aAddr[3];
+        if (aAddr[4]) {
+            dbgAddr.aCmds = this.parseCommand(dbgAddr.sCmd = aAddr[4]);
+        }
+        return dbgAddr;
+    }
+
+    /**
+     * initBus(bus, cpu, dbg)
+     *
+     * @this {DebuggerPDP10}
+     * @param {ComputerPDP10} cmp
+     * @param {BusPDP10} bus
+     * @param {CPUStatePDP10} cpu
+     * @param {DebuggerPDP10} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cmp = cmp;
+        this.cpu = cpu;
+        this.panel = cmp.panel;
+        this.nBusWidth = bus.getWidth();
+
+        /*
+         * Override the Debugger's message configuration if specified.
+         */
+        var sMessages = /** @type {string|undefined} */ (cmp.getMachineParm('messages'));
+        if (sMessages) this.messageInit(sMessages);
+
+        /*
+         * Override the Debugger's initialization commands if specified.
+         */
+        var sCommands = /** @type {string|undefined} */ (cmp.getMachineParm('commands'));
+        if (sCommands) this.sInitCommands = sCommands;
+
+        /*
+         * Update aOpReserved as appropriate for the current model
+         */
+
+        this.messageDump(MessagesPDP10.BUS,  function onDumpBus(asArgs) { dbg.dumpBus(asArgs); });
+
+        this.setReady();
+    }
+
+    /**
+     * setBinding(sType, sBinding, control, sValue)
+     *
+     * @this {DebuggerPDP10}
+     * @param {string|null} sType is the type of the HTML control (eg, "button", "textarea", "register", "flag", "rled", etc)
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "debugInput")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sType, sBinding, control, sValue)
+    {
+        var dbg = this;
+        switch (sBinding) {
+
+        case "debugInput":
+            this.bindings[sBinding] = control;
+            this.controlDebug = control;
+            /*
+             * For halted machines, this is fine, but for auto-start machines, it can be annoying.
+             *
+             *      control.focus();
+             */
+            control.onkeydown = function onKeyDownDebugInput(event) {
+                var sCmd;
+                if (event.keyCode == Keys.KEYCODE.CR) {
+                    sCmd = control.value;
+                    control.value = "";
+                    dbg.doCommands(sCmd, true);
+                }
+                else if (event.keyCode == Keys.KEYCODE.ESC) {
+                    control.value = sCmd = "";
+                }
+                else {
+                    if (event.keyCode == Keys.KEYCODE.UP) {
+                        sCmd = dbg.getPrevCommand();
+                    }
+                    else if (event.keyCode == Keys.KEYCODE.DOWN) {
+                        sCmd = dbg.getNextCommand();
+                    }
+                    if (sCmd != null) {
+                        var cch = sCmd.length;
+                        control.value = sCmd;
+                        control.setSelectionRange(cch, cch);
+                    }
+                }
+                if (sCmd != null && event.preventDefault) event.preventDefault();
+            };
+            return true;
+
+        case "debugEnter":
+            this.bindings[sBinding] = control;
+            Web.onClickRepeat(
+                control,
+                500, 100,
+                function onClickDebugEnter(fRepeat) {
+                    if (dbg.controlDebug) {
+                        var sCmd = dbg.controlDebug.value;
+                        dbg.controlDebug.value = "";
+                        dbg.doCommands(sCmd, true);
+                        return true;
+                    }
+                    if (DEBUG) dbg.log("no debugger input buffer");
+                    return false;
+                }
+            );
+            return true;
+
+        case "step":
+            this.bindings[sBinding] = control;
+            Web.onClickRepeat(
+                control,
+                500, 100,
+                function onClickStep(fRepeat) {
+                    var fCompleted = false;
+                    if (!dbg.isBusy(true)) {
+                        dbg.setBusy(true);
+                        fCompleted = dbg.stepCPU(fRepeat? 1 : 0, null);
+                        dbg.setBusy(false);
+                    }
+                    return fCompleted;
+                }
+            );
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * setFocus(fScroll)
+     *
+     * @this {DebuggerPDP10}
+     * @param {boolean} [fScroll] (true if you really want the control scrolled into view)
+     */
+    setFocus(fScroll)
+    {
+        if (this.controlDebug) {
+            /*
+             * This is the recommended work-around to prevent the browser from scrolling the focused element
+             * into view.  The CPU is not a visual component, so when the CPU wants to set focus, the primary intent
+             * is to ensure that keyboard input is fielded properly.
+             */
+            var x = 0, y = 0;
+            if (!fScroll && window) {
+                x = window.scrollX;
+                y = window.scrollY;
+            }
+
+            this.controlDebug.focus();
+
+            if (!fScroll && window) {
+                window.scrollTo(x, y);
+            }
+        }
+    }
+
+    /**
+     * getWord(dbgAddr, inc)
+     *
+     * @this {DebuggerPDP10}
+     * @param {DbgAddrPDP10} dbgAddr
+     * @param {number} [inc]
+     * @return {number}
+     */
+    getWord(dbgAddr, inc)
+    {
+        var w = PDP10.WORD_INVALID;
+        var addr = this.getAddr(dbgAddr, false);
+        if (addr !== PDP10.ADDR_INVALID) {
+            w = this.bus.getWordDirect(addr);
+            if (inc) this.incAddr(dbgAddr, inc);
+        }
+        return w;
+    }
+
+    /**
+     * setWord(dbgAddr, w, inc)
+     *
+     * @this {DebuggerPDP10}
+     * @param {DbgAddrPDP10} dbgAddr
+     * @param {number} w
+     * @param {number} [inc]
+     */
+    setWord(dbgAddr, w, inc)
+    {
+        var addr = this.getAddr(dbgAddr, true);
+        if (addr !== PDP10.ADDR_INVALID) {
+            this.bus.setWordDirect(addr, w);
+            if (inc) this.incAddr(dbgAddr, inc);
+            this.cmp.updateDisplays(-1);
+        }
+    }
+
+    /**
+     * evalMUL(dst, src)
+     *
+     * Overrides the standard multiplication function with one that honors PDP-10 semantics and precision.
+     *
+     * @this {DebuggerPDP10}
+     * @param {number} dst
+     * @param {number} src
+     * @return {number} (dst * src)
+     */
+    evalMUL(dst, src)
+    {
+        /*
+         * The CPU requires that all 36-bit inputs/outputs be UNSIGNED, whereas our expression evaluator allows signed
+         * inputs/outputs.  So we perform two's complement conversions on all inputs/outputs as needed.
+         */
+        if (dst < 0) dst += PDP10.WORD_LIMIT;
+        if (src < 0) src += PDP10.WORD_LIMIT;
+        var result = PDP10.doMUL.call(this.cpu, dst, src, false, true);
+        if (result >= PDP10.INT_LIMIT) result -= PDP10.WORD_LIMIT;
+        if (MAXDEBUG) {
+            var resultJS = this.truncate(dst * src);
+            if (resultJS !== result) {
+                var sReference = this.macro10? (" @" + this.toStrBase(this.macro10.nLocation)) : "";
+                var sResults = "PDP-10: " + this.toStrBase(result, 36) + " JavaScript: " + this.toStrBase(resultJS, 36);
+                this.println("MUL(" + this.toStrBase(dst, 36) + "," + this.toStrBase(src, 36) + ") " + sResults + sReference);
+            }
+        }
+        return result;
+    }
+
+    /**
+     * parseAddr(sAddr, dbgAddr)
+     *
+     * Address evaluation and validation (eg, range checks) are no longer performed at this stage.  That's
+     * done later, by getAddr(), which returns PDP10.ADDR_INVALID for invalid segments, out-of-range offsets,
+     * etc.  The Debugger's low-level get/set memory functions verify all getAddr() results, but even if an
+     * invalid address is passed through to the Bus memory interfaces, the address will simply be masked with
+     * bus.nBusMask; in the case of PDP10.ADDR_INVALID, that will generally refer to the top of the physical
+     * address space.
+     *
+     * @this {DebuggerPDP10}
+     * @param {string|undefined} sAddr
+     * @param {DbgAddrPDP10} [dbgAddr]
+     * @return {DbgAddrPDP10}
+     */
+    parseAddr(sAddr, dbgAddr)
+    {
+        var fPhysical, nBase;
+        if (!dbgAddr) dbgAddr = this.newAddr();
+        var addr = dbgAddr.addr;
+        if (sAddr !== undefined) {
+            sAddr = this.parseReference(sAddr);
+            var ch = sAddr.charAt(0);
+            if (ch == '%') {
+                fPhysical = true;
+                sAddr = sAddr.substr(1);
+            }
+            var dbgAddrTmp = this.findSymbolAddr(sAddr);
+            if (dbgAddrTmp) return dbgAddrTmp;
+            if (sAddr.indexOf("0x") >= 0) {
+                nBase = 16
+            } else if (sAddr.indexOf("0o") >= 0) {
+                nBase = 8;
+            } else if (sAddr.indexOf('.') >= 0) {
+                nBase = 10;
+            }
+            addr = this.parseExpression(sAddr);
+        }
+        if (addr != null) {
+            addr = this.validateWord(addr, this.nBusWidth);
+            this.setAddr(dbgAddr, addr, fPhysical, nBase);
+        }
+        return dbgAddr;
+    }
+
+    /**
+     * parseAddrOptions(dbdAddr, sOptions)
+     *
+     * @this {DebuggerPDP10}
+     * @param {DbgAddrPDP10} dbgAddr
+     * @param {string} [sOptions]
+     */
+    parseAddrOptions(dbgAddr, sOptions)
+    {
+        if (sOptions) {
+            var a = sOptions.match(/(['"])(.*?)\1/);
+            if (a) {
+                dbgAddr.aCmds = this.parseCommand(dbgAddr.sCmd = a[2]);
+            }
+        }
+    }
+
+    /**
+     * validateWord(w, bits)
+     *
+     * @this {DebuggerPDP10}
+     * @param {number} w
+     * @param {number} [bits]
+     * @return {number}
+     */
+    validateWord(w, bits = 36)
+    {
+        /*
+         * Although it's expected that most callers will supply unsigned 36-bit values, we're nice about
+         * converting any signed values to their unsigned (two's complement) counterpart, provided they are
+         * within the acceptable range.  Any values outside that range will be dealt with afterward.
+         */
+        if (w < 0 && w >= -PDP10.INT_LIMIT) {
+            w += PDP10.WORD_LIMIT;
+        }
+        var value = Math.trunc(Math.abs(w)) % Math.pow(2, bits);
+        if (DEBUG && w !== value) {
+            this.println("validateWord(" + Str.toOct(w) + "): out of range, truncated to " + Str.toOct(value));
+        }
+        return value;
+    }
+
+    /**
+     * incAddr(dbgAddr, inc)
+     *
+     * @this {DebuggerPDP10}
+     * @param {DbgAddrPDP10} dbgAddr
+     * @param {number} [inc] contains value to increment dbgAddr by (default is 1)
+     */
+    incAddr(dbgAddr, inc)
+    {
+        if (dbgAddr.addr != null) {
+            dbgAddr.addr += (inc || 1);
+        }
+    }
+
+    /**
+     * toStrOffset(off)
+     *
+     * @this {DebuggerPDP10}
+     * @param {number|null|undefined} [off]
+     * @return {string} default base representation of off
+     */
+    toStrOffset(off)
+    {
+        return this.toStrBase(off, 18);
+    }
+
+    /**
+     * toStrAddr(dbgAddr)
+     *
+     * @this {DebuggerPDP10}
+     * @param {DbgAddrPDP10} dbgAddr
+     * @return {string} default base representation of the address
+     */
+    toStrAddr(dbgAddr)
+    {
+        return this.toStrOffset(dbgAddr.addr);
+    }
+
+    /**
+     * toStrWord(w)
+     *
+     * @this {DebuggerPDP10}
+     * @param {number} w (up to, but not including, WORD_LIMIT)
+     * @return {string} octal representation of the 36-bit word, as two 18-bit values
+     */
+    toStrWord(w)
+    {
+        /*
+         * ADDR_LIMIT is not derived from WORD_LIMIT; we're just taking advantage of the fact
+         * that ADDR_LIMIT happens to be exactly half of WORD_LIMIT, and they are both powers of two.
+         */
+        return this.toStrBase(w / PDP10.ADDR_LIMIT, 18) + ' ' + this.toStrBase(w % PDP10.ADDR_LIMIT, 18);
+    }
+
+    /**
+     * dumpBlocks(aBlocks, sAddr)
+     *
+     * @this {DebuggerPDP10}
+     * @param {Array} aBlocks
+     * @param {string} [sAddr] (optional block address)
+     */
+    dumpBlocks(aBlocks, sAddr)
+    {
+        var addr = 0, i = 0, n = aBlocks.length;
+
+        if (sAddr) {
+            addr = this.getAddr(this.parseAddr(sAddr, this.dbgAddrData));
+            if (addr === PDP10.ADDR_INVALID) {
+                this.println("invalid address: " + sAddr);
+                return;
+            }
+            i = addr >>> this.bus.nBlockShift;
+            n = 1;
+        }
+
+        this.println("blockid   physical   blockaddr  used    size    type");
+        this.println("--------  ---------  ---------  ------  ------  ----");
+
+        var typePrev = -1, cPrev = 0;
+        while (n--) {
+            var block = aBlocks[i];
+            if (block.type == typePrev) {
+                if (!cPrev++) this.println("...");
+            } else {
+                typePrev = block.type;
+                var sType = MemoryPDP10.TYPE_NAMES[typePrev];
+                if (block) {
+                    this.println(Str.toHex(block.id, 8) + "  %" + Str.toHex(i << this.bus.nBlockShift, 8) + "  %" + Str.toHex(block.addr, 8) + "  " + Str.toHexWord(block.used) + "  " + Str.toHexWord(block.size) + "  " + sType);
+                }
+                if (typePrev != MemoryPDP10.TYPE.NONE) typePrev = -1;
+                cPrev = 0;
+            }
+            addr += this.bus.nBlockSize;
+            i++;
+        }
+    }
+
+    /**
+     * dumpBus(asArgs)
+     *
+     * Dumps Bus allocations.
+     *
+     * @this {DebuggerPDP10}
+     * @param {Array.<string>} asArgs (asArgs[0] is an optional block address)
+     */
+    dumpBus(asArgs)
+    {
+        this.dumpBlocks(this.bus.aBusBlocks, asArgs[0]);
+    }
+
+    /**
+     * dumpHistory(sPrev, sLines)
+     *
+     * If sLines is not a number, it can be a instruction filter.  However, for the moment, the only
+     * supported filter is "call", which filters the history buffer for all CALL and RET instructions
+     * from the specified previous point forward.
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} [sPrev] is a (decimal) number of instructions to rewind to (default is 10)
+     * @param {string} [sLines] is a (decimal) number of instructions to print (default is, again, 10)
+     */
+    dumpHistory(sPrev, sLines)
+    {
+        var sMore = "";
+        var cHistory = 0;
+        var iHistory = this.iInstructionHistory;
+        var aHistory = this.aInstructionHistory;
+
+        if (aHistory.length) {
+            var nPrev = +sPrev || this.nextHistory;
+            var nLines = +sLines || 10;
+
+            if (isNaN(nPrev)) {
+                nPrev = nLines;
+            } else {
+                sMore = "more ";
+            }
+
+            if (nPrev > aHistory.length) {
+                this.println("note: only " + aHistory.length + " available");
+                nPrev = aHistory.length;
+            }
+
+            iHistory -= nPrev;
+            if (iHistory < 0) {
+                /*
+                 * If the dbgAddr of the last aHistory element contains a valid selector, wrap around.
+                 */
+                if (aHistory[aHistory.length - 1].addr == null) {
+                    nPrev = iHistory + nPrev;
+                    iHistory = 0;
+                } else {
+                    iHistory += aHistory.length;
+                }
+            }
+
+            var aFilters = [];
+            if (sLines == "call") {
+                nLines = 100000;
+                aFilters = ["CALL"];
+            }
+
+            if (sPrev !== undefined) {
+                this.println(nPrev + " instructions earlier:");
+            }
+
+            /*
+             * TODO: The following is necessary to prevent dumpHistory() from causing additional (or worse, recursive)
+             * faults due to segmented addresses that are no longer valid, but the only alternative is to dramatically
+             * increase the amount of memory used to store instruction history (eg, storing copies of all the instruction
+             * bytes alongside the execution addresses).
+             *
+             * For now, we're living dangerously, so that our history dumps actually work.
+             *
+             *      this.nSuppressBreaks++;
+             *
+             * If you re-enable this protection, be sure to re-enable the decrement below, too.
+             */
+            while (nLines > 0 && iHistory != this.iInstructionHistory) {
+
+                var dbgAddr = aHistory[iHistory++];
+                if (dbgAddr.addr == null) break;
+
+                /*
+                 * We must create a new dbgAddr from the address in aHistory, because dbgAddr was
+                 * a reference, not a copy, and we don't want getInstruction() modifying the original.
+                 */
+                var dbgAddrNew = this.newAddr(dbgAddr.addr);
+
+                var sComment = "history";
+                var nSequence = nPrev--;
+
+                /*
+                 * TODO: Need to some UI to control whether cycle counts are displayed as part of the history.
+                 * It's currently disabled in checkInstruction(), so it's disable here, too.
+                 *
+                if (DEBUG && dbgAddr.cycleCount != null) {
+                    sComment = "cycles";
+                    nSequence = dbgAddr.cycleCount;
+                }
+                 */
+
+                var sInstruction = this.getInstruction(dbgAddrNew, sComment, nSequence);
+
+                if (!aFilters.length || sInstruction.indexOf(aFilters[0]) >= 0) {
+                    this.println(sInstruction);
+                }
+
+                /*
+                 * If there were OPERAND or ADDRESS overrides on the previous instruction, getInstruction()
+                 * will have automatically disassembled additional bytes, so skip additional history entries.
+                 */
+                if (dbgAddrNew.cOverrides) {
+                    iHistory += dbgAddrNew.cOverrides; nLines -= dbgAddrNew.cOverrides; nPrev -= dbgAddrNew.cOverrides;
+                }
+
+                if (iHistory >= aHistory.length) iHistory = 0;
+                this.nextHistory = nPrev;
+                cHistory++;
+                nLines--;
+            }
+            /*
+             * See comments above.
+             *
+             *      this.nSuppressBreaks--;
+             */
+        }
+
+        if (!cHistory) {
+            this.println("no " + sMore + "history available");
+            this.nextHistory = undefined;
+        }
+    }
+
+    /**
+     * messageInit(sEnable)
+     *
+     * @this {DebuggerPDP10}
+     * @param {string|undefined} sEnable contains zero or more message categories to enable, separated by '|'
+     */
+    messageInit(sEnable)
+    {
+        this.dbg = this;
+        this.bitsMessage = this.bitsWarning = MessagesPDP10.FAULT | MessagesPDP10.WARN;
+        this.sMessagePrev = null;
+        this.aMessageBuffer = [];
+        /*
+         * Internally, we use "key" instead of "keys", since the latter is a method on JavasScript objects,
+         * but externally, we allow the user to specify "keys"; "kbd" is also allowed as shorthand for "keyboard".
+         */
+        var aEnable = this.parseCommand(sEnable.replace("keys","key").replace("kbd","keyboard"), false, '|');
+        if (aEnable.length) {
+            for (var m in MessagesPDP10.CATEGORIES) {
+                if (Usr.indexOf(aEnable, m) >= 0) {
+                    this.bitsMessage |= MessagesPDP10.CATEGORIES[m];
+                    this.println(m + " messages enabled");
+                }
+            }
+        }
+    }
+
+    /**
+     * messageDump(bitMessage, fnDumper)
+     *
+     * @this {DebuggerPDP10}
+     * @param {number} bitMessage is one Messages category flag
+     * @param {function(Array.<string>)} fnDumper is a function the Debugger can use to dump data for that category
+     * @return {boolean} true if successfully registered, false if not
+     */
+    messageDump(bitMessage, fnDumper)
+    {
+        for (var m in MessagesPDP10.CATEGORIES) {
+            if (bitMessage == MessagesPDP10.CATEGORIES[m]) {
+                this.afnDumpers[m] = fnDumper;
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * getRegIndex(sReg, off)
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} sReg
+     * @param {number} [off] optional offset into sReg
+     * @return {number} register index, or -1 if not found
+     */
+    getRegIndex(sReg, off)
+    {
+        return DebuggerPDP10.REGNAMES.indexOf(sReg.toUpperCase());
+    }
+
+    /**
+     * getRegName(iReg)
+     *
+     * @this {DebuggerPDP10}
+     * @param {number} iReg (0-7; not used for other registers)
+     * @return {string}
+     */
+    getRegName(iReg)
+    {
+        return DebuggerPDP10.REGNAMES[iReg] || "";
+    }
+
+    /**
+     * getRegValue(iReg)
+     *
+     * @this {DebuggerPDP10}
+     * @param {number} iReg
+     * @return {number|undefined}
+     */
+    getRegValue(iReg)
+    {
+        var value;
+        var cpu = this.cpu;
+        switch(iReg) {
+        case DebuggerPDP10.REGS.PC:
+            value = cpu.getPC();
+            break;
+        case DebuggerPDP10.REGS.RA:
+            value = cpu.regRA;
+            break;
+        case DebuggerPDP10.REGS.EA:
+            value = cpu.regEA;
+            break;
+        case DebuggerPDP10.REGS.PS:
+            value = cpu.getPS();
+            break;
+        case DebuggerPDP10.REGS.OV:
+            value = (cpu.regPS & PDP10.PSFLAG.AROV)? 1 : 0;
+            break;
+        case DebuggerPDP10.REGS.C0:
+            value = (cpu.regPS & PDP10.PSFLAG.CRY0)? 1 : 0;
+            break;
+        case DebuggerPDP10.REGS.C1:
+            value = (cpu.regPS & PDP10.PSFLAG.CRY1)? 1 : 0;
+            break;
+        case DebuggerPDP10.REGS.BI:
+            value = (cpu.regPS & PDP10.PSFLAG.BIS)? 1 : 0;
+            break;
+        case DebuggerPDP10.REGS.ND:
+            value = (cpu.regPS & PDP10.PSFLAG.DCK)? 1 : 0;
+            break;
+        case DebuggerPDP10.REGS.PD:
+            value = (cpu.regPS & PDP10.PSFLAG.PDOV)? 1 : 0;
+            break;
+        }
+        return value;
+    }
+
+    /**
+     * setRegValue(iReg, value)
+     *
+     * @this {DebuggerPDP10}
+     * @param {number} iReg
+     * @param {number} value
+     */
+    setRegValue(iReg, value)
+    {
+        var flag = 0;
+        var cpu = this.cpu;
+
+        switch(iReg) {
+        case DebuggerPDP10.REGS.PC:
+            cpu.setPC(value);
+            this.setAddr(this.dbgAddrCode, cpu.getPC());
+            break;
+        case DebuggerPDP10.REGS.PS:
+            cpu.setPS(value);
+            break;
+        case DebuggerPDP10.REGS.OV:
+            flag = PDP10.PSFLAG.AROV;
+            break;
+        case DebuggerPDP10.REGS.C0:
+            flag = PDP10.PSFLAG.CRY0;
+            break;
+        case DebuggerPDP10.REGS.C1:
+            flag = PDP10.PSFLAG.CRY1;
+            break;
+        case DebuggerPDP10.REGS.BI:
+            flag = PDP10.PSFLAG.BIS;
+            break;
+        case DebuggerPDP10.REGS.ND:
+            flag = PDP10.PSFLAG.DCK;
+            break;
+        case DebuggerPDP10.REGS.PD:
+            flag = PDP10.PSFLAG.PDOV;
+            break;
+        }
+        if (flag) {
+            if (value) {
+                cpu.regPS |= flag;
+            } else {
+                cpu.regPS &= ~flag;
+            }
+        }
+    }
+
+    /**
+     * replaceRegs(s)
+     *
+     * TODO: Implement or eliminate.
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} s
+     * @return {string}
+     */
+    replaceRegs(s)
+    {
+        return s;
+    }
+
+    /**
+     * message(sMessage, fAddress)
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} sMessage is any caller-defined message string
+     * @param {boolean} [fAddress] is true to display the current address
+     */
+    message(sMessage, fAddress)
+    {
+        if (fAddress) {
+            sMessage += " @" + this.toStrAddr(this.newAddr(this.cpu.getLastPC()));
+        }
+
+        if (this.sMessagePrev && sMessage == this.sMessagePrev) return;
+        this.sMessagePrev = sMessage;
+
+        if (this.bitsMessage & MessagesPDP10.BUFFER) {
+            this.aMessageBuffer.push(sMessage);
+            return;
+        }
+
+        var fRunning;
+        if ((this.bitsMessage & MessagesPDP10.HALT) && this.cpu && (fRunning = this.cpu.isRunning()) || this.isBusy(true)) {
+            this.stopCPU();
+            if (fRunning) sMessage += " (cpu halted)";
+        }
+
+        this.println(sMessage); // + " (" + this.cpu.getCycles() + " cycles)"
+
+        /*
+         * We have no idea what the frequency of println() calls might be; all we know is that they easily
+         * screw up the CPU's careful assumptions about cycles per burst.  So we call yieldCPU() after every
+         * message, to effectively end the current burst and start fresh.
+         *
+         * TODO: See CPUPDP10.calcStartTime() for a discussion of why we might want to call yieldCPU() *before*
+         * we display the message.
+         */
+        if (this.cpu) this.cpu.yieldCPU();
+    }
+
+    /**
+     * init()
+     *
+     * @this {DebuggerPDP10}
+     * @param {boolean} [fAutoStart]
+     */
+    init(fAutoStart)
+    {
+        this.fInit = true;
+        this.println("Type ? for help with PDPjs Debugger commands");
+        this.updateStatus();
+        if (!fAutoStart) this.setFocus();
+        if (this.sInitCommands) {
+            var sCmds = this.sInitCommands;
+            this.sInitCommands = null;
+            this.doCommands(sCmds, true);
+        }
+    }
+
+    /**
+     * historyInit(fQuiet)
+     *
+     * This function is intended to be called by the constructor, reset(), addBreakpoint(), findBreakpoint()
+     * and any other function that changes the checksEnabled() criteria used to decide whether checkInstruction()
+     * should be called.
+     *
+     * That is, if the history arrays need to be allocated and haven't already been allocated, then allocate them,
+     * and if the arrays are no longer needed, then deallocate them.
+     *
+     * @this {DebuggerPDP10}
+     * @param {boolean} [fQuiet]
+     */
+    historyInit(fQuiet)
+    {
+        var i;
+        if (!this.checksEnabled()) {
+            if (this.aInstructionHistory && this.aInstructionHistory.length && !fQuiet) {
+                this.println("instruction history buffer freed");
+            }
+            this.iInstructionHistory = 0;
+            this.aInstructionHistory = [];
+            return;
+        }
+        if (!this.aInstructionHistory || !this.aInstructionHistory.length) {
+            this.aInstructionHistory = new Array(DebuggerPDP10.HISTORY_LIMIT);
+            for (i = 0; i < this.aInstructionHistory.length; i++) {
+                /*
+                 * Preallocate dummy Addr (Array) objects in every history slot, so that
+                 * checkInstruction() doesn't need to call newAddr() on every slot update.
+                 */
+                this.aInstructionHistory[i] = this.newAddr();
+            }
+            this.iInstructionHistory = 0;
+            if (!fQuiet) {
+                this.println("instruction history buffer allocated");
+            }
+        }
+    }
+
+    /**
+     * startCPU(fUpdateFocus, fQuiet)
+     *
+     * @this {DebuggerPDP10}
+     * @param {boolean} [fUpdateFocus] is true to update focus
+     * @param {boolean} [fQuiet]
+     * @return {boolean} true if run request successful, false if not
+     */
+    startCPU(fUpdateFocus, fQuiet)
+    {
+        if (!this.checkCPU(fQuiet)) return false;
+        this.cpu.startCPU(fUpdateFocus);
+        return true;
+    }
+
+    /**
+     * stepCPU(nCycles, fRegs, fUpdateDisplays)
+     *
+     * @this {DebuggerPDP10}
+     * @param {number} nCycles (0 for one instruction without checking breakpoints)
+     * @param {boolean|null} [fRegs] is true to display registers after step (default is false; use null for previous setting)
+     * @param {boolean} [fUpdateDisplays] is false to disable Computer display updates (default is true)
+     * @return {boolean}
+     */
+    stepCPU(nCycles, fRegs, fUpdateDisplays)
+    {
+        if (!this.checkCPU()) return false;
+
+        var sCmd = "";
+        if (fRegs === null) {
+            fRegs = (!this.sCmdTracePrev || this.sCmdTracePrev == "tr");
+            sCmd = fRegs? "tr" : "t";
+        }
+
+        this.nCycles = 0;
+
+        if (!nCycles) {
+            /*
+             * When single-stepping, the CPU won't call checkInstruction(), which is good for
+             * avoiding breakpoints, but bad for instruction data collection if checks are enabled.
+             * So we call checkInstruction() ourselves.
+             */
+            if (this.checksEnabled()) this.checkInstruction(this.cpu.getPC(), 0);
+        }
+        /*
+         * For our typically tiny bursts (usually single instructions), mimic what runCPU() does.
+         */
+        try {
+            nCycles = this.cpu.getBurstCycles(nCycles);
+            var nCyclesStep = this.cpu.stepCPU(nCycles);
+            if (nCyclesStep > 0) {
+                this.cpu.updateTimers(nCyclesStep);
+                this.nCycles += nCyclesStep;
+                this.cpu.addCycles(nCyclesStep, true);
+                this.cpu.updateChecksum(nCyclesStep);
+                this.cInstructions++;
+            }
+        }
+        catch(exception) {
+            /*
+             * We assume that any numeric exception was explicitly thrown by the CPU to interrupt the
+             * current instruction.  For all other exceptions, we attempt a stack dump.
+             */
+            if (typeof exception != "number") {
+                var e = exception;
+                this.nCycles = 0;
+                this.cpu.setError(e.stack || e.message);
+            }
+        }
+
+        /*
+         * Because we called cpu.stepCPU() and not cpu.startCPU(), we must nudge the Computer's update code,
+         * and then update our own state.  Normally, the only time fUpdateDisplays will be false is when doTrace()
+         * is calling us in a loop, in which case it will perform its own updateDisplays() when it's done.
+         */
+        if (fUpdateDisplays !== false) {
+            if (this.panel) this.panel.stop();
+            this.cmp.updateDisplays(-1);
+        }
+
+        this.updateStatus(fRegs || false, sCmd);
+        return (this.nCycles > 0);
+    }
+
+    /**
+     * stopCPU()
+     *
+     * @this {DebuggerPDP10}
+     * @param {boolean} [fComplete]
+     */
+    stopCPU(fComplete)
+    {
+        if (this.cpu) this.cpu.stopCPU(fComplete);
+    }
+
+    /**
+     * updateStatus(fRegs, sCmd)
+     *
+     * @this {DebuggerPDP10}
+     * @param {boolean} [fRegs] (default is true)
+     * @param {string} [sCmd]
+     */
+    updateStatus(fRegs = true, sCmd)
+    {
+        if (!this.fInit) return;
+
+        if (sCmd) {
+            this.println(DebuggerPDP10.PROMPT + sCmd);
+        }
+
+        this.setAddr(this.dbgAddrCode, this.cpu.getPC());
+
+        /*
+         * this.nStep used to be a simple boolean, but now it's 0 (or undefined)
+         * if inactive, 1 if stepping over an instruction without a register dump, or 2
+         * if stepping over an instruction with a register dump.
+         */
+        if (!fRegs || this.nStep == 1) {
+            this.doUnassemble();
+        } else {
+            this.doRegisters();
+        }
+    }
+
+    /**
+     * checkCPU(fQuiet)
+     *
+     * Make sure the CPU is ready (finished initializing), powered, not already running, and not in an error state.
+     *
+     * @this {DebuggerPDP10}
+     * @param {boolean} [fQuiet]
+     * @return {boolean}
+     */
+    checkCPU(fQuiet)
+    {
+        if (!this.cpu || !this.cpu.isReady() || !this.cpu.isPowered() || this.cpu.isRunning()) {
+            if (!fQuiet) this.println("cpu busy or unavailable, command ignored");
+            return false;
+        }
+        return !this.cpu.isError();
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {DebuggerPDP10}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            /*
+             * Because Debugger save/restore support is somewhat limited (and didn't always exist),
+             * we deviate from the typical save/restore design pattern: instead of reset OR restore,
+             * we always reset and then perform a (potentially limited) restore.
+             */
+            this.reset(true);
+
+            // this.println(data? "resuming" : "powering up");
+
+            if (data) {
+                return this.restore(data);
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {DebuggerPDP10}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean}
+     */
+    powerDown(fSave, fShutdown)
+    {
+        if (fShutdown) this.println(fSave? "suspending" : "shutting down");
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * reset(fQuiet)
+     *
+     * This is a notification handler, called by the Computer, to inform us of a reset.
+     *
+     * @this {DebuggerPDP10}
+     * @param {boolean} fQuiet (true only when called from our own powerUp handler)
+     */
+    reset(fQuiet)
+    {
+        this.historyInit();
+        this.cInstructions = this.cInstructionsStart = 0;
+        this.sMessagePrev = null;
+        this.nCycles = 0;
+        this.setAddr(this.dbgAddrCode, this.cpu.getPC());
+        /*
+         * fRunning is set by start() and cleared by stop().  In addition, we clear
+         * it here, so that if the CPU is reset while running, we can prevent stop()
+         * from unnecessarily dumping the CPU state.
+         */
+        this.flags.running = false;
+        this.clearTempBreakpoint();
+        if (!fQuiet) this.updateStatus();
+    }
+
+    /**
+     * save()
+     *
+     * This implements (very rudimentary) save support for the Debugger component.
+     *
+     * @this {DebuggerPDP10}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, this.packAddr(this.dbgAddrCode));
+        state.set(1, this.packAddr(this.dbgAddrData));
+        state.set(2, this.packAddr(this.dbgAddrAssemble));
+        state.set(3, [this.aPrevCmds, this.fAssemble, this.bitsMessage]);
+        state.set(4, this.aSymbolTable);
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements (very rudimentary) restore support for the Debugger component.
+     *
+     * @this {DebuggerPDP10}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        var i = 0;
+        if (data[3] !== undefined) {
+            this.dbgAddrCode = this.unpackAddr(data[i++]);
+            this.dbgAddrData = this.unpackAddr(data[i++]);
+            this.dbgAddrAssemble = this.unpackAddr(data[i++]);
+            this.aPrevCmds = data[i][0];
+            if (typeof this.aPrevCmds == "string") this.aPrevCmds = [this.aPrevCmds];
+            this.fAssemble = data[i][1];
+            this.bitsMessage |= data[i][2];     // keep our current message bits set, and simply "add" any extra bits defined by the saved state
+        }
+        if (data[4]) this.aSymbolTable = data[4];
+        return true;
+    }
+
+    /**
+     * start(ms, nCycles)
+     *
+     * This is a notification handler, called by the Computer, to inform us the CPU has started.
+     *
+     * @this {DebuggerPDP10}
+     * @param {number} ms
+     * @param {number} nCycles
+     */
+    start(ms, nCycles)
+    {
+        if (!this.nStep) this.println("running");
+        this.flags.running = true;
+        this.msStart = ms;
+        this.nCyclesStart = nCycles;
+    }
+
+    /**
+     * stop(ms, nCycles)
+     *
+     * This is a notification handler, called by the Computer, to inform us the CPU has now stopped.
+     *
+     * @this {DebuggerPDP10}
+     * @param {number} ms
+     * @param {number} nCycles
+     */
+    stop(ms, nCycles)
+    {
+        if (this.flags.running) {
+            this.flags.running = false;
+            this.nCycles = nCycles - this.nCyclesStart;
+            if (!this.nStep) {
+                var sStopped = "stopped";
+                if (this.nCycles) {
+                    var msTotal = ms - this.msStart;
+                    var nCyclesPerSecond = (msTotal > 0? Math.round(this.nCycles * 1000 / msTotal) : 0);
+                    sStopped += " (";
+                    if (this.checksEnabled()) {
+                        sStopped += this.cInstructions + " instructions, ";
+                        /*
+                         * $ops displays progress by calculating cInstructions - cInstructionsStart, so before
+                         * zeroing cInstructions, we should subtract cInstructions from cInstructionsStart (since
+                         * we're effectively subtracting cInstructions from cInstructions as well).
+                         */
+                        this.cInstructionsStart -= this.cInstructions;
+                        this.cInstructions = 0;
+                    }
+                    sStopped += this.nCycles + " cycles, " + msTotal + " ms, " + nCyclesPerSecond + " hz)";
+                } else {
+                    if (this.messageEnabled(MessagesPDP10.HALT)) {
+                        /*
+                         * It's possible the user is trying to 'g' past a fault that was blocked by helpCheckFault()
+                         * for the Debugger's benefit; if so, it will continue to be blocked, so try displaying a helpful
+                         * message (another helpful tip would be to simply turn off the "halt" message category).
+                         */
+                        sStopped += " (use the 't' command to execute blocked faults)";
+                    }
+                }
+                this.println(sStopped);
+            }
+            this.updateStatus(true);
+            this.setFocus();
+            this.clearTempBreakpoint(this.cpu.getPC());
+            this.sMessagePrev = null;
+        }
+    }
+
+    /**
+     * checksEnabled(fRelease)
+     *
+     * This "check" function is called by the CPU; we indicate whether or not every instruction needs to be checked.
+     *
+     * Originally, this returned true even when there were only read and/or write breakpoints, but those breakpoints
+     * no longer require the intervention of checkInstruction(); the Bus component automatically swaps in/out appropriate
+     * "checked" Memory access functions to deal with those breakpoints in the corresponding Memory blocks.  So I've
+     * simplified the test below.
+     *
+     * @this {DebuggerPDP10}
+     * @param {boolean} [fRelease] is true for release criteria only; default is false (any criteria)
+     * @return {boolean} true if every instruction needs to pass through checkInstruction(), false if not
+     */
+    checksEnabled(fRelease)
+    {
+        return ((DEBUG && !fRelease)? true : (this.aBreakExec.length > 1 || !!this.nBreakInstructions));
+    }
+
+    /**
+     * checkInstruction(addr, nState)
+     *
+     * This "check" function is called by the CPU to inform us about the next instruction to be executed,
+     * giving us an opportunity to look for "exec" breakpoints and update opcode instruction history.
+     *
+     * @this {DebuggerPDP10}
+     * @param {number} addr
+     * @param {number} nState is < 0 if stepping, 0 if starting, or > 0 if running
+     * @return {boolean} true if breakpoint hit, false if not
+     */
+    checkInstruction(addr, nState)
+    {
+        var opCode = -1;
+        var cpu = this.cpu;
+
+        /*
+         * If opHalt() calls our stopInstruction() function, it will effectively rewind the PC back to the HALT,
+         * purely for our debugging benefit, so we must compensate for that here by advancing the PC past the HALT
+         * when the machine starts up again.
+         */
+        if (!nState) {
+            opCode = this.cpu.readWord(addr);
+            if ((opCode >> PDP10.OPCODE.A_SHIFT) == PDP10.OPCODE.HALT && this.cpu.getLastPC() == addr) {
+                addr = this.cpu.advancePC(1);
+            }
+        }
+
+        /*
+         * If the CPU stopped on a breakpoint, we're not interested in stopping again if the machine is starting.
+         */
+        if (nState > 0) {
+            if (this.nBreakInstructions) {
+                if (!--this.nBreakInstructions) return true;
+            }
+            if (this.checkBreakpoint(addr, 1, this.aBreakExec)) {
+                return true;
+            }
+        }
+
+        /*
+         * The rest of the instruction tracking logic can only be performed if historyInit() has allocated the
+         * necessary data structures.  Note that there is no explicit UI for enabling/disabling history, other than
+         * adding/removing breakpoints, simply because it's breakpoints that trigger the call to checkInstruction();
+         * well, OK, and a few other things now, like enabling MessagesPDP10.INT messages.
+         */
+        if (nState >= 0 && this.aInstructionHistory.length) {
+            this.cInstructions++;
+            if (opCode < 0) {
+                opCode = this.cpu.readWord(addr);
+            }
+            if (opCode >= 0) {
+                var dbgAddr = this.aInstructionHistory[this.iInstructionHistory];
+                this.setAddr(dbgAddr, addr);
+                // if (DEBUG) dbgAddr.cycleCount = cpu.getCycles();
+                if (++this.iInstructionHistory == this.aInstructionHistory.length) this.iInstructionHistory = 0;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * findInstruction(opCode, fOperands)
+     *
+     * @this {DebuggerPDP10}
+     * @param {number} opCode
+     * @param {boolean} [fOperands] (optional; default is true)
+     * @return {string}
+     */
+    findInstruction(opCode, fOperands = true)
+    {
+        var opNum, opMask, aModes, iMode = 0;
+        var op = (opCode / PDP10.OPCODE.OP_SCALE)|0;
+
+        for (var mask in DebuggerPDP10.OPTABLE) {
+            var opMasks = DebuggerPDP10.OPTABLE[mask];
+            opNum = opMasks[op & mask];
+            if (opNum) {
+                opMask = +mask;
+                /*
+                 * When we extracted op from opCode using OP_SCALE, we included 6 additional bits
+                 * to help distinguish OPIO instructions from non-OPIO instructions.  But for the
+                 * following tests, we don't need those bits, so we get rid of them now.
+                 */
+                op >>= 6;
+                switch(opMask) {
+                case PDP10.OPCODE.OPMODE:
+                    aModes = DebuggerPDP10.OPMODES;
+                    iMode = (op & 3);
+                    break;
+                case PDP10.OPCODE.OPCOMP:
+                    aModes = DebuggerPDP10.OPCOMPS;
+                    iMode = (op & 7);
+                    break;
+                case PDP10.OPCODE.OPTEST:
+                    aModes = DebuggerPDP10.OPTESTS;
+                    iMode = ((op & 0o60) >> 2) | ((op & 0o6) >> 1);
+                    break;
+                }
+                break;
+            }
+        }
+
+        var sMode = aModes && aModes[iMode] || "";
+        if (sMode == "S" && opNum > DebuggerPDP10.OPS.MOVM) sMode = "B";
+        var sOperation = DebuggerPDP10.OPNAMES[opNum || 0] + sMode;
+
+        if (!fOperands) {
+            if (!opNum) sOperation = "";
+        } else {
+            if (!opNum) {
+                sOperation = Str.pad(sOperation, 8) + this.toStrWord(opCode);
+            } else {
+                var n, sOperand;
+                if (opMask == PDP10.OPCODE.OPIO) {
+                    n = (opCode / PDP10.OPCODE.IO_SCALE) & PDP10.OPCODE.IO_MASK;
+                    sOperand = this.toStrBase(n, -1);
+                } else {
+                    n = (opCode >> PDP10.OPCODE.A_SHIFT) & PDP10.OPCODE.A_MASK;
+                    sOperand = this.toStrBase(n, -1);
+                    for (var m = 0; sOperand && m < DebuggerPDP10.ALTOPS.length; m++) {
+                        if (opNum == DebuggerPDP10.ALTOPS[m][0]) {
+                            var opAlt = DebuggerPDP10.ALTOPS[m][n];
+                            if (opAlt) {
+                                sOperation = DebuggerPDP10.OPNAMES[opAlt];
+                                sOperand = "";
+                                break;
+                            }
+                        }
+                    }
+                }
+                sOperation = Str.pad(sOperation, 8) + (sOperand? sOperand + ',' : "");
+                if (opCode & PDP10.OPCODE.I_FIELD) sOperation += '@';
+                sOperation += this.toStrBase(opCode & PDP10.OPCODE.Y_MASK, -1);
+                var i = (opCode >> PDP10.OPCODE.X_SHIFT) & PDP10.OPCODE.X_MASK;
+                if (i) sOperation += '(' + this.toStrBase(i, -1) + ')';
+            }
+        }
+        return sOperation;
+    }
+
+    /**
+     * getInstruction(dbgAddr, sComment, nSequence)
+     *
+     * Get the next instruction, by decoding the opcode and any operands.
+     *
+     * @this {DebuggerPDP10}
+     * @param {DbgAddrPDP10} dbgAddr
+     * @param {string} [sComment] is an associated comment
+     * @param {number|null} [nSequence] is an associated sequence number, undefined if none
+     * @return {string} (and dbgAddr is updated to the next instruction)
+     */
+    getInstruction(dbgAddr, sComment, nSequence)
+    {
+        var dbgAddrOp = this.newAddr(dbgAddr.addr);
+        var opCode = this.getWord(dbgAddr, 1);
+        var sOperation = this.findInstruction(opCode);
+
+        var sOpcodes = "";
+        var sLine = this.toStrAddr(dbgAddrOp) + ":";
+        if (dbgAddrOp.addr !== PDP10.ADDR_INVALID && dbgAddr.addr !== PDP10.ADDR_INVALID) {
+            do {
+                var w = this.getWord(dbgAddrOp, 1);
+                sOpcodes += ' ' + this.toStrWord(w);
+                if (dbgAddrOp.addr == null) break;
+            } while (dbgAddrOp.addr != dbgAddr.addr);
+        }
+
+        sLine += Str.pad(sOpcodes, 16) + sOperation;
+
+        if (sComment) {
+            sLine = Str.pad(sLine, 48) + ';' + (sComment || "");
+            if (!this.cpu.flags.checksum) {
+                sLine += (nSequence != null? '=' + nSequence.toString() : "");
+            } else {
+                var nCycles = this.cpu.getCycles();
+                sLine += "cycles=" + nCycles.toString() + " cs=" + Str.toHex(this.cpu.nChecksum);
+            }
+        }
+        return sLine;
+    }
+
+    /**
+     * parseInstruction(sOpcode, sOperands, addr, aUndefined)
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} sOpcode
+     * @param {string} [sOperands]
+     * @param {number} [addr] of memory where this instruction is being assembled
+     * @param {Array} [aUndefined]
+     * @return {number} (opcode, or -1 if unrecognized instruction)
+     */
+    parseInstruction(sOpcode, sOperands, addr, aUndefined)
+    {
+        var opCode = -1;
+        var opMask, opNum;
+
+        if (!sOpcode) {
+            /*
+             * MACRO-10 also allows instructions to be assembled without an opcode (ie, just an address expression),
+             * so if that's all we have, skip the opcode parsing.
+             */
+            if (sOperands) opCode = opMask = 0;
+        }
+        else {
+            var sMnemonic = sOpcode.toUpperCase();
+            /*
+             * Perform any alternate mnemonic substitutions first
+             */
+            for (var m = 0; m < DebuggerPDP10.ALTOPS.length; m++) {
+                for (var n in DebuggerPDP10.ALTOPS[m]) {
+                    if (!+n) continue;
+                    opNum = DebuggerPDP10.ALTOPS[m][n];
+                    if (sMnemonic == DebuggerPDP10.OPNAMES[opNum]) {
+                        sMnemonic = DebuggerPDP10.OPNAMES[DebuggerPDP10.ALTOPS[m][0]];
+                        if (sOperands) sOperands = this.toStrBase(+n) + ',' + sOperands;
+                        break;
+                    }
+                }
+            }
+            for (var mask in DebuggerPDP10.OPTABLE) {
+
+                var aModes;
+                opMask = +mask;
+                var opMasks = DebuggerPDP10.OPTABLE[mask];
+
+                switch (opMask) {
+                case PDP10.OPCODE.OPMODE:
+                    aModes = DebuggerPDP10.OPMODES;
+                    break;
+                case PDP10.OPCODE.OPCOMP:
+                    aModes = DebuggerPDP10.OPCOMPS;
+                    break;
+                case PDP10.OPCODE.OPTEST:
+                    aModes = DebuggerPDP10.OPTESTS;
+                    break;
+                default:
+                    aModes = [""];
+                    break;
+                }
+                var opMode = 0;
+                for (var op in opMasks) {
+                    opNum = opMasks[op];
+                    for (var iMode = 0; iMode < aModes.length; iMode++) {
+
+                        var sMode = aModes[iMode];
+                        if (sMode == "S" && opNum > DebuggerPDP10.OPS.MOVM) sMode = "B";
+                        var sCandidate = DebuggerPDP10.OPNAMES[opNum] + sMode;
+
+                        if (sMnemonic == sCandidate) {
+                            if (opMask != PDP10.OPCODE.OPTEST) {
+                                opMode = iMode;
+                            } else {
+                                opMode = ((iMode & 0o3) << 1) | ((iMode & 0o14) << 2);
+                            }
+                            opCode = (op | (opMode << 6)) * PDP10.OPCODE.OP_SCALE;
+                            break;
+                        }
+                    }
+                    if (opCode >= 0) break;
+                }
+                if (opCode >= 0) break;
+            }
+            /*
+             * MACRO-10 also allows instructions to be assembled without an opcode (ie, just an address expression),
+             * so we'll give that a try next (as long as we're not mashing two symbols together).
+             */
+            if (opCode < 0 && (!sOperands || !sOperands.match(/^[0-9A-Z$%.?]/i))) {
+                sOperands = sOpcode + sOperands;
+                sOpcode = "";
+                opCode = 0;
+            }
+        }
+
+        if (opCode >= 0) {
+            if (sOperands) {
+
+                var aOperands = sOperands.split(',');
+                if (aOperands.length > 2) {
+                    if (!aUndefined) this.println("too many operands: " + sOperands);
+                    aOperands.length = 0;
+                    opCode = -1;
+                }
+
+                for (var i = 0; i < aOperands.length; i++) {
+
+                    var sOperand = aOperands[i].trim();
+                    if (!sOperand) continue;
+
+                    var match = sOperand.match(/(@?)([^(]*)\(?([^)]*)\)?/);
+                    if (!match) {
+                        if (!aUndefined) this.println("unknown operand: " + sOperand);
+                        opCode = -1;
+                        break;
+                    }
+
+                    /*
+                     * If the operand contains an indirection operator (@) and/or index register (X), we parse those
+                     * first and update the indirect (I) bit and index (X) bits as appropriate.  The order is important,
+                     * because if we parse them AFTER parsing the address expression, we might lose an undefined symbol
+                     * indication, and if the caller needs to handle address fixups, that would be bad.
+                     */
+                    if (match[1]) opCode += PDP10.OPCODE.I_FIELD;
+
+                    sOperand = match[3];
+                    if (sOperand) {
+                        operand = this.parseExpression(sOperand, aUndefined);
+                        if (operand == undefined) {
+                            opCode = -1;
+                            break;
+                        }
+                        /*
+                         * Here's a fun tidbit from the April 1978 MACRO-10 manual, p. 4-5:
+                         *
+                         *      NOTE: To assemble the index, MACRO places the index register address in a fullword of storage,
+                         *      swaps its halfwords, and then adds the swapped word to the instruction word.
+                         *
+                         * Which means that an instruction like this (where AC is zero):
+                         *
+                         *        8839	037653	205 00 0 00 400000 		MOVSI	AC,(1B<^O<AC>>)	;INITIALIZE AC
+                         *
+                         * produces an instruction that does NOT use indexing at all, even though it is coded as such.  So my
+                         * simplistic masking of the index operand with PDP10.OPCODE.X_MASK, while logical, was completely wrong:
+                         *
+                         *      if (operand < 0 || operand > PDP10.OPCODE.X_MASK) {
+                         *          operand &= PDP10.OPCODE.X_MASK;
+                         *          if (MAXDEBUG) this.println("index (" + sOperand + ") truncated to " + this.toStrBase(operand));
+                         *      }
+                         *      opCode += operand << PDP10.OPCODE.X_SHIFT;
+                         */
+                        operand = PDP10.SWAP(this.truncate(operand, 36, true));
+                        opCode += operand;
+                    }
+
+                    sOperand = match[2];
+                    if (i || aOperands.length == 1) {
+                        /*
+                         * If this is NOT the first operand, replace all periods NOT preceded by a digit with the current address.
+                         */
+                        if (!sOperand) {
+                            sOperand = "0";
+                        } else {
+                            sOperand = sOperand.replace(/(^|[^0-9])\./g, "$1" + this.toStrOffset(addr));
+                        }
+                    }
+
+                    var operand = this.parseExpression(sOperand, aUndefined);
+                    if (operand == undefined) {
+                        opCode = -1;
+                        break;
+                    }
+
+                    if (!i && aOperands.length > 1) {
+                        if (opMask == PDP10.OPCODE.OPIO) {
+                            if (operand < 0 || operand > PDP10.OPCODE.IO_MASK) {
+                                operand &= PDP10.OPCODE.IO_MASK;
+                                if (MAXDEBUG) this.println("device code (" + sOperand + ") truncated to " + this.toStrBase(operand));
+                            }
+                            opCode += (operand * PDP10.OPCODE.IO_SCALE);
+                        }
+                        else {
+                            if (operand < 0 || operand > PDP10.OPCODE.A_MASK) {
+                                operand &= PDP10.OPCODE.A_MASK;
+                                if (MAXDEBUG) this.println("accumulator (" + sOperand + ") truncated to " + this.toStrBase(operand));
+                            }
+                            opCode += (operand << PDP10.OPCODE.A_SHIFT);
+                        }
+                        continue;
+                    }
+
+                    /*
+                     * I came across what I believe is a typo in the DEC "DAKAC" diagnostic:
+                     *
+                     *      CAME	[0,-1]		;PASS TEST IF C(AC)=0,,-1
+                     *
+                     * Based on the comment, it's clear what they really meant was either "[0,,-1]" or "[XWD 0,-1]".
+                     * However, they still got the desired result, which means when the assembler parses an mnemonic-less
+                     * instruction like "0,-1", it must truncate the second (address) operand.
+                     *
+                     * TODO: Determine if I should ALWAYS truncate.  I'm trying to retain the flexibility of allowing
+                     * a full 36-bit instruction to be encoded with a single numeric expression (ie, one operand).
+                     */
+                    if (sOpcode || i) {
+                        if (operand < 0 || operand > PDP10.OPCODE.Y_MASK) {
+                            operand &= PDP10.ADDR_MASK;
+                            if (MAXDEBUG) this.println("address (" + sOperand + ") truncated to " + this.toStrBase(operand));
+                        }
+                    }
+                    opCode += operand;
+                }
+            }
+            //
+            // TODO: Complain about missing operands only if we know the instruction requires them.
+            //
+            // else {
+            //     this.println("missing operand(s)");
+            //     opCode = -1;
+            // }
+        }
+
+        if (opCode < 0 && !aUndefined) {
+            this.println("unknown instruction: " + sOpcode + ' ' + sOperands);
+        }
+
+        return opCode;
+    }
+
+    /**
+     * stopInstruction(sMessage)
+     *
+     * TODO: Currently, the only way to prevent this call from stopping the CPU is when you're single-stepping.
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} [sMessage]
+     * @return {boolean} true if stopping is enabled, false if not
+     */
+    stopInstruction(sMessage)
+    {
+        var cpu = this.cpu;
+        if (cpu.isRunning()) {
+            cpu.setPC(this.cpu.getLastPC());
+            if (sMessage) this.println(sMessage);
+            this.stopCPU();
+            /*
+             * TODO: Review the appropriate-ness of throwing a bogus vector number in order to immediately stop
+             * the instruction.  It's handy, but it also means that we no longer actually return true, so callers
+             * of either stopInstruction() or undefinedInstruction() may have unreachable code paths.
+             */
+            throw -1;
+        }
+        return false;
+    }
+
+    /**
+     * undefinedInstruction(opCode)
+     *
+     * @this {DebuggerPDP10}
+     * @param {number} opCode
+     * @return {boolean} true if stopping is enabled, false if not
+     */
+    undefinedInstruction(opCode)
+    {
+        if (this.messageEnabled(MessagesPDP10.CPU)) {
+            this.printMessage("undefined opcode " + this.toStrBase(opCode), true, true);
+            return this.stopInstruction();  // allow the caller to step over it if they really want a trap generated
+        }
+        return false;
+    }
+
+    /**
+     * checkMemoryRead(addr, nb)
+     *
+     * This "check" function is called by a Memory block to inform us that a memory read occurred, giving us an
+     * opportunity to track the read if we want, and look for a matching "read" breakpoint, if any.
+     *
+     * In the "old days", it would be an error for this call to fail to find a matching Debugger breakpoint, but now
+     * Memory blocks have no idea whether the Debugger or the machine's Debug register(s) triggered this "checked" read.
+     *
+     * If we return true, we "trump" the machine's Debug register(s); false allows normal Debug register processing.
+     *
+     * @this {DebuggerPDP10}
+     * @param {number} addr
+     * @param {number} [nb] (# of bytes; default is 1)
+     * @return {boolean} true if breakpoint hit, false if not
+     */
+    checkMemoryRead(addr, nb)
+    {
+        if (this.checkBreakpoint(addr, nb || 1, this.aBreakRead)) {
+            this.stopCPU(false);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * checkMemoryWrite(addr, nb)
+     *
+     * This "check" function is called by a Memory block to inform us that a memory write occurred, giving us an
+     * opportunity to track the write if we want, and look for a matching "write" breakpoint, if any.
+     *
+     * In the "old days", it would be an error for this call to fail to find a matching Debugger breakpoint, but now
+     * Memory blocks have no idea whether the Debugger or the machine's Debug register(s) triggered this "checked" write.
+     *
+     * If we return true, we "trump" the machine's Debug register(s); false allows normal Debug register processing.
+     *
+     * @this {DebuggerPDP10}
+     * @param {number} addr
+     * @param {number} [nb] (# of bytes; default is 1)
+     * @return {boolean} true if breakpoint hit, false if not
+     */
+    checkMemoryWrite(addr, nb)
+    {
+        if (this.checkBreakpoint(addr, nb || 1, this.aBreakWrite)) {
+            this.stopCPU(false);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * clearBreakpoints()
+     *
+     * @this {DebuggerPDP10}
+     */
+    clearBreakpoints()
+    {
+        var i, dbgAddr, addr;
+        this.aBreakExec = ["bp"];
+        if (this.aBreakRead !== undefined) {
+            for (i = 1; i < this.aBreakRead.length; i++) {
+                dbgAddr = this.aBreakRead[i];
+                addr = this.getAddr(dbgAddr);
+                this.bus.removeMemBreak(addr, false);
+            }
+        }
+        this.aBreakRead = ["br"];
+        if (this.aBreakWrite !== undefined) {
+            for (i = 1; i < this.aBreakWrite.length; i++) {
+                dbgAddr = this.aBreakWrite[i];
+                addr = this.getAddr(dbgAddr);
+                this.bus.removeMemBreak(addr, true);
+            }
+        }
+        this.aBreakWrite = ["bw"];
+        /*
+         * nSuppressBreaks ensures we can't get into an infinite loop where a breakpoint lookup
+         * requires reading memory that triggers more memory reads, which triggers more breakpoint checks.
+         */
+        this.nSuppressBreaks = 0;
+        this.nBreakInstructions = 0;
+    }
+
+    /**
+     * addBreakpoint(aBreak, dbgAddr, fTemporary)
+     *
+     * In case you haven't already figured this out, all our breakpoint commands use the address
+     * to identify a breakpoint, not an incrementally assigned breakpoint index like other debuggers;
+     * see doBreak() for details.
+     *
+     * This has a few implications, one being that you CANNOT set more than one kind of breakpoint
+     * on a single address.  In practice, that's rarely a problem, because you can almost always set
+     * a different breakpoint on a neighboring address.
+     *
+     * Also, there is one exception to the "one address, one breakpoint" rule, and that involves
+     * temporary breakpoints (ie, one-time execution breakpoints that either a "p" or "g" command
+     * may create to step over a chunk of code).  Those breakpoints automatically clear themselves,
+     * so there usually isn't any need to refer to them using breakpoint commands.
+     *
+     * TODO: Consider supporting the more "traditional" breakpoint index syntax; the current
+     * address-based syntax was implemented solely for expediency and consistency.  At the same time,
+     * also consider a more WDEB386-like syntax, where "br" is used to set a variety of access-specific
+     * breakpoints, using modifiers like "r1", "r2", "w1", "w2, etc.
+     *
+     * @this {DebuggerPDP10}
+     * @param {Array} aBreak
+     * @param {DbgAddrPDP10} dbgAddr
+     * @param {boolean} [fTemporary]
+     * @return {boolean} true if breakpoint added, false if already exists
+     */
+    addBreakpoint(aBreak, dbgAddr, fTemporary)
+    {
+        var fSuccess = true;
+
+        // this.nSuppressBreaks++;
+
+        /*
+         * Instead of complaining that a breakpoint already exists (as we used to do), we now
+         * allow breakpoints to be re-set; this makes it easier to update any commands that may
+         * be associated with the breakpoint.
+         *
+         * The only exception: we DO allow a temporary breakpoint at an address where there may
+         * already be a breakpoint, so that you can easily step ("p" or "g") over such addresses.
+         */
+        if (!fTemporary) {
+            this.findBreakpoint(aBreak, dbgAddr, true, false, true);
+        }
+
+        if (aBreak != this.aBreakExec) {
+            var addr = this.getAddr(dbgAddr);
+            if (addr === PDP10.ADDR_INVALID) {
+                this.println("invalid address: " + this.toStrAddr(dbgAddr));
+                fSuccess = false;
+            } else {
+                var fWrite = (aBreak == this.aBreakWrite);
+                this.bus.addMemBreak(addr, fWrite);
+            }
+        }
+
+        if (fSuccess) {
+            aBreak.push(dbgAddr);
+            if (fTemporary) {
+                dbgAddr.fTemporary = true;
+            }
+            else {
+                this.printBreakpoint(aBreak, aBreak.length-1, "set");
+                this.historyInit();
+            }
+        }
+
+        // this.nSuppressBreaks--;
+
+        return fSuccess;
+    }
+
+    /**
+     * findBreakpoint(aBreak, dbgAddr, fRemove, fTemporary, fQuiet)
+     *
+     * @this {DebuggerPDP10}
+     * @param {Array} aBreak
+     * @param {DbgAddrPDP10} dbgAddr
+     * @param {boolean} [fRemove]
+     * @param {boolean} [fTemporary]
+     * @param {boolean} [fQuiet]
+     * @return {boolean} true if found, false if not
+     */
+    findBreakpoint(aBreak, dbgAddr, fRemove, fTemporary, fQuiet)
+    {
+        var fFound = false;
+        var addr = this.getAddr(dbgAddr);
+        for (var i = 1; i < aBreak.length; i++) {
+            var dbgAddrBreak = aBreak[i];
+            if (addr == this.getAddr(dbgAddrBreak)) {
+                if (!fTemporary || dbgAddrBreak.fTemporary) {
+                    fFound = true;
+                    if (fRemove) {
+                        if (!dbgAddrBreak.fTemporary && !fQuiet) {
+                            this.printBreakpoint(aBreak, i, "cleared");
+                        }
+                        aBreak.splice(i, 1);
+                        if (aBreak != this.aBreakExec) {
+                            var fWrite = (aBreak == this.aBreakWrite);
+                            this.bus.removeMemBreak(addr, fWrite);
+                        }
+                        /*
+                         * We'll mirror the logic in addBreakpoint() and leave the history buffer alone if this
+                         * was a temporary breakpoint.
+                         */
+                        if (!dbgAddrBreak.fTemporary) {
+                            this.historyInit();
+                        }
+                        break;
+                    }
+                    if (!fQuiet) this.printBreakpoint(aBreak, i, "exists");
+                    break;
+                }
+            }
+        }
+        return fFound;
+    }
+
+    /**
+     * listBreakpoints(aBreak)
+     *
+     * @this {DebuggerPDP10}
+     * @param {Array} aBreak
+     * @return {number} of breakpoints listed, 0 if none
+     */
+    listBreakpoints(aBreak)
+    {
+        for (var i = 1; i < aBreak.length; i++) {
+            this.printBreakpoint(aBreak, i);
+        }
+        return aBreak.length - 1;
+    }
+
+    /**
+     * printBreakpoint(aBreak, i, sAction)
+     *
+     * @this {DebuggerPDP10}
+     * @param {Array} aBreak
+     * @param {number} i
+     * @param {string} [sAction]
+     */
+    printBreakpoint(aBreak, i, sAction)
+    {
+        var dbgAddr = aBreak[i];
+        this.println(aBreak[0] + ' ' + this.toStrAddr(dbgAddr) + (sAction? (' ' + sAction) : (dbgAddr.sCmd? (' "' + dbgAddr.sCmd + '"') : '')));
+    }
+
+    /**
+     * setTempBreakpoint(dbgAddr)
+     *
+     * @this {DebuggerPDP10}
+     * @param {DbgAddrPDP10} dbgAddr of new temp breakpoint
+     */
+    setTempBreakpoint(dbgAddr)
+    {
+        this.addBreakpoint(this.aBreakExec, dbgAddr, true);
+    }
+
+    /**
+     * clearTempBreakpoint(addr)
+     *
+     * @this {DebuggerPDP10}
+     * @param {number|undefined} [addr] clear all temp breakpoints if no address specified
+     */
+    clearTempBreakpoint(addr)
+    {
+        if (addr !== undefined) {
+            this.checkBreakpoint(addr, 1, this.aBreakExec, true);
+            this.nStep = 0;
+        } else {
+            for (var i = 1; i < this.aBreakExec.length; i++) {
+                var dbgAddrBreak = this.aBreakExec[i];
+                if (dbgAddrBreak.fTemporary) {
+                    if (!this.findBreakpoint(this.aBreakExec, dbgAddrBreak, true, true)) break;
+                    i = 0;
+                }
+            }
+        }
+    }
+
+    /**
+     * checkBreakpoint(addr, nb, aBreak, fTemporary)
+     *
+     * @this {DebuggerPDP10}
+     * @param {number} addr
+     * @param {number} nb (# of bytes)
+     * @param {Array} aBreak
+     * @param {boolean} [fTemporary]
+     * @return {boolean} true if breakpoint has been hit, false if not
+     */
+    checkBreakpoint(addr, nb, aBreak, fTemporary)
+    {
+        /*
+         * Time to check for breakpoints; note that this should be done BEFORE updating history data
+         * (see checkInstruction), since we might not actually execute the current instruction.
+         */
+        var fBreak = false;
+
+        if (!this.nSuppressBreaks++) {
+
+            for (var i = 1; !fBreak && i < aBreak.length; i++) {
+
+                var dbgAddrBreak = aBreak[i];
+
+                if (fTemporary && !dbgAddrBreak.fTemporary) continue;
+
+                /*
+                 * If we're checking an execution address, which is always virtual, and virtual
+                 * addresses are always restricted to 16 bits, let's mask the breakpoint address to match
+                 * (the user should know better, but we'll be nice).
+                 */
+                var addrBreak = this.getAddr(dbgAddrBreak) & (aBreak == this.aBreakExec? 0xffff : -1);
+                for (var n = 0; n < nb; n++) {
+
+                    if ((addr + n) != addrBreak) continue;
+
+                    var a;
+                    fBreak = true;
+                    if (dbgAddrBreak.fTemporary) {
+                        this.findBreakpoint(aBreak, dbgAddrBreak, true, true);
+                        fTemporary = true;
+                    }
+                    if (a = dbgAddrBreak.aCmds) {
+                        /*
+                         * When one or more commands are attached to a breakpoint, we don't halt by default.
+                         * Instead, we set fBreak to true only if, at the completion of all the commands, the
+                         * CPU is halted; in other words, you should include "h" as one of the breakpoint commands
+                         * if you want the breakpoint to stop execution.
+                         *
+                         * Another useful command is "if", which will return false if the expression is false,
+                         * at which point we'll jump ahead to the next "else" command, and if there isn't an "else",
+                         * we abort.
+                         */
+                        fBreak = false;
+                        for (var j = 0; j < a.length; j++) {
+                            if (!this.doCommand(a[j], true)) {
+                                if (a[j].indexOf("if")) {
+                                    fBreak = true;          // the failed command wasn't "if", so abort
+                                    break;
+                                }
+                                var k = j + 1;
+                                for (; k < a.length; k++) {
+                                    if (!a[k].indexOf("else")) break;
+                                    j++;
+                                }
+                                if (k == a.length) {        // couldn't find an "else" after the "if", so abort
+                                    fBreak = true;
+                                    break;
+                                }
+                                /*
+                                 * If we're still here, we'll execute the "else" command (which is just a no-op),
+                                 * followed by any remaining commands.
+                                 */
+                            }
+                        }
+                        if (!this.cpu.isRunning()) fBreak = true;
+                    }
+                    if (fBreak) {
+                        if (!fTemporary) this.printBreakpoint(aBreak, i, "hit");
+                        break;
+                    }
+                }
+            }
+        }
+
+        this.nSuppressBreaks--;
+
+        return fBreak;
+    }
+
+    /**
+     * getAccOutput(iAcc)
+     *
+     * @this {DebuggerPDP10}
+     * @param {number} iAcc
+     * @return {string}
+     */
+    getAccOutput(iAcc)
+    {
+        var sReg = Str.toOct(iAcc, 2);
+        this.setAddr(this.dbgAddrAcc, iAcc);
+        sReg += '=' + this.toStrBase(this.getWord(this.dbgAddrAcc), 36) + ' ';
+        return sReg;
+    }
+
+    /**
+     * getRegOutput(iReg)
+     *
+     * @this {DebuggerPDP10}
+     * @param {number} iReg
+     * @return {string}
+     */
+    getRegOutput(iReg)
+    {
+        var sReg = this.getRegName(iReg);
+        if (sReg) {
+            var nBits = (iReg >= DebuggerPDP10.REGS.OV? 1 : (iReg == DebuggerPDP10.REGS.RA? 23 : 18));
+            sReg += '=' + this.toStrBase(this.getRegValue(iReg), nBits) + ' ';
+        }
+        return sReg;
+    }
+
+    /**
+     * getMiscDump()
+     *
+     * @this {DebuggerPDP10}
+     * @return {string}
+     */
+    getMiscDump()
+    {
+        var sDump = "";
+        for (var i = 0; i < DebuggerPDP10.REGNAMES.length; i++) {
+            sDump += this.getRegOutput(i);
+        }
+        return sDump;
+    }
+
+    /**
+     * getRegDump(fMisc)
+     *
+     * For now, fMisc defaults to true, providing a full register dump by default.
+     *
+     * @this {DebuggerPDP10}
+     * @param {boolean|undefined} [fMisc] (true to include misc registers)
+     * @return {string}
+     */
+    getRegDump(fMisc = true)
+    {
+        var sDump = "";
+        for (var i = 0; i < 16; i++) {
+            if (i && !(i & 3)) sDump += '\n';
+            sDump += this.getAccOutput(i);
+        }
+        if (fMisc) sDump += '\n' + this.getMiscDump();
+        return sDump;
+    }
+
+    /**
+     * comparePairs(p1, p2)
+     *
+     * @this {DebuggerPDP10}
+     * @param {number|string|Array|Object} p1
+     * @param {number|string|Array|Object} p2
+     * @return {number}
+     */
+    comparePairs(p1, p2)
+    {
+        return p1[0] > p2[0]? 1 : p1[0] < p2[0]? -1 : 0;
+    }
+
+    /**
+     * addSymbols(sModule, addr, len, aSymbols)
+     *
+     * As filedump.js (formerly convrom.php) explains, aSymbols is a JSON-encoded object whose properties consist
+     * of all the symbols (in upper-case), and the values of those properties are objects containing any or all of
+     * the following properties:
+     *
+     *      'v': the value of an absolute (unsized) value
+     *      'b': either 1, 2, 4 or undefined if an unsized value
+     *      's': either a hard-coded segment or undefined
+     *      'o': the offset of the symbol within the associated address space
+     *      'l': the original-case version of the symbol, present only if it wasn't originally upper-case
+     *      'a': annotation for the specified offset; eg, the original assembly language, with optional comment
+     *
+     * To that list of properties, we also add:
+     *
+     *      'p': the physical address (calculated whenever both 's' and 'o' properties are defined)
+     *
+     * Note that values for any 'v', 'b', 's' and 'o' properties are unquoted decimal values, and the values
+     * for any 'l' or 'a' properties are quoted strings. Also, if double-quotes were used in any of the original
+     * annotation ('a') values, they will have been converted to two single-quotes, so we're responsible for
+     * converting them back to individual double-quotes.
+     *
+     * For example:
+     *      {
+     *          'HF_PORT': {
+     *              'v':800
+     *          },
+     *          'HDISK_INT': {
+     *              'b':4, 's':0, 'o':52
+     *          },
+     *          'ORG_VECTOR': {
+     *              'b':4, 's':0, 'o':76
+     *          },
+     *          'CMD_BLOCK': {
+     *              'b':1, 's':64, 'o':66
+     *          },
+     *          'DISK_SETUP': {
+     *              'o':3
+     *          },
+     *          '.40': {
+     *              'o':40, 'a':"MOV AX,WORD PTR ORG_VECTOR ;GET DISKETTE VECTOR"
+     *          }
+     *      }
+     *
+     * If a symbol only has an offset, then that offset value can be assigned to the symbol property directly:
+     *
+     *          'DISK_SETUP': 3
+     *
+     * The last property is an example of an "anonymous" entry, for offsets where there is no associated symbol.
+     * Such entries are identified by a period followed by a unique number (usually the offset of the entry), and
+     * they usually only contain offset ('o') and annotation ('a') properties.  I could eliminate the leading
+     * period, but it offers a very convenient way of quickly discriminating among genuine vs. anonymous symbols.
+     *
+     * We add all these entries to our internal symbol table, which is an array of 4-element arrays, each of which
+     * look like:
+     *
+     *      [addr, len, aSymbols, aOffsets]
+     *
+     * There are two basic symbol operations: findSymbol(), which takes an address and finds the symbol, if any,
+     * at that address, and findSymbolAddr(), which takes a string and attempts to match it to a non-anonymous
+     * symbol with a matching offset ('o') property.
+     *
+     * To implement findSymbol() efficiently, addSymbols() creates an array of [offset, sSymbol] pairs
+     * (aOffsets), one pair for each symbol that corresponds to an offset within the specified address space.
+     *
+     * We guarantee the elements of aOffsets are in offset order, because we build it using binaryInsert();
+     * it's quite likely that the MAP file already ordered all its symbols in offset order, but since they're
+     * hand-edited files, we can't assume that, and we need to ensure that findSymbol()'s binarySearch() operates
+     * properly.
+     *
+     * @this {DebuggerPDP10}
+     * @param {string|null} sModule
+     * @param {number|null} addr (physical address where the symbols are located, if the memory is physical; eg, ROM)
+     * @param {number} len (the size of the region, in bytes)
+     * @param {Object} aSymbols (collection of symbols in this group; the format of this collection is described below)
+     */
+    addSymbols(sModule, addr, len, aSymbols)
+    {
+        var dbgAddr = {};
+        var aOffsets = [];
+        for (var sSymbol in aSymbols) {
+            var symbol = aSymbols[sSymbol];
+            if (typeof symbol == "number") {
+                aSymbols[sSymbol] = symbol = {'o': symbol};
+            }
+            var offSymbol = symbol['o'];
+            var sAnnotation = symbol['a'];
+            if (offSymbol !== undefined) {
+                Usr.binaryInsert(aOffsets, [offSymbol >>> 0, sSymbol], this.comparePairs);
+            }
+            if (sAnnotation) symbol['a'] = sAnnotation.replace(/''/g, "\"");
+        }
+        var symbolTable = {
+            sModule: sModule,
+            addr: addr,
+            len: len,
+            aSymbols: aSymbols,
+            aOffsets: aOffsets
+        };
+        this.aSymbolTable.push(symbolTable);
+    }
+
+    /**
+     * dumpSymbols()
+     *
+     * TODO: Add "numerical" and "alphabetical" dump options. This is simply dumping them in whatever
+     * order they appeared in the original MAP file.
+     *
+     * @this {DebuggerPDP10}
+     */
+    dumpSymbols()
+    {
+        for (var iTable = 0; iTable < this.aSymbolTable.length; iTable++) {
+            var symbolTable = this.aSymbolTable[iTable];
+            for (var sSymbol in symbolTable.aSymbols) {
+                if (sSymbol.charAt(0) == '.') continue;
+                var symbol = symbolTable.aSymbols[sSymbol];
+                var offSymbol = symbol['o'];
+                if (offSymbol === undefined) continue;
+                var sSymbolOrig = symbolTable.aSymbols[sSymbol]['l'];
+                if (sSymbolOrig) sSymbol = sSymbolOrig;
+                this.println(this.toStrOffset(offSymbol) + ' ' + sSymbol);
+            }
+        }
+    }
+
+    /**
+     * findSymbol(dbgAddr, fNearest)
+     *
+     * Search aSymbolTable for dbgAddr, and return an Array for the corresponding symbol (empty if not found).
+     *
+     * If fNearest is true, and no exact match was found, then the Array returned will contain TWO sets of
+     * entries: [0]-[3] will refer to closest preceding symbol, and [4]-[7] will refer to the closest subsequent symbol.
+     *
+     * @this {DebuggerPDP10}
+     * @param {DbgAddrPDP10} dbgAddr
+     * @param {boolean} [fNearest]
+     * @return {Array} where [0] == symbol name, [1] == symbol value, [2] == any annotation, and [3] == any associated comment
+     */
+    findSymbol(dbgAddr, fNearest)
+    {
+        var aSymbol = [];
+        var addrSymbol = this.getAddr(dbgAddr) >>> 0;
+        for (var iTable = 0; iTable < this.aSymbolTable.length; iTable++) {
+            var symbolTable = this.aSymbolTable[iTable];
+            var addr = symbolTable.addr >>> 0;
+            var len = symbolTable.len;
+            if (addrSymbol >= addr && addrSymbol < addr + len) {
+                var offSymbol = addrSymbol - addr;
+                var result = Usr.binarySearch(symbolTable.aOffsets, [offSymbol], this.comparePairs);
+                if (result >= 0) {
+                    this.returnSymbol(iTable, result, aSymbol);
+                }
+                else if (fNearest) {
+                    result = ~result;
+                    this.returnSymbol(iTable, result-1, aSymbol);
+                    this.returnSymbol(iTable, result, aSymbol);
+                }
+                break;
+            }
+        }
+        return aSymbol;
+    }
+
+    /**
+     * findSymbolAddr(sSymbol)
+     *
+     * Search our symbol tables for sSymbol, and if found, return a dbgAddr (same as parseAddr()).
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} sSymbol
+     * @return {DbgAddrPDP10|undefined}
+     */
+    findSymbolAddr(sSymbol)
+    {
+        var dbgAddr, offSymbol;
+
+        if (sSymbol.match(/^[a-z_][a-z0-9_]*$/i)) {
+            var sUpperCase = sSymbol.toUpperCase();
+            for (var iTable = 0; iTable < this.aSymbolTable.length; iTable++) {
+                var symbolTable = this.aSymbolTable[iTable];
+                var symbol = symbolTable.aSymbols[sUpperCase];
+                if (symbol != null) {
+                    offSymbol = symbol['o'];
+                    /*
+                     * If the symbol matched but there's no 'o' offset (ie, it wasn't for an address), there's
+                     * no point looking any farther, since each symbol appears only once.
+                     *
+                     * NOTE: We assume that every ROM is ORG'ed at 0x0000, and therefore unless the symbol has an
+                     * explicitly-defined segment, we return the segment associated with the entire group; for a ROM,
+                     * that segment is normally "addrROM >>> 4".  Down the road, we may want/need to support a special
+                     * symbol entry (eg, ".ORG") that defines an alternate origin.
+                     */
+                    break;
+                }
+            }
+        }
+        if (offSymbol != null) {
+            dbgAddr = this.newAddr(offSymbol);
+        }
+        return dbgAddr;
+    }
+
+    /**
+     * loadImage(aWords, addrStart)
+     *
+     * @this {DebuggerPDP10}
+     * @param {Array.<number>} aWords
+     * @param {number|null|undefined} addrStart
+     */
+    loadImage(aWords, addrStart)
+    {
+        var bus = this.bus;
+        var dbg = this.dbg;
+        var nWords = 0, addrLo = null, addrHi = 0;
+        aWords.forEach(function(w, addr) {
+            bus.setWord(addr, w);
+            if (addrLo == null) addrLo = addr;
+            if (addr > addrHi) addrHi = addr;
+            nWords++;
+        });
+        if (!nWords) {
+            this.println("no data");
+        } else {
+            var sStart = "start address ";
+            if (addrStart != null) {
+                this.cpu.setPC(addrStart);
+                sStart += this.toStrBase(addrStart);
+            } else {
+                sStart += "unspecified";
+            }
+            this.println(nWords + " words loaded at " + this.toStrBase(addrLo) + '-' + this.toStrBase(addrHi) + ", " + sStart);
+            this.updateStatus();
+        }
+    }
+
+    /**
+     * returnSymbol(iTable, iOffset, aSymbol)
+     *
+     * Helper function for findSymbol().
+     *
+     * @this {DebuggerPDP10}
+     * @param {number} iTable
+     * @param {number} iOffset
+     * @param {Array} aSymbol is updated with the specified symbol, if it exists
+     */
+    returnSymbol(iTable, iOffset, aSymbol)
+    {
+        var symbol = {};
+        var aOffsets = this.aSymbolTable[iTable].aOffsets;
+        var offset = 0, sSymbol = null;
+        if (iOffset >= 0 && iOffset < aOffsets.length) {
+            offset = aOffsets[iOffset][0];
+            sSymbol = aOffsets[iOffset][1];
+        }
+        if (sSymbol) {
+            symbol = this.aSymbolTable[iTable].aSymbols[sSymbol];
+            sSymbol = (sSymbol.charAt(0) == '.'? null : (symbol['l'] || sSymbol));
+        }
+        aSymbol.push(sSymbol);
+        aSymbol.push(offset);
+        aSymbol.push(symbol['a']);
+        aSymbol.push(symbol['c']);
+    }
+
+    /**
+     * doHelp()
+     *
+     * @this {DebuggerPDP10}
+     */
+    doHelp()
+    {
+        var s = "commands:";
+        for (var sCommand in DebuggerPDP10.COMMANDS) {
+            s += '\n' + Str.pad(sCommand, 9) + DebuggerPDP10.COMMANDS[sCommand];
+        }
+        if (!this.checksEnabled()) s += "\nnote: history disabled if no exec breakpoints";
+        this.println(s);
+    }
+
+    /**
+     * doAssemble(asArgs)
+     *
+     * This always receives the complete argument array, where the order of the arguments is:
+     *
+     *      [0]: the assemble command (assumed to be "a")
+     *      [1]: the target address (eg, "200")
+     *      [2]: the opcode mnemonic (eg, "hrli")
+     *      [3]: the operands, if any
+     *
+     * The Debugger enters "assemble mode" whenever only the first (or first and second) arguments are present.
+     * As long as "assemble mode is active, the user can omit the first two arguments on all later assemble commands
+     * until "assemble mode" is cancelled with an empty command line; the command processor automatically prepends "a"
+     * and the next available target address to the argument array.
+     *
+     * Entering "assemble mode" is optional; one could enter a series of fully-qualified assemble commands; eg:
+     *
+     *      a 100 hrli 1,111111
+     *      a 101 hrri 1,444444
+     *      ...
+     *
+     * without ever entering "assemble mode", but of course, that requires more typing and doesn't take advantage
+     * of automatic target address advancement (see dbgAddrAssemble).
+     *
+     * When filename(s) or URL(s) are provided in lieu of an opcode, we pass those on to the Macro10 component for
+     * assembling (multiple files must be separated by semicolons), along with any option letters that were included
+     * with the "a" command; for example, if "ap" was specified, then "p" will be passed to Macro10 as an option.
+     *
+     * See the Macro10 component for a list of supported options.
+     *
+     * When assembling a file, the target address determines the initial location counter for the assembly process,
+     * but that can always be overridden by a LOC (or RELOC) pseudo-op in the file.  The target address will also be
+     * used as the starting address unless that's overridden by an END pseudo-op.  In the absence of a target address,
+     * the location counter starts at zero, and the starting address defaults to the PC register.
+     *
+     * @this {DebuggerPDP10}
+     * @param {Array.<string>} asArgs is the complete argument array, beginning with the "a" command in asArgs[0]
+     * @return {boolean}
+     */
+    doAssemble(asArgs)
+    {
+        var sOptions = asArgs[0].substr(1);
+        var sAddr = asArgs[1] && asArgs[1][0] >= '0' && asArgs[1][0] <= '9'? asArgs[1] : undefined;
+        var sOpcode = sAddr? asArgs[2] : asArgs[1];
+        var dbgAddr = this.parseAddr(sAddr, this.dbgAddrAssemble);
+
+        if (!sOpcode) {
+            this.println("begin assemble at " + this.toStrAddr(dbgAddr));
+            this.fAssemble = true;
+            this.cmp.updateDisplays();
+            return true;
+        }
+
+        var match = sOpcode.match(/^(['"]?)(.*?)(\.klm|\.mac|\.html|\.txt|)\1$/i);
+        if (match && (match[1] || match[3])) {
+            var dbg = this;
+            var cpu = this.cpu;
+            dbgAddr = this.parseAddr(sAddr);
+            if (this.macro10) {
+                dbg.println("assembly already in progress");
+            }
+            else {
+                var sFile = match[2] + match[3];
+                if (!match[3]) sOptions += 's';
+                var addrLoad = dbgAddr.addr;
+                var macro10 = this.macro10 = new Macro10(dbg);
+                macro10.assembleFiles(sFile, addrLoad, sOptions, function doneMacro10(nErrorCode, sURL) {
+                    if (!nErrorCode) {
+                        /*
+                         * NOTE: Most Debugger operations run in the context of doCommand(), which catches any exceptions;
+                         * however, this callback may be running in a different context (eg, a network request callback), so
+                         * better safe than sorry.
+                         */
+                        try {
+                            var addrStart = macro10.getStart();
+                            if (addrStart == null) addrStart = addrLoad;
+                            dbg.loadImage(macro10.getImage(), addrStart);
+                        } catch(e) {
+                            if (typeof e == "number") {
+                                nErrorCode = e || -1;
+                            } else {
+                                dbg.println(e.message);
+                                nErrorCode = -1;        // fake error so that command processing stops
+                            }
+                        }
+                    }
+                    if (nErrorCode) {
+                        dbg.println("error (" + nErrorCode + ") processing " + (sURL || sFile));
+                    }
+                    dbg.macro10 = null;
+                    if (!nErrorCode) dbg.doCommands();
+                });
+            }
+            return false;
+        }
+
+        asArgs.shift();
+        asArgs.shift();
+        asArgs.shift();
+        var sOperands = asArgs.join("");
+        var opCode = this.parseInstruction(sOpcode, sOperands, dbgAddr.addr || 0);
+
+        if (opCode >= 0) {
+            this.setWord(dbgAddr, opCode);
+            this.println(this.getInstruction(dbgAddr));
+        }
+        return true;
+    }
+
+    /**
+     * doBreak(sCmd, sAddr, sOptions)
+     *
+     * As the "help" output below indicates, the following breakpoint commands are supported:
+     *
+     *      bp #    set exec breakpoint
+     *      br #    set read breakpoint
+     *      bw #    set write breakpoint
+     *      bc #    clear breakpoint (* to clear all)
+     *      bl      list all breakpoints
+     *      bn [#]  break after # instruction(s)
+     *
+     * The "bn" command, like the "dh" command and all other commands that use an instruction count,
+     * assumes a decimal value, regardless of the current base.  Use "bn" without an argument to display
+     * the break count, and use "bn 0" to clear the break count.
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} sCmd
+     * @param {string|undefined} [sAddr]
+     * @param {string} [sOptions] (the rest of the breakpoint command-line)
+     */
+    doBreak(sCmd, sAddr, sOptions)
+    {
+        if (sAddr == '?') {
+            this.println("breakpoint commands:");
+            this.println("\tbp #\tset exec breakpoint");
+            this.println("\tbr #\tset read breakpoint");
+            this.println("\tbw #\tset write breakpoint");
+            this.println("\tbc #\tclear breakpoint (* to clear all)");
+            this.println("\tbl\tlist all breakpoints");
+            this.println("\tbn [#]\tbreak after # instruction(s)");
+            return;
+        }
+
+        var sParm = sCmd.charAt(1);
+        if (sParm == 'l') {
+            var cBreaks = 0;
+            cBreaks += this.listBreakpoints(this.aBreakExec);
+            cBreaks += this.listBreakpoints(this.aBreakRead);
+            cBreaks += this.listBreakpoints(this.aBreakWrite);
+            if (!cBreaks) this.println("no breakpoints");
+            return;
+        }
+
+        if (sParm == 'n') {
+            var n = +sAddr || 0;
+            if (sAddr) this.nBreakInstructions = n;
+            this.println("break after " + n + " instruction(s)");
+            return;
+        }
+
+        if (sAddr === undefined) {
+            this.println("missing breakpoint address");
+            return;
+        }
+
+        var dbgAddr = sAddr == '*'? this.newAddr() : this.parseAddr(sAddr, this.dbgAddrCode);
+
+        if (sParm == 'c') {
+            if (dbgAddr.addr == null) {
+                this.clearBreakpoints();
+                this.println("all breakpoints cleared");
+                return;
+            }
+            if (this.findBreakpoint(this.aBreakExec, dbgAddr, true))
+                return;
+            if (this.findBreakpoint(this.aBreakRead, dbgAddr, true))
+                return;
+            if (this.findBreakpoint(this.aBreakWrite, dbgAddr, true))
+                return;
+            this.println("breakpoint missing: " + this.toStrAddr(dbgAddr));
+            return;
+        }
+
+        if (dbgAddr.addr == null) return;
+
+        this.parseAddrOptions(dbgAddr, sOptions);
+
+        if (sParm == 'p') {
+            this.addBreakpoint(this.aBreakExec, dbgAddr);
+            return;
+        }
+        if (sParm == 'r') {
+            this.addBreakpoint(this.aBreakRead, dbgAddr);
+            return;
+        }
+        if (sParm == 'w') {
+            this.addBreakpoint(this.aBreakWrite, dbgAddr);
+            return;
+        }
+        this.println("unknown breakpoint command: " + sParm);
+    }
+
+    /**
+     * doClear(sCmd)
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} [sCmd] (eg, "cls" or "clear")
+     */
+    doClear(sCmd)
+    {
+        /*
+         * TODO: There should be a clear() component method that the Control Panel overrides to perform this function.
+         */
+        if (this.controlPrint) this.controlPrint.value = "";
+    }
+
+    /**
+     * doDump(asArgs)
+     *
+     * @this {DebuggerPDP10}
+     * @param {Array.<string>} asArgs (formerly sCmd, [sAddr], [sLen] and [sBytes])
+     */
+    doDump(asArgs)
+    {
+        var m;
+        var sCmd = asArgs[0];
+        var sAddr = asArgs[1];
+        var sLen = asArgs[2];
+        var sBytes = asArgs[3];
+
+        if (sAddr == '?') {
+            var sDumpers = "";
+            for (m in MessagesPDP10.CATEGORIES) {
+                if (this.afnDumpers[m]) {
+                    if (sDumpers) sDumpers += ',';
+                    sDumpers = sDumpers + m;
+                }
+            }
+            sDumpers += ",state,symbols";
+            this.println("dump memory commands:");
+            this.println("\tdw [a] [n]    dump n words at address a");
+            this.println("\tds [a] [n]    dump n words at address a as JSON");
+            this.println("\tdh [p] [n]    dump n instructions from history position p");
+            if (sDumpers.length) this.println("dump extension commands:\n\t" + sDumpers);
+            return;
+        }
+
+        if (sAddr == "state") {
+            var sState = this.cmp.powerOff(true);
+            if (sLen == "console") {
+                /*
+                 * Console buffers are notoriously small, and even the following code, which breaks the
+                 * data into parts (eg, "d state console 1", "d state console 2", etc) just isn't that helpful.
+                 *
+                 *      var nPart = +sBytes;
+                 *      if (nPart) sState = sState.substr(1000000 * (nPart-1), 1000000);
+                 *
+                 * So, the best way to capture a large machine state is to use the new "Save Machine" link
+                 * that downloads a machine's entire state.  Alternatively, run your own local server and use
+                 * server-side storage.  Take a look at the "Save" binding in computer.js, which binds an HTML
+                 * control to the computer.powerOff() and computer.saveServerState() functions.
+                 */
+                console.log(sState);
+            } else {
+                this.doClear();
+                if (sState) this.println(sState);
+            }
+            return;
+        }
+
+        if (sAddr == "symbols") {
+            this.dumpSymbols();
+            return;
+        }
+
+        if (sCmd == "d") {
+            for (m in MessagesPDP10.CATEGORIES) {
+                if (asArgs[1] == m) {
+                    var fnDumper = this.afnDumpers[m];
+                    if (fnDumper) {
+                        asArgs.shift();
+                        asArgs.shift();
+                        fnDumper(asArgs);
+                    } else {
+                        this.println("no dump registered for " + sAddr);
+                    }
+                    return;
+                }
+            }
+            if (!sAddr) sCmd = this.sCmdDumpPrev || "dw";
+        } else {
+            this.sCmdDumpPrev = sCmd;
+        }
+
+        if (sCmd == "dh") {
+            this.dumpHistory(sAddr, sLen);
+            return;
+        }
+
+        var len = 0;
+        var fJSON = (sCmd == "ds");
+        var dbgAddr = this.parseAddr(sAddr, this.dbgAddrData);
+
+        if (sLen) {
+            if (sLen.charAt(0) == 'l') {
+                sLen = sLen.substr(1) || sBytes;
+                len = this.parseValue(sLen);
+            }
+            else {
+                var dbgAddrEnd = this.parseAddr(sLen);
+                len = dbgAddrEnd.addr - dbgAddr.addr;
+            }
+            if (len < 0) len = 0;
+            if (len > 0x10000) len = 0x10000;
+        }
+
+        var nBase = this.nBase;
+        if (dbgAddr.nBase) this.nBase = dbgAddr.nBase;
+
+        var size = (sCmd == "db"? 1 : 2);
+        var nWords = len || 32;
+        var nWordsPerLine = (size == 1? 1 : 4);
+        var nLines = (((nWords + nWordsPerLine - 1) / nWordsPerLine)|0) || 1;
+
+        var sDump = "";
+        while (nLines-- && nWords > 0) {
+            var sData = "", sChars = "";
+            sAddr = this.toStrAddr(dbgAddr);
+            var n = nWordsPerLine;
+            while (n-- > 0 && nWords-- > 0) {
+                var w = this.getWord(dbgAddr, 1);
+                if (fJSON) {
+                    if (sData) sData += ',';
+                    sData += w;
+                } else {
+                    sData += this.toStrWord(w);
+                    sData += '  ';
+                }
+                /*
+                 * TODO: Provide some UI for choosing whether to dump SIXBIT or ASCII data.
+                 */
+                var nBits = 7;
+                var shift = 36 - nBits;
+                for (var i = 0; size == 1 && shift >= 0; i++) {
+                    var c = ((w / Math.pow(2, shift)) % Math.pow(2, nBits));
+                    sData += this.toStrBase(c, nBits) + ' ';
+                    c += (nBits == 6? 0x20 : 0);
+                    sChars += (c < 0x20? '.' : String.fromCharCode(c));
+                    shift -= nBits;
+                }
+            }
+            if (sDump) sDump += "\n";
+            if (fJSON) {
+                sDump += sData + ",";
+            } else {
+                sDump += sAddr + ": " + sData + ((n < 0)? (' ' + sChars) : "");
+            }
+        }
+
+        if (sDump) this.println(sDump);
+
+        this.nBase = nBase;
+    }
+
+    /**
+     * doEdit(asArgs)
+     *
+     * @this {DebuggerPDP10}
+     * @param {Array.<string>} asArgs
+     */
+    doEdit(asArgs)
+    {
+        var fnGet, fnSet;
+        var sCmd = asArgs[0];
+        var sAddr = asArgs[1];
+        if (sCmd == "e" || sCmd == "ew") {
+            fnGet = this.getWord;
+            fnSet = this.setWord;
+        } else {
+            sAddr = null;
+        }
+        if (sAddr == null) {
+            this.println("edit memory commands:");
+            this.println("\tew [a] [...]  edit words at address a");
+            return;
+        }
+        var dbgAddr = this.parseAddr(sAddr, this.dbgAddrData);
+        for (var i = 2; i < asArgs.length; i++) {
+            var w = this.parseExpression(asArgs[i]);
+            if (w === undefined) break;
+            w = this.validateWord(w);
+            this.println("changing " + this.toStrAddr(dbgAddr) + " from " + this.toStrWord(fnGet.call(this, dbgAddr)) + " to " + this.toStrWord(w));
+            fnSet.call(this, dbgAddr, w, 1);
+        }
+    }
+
+    /**
+     * doHalt(fQuiet)
+     *
+     * @this {DebuggerPDP10}
+     * @param {boolean} [fQuiet]
+     */
+    doHalt(fQuiet)
+    {
+        var sMsg;
+        if (this.flags.running) {
+            if (!fQuiet) this.println("halting");
+            this.stopCPU();
+        } else {
+            if (this.isBusy(true)) return;
+            if (!fQuiet) this.println("already halted");
+        }
+    }
+
+    /**
+     * doIf(sCmd, fQuiet)
+     *
+     * NOTE: Don't forget that the default base for all numeric constants is 16 (hex), so when you evaluate
+     * an expression like "a==10", it will compare the value of the variable "a" to 0x10; use a trailing period
+     * (eg, "10.") if you really intend decimal.
+     *
+     * Also, if no variable named "a" exists, "a" will evaluate to 0x0A, so the expression "a==10" becomes
+     * "0x0A==0x10" (false), whereas the expression "a==10." becomes "0x0A==0x0A" (true).
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} sCmd
+     * @param {boolean} [fQuiet]
+     * @return {boolean} true if expression is non-zero, false if zero (or undefined due to a parse error)
+     */
+    doIf(sCmd, fQuiet)
+    {
+        sCmd = Str.trim(sCmd);
+        if (!this.parseExpression(sCmd)) {
+            if (!fQuiet) this.println("false: " + sCmd);
+            return false;
+        }
+        if (!fQuiet) this.println("true: " + sCmd);
+        return true;
+    }
+
+    /**
+     * doInfo(asArgs)
+     *
+     * @this {DebuggerPDP10}
+     * @param {Array.<string>} asArgs
+     * @return {boolean} true only if the instruction info command ("n") is supported
+     */
+    doInfo(asArgs)
+    {
+        if (DEBUG) {
+            this.println("msPerYield: " + this.cpu.msPerYield);
+            this.println("nCyclesPerYield: " + this.cpu.nCyclesPerYield);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * doVar(sCmd)
+     *
+     * The command must be of the form "{variable} = [{expression}]", where expression may contain constants,
+     * operators, registers, symbols, other variables, or nothing at all; in the latter case, the variable, if
+     * any, is deleted.
+     *
+     * Other supported shorthand: "var" with no parameters prints the values of all variables, and "var {variable}"
+     * prints the value of the specified variable.
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} sCmd
+     * @return {boolean} true if valid "var" assignment, false if not
+     */
+    doVar(sCmd)
+    {
+        var a = sCmd.match(/^\s*([A-Z_]?[A-Z0-9_]*)\s*(=?)\s*(.*)$/i);
+        if (a) {
+            if (!a[1]) {
+                if (!this.printVariable()) this.println("no variables");
+                return true;    // it's not considered an error to print an empty list of variables
+            }
+            if (!a[2]) {
+                return this.printVariable(a[1]);
+            }
+            if (!a[3]) {
+                this.delVariable(a[1]);
+                return true;    // it's not considered an error to delete a variable that didn't exist
+            }
+            var v = this.parseExpression(a[3]);
+            if (v !== undefined) {
+                this.setVariable(a[1], v);
+                return true;
+            }
+            return false;
+        }
+        this.println("invalid assignment:" + sCmd);
+        return false;
+    }
+
+    /**
+     * doList(sAddr, fPrint)
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} sAddr
+     * @param {boolean} [fPrint]
+     * @return {string|null}
+     */
+    doList(sAddr, fPrint)
+    {
+        var sSymbol = null;
+
+        var dbgAddr = this.parseAddr(sAddr);
+        var addr = this.getAddr(dbgAddr);
+        var aSymbol = this.findSymbol(dbgAddr, true);
+        if (aSymbol.length) {
+            var nDelta, sDelta, s;
+            if (aSymbol[0]) {
+                sDelta = "";
+                nDelta = dbgAddr.addr - aSymbol[1];
+                if (nDelta) sDelta = " + " + Str.toHexWord(nDelta);
+                s = aSymbol[0] + " (" + this.toStrOffset(aSymbol[1]) + ')' + sDelta;
+                if (fPrint) this.println(s);
+                sSymbol = s;
+            }
+            if (aSymbol.length > 4 && aSymbol[4]) {
+                sDelta = "";
+                nDelta = aSymbol[5] - dbgAddr.addr;
+                if (nDelta) sDelta = " - " + Str.toHexWord(nDelta);
+                s = aSymbol[4] + " (" + this.toStrOffset(aSymbol[5]) + ')' + sDelta;
+                if (fPrint) this.println(s);
+                if (!sSymbol) sSymbol = s;
+            }
+        } else {
+            if (fPrint) this.println("no symbols");
+        }
+        return sSymbol;
+    }
+
+    /**
+     * doMessages(asArgs)
+     *
+     * @this {DebuggerPDP10}
+     * @param {Array.<string>} asArgs
+     */
+    doMessages(asArgs)
+    {
+        var m;
+        var fCriteria = null;
+        var sCategory = asArgs[1];
+        if (sCategory == '?') sCategory = undefined;
+
+        if (sCategory !== undefined) {
+            var bitsMessage = 0;
+            if (sCategory == "all") {
+                bitsMessage = (0xffffffff|0) & ~(MessagesPDP10.HALT | MessagesPDP10.KEYS | MessagesPDP10.LOG);
+                sCategory = null;
+            } else if (sCategory == "on") {
+                fCriteria = true;
+                sCategory = null;
+            } else if (sCategory == "off") {
+                fCriteria = false;
+                sCategory = null;
+            } else {
+                /*
+                 * Internally, we use "key" instead of "keys", since the latter is a method on JavasScript objects,
+                 * but externally, we allow the user to specify "keys"; "kbd" is also allowed as shorthand for "keyboard".
+                 */
+                if (sCategory == "keys") sCategory = "key";
+                if (sCategory == "kbd") sCategory = "keyboard";
+                for (m in MessagesPDP10.CATEGORIES) {
+                    if (sCategory == m) {
+                        bitsMessage = MessagesPDP10.CATEGORIES[m];
+                        fCriteria = !!(this.bitsMessage & bitsMessage);
+                        break;
+                    }
+                }
+                if (!bitsMessage) {
+                    this.println("unknown message category: " + sCategory);
+                    return;
+                }
+            }
+            if (bitsMessage) {
+                if (asArgs[2] == "on") {
+                    this.bitsMessage |= bitsMessage;
+                    fCriteria = true;
+                }
+                else if (asArgs[2] == "off") {
+                    this.bitsMessage &= ~bitsMessage;
+                    fCriteria = false;
+                    if (bitsMessage == MessagesPDP10.BUFFER) {
+                        var i = this.aMessageBuffer.length >= 1000? this.aMessageBuffer.length - 1000 : 0;
+                        while (i < this.aMessageBuffer.length) {
+                            this.println(this.aMessageBuffer[i++]);
+                        }
+                        this.aMessageBuffer = [];
+                    }
+                }
+            }
+        }
+
+        /*
+         * Display those message categories that match the current criteria (on or off)
+         */
+        var n = 0;
+        var sCategories = "";
+        for (m in MessagesPDP10.CATEGORIES) {
+            if (!sCategory || sCategory == m) {
+                var bitMessage = MessagesPDP10.CATEGORIES[m];
+                var fEnabled = !!(this.bitsMessage & bitMessage);
+                if (fCriteria !== null && fCriteria != fEnabled) continue;
+                if (sCategories) sCategories += ',';
+                if (!(++n % 10)) sCategories += "\n\t";     // jshint ignore:line
+                /*
+                 * Internally, we use "key" instead of "keys", since the latter is a method on JavasScript objects,
+                 * but externally, we allow the user to specify "keys".
+                 */
+                if (m == "key") m = "keys";
+                sCategories += m;
+            }
+        }
+
+        if (sCategory === undefined) {
+            this.println("message commands:\n\tm [category] [on|off]\tturn categories on/off");
+        }
+
+        this.println((fCriteria !== null? (fCriteria? "messages on:  " : "messages off: ") : "message categories:\n\t") + (sCategories || "none"));
+
+        this.historyInit();     // call this just in case MessagesPDP10.INT was turned on
+    }
+
+    /**
+     * doOptions(asArgs)
+     *
+     * @this {DebuggerPDP10}
+     * @param {Array.<string>} asArgs
+     */
+    doOptions(asArgs)
+    {
+        switch (asArgs[1]) {
+
+        case "base":
+            if (asArgs[2]) {
+                var nBase = +asArgs[2];
+                if (nBase == 2 || nBase == 8 || nBase == 10 || nBase == 16) {
+                    this.nBase = nBase;
+                } else {
+                    this.println("invalid base: " + nBase);
+                    break;
+                }
+            }
+            this.println("default base: " + this.nBase);
+            break;
+
+        case "cs":
+            var nCycles;
+            if (asArgs[3] !== undefined) nCycles = +asArgs[3];          // warning: decimal instead of hex conversion
+            switch (asArgs[2]) {
+                case "int":
+                    this.cpu.nCyclesChecksumInterval = nCycles;
+                    break;
+                case "start":
+                    this.cpu.nCyclesChecksumStart = nCycles;
+                    break;
+                case "stop":
+                    this.cpu.nCyclesChecksumStop = nCycles;
+                    break;
+                default:
+                    this.println("unknown cs option");
+                    return;
+            }
+            if (nCycles !== undefined) {
+                this.cpu.resetChecksum();
+            }
+            this.println("checksums " + (this.cpu.flags.checksum? "enabled" : "disabled"));
+            return;
+
+        case "sp":
+            if (asArgs[2] !== undefined) {
+                if (!this.cpu.setSpeed(+asArgs[2])) {
+                    this.println("warning: using 1x multiplier, previous target not reached");
+                }
+            }
+            this.println("target speed: " + this.cpu.getSpeedTarget() + " (" + this.cpu.getSpeed() + "x)");
+            return;
+
+        default:
+            if (asArgs[1]) {
+                this.println("unknown option: " + asArgs[1]);
+                return;
+            }
+            /* falls through */
+
+        case "?":
+            this.println("debugger options:");
+            this.println("\tbase #\t\tset default base to #");
+            this.println("\tcs int #\tset checksum cycle interval to #");
+            this.println("\tcs start #\tset checksum cycle start count to #");
+            this.println("\tcs stop #\tset checksum cycle stop count to #");
+            this.println("\tsp #\t\tset speed multiplier to #");
+            break;
+        }
+    }
+
+    /**
+     * doRegisters(asArgs, fInstruction)
+     *
+     * @this {DebuggerPDP10}
+     * @param {Array.<string>} [asArgs]
+     * @param {boolean} [fInstruction] (true to include the current instruction; default is true)
+     */
+    doRegisters(asArgs, fInstruction)
+    {
+        if (asArgs && asArgs[1] == '?') {
+            this.println("register commands:");
+            this.println("\tr\tdump registers");
+            this.println("\trm\tdump misc registers");
+            this.println("\trx [#]\tset flag or register x to [#]");
+            return;
+        }
+
+        var cpu = this.cpu;
+        var fMisc = undefined;
+        if (fInstruction == null) fInstruction = true;
+
+        if (asArgs != null && asArgs.length > 1) {
+            var sReg = asArgs[1];
+
+            if (sReg == 'm') {
+                fMisc = true;
+            }
+            else {
+                var sValue = null;
+                var i = sReg.indexOf('=');
+                if (i > 0) {
+                    sValue = sReg.substr(i + 1);
+                    sReg = sReg.substr(0, i);
+                }
+                else if (asArgs.length > 2) {
+                    sValue = asArgs[2];
+                }
+                else {
+                    this.println("missing value for " + asArgs[1]);
+                    return;
+                }
+
+                var value = this.parseExpression(sValue);
+                if (value === undefined) return;
+
+                var iReg = this.getRegIndex(sReg);
+                if (iReg < 0) {
+                    this.println("unknown register: " + sReg);
+                    return;
+                }
+
+                this.setRegValue(iReg, value);
+
+                this.cmp.updateDisplays();
+                this.println("updated registers:");
+            }
+        }
+
+        this.println(this.getRegDump(fMisc));
+
+        if (fInstruction) {
+            this.setAddr(this.dbgAddrCode, cpu.getXC());
+            this.doUnassemble(this.toStrAddr(this.dbgAddrCode));
+        }
+    }
+
+    /**
+     * doRun(sCmd, sAddr, sOptions, fQuiet)
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} sCmd
+     * @param {string|undefined} [sAddr]
+     * @param {string} [sOptions] (the rest of the breakpoint command-line)
+     * @param {boolean} [fQuiet]
+     */
+    doRun(sCmd, sAddr, sOptions, fQuiet)
+    {
+        if (sAddr !== undefined) {
+            var dbgAddr = this.parseAddr(sAddr);
+            this.parseAddrOptions(dbgAddr, sOptions);
+            this.setTempBreakpoint(dbgAddr);
+        }
+        this.startCPU(true, fQuiet);
+    }
+
+    /**
+     * doPrint(sCmd)
+     *
+     * NOTE: If the string to print is a quoted string, then we run it through replaceRegs(), so that
+     * you can take advantage of all the special replacement options used for software interrupt logging.
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} sCmd
+     */
+    doPrint(sCmd)
+    {
+        sCmd = Str.trim(sCmd);
+        var a = sCmd.match(/^(['"])(.*?)\1$/);
+        if (!a) {
+            this.parseExpression(sCmd, false);
+        } else {
+            if (a[2].length > 1) {
+                this.println(this.replaceRegs(a[2]));
+            } else {
+                this.printValue(null, a[2].charCodeAt(0));
+            }
+        }
+    }
+
+    /**
+     * doStep(sCmd, sOption)
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} [sCmd] "p" or "pr"
+     * @param {string} [sOption]
+     */
+    doStep(sCmd, sOption)
+    {
+        var fCallStep = true;
+        var nRegs = (sCmd == "p"? 0 : (sCmd == "pr"? 1 : -1));
+
+        if (sOption == '?' || nRegs < 0) {
+            this.println("step commands:");
+            this.println("\tp\tstep over instruction");
+            this.println("\tpr\tstep over instruction with register update");
+            return;
+        }
+
+        /*
+         * Set up the value for this.nStep (ie, 1 or 2) depending on whether the user wants
+         * a subsequent register dump ("pr") or not ("p").
+         */
+        var nStep = 1 + nRegs;
+
+        if (!this.nStep) {
+            var dbgAddr = this.newAddr(this.cpu.getPC());
+            var opCode = this.getWord(dbgAddr);
+
+            if (this.nStep) {
+                this.setTempBreakpoint(dbgAddr);
+                if (!this.startCPU()) {
+                    if (this.cmp) this.cmp.setFocus();
+                    this.nStep = 0;
+                }
+                /*
+                 * A successful run will ultimately call stop(), which will in turn call clearTempBreakpoint(),
+                 * which will clear nStep, so there's your assurance that nStep will be reset.  Now we may have
+                 * stopped for reasons unrelated to the temporary breakpoint, but that's OK.
+                 */
+            } else {
+                this.doTrace(nRegs? "tr" : "t");
+            }
+        } else {
+            this.println("step in progress");
+        }
+    }
+
+    /**
+     * getCall(dbgAddr)
+     *
+     * Given a possible return address (typically from the stack), look for a matching CALL (or INT) that
+     * immediately precedes that address.
+     *
+     * @this {DebuggerPDP10}
+     * @param {DbgAddrPDP10} dbgAddr
+     * @return {string|null} CALL instruction at or near dbgAddr, or null if none
+     */
+    getCall(dbgAddr)
+    {
+        var sCall = null;
+        var addr = dbgAddr.addr;
+        var addrOrig = addr;
+        for (var n = 1; n <= 6 && !!addr; n++) {
+            if (n > 2) {
+                dbgAddr.addr = addr;
+                var s = this.getInstruction(dbgAddr);
+                if (s.indexOf("JSR") >= 0) {
+                    /*
+                     * Verify that the length of this call, when added to the address of the call, matches
+                     * the original return address.  We do this by getting the string index of the opcode bytes,
+                     * subtracting that from the string index of the next space, and dividing that difference
+                     * by two, to yield the length of the CALL (or INT) instruction, in bytes.
+                     */
+                    var i = s.indexOf(' ');
+                    var j = s.indexOf(' ', i+1);
+                    if (addr + (j - i - 1)/2 == addrOrig) {
+                        sCall = s;
+                        break;
+                    }
+                }
+            }
+            addr -= 2;
+        }
+        dbgAddr.addr = addrOrig;
+        return sCall;
+    }
+
+    /**
+     * doStackTrace(sCmd, sAddr)
+     *
+     * Use "k" for a normal stack trace and "ks" for a stack trace with symbolic info.
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} [sCmd]
+     * @param {string} [sAddr] (not used yet)
+     */
+    doStackTrace(sCmd, sAddr)
+    {
+        if (sAddr == '?') {
+            this.println("stack trace commands:");
+            this.println("\tk\tshow frame addresses");
+            this.println("\tks\tshow symbol information");
+            return;
+        }
+
+        var nFrames = 10, cFrames = 0;
+        var dbgAddrCall = this.newAddr();
+        var dbgAddrStack = this.newAddr(/*this.cpu.getSP()*/);
+        this.println("stack trace for " + this.toStrAddr(dbgAddrStack));
+
+        while (cFrames < nFrames) {
+            var sCall = null, sCallPrev = null, cTests = 256;
+            while ((dbgAddrStack.addr >>> 0) < 0x10000) {
+                dbgAddrCall.addr = this.getWord(dbgAddrStack, 2);
+                /*
+                 * Because we're using the auto-increment feature of getWord(), and because that will automatically
+                 * wrap the offset around the end of the segment, we must also check the addr property to detect the wrap.
+                 */
+                if (dbgAddrStack.addr == null || !cTests--) break;
+                if (dbgAddrCall.addr & 0x1) continue;           // an odd address on the PDP-11 is not a valid instruction boundary
+                sCall = this.getCall(dbgAddrCall);
+                if (sCall) break;
+            }
+            /*
+             * The sCallPrev check eliminates duplicate sequential calls, which are usually (but not always)
+             * indicative of a false positive, in which case the previous call is probably bogus as well, but
+             * at least we won't duplicate that mistake.  Of course, there are always exceptions, recursion
+             * being one of them, but it's rare that we're debugging recursive code.
+             */
+            if (!sCall || sCall == sCallPrev) break;
+            var sSymbol = null;
+            if (sCmd == "ks") {
+                var a = sCall.match(/[0-9A-F]+$/);
+                if (a) sSymbol = this.doList(a[0]);
+            }
+            sCall = Str.pad(sCall, 50) + "  ;" + (sSymbol || "stack=" + this.toStrAddr(dbgAddrStack)); // + " return=" + this.toStrAddr(dbgAddrCall));
+            this.println(sCall);
+            sCallPrev = sCall;
+            cFrames++;
+        }
+        if (!cFrames) this.println("no return addresses found");
+    }
+
+    /**
+     * doTrace(sCmd, sCount)
+     *
+     * The "t" and "tr" commands interpret the count as a number of instructions, and since
+     * we call the Debugger's stepCPU() for each iteration, a single instruction includes
+     * any/all prefixes; the CPU's stepCPU() treats prefixes as discrete operations.  The only
+     * difference between "t" and "tr": the former displays only the next instruction, while
+     * the latter also displays the (updated) registers.
+     *
+     * The "tc" command interprets the count as a number of cycles rather than instructions,
+     * allowing you to quickly execute large chunks of instructions with a single command; it
+     * doesn't display anything until the the chunk has finished.  "tc 1" is also a useful
+     * command in that it doesn't inhibit interrupts like "t" or "tr" does.
+     *
+     * However, generally a more useful command is "bn", which allows you to break after some
+     * number of instructions have been executed (as opposed to some number of cycles).
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} [sCmd] ("t", "tc", or "tr")
+     * @param {string} [sCount] # of instructions to step
+     */
+    doTrace(sCmd, sCount)
+    {
+        if (sCount == '?') {
+            this.println("trace commands:");
+            this.println("\tt  [#]\ttrace # instructions");
+            this.println("\ttr [#]\ttrace # instructions with register updates");
+            this.println("\ttc [#]\ttrace # cycles");
+            this.println("note: bn [#] breaks after # instructions without updates");
+            return;
+        }
+
+        var dbg = this;
+        var fRegs = (sCmd != "t");
+        var nCount = this.parseValue(sCount, null, true) || 1;
+
+        /*
+         * We used to set nCycles to 1 when a count > 1 was specified, because nCycles set
+         * to 0 used to mean "execute the next instruction without checking for interrupts".
+         * Well, this machine's stepCPU() doesn't do that; it ALWAYS checks for interrupts,
+         * so we should leave nCycles set to 0, so that if an interrupt is dispatched, we will
+         * get to see the first instruction of the interrupt handler.
+         */
+        var nCycles = 0;    // (nCount == 1? 0 : 1);
+
+        if (sCmd == "tc") {
+            nCycles = nCount;
+            nCount = 1;
+        }
+        this.sCmdTracePrev = sCmd;
+
+        Web.onCountRepeat(
+            nCount,
+            function onCountStep() {
+                return dbg.setBusy(true) && dbg.stepCPU(nCycles, fRegs, false);
+            },
+            function onCountStepComplete() {
+                /*
+                 * We explicitly called stepCPU() with fUpdateDisplays set to false, because repeatedly
+                 * calling updateDisplays() can be very slow, especially if a Control Panel is present with
+                 * displayLiveRegs enabled, so once the repeat count has been exhausted, we must perform
+                 * a final updateDisplays().
+                 */
+                if (dbg.panel) dbg.panel.stop();
+                dbg.cmp.updateDisplays(-1);
+                dbg.setBusy(false);
+            }
+        );
+    }
+
+    /**
+     * doUnassemble(sAddr, sAddrEnd, nLines)
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} [sAddr]
+     * @param {string} [sAddrEnd]
+     * @param {number} [nLines]
+     */
+    doUnassemble(sAddr, sAddrEnd, nLines)
+    {
+        var dbgAddr = this.parseAddr(sAddr, this.dbgAddrCode);
+
+        if (nLines === undefined) nLines = 1;
+
+        var nBytes = 0x100;
+        if (sAddrEnd !== undefined) {
+
+            if (sAddrEnd.charAt(0) == 'l') {
+                var n = this.parseValue(sAddrEnd.substr(1));
+                if (n != null) nLines = n;
+            }
+            else {
+                var dbgAddrEnd = this.parseAddr(sAddrEnd);
+                if (dbgAddrEnd.addr < dbgAddr.addr) return;
+
+                nBytes = dbgAddrEnd.addr - dbgAddr.addr;
+                if (!DEBUG && nBytes > 0x100) {
+                    /*
+                     * Limiting the amount of disassembled code to 256 bytes in non-DEBUG builds is partly to
+                     * prevent the user from wedging the browser by dumping too many lines, but also a recognition
+                     * that, in non-DEBUG builds, this.println() keeps print output buffer truncated to 8Kb anyway.
+                     */
+                    this.println("range too large");
+                    return;
+                }
+                nLines = -1;
+            }
+        }
+
+        var nPrinted = 0;
+
+        while (nBytes > 0 && nLines--) {
+
+            var nSequence = (this.isBusy(false) || this.nStep)? this.nCycles : null;
+            var sComment = (nSequence != null? "cycles" : null);
+            var aSymbol = this.findSymbol(dbgAddr);
+
+            var addr = dbgAddr.addr;    // we snap dbgAddr.addr *after* calling findSymbol(), which re-evaluates it
+
+            if (aSymbol[0] && nLines) {
+                if (!nPrinted && nLines || aSymbol[0].indexOf('+') < 0) {
+                    var sLabel = aSymbol[0] + ':';
+                    if (aSymbol[2]) sLabel += ' ' + aSymbol[2];
+                    this.println(sLabel);
+                }
+            }
+            if (aSymbol[3]) {
+                sComment = aSymbol[3];
+                nSequence = null;
+            }
+            this.copyAddr(this.dbgAddrAssemble, dbgAddr);
+            this.println(this.getInstruction(dbgAddr, sComment, nSequence));
+            nBytes -= dbgAddr.addr - addr;
+            nPrinted++;
+        }
+    }
+
+    /**
+     * splitArgs(sCmd, sDelim)
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} sCmd
+     * @param {string} [sDelim]
+     * @return {Array.<string>}
+     */
+    splitArgs(sCmd, sDelim = " ")
+    {
+        var asArgs = [];
+        var chQuote = "";
+        var i = 0, iLast = 0;
+
+        while (i < sCmd.length) {
+            var ch = sCmd[i++];
+            if (chQuote) {
+                if (ch == chQuote) {
+                    chQuote = "";
+                    asArgs.push(sCmd.substr(iLast, i - iLast));
+                    iLast = i;
+                }
+                continue;
+            }
+            if (ch == '"' || ch == "'") {
+                chQuote = ch;
+                continue;
+            }
+            if (sDelim.indexOf(ch) >= 0) {
+                asArgs.push(sCmd.substr(iLast, i - iLast - 1));
+                iLast = i;
+            }
+        }
+        if (iLast < i) {
+            asArgs.push(sCmd.substr(iLast, i - iLast));
+        }
+
+        asArgs[0] = asArgs[0].toLowerCase();
+        if (asArgs && asArgs.length) {
+            var s0 = asArgs[0];
+            var ch0 = s0.charAt(0);
+            for (i = 1; i < s0.length; i++) {
+                ch = s0.charAt(i);
+                if (ch0 == '?' || ch0 == 'r' || ch < 'a' || ch > 'z') {
+                    asArgs[0] = s0.substr(i);
+                    asArgs.unshift(s0.substr(0, i));
+                    break;
+                }
+            }
+        }
+        return asArgs;
+    }
+
+    /**
+     * doCommand(sCmd, fQuiet)
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} sCmd
+     * @param {boolean} [fQuiet]
+     * @return {boolean} true if command processed, false if unrecognized
+     */
+    doCommand(sCmd, fQuiet)
+    {
+        var result = true;
+
+        try {
+            if (DEBUG && sCmd == "test") {
+                this.doTest();
+                return true;
+            }
+            if (!sCmd.length || sCmd == "end") {
+                if (this.fAssemble) {
+                    this.println("ended assemble at " + this.toStrAddr(this.dbgAddrAssemble));
+                    this.fAssemble = false;
+                }
+                sCmd = "";
+            }
+            else if (!fQuiet) {
+                this.println(DebuggerPDP10.PROMPT + sCmd);
+            }
+
+            var ch = sCmd.charAt(0);
+            if (ch == '"' || ch == "'") return true;
+
+            /*
+             * Zap the previous message buffer to ensure the new command's output is not tossed out as a repeat.
+             */
+            this.sMessagePrev = null;
+
+            /*
+             * I've relaxed the !isBusy() requirement, to maximize our ability to issue Debugger commands externally.
+             */
+            if (this.isReady() /* && !this.isBusy(true) */ && sCmd.length > 0) {
+
+                if (this.fAssemble) {
+                    sCmd = "a " + this.toStrAddr(this.dbgAddrAssemble) + ' ' + sCmd;
+                }
+
+                var fError = false;
+                var asArgs = this.splitArgs(sCmd);
+
+                switch (asArgs[0].charAt(0)) {
+                case 'a':
+                    result = this.doAssemble(asArgs);
+                    break;
+                case 'b':
+                    this.doBreak(asArgs[0], asArgs[1], sCmd);
+                    break;
+                case 'c':
+                    this.doClear(asArgs[0]);
+                    break;
+                case 'd':
+                    if (!COMPILED && sCmd == "debug") {
+                        window.DEBUG = true;
+                        this.println("DEBUG checks on");
+                        break;
+                    }
+                    this.doDump(asArgs);
+                    break;
+                case 'e':
+                    if (asArgs[0] == "else") break;
+                    this.doEdit(asArgs);
+                    break;
+                case 'g':
+                    this.doRun(asArgs[0], asArgs[1], sCmd, fQuiet);
+                    break;
+                case 'h':
+                    this.doHalt(fQuiet);
+                    break;
+                case 'i':
+                    if (asArgs[0] == "if") {
+                        if (!this.doIf(sCmd.substr(2), fQuiet)) {
+                            result = false;
+                        }
+                        break;
+                    }
+                    fError = true;
+                    break;
+                case 'k':
+                    this.doStackTrace(asArgs[0], asArgs[1]);
+                    break;
+                case 'l':
+                    if (asArgs[0] == "ln") {
+                        this.doList(asArgs[1], true);
+                        break;
+                    }
+                    fError = true;
+                    break;
+                case 'm':
+                    this.doMessages(asArgs);
+                    break;
+                case 'p':
+                    if (asArgs[0] == "print") {
+                        this.doPrint(sCmd.substr(5));
+                        break;
+                    }
+                    this.doStep(asArgs[0], asArgs[1]);
+                    break;
+                case 'r':
+                    if (sCmd == "reset") {
+                        if (this.cmp) this.cmp.reset();
+                        break;
+                    }
+                    this.doRegisters(asArgs);
+                    break;
+                case 's':
+                    this.doOptions(asArgs);
+                    break;
+                case 't':
+                    this.doTrace(asArgs[0], asArgs[1]);
+                    break;
+                case 'u':
+                    this.doUnassemble(asArgs[1], asArgs[2], 8);
+                    break;
+                case 'v':
+                    if (asArgs[0] == "var") {
+                        if (!this.doVar(sCmd.substr(3))) {
+                            result = false;
+                        }
+                        break;
+                    }
+                    if (asArgs[0] == "ver") {
+                        this.println((PDP10.APPNAME || "PDP10") + " version " + (XMLVERSION || PDP10.APPVERSION) + " (" + this.cpu.model + (PDP10.COMPILED? ",RELEASE" : (PDP10.DEBUG? ",DEBUG" : ",NODEBUG")) + ')');
+                        this.println(Web.getUserAgent());
+                        break;
+                    }
+                    fError = true;
+                    break;
+                case '?':
+                    if (asArgs[1]) {
+                        this.doPrint(sCmd.substr(1));
+                        break;
+                    }
+                    this.doHelp();
+                    break;
+                case 'n':
+                    if (!COMPILED && sCmd == "nodebug") {
+                        window.DEBUG = false;
+                        this.println("DEBUG checks off");
+                        break;
+                    }
+                    if (this.doInfo(asArgs)) break;
+                    /* falls through */
+                default:
+                    fError = true;
+                    break;
+                }
+                if (fError) {
+                    this.println("unknown command: " + sCmd);
+                    result = false;
+                }
+            }
+        } catch(e) {
+            this.println("Debugger " + (e.stack || e.message));
+            result = false;
+        }
+        return result;
+    }
+
+    /**
+     * doCommands(sCmds, fSave)
+     *
+     * This function is now written so that if any async command, such as assemble ('a'), stopped the
+     * flow of commands by returning false, it can call us from its callback handler with no arguments,
+     * and command processing should continue where it left off.
+     *
+     * @this {DebuggerPDP10}
+     * @param {string} [sCmds]
+     * @param {boolean} [fSave]
+     * @return {boolean} true if all commands processed, false if not
+     */
+    doCommands(sCmds, fSave)
+    {
+        if (sCmds != null) {
+            this.aCommands = this.parseCommand(sCmds, fSave);
+        }
+        var sCmd;
+        while (sCmd = this.aCommands.shift()) {
+            if (!this.doCommand(sCmd)) return false;
+        }
+        return true;
+    }
+
+    /**
+     * doTest()
+     *
+     * This function exercises the disassembler by performing look-ups for all possible operation codes
+     * and displaying the results.  It's not intended to be included in the compiled version of the Debugger
+     * (DEBUG only).
+     *
+     * @this {DebuggerPDP10}
+     */
+    doTest()
+    {
+        if (MAXDEBUG) {
+            var ops = {}, aOpXXX = [];
+            var op, opXXX, opCode, sOperation;
+            for (op = 0o00000; op <= 0o77774; op += 4) {
+                opCode = op * Math.pow(2, 21);
+                sOperation = this.findInstruction(opCode, false);
+                if (!sOperation) continue;
+                if (ops[sOperation] === undefined) {
+                    ops[sOperation] = op;
+                } else {
+                    ops[sOperation] &= op;
+                }
+                opXXX = op >> 6;
+                if (!aOpXXX[opXXX]) {
+                    aOpXXX[opXXX] = sOperation;
+                } else if (aOpXXX[opXXX] != sOperation) {
+                    aOpXXX[opXXX] = "XXX";
+                }
+            }
+            for (sOperation in ops) {
+                op = ops[sOperation];
+                this.println(Str.pad(sOperation + ":", 8) + this.toStrWord(op * Math.pow(2, 21)));
+                //
+                // The following code leveraged the disassembler to generate opcode handlers.
+                //
+                // this.println("/**");
+                // this.println(" * op" + sOperation + "(" + this.toStrWord(op * Math.pow(2, 21)) + ")");
+                // this.println(" *");
+                // this.println(" * @this {CPUStatePDP10}");
+                // this.println(" * @param {number} opCode");
+                // this.println(" */");
+                // this.println("PDP10.op" + sOperation + " = function(opCode)");
+                // this.println("{");
+                // this.println("    this.opUndefined(op);");
+                // this.println("};\n");
+            }
+            //
+            // The following code generated an opcode dispatch table.
+            //
+            // this.println("PDP10.aOpXXX = [");
+            // for (opXXX = 0o000; opXXX <= 0o777; opXXX++) {
+            //     sOperation = aOpXXX[opXXX];
+            //     sOperation = sOperation? ("    PDP10.op" + sOperation + ",") : "    PDP10.opUndefined,";
+            //     sOperation = Str.pad(sOperation, 32);
+            //     sOperation += "// " + Str.toOct(opXXX, 3, true) + "xxx";
+            //     this.println(sOperation);
+            // }
+            // this.println("];");
+        }
+    }
+
+    /**
+     * DebuggerPDP10.init()
+     *
+     * This function operates on every HTML element of class "debugger", extracting the
+     * JSON-encoded parameters for the Debugger constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a Debugger component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeDbg = Component.getElementsByClass(document, PDP10.APPCLASS, "debugger");
+        for (var iDbg = 0; iDbg < aeDbg.length; iDbg++) {
+            var eDbg = aeDbg[iDbg];
+            var parmsDbg = Component.getComponentParms(eDbg);
+            var dbg = new DebuggerPDP10(parmsDbg);
+            Component.bindComponentControls(dbg, eDbg, PDP10.APPCLASS);
+        }
+    }
+}
+
+if (DEBUGGER) {
+
+    /*
+     * NOTE: Every DebuggerPDP10 property from here to the first prototype function definition (initBus()) is
+     * considered a "class constant"; most of them use our "all-caps" convention (and all of them SHOULD, but
+     * that wouldn't help us catch any bugs).
+     *
+     * Technically, all of them should ALSO be preceded by a "@const" annotation, but that's a lot of work and it
+     * really clutters the code.  I wish the Closure Compiler had a way to annotate every definition with a given
+     * section with a single annotation....
+     */
+
+    DebuggerPDP10.COMMANDS = {
+        '?':        "help/print",
+        'a [#]':    "assemble",             // TODO: Implement this command someday
+        'b [#]':    "breakpoint",           // multiple variations (use b? to list them)
+        'c':        "clear output",
+        'd [#]':    "dump memory",          // additional syntax: d [#] [l#], where l# is a number of bytes to dump
+        'e [#]':    "edit memory",
+        'g [#]':    "go [to #]",
+        'h':        "halt",
+        'if':       "eval expression",
+        'int [#]':  "request interrupt",
+        'k':        "stack trace",
+        "ln":       "list nearest symbol(s)",
+        'm':        "messages",
+        'p':        "step over",            // other variations: pr (step and dump registers)
+        'print':    "print expression",
+        'r':        "dump/set registers",
+        'reset':    "reset machine",
+        's':        "set options",
+        't [#]':    "trace",                // other variations: tr (trace and dump registers)
+        'u [#]':    "unassemble",
+        'var':      "assign variable",
+        'ver':      "print version"
+    };
+
+    /*
+     * CPU opcode IDs
+     */
+    DebuggerPDP10.OPS = {
+        NONE:   0,
+        HLL:    1,      HLLZ:   2,      HLLO:   3,      HLLE:   4,
+        HRL:    5,      HRLZ:   6,      HRLO:   7,      HRLE:   8,
+        HRR:    9,      HRRZ:   10,     HRRO:   11,     HRRE:   12,
+        HLR:    13,     HLRZ:   14,     HLRO:   15,     HLRE:   16,
+        MOVE:   17,     MOVS:   18,     MOVN:   19,     MOVM:   20,
+        EXCH:   21,     BLT:    22,     PUSH:   23,     POP:    24,
+        LDB:    25,     DPB:    26,     IBP:    27,     ILDB:   28,
+        IDPB:   29,     SETZ:   30,     SETO:   31,     SETA:   32,
+        SETCA:  33,     SETM:   34,     SETCM:  35,     AND:    36,
+        ANDCA:  37,     ANDCM:  38,     ANDCB:  39,     IOR:    40,
+        ORCA:   41,     ORCM:   42,     ORCB:   43,     XOR:    44,
+        EQV:    45,     LSH:    46,     LSHC:   47,     ROT:    48,
+        ROTC:   49,     ADD:    50,     SUB:    51,     MUL:    52,
+        IMUL:   53,     DIV:    54,     IDIV:   55,     ASH:    56,
+        ASHC:   57,     FSC:    58,     FADR:   59,     FSBR:   60,
+        FMPR:   61,     FDVR:   62,     DFN:    63,     UFA:    64,
+        FAD:    65,     FSB:    66,     FMP:    67,     FDV:    68,
+        AOBJP:  69,     AOBJN:  70,     CAI:    71,     CAM:    72,
+        JUMP:   73,     SKIP:   74,     AOJ:    75,     AOS:    76,
+        SOJ:    77,     SOS:    78,     TR:     79,     TL:     80,
+        TD:     81,     TS:     82,     XCT:    83,     JFFO:   84,
+        JFCL:   85,     JSR:    86,     JSP:    87,     JRST:   88,
+        JSA:    89,     JRA:    90,     PUSHJ:  91,     POPJ:   92,
+        BLKI:   93,     DATAI:  94,     BLKO:   95,     DATAO:  96,
+        CONO:   97,     CONI:   98,     CONSZ:  99,     CONSO:  100,
+        UUO:    101,    JOV:    102,    JCRY0:  103,    JCRY1:  104,
+        JCRY:   105,    JFOV:   106,    HALT:   107,    JRSTF:  108,
+        JEN:    109
+    };
+
+    /*
+     * CPU opcode names, indexed by CPU opcode ordinal (above)
+     */
+    DebuggerPDP10.OPNAMES = [
+        ".WORD",
+        "HLL",          "HLLZ",         "HLLO",         "HLLE",
+        "HRL",          "HRLZ",         "HRLO",         "HRLE",
+        "HRR",          "HRRZ",         "HRRO",         "HRRE",
+        "HLR",          "HLRZ",         "HLRO",         "HLRE",
+        "MOVE",         "MOVS",         "MOVN",         "MOVM",
+        "EXCH",         "BLT",          "PUSH",         "POP",
+        "LDB",          "DPB",          "IBP",          "ILDB",
+        "IDPB",         "SETZ",         "SETO",         "SETA",
+        "SETCA",        "SETM",         "SETCM",        "AND",
+        "ANDCA",        "ANDCM",        "ANDCB",        "IOR",
+        "ORCA",         "ORCM",         "ORCB",         "XOR",
+        "EQV",          "LSH",          "LSHC",         "ROT",
+        "ROTC",         "ADD",          "SUB",          "MUL",
+        "IMUL",         "DIV",          "IDIV",         "ASH",
+        "ASHC",         "FSC",          "FADR",         "FSBR",
+        "FMPR",         "FDVR",         "DFN",          "UFA",
+        "FAD",          "FSB",          "FMP",          "FDV",
+        "AOBJP",        "AOBJN",        "CAI",          "CAM",
+        "JUMP",         "SKIP",         "AOJ",          "AOS",
+        "SOJ",          "SOS",          "TR",           "TL",
+        "TD",           "TS",           "XCT",          "JFFO",
+        "JFCL",         "JSR",          "JSP",          "JRST",
+        "JSA",          "JRA",          "PUSHJ",        "POPJ",
+        "BLKI",         "DATAI",        "BLKO",         "DATAO",
+        "CONO",         "CONI",         "CONSZ",        "CONSO",
+        "UUO",          "JOV",          "JCRY0",        "JCRY1",
+        "JCRY",         "JFOV",         "HALT",         'JRSTF',
+        "JEN"
+    ];
+
+    DebuggerPDP10.REGS = {
+        PC:     0,
+        RA:     1,
+        EA:     2,
+        PS:     3,
+        OV:     4,                              // single-bit "register" representing the Overflow flag
+        C0:     5,                              // single-bit "register" representing the Carry 0 flag
+        C1:     6,                              // single-bit "register" representing the Carry 1 flag
+        BI:     7,                              // single-bit "register" representing the Byte Interrupt flag
+        ND:     8,                              // single-bit "register" representing the No Divide flag
+        PD:     9,                              // single-bit "register" representing the Pushdown Overflow flag
+    };
+
+    DebuggerPDP10.REGNAMES = [
+        "PC", "RA", "EA", "PS", "OV", "C0", "C1", "BI", "ND", "PD"
+    ];
+
+    /*
+     * OPTABLE is a collection of masks, and each mask refers to a collection of opcode
+     * patterns associated with that mask; the disassembler applies each mask to the opcode,
+     * and when a masked opcode matches one of the associated patterns, the corresponding
+     * instruction is considered a match.
+     */
+    DebuggerPDP10.OPTABLE = {
+        [PDP10.OPCODE.OPUUO]: {                 // 0o70000
+            0o00000: DebuggerPDP10.OPS.UUO
+        },
+        [PDP10.OPCODE.OPMASK]: {                // 0o77700
+            0o13000: DebuggerPDP10.OPS.UFA,
+            0o13100: DebuggerPDP10.OPS.DFN,
+            0o13200: DebuggerPDP10.OPS.FSC,
+            0o13300: DebuggerPDP10.OPS.IBP,
+            0o13400: DebuggerPDP10.OPS.ILDB,
+            0o13500: DebuggerPDP10.OPS.LDB,
+            0o13600: DebuggerPDP10.OPS.IDPB,
+            0o13700: DebuggerPDP10.OPS.DPB,
+            0o24000: DebuggerPDP10.OPS.ASH,
+            0o24100: DebuggerPDP10.OPS.ROT,
+            0o24200: DebuggerPDP10.OPS.LSH,
+            0o24300: DebuggerPDP10.OPS.JFFO,
+            0o24400: DebuggerPDP10.OPS.ASHC,
+            0o24500: DebuggerPDP10.OPS.ROTC,
+            0o24600: DebuggerPDP10.OPS.LSHC,
+            0o25000: DebuggerPDP10.OPS.EXCH,
+            0o25100: DebuggerPDP10.OPS.BLT,
+            0o25200: DebuggerPDP10.OPS.AOBJP,
+            0o25300: DebuggerPDP10.OPS.AOBJN,
+            0o25400: DebuggerPDP10.OPS.JRST,    // includes HALT, JRSTF, and JEN
+            0o25500: DebuggerPDP10.OPS.JFCL,    // includes JOV, JCRY0, JCRY1, JCRY, and JFOV
+            0o25600: DebuggerPDP10.OPS.XCT,
+            0o26000: DebuggerPDP10.OPS.PUSHJ,
+            0o26100: DebuggerPDP10.OPS.PUSH,
+            0o26200: DebuggerPDP10.OPS.POP,
+            0o26300: DebuggerPDP10.OPS.POPJ,
+            0o26400: DebuggerPDP10.OPS.JSR,
+            0o26500: DebuggerPDP10.OPS.JSP,
+            0o26600: DebuggerPDP10.OPS.JSA,
+            0o26700: DebuggerPDP10.OPS.JRA,
+        },
+        [PDP10.OPCODE.OPMODE]: {                // 0o77400
+            0o14000: DebuggerPDP10.OPS.FAD,
+            0o14400: DebuggerPDP10.OPS.FADR,
+            0o15000: DebuggerPDP10.OPS.FSB,
+            0o15400: DebuggerPDP10.OPS.FSBR,
+            0o16000: DebuggerPDP10.OPS.FMP,
+            0o16400: DebuggerPDP10.OPS.FMPR,
+            0o17000: DebuggerPDP10.OPS.FDV,
+            0o17400: DebuggerPDP10.OPS.FDVR,
+            0o20000: DebuggerPDP10.OPS.MOVE,
+            0o20400: DebuggerPDP10.OPS.MOVS,
+            0o21000: DebuggerPDP10.OPS.MOVN,
+            0o21400: DebuggerPDP10.OPS.MOVM,
+            0o22000: DebuggerPDP10.OPS.IMUL,
+            0o22400: DebuggerPDP10.OPS.MUL,
+            0o23000: DebuggerPDP10.OPS.IDIV,
+            0o23400: DebuggerPDP10.OPS.DIV,
+            0o27000: DebuggerPDP10.OPS.ADD,
+            0o27400: DebuggerPDP10.OPS.SUB,
+            0o40000: DebuggerPDP10.OPS.SETZ,    // MACRO alias: CLEAR
+            0o40400: DebuggerPDP10.OPS.AND,
+            0o41000: DebuggerPDP10.OPS.ANDCA,
+            0o41400: DebuggerPDP10.OPS.SETM,
+            0o42000: DebuggerPDP10.OPS.ANDCM,
+            0o42400: DebuggerPDP10.OPS.SETA,
+            0o43000: DebuggerPDP10.OPS.XOR,
+            0o43400: DebuggerPDP10.OPS.IOR,     // MACRO alias: OR
+            0o44000: DebuggerPDP10.OPS.ANDCB,
+            0o44400: DebuggerPDP10.OPS.EQV,
+            0o45000: DebuggerPDP10.OPS.SETCA,
+            0o45400: DebuggerPDP10.OPS.ORCA,
+            0o46000: DebuggerPDP10.OPS.SETCM,
+            0o46400: DebuggerPDP10.OPS.ORCM,
+            0o47000: DebuggerPDP10.OPS.ORCB,
+            0o47400: DebuggerPDP10.OPS.SETO,
+            0o50000: DebuggerPDP10.OPS.HLL,
+            0o50400: DebuggerPDP10.OPS.HRL,
+            0o51000: DebuggerPDP10.OPS.HLLZ,
+            0o51400: DebuggerPDP10.OPS.HRLZ,
+            0o52000: DebuggerPDP10.OPS.HLLO,
+            0o52400: DebuggerPDP10.OPS.HRLO,
+            0o53000: DebuggerPDP10.OPS.HLLE,
+            0o53400: DebuggerPDP10.OPS.HRLE,
+            0o54000: DebuggerPDP10.OPS.HRR,
+            0o54400: DebuggerPDP10.OPS.HLR,
+            0o55000: DebuggerPDP10.OPS.HRRZ,
+            0o55400: DebuggerPDP10.OPS.HLRZ,
+            0o56000: DebuggerPDP10.OPS.HRRO,
+            0o56400: DebuggerPDP10.OPS.HLRO,
+            0o57000: DebuggerPDP10.OPS.HRRE,
+            0o57400: DebuggerPDP10.OPS.HLRE
+        },
+        [PDP10.OPCODE.OPCOMP]: {                // 0o77000
+            0o30000: DebuggerPDP10.OPS.CAI,
+            0o31000: DebuggerPDP10.OPS.CAM,
+            0o32000: DebuggerPDP10.OPS.JUMP,
+            0o33000: DebuggerPDP10.OPS.SKIP,
+            0o34000: DebuggerPDP10.OPS.AOJ,
+            0o35000: DebuggerPDP10.OPS.AOS,
+            0o36000: DebuggerPDP10.OPS.SOJ,
+            0o37000: DebuggerPDP10.OPS.SOS,
+        },
+        [PDP10.OPCODE.OPTEST]: {                // 0o71100
+            0o60000: DebuggerPDP10.OPS.TR,
+            0o60100: DebuggerPDP10.OPS.TL,
+            0o61000: DebuggerPDP10.OPS.TD,
+            0o61100: DebuggerPDP10.OPS.TS,
+        },
+        [PDP10.OPCODE.OPIO]: {                  // 0o70034
+            0o70000: DebuggerPDP10.OPS.BLKI,
+            0o70004: DebuggerPDP10.OPS.DATAI,
+            0o70010: DebuggerPDP10.OPS.BLKO,
+            0o70014: DebuggerPDP10.OPS.DATAO,
+            0o70020: DebuggerPDP10.OPS.CONO,
+            0o70024: DebuggerPDP10.OPS.CONI,
+            0o70030: DebuggerPDP10.OPS.CONSZ,
+            0o70034: DebuggerPDP10.OPS.CONSO
+        }
+    };
+
+    DebuggerPDP10.OPMODES = ["", "I", "M", "S"];
+    DebuggerPDP10.OPCOMPS = ["", "L", "E", "LE", "A", "GE", "N", "G"];
+    DebuggerPDP10.OPTESTS = ["N", "NE", "NA", "NN", "Z", "ZE", "ZA", "ZN", "C", "CE", "CA", "CN", "O", "OE", "OA", "ON"];
+
+    /*
+     * Apparently, DEC's MACRO program permits "JFCL xxx" (with a single argument) as an alternate for "JFCL 0,xxx"
+     * (which in turn is long-hand for "No-op", since JFCL with 0 does nothing).
+     */
+    DebuggerPDP10.JFCL = {
+        0o00:    DebuggerPDP10.OPS.JFCL,
+        0o10:    DebuggerPDP10.OPS.JOV,
+        0o04:    DebuggerPDP10.OPS.JCRY0,
+        0o02:    DebuggerPDP10.OPS.JCRY1,
+        0o06:    DebuggerPDP10.OPS.JCRY,
+        0o01:    DebuggerPDP10.OPS.JFOV
+    };
+
+    DebuggerPDP10.JRST = {
+        0o00:    DebuggerPDP10.OPS.JRST,
+        0o04:    DebuggerPDP10.OPS.HALT,
+        0o02:    DebuggerPDP10.OPS.JRSTF,
+        0o12:    DebuggerPDP10.OPS.JEN
+    };
+
+    DebuggerPDP10.ALTOPS = [
+        DebuggerPDP10.JFCL, DebuggerPDP10.JRST
+    ];
+
+    DebuggerPDP10.HISTORY_LIMIT = DEBUG? 100000 : 1000;
+
+    DebuggerPDP10.PROMPT = ">> ";
+
+    /*
+     * Initialize every Debugger module on the page (as IF there's ever going to be more than one ;-))
+     */
+    Web.onInit(DebuggerPDP10.init);
+
+}   // endif DEBUGGER
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp10/lib/macro10.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * Elements of tblMacros.
+ *
+ * @typedef {{
+ *      name:(string),
+ *      nOperand:(number),
+ *      aParms:(Array.<string>),
+ *      aDefaults:(Array.<string>),
+ *      aValues:(Array.<string>),
+ *      sText:(string),
+ *      nLine:(number)
+ * }}
+ */
+var Mac;
+
+/**
+ * Elements of tblSymbols.
+ *
+ * @typedef {{
+ *      name:(string),
+ *      value:(number),
+ *      nType:(number),
+ *      nLine:(number)
+ * }}
+ */
+var Sym;
+
+/**
+ * Elements of aLiterals.
+ *
+ * @typedef {{
+ *      name:(string),
+ *      aWords:(Array.<number>),
+ *      aFixups:(Array.<string>)
+ * }}
+ */
+var Lit;
+
+/**
+ * Elements of stackScopes.
+ *
+ * @typedef {{
+ *      name:(string|undefined),
+ *      aWords:(Array.<number>),
+ *      aFixups:(Array.<string>),
+ *      nLocation:(number),
+ *      nLocationScope:(number),
+ *      nLine:(number)
+ * }}
+ */
+var Scope;
+
+/**
+ * @class Macro10
+ * @property {string} sURL
+ * @property {number|null} addrLoad
+ * @property {string} sOptions
+ * @property {DebuggerPDP10} dbg
+ * @property {function(...)|undefined} done
+ * @property {number} iURL
+ * @property {Array.<string>} aURLs
+ * @property {Array.<number>} anLines
+ * @property {Array.<string>} asLines
+ * @property {number|null|undefined} addrStart
+ * @unrestricted
+ */
+class Macro10 {
+    /**
+     * Macro10(dbg)
+     *
+     * A "mini" version of DEC's MACRO-10 assembler, with just enough features to support the handful
+     * of DEC diagnostic source code files that we choose to throw at it.
+     *
+     * We rely on the calling component (dbg) to provide a variety of helper services (eg, println(),
+     * parseExpression(), etc).  This is NOT a subclass of Component, so Component services are not part
+     * of this class.
+     *
+     * @this {Macro10}
+     * @param {DebuggerPDP10} dbg (used to provide helper services to the Macro10 class)
+     */
+    constructor(dbg)
+    {
+        this.dbg = dbg;
+    }
+
+    /**
+     * init(addrLoad, sOptions, done)
+     *
+     * Initializes all instance properties.  Called by assembleFiles() and assembleString().
+     *
+     * Supported options include:
+     *
+     *      'd': leave all symbols in the debugger's variable table
+     *      'p': print the preprocessed resource(s) without assembling them
+     *      'l': print lines as they are parsed
+     *      's': treat the URL as a string and assemble it (assembleFiles() only)
+     *
+     * The done() callback is called after the resource(s) have been loaded (if necessary), parsed, and
+     * assembled.  The caller must use other methods to obtain further results (eg, getImage(), getStart()).
+     *
+     * The callback includes a non-zero error code if there was an error (and the URL):
+     *
+     *      done(nErrorCode, sURL)
+     *
+     * @this {Macro10}
+     * @param {number|null} [addrLoad] (the absolute address to assemble the code at, if any)
+     * @param {string|undefined} [sOptions] (zero or more letter codes to control the assembly process)
+     * @param {function(...)|undefined} [done]
+     */
+    init(addrLoad, sOptions, done)
+    {
+        this.addrLoad = addrLoad;
+        this.sOptions = (sOptions || "").toLowerCase();
+        this.done = done;
+
+        this.iURL = 0;
+        this.aURLs = [];
+
+        /**
+         * Number of lines per file.
+         *
+         * @type {Array.<number>}
+         */
+        this.anLines = [];
+
+        /**
+         * Lines from all the resources.
+         *
+         * @type {Array.<string>}
+         */
+        this.asLines = [];
+
+        if (MAXDEBUG) this.println("starting PCjs MACRO-10 Mini-Assembler...");
+
+        /*
+         * Initialize all the tables and other data structures that MACRO-10 uses.
+         *
+         * The Macros (tblMacros) and Symbols (tblSymbols) tables are fairly straightforward: they are
+         * indexed by a macro or symbol name, and each element is a Mac or Sym object, respectively.
+         *
+         * We also treat REPEAT blocks and CONDITIONAL (eg, IFE) blocks like macros, except that they are
+         * anonymous, parameter-less, and immediately invoked.  REPEAT blocks are always immediately invoked
+         * (repeatedly, based on the repeat count), whereas CONDITIONAL blocks are either immediately
+         * invoked if the associated condition is true or skipped if the condition is false.
+         *
+         * Finally, we have LITERAL blocks, which are semi-anonymous (we give each one an auto-generated
+         * name based on the current location) and are automatically but not immediately invoked.  Instead,
+         * after we've finished processing all the lines in the original input file, we run through all
+         * the LITERAL blocks in tblMacros and process the associated statement(s) at that time.
+         *
+         * Macros have the name that was assigned to them, REPEAT and conditional blocks have generated names
+         * that match the pseudo-op (eg, "?REPEAT", "?IFE"), and LITERAL blocks have generated location-based
+         * names.  All generated names use a leading question mark ('?') so that they don't conflict with
+         * normal MACRO-10 symbols.
+         */
+
+        /**
+         * @type {Object.<Mac>}
+         */
+        this.tblMacros = {};
+
+        /**
+         * @type {Object.<Sym>}
+         */
+        this.tblSymbols = {};
+
+        /**
+         * @type {Array.<Lit>}
+         */
+        this.aLiterals = [];            // array of literals
+
+        /**
+         * This keeps track of symbols suffixed with '#', which are later assembled into a variable pool,
+         * following the literal pool.
+         *
+         * @type {Array.<string>}
+         */
+        this.aVariables = [];
+
+        /**
+         * @type {Array.<number>}
+         */
+        this.aWords = [];               // filled in by the various genXXX() functions
+
+        /**
+         * This sparse array is indexed by location, and each used entry contains any undefined symbols that
+         * must be evaluated to fully resolve the word at the corresponding location.  NOTE: There's no requirement
+         * that the array be sparse; we could certainly fill each unused entry with null (ie, for locations that
+         * don't require a fixup).
+         *
+         * @type {Array.<string>}
+         */
+        this.aFixups = [];
+
+        /**
+         * This array parallels aFixups, providing context (ie, line numbers) for any fixups that we want to analyze.
+         *
+         * @type {Array.<number>}
+         */
+        this.aLineRefs = [];
+
+        this.nLine = 0;
+        this.nError = 0;
+        this.nLiteral = 0;              // used to uniquely number literals
+
+        /**
+         * @type {number}
+         */
+        this.nLocation = this.addrLoad || 0;
+
+        /**
+         * @type {number}
+         */
+        this.nLocationScope = -1;
+
+        /**
+         * @type {Array.<Scope>}
+         */
+        this.stackScopes = [];
+
+        this.sOperator = null;          // the active operator, if any
+        this.nMacroDef = 0;             // the active macro definition state
+        this.sMacroDef = null;          // the active macro definition name
+        this.chMacroOpen = this.chMacroClose = '';
+
+        /*
+         * This regular expression breaks each MACRO-10 line into the following elements:
+         *
+         *      [1]: label (with trailing semicolon), if any
+         *      [2]: operator (eg, opcode mnemonic or pseudo-op), if any
+         *      [3]: operator/operand whitespace separator, if any
+         *      [4]: operand(s), if any
+         *      [5]: comment, if any
+         */
+        this.reLine = /^[ \t]*([A-Z$%.?][0-9A-Z$%.]*:|)[ \t]*([A-Z$%.][0-9A-Z$%.]*|)([ \t]*)([^;]+|)(;?[\s\S]*)/i;
+
+        this.macroCall = null;          // the active macro being called, if any
+
+        /**
+         * If an ASCII/ASCIZ/SIXBIT pseudo-op is active, chASCII is set to the separator
+         * and sASCII collects the intervening character(s).
+         *
+         * @type {null|string}
+         */
+        this.chASCII = null;
+
+        /**
+         * @type {string}
+         */
+        this.sASCII = "";
+
+        this.addrStart = null;
+    }
+
+    /**
+     * assembleFiles(sURL, addrLoad, sOptions, done)
+     *
+     * Requests the resource(s) specified by sURL; multiple resources can be requested by separating
+     * them with semicolons.  The resources are requested and combined in the same order they are listed,
+     * and after the last resource has been received, they are assembled as a single unit.
+     *
+     * As a courtesy to the Debugger's doAssemble() function, we allow it to select between assembleFiles()
+     * and assembleString() by specifying an 's' option here, rather than having two separate code paths.
+     *
+     * @this {Macro10}
+     * @param {string} sURL (the URL(s) of the resource to be assembled)
+     * @param {number|null} [addrLoad] (the absolute address to assemble the code at, if any)
+     * @param {string|undefined} [sOptions] (zero or more letter codes to control the assembly process)
+     * @param {function(...)|undefined} [done]
+     */
+    assembleFiles(sURL, addrLoad, sOptions, done)
+    {
+        if (sOptions && sOptions.indexOf('s') >= 0) {
+            this.assembleString(sURL, addrLoad, sOptions, done);
+            return;
+        }
+
+        this.init(addrLoad, sOptions, done);
+
+        this.aURLs = sURL.split(';');
+
+        this.loadNextResource();
+    }
+
+    /**
+     * assembleString(sText, addrLoad, sOptions, done)
+     *
+     * Assembles the given text.
+     *
+     * @this {Macro10}
+     * @param {string} sText
+     * @param {number|null} [addrLoad] (the absolute address to assemble the code at, if any)
+     * @param {string|undefined} [sOptions] (zero or more letter codes to control the assembly process)
+     * @param {function(...)|undefined} [done]
+     * @return {number}
+     */
+    assembleString(sText, addrLoad, sOptions, done)
+    {
+        this.init(addrLoad, sOptions, done);
+
+        this.asLines = sText.split(/(\r?\n)/);
+        this.anLines.push(this.asLines.length);
+
+        this.parseResources();
+
+        if (this.done) this.done(this.nError);
+
+        return this.nError;
+    }
+
+    /**
+     * loadNextResource()
+     *
+     * @this {Macro10}
+     */
+    loadNextResource()
+    {
+        if (this.iURL == this.aURLs.length) {
+            this.parseResources();
+            if (this.done) this.done(this.nError);
+            return;
+        }
+
+        var macro10 = this;
+        var sURL = this.aURLs[this.iURL];
+
+        this.println("loading " + Str.getBaseName(sURL));
+
+        /*
+         * We know that local resources ending with ".MAC" are actually stored with a ".txt" extension.
+         */
+        if (sURL.indexOf(':') < 0) {
+            var sExt = sURL.slice(-4).toUpperCase();
+            if (".MAC.KLM".indexOf(sExt) >= 0) sURL += ".txt";
+        }
+
+        Web.getResource(sURL, null, true, function processMacro10(sFile, sResource, nErrorCode) {
+            if (nErrorCode) {
+                if (macro10.done) macro10.done(nErrorCode, sFile);
+                return;
+            }
+            var sText = sResource;
+            if (Str.endsWith(sFile, ".html")) {
+                /*
+                 * We want to parse ONLY the text between <PRE>...</PRE> tags, and eliminate any HTML entities.
+                 */
+                sText = "";
+                var match, re = /<pre>([\s\S]*?)<\/pre>/gi;
+                while (match = re.exec(sResource)) {
+                    var s = match[1];
+                    if (s.indexOf('&') >= 0) s = s.replace(/&lt;/gi, '<').replace(/&gt;/gi, '>').replace(/&amp;/gi, '&');
+                    sText += s;
+                }
+                match = sText.match(/&[a-z]+;/i);
+                if (match) macro10.warning("unrecognized HTML entity '" + match[0] + "'");
+            }
+
+            /*
+             * For a file containing N lines, split() will return an array of N*2+1 entries, with every even entry
+             * containing the characters, if any, preceding a line-ending, and every odd entry (including the final
+             * entry) containing a line-ending.
+             *
+             * If, for some reason, split() doesn't do that, then we try to warn and patch things up as best we can.
+             */
+            var asLines = sText.split(/(\r?\n)/);
+            if (asLines.length & 1) {
+                s = asLines.pop();
+                if (s) {
+                    macro10.warning("unexpected line '" + s + "'");
+                    asLines.push(s);
+                    asLines.push("");
+                }
+            } else {
+                macro10.warning("unexpected number of lines (" + asLines.length + ")");
+            }
+
+            macro10.asLines = macro10.asLines.concat(asLines);
+            macro10.anLines[macro10.iURL] = (asLines.length >> 1);
+            macro10.iURL++;
+
+            setTimeout(function() {
+                macro10.loadNextResource();
+            }, 0);
+        });
+    }
+
+    /**
+     * getImage()
+     *
+     * Service for the Debugger to obtain the assembled data after a (hopefully) successful assembly process.
+     *
+     * @this {Macro10}
+     * @return {Array.<number>}
+     */
+    getImage()
+    {
+        return this.aWords;
+    }
+
+    /**
+     * getStart()
+     *
+     * Service for the Debugger to obtain the starting address after a (hopefully) successful assembly process.
+     *
+     * @this {Macro10}
+     * @return {number|null|undefined}
+     */
+    getStart()
+    {
+        return this.addrStart;
+    }
+
+    /**
+     * parseResources()
+     *
+     * Begin the assembly process.
+     *
+     * @this {Macro10}
+     * @return {number}
+     */
+    parseResources()
+    {
+        var macro10 = this;
+
+        /*
+         * If the "preprocess" option is set, then print everything without assembling.
+         */
+        if (this.sOptions.indexOf('p') >= 0) {
+            this.println(this.asLines.join(""));
+            return 0;
+        }
+
+        var a = this.dbg.resetVariables();
+
+        /*
+         * Add predefined device codes
+         */
+        this.addSymbol("APR", 0);       // Priority Interrupt
+        this.addSymbol("PI",  4);       // Arithmetic Processor
+
+        try {
+            for (let i = 0; i < this.asLines.length; i += 2) {
+
+                this.nLine++;
+
+                /*
+                 * If the "line" option is set, then print all the lines as they are parsed.
+                 */
+                if (this.sOptions.indexOf('l') >= 0) {
+                    this.println(this.getLineRef() + ": " + this.asLines[i]);
+                }
+
+                /*
+                 * Since, at this early stage, I'm not sure whether all the resources I'm interested in
+                 * assembling have had their original CR/LF line endings preserved (eg, some files may have
+                 * been converted to LF-only line endings), I'm going to skip over whatever line endings
+                 * are in the array (stored in every OTHER entry) and insert my own uniform CR/LF sequences.
+                 */
+                if (!this.parseLine(this.asLines[i] + '\r\n')) break;
+
+                /*
+                 * When an END statement is encountered, addrStart will change from null to either undefined
+                 * or a starting address.
+                 */
+                if (this.addrStart !== null) break;
+            }
+
+            if (this.nMacroDef) {
+                this.error("open block", this.tblMacros[this.sMacroDef].nLine);
+            }
+
+            if (this.stackScopes.length) {
+                this.error("open scope", this.stackScopes[0].nLine);
+            }
+
+            /*
+             * Process all literals next.
+             */
+            this.doLiterals();
+
+            /*
+             * Process all variables next.
+             */
+            this.doVariables();
+
+            /*
+             * And last but not least, perform all fixups.
+             */
+            this.aFixups.forEach(function processFixup(sValue, nLocation) {
+                let value = macro10.parseExpression(sValue, undefined, nLocation, macro10.aLineRefs[nLocation]);
+                if (value === undefined) return;
+                value += macro10.aWords[nLocation];
+                macro10.aWords[nLocation] = macro10.truncate(value, nLocation);
+            });
+
+        } catch(err) {
+            this.println(err.message);
+            this.nError = -1;
+        }
+
+        if (this.sOptions.indexOf('d') < 0) this.dbg.restoreVariables(a);
+
+        return this.nError;
+    }
+
+    /**
+     * parseLine(sLine, aParms, aValues, aDefaults)
+     *
+     * @this {Macro10}
+     * @param {string} sLine (line contents)
+     * @param {Array.<string>} [aParms]
+     * @param {Array.<string>} [aValues]
+     * @param {Array.<string>} [aDefaults]
+     * @return {boolean}
+     */
+    parseLine(sLine, aParms, aValues, aDefaults)
+    {
+        var i, matchLine;
+
+        if (this.chASCII != null) {
+            sLine = this.defASCII(sLine);
+        }
+
+        var fParse = true;
+        var sLabel, sOperator = "", sSeparator, sOperands, sRemainder;
+
+        while (fParse) {
+            matchLine = sLine.match(this.reLine);
+            if (!matchLine || matchLine[5] && matchLine[5].slice(0, 1) != ';') {
+                this.error("failed to parse line '" + sLine + "'");
+                return false;
+            }
+            fParse = false;
+            sOperator = matchLine[2].toUpperCase();
+
+            /*
+             * TODO: The following kludge needs to be fixed at some point.  The goal here is to prevent any
+             * of the caller's parameters from replacing any IRP/IRPC call parameters, but the goal is actually
+             * much bigger than that, because it's not just IRP/IRPC call parameters that must be left intact,
+             * but ANY macro call parameters; IRP/IRPC macros are just easier to pick out.  Unfortunately, as
+             * the code is currently structured, we won't know if we're dealing with any macro call parameters
+             * on this line until parseMacro() is called, below.
+             */
+            if (sOperator == Macro10.PSEUDO_OP.IRP || sOperator == Macro10.PSEUDO_OP.IRPC) {
+                aParms = null;
+            }
+
+            if (aParms) {
+                for (var iParm = 0; iParm < aParms.length; iParm++) {
+                    var sParm = aParms[iParm];
+
+                    var macroDef = this.tblMacros[this.sMacroDef];
+                    if (macroDef && macroDef.aParms.indexOf(sParm) >= 0) continue;
+
+                    var sReplace = aValues[iParm] || aDefaults[iParm] || "";
+                    var iSearch = 0;
+                    var iLimit = sLine.length - matchLine[5].length;    // set the limit at the start of the comment, if any
+                    while (iSearch < iLimit) {
+                        var iMatch = sLine.indexOf(sParm, iSearch);
+                        if (iMatch < 0) break;
+                        iSearch = iMatch + 1;
+                        var iMatchEnd = iMatch + sParm.length;
+                        var chPre = '', chPost = '';
+                        if ((!iMatch || !this.isSymbolChar(chPre = sLine[iMatch - 1])) && (iMatchEnd >= sLine.length || !this.isSymbolChar(chPost = sLine[iMatchEnd]))) {
+                            /*
+                             * If the "concatenation character" (') appears before (or after) the symbol being replaced, remove it.
+                             */
+                            if (chPre == "'") iMatch--;
+                            if (chPost == "'") iMatchEnd++;
+                            sLine = sLine.substr(0, iMatch) + sReplace + sLine.substr(iMatchEnd);
+                            iSearch = iMatch + sReplace.length;
+                            fParse = true;
+                        }
+                    }
+                }
+                aParms = null;
+            }
+            if (this.nMacroDef) {
+                if (this.nMacroDef == 1) {
+                    i = sLine.indexOf(this.chMacroOpen);
+                    if (i >= 0) {
+                        this.nMacroDef++;
+                        sLine = sLine.substr(i+1);
+                    } else {
+                        this.error("expected " + this.sOperator + " definition in '" + sLine + "'");
+                    }
+                }
+                if (this.nMacroDef > 1) {
+                    sLine = this.appendMacro(sLine);
+                    fParse = true;
+                }
+                if (this.nMacroDef) return true;
+            }
+        }
+
+        sLabel = matchLine[1];
+        sSeparator = matchLine[3];
+        sOperands = matchLine[4].trim();
+        sRemainder = matchLine[4] + matchLine[5];
+
+        if (sLabel) {
+            sLabel = sLabel.slice(0, -1);
+            this.addSymbol(sLabel, this.nLocation, Macro10.SYMTYPE.LABEL);
+        }
+
+        var matchOp;
+        if (sOperator && (matchOp = sOperands.match(/^([=:]+)(.*)/))) {
+            var nType = 0;
+            sLabel = sOperator;
+            sOperator = matchOp[1];
+            sOperands = matchOp[2];
+            if (sOperator == '==') {
+                nType |= Macro10.SYMTYPE.PRIVATE;
+            }
+            else if (sOperator == '=:') {
+                nType |= Macro10.SYMTYPE.INTERNAL;
+            }
+            this.addSymbol(sLabel, sOperands, nType);
+            sOperator = sOperands = "";
+        }
+
+        if (!sOperator && !sOperands) return true;
+
+        this.sOperator = sOperator;
+
+        /*
+         * Check the operands for a literal.  If the line contains and/or ends with a literal
+         * we record it and replace it with an internal symbol.  We assume only one literal per line,
+         * especially since they can be open-ended (ie, continue for multiple lines).
+         */
+        var sLiteral = this.getLiteral(sOperands);
+        if (sLiteral) {
+            sOperands = sOperands.replace(sLiteral, this.defMacro(Macro10.PSEUDO_OP.LITERAL, this.getLiteral(sRemainder)));
+            if (!sSeparator) sSeparator = "\t";
+        }
+
+        /*
+         * Check the operands for any reserved symbols (ie, symbols with a trailing '#', such as "USER#").
+         */
+        var sSymbol;
+        while (sSymbol = this.getReserved(sOperands)) {
+            sOperands = sOperands.replace(sSymbol, sSymbol.slice(0, -1));
+        }
+
+        if (!this.parseMacro(sOperator, sOperands)) {
+
+            switch (sOperator) {
+            case Macro10.PSEUDO_OP.ASCII:
+            case Macro10.PSEUDO_OP.ASCIZ:
+            case Macro10.PSEUDO_OP.SIXBIT:
+                this.defASCII(sRemainder);
+                break;
+
+            case Macro10.PSEUDO_OP.BLOCK:
+                this.defBLOCK(sOperands);
+                break;
+
+            case Macro10.PSEUDO_OP.BYTE:
+                this.defBYTE(sOperands);
+                break;
+
+            case Macro10.PSEUDO_OP.END:
+                this.defEND(sOperands);
+                break;
+
+            case Macro10.PSEUDO_OP.EXP:
+                this.defWord(sOperands);
+                break;
+
+            case Macro10.PSEUDO_OP.LIT:
+                this.doLiterals();
+                break;
+
+            case Macro10.PSEUDO_OP.LOC:
+                this.defLocation(sOperands);
+                break;
+
+            case Macro10.PSEUDO_OP.VAR:
+                this.doVariables();
+                break;
+
+            case Macro10.PSEUDO_OP.XWD:
+                this.defXWD(sOperands);
+                break;
+
+            case Macro10.PSEUDO_OP.DEFINE:
+            case Macro10.PSEUDO_OP.IF1:
+            case Macro10.PSEUDO_OP.IFDEF:
+            case Macro10.PSEUDO_OP.IFDIF:
+            case Macro10.PSEUDO_OP.IFE:
+            case Macro10.PSEUDO_OP.IFG:
+            case Macro10.PSEUDO_OP.IFGE:
+            case Macro10.PSEUDO_OP.IFIDN:
+            case Macro10.PSEUDO_OP.IFL:
+            case Macro10.PSEUDO_OP.IFLE:
+            case Macro10.PSEUDO_OP.IFN:
+            case Macro10.PSEUDO_OP.IFNDEF:
+            case Macro10.PSEUDO_OP.IRP:
+            case Macro10.PSEUDO_OP.IRPC:
+            case Macro10.PSEUDO_OP.OPDEF:
+            case Macro10.PSEUDO_OP.REPEAT:
+                this.defMacro(sOperator, sRemainder);
+                break;
+
+            case Macro10.PSEUDO_OP.PURGE:
+                this.delSymbols(sOperands);
+                break;
+
+            case Macro10.PSEUDO_OP.LALL:    // TODO
+            case Macro10.PSEUDO_OP.LIST:    // TODO
+            case Macro10.PSEUDO_OP.NOSYM:   // TODO
+            case Macro10.PSEUDO_OP.PAGE:    // TODO
+            case Macro10.PSEUDO_OP.SUBTTL:  // TODO
+            case Macro10.PSEUDO_OP.TITLE:   // TODO
+            case Macro10.PSEUDO_OP.XALL:    // TODO
+            case Macro10.PSEUDO_OP.XLIST:   // TODO
+                break;
+
+            default:
+                this.defWord(sOperator, sSeparator, sOperands);
+                break;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * parseLiteral(name, sText)
+     *
+     * This is like parseText() except that we set up a new scope, including new aWords and aFixups arrays.
+     *
+     * @this {Macro10}
+     * @param {string} name
+     * @param {string} sText
+     */
+    parseLiteral(name, sText)
+    {
+        this.pushScope(name);
+        this.parseText(sText);
+        this.popScope();
+    }
+
+    /**
+     * parseMacro(name, sOperands)
+     *
+     * For OPDEF macros, the operands are opcode values rather than conventional macro parameter values.
+     * As the MACRO-10 manual explains:
+     *
+     *      Defines the symbol as an operator equivalent to expression, giving the symbol a fullword value.
+     *      When the operator is later used with operands, the accumulator fields are added, the indirect bits
+     *      are ORed, the memory addresses are added, and the index register addresses are added.
+     *
+     *      EXAMPLE:    OPDEF CAL [MOVE 1,@SYM(2)]
+     *                  CAL 1,BOL(2)
+     *
+     *      RESULT:     MOVE 2,@SYM+BOL(4)
+     *
+     * The easiest thing to do is parse the OPDEF text, allowing it to generate its default "fullword value",
+     * then parse the operands in their own scope, extract the bits generated from the operands, and merge them
+     * into the generated OPDEF value.
+     *
+     * @this {Macro10}
+     * @param {string} name
+     * @param {string} [sOperands]
+     * @return {boolean}
+     */
+    parseMacro(name, sOperands)
+    {
+        var macro = this.tblMacros[name];
+        if (!macro) return false;
+
+        if (sOperands != null) {
+            /*
+             * If this is an OPDEF, then a two-step process is required: generate the OPDEF's value, then parse
+             * the operands and merge their bits with the OPDEF's bits.
+             */
+            if (macro.nOperand == Macro10.MACRO_OP.OPDEF) {
+
+                var nLocation = this.nLocation;
+                this.parseText(macro.sText);
+                if (nLocation < this.nLocation) {
+
+                    /*
+                     * An OPDEF invocation *may* have operands, but it's not required to.
+                     */
+                    if (!sOperands) return true;
+
+                    this.pushScope();
+                    this.parseText(sOperands);
+                    var w = this.aWords[0];
+                    var sFixup = this.aFixups[0];
+                    this.popScope();
+                    if (w !== undefined) {
+                        this.aWords[nLocation] += (w & (PDP10.OPCODE.A_FIELD | PDP10.OPCODE.X_FIELD | PDP10.OPCODE.Y_FIELD));
+                        /*
+                         * We can't "OR" (|=) the I_FIELD bit into the target word, because it's a 36-bit value and bitwise
+                         * operators truncate to 32 bits, so we'll use addition, trusting that the field was initially zero.
+                         */
+
+                        this.aWords[nLocation] += (w & PDP10.OPCODE.I_FIELD);
+                        if (sFixup) {
+                            if (!this.aFixups[nLocation]) {
+                                this.aFixups[nLocation] = sFixup;
+                            } else {
+                                this.aFixups[nLocation] += '+' + sFixup;
+                            }
+                        }
+                        return true;
+                    }
+                }
+
+                /*
+                 * Either the OPDEF didn't generate any data OR the OPDEF's operands failed to evaluate.
+                 */
+                this.error("OPDEF '" + name + "' (" + sOperands + ") failed");
+                return false;
+            }
+            var macroPrev = this.macroCall;
+            this.macroCall = macro;
+            macro.aValues = this.getValues(sOperands, true);
+            this.parseText(macro.sText, macro.aParms, macro.aValues, macro.aDefaults);
+            /*
+             * WARNING: Our simplistic approach to macro expansion and processing means that recursive macros
+             * (such as the SHIFT macro in /apps/pdp10/tests/macro10/TEXT.MAC) could blow the stack.  Nothing bad
+             * should happen (other than a JavaScript stack limit exception aborting the assembly), but it begs
+             * the question: did MACRO-10 perform any tail recursion optimizations or other tricks to prevent macros
+             * from gobbling stack, or could they blow MACRO-10's stack just as easily?
+             */
+            this.macroCall = macroPrev;
+            return true;
+        }
+
+        if (name[0] != '?') return false;
+
+        var sOperator = name.substr(1);
+
+        switch(sOperator) {
+        case Macro10.PSEUDO_OP.IFE:
+        case Macro10.PSEUDO_OP.IFDIF:
+        case Macro10.PSEUDO_OP.IFNDEF:
+            if (!macro.nOperand) {
+                this.parseText(macro.sText);
+            }
+            break;
+
+        case Macro10.PSEUDO_OP.IFG:
+            if (macro.nOperand > 0) {
+                this.parseText(macro.sText);
+            }
+            break;
+
+        case Macro10.PSEUDO_OP.IFGE:
+            if (macro.nOperand >= 0) {
+                this.parseText(macro.sText);
+            }
+            break;
+
+        case Macro10.PSEUDO_OP.IFL:
+            if (macro.nOperand < 0) {
+                this.parseText(macro.sText);
+            }
+            break;
+
+        case Macro10.PSEUDO_OP.IFLE:
+            if (macro.nOperand <= 0) {
+                this.parseText(macro.sText);
+            }
+            break;
+
+        case Macro10.PSEUDO_OP.IF1:
+        case Macro10.PSEUDO_OP.IFN:
+        case Macro10.PSEUDO_OP.IFDEF:
+        case Macro10.PSEUDO_OP.IFIDN:
+            if (macro.nOperand) {
+                this.parseText(macro.sText);
+            }
+            break;
+
+        case Macro10.PSEUDO_OP.IRP:
+        case Macro10.PSEUDO_OP.IRPC:
+            for (let i = 0; i < macro.aValues.length; i++) {
+                this.parseText(macro.sText, macro.aParms, [macro.aValues[i]], []);
+            }
+            break;
+
+        case Macro10.PSEUDO_OP.REPEAT:
+            while (macro.nOperand-- > 0) {
+                this.parseText(macro.sText);
+            }
+            break;
+
+        default:
+            this.parseLiteral(name, macro.sText);
+            break;
+        }
+        return true;
+    }
+
+    /**
+     * parseText(sText, aParms, aValues, aDefaults)
+     *
+     * @this {Macro10}
+     * @param {string} sText
+     * @param {Array.<string>} [aParms]
+     * @param {Array.<string>} [aValues]
+     * @param {Array.<string>} [aDefaults]
+     */
+    parseText(sText, aParms, aValues, aDefaults)
+    {
+        /*
+         * Unlike the caller of parseResources(), we don't split the text using a capture group,
+         * so all line separators are tossed, and just like parseResources(), we always include a
+         * uniform CR/LF sequence at the end of each line.
+         *
+         * TODO: Consider whether callers should always store their text snippets as line arrays, too,
+         * to avoid this re-splitting.
+         */
+        var asLines = sText.split(/\r?\n/);
+        for (var iLine = 0; iLine < asLines.length; iLine++) {
+            var sLine = asLines[iLine] + '\r\n';
+            if (!this.parseLine(sLine, aParms, aValues, aDefaults)) break;
+        }
+    }
+
+    /**
+     * pushScope(name)
+     *
+     * @this {Macro10}
+     * @param {string} [name] (must be defined for literals only)
+     */
+    pushScope(name)
+    {
+        this.stackScopes.push({
+            name,
+            aWords: this.aWords,
+            aFixups: this.aFixups,
+            nLocation: this.nLocation,
+            nLocationScope: this.nLocationScope,
+            nLine: this.nLine
+        });
+        this.aWords = [];
+        this.aFixups = [];
+        if (this.nLocationScope < 0) this.nLocationScope = this.nLocation;
+        this.nLocation = 0;
+    }
+
+    /**
+     * popScope()
+     *
+     * @this {Macro10}
+     */
+    popScope()
+    {
+        if (!this.stackScopes.length) {
+            this.error("scope nesting error");
+            return;
+        }
+        var name = this.stackScopes[this.stackScopes.length - 1].name;
+        if (name) this.aLiterals.push({name, aWords: this.aWords, aFixups: this.aFixups});
+        var scope = this.stackScopes.pop();
+        this.aWords = scope.aWords;
+        this.aFixups = scope.aFixups;
+        this.nLocation = scope.nLocation;
+        this.nLocationScope = scope.nLocationScope;
+        if (!this.stackScopes.length && this.nLocationScope != -1) {
+            this.error("scope restore error");
+        }
+    }
+
+    /**
+     * getExpression(sOperands, sDelim)
+     *
+     * TODO: Add support for IFIDN, IFDIF, IFB and IFNB: if the first non-blank, non-tab character is
+     * a character other than '<', then that becomes the delimiter, allowing angle brackets in the string.
+     *
+     * @this {Macro10}
+     * @param {string} sOperands
+     * @param {string} [sDelim] (eg, comma, closing parenthesis)
+     * @return {string|null} (if the operands begin with an expression, return it)
+     */
+    getExpression(sOperands, sDelim = ",")
+    {
+        var i = 0;
+        var fQuotes = false;
+        var sOperand = null;
+        var cNesting = 0;
+        while (i < sOperands.length) {
+            var ch = sOperands[i++];
+            if (ch == '"') {
+                fQuotes = !fQuotes;
+                continue;
+            }
+            if (fQuotes) continue;
+            if (!cNesting && sDelim.indexOf(ch) >= 0) {
+                i--;
+                break;
+            }
+            if (ch == '<') {
+                cNesting++;
+            } else if (ch == '>') {
+                if (--cNesting < 0) {
+                    this.error("missing bracket(s) in '" + sOperands + "'");
+                    break;
+                }
+            }
+        }
+        if (!cNesting) {
+            sOperand = sOperands.substr(0, i);
+        }
+        else if (cNesting > 0) {
+            this.error("extra bracket(s) in '" + sOperands + "'");
+        }
+        return sOperand;
+    }
+
+    /**
+     * parseExpression(sExp, aUndefined, nLocation, nLine)
+     *
+     * This is a wrapper around the Debugger's parseExpression() function to take care of some
+     * additional requirements we have, such as interpreting a period as the current location and
+     * interpreting two expressions separated by two commas as the left and right 18-bit halves
+     * of a 36-bit value.
+     *
+     * @this {Macro10}
+     * @param {string} sExp
+     * @param {Array} [aUndefined]
+     * @param {number|undefined} [nLocation]
+     * @param {number|undefined} [nLine]
+     * @return {number|undefined}
+     */
+    parseExpression(sExp, aUndefined, nLocation, nLine)
+    {
+        var result = -1;
+
+        if (nLocation === undefined) {
+            nLocation = (this.nLocationScope >= 0? this.nLocationScope : this.nLocation);
+        }
+
+        /*
+         * The SIXBIT (and presumably ASCII; not sure about ASCIZ) pseudo-ops can also be used in expressions
+         * (or at least assignments), so we check for those in the given expression and convert them to quoted
+         * sequences that the Debugger's parseExpression() understands.
+         */
+        var sEval = sExp.replace(/SIXBIT\s*(\S)(.*?)\1/g, "'$2'").replace(/ASCII\s*(\S)(.*?)\1/g, '"$2"');
+
+        /*
+         * If this is NOT a first-pass call, then let's not waste time calling parseInstruction(); not only
+         * may it generate redundant error messages, but it shouldn't be necessary, because we should be down
+         * to fixup expressions.
+         */
+        if (aUndefined) {
+            var match;
+            var sOperator = "";
+            var sOperands = sEval;
+            if (match = sEval.match(/^([^\s]+)\s*(.*?)\s*$/)) {
+                sOperator = match[1];
+                sOperands = match[2];
+            }
+            result = this.dbg.parseInstruction(sOperator, sOperands, nLocation, aUndefined);
+        }
+
+        if (result < 0) {
+            /*
+             * Check for the "period" syntax that MACRO-10 uses to represent the value of the current location.
+             * The Debugger's parseInstruction() method understands that syntax, but its parseExpression() method
+             * does not.
+             *
+             * Note that the Debugger's parseInstruction() replaces any period not PRECEDED by a decimal
+             * digit with the current address, because our Debuggers' only other interpretation of a period
+             * is as the suffix of a decimal integer, whereas MACRO-10's only other interpretation of a period
+             * is (I think) as the decimal point within a floating-point number, so here we only replace periods
+             * that are not FOLLOWED by a decimal digit.
+             */
+            sEval = sEval.replace(/\.([^0-9]|$)/g, this.dbg.toStrBase(nLocation, -1) + "$1");
+            result = this.dbg.parseExpression(sEval, aUndefined);
+            if (result === undefined) {
+                this.error("unable to parse expression '" + sExp + "'", nLine);
+            }
+        }
+        return result;
+    }
+
+    /**
+     * getLiteral(sOperands)
+     *
+     * Check the operands for a literal (ie, an expression starting with a square bracket).
+     *
+     * @this {Macro10}
+     * @param {string} sOperands
+     * @return {string} (if the operands contain a literal, return it)
+     */
+    getLiteral(sOperands)
+    {
+        var cNesting = 0;
+        var sLiteral = "";
+        var i = 0, iBegin = -1, iEnd = sOperands.length;
+        while (i < sOperands.length) {
+            var ch = sOperands[i];
+            if (ch == ';') break;
+            if (ch == '[') {
+                if (!cNesting++) iBegin = i;
+            }
+            i++;
+            if (ch == ']' && --cNesting <= 0) {
+                iEnd = i;
+                break;
+            }
+        }
+        if (cNesting < 0) {
+            this.error("missing bracket(s) in '" + sOperands + "'");
+        }
+        if (iBegin >= 0) {
+            sLiteral = sOperands.substr(iBegin, iEnd - iBegin);
+        }
+        return sLiteral;
+    }
+
+    /**
+     * getDefaults(aParms)
+     *
+     * Check the given array of macro parameters for default values, remove them, and return them in a parallel array.
+     *
+     * @this {Macro10}
+     * @param {Array.<string>} aParms
+     * @return {Array.<string>}
+     */
+    getDefaults(aParms)
+    {
+        var aDefaults = [];
+        for (var i = 0; i < aParms.length; i++) {
+            var j = aParms[i].indexOf('<');
+            if (j >= 0) {
+                var k = aParms[i].lastIndexOf('>');
+                if (k < 0) k = aParms[i].length;
+                aDefaults[i] = aParms[i].substr(j, k - j);
+                aParms[i] = aParms[i].substr(0, j);
+            }
+        }
+        return aDefaults;
+    }
+
+    /**
+     * getLineRef(nLine)
+     *
+     * @this {Macro10}
+     * @param {number|undefined} [nLine]
+     * @return {string}
+     */
+    getLineRef(nLine = this.nLine)
+    {
+        var iURL = 0;
+        while (nLine > this.anLines[iURL]) {
+            nLine -= this.anLines[iURL];
+            if (iURL < this.aURLs.length - 1) {
+                iURL++;
+            } else {
+                break;
+            }
+        }
+        return Str.getBaseName(this.aURLs[iURL] + " line " + nLine);
+    }
+
+    /**
+     * getReserved(sOperands)
+     *
+     * Check the operands for any reserved symbols (ie, symbols with a trailing '#', such as "USER#").
+     *
+     * @this {Macro10}
+     * @param {string} sOperands
+     * @return {string|null} (if the operands contain a reserved symbol, return it)
+     */
+    getReserved(sOperands)
+    {
+        var match, sReserved = null;
+        if (match = sOperands.match(/([A-Z$%.][0-9A-Z$%.]*)#/i)) {
+            sReserved = match[0];
+            var sLabel = match[1];
+            var name = '?' + sLabel;
+            /*
+             * We now allow reserved symbols to reused (which would make sense if they appeared in a macro).
+             */
+            if (this.tblMacros[name] === undefined) {
+                var aParms, aDefaults, aValues;
+                aParms = aDefaults = aValues = [];
+                this.tblMacros[name] = {
+                    name: name,
+                    nOperand: Macro10.MACRO_OP.RESERVED,
+                    aParms,
+                    aDefaults,
+                    aValues,
+                    sText: sLabel + ": 0",
+                    nLine: this.nLine
+                };
+                this.aVariables.push(name);
+            }
+        }
+        return sReserved;
+    }
+
+    /**
+     * getString(sValue, nConversion)
+     *
+     * Converts the given expression string (sValue) to one of the following, based on the conversion code (nConversion):
+     *
+     *      0: numeric string (default)
+     *      1: SIXBIT string
+     *      2: ASCII string
+     *
+     * If the expression cannot be evaluated, or if the requested conversion isn't recognized, the original value is returned.
+     *
+     * @this {Macro10}
+     * @param {string} sValue
+     * @param {number} [nConversion]
+     * @return {string}
+     */
+    getString(sValue, nConversion = 0)
+    {
+        var c, s;
+        var value = this.parseExpression(sValue);
+        if (value !== undefined) {
+            var cchMax = 5;
+            switch(nConversion) {
+            case 0:
+                sValue = this.dbg.toStrBase(value, -1);
+                break;
+            case 6:
+                cchMax++;
+                /* falls through */
+            case 7:
+                s = "";
+                while (value && cchMax--) {
+                    c = value & (Math.pow(2, nConversion) - 1);
+                    s = String.fromCharCode(c + (nConversion == 6? 0x20 : 0)) + s;
+                    value = Math.trunc(value / Math.pow(2, nConversion));
+                }
+                break;
+            }
+        }
+        return sValue;
+    }
+
+    /**
+     * getSymbol(sOperands)
+     *
+     * Check the operands for a symbol.  TODO: Use this method?
+     *
+     * @this {Macro10}
+     * @param {string} sOperands
+     * @return {string|null} (if the operands contain a symbol, return it)
+     */
+    getSymbol(sOperands)
+    {
+        var match = sOperands.match(/([A-Z$%.][0-9A-Z$%.]*)/i);
+        return match && match[1] || null;
+    }
+
+    /**
+     * getValues(sOperands, fParens)
+     *
+     * @this {Macro10}
+     * @param {string} sOperands
+     * @param {boolean} [fParens] (true to strip any parens from around the entire operands)
+     * @return {Array.<string>}
+     */
+    getValues(sOperands, fParens)
+    {
+        var aValues = [];
+        if (fParens) sOperands = sOperands.replace(/^\(?(.*?)\)?$/, "$1");
+        while (sOperands) {
+            sOperands = sOperands.trim();
+            var sOperand = this.getExpression(sOperands);
+            if (!sOperand) break;
+            var sValue = sOperand;
+            if (sOperand[0] == '\\') {
+                var cchPrefix = 1;
+                var nConversion = 0;
+                if (sOperand[1] == "'") {
+                    cchPrefix++;
+                    nConversion = 6;
+                } else if (sOperand[1] == '"') {
+                    cchPrefix++;
+                    nConversion = 7;
+                }
+                sValue = this.getString(sOperand.substr(cchPrefix), nConversion);
+            }
+            aValues.push(sValue);
+            sOperands = sOperands.substr(sOperand.length + 1);
+        }
+        return aValues;
+    }
+
+    /**
+     * isDefined(sName)
+     *
+     * @this {Macro10}
+     * @param {string} sName
+     * @return {boolean}
+     */
+    isDefined(sName)
+    {
+        return this.isMacro(sName) || this.isSymbol(sName) || this.dbg.isVariable(sName);
+    }
+
+    /**
+     * isMacro(sName)
+     *
+     * @this {Macro10}
+     * @param {string} sName
+     * @return {boolean}
+     */
+    isMacro(sName)
+    {
+        return this.tblMacros[sName] !== undefined;
+    }
+
+    /**
+     * isSymbol(sName)
+     *
+     * @this {Macro10}
+     * @param {string} sName
+     * @return {boolean}
+     */
+    isSymbol(sName)
+    {
+        return this.tblSymbols[sName] !== undefined;
+    }
+
+    /**
+     * isSymbolChar(ch)
+     *
+     * @this {Macro10}
+     * @param {string} ch
+     * @return {boolean}
+     */
+    isSymbolChar(ch)
+    {
+        return !!ch.match(/[0-9A-Z$%.]/i);
+    }
+
+    /**
+     * defASCII(sOperands)
+     *
+     * @this {Macro10}
+     * @param {string} sOperands
+     * @return {string} (returns whatever portion of the string was not part of an ASCII pseudo-op)
+     */
+    defASCII(sOperands)
+    {
+        var sRemain = sOperands;
+        if (this.chASCII == null) {
+            this.chASCII = this.sASCII = "";
+            if (sOperands) {
+                this.chASCII = sOperands[0];
+                sRemain = sOperands = sOperands.substr(1);
+            }
+        }
+        if (this.chASCII) {
+            var i = sOperands.indexOf(this.chASCII);
+            if (i < 0) {
+                sRemain = "";
+            } else {
+                sRemain = sOperands.substr(i + 1);
+                sOperands = sOperands.substr(0, i);
+                this.chASCII = null;
+            }
+            this.sASCII += sOperands;
+        }
+        if (this.chASCII == null) {
+            this.genASCII();
+        }
+        return sRemain;
+    }
+
+    /**
+     * defMacro(sOperator, sOperands)
+     *
+     * If sOperator is DEFINE (or OPDEF), then a macro definition is expected.  If it's REPEAT, then we're
+     * starting a REPEAT block instead.
+     *
+     * REPEAT blocks piggy-back on this code because they're essentially anonymous immediately-invoked macros;
+     * we use an illegal MACRO-10 symbol ('?REPEAT') to name the anonymous macro while it's being defined, and the
+     * macro's nOperand field will contain the repeat count.
+     *
+     * The piggy-backing continues with other pseudo-ops like IFE, which again contain an anonymous block of text
+     * that is immediately invoked if the criteria associated with the expression stored in the nOperand field is
+     * satisfied.  That satisfaction occurs (or doesn't occur) when parseMacro() is called, once the macro has
+     * been fully defined.
+     *
+     * @this {Macro10}
+     * @param {string} sOperator
+     * @param {string} sOperands
+     * @return {string}
+     */
+    defMacro(sOperator, sOperands)
+    {
+        var i, match, name, nOperand, aParms, aDefaults, aValues, iMatch;
+
+        this.chMacroOpen = '<';
+        this.chMacroClose = '>';
+        aParms = aDefaults = aValues = [];
+
+        if (sOperator == Macro10.PSEUDO_OP.DEFINE) {
+            /*
+             * This is a DEFINE (macro) block.  At present, this requires that all
+             * (parenthesized) parameters exist on the same line, but the (angle-bracketed)
+             * definition can continue on for multiple lines.
+             */
+            match = sOperands.match(/([A-Z$%.][0-9A-Z$%.]*)\s*(\([^)]*\)|)\s*,?\s*(<|)([\s\S]*)/i);
+            if (!match) {
+                this.error("unrecognized " + sOperator + " in '" + sOperands + "'");
+                return sOperands;
+            }
+            name = match[1];
+            /*
+             * If this macro has defined parameters, parse them (and any defaults) now.
+             */
+            if (match[2] && match[2] != ',') {
+                aParms = this.getValues(match[2], true);
+                aDefaults = this.getDefaults(aParms);
+            }
+            nOperand = Macro10.MACRO_OP.DEFINE;
+            iMatch = 3;
+        }
+        else if (sOperator == Macro10.PSEUDO_OP.OPDEF) {
+            /*
+             * This is a OPDEF block.  Unlike DEFINE blocks, I'm assuming that the
+             * (square-bracketed) definition begins on the same line, but I'm not requiring
+             * it to end on the same line (I'm not sure that MACRO-10 allowed multi-line
+             * OPDEFs, but it doesn't matter to us).
+             */
+            this.chMacroOpen = '[';
+            this.chMacroClose = ']';
+            match = sOperands.match(/([A-Z$%.][0-9A-Z$%.]*)\s*(\[)([\s\S]*)/i);
+            if (!match) {
+                this.error("unrecognized " + sOperator + " in '" + sOperands + "'");
+                return sOperands;
+            }
+            name = match[1];
+            nOperand = Macro10.MACRO_OP.OPDEF;
+            iMatch = 2;
+        }
+        else if (sOperator == Macro10.PSEUDO_OP.LITERAL) {
+            /*
+             * This is a LITERAL block.
+             */
+            this.chMacroOpen = '[';
+            this.chMacroClose = ']';
+            name = '?' + Str.toDec(++this.nLiteral, 5);
+            if (this.tblMacros[name] !== undefined) {
+                this.error("literal symbol '" + name + "' redefined");
+            }
+            match = [sOperands[0], sOperands.substr(1)];
+            nOperand = Macro10.MACRO_OP.LITERAL;
+            iMatch = 0;
+        }
+        else if (sOperator == Macro10.PSEUDO_OP.IRP || sOperator == Macro10.PSEUDO_OP.IRPC) {
+            /*
+             * IRP (and IRPC) blocks are very similar to DEFINE blocks, but they define exactly ONE macro parameter
+             * with NO parentheses (whereas regular macros always define their parameters, if any, WITH parentheses),
+             * and then the IRP (or IRPC) block is immediately invoked with the corresponding value from the
+             * enclosing macro.
+             */
+            if (!this.macroCall) {
+                this.error(sOperator + " outside of macro");
+            }
+            match = sOperands.match(/([A-Z$%.][0-9A-Z$%.]*)\s*,\s*(<|)([\s\S]*)/i);
+            if (!match) {
+                this.error("unrecognized " + sOperator + " operands '" + sOperands + "'");
+                return sOperands;
+            }
+            for (i = 0; i < this.macroCall.aParms.length; i++) {
+                if (match[1] == this.macroCall.aParms[i]) break;
+            }
+            if (i == this.macroCall.aParms.length) {
+                this.error("invalid " + sOperator + " parameter '" + match[1] + "'");
+                return sOperands;
+            }
+            name = '?' + sOperator;
+            aParms = [match[1]];
+            if (sOperator == Macro10.PSEUDO_OP.IRPC) {
+                aValues = this.macroCall.aValues[i].split("");
+            } else {
+                aValues = this.getValues(this.macroCall.aValues[i]);
+            }
+            nOperand = aValues.length;
+            iMatch = 2;
+        }
+        else {
+            /*
+             * This must be a REPEAT or CONDITIONAL block.
+             */
+            if (sOperator == Macro10.PSEUDO_OP.IF1) {
+                nOperand = 1;
+                if (sOperands[0] == ',') sOperands = sOperands.substr(1).trim();
+            }
+            else {
+                var sOperand = this.getExpression(sOperands);
+                if (!sOperand) {
+                    this.error("missing " + sOperator + " expression '" + sOperands + "'");
+                    return sOperands;
+                }
+                sOperands = sOperands.substr(sOperand.length + 1);
+                sOperand = sOperand.trim();
+                if (sOperator == Macro10.PSEUDO_OP.IFDIF || sOperator == Macro10.PSEUDO_OP.IFIDN) {
+                    var sOperand2 = this.getExpression(sOperands);
+                    if (!sOperand2) {
+                        this.error("missing second " + sOperator + " expression '" + sOperands + "'");
+                        return sOperands;
+                    }
+                    sOperands = sOperands.substr(sOperand2.length + 1);
+                    sOperand2 = sOperand2.trim();
+                    nOperand = (sOperand == sOperand2)? 1 : 0;
+                }
+                if (sOperator == Macro10.PSEUDO_OP.IFDEF || sOperator == Macro10.PSEUDO_OP.IFNDEF) {
+                    nOperand = this.isDefined(sOperand)? 1 : 0;
+                } else {
+                    /*
+                     * The expression is either a repeat count or a condition.  Either way, we must be able to
+                     * resolve it now, so we don't set fPass1 (but that doesn't mean it's the second pass, either).
+                     */
+                    nOperand = this.parseExpression(sOperand) || 0;
+                }
+            }
+            match = sOperands.match(/\s*(<|)([\s\S]*)/i);
+            name = '?' + sOperator;
+            iMatch = 1;
+        }
+
+        /*
+         * Now we need to set a global parsing state: we are either about to receive a macro definition on
+         * subsequent lines (1), the definition has already started on the current line (2), or the definition
+         * started and ended on the current line (0).
+         */
+        name = name.toUpperCase();
+        this.nMacroDef = 1;
+        this.sMacroDef = name;
+        this.tblMacros[name] = {name, nOperand, aParms, aDefaults, aValues, sText: "", nLine: this.nLine};
+
+        if (match[iMatch]) {                            // if there is an opening bracket
+            this.nMacroDef = 2;                         // then the macro definition has started
+            this.appendMacro(match[iMatch + 1]);
+        }
+
+        return name;
+    }
+
+    /**
+     * appendMacro(sLine)
+     *
+     * @this {Macro10}
+     * @param {string} sLine
+     * @return {string}
+     */
+    appendMacro(sLine)
+    {
+        var sRemain = "";
+        for (var i = 0; i < sLine.length; i++) {
+            if (sLine[i] == this.chMacroOpen) {
+                this.nMacroDef++;
+            } else if (sLine[i] == this.chMacroClose) {
+                this.nMacroDef--;
+                if (this.nMacroDef == 1) {
+                    this.nMacroDef = 0;
+                    sRemain = sLine.substr(i + 1);
+                    sLine = sLine.substr(0, i);
+                    break;
+                }
+            }
+        }
+        var name = this.sMacroDef || "";
+        this.tblMacros[name].sText += sLine;
+        if (!this.nMacroDef) {
+            this.sMacroDef = null;
+            this.parseMacro(name);
+        }
+        return sRemain;
+    }
+
+    /**
+     * addSymbol(name, value, nType)
+     *
+     * @this {Macro10}
+     * @param {string} name
+     * @param {number|string} value
+     * @param {number} [nType]
+     */
+    addSymbol(name, value, nType = 0)
+    {
+        name = name.toUpperCase().substr(0, 6);
+        if ((nType & Macro10.SYMTYPE.LABEL) && this.tblSymbols[name] !== undefined) {
+            this.error("redefined label '" + name + "'");
+            return;
+        }
+        var sUndefined = undefined;
+        if (typeof value == 'string') {
+            var aUndefined = [];
+            var v = this.parseExpression(value, aUndefined);
+            if (v === undefined) {
+                this.error("invalid symbol '" + name + "': " + value);
+                return;
+            }
+            if (aUndefined.length > 1) {
+                this.error("too many undefined symbols in '" + name + "': " + aUndefined.join());
+            }
+            value = v;
+            sUndefined = aUndefined[0];
+        }
+        var sym = this.tblSymbols[name];
+        if (sym) {
+            sym.value = value;
+            sym.nType = nType;
+            sym.nLine = this.nLine;
+        } else {
+            this.tblSymbols[name] = {name, value, nType, nLine: this.nLine};
+        }
+        this.dbg.setVariable(name, value, sUndefined);
+    }
+
+    /**
+     * defBLOCK()
+     *
+     * Processes the BLOCK pseudo-op.
+     *
+     * @this {Macro10}
+     * @param {string} sOperands
+     */
+    defBLOCK(sOperands)
+    {
+        var w = this.parseExpression(sOperands);
+        if (w !== undefined && w >= 0 && w <= 0o777777) {
+            this.nLocation += w;    // while (w--) this.genWord(0);
+        } else {
+            this.error("unrecognized BLOCK expression '" + sOperands + "'");
+        }
+    }
+
+    /**
+     * defBYTE()
+     *
+     * Processes the BYTE pseudo-op.
+     *
+     * @this {Macro10}
+     * @param {string} sOperands
+     */
+    defBYTE(sOperands)
+    {
+        var sOperand;
+        var nBits = 0, nValue = 0, nBitsRemaining = 36;
+
+        while (sOperand = this.getExpression(sOperands)) {
+            sOperands = sOperands.substr(sOperand.length).trim();
+            var sValue = sOperand;
+            var match = sOperand.match(/^\((.*)\)\s*(.*)$/);
+            if (match) {
+                if (match[1]) nBits = this.parseExpression("^D" + match[1]);
+                sValue = match[2];
+            }
+            if (!nBits) {
+                /*
+                 * According the the 1978 MACRO-10 spec, "If the byte size is 0 or is missing (empty parentheses), a zero word
+                 * is generated."  I'm not clear exactly on how to interpret this, so I'll make a simplistic assumption for now.
+                 */
+                this.genWord(0);
+                continue;
+            }
+            var v = sValue? this.parseExpression(sValue) : 0;
+            if (v === undefined || nBits < 0 || nBits > 36) {
+                this.error("unexpected BYTE operand: " + sOperand);
+                break;
+            }
+            v = this.dbg.truncate(v, nBits, true);
+            if (nBitsRemaining < nBits) {
+                this.genWord(nValue);
+                nValue = 0;
+                nBitsRemaining = 36;
+            }
+            nValue += v * Math.pow(2, nBitsRemaining - nBits);
+            nBitsRemaining -= nBits;
+        }
+        if (nBitsRemaining < 36) {
+            this.genWord(nValue);
+        }
+    }
+
+    /**
+     * defEND()
+     *
+     * Processes the END pseudo-op.
+     *
+     * @this {Macro10}
+     * @param {string} sOperands
+     */
+    defEND(sOperands)
+    {
+        if (!sOperands) {
+            this.addrStart = this.addrLoad;
+        } else {
+            this.addrStart = this.parseExpression(sOperands);
+            if (this.addrStart === undefined) {
+                this.error("unrecognized END expression '" + sOperands + "'");
+            }
+        }
+    }
+
+    /**
+     * defLocation(sOperands)
+     *
+     * Processes the LOC pseudo-op.
+     *
+     * @this {Macro10}
+     * @param {string} sOperands
+     */
+    defLocation(sOperands)
+    {
+        this.nLocation = this.parseExpression(sOperands) || 0;
+    }
+
+    /**
+     * defXWD()
+     *
+     * Processes the XWD pseudo-op.
+     *
+     * Since the XWD pseudo-op appears to be equivalent to two values separated by two commas, which defWord() must also
+     * support, we can piggy-back on defWord().
+     *
+     * @this {Macro10}
+     * @param {string} sOperands
+     */
+    defXWD(sOperands)
+    {
+        this.defWord(sOperands.replace(",", ",,"));
+    }
+
+    /**
+     * defWord(sOperator, sSeparator, sOperands)
+     *
+     * @this {Macro10}
+     * @param {string} sOperator
+     * @param {string} [sSeparator]
+     * @param {string} [sOperands]
+     */
+    defWord(sOperator, sSeparator = "", sOperands = "")
+    {
+        var aUndefined = [];
+        var sExp = (sOperator + sSeparator + sOperands).trim();
+        var w = this.parseExpression(sExp, aUndefined);
+        if (w !== undefined) {
+            if (!aUndefined.length) {
+                this.genWord(w);
+            } else if (aUndefined.length == 1) {
+                this.genWord(w, aUndefined[0]);
+            }
+            else {
+                this.genWord(0, sExp);
+            }
+        } else {
+            this.error("unrecognized word expression '" + sExp + "'");
+        }
+    }
+
+    /**
+     * delSymbols(sOperands)
+     *
+     * @this {Macro10}
+     * @param {string} sOperands
+     */
+    delSymbols(sOperands)
+    {
+        var aValues = this.getValues(sOperands);
+        for (var i = 0; i < aValues.length; i++) {
+            this.dbg.delVariable(aValues[i]);
+            delete this.tblSymbols[aValues[i]];
+        }
+    }
+
+    /**
+     * doLiterals()
+     *
+     * @this {Macro10}
+     */
+    doLiterals()
+    {
+        let nLocationLiterals = this.nLocation;
+
+        for (let i = 0; i < this.aLiterals.length; i++) {
+            /*
+             * Apparently, the time has come to implement "literal collapsing"; I was treating it as just
+             * a nice optimization, but it turns out that DEC has written tests that actually DEPEND on it:
+             *
+             *      C26300: HRRZI   [135531,,246642]    ;PRELOAD AC0 WITH 0,, LITERAL ADDRESS
+             *              JRA     .+1                 ;*JRA SHOULD PLACE C(AC0) INTO AC0
+             *              CAIE    [135531,,246642]    ;PASS IF JRA PLACED C(AC0) INTO AC0
+             *              STOP
+             *
+             * If the HRRZI and CAIE instructions don't refer to the same exact literal, the test will fail.
+             * For purposes of this particular test, the values they stuffed into the literals are essentially
+             * gibberish, but the same literal may be used in another test where the values are significant.
+             *
+             * However, I'm still going to keep it simple.  In this example from p. 2-8 of the April 1978
+             * MACRO-10 manual, I will NOT be attempting to collapse null words at the end of ASCIZ sequences
+             * with other null words, especially if they were defined before the ASCIZ:
+             *
+             *      Literals having the same value are collapsed in MACRO's literal pool.
+             *      Thus for the statements:
+             *
+             *              PUSH    P,[0]
+             *              PUSH    P,[0]
+             *              MOVEI   1,[ASCIZ /TEST1/]
+             *
+             *      the same address is shared by the two literals [0], and by the null word
+             *      generated at the end of [ASCIZ /TEST1/].
+             */
+            let lit = this.aLiterals[i];
+            /*
+             * First things first: verify that the literal is one contiguous zero-based set of words (I'm not sure
+             * how it couldn't be, but better safe than sorry).
+             */
+            let aWords = [];
+            let nWords = 0;
+            lit.aWords.forEach(function(w, nLocation) {
+                if (nLocation === aWords.length) aWords.push(w);
+                nWords++;
+            });
+            if (nWords == aWords.length) {
+                /*
+                 * So far, so good.  Now we'll simply brute-force-search our way through the existing set of
+                 * literals, looking for a complete match.
+                 */
+                for (let nLocation = nLocationLiterals; nLocation + nWords <= this.nLocation; nLocation++) {
+                    let n;
+                    for (n = 0; n < nWords; n++) {
+                        /*
+                         * This check requires that the initial values of the words in the literals match AND that
+                         * their fixup expressions, if any, match as well.  Here again, MACRO-10 may be more aggressive
+                         * in either verifying fixup equality or evaluating any fixups that it can immediately, but
+                         * but I prefer to leave all fixup evaluation where it is (below), after all literals and then
+                         * all variables have been added to the output.
+                         */
+                        if (aWords[n] !== this.aWords[nLocation + n] || lit.aFixups[n] != this.aFixups[nLocation]) break;
+                    }
+                    if (n == nWords) {
+                        this.addSymbol(lit.name, nLocation, Macro10.SYMTYPE.LABEL);
+                        lit = null;
+                        break;
+                    }
+                }
+            }
+            if (lit) {
+                var macro10 = this;
+                this.addSymbol(lit.name, this.nLocation, Macro10.SYMTYPE.LABEL);
+                lit.aWords.forEach(function(w, nLocation) {
+                    macro10.genWord(w, lit.aFixups[nLocation]);
+                });
+            }
+        }
+        this.aLiterals = [];
+    }
+
+    /**
+     * doVariables()
+     *
+     * @this {Macro10}
+     */
+    doVariables()
+    {
+        for (let i = 0; i < this.aVariables.length; i++) {
+            let name = this.aVariables[i];
+            let macro = this.tblMacros[name];
+            if (!macro) {
+                /*
+                 * This is more of an assert(), because it should never happen, regardless of input.
+                 */
+                this.error("missing definition for variable '" + name + "'");
+                continue;
+            }
+            this.parseText(macro.sText);
+        }
+        this.aVariables = [];
+    }
+
+    /**
+     * genASCII()
+     *
+     * Based on the last operator, generate the appropriate ASCII/ASCIZ/SIXBIT data.
+     *
+     * @this {Macro10}
+     */
+    genASCII()
+    {
+        var n = 0, w = 0;       // number of characters in current word, and current word
+        var bits, shift;        // bits per character, and bits to left-shift next character
+        var cch = this.sASCII.length;
+        if (this.sOperator == Macro10.PSEUDO_OP.ASCIZ) cch++;
+        for (var i = 0; i < cch; i++) {
+            if (!n) {
+                w = 0; shift = 29; bits = 7;
+                if (this.sOperator == Macro10.PSEUDO_OP.SIXBIT) {
+                    bits--; shift++;
+                }
+            }
+            /*
+             * If we're processing an ASCIZ pseudo-op, then yes, we will fetch one character beyond
+             * the end of sASCII, which will return NaN, but when we mask a falsey value like NaN, we
+             * get zero, so it's all good.
+             */
+            var c = this.sASCII.charCodeAt(i) & 0o177;
+            /*
+             * If we're doing 6-bit encoding, then perform the conversion of lower-case to upper-case,
+             * and then adjust/mask.
+             */
+            if (bits == 6) {
+                if (c >= 0x61 && c <= 0x7A) c -= 0x20;
+                c = (c + 0o40) & 0o77;
+            }
+            w += c * Math.pow(2, shift);
+            shift -= bits;
+            n++;
+            if (shift < 0) {
+                this.genWord(w);
+                n = 0;
+            }
+        }
+        if (n) this.genWord(w);
+    }
+
+    /**
+     * genWord(value, sUndefined)
+     *
+     * @this {Macro10}
+     * @param {number} value (default value for the current location)
+     * @param {string} [sUndefined] (optional fixup to evaluate later)
+     */
+    genWord(value, sUndefined)
+    {
+        this.aWords[this.nLocation] = this.truncate(value);
+        if (sUndefined !== undefined) this.aFixups[this.nLocation] = sUndefined;
+        this.aLineRefs[this.nLocation] = this.nLine;
+        this.nLocation++;
+    }
+
+    /**
+     * truncate(value, nLocation)
+     *
+     * @this {Macro10}
+     * @param {number} value
+     * @param {number} [nLocation]
+     * @return {number}
+     */
+    truncate(value, nLocation = this.nLocation)
+    {
+        var w = this.dbg.truncate(value || 0, 36, true);
+        if (value < -PDP10.INT_LIMIT || value >= PDP10.WORD_LIMIT) {
+            this.warning("truncated value " + Str.toOct(value) + " at location " + Str.toOct(nLocation) + " to " + Str.toOct(w));
+        }
+        return w;
+    }
+
+    /**
+     * error(sError, nLine)
+     *
+     * @this {Macro10}
+     * @param {string} sError
+     * @param {number} [nLine]
+     * @throws {Error}
+     */
+    error(sError, nLine)
+    {
+        throw new Error("error in " + this.getLineRef(nLine) + ": " + sError);
+    }
+
+    /**
+     * warning(sWarning, nLine)
+     *
+     * @this {Macro10}
+     * @param {string} sWarning
+     * @param {number} [nLine]
+     */
+    warning(sWarning, nLine)
+    {
+        this.println("warning in " + this.getLineRef(nLine) + ": " + sWarning);
+    }
+
+    /**
+     * println(s)
+     *
+     * @this {Macro10}
+     * @param {string} s
+     */
+    println(s)
+    {
+        if (!this.dbg) {
+            console.log(s);
+        } else {
+            this.dbg.println(s);
+        }
+    }
+}
+
+Macro10.SYMTYPE = {
+    LABEL:      0x01,
+    PRIVATE:    0x02,
+    INTERNAL:   0x04
+};
+
+Macro10.PSEUDO_OP = {
+    ASCII:      "ASCII",
+    ASCIZ:      "ASCIZ",
+    BLOCK:      "BLOCK",
+    BYTE:       "BYTE",
+    DEFINE:     "DEFINE",
+    END:        "END",
+    EXP:        "EXP",
+    IF1:        "IF1",
+    IFDEF:      "IFDEF",
+    IFDIF:      "IFDIF",
+    IFE:        "IFE",
+    IFG:        "IFG",
+    IFGE:       "IFGE",
+    IFIDN:      "IFIDN",
+    IFL:        "IFL",
+    IFLE:       "IFLE",
+    IFN:        "IFN",
+    IFNDEF:     "IFNDEF",
+    IRP:        "IRP",
+    IRPC:       "IRPC",
+    LALL:       "LALL",
+    LIT:        "LIT",
+    LITERAL:    "LITERAL",      // this is a pseudo-pseudo-op, for internal use only
+    LIST:       "LIST",
+    LOC:        "LOC",
+    NOSYM:      "NOSYM",
+    OPDEF:      "OPDEF",
+    PAGE:       "PAGE",
+    PURGE:      "PURGE",
+    REPEAT:     "REPEAT",
+    SIXBIT:     "SIXBIT",
+    SUBTTL:     "SUBTTL",
+    TITLE:      "TITLE",
+    VAR:        "VAR",
+    XALL:       "XALL",
+    XWD:        "XWD",
+    XLIST:      "XLIST"
+};
+
+/*
+ * This enumerates the kinds of macros stored in tblMacros.  The nOperand field should contain
+ * one of these values, unless it's a REPEAT or CONDITIONAL block, in which case it will contain
+ * either a repeat count or conditional value.
+ */
+Macro10.MACRO_OP = {
+    DEFINE:         -1,
+    OPDEF:          -2,
+    LITERAL:        -3,
+    RESERVED:       -4,
+};
+
+/**
+ * @copyright http://pcjs.org/modules/pdp10/lib/computer.js (C) Jeff Parsons 2012-2017
+ */
+
+
+class ComputerPDP10 extends Component {
+    /**
+     * ComputerPDP10(parmsComputer, parmsMachine, fSuspended)
+     *
+     * The ComputerPDP10 component has no required (parmsComputer) properties, but it does
+     * support the following:
+     *
+     *      autoPower: true to automatically power the computer (default), false to wait;
+     *      false is honored only if a "power" button binding exists.
+     *
+     *      busWidth: number of memory address lines (address bits) on the computer's "bus";
+     *      20 is the minimum (and the default), which implies 8086/8088 real-mode addressing,
+     *      while 24 is required for 80286 protected-mode addressing.  This value is passed
+     *      directly through to the Bus component; see that component for more details.
+     *
+     *      resume: one of the ComputerPDP10.RESUME constants, which are as follows:
+     *          '0' if resume disabled (default)
+     *          '1' if enabled without prompting
+     *          '2' if enabled with prompting
+     *          '3' if enabled with prompting and auto-delete
+     *          or a string containing the path of a predefined JSON-encoded state
+     *
+     *      state: the path to JSON-encoded state file (see details regarding 'state' below)
+     *
+     * The parmsMachine object, if provided, may contain any of:
+     *
+     *      autoMount: if set, this should override any 'autoMount' property in the FDC's
+     *      parmsFDC object.
+     *
+     *      autoPower: if set, this should override any 'autoPower' property in the ComputerPDP10's
+     *      parmsComputer object.
+     *
+     *      messages: if set, this should override any 'messages' property in the Debugger's
+     *      parmsDbg object.
+     *
+     *      state: if set, this should override any 'state' property in the ComputerPDP10's
+     *      parmsComputer object.
+     *
+     *      url: the location of the machine XML file
+     *
+     * If a predefined state is supplied AND it's successfully loaded, then resume behavior
+     * defaults to '1' (ie, resume enabled without prompting).
+     *
+     * This component insures that all components are ready before "powering" them.
+     *
+     * Different components become ready at different times, and initialization order (ie,
+     * the order the scripts are combined on the page) only partially determines readiness.
+     * This is because components like ROM and Video must finish loading their resource files
+     * before they are ready.  Other components become ready after we call their initBus()
+     * function, because they have a Bus or CPU dependency, such as access to memory management
+     * functions.  And other components, like CPU and Panel, are ready as soon as their
+     * constructor finishes.
+     *
+     * Once a component has indicated it's ready, we call its powerUp() notification
+     * function (if it has one--it's optional).  We call the CPU's powerUp() function last,
+     * so that the CPU is assured that all other components are ready and "powered".
+     *
+     * @param {Object} parmsComputer
+     * @param {Object} [parmsMachine]
+     * @param {boolean} [fSuspended]
+     */
+    constructor(parmsComputer, parmsMachine, fSuspended)
+    {
+        super("Computer", parmsComputer, MessagesPDP10.COMPUTER);
+
+        this.flags.powered = false;
+
+        this.parmsMachine = null;
+        this.setMachineParms(parmsMachine);
+
+        this.fAutoPower = this.getMachineParm('autoPower', parmsComputer, Str.TYPES.BOOLEAN);
+
+        /*
+         * nPowerChange is 0 while the power state is stable, 1 while power is transitioning
+         * to "on", and -1 while power is transitioning to "off".
+         */
+        this.nPowerChange = 0;
+
+        /*
+         * TODO: Deprecate 'buswidth' (it should have always used camelCase)
+         */
+        this.nBusWidth = +parmsComputer['busWidth'] || +parmsComputer['buswidth'];
+
+        this.sResumePath = this.sStatePath = null;
+        this.sStateData = null;
+        this.fStateData = false;            // remembers if sStateData was loaded
+        this.fServerState = false;
+        this.stateComputer = this.stateFailSafe = null;
+        this.fInitialized = this.fReload = this.fRestoreError = false;
+
+        this.url = /** @type {string} */ (this.getMachineParm('url') || "");
+
+        /*
+         * Generate a random number x (where 0 <= x < 1), add 0.1 so that it's guaranteed to be
+         * non-zero, convert to base 36, and chop off the leading digit and "decimal" point.
+         */
+        this.sMachineID = (Math.random() + 0.1).toString(36).substr(2,12);
+        this.sUserID = this.queryUserID();
+
+        /*
+         * Find the appropriate CPU (and Debugger and Control Panel, if any).
+         *
+         * CLOSURE COMPILER TIP: To override the type of a right-hand expression (as we need to do here,
+         * where we know getComponentByType() will only return an CPUState object or null), wrap the expression
+         * in parentheses.  I never knew this until I stumbled across it in "Closure: The Definitive Guide".
+         */
+        this.cpu = /** @type {CPUStatePDP10} */ (Component.getComponentByType("CPU", this.id));
+        if (!this.cpu) {
+            Component.error("Unable to find CPU component");
+            return;
+        }
+        this.dbg = /** @type {DebuggerPDP10} */ (Component.getComponentByType("Debugger", this.id));
+
+        /*
+         * Initialize the Bus component
+         */
+        this.bus = new BusPDP10({'id': this.idMachine + '.bus', 'busWidth': this.nBusWidth}, this.cpu, this.dbg);
+
+        /*
+         * Iterate through all the components and connect them to the Control Panel, if any
+         */
+        var iComponent, component;
+        var aComponents = Component.getComponents(this.id);
+        this.panel = /** @type {PanelPDP10} */ (Component.getComponentByType("Panel", this.id));
+
+        if (this.panel && this.panel.controlPrint) {
+            for (iComponent = 0; iComponent < aComponents.length; iComponent++) {
+                component = aComponents[iComponent];
+                /*
+                 * I can think of many "cleaner" ways for the Control Panel component to pass its
+                 * notice(), println(), etc, overrides on to all the other components, but it's just
+                 * too darn convenient to slam those overrides into the components directly.
+                 */
+                component.notice = this.panel.notice;
+                component.println = this.panel.println;
+                component.controlPrint = this.panel.controlPrint;
+            }
+        }
+
+        this.println(PDP10.APPNAME + " v" + PDP10.APPVERSION + "\n" + COPYRIGHT + "\n" + LICENSE);
+
+        /*
+         * Iterate through all the components again and call their initBus() handler, if any
+         */
+        for (iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            component = aComponents[iComponent];
+            if (component.initBus) component.initBus(this, this.bus, this.cpu, this.dbg);
+        }
+
+        var sStatePath = null;
+        var sResume = /** @type {string} */ (this.getMachineParm('resume', parmsComputer));
+        if (sResume !== undefined) {
+            /*
+             * Decide whether the 'resume' property is a number or the path of a state file to resume.
+             */
+            if (sResume.length > 1) {
+                sStatePath = this.sResumePath = sResume;
+            } else {
+                this.resume = parseInt(sResume, 10);
+            }
+        }
+
+        /*
+         * The Computer 'state' property allows a state file to be specified independent of the 'resume' feature;
+         * previously, you could only use 'resume' to load a state file -- which we still support, but loading a state
+         * file that way prevents the machine's state from being saved, since we always resume from the 'resume' file.
+         *
+         * The other wrinkle is on the restore side: we need to IGNORE the 'state' property if a saved state now exists.
+         * So we have to peek at localStorage, and unfortunately, the only way to "peek" is to actually load the data,
+         * but we're not ready to use it yet, so powerUp() has been changed to use any existing stateComputer that we've
+         * already loaded.
+         *
+         * However, there's now a wrinkle to the wrinkle: if a 'state' parameter has been passed via the URL, then that
+         * OVERRIDES everything; it overrides any 'state' Computer parameter AND it disables resume of any saved state in
+         * localStorage (in other words, it prevents fAllowResume from being true, and forcing resume off).
+         */
+        var fAllowResume;
+        var sState = this.getMachineParm('state') || (fAllowResume = true) && parmsComputer['state'];
+
+        if (sState) {
+            this.sStatePath = sStatePath = sState;
+            if (!fAllowResume) {
+                this.fServerState = true;
+                this.resume = ComputerPDP10.RESUME_NONE;
+            }
+            if (this.resume) {
+                this.stateComputer = new State(this, PDP10.APPVERSION);
+                if (this.stateComputer.load()) {
+                    sStatePath = null;
+                } else {
+                    delete this.stateComputer;
+                }
+            }
+        }
+
+        /*
+         * If sStatePath is set, we must use it.  But if there's no sStatePath AND resume is set,
+         * then we have the option of resuming from a server-side state, assuming a valid USERID.
+         */
+        if (!sStatePath && this.resume) {
+            sStatePath = this.getServerStatePath();
+            if (sStatePath) this.fServerState = true;
+        }
+
+        if (!sStatePath) {
+            this.setReady();
+        } else {
+            var cmp = this;
+            Web.getResource(sStatePath, null, true, function doneStateLoad(sURL, sResource, nErrorCode) {
+                cmp.finishStateLoad(sURL, sResource, nErrorCode);
+            });
+        }
+
+        if (!this.bindings["power"]) this.fAutoPower = true;
+
+        /*
+         * Power on the computer, giving every component the opportunity to reset or restore itself.
+         */
+        if (!fSuspended && this.fAutoPower) this.wait(this.powerOn);
+    }
+
+    /**
+     * getMachineID()
+     *
+     * @return {string}
+     */
+    getMachineID()
+    {
+        return this.sMachineID;
+    }
+
+    /**
+     * setMachineParms(parmsMachine)
+     *
+     * If no explicit machine parms were provided, then we check for 'parms' in the bundled resources (if any).
+     *
+     * @param {Object} [parmsMachine]
+     */
+    setMachineParms(parmsMachine)
+    {
+        if (!parmsMachine) {
+            var sParms;
+            if (typeof resources == 'object' && (sParms = resources['parms'])) {
+                try {
+                    parmsMachine = /** @type {Object} */ (eval("(" + sParms + ")"));
+                } catch(e) {
+                    Component.error(e.message + " (" + sParms + ")");
+                }
+            }
+        }
+        this.parmsMachine = parmsMachine;
+    }
+
+    /**
+     * getMachineParm(sParm, parmsComponent, type, defaultValue)
+     *
+     * If the machine parameter doesn't exist, we check for a matching component parameter
+     * (if parmsComponent is provided), and failing that, we check the bundled resources (if any).
+     *
+     * At the moment, the only bundled resource request we expect to encounter is 'state'; if it exists,
+     * then we return 'state' back to the caller (ie, the name of the resource), so that the caller will
+     * then attempt to load the 'state' resource to obtain the actual state.
+     *
+     * TODO: It would be nice if we could tell the Closure Compiler that when a specific type parameter
+     * (eg, Str.TYPES.NUMBER) is used, the return value will be that type; unfortunately, every caller
+     * must coerce their own return value.
+     *
+     * @param {string} sParm
+     * @param {Object|null} [parmsComponent]
+     * @param {number} [type] (from Str.TYPES)
+     * @param {*} [defaultValue]
+     * @return {*}
+     */
+    getMachineParm(sParm, parmsComponent, type, defaultValue)
+    {
+        /*
+         * When checking parmsURL, the check is allowed be a bit looser, because URL parameters are
+         * user-supplied, whereas most other parameters are developer-supplied.  Granted, a developer
+         * may also be sloppy and neglect to use correct case (eg, 'automount' instead of 'autoMount'),
+         * but there are limits to my paranoia.
+         */
+        var sParmLC = sParm.toLowerCase();
+        var value = Web.getURLParm(sParm) || Web.getURLParm(sParmLC);
+        if (value === undefined && this.parmsMachine) value = this.parmsMachine[sParm];
+        if (value === undefined && parmsComponent) value = parmsComponent[sParm];
+        if (value === undefined && typeof resources == 'object' && resources[sParm]) value = sParm;
+        if (value === undefined) value = defaultValue;
+        if (typeof value == "string" && type) {
+            switch(type) {
+            case Str.TYPES.NUMBER:
+                value = +value;
+                if (isNaN(/** @type {number} */(value))) value = defaultValue || 0;
+                break;
+            case Str.TYPES.BOOLEAN:
+                value = (value == "true");
+                break;
+            }
+        }
+        return value;
+    }
+
+    /**
+     * saveMachineParms()
+     *
+     * @return {string|null}
+     */
+    saveMachineParms()
+    {
+        return this.parmsMachine? JSON.stringify(this.parmsMachine) : null;
+    }
+
+    /**
+     * getUserID()
+     *
+     * @return {string}
+     */
+    getUserID()
+    {
+        return this.sUserID || "";
+    }
+
+    /**
+     * finishStateLoad(sURL, sStateData, nErrorCode)
+     *
+     * @this {ComputerPDP10}
+     * @param {string} sURL
+     * @param {string} sStateData
+     * @param {number} nErrorCode
+     */
+    finishStateLoad(sURL, sStateData, nErrorCode)
+    {
+        if (!nErrorCode) {
+            this.sStateData = sStateData;
+            this.fStateData = true;
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage("loaded state file " + sURL.replace(this.sUserID || "xxx", "xxx"));
+            }
+        } else {
+            this.sResumePath = null;
+            this.fServerState = false;
+            this.notice('Unable to load machine state from server (error ' + nErrorCode + (sStateData? ': ' + Str.trim(sStateData) : '') + ')');
+        }
+        this.setReady();
+    }
+
+    /**
+     * wait(fn, parms)
+     *
+     * wait() waits until every component is ready (including ourselves, the last component we check), then calls the
+     * specified Computer method.
+     *
+     * TODO: The Closure Compiler makes it difficult for us to define a function type for "fn" that works in all cases;
+     * sometimes we want to pass a function that takes only a "number", and other times we want to pass a function that
+     * takes only an "Array" (the type will mirror that of the "parms" parameter).  However, the Closure Compiler insists
+     * that both functions must be declared as accepting both types of parameters.  So once again, we must use an untyped
+     * function declaration, instead of something stricter like:
+     *
+     *      param {function(this:Computer, (number|Array|undefined)): undefined} fn
+     *
+     * @this {ComputerPDP10}
+     * @param {function(...)} fn
+     * @param {number|Array} [parms] optional parameters
+     */
+    wait(fn, parms)
+    {
+        var computer = this;
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent <= aComponents.length; iComponent++) {
+            var component = (iComponent < aComponents.length ? aComponents[iComponent] : this);
+            if (!component.isReady()) {
+                component.isReady(function onComponentReady() {
+                    computer.wait(fn, parms);
+                });
+                return;
+            }
+        }
+        if (DEBUG && this.messageEnabled()) this.printMessage("ComputerPDP10.wait(ready)");
+        fn.call(this, parms);
+    }
+
+    /**
+     * validateState(stateComputer)
+     *
+     * NOTE: We clear() stateValidate only when there's no stateComputer.
+     *
+     * @this {ComputerPDP10}
+     * @param {State|null} [stateComputer]
+     * @return {boolean} true if state passes validation, false if not
+     */
+    validateState(stateComputer)
+    {
+        var fValid = true;
+        var stateValidate = new State(this, PDP10.APPVERSION, ComputerPDP10.STATE_VALIDATE);
+        if (stateValidate.load() && stateValidate.parse()) {
+            var sTimestampValidate = stateValidate.get(ComputerPDP10.STATE_TIMESTAMP);
+            var sTimestampComputer = stateComputer? stateComputer.get(ComputerPDP10.STATE_TIMESTAMP) : "unknown";
+            if (sTimestampValidate != sTimestampComputer) {
+                this.notice("Machine state may be out-of-date\n(" + sTimestampValidate + " vs. " + sTimestampComputer + ")\nCheck your browser's local storage limits");
+                fValid = false;
+                if (!stateComputer) stateValidate.clear();
+            } else {
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage("Last state: " + sTimestampComputer + " (validate: " + sTimestampValidate + ")");
+                }
+            }
+        }
+        return fValid;
+    }
+
+    /**
+     * powerOn(resume)
+     *
+     * Power every component "up", applying any previously available state information.
+     *
+     * @this {ComputerPDP10}
+     * @param {number} [resume] is a valid RESUME value; default is this.resume
+     */
+    powerOn(resume)
+    {
+        if (resume === undefined) {
+            resume = this.resume || (this.sStateData? ComputerPDP10.RESUME_AUTO : ComputerPDP10.RESUME_NONE);
+        }
+
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("ComputerPDP10.powerOn(" + (resume == ComputerPDP10.RESUME_REPOWER ? "repower" : (resume ? "resume" : "")) + ")");
+        }
+
+        if (this.nPowerChange) {
+            return;
+        }
+        this.nPowerChange++;
+
+        var fRepower = false;
+        var fRestore = false;
+        this.fRestoreError = false;
+        var stateComputer = this.stateComputer || new State(this, PDP10.APPVERSION);
+
+        if (resume == ComputerPDP10.RESUME_REPOWER) {
+            fRepower = true;
+        }
+        else if (resume > ComputerPDP10.RESUME_NONE) {
+            if (stateComputer.load(this.sStateData)) {
+                /*
+                 * Since we're resuming something (either a predefined state or a state from localStorage), let's
+                 * create a "failsafe" checkpoint in localStorage, and destroy it at the end of a successful powerOn().
+                 * Which means, of course, that if a previous "failsafe" checkpoint already exists, something bad
+                 * may have happened the last time around.
+                 */
+                this.stateFailSafe = new State(this, PDP10.APPVERSION, ComputerPDP10.STATE_FAILSAFE);
+                if (this.stateFailSafe.load()) {
+                    this.powerReport(stateComputer);
+                    /*
+                     * We already know resume is something other than RESUME_NONE, so we'll go ahead and bump it
+                     * all the way to RESUME_PROMPT, so that the user will be prompted, and if the user declines to
+                     * restore, the state will be removed.
+                     */
+                    resume = ComputerPDP10.RESUME_PROMPT;
+                    /*
+                     * To ensure that the set() below succeeds, we need to call unload(), otherwise it may fail
+                     * with a "read only" error (eg, "TypeError: Cannot assign to read only property 'timestamp'").
+                     */
+                    this.stateFailSafe.unload();
+                }
+
+                this.stateFailSafe.set(ComputerPDP10.STATE_TIMESTAMP, Usr.getTimestamp());
+                this.stateFailSafe.store();
+
+                var fValidate = this.resume && !this.fServerState;
+                if (resume == ComputerPDP10.RESUME_AUTO || Component.confirmUser("Click OK to restore the previous " + PDP10.APPNAME + " machine state, or CANCEL to reset the machine.")) {
+                    fRestore = stateComputer.parse();
+                    if (fRestore) {
+                        var sCode = /** @type {string} */ (stateComputer.get(UserAPI.RES.CODE));
+                        var sData = /** @type {string} */ (stateComputer.get(UserAPI.RES.DATA));
+                        if (sCode) {
+                            if (sCode == UserAPI.CODE.OK) {
+                                stateComputer.load(sData);
+                            } else {
+                                /*
+                                 * A missing (or not yet created) state file is no cause for alarm, but other errors might be
+                                 */
+                                if (sCode == UserAPI.CODE.FAIL && sData != UserAPI.FAIL.NOSTATE) {
+                                    this.notice("Error: " + sData);
+                                    if (sData == UserAPI.FAIL.VERIFY) this.resetUserID();
+                                } else {
+                                    this.println(sCode + ": " + sData);
+                                }
+                                /*
+                                 * Try falling back to the state that we should have saved in localStorage, as a backup to the
+                                 * server-side state.
+                                 */
+                                stateComputer.unload();     // discard the invalid server-side state first
+                                if (stateComputer.load()) {
+                                    fRestore = stateComputer.parse();
+                                    fValidate = true;
+                                } else {
+                                    fRestore = false;       // hmmm, there was nothing in localStorage either
+                                }
+                            }
+                        }
+                    }
+                    /*
+                     * If the load/parse was successful, and it was from localStorage (not sStateData),
+                     * then we should to try verify that localStorage snapshot is current.  One reason it may
+                     * NOT be current is if localStorage was full and we got a quota error during the last
+                     * powerOff().
+                     */
+                    if (fValidate) this.validateState(fRestore? stateComputer : null);
+                } else {
+                    /*
+                     * RESUME_PROMPT indicates we should delete the state if they clicked Cancel to confirm() above.
+                     */
+                    if (resume == ComputerPDP10.RESUME_PROMPT) stateComputer.clear();
+                }
+            } else {
+                /*
+                 * If there's no state, then there should also be no validation timestamp; if there is, then once again,
+                 * we're probably dealing with a quota error.
+                 */
+                this.validateState();
+            }
+            delete this.sStateData;
+            delete this.stateComputer;
+        }
+
+        /*
+         * Start powering all components, including any data they may need to restore their state;
+         * we restore power to the CPU last.
+         */
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component !== this && component != this.cpu) {
+                fRestore = this.powerRestore(component, stateComputer, fRepower, fRestore);
+            }
+        }
+
+        /*
+         * Assuming this is not a repower, we must perform another wait, because some components may
+         * have marked themselves as "not ready" again (eg, the FDC component, if the restore forced it
+         * to mount one or more additional disk images).
+         */
+        var aParms = [stateComputer, resume, fRestore];
+
+        if (resume != ComputerPDP10.RESUME_REPOWER) {
+            this.wait(this.donePowerOn, aParms);
+            return;
+        }
+        this.donePowerOn(aParms);
+    }
+
+    /**
+     * powerRestore(component, stateComputer, fRepower, fRestore)
+     *
+     * @this {ComputerPDP10}
+     * @param {Component} component
+     * @param {State} stateComputer
+     * @param {boolean} fRepower
+     * @param {boolean} fRestore
+     * @return {boolean} true if restore should continue, false if not
+     */
+    powerRestore(component, stateComputer, fRepower, fRestore)
+    {
+        if (!component.flags.powered) {
+
+            /*
+             * TODO: If all components called super.powerUp(), the powered flag would be set automatically.
+             */
+
+            component.flags.powered = true;
+
+            var data = null;
+
+            try {
+                if (fRestore) {
+                    data = stateComputer.get(component.id);
+                    if (!data) {
+                        /*
+                         * This is a hack that makes it possible for a machine whose ID has been
+                         * supplemented with a suffix (a single letter or digit) to find object IDs
+                         * in states created from a machine without the suffix.
+                         *
+                         * For example, if a state file was created from a machine with ID "ibm5160"
+                         * but the current machine is "ibm5160a", this attempts a second lookup with
+                         * "ibm5160", enabling us to find objects that match the original machine ID
+                         * (eg, "ibm5160.romEGA").
+                         */
+                        data = stateComputer.get(component.id.replace(/[a-z0-9]\./i, '.'));
+                    }
+                }
+
+                /*
+                 * State.get() will return whatever was originally passed to State.set() (eg, an
+                 * Object or a string), but components are supposed to store only Objects, so if a
+                 * string comes back, something went wrong.  By explicitly eliminating "string" data,
+                 * the Closure Compiler stops complaining that we might be passing strings to our
+                 * powerUp() functions (even though we know we're not).
+                 *
+                 * TODO: Determine if there's some way to coerce the Closure Compiler into treating
+                 * data as Object or null, without having to include this runtime check.  An assert
+                 * would be a good idea, but this is overkill.
+                 */
+                if (typeof data === "string") data = null;
+
+                /*
+                 * If computer is null, this is simply a repower notification, which most components
+                 * don't do anything with.  Exceptions include: CPU (since it may be halted) and Video
+                 * (since its screen may be "turned off").
+                 */
+                if (!component.powerUp(data, fRepower) && data) {
+
+                    Component.error("Unable to restore state for " + component.type);
+                    /*
+                     * If this is a resume error for a machine that also has a predefined state
+                     * AND we're not restoring from that state, then throw away the current state,
+                     * prevent any new state from being created, and then force a reload, which will
+                     * hopefully restore us to the functioning predefined state.
+                     *
+                     * TODO: Considering doing this in ALL cases, not just in situations where a
+                     * 'state' exists but we're not actually resuming from it.
+                     */
+                    if (this.sStatePath && !this.fStateData) {
+                        stateComputer.clear();
+                        this.resume = ComputerPDP10.RESUME_NONE;
+                        Web.reloadPage();
+                    } else {
+                        /*
+                         * In all other cases, we set fRestoreError, which should trigger a call to
+                         * powerReport() and then delete the offending state.
+                         */
+                        this.fRestoreError = true;
+                    }
+                    /*
+                     * Any failure triggers an automatic to call powerUp() again, without any state,
+                     * in the hopes that the component can recover by performing a reset.
+                     */
+                    component.powerUp(null);
+                    /*
+                     * We also disable the rest of the restore operation, because it's not clear
+                     * the remaining state information can be trusted;  the machine is already in an
+                     * inconsistent state, so we're not likely to make things worse, and the only
+                     * alternative (starting over and performing a state-less reset) isn't likely to make
+                     * the user any happier.  But, we'll see... we need some experience with the code.
+                     */
+                    fRestore = false;
+                }
+
+                if (!fRepower && component.comment) {
+                    var asComments = component.comment.split("|");
+                    for (var i = 0; i < asComments.length; i++) {
+                        component.status(asComments[i]);
+                    }
+                }
+            }
+            catch (err) {
+                Component.error("Error restoring state for " + component.type + " (" + err.message + ")");
+            }
+        }
+        return fRestore;
+    }
+
+    /**
+     * donePowerOn(aParms)
+     *
+     * This is nothing more than a continuation of powerOn(), giving us the option of calling wait() one more time.
+     *
+     * @this {ComputerPDP10}
+     * @param {Array} aParms containing [stateComputer, resume, fRestore]
+     */
+    donePowerOn(aParms)
+    {
+        var stateComputer = aParms[0];
+        var fRepower = (aParms[1] < 0);
+        var fRestore = aParms[2];
+
+        if (DEBUG && this.flags.powered && this.messageEnabled()) {
+            this.printMessage("ComputerPDP10.donePowerOn(): redundant");
+        }
+
+        this.fInitialized = true;
+        this.flags.powered = true;
+        var controlPower = this.bindings["power"];
+        if (controlPower) controlPower.textContent = "Shutdown";
+
+        /*
+         * Once we get to this point, we're guaranteed that all components are ready, so it's safe to power the CPU;
+         * the CPU should begin executing immediately, unless a debugger is attached.
+         */
+        if (this.cpu) {
+            /*
+             * TODO: Do we not care about the return value here? (ie, is checking fRestoreError sufficient)?
+             */
+            this.powerRestore(this.cpu, stateComputer, fRepower, fRestore);
+            this.updateDisplays(-2);
+            this.cpu.autoStart();
+        }
+
+        /*
+         * If the state was bad, offer to report it and then delete it.  Deleting may be moot, since invariably a new
+         * state will be created on powerOff() before the next powerOn(), but it seems like good paranoia all the same.
+         */
+        if (this.fRestoreError) {
+            this.powerReport(stateComputer);
+            stateComputer.clear();
+        }
+
+        if (!fRepower && this.stateFailSafe) {
+            this.stateFailSafe.clear();
+            delete this.stateFailSafe;
+        }
+
+        this.nPowerChange = 0;
+    }
+
+    /**
+     * checkPower()
+     *
+     * @this {ComputerPDP10}
+     * @return {boolean} true if the computer is fully powered, false otherwise
+     */
+    checkPower()
+    {
+        if (this.flags.powered) return true;
+
+        var component = null, iComponent;
+        var aComponents = Component.getComponents(this.id);
+        for (iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            component = aComponents[iComponent];
+            if (component !== this && !component.flags.ready) break;
+        }
+        if (iComponent == aComponents.length) {
+            for (iComponent = 0; iComponent < aComponents.length; iComponent++) {
+                component = aComponents[iComponent];
+                if (component !== this && !component.flags.powered) break;
+            }
+        }
+        if (iComponent == aComponents.length) component = this;
+        var s = "The " + component.type + " component (" + component.id + ") is not " + (!component.flags.ready? "ready yet" + (component.fnReady? " (waiting for notification)" : "") : "powered yet") + ".";
+        Component.alertUser(s);
+        return false;
+    }
+
+    /**
+     * powerReport(stateComputer)
+     *
+     * @this {ComputerPDP10}
+     * @param {State} stateComputer
+     */
+    powerReport(stateComputer)
+    {
+        if (Component.confirmUser("There may be a problem with your " + PDP10.APPNAME + " machine.\n\nTo help us diagnose it, click OK to send this " + PDP10.APPNAME + " machine state to http://" + SITEHOST + ".")) {
+            Web.sendReport(PDP10.APPNAME, PDP10.APPVERSION, this.url, this.getUserID(), ReportAPI.TYPE.BUG, stateComputer.toString());
+        }
+    }
+
+    /**
+     * powerOff(fSave, fShutdown)
+     *
+     * Power every component "down" and optionally save the machine state.
+     *
+     * There's one scenario that powerOff() isn't currently able to deal with very effectively: what to do when
+     * the user switches away while it's still being restored, causing Disk getResource() calls to fail.  The
+     * Disk component calls notify() when that happens -- see Disk.mount() -- but the FDC and HDC controllers don't
+     * notify *us* of those problems, so Computer assumes that the restore was completely successful, when in fact
+     * it was only partially successful.
+     *
+     * Then we immediately arrive here to perform a save, following that incomplete restore.  It would be wrong to
+     * deal with that incomplete restore by setting fRestoreError, because we don't want to trigger a powerReport()
+     * and the deletion of the previous state, because the state itself was presumably OK.  Unfortunately, the new
+     * state we now save will no longer include manually mounted disk images whose remounts were interrupted, so future
+     * restores won't remount them either.
+     *
+     * We could perhaps solve this by having the Disk component notify us in those situations, set a new flag
+     * (fRestoreIncomplete?), and set fSave to false if that's ever set.  Be careful though: when fSave is false,
+     * that means MORE than not saving; it also means deleting any previous state, which is NOT what you'd want to
+     * do in a "fRestoreIncomplete" situation.  Also, we have to worry about Disk operations that fail for other reasons,
+     * making sure those failures don't interfere with the save process in the same way.
+     *
+     * As it stands, the worst that happens is any manually mounted disk images might have to be manually remounted,
+     * which doesn't seem like a huge problem.
+     *
+     * @this {ComputerPDP10}
+     * @param {boolean} [fSave] is true to request a saved state
+     * @param {boolean} [fShutdown] is true if the machine is being shut down
+     * @return {string|null} string representing the saved state (or null if error)
+     */
+    powerOff(fSave, fShutdown)
+    {
+        var data;
+        var sState = "none";
+
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("ComputerPDP10.powerOff(" + (fSave ? "save" : "nosave") + (fShutdown ? ",shutdown" : "") + ")");
+        }
+
+        if (this.nPowerChange) {
+            return null;
+        }
+        this.nPowerChange--;
+
+        var stateComputer = new State(this, PDP10.APPVERSION);
+        var stateValidate = new State(this, PDP10.APPVERSION, ComputerPDP10.STATE_VALIDATE);
+
+        var sTimestamp = Usr.getTimestamp();
+        stateValidate.set(ComputerPDP10.STATE_TIMESTAMP, sTimestamp);
+        stateComputer.set(ComputerPDP10.STATE_TIMESTAMP, sTimestamp);
+        stateComputer.set(ComputerPDP10.STATE_VERSION, APPVERSION);
+        stateComputer.set(ComputerPDP10.STATE_HOSTURL, Web.getHostURL());
+        stateComputer.set(ComputerPDP10.STATE_BROWSER, Web.getUserAgent());
+
+        /*
+         * Always power the CPU "down" first, just to help insure it doesn't ask other components to do anything
+         * after they're no longer ready.
+         */
+        if (this.cpu && this.cpu.powerDown) {
+            if (fShutdown) {
+                if (fSave) this.cpu.flags.autoStart = this.cpu.flags.running;
+                this.cpu.stopCPU();
+            }
+            data = this.cpu.powerDown(fSave, fShutdown);
+            if (typeof data === "object") stateComputer.set(this.cpu.id, data);
+            if (fShutdown) {
+                this.cpu.flags.powered = false;
+                if (data === false) sState = null;
+            }
+        }
+
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component.flags.powered) {
+                if (component.powerDown) {
+                    data = component.powerDown(fSave, fShutdown);
+                    if (typeof data === "object") stateComputer.set(component.id, data);
+                }
+                if (fShutdown) {
+                    component.flags.powered = false;
+                    if (data === false) sState = null;
+                }
+            }
+        }
+
+        if (sState) {
+            if (fShutdown) {
+                var fClear = false;
+                var fClearAll = false;
+                if (fSave) {
+                    if (this.sUserID) {
+                        this.saveServerState(this.sUserID, stateComputer.toString());
+                    }
+                    if (!stateValidate.store() || !stateComputer.store()) {
+                        sState = null;
+                        /*
+                         * New behavior as of v1.13.2:  if it appears that localStorage is full, we blow it ALL away.
+                         * Dedicated server-side storage is the only way we'll ever be able to reliably preserve a
+                         * particular machine's state.  Historically, attempting to limp along with whatever localStorage
+                         * is left just generates the same useless and annoying warnings over and over.
+                         */
+                        fClear = fClearAll = true;
+                    }
+                }
+                else {
+                    /*
+                     * I used to ALWAYS clear (ie, delete) any associated computer state, but now I do this only if the
+                     * current machine is "resumable", because there are situations where I have two configurations
+                     * for the same machine -- one resumable and one not -- and I don't want the latter throwing away the
+                     * state of the former.
+                     *
+                     * So this code is here now strictly for callers to delete the state of a "resumable" machine, not as
+                     * some paranoid clean-up operation.
+                     *
+                     * An undocumented feature of this operation is that if your configuration uses the special 'resume="3"'
+                     * value, and you click the "Reset" button, and then you click OK to reset the everything, this will
+                     * actually reset EVERYTHING (ie, all localStorage for ALL configs will be reclaimed).
+                     */
+                    if (this.resume) {
+                        fClear = true;
+                        fClearAll = (this.resume == ComputerPDP10.RESUME_DELETE);
+                    }
+                }
+                if (fClear) {
+                    stateComputer.clear(fClearAll);
+                }
+            } else {
+                sState = stateComputer.toString();
+            }
+        }
+
+        if (fShutdown) {
+            this.flags.powered = false;
+            var controlPower = this.bindings["power"];
+            if (controlPower) controlPower.textContent = "Power";
+        }
+
+        this.nPowerChange = 0;
+
+        return sState;
+    }
+
+    /**
+     * reset()
+     *
+     * Notify all (other) components with a reset() method that the Computer is being reset.
+     *
+     * NOTE: We'd like to reset the Bus first (due to the importance of the A20 line), but since we
+     * allocated the Bus object ourselves, after all the other components were allocated, it ends
+     * up near the end of Component's list of components.  Hence the special case for this.bus below.
+     *
+     * Ditto for the CPU, in part because if the Front Panel resets before the CPU, it will end up
+     * snapping/displaying the PC as of the last instruction executed, before the CPU resets the PC,
+     * causing the Front Panel to display a stale address when we call updateDisplays() at the end.
+     *
+     * @this {ComputerPDP10}
+     */
+    reset()
+    {
+        this.flags.reset = true;
+        if (this.bus && this.bus.reset) {
+            this.printMessage("Resetting " + this.bus.type);
+            this.bus.reset();
+        }
+        if (this.cpu && this.cpu.reset) {
+            this.printMessage("Resetting " + this.cpu.type);
+            this.cpu.reset();
+        }
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component !== this && component !== this.bus && component !== this.cpu && component.reset) {
+                this.printMessage("Resetting " + component.type);
+                component.reset();
+            }
+        }
+        this.flags.reset = false;
+        this.updateDisplays(-1);
+    }
+
+    /**
+     * start(ms, nCycles)
+     *
+     * Notify all (other) components with a start() method that the CPU has started.
+     *
+     * Note that we're called by startCPU(), which is why we exclude the CPU component,
+     * as well as ourselves.
+     *
+     * @this {ComputerPDP10}
+     * @param {number} ms
+     * @param {number} nCycles
+     */
+    start(ms, nCycles)
+    {
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component.type == "CPU" || component === this) continue;
+            if (component.start) {
+                component.start(ms, nCycles);
+            }
+        }
+        this.updateDisplays(-1);
+    }
+
+    /**
+     * stop(ms, nCycles)
+     *
+     * Notify all (other) components with a stop() method that the CPU has stopped.
+     *
+     * Note that we're called by stopCPU(), which is why we exclude the CPU component,
+     * as well as ourselves.
+     *
+     * @this {ComputerPDP10}
+     * @param {number} ms
+     * @param {number} nCycles
+     */
+    stop(ms, nCycles)
+    {
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component.type == "CPU" || component === this) continue;
+            if (component.stop) {
+                component.stop(ms, nCycles);
+            }
+        }
+        this.updateDisplays(-1);
+    }
+
+    /**
+     * updateDisplays(nUpdate)
+     *
+     * TODO: Notify all components with an updateDisplay() method that the computer's state has changed (not
+     * just the hard-coded ones below).
+     *
+     * If any DOM controls were bound to the CPU, then we need to call its updateDisplay() handler; if there are no
+     * such bindings, then cpu.updateDisplay() does nothing.
+     *
+     * Similarly, if there's a Panel, then we need to call its updateDisplay() handler, in case it created its own canvas
+     * and implemented its own register display (eg, dumpRegisters()); if not, then panel.updateDisplay() also does nothing.
+     *
+     * In practice, there will *either* be a Panel with a custom canvas *or* a set of DOM controls bound to the CPU *or*
+     * neither.  In theory, there could be BOTH, but that would be unusual.
+     *
+     * TODO: Consider alternate approaches to these largely register-oriented display updates.  Ordinarily, we like to
+     * separate logic from presentation, and currently the CPUState contains both, since it's the component that intimately
+     * knows the names, number, sizes, etc, of all the active registers.  The Panel component is the logical candidate,
+     * but Panel is an optional component; it's often the case that only machines that include the Debugger also include
+     * Panel.
+     *
+     * @this {ComputerPDP10}
+     * @param {number} [nUpdate] (1 for periodic, -1 for forced, 0 or undefined otherwise)
+     */
+    updateDisplays(nUpdate)
+    {
+        /*
+         * nUpdate is generally set to -1 whenever the CPU is transitioning to/from a running state, in which case
+         * cpu.updateDisplay() will definitely want to hide/show register contents; however, at other times, when the
+         * CPU is running, constantly updating the DOM controls too frequently can adversely impact overall performance.
+         *
+         * nUpdate will also be -1 whenever the Debugger has modified the state of the machine, implying that we're
+         * not sure what, if anything, actually changed.
+         */
+        if (this.cpu) this.cpu.updateDisplay(nUpdate || 0);
+        if (this.panel) this.panel.updateDisplay(nUpdate || 0);
+    }
+
+    /**
+     * setBinding(sType, sBinding, control, sValue)
+     *
+     * @this {ComputerPDP10}
+     * @param {string|null} sType is the type of the HTML control (eg, "button", "textarea", "register", "flag", "rled", etc)
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "reset")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sType, sBinding, control, sValue)
+    {
+        var computer = this;
+
+        switch (sBinding) {
+        case "power":
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickPower() {
+                computer.onPower();
+            };
+            return true;
+
+        case "reset":
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickReset() {
+                computer.onReset();
+            };
+            return true;
+
+        /*
+         * Technically, this binding should now be called "saveState", to clearly distinguish it from
+         * the "Save Machine" control that's normally bound to the savePC() function in save.js.  Saving
+         * an entire machine includes everything needed to start/restore the machine; eg, the machine
+         * XML configuration file(s) *and* the JSON-encoded machine state.
+         */
+        case "save":
+            /*
+             * Since this feature depends on the server supporting the PCjs User API (see userapi.js),
+             * and since pcjs.org is no longer running a Node web server, we disable the feature for that
+             * particular host.
+             */
+            if (Str.endsWith(Web.getHost(), "pcjs.org")) {
+                if (DEBUG) this.log("Remote user API not available");
+                /*
+                 * We could also simply hide the control; eg:
+                 *
+                 *      control.style.display = "none";
+                 *
+                 * but removing the control altogether seems better.
+                 */
+                control.parentNode.removeChild(/** @type {Node} */ (control));
+                return false;
+            }
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickSave() {
+                var sUserID = computer.queryUserID(true);
+                if (sUserID) {
+                    /*
+                     * I modified the test to include a check for sStatePath so that I could save new states
+                     * for machines with existing states; otherwise, I'd have no (easy) way of capturing and
+                     * updating their state.  Making the machine (even temporarily) resumable would have been
+                     * one work-around, but it's not appropriate for some machines, as their state is simply
+                     * too large (for localStorage anyway, which is the default storage solution).
+                     */
+                    var fSave = !!(computer.resume && !computer.sResumePath || computer.sStatePath);
+                    var sState = computer.powerOff(fSave);
+                    if (fSave) {
+                        computer.saveServerState(sUserID, sState);
+                    } else {
+                        computer.notice("Resume disabled, machine state not saved");
+                    }
+                }
+                /*
+                 * This seemed like a handy alternative, but it turned out to be a no-go, at least for large states:
+                 *
+                 *      var sState = computer.powerOff(true);
+                 *      if (sState) {
+                 *          sState = "data:text/json;charset=utf-8," + encodeURIComponent(sState);
+                 *          window.open(sState);
+                 *      }
+                 *
+                 * Perhaps if I embedded the data in a link on the current page instead; eg:
+                 *
+                 *      $('<a href="' + sState + '" download="state.json">Download</a>').appendTo('#container');
+                 */
+            };
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * resetUserID()
+     */
+    resetUserID()
+    {
+        Web.setLocalStorageItem(ComputerPDP10.STATE_USERID, "");
+        this.sUserID = null;
+    }
+
+    /**
+     * queryUserID(fPrompt)
+     *
+     * @param {boolean} [fPrompt]
+     * @returns {string|null|undefined}
+     */
+    queryUserID(fPrompt)
+    {
+        var sUserID = this.sUserID;
+        if (!sUserID) {
+            sUserID = Web.getLocalStorageItem(ComputerPDP10.STATE_USERID);
+            if (sUserID !== undefined) {
+                if (!sUserID && fPrompt) {
+                    /*
+                     * NOTE: Warning the user here that "Save" operations are not currently supported by pcjs.org is
+                     * merely a precaution, because ordinarily, setBinding() should have already determined if we are
+                     * running from pcjs.org and disabled any "Save" button.
+                     */
+                    sUserID = Component.promptUser("Saving machine states on the pcjs.org server is currently unsupported.\n\nIf you're running your own server, enter your user ID below.");
+                    if (sUserID) {
+                        sUserID = this.verifyUserID(sUserID);
+                        if (!sUserID) this.notice("The user ID is invalid.");
+                    }
+                }
+            } else if (fPrompt) {
+                this.notice("Browser local storage is not available");
+            }
+        }
+        return sUserID;
+    }
+
+    /**
+     * verifyUserID(sUserID)
+     *
+     * @this {ComputerPDP10}
+     * @param {string} sUserID
+     * @return {string} validated user ID, or null if error
+     */
+    verifyUserID(sUserID)
+    {
+        this.sUserID = null;
+        var fMessages = DEBUG && this.messageEnabled();
+        if (fMessages) this.printMessage("verifyUserID(" + sUserID + ")");
+        var sRequest = Web.getHost() + UserAPI.ENDPOINT + '?' + UserAPI.QUERY.REQ + '=' + UserAPI.REQ.VERIFY + '&' + UserAPI.QUERY.USER + '=' + sUserID;
+        var response = Web.getResource(sRequest);
+        var nErrorCode = response[0];
+        var sResponse = response[1];
+        if (!nErrorCode && sResponse) {
+            try {
+                response = eval("(" + sResponse + ")");
+                if (response.code && response.code == UserAPI.CODE.OK) {
+                    Web.setLocalStorageItem(ComputerPDP10.STATE_USERID, response.data);
+                    if (fMessages) this.printMessage(ComputerPDP10.STATE_USERID + " updated: " + response.data);
+                    this.sUserID = response.data;
+                } else {
+                    if (fMessages) this.printMessage(response.code + ": " + response.data);
+                }
+            } catch (e) {
+                Component.error(e.message + " (" + sResponse + ")");
+            }
+        } else {
+            if (fMessages) this.printMessage("invalid response (error " + nErrorCode + ")");
+        }
+        return this.sUserID;
+    }
+
+    /**
+     * getServerStatePath()
+     *
+     * @this {ComputerPDP10}
+     * @return {string|null} sStatePath (null if no localStorage or no USERID stored in localStorage)
+     */
+    getServerStatePath()
+    {
+        var sStatePath = null;
+        if (this.sUserID) {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage(ComputerPDP10.STATE_USERID + " for load: " + this.sUserID);
+            }
+            sStatePath = Web.getHost() + UserAPI.ENDPOINT + '?' + UserAPI.QUERY.REQ + '=' + UserAPI.REQ.LOAD + '&' + UserAPI.QUERY.USER + '=' + this.sUserID + '&' + UserAPI.QUERY.STATE + '=' + State.key(this, PDP10.APPVERSION);
+        } else {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage(ComputerPDP10.STATE_USERID + " unavailable");
+            }
+        }
+        return sStatePath;
+    }
+
+    /**
+     * saveServerState(sUserID, sState)
+     *
+     * @param {string} sUserID
+     * @param {string|null} sState
+     */
+    saveServerState(sUserID, sState)
+    {
+        /*
+         * We must pass fSync == true, because (as I understand it) browsers will blow off any async
+         * requests when a page is being closed.  Since our request is synchronous, storeServerState()
+         * should also return a result, but there's not much we can do with it, since browsers ALSO
+         * tend to blow off alerts() and the like when closing down.
+         */
+        if (sState) {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage("size of server state: " + sState.length + " bytes");
+            }
+            var response = this.storeServerState(sUserID, sState, true);
+            if (response && response[UserAPI.RES.CODE] == UserAPI.CODE.OK) {
+                this.notice("Machine state saved to server");
+            } else if (sState) {
+                var sError = (response && response[UserAPI.RES.DATA]) || UserAPI.FAIL.BADSTORE;
+                if (response[UserAPI.RES.CODE] == UserAPI.CODE.FAIL) {
+                    sError = "Error: " + sError;
+                } else {
+                    sError = "Error " + response[UserAPI.RES.CODE] + ": " + sError;
+                }
+                this.notice(sError);
+                this.resetUserID();
+            }
+        } else {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage("no state to store");
+            }
+        }
+    }
+
+    /**
+     * storeServerState(sUserID, sState, fSync)
+     *
+     * @this {ComputerPDP10}
+     * @param {string} sUserID
+     * @param {string} sState
+     * @param {boolean} [fSync] is true if we're powering down and should perform a synchronous request (default is async)
+     * @return {*} server response if fSync is true and a response was received; otherwise null
+     */
+    storeServerState(sUserID, sState, fSync)
+    {
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage(ComputerPDP10.STATE_USERID + " for store: " + sUserID);
+        }
+        /*
+         * TODO: Determine whether or not any browsers cancel our request if we're called during a browser "shutdown" event,
+         * and whether or not it matters if we do an async request (currently, we're not, to try to ensure the request goes through).
+         */
+        var dataPost = {};
+        dataPost[UserAPI.QUERY.REQ] = UserAPI.REQ.STORE;
+        dataPost[UserAPI.QUERY.USER] = sUserID;
+        dataPost[UserAPI.QUERY.STATE] = State.key(this, PDP10.APPVERSION);
+        dataPost[UserAPI.QUERY.DATA] = sState;
+        var sRequest = Web.getHost() + UserAPI.ENDPOINT;
+        if (!fSync) {
+            Web.getResource(sRequest, dataPost, true);
+        } else {
+            var response = Web.getResource(sRequest, dataPost);
+            var sResponse = response[0];
+            if (response[1]) {
+                if (sResponse) {
+                    var i = sResponse.indexOf('\n');
+                    if (i > 0) sResponse = sResponse.substr(0, i);
+                    if (!sResponse.indexOf("Error: ")) sResponse = sResponse.substr(7);
+                }
+                sResponse = '{"' + UserAPI.RES.CODE + '":' + response[1] + ',"' + UserAPI.RES.DATA + '":"' + sResponse + '"}';
+            }
+            if (DEBUG && this.messageEnabled()) this.printMessage(sResponse);
+            return JSON.parse(sResponse);
+        }
+        return null;
+    }
+
+    /**
+     * onPower()
+     *
+     * This handles UI requests to toggle the computer's power (eg, see the "power" button binding).
+     *
+     * @this {ComputerPDP10}
+     */
+    onPower()
+    {
+        if (!this.nPowerChange) {
+            if (!this.flags.powered) {
+                this.wait(this.powerOn);
+            } else {
+                this.powerOff(false, true);
+            }
+        }
+    }
+
+    /**
+     * onReset()
+     *
+     * This handles UI requests to reset the computer's state (eg, see the "reset" button binding).
+     *
+     * @this {ComputerPDP10}
+     */
+    onReset()
+    {
+        /*
+         * I'm going to start with the presumption that it makes little sense for an "unpowered" computer to be "reset";
+         * ditto if the power state is currently being changed.
+         */
+        if (!this.flags.powered || this.nPowerChange) return;
+
+        /*
+         * If this is a "resumable" machine (and it's not using a predefined state), then we overload the reset
+         * operation to offer an explicit "save or discard" option first.  This is currently the only UI we offer to
+         * discard a machine's state, including any disk changes.  The traditional "reset" operation is still available
+         * for non-resumable machines.
+         *
+         * TODO: Break this behavior out into a separate "discard" operation, in case the designer of the machine really
+         * wants to clutter the UI with confusing options. ;-)
+         */
+        if (this.resume && !this.sResumePath) {
+            /*
+             * I used to bypass the prompt if this.resume == ComputerPDP10.RESUME_AUTO, setting fSave to true automatically,
+             * but that gives the user no means of resetting a resumable machine that contains errors in its resume state.
+             */
+            var fSave = (/* this.resume == ComputerPDP10.RESUME_AUTO || */ Component.confirmUser("Click OK to save changes to this " + PDP10.APPNAME + " machine.\n\nWARNING: If you CANCEL, all disk changes will be discarded."));
+            this.powerOff(fSave, true);
+            /*
+             * Forcing the page to reload is an expedient option, but ugly. It's preferable to call powerOn()
+             * and rely on all the components to reset themselves to their default state.  The components with
+             * the greatest burden here are FDC and HDC, which must rely on the fReload flag to determine whether
+             * or not to unload/reload all their original auto-mounted disk images.
+             *
+             * However, if we started with a predefined state (ie, sStatePath is set), we take this shortcut, because
+             * we don't (yet) have code in place to gracefully reload the initial state (requires calling getResource()
+             * again); alternatively, we could avoid throwing that state away, but it seems better to save the memory.
+             *
+             * TODO: Make this more graceful, so that we can stop using the reloadPage() sledgehammer.
+             */
+            if (!fSave && this.sStatePath) {
+                Web.reloadPage();
+                return;
+            }
+            if (!fSave) this.fReload = true;
+            this.powerOn(ComputerPDP10.RESUME_NONE);
+            this.fReload = false;
+        } else {
+            this.reset();
+            if (this.cpu && !this.dbg) this.cpu.autoStart();
+        }
+    }
+
+    /**
+     * getMachineComponent(sType, componentPrev)
+     *
+     * @this {ComputerPDP10}
+     * @param {string} sType
+     * @param {Component|null} [componentPrev] of previously returned component, if any
+     * @return {Component|null}
+     */
+    getMachineComponent(sType, componentPrev)
+    {
+        var componentLast = componentPrev;
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (componentPrev) {
+                if (componentPrev == component) componentPrev = null;
+                continue;
+            }
+            if (component.type == sType) return component;
+        }
+        if (!componentLast) Component.log("Machine component type '" + sType + "' not found", "warning");
+        return null;
+    }
+
+    /**
+     * setFocus(fScroll)
+     *
+     * NOTE: When soft keyboard buttons call us to return focus to the machine (and away from the button),
+     * the browser's default behavior is to scroll the element into view, which can be annoying, especially on iOS,
+     * where the display is more constrained, so we no longer do it by default (fScroll must be true).
+     *
+     * @this {ComputerPDP10}
+     * @param {boolean} [fScroll] (true if you really want the control scrolled into view)
+     */
+    setFocus(fScroll)
+    {
+        if (this.controlPrint) {
+            /*
+             * This seems to be recommended work-around to prevent the browser from scrolling the focused element
+             * into view.  The CPU is not a visual component, so when the CPU wants to set focus, the primary intent
+             * is to ensure that keyboard input is fielded properly.
+             */
+            var x = 0, y = 0;
+            if (!fScroll && window) {
+                x = window.scrollX;
+                y = window.scrollY;
+            }
+
+            this.controlPrint.focus();
+
+            if (!fScroll && window) {
+                window.scrollTo(x, y);
+            }
+        }
+    }
+
+    /**
+     * ComputerPDP10.init()
+     *
+     * For every machine represented by an HTML element of class "PDP10-machine", this function
+     * locates the HTML element of class "computer", extracting the JSON-encoded parameters for the
+     * Computer constructor from the element's "data-value" attribute, invoking the constructor to
+     * create a Computer component, and then binding any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        /*
+         * In non-COMPILED builds, embedMachine() may have set XMLVERSION.
+         */
+        if (!COMPILED && XMLVERSION) PDP10.APPVERSION = XMLVERSION;
+
+        var aeMachines = Component.getElementsByClass(document, PDP10.APPCLASS + "-machine");
+
+        for (var iMachine = 0; iMachine < aeMachines.length; iMachine++) {
+
+            var eMachine = aeMachines[iMachine];
+            var parmsMachine = Component.getComponentParms(eMachine);
+
+            var aeComputers = Component.getElementsByClass(eMachine, PDP10.APPCLASS, "computer");
+
+            for (var iComputer = 0; iComputer < aeComputers.length; iComputer++) {
+
+                var eComputer = aeComputers[iComputer];
+                var parmsComputer = Component.getComponentParms(eComputer);
+
+                /*
+                 * We set fSuspended in the Computer constructor because we want to "power up" the
+                 * computer ourselves, after any/all bindings are in place.
+                 */
+                var computer = new ComputerPDP10(parmsComputer, parmsMachine, true);
+
+                if (DEBUG && computer.messageEnabled()) {
+                    computer.printMessage("onInit(" + computer.flags.powered + ")");
+                }
+
+                /*
+                 * Bind any "power", "reset" and "save" buttons.  An "erase" button was also considered,
+                 * but "reset" now provides a way to force the machine to start from scratch again, so "erase"
+                 * may be redundant now.
+                 */
+                Component.bindComponentControls(computer, eComputer, PDP10.APPCLASS);
+
+                /*
+                 * Power on the computer, giving every component the opportunity to reset or restore itself.
+                 */
+                if (computer.fAutoPower) computer.wait(computer.powerOn);
+            }
+        }
+    }
+
+    /**
+     * ComputerPDP10.show()
+     *
+     * When exit() is using an "onbeforeunload" handler, this "onpageshow" handler allows us to repower everything,
+     * without either resetting or restoring.  We call powerOn() with a special resume value (RESUME_REPOWER) if the
+     * computer is already marked as "ready", meaning the browser didn't change anything.  This "repower" process
+     * should be very quick, essentially just marking all components as powered again (so that, for example, the Video
+     * component will start drawing again) and firing the CPU up again.
+     */
+    static show()
+    {
+        var aeComputers = Component.getElementsByClass(document, PDP10.APPCLASS, "computer");
+        for (var iComputer = 0; iComputer < aeComputers.length; iComputer++) {
+            var eComputer = aeComputers[iComputer];
+            var parmsComputer = Component.getComponentParms(eComputer);
+            var computer = /** @type {ComputerPDP10} */ (Component.getComponentByType("Computer", parmsComputer['id']));
+            if (computer) {
+
+                if (DEBUG && computer.messageEnabled()) {
+                    computer.printMessage("onShow(" + computer.fInitialized + "," + computer.flags.powered + ")");
+                }
+
+                /*
+                 * Note that the FIRST 'onpageshow' event, and therefore the first show() callback, occurs
+                 * AFTER the the initial 'onload' event, and at that point in time, fInitialized will not be set yet.
+                 * So, practically speaking, the first show() callback isn't all that useful.
+                 */
+                if (computer.fInitialized && !computer.flags.powered) {
+                    /**
+                     * Repower the computer, notifying every component to continue running as-is.
+                     */
+                    computer.powerOn(ComputerPDP10.RESUME_REPOWER);
+                }
+            }
+        }
+    }
+
+    /**
+     * ComputerPDP10.exit()
+     *
+     * The Computer is currently the only component that uses an "exit" handler, which Web.onExit() defines as
+     * either an "unload" or "onbeforeunload" handler.  This gives us the opportunity to save the machine state,
+     * using our powerOff() function, before the page goes away.
+     *
+     * It's worth noting that "onbeforeunload" offers one nice feature when used instead of "onload": the entire
+     * page (and therefore this entire application) is retained in its current state by the browser (well, some
+     * browsers), so that if you go to a new URL, either by entering a new URL in the same window/tab, or by pressing
+     * the FORWARD button, and then you press the BACK button, the page is immediately restored to its previous state.
+     *
+     * In fact, that's how some browsers operate whether you have an "onbeforeunload" handler or not; in other words,
+     * an "onbeforeunload" handler doesn't change the page retention behavior of the browser.  By contrast, the mere
+     * presence of an "onunload" handler generally causes a browser to throw the page away once the handler returns.
+     *
+     * However, in order to safely use "onbeforeunload", we must add yet another handler ("onpageshow") to repower
+     * everything, without either resetting or restoring.  Hence, the ComputerPDP10.show() function, which calls powerOn()
+     * with a special resume value (RESUME_REPOWER) if the computer is already marked as "ready", meaning the browser
+     * didn't change anything.  This "repower" process should be very quick, essentially just marking all components as
+     * powered again (so that, for example, the Video component will start drawing again) and firing the CPU up again.
+     *
+     * Reportedly, some browsers (eg, Opera) don't support "onbeforeunload", in which case Component will have to use
+     * "unload" instead.  But even when the page must be rebuilt from scratch, the combination of browser cache and
+     * localStorage means the simulation should be restored and become operational almost immediately.
+     */
+    static exit()
+    {
+        var aeComputers = Component.getElementsByClass(document, PDP10.APPCLASS, "computer");
+        for (var iComputer = 0; iComputer < aeComputers.length; iComputer++) {
+            var eComputer = aeComputers[iComputer];
+            var parmsComputer = Component.getComponentParms(eComputer);
+            var computer = /** @type {ComputerPDP10} */ (Component.getComponentByType("Computer", parmsComputer['id']));
+            if (computer) {
+
+                if (DEBUG && computer.messageEnabled()) {
+                    computer.printMessage("onExit(" + computer.flags.powered + ")");
+                }
+
+                if (computer.flags.powered) {
+                    /**
+                     * Power off the computer, giving every component an opportunity to save its state,
+                     * but only if 'resume' has been set AND there is no valid resume path (because if a valid resume
+                     * path exists, we'll always load our state from there, and not from whatever we save here).
+                     */
+                    computer.powerOff(!!(computer.resume && !computer.sResumePath), true);
+                }
+            }
+        }
+    }
+}
+
+ComputerPDP10.STATE_FAILSAFE  = "failsafe";
+ComputerPDP10.STATE_VALIDATE  = "validate";
+ComputerPDP10.STATE_TIMESTAMP = "timestamp";
+ComputerPDP10.STATE_VERSION   = "version";
+ComputerPDP10.STATE_HOSTURL   = "url";
+ComputerPDP10.STATE_BROWSER   = "browser";
+ComputerPDP10.STATE_USERID    = "user";
+
+/*
+ * The following constants define all the resume options.  Negative values (eg, RESUME_REPOWER) are for
+ * internal use only, and RESUME_DELETE is not documented (it provides a way of deleting ALL saved states
+ * whenever a resume is declined).  As a result, the only "end-user" values are 0, 1 and 2.
+ */
+ComputerPDP10.RESUME_REPOWER  = -1;  // resume without changing any state (for internal use only)
+ComputerPDP10.RESUME_NONE     =  0;  // default (no resume)
+ComputerPDP10.RESUME_AUTO     =  1;  // automatically save/restore state
+ComputerPDP10.RESUME_PROMPT   =  2;  // automatically save but conditionally restore (WARNING: if restore is declined, any state is discarded)
+ComputerPDP10.RESUME_DELETE   =  3;  // same as RESUME_PROMPT but discards ALL machines states whenever ANY machine restore is declined (undocumented)
+
+/*
+ * Initialize every Computer on the page.
+ */
+Web.onInit(ComputerPDP10.init);
+Web.onShow(ComputerPDP10.show);
+Web.onExit(ComputerPDP10.exit);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/state.js (C) Jeff Parsons 2012-2017
+ */
+
+
+class State {
+    /**
+     * State(component, sVersion, sSuffix)
+     *
+     * State objects are used by components to save/restore their state.
+     *
+     * During a save operation, components add data to a State object via set(), and then return
+     * the resulting data using data().
+     *
+     * During a restore operation, the Computer component passes the results of each data() call
+     * back to the originating component.
+     *
+     * WARNING: Since State objects are low-level objects that have no UI requirements, they do not
+     * inherit from the Component class, so you should only use class methods of Component, such as
+     * Component.assert() (or Debugger methods if the Debugger is available).
+     *
+     * NOTE: 1.01 is the first version to provide limited save/restore support using localStorage.
+     * From that point on, care must be taken to insure that any new version that's incompatible with
+     * previous localStorage data be released with a version number that is at least 1 greater,
+     * since we're tagging the localStorage data with the integer portion of the version string.
+     *
+     * @param {Component} component
+     * @param {string} [sVersion] is used to append a major version number to the key
+     * @param {string} [sSuffix] is used to append any additional suffixes to the key
+     */
+    constructor(component, sVersion, sSuffix)
+    {
+        this.id = component.id;
+        this.dbg = component.dbg;
+        this.json = "";
+        this.state = {};
+        this.fLoaded = this.fParsed = false;
+        this.key = State.key(component, sVersion, sSuffix);
+        this.unload(component.parms);
+    }
+
+    /**
+     * set(id, data)
+     *
+     * @this {State}
+     * @param {number|string} id
+     * @param {Object|string} data
+     */
+    set(id, data)
+    {
+        try {
+            this.state[id] = data;
+        } catch(e) {
+            Component.log(e.message);
+        }
+    }
+
+    /**
+     * get(id)
+     *
+     * @this {State}
+     * @param {number|string} id
+     * @return {Object|string|null}
+     */
+    get(id)
+    {
+        return this.state[id] || null;
+    }
+
+    /**
+     * data()
+     *
+     * @this {State}
+     * @return {Object}
+     */
+    data()
+    {
+        return this.state;
+    }
+
+    /**
+     * load(json)
+     *
+     * WARNING: Make sure you follow this call with either a call to parse() or unload(),
+     * because any stringified data that we've loaded isn't usable until it's been parsed.
+     *
+     * @this {State}
+     * @param {string|null} [json]
+     * @return {boolean} true if state exists in localStorage, false if not
+     */
+    load(json)
+    {
+        if (json) {
+            this.json = json;
+            this.fLoaded = true;
+            this.fParsed = false;
+            return true;
+        }
+        if (this.fLoaded) {
+            /*
+             * This is assumed to be a redundant load().
+             */
+            return true;
+        }
+        if (Web.hasLocalStorage()) {
+            var s = Web.getLocalStorageItem(this.key);
+            if (s) {
+                this.json = s;
+                this.fLoaded = true;
+                if (DEBUG) Component.log("localStorage(" + this.key + "): " + s.length + " bytes loaded");
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * parse()
+     *
+     * This completes the load() operation, by parsing what was loaded, on the assumption there
+     * might be some benefit to deferring parsing until we've given the user a chance to confirm.
+     * Otherwise, load() could have just as easily done this, too.
+     *
+     * @this {State}
+     * @return {boolean} true if successful, false if error
+     */
+    parse()
+    {
+        var fSuccess = true;
+        if (!this.fParsed) {
+            try {
+                this.state = JSON.parse(this.json);
+                this.fParsed = true;
+            } catch (e) {
+                Component.error(e.message || e);
+                fSuccess = false;
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * store()
+     *
+     * @this {State}
+     * @return {boolean} true if successful, false if error
+     */
+    store()
+    {
+        var fSuccess = true;
+        if (Web.hasLocalStorage()) {
+            var s = JSON.stringify(this.state);
+            if (Web.setLocalStorageItem(this.key, s)) {
+                if (DEBUG) Component.log("localStorage(" + this.key + "): " + s.length + " bytes stored");
+            } else {
+                /*
+                 * WARNING: Because browsers tend to disable all alerts() during an "unload" operation,
+                 * it's unlikely anyone will ever see the "quota" errors that occur at this point.  Need to
+                 * think of some way to notify the user that there's a problem, and offer a way of cleaning
+                 * up old states.
+                 */
+                Component.error("Unable to store " + s.length + " bytes in browser local storage");
+                fSuccess = false;
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * toString()
+     *
+     * @this {State}
+     * @return {string} JSON-encoded state
+     */
+    toString()
+    {
+        return this.state? JSON.stringify(this.state) : this.json;
+    }
+
+    /**
+     * unload(parms)
+     *
+     * This discards any data saved via set() or loaded via load(), creating an empty State object.
+     * Note that you have to follow this call with an explicit call to store() if you want to remove
+     * the state from localStorage as well.
+     *
+     * @this {State}
+     * @param {Object} [parms]
+     */
+    unload(parms)
+    {
+        this.json = "";
+        this.state = {};
+        this.fLoaded = this.fParsed = false;
+        if (parms) this.set("parms", parms);
+    }
+
+    /**
+     * clear(fAll)
+     *
+     * This unloads the current state, and then clears ALL localStorage for the current machine,
+     * independent of version, to reduce the chance of orphaned states wasting part of our limited allocation.
+     *
+     * @this {State}
+     * @param {boolean} [fAll] true to unconditionally clear ALL localStorage for the current domain
+     */
+    clear(fAll)
+    {
+        this.unload();
+        var aKeys = Web.getLocalStorageKeys();
+        for (var i = 0; i < aKeys.length; i++) {
+            var sKey = aKeys[i];
+            if (sKey && (fAll || sKey.substr(0, this.key.length) == this.key)) {
+                Web.removeLocalStorageItem(sKey);
+                if (DEBUG) Component.log("localStorage(" + sKey + ") removed");
+                aKeys.splice(i, 1);
+                i = 0;
+            }
+        }
+    }
+
+    /**
+     * State.key(component, sVersion, sSuffix)
+     *
+     * This encapsulates the key generation code.
+     *
+     * @param {Component} component
+     * @param {string} [sVersion] is used to append a major version number to the key
+     * @param {string} [sSuffix] is used to append any additional suffixes to the key
+     * @return {string} key
+     */
+    static key(component, sVersion, sSuffix)
+    {
+        var key = component.id;
+        if (sVersion) {
+            var i = sVersion.indexOf('.');
+            if (i > 0) key += ".v" + sVersion.substr(0, i);
+        }
+        if (sSuffix) {
+            key += "." + sSuffix;
+        }
+        return key;
+    }
+
+    /**
+     * State.compress(aSrc)
+     *
+     * @param {Array.<number>|null} aSrc
+     * @return {Array.<number>|null} is either the original array (aSrc), or a smaller array of "count, value" pairs (aComp)
+     */
+    static compress(aSrc)
+    {
+        if (aSrc) {
+            var iSrc = 0;
+            var iComp = 0;
+            var aComp = [];
+            while (iSrc < aSrc.length) {
+                var n = aSrc[iSrc];
+
+                var iCompare = iSrc + 1;
+                while (iCompare < aSrc.length && aSrc[iCompare] === n) iCompare++;
+                aComp[iComp++] = iCompare - iSrc;
+                aComp[iComp++] = n;
+                iSrc = iCompare;
+            }
+            if (aComp.length < aSrc.length) return aComp;
+        }
+        return aSrc;
+    }
+
+    /**
+     * State.decompress(aComp)
+     *
+     * @param {Array.<number>} aComp
+     * @param {number} nLength is expected length of decompressed data
+     * @return {Array.<number>}
+     */
+    static decompress(aComp, nLength)
+    {
+        var iDst = 0;
+        var aDst = new Array(nLength);
+        var iComp = 0;
+        while (iComp < aComp.length - 1) {
+            var c = aComp[iComp++];
+            var n = aComp[iComp++];
+            while (c--) {
+                aDst[iDst++] = n;
+            }
+        }
+
+        return aDst;
+    }
+
+    /**
+     * State.compressEvenOdd(aSrc)
+     *
+     * This is a very simple variation on compress() that compresses all the EVEN elements of aSrc first,
+     * followed by all the ODD elements.  This tends to work better on EGA video memory, because when odd/even
+     * addressing is enabled (eg, for text modes), the DWORD values tend to alternate, which is the worst case
+     * for compress(), but the best case for compressEvenOdd().
+     *
+     * One wrinkle we support: if the first element is uninitialized, then we assume the entire array is undefined,
+     * and return an empty compressed array.  Conversely, decompressEvenOdd() will take an empty compressed array
+     * and return an uninitialized array.
+     *
+     * @param {Array.<number>|null} aSrc
+     * @return {Array.<number>|null} is either the original array (aSrc), or a smaller array of "count, value" pairs (aComp)
+     */
+    static compressEvenOdd(aSrc)
+    {
+        if (aSrc) {
+            var iComp = 0, aComp = [];
+            if (aSrc[0] !== undefined) {
+                for (var off = 0; off < 2; off++) {
+                    var iSrc = off;
+                    while (iSrc < aSrc.length) {
+                        var n = aSrc[iSrc];
+                        var iCompare = iSrc + 2;
+                        while (iCompare < aSrc.length && aSrc[iCompare] === n) iCompare += 2;
+                        aComp[iComp++] = (iCompare - iSrc) >> 1;
+                        aComp[iComp++] = n;
+                        iSrc = iCompare;
+                    }
+                }
+            }
+            if (aComp.length < aSrc.length) return aComp;
+        }
+        return aSrc;
+    }
+
+    /**
+     * State.decompressEvenOdd(aComp, nLength)
+     *
+     * This is the counterpart to compressEvenOdd().  Note that because there's nothing in the compressed sequence
+     * that differentiates a compress() sequence from a compressEvenOdd() sequence, you simply have to be consistent:
+     * if you used even/odd compression, then you must use even/odd decompression.
+     *
+     * @param {Array.<number>} aComp
+     * @param {number} nLength is expected length of decompressed data
+     * @return {Array.<number>}
+     */
+    static decompressEvenOdd(aComp, nLength)
+    {
+        var iDst = 0;
+        var aDst = new Array(nLength);
+        var iComp = 0;
+        while (iComp < aComp.length - 1) {
+            var c = aComp[iComp++];
+            var n = aComp[iComp++];
+            while (c--) {
+                aDst[iDst] = n;
+                iDst += 2;
+            }
+            /*
+             * The output of a "count,value" pair will never exceed the end of the output array, so as soon as we reach it
+             * the first time, we know it's time to switch to ODD elements, and as soon as we reach it again, we should be
+             * done.
+             */
+
+            if (iDst == nLength) iDst = 1;
+        }
+
+        return aDst;
+    }
+}
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/embed.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * We now support asynchronous XML and XSL file loads; simply set fAsync (below) to true.
+ *
+ * NOTE: For that support to work, we have to keep track of the number of machines on the page
+ * (ie, how many embedMachine() calls were issued), reduce the count as each machine XML file
+ * is fully transformed into HTML, and when the count finally returns to zero, notify all the
+ * machine component init() handlers.
+ *
+ * Also, to prevent those init() handlers from running prematurely, we must disable all page
+ * notification events at the start of the embedding process (Web.enablePageEvents(false)) and
+ * re-enable them at the end (Web.enablePageEvents(true)).
+ */
+var fAsync = true;
+var cAsyncMachines = 0;
+
+/**
+ * loadXML(sFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+ *
+ * This is the preferred way to load all XML and XSL files. It uses getResource()
+ * to load them as strings, which parseXML() can massage before parsing/transforming them.
+ *
+ * For example, since I've been unable to get the XSLT document() function to work inside any
+ * XSL document loaded by JavaScript's XSLT processor, that has prevented me from dynamically
+ * loading any XML machine file that uses the "ref" attribute to refer to and incorporate
+ * another XML document.
+ *
+ * To solve that, I've added an fResolve parameter that tells parseXML() to fetch any
+ * referenced documents ITSELF and insert them into the XML string prior to parsing, instead
+ * of relying on the XSLT template to pull them in.  That fetching is handled by resolveXML(),
+ * which iterates over the XML until all "refs" have been resolved (including any nested
+ * references).
+ *
+ * Also, XSL files with a <!DOCTYPE [...]> cause MSIE's Microsoft.XMLDOM.loadXML() function
+ * to choke, so I strip that out prior to parsing as well.
+ *
+ * TODO: Figure out why the XSLT document() function works great when the web browser loads an
+ * XML file (and the associated XSL file) itself, but does not work when loading documents via
+ * JavaScript XSLT support. Is it broken, is it a security issue, or am I just calling it wrong?
+ *
+ * @param {string} sXMLFile
+ * @param {string|null|undefined} idMachine
+ * @param {string|null|undefined} sAppName
+ * @param {string|null|undefined} sAppClass
+ * @param {string|null|undefined} sParms
+ * @param {boolean} fResolve is true to resolve any "ref" attributes
+ * @param {function(string)} display
+ * @param {function(string,Object)} done (string contains the unparsed XML string data, and Object contains a parsed XML object)
+ */
+function loadXML(sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+{
+    var doneLoadXML = function(sURLName, sXML, nErrorCode) {
+        if (nErrorCode) {
+            if (!sXML) sXML = "unable to load " + sXMLFile + " (" + nErrorCode + ")";
+            done(sXML, null);
+            return;
+        }
+        parseXML(sXML, sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done);
+    };
+    display("Loading " + sXMLFile + "...");
+    Web.getResource(sXMLFile, null, fAsync, doneLoadXML);
+}
+
+/**
+ * parseXML(sXML, sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+ *
+ * Generates an XML document from an XML string. This function also provides a work-around for XSLT's
+ * lack of support for the document() function (at least on some browsers), by replacing every reference
+ * tag (ie, a tag with a "ref" attribute) with the contents of the referenced file.
+ *
+ * @param {string} sXML
+ * @param {string|null} sXMLFile
+ * @param {string|null|undefined} idMachine
+ * @param {string|null|undefined} sAppName
+ * @param {string|null|undefined} sAppClass
+ * @param {string|null|undefined} sParms
+ * @param {boolean} fResolve is true to resolve any "ref" attributes; default is false
+ * @param {function(string)} display
+ * @param {function(string,Object)} done (string contains the unparsed XML string data, and Object contains a parsed XML object)
+ */
+function parseXML(sXML, sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+{
+    var buildXML = function(sXML, sError) {
+        if (sError) {
+            done(sError, null);
+            return;
+        }
+        if (idMachine) {
+
+            /*
+             * A more sensible place to record the machine XML would be embedMachine(), like we do for the
+             * XSL file, but since we're about to modify the original machine XML, it's best to record it now.
+             */
+            Component.addMachineResource(idMachine, sXMLFile, sXML);
+
+            var sURL = sXMLFile;
+            if (sURL && sURL.indexOf('/') < 0 && window.location.pathname.slice(-1) == '/') {
+                sURL = window.location.pathname + sURL;
+            }
+            /*
+             * We embed the URL of the XML file both as a separate "xml" attribute for easy access from the
+             * XSL file, and as part of the "parms" attribute for easy access from machines (see getMachineParm()).
+             */
+            if (!sParms) {
+                sParms = '{';
+            } else if (sParms.slice(-1) == '}') {
+                sParms = sParms.slice(0, -1);
+                if (sParms.length > 1) sParms += ',';
+            } else {            // sParms must just be a "state" file, so encode it as a "state" property
+                sParms = '{state:"' + sParms + '",';
+            }
+            sParms += 'url:"' + sURL + '"}';
+            /*
+             * Note that while we no longer generate a machine XML file with a "state" attribute (because it's
+             * encoded inside the "parms" attribute), the XSL file must still cope with "state" attributes inside
+             * other XML files; for example, manifest XML files like /apps/pc/1981/visicalc/manifest.xml contain
+             * machine elements with "state" attributes that must still be passed down to the computer element
+             * "the old fashioned way".
+             *
+             * Until/unless that changes, components.xsl cannot be simplified as much as I might have hoped.
+             */
+            if (typeof resources == 'object') sURL = null;      // turn off URL inclusion if we have embedded resources
+            sXML = sXML.replace(/(<machine[^>]*\sid=)(['"]).*?\2/, "$1$2" + idMachine + "$2" + (sParms? " parms='" + sParms + "'" : "") + (sURL? ' url="' + sURL + '"' : ''));
+        }
+
+        if (!fResolve) {
+            /*
+             * I'm trying to switch to a shared components.xsl (at least for all PC-class machines),
+             * but in the interim, that means hacking the XSL file on the fly to reflect the actual class.
+             */
+            sXML = sXML.replace(/(<xsl:variable name="APPNAME">).*?(<\/xsl:variable>)/, "$1" + sAppName + "$2");
+            sXML = sXML.replace(/(<xsl:variable name="APPCLASS">).*?(<\/xsl:variable>)/, "$1" + sAppClass + "$2");
+
+            /*
+             * Non-COMPILED kludge to replace the version number template in the XSL file (which we assume we're reading,
+             * since fResolve is false) with whatever XMLVERSION we extracted from the XML file (see corresponding kludge below).
+             *
+             * ES6 ALERT: Template strings.
+             */
+            if (!COMPILED && XMLVERSION) {
+                sXML = sXML.replace(/<xsl:variable name="APPVERSION">1.x.x<\/xsl:variable>/, `<xsl:variable name="APPVERSION">${XMLVERSION}</xsl:variable>`);
+            }
+        }
+
+        /*
+         * If the resource we requested is not really an XML file (or the file didn't exist and the server simply returned
+         * a message like "Cannot GET /devices/pc/machine/5150/cga/64kb/donkey/machine.xml"), we'd like to display a more
+         * meaningful message, because the XML DOM parsers will blithely return a document that contains nothing useful; eg:
+         *
+         *      This page contains the following errors:error on line 1 at column 1:
+         *      Document is empty Below is a rendering of the page up to the first error.
+         *
+         * Supposedly, the IE XML DOM parser will throw an exception, but I haven't tested that, and unless all other
+         * browsers do that, that's not helpful.
+         *
+         * The best I can do at this stage (assuming Web.getResource() didn't drop any error information on the floor)
+         * is verify that the requested resource "looks like" valid XML (in other words, it begins with a '<').
+         */
+        var xmlDoc = null;
+        if (sXML.charAt(0) == '<') {
+            try {
+                /*
+                 * Another hack for MSIE, which fails to load XSL documents containing a <!DOCTYPE [...]> tag.
+                 *
+                 * This is also why the XSLTProcessor 'transformToFragment' method in Microsoft Edge silently failed,
+                 * so I had pull this hack out of the "ActiveXObject" code.  And rather than add yet-another Microsoft
+                 * browser check, I'm going to try doing this across the board, and hope that none of the other XSLT
+                 * processors fail *without* the DOCTYPE tag.
+                 */
+                if (!fResolve) {
+                    sXML = sXML.replace(/<!DOCTYPE(.|[\r\n])*]>\s*/g, "");
+                }
+                /*
+                 * Beginning with Microsoft Edge and the corresponding release of Windows 10, all the
+                 * 'ActiveXObject' crud has gone away; but of course, this code must remain in place if
+                 * we want to continue supporting older Internet Explorer browsers (ie, back to IE9).
+                 */
+                /** @namespace window.ActiveXObject */
+                if (window.ActiveXObject || 'ActiveXObject' in window) {        // second test is required for IE11 on Windows 8.1
+                    xmlDoc = new window.ActiveXObject("Microsoft.XMLDOM");
+                    xmlDoc.async = false;
+                    xmlDoc['loadXML'](sXML);
+                } else {
+                    /** @namespace window.DOMParser */
+                    xmlDoc = (new window.DOMParser()).parseFromString(sXML, "text/xml");
+                }
+            } catch(e) {
+                xmlDoc = null;
+                sXML = e.message;
+            }
+        } else {
+            sXML = "unrecognized XML: " + (sXML.length > 255? sXML.substr(0, 255) + "..." : sXML);
+        }
+        done(sXML, xmlDoc);
+    };
+    if (sXML) {
+        if (PRIVATE) sXML = sXML.replace(/\/library.xml/, "/private/library.xml");
+        if (fResolve) {
+            resolveXML(sXML, display, buildXML);
+            return;
+        }
+        buildXML(sXML, null);
+        return;
+    }
+    done("no data" + (sXMLFile? " for file: " + sXMLFile : ""), null);
+}
+
+/**
+ * resolveXML(sXML, display, done)
+ *
+ * Replaces every tag with a "ref" attribute with the contents of the corresponding file.
+ *
+ * TODO: Fix some of the limitations of this code, such as: 1) requiring the "ref" attribute
+ * to appear as the tag's first attribute, 2) requiring the "ref" attribute to be double-quoted,
+ * and 3) requiring the "ref" tag to be self-closing.
+ *
+ * @param {string} sXML
+ * @param {function(string)} display
+ * @param {function(string,(string|null))} done (the first string contains the resolved XML data, the second is for any error message)
+ */
+function resolveXML(sXML, display, done)
+{
+    var matchRef;
+    var reRef = /<([a-z]+)\s+ref="(.*?)"(.*?)\/>/g;
+
+    if ((matchRef = reRef.exec(sXML))) {
+
+        var sRefFile = matchRef[2];
+
+        var doneReadXML = function(sURLName, sXMLRef, nErrorCode) {
+            if (nErrorCode || !sXMLRef) {
+                done(sXML, "unable to resolve XML reference: " + matchRef[0] + " (" + nErrorCode + ")");
+                return;
+            }
+            /*
+             * If there are additional attributes in the "referring" XML tag, we want to insert them
+             * into the "referred" XML tag; attributes that don't exist in the referred tag should be
+             * appended, and attributes that DO exist should be overwritten.
+             */
+            var sRefAttrs = matchRef[3];
+            if (sRefAttrs) {
+                var aXMLRefTag = sXMLRef.match(new RegExp("<" + matchRef[1] + "[^>]*>"));
+                if (aXMLRefTag) {
+                    var sXMLNewTag = aXMLRefTag[0];
+                    /*
+                     * Iterate over all the attributes in the "referring" XML tag (sRefAttrs)
+                     */
+                    var matchAttr;
+                    var reAttr = /( [a-z]+=)(['"])(.*?)\2/g;
+                    while ((matchAttr = reAttr.exec(sRefAttrs))) {
+                        if (sXMLNewTag.indexOf(matchAttr[1]) < 0) {
+                            /*
+                             * This is the append case
+                             */
+                            sXMLNewTag = sXMLNewTag.replace(">", matchAttr[0] + ">");
+                        } else {
+                            /*
+                             * This is the overwrite case
+                             */
+                            sXMLNewTag = sXMLNewTag.replace(new RegExp(matchAttr[1] + "(['\"])(.*?)\\1"), matchAttr[0]);
+                        }
+                    }
+                    if (aXMLRefTag[0] != sXMLNewTag) {
+                        sXMLRef = sXMLRef.replace(aXMLRefTag[0], sXMLNewTag);
+                    }
+                } else {
+                    done(sXML, "missing <" + matchRef[1] + "> in " + sRefFile);
+                    return;
+                }
+            }
+
+            /*
+             * Apparently when a Windows Azure server delivers one of my XML files, it may modify the first line:
+             *
+             *      <?xml version="1.0" encoding="UTF-8"?>\n
+             *
+             * I didn't determine exactly what it was doing at this point (probably just changing the \n to \r\n),
+             * but in any case, relaxing the following replace() solved it.
+             */
+            sXMLRef = sXMLRef.replace(/<\?xml[^>]*>[\r\n]*/, "");
+
+            sXML = sXML.replace(matchRef[0], sXMLRef);
+
+            resolveXML(sXML, display, done);
+        };
+
+        display("Loading " + sRefFile + "...");
+        Web.getResource(sRefFile, null, fAsync, doneReadXML);
+        return;
+    }
+    done(sXML, null);
+}
+
+/**
+ * embedMachine(sAppName, sAppClass, sVersion, idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * This allows to you embed a machine on a web page, by transforming the machine XML into HTML.
+ *
+ * @param {string} sAppName is the app name (eg, "PCx86")
+ * @param {string} sAppClass is the app class (eg, "pcx86"); also known as the machine class
+ * @param {string} sVersion is the app version (eg, "1.15.7")
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedMachine(sAppName, sAppClass, sVersion, idMachine, sXMLFile, sXSLFile, sParms)
+{
+    var eMachine, eWarning, fSuccess = true;
+
+    cAsyncMachines++;
+    Component.addMachine(idMachine);
+
+    var doneMachine = function() {
+
+        if (!--cAsyncMachines) {
+            if (fAsync) Web.enablePageEvents(true);
+        }
+    };
+
+    var displayError = function(sError) {
+        Component.log(sError);
+        displayMessage("Error: " + sError);
+        if (fSuccess) doneMachine();
+        fSuccess = false;
+    };
+
+    var displayMessage = function(sMessage) {
+        if (eWarning === undefined) {
+            /*
+             * Our MarkOut module (in convertMDMachineLinks()) creates machine containers that look like:
+             *
+             *      <div id="' + sMachineID + '" class="machine-placeholder"><p>Embedded PC</p><p class="machine-warning">...</p></div>
+             *
+             * with the "machine-warning" paragraph pre-populated with a warning message that the user will
+             * see if nothing at all happens.  But hopefully, in the normal case (and especially the error case),
+             * *something* will have happened.
+             *
+             * Note that it is the HTMLOut module (in processMachines()) that ultimately decides which scripts to
+             * include and then generates the embedXXX() call.
+             */
+            var aeWarning = (eMachine && Component.getElementsByClass(eMachine, "machine-warning"));
+            eWarning = (aeWarning && aeWarning[0]) || eMachine;
+        }
+        if (eWarning) eWarning.innerHTML = Str.escapeHTML(sMessage);
+    };
+
+    try {
+        eMachine = document.getElementById(idMachine);
+        if (eMachine) {
+
+            /*
+             * If we have a 'css' resource, add it to the page first.
+             */
+            var css;
+            if (typeof resources == "object" && (css = resources['css'])) {
+                var head = document.head || document.getElementsByTagName('head')[0];
+                var style = document.createElement('style');
+                style.type = 'text/css';
+                if (style.styleSheet) {
+                    style.styleSheet.cssText = css;
+                } else {
+                    style.appendChild(document.createTextNode(css));
+                }
+                head.appendChild(style);
+            }
+
+            if (!sXSLFile) {
+                /*
+                 * Now that PCjs is an open-source project, we can make the following test more flexible,
+                 * and revert to the internal template if DEBUG *or* internal version (instead of *and*).
+                 *
+                 * Third-party sites that don't use the PCjs server will ALWAYS want to specify a fully-qualified
+                 * path to the XSL file, unless they choose to mirror our folder structure.
+                 */
+                var sAppFolder = sAppClass;
+                if (DEBUG || sVersion == "1.x.x") {
+                    sXSLFile = "/modules/" + sAppFolder + "/templates/components.xsl";
+                } else {
+                    if (sAppClass.substr(0, 3) == "pdp") sAppFolder = "pdpjs";
+                    sXSLFile = "/versions/" + sAppFolder + "/" + sVersion + "/components.xsl";
+                }
+            }
+
+            var processXML = function(sXML, xml) {
+                if (!xml) {
+                    displayError(sXML);
+                    return;
+                }
+
+                /*
+                 * Non-COMPILED kludge to extract the version number from the stylesheet path in the machine XML file;
+                 * we don't need this code in COMPILED (non-DEBUG) releases, because APPVERSION is hard-coded into them.
+                 */
+                if (!COMPILED) {
+                    var aMatch = sXML.match(/<\?xml-stylesheet[^>]* href=(['"])[^'"]*?\/([0-9.]*)\/([^'"]*)\1/);
+                    if (aMatch) XMLVERSION = aMatch[2];
+                }
+
+                var transformXML = function(sXSL, xsl) {
+                    if (!xsl) {
+                        displayError(sXSL);
+                        return;
+                    }
+
+                    /*
+                     * Record the XSL file, in case someone wants to save the entire machine later.
+                     */
+                    Component.addMachineResource(idMachine, sXSLFile, sXSL);
+
+                    /*
+                     * The <machine> template in components.xsl now generates a "machine div" that makes
+                     * the div we required the caller of embedMachine() to provide redundant, so instead
+                     * of appending this fragment to the caller's node, we REPLACE the caller's node.
+                     * This works only because because we ALSO inject the caller's "machine div" ID into
+                     * the fragment's ID during parseXML().
+                     *
+                     *      eMachine.innerHTML = sFragment;
+                     *
+                     * Also, if the transform function fails, make sure you're using the appropriate
+                     * "components.xsl" and not a "machine.xsl", because the latter will not produce valid
+                     * embeddable HTML (and is the most common cause of failure at this final stage).
+                     */
+                    displayMessage("Processing " + sXMLFile + "...");
+
+                    /*
+                     * Beginning with Microsoft Edge and the corresponding release of Windows 10, all the
+                     * 'ActiveXObject' crud has gone away; but of course, this code must remain in place if
+                     * we want to continue supporting older Internet Explorer browsers (ie, back to IE9).
+                     */
+                    if (window.ActiveXObject || 'ActiveXObject' in window) {        // second test is required for IE11 on Windows 8.1
+                        var sFragment = xml['transformNode'](xsl);
+                        if (sFragment) {
+                            eMachine.outerHTML = sFragment;
+                            doneMachine();
+                        } else {
+                            displayError("transformNodeToObject failed");
+                        }
+                    }
+                    else if (document.implementation && document.implementation.createDocument) {
+                        var xsltProcessor = new XSLTProcessor();
+                        xsltProcessor['importStylesheet'](xsl);
+                        var eFragment = xsltProcessor['transformToFragment'](xml, document);
+                        if (eFragment) {
+                            /*
+                             * This fails in Microsoft Edge...
+                             *
+                            var machine = eFragment.getElementById(idMachine);
+                            if (!machine) {
+                                displayError("machine generation failed: " + idMachine);
+                            } else
+                            */
+                            if (eMachine.parentNode) {
+                                eMachine.parentNode.replaceChild(eFragment, eMachine);
+                                doneMachine();
+                            } else {
+                                /*
+                                 * NOTE: This error can occur if our Node web server, when processing a folder with
+                                 * both a manifest.xml with a machine.xml reference AND a README.md containing a
+                                 * machine link, generates duplicate embedXXX() calls for the same machine; if the
+                                 * first embedXXX() call finds its target, subsequent calls for the same target will
+                                 * fail.
+                                 *
+                                 * Technically, such a folder is in a misconfigured state, but it happens, in part
+                                 * because when we switched to the Jekyll web server, we had to add machine links to
+                                 * all README.md files where we had previously relied on manifest.xml or machine.xml
+                                 * processing.  This is because the Jekyll web server currently doesn't process XML
+                                 * files, nor is support for that likely to be added any time soon; it was a nice
+                                 * feature of the Node web server, but it's not clear that it's worth doing for Jekyll.
+                                 */
+                                displayError("invalid machine element: " + idMachine);
+                            }
+                        } else {
+                            displayError("transformToFragment failed");
+                        }
+                    } else {
+                        /*
+                         * Perhaps I should have performed this test at the outset; on the other hand, I'm
+                         * not aware of any browsers don't support one or both of the above XSLT transformation
+                         * methods, so treat this as a bug.
+                         */
+                        displayError("unable to transform XML: unsupported browser");
+                    }
+                };
+                loadXML(sXSLFile, null, sAppName, sAppClass, null, false, displayMessage, transformXML);
+            };
+
+            if (sXMLFile.charAt(0) != '<') {
+                loadXML(sXMLFile, idMachine, sAppName, sAppClass, sParms, true, displayMessage, processXML);
+            } else {
+                parseXML(sXMLFile, null, idMachine, sAppName, sAppClass, sParms, false, displayMessage, processXML);
+            }
+        } else {
+            displayError("missing machine element: " + idMachine);
+        }
+    } catch(e) {
+        displayError(e.message);
+    }
+    return fSuccess;
+}
+
+/**
+ * embedC1P(idMachine, sXMLFile, sXSLFile)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @return {boolean} true if successful, false if error
+ */
+function embedC1P(idMachine, sXMLFile, sXSLFile)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("C1Pjs", "c1pjs", APPVERSION, idMachine, sXMLFile, sXSLFile);
+}
+
+/**
+ * embedPCx86(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPCx86(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PCx86", "pcx86", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * embedPC8080(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPC8080(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PC8080", "pc8080", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * embedPDP10(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPDP10(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PDPjs", "pdp10", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * embedPDP11(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPDP11(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PDPjs", "pdp11", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * findMachineComponent(idMachine, sType)
+ *
+ * @param {string} idMachine
+ * @param {string} sType
+ * @return {Component|null}
+ */
+function findMachineComponent(idMachine, sType)
+{
+    return Component.getComponentByType(sType, idMachine + ".machine");
+}
+
+/**
+ * processMachineScript(idMachine, sScript)
+ *
+ * @param {string} idMachine
+ * @param {string} sScript
+ * @return {boolean}
+ */
+function processMachineScript(idMachine, sScript)
+{
+    return Component.processScript(idMachine, sScript);
+}
+
+/**
+ * Prevent the Closure Compiler from renaming functions we want to export, by adding them as global properties.
+ *
+ * TODO: Consider making all these functions properties on a single global object (eg, 'PCjs'), to minimize global
+ * pollution and risk of name collision.
+ */
+if (APPNAME == "C1Pjs") {
+    window['embedC1P']    = embedC1P;
+}
+if (APPNAME == "PCx86") {
+    window['embedPC']     = embedPCx86;         // WARNING: embedPC() deprecated as of v1.23.0
+    window['embedPCx86']  = embedPCx86;
+}
+if (APPNAME == "PC8080") {
+    window['embedPC8080'] = embedPC8080;
+}
+if (APPNAME == "PDPjs") {
+    window['embedPDP10']  = embedPDP10;
+    window['embedPDP11']  = embedPDP11;
+}
+
+window['findMachineComponent'] = findMachineComponent;
+window['processMachineScript'] = processMachineScript;
+
+window['enableEvents'] = Web.enablePageEvents;
+window['sendEvent']    = Web.sendPageEvent;
diff --git a/versions/pdpjs/1.35.0/pdp10.js b/versions/pdpjs/1.35.0/pdp10.js
index a71045bc9..55080e5cf 100644
--- a/versions/pdpjs/1.35.0/pdp10.js
+++ b/versions/pdpjs/1.35.0/pdp10.js
@@ -192,4 +192,4 @@ function Kd(a,b,c){var d;if(d=/<([a-z]+)\s+ref="(.*?)"(.*?)\/>/g.exec(a)){var e=
 function Ld(a,b,c,d,e){function f(a){if(void 0===m){var b=h&&A(h,"machine-warning");m=b&&b[0]||h}m&&(m.innerHTML=qa(a))}function g(a){f("Error: "+a);u&&(--Hd||Ha(!0));u=!1}var h,m,u=!0;Hd++;Ma[b]={};try{if(h=document.getElementById(b)){var D;if("object"==typeof resources&&(D=resources.css)){var H=document.head||document.getElementsByTagName("head")[0],Ea=document.createElement("style");Ea.type="text/css";Ea.styleSheet?Ea.styleSheet.cssText=D:Ea.appendChild(document.createTextNode(D));H.appendChild(Ea)}d||
 (D=a,"pdp"==a.substr(0,3)&&(D="pdpjs"),d="/versions/"+D+"/1.35.0/components.xsl");D=function(e,m){m?Id(d,null,a,null,!1,f,function(a,e){e?(La(b,d,a),f("Processing "+c+"..."),window.ActiveXObject||"ActiveXObject"in window?(e=m.transformNode(e))?(h.outerHTML=e,--Hd||Ha(!0)):g("transformNodeToObject failed"):document.implementation&&document.implementation.createDocument?(a=new XSLTProcessor,a.importStylesheet(e),(e=a.transformToFragment(m,document))?h.parentNode?(h.parentNode.replaceChild(e,h),--Hd||
 Ha(!0)):g("invalid machine element: "+b):g("transformToFragment failed")):g("unable to transform XML: unsupported browser")):g(a)}):g(e)};"<"!=c.charAt(0)?Id(c,b,a,e,!0,f,D):Jd(c,null,b,a,e,!1,f,D)}else g("missing machine element: "+b)}catch(Md){g(Md.message)}return u}window.embedPDP10=function(a,b,c,d){Ha(!1);return Ld("pdp10",a,b,c,d)};window.embedPDP11=function(a,b,c,d){Ha(!1);return Ld("pdp11",a,b,c,d)};window.findMachineComponent=function(a,b){return x(b,a+".machine")};
-window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==typeof b&&!Sa[a]){for(var c=!0,d=Sa,e=a,f=b.length,g=[],h=[],m="",u=null,D=0;D<f;D++){var H=b[D];if('"'==H||"'"==H)u&&H!=u?m+=H:(u?u=null:u=H,m&&(h.push(m),m=""));else{if(!u){if("\r"==H||"\n"==H)H=";";if(" "==H||"\t"==H||";"==H){m&&(h.push(m),m="");";"==H&&h.length&&(g.push(h),h=[]);continue}}m+=H}}m&&h.push(m);h.length&&g.push(h);d[e]=g;Ra(a)||(c=!1)}return c};window.enableEvents=Ha;window.sendEvent=Ja;})();//# sourceMappingURL=/tmp/pdpjs/1.35.0/pdp10.map
+window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==typeof b&&!Sa[a]){for(var c=!0,d=Sa,e=a,f=b.length,g=[],h=[],m="",u=null,D=0;D<f;D++){var H=b[D];if('"'==H||"'"==H)u&&H!=u?m+=H:(u?u=null:u=H,m&&(h.push(m),m=""));else{if(!u){if("\r"==H||"\n"==H)H=";";if(" "==H||"\t"==H||";"==H){m&&(h.push(m),m="");";"==H&&h.length&&(g.push(h),h=[]);continue}}m+=H}}m&&h.push(m);h.length&&g.push(h);d[e]=g;Ra(a)||(c=!1)}return c};window.enableEvents=Ha;window.sendEvent=Ja;})();//# sourceMappingURL=/versions/pdpjs/1.35.0/pdp10.map
diff --git a/versions/pdpjs/1.35.0/pdp11-dbg.js b/versions/pdpjs/1.35.0/pdp11-dbg.js
index 245ba42c7..7cd370405 100644
--- a/versions/pdpjs/1.35.0/pdp11-dbg.js
+++ b/versions/pdpjs/1.35.0/pdp11-dbg.js
@@ -399,4 +399,4 @@ function Jl(a,b,c){var d;if(d=/<([a-z]+)\s+ref="(.*?)"(.*?)\/>/g.exec(a)){var e=
 function Kl(a,b,c,d,e){function f(a){if(void 0===l){var b=k&&A(k,"machine-warning");l=b&&b[0]||k}l&&(l.innerHTML=wa(a))}function g(a){f("Error: "+a);m&&(--Gl||$a(!0));m=!1}var k,l,m=!0;Gl++;fb[b]={};try{if(k=document.getElementById(b)){var n;if("object"==typeof resources&&(n=resources.css)){var q=document.head||document.getElementsByTagName("head")[0],t=document.createElement("style");t.type="text/css";t.styleSheet?t.styleSheet.cssText=n:t.appendChild(document.createTextNode(n));q.appendChild(t)}d||
 (n=a,"pdp"==a.substr(0,3)&&(n="pdpjs"),d="/versions/"+n+"/1.35.0/components.xsl");n=function(e,l){l?Hl(d,null,a,null,!1,f,function(a,e){e?(eb(b,d,a),f("Processing "+c+"..."),window.ActiveXObject||"ActiveXObject"in window?(e=l.transformNode(e))?(k.outerHTML=e,--Gl||$a(!0)):g("transformNodeToObject failed"):document.implementation&&document.implementation.createDocument?(a=new XSLTProcessor,a.importStylesheet(e),(e=a.transformToFragment(l,document))?k.parentNode?(k.parentNode.replaceChild(e,k),--Gl||
 $a(!0)):g("invalid machine element: "+b):g("transformToFragment failed")):g("unable to transform XML: unsupported browser")):g(a)}):g(e)};"<"!=c.charAt(0)?Hl(c,b,a,e,!0,f,n):Il(c,null,b,a,e,!1,f,n)}else g("missing machine element: "+b)}catch(r){g(r.message)}return m}window.embedPDP10=function(a,b,c,d){$a(!1);return Kl("pdp10",a,b,c,d)};window.embedPDP11=function(a,b,c,d){$a(!1);return Kl("pdp11",a,b,c,d)};window.findMachineComponent=function(a,b){return kb(b,a+".machine")};
-window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==typeof b&&!rb[a]){for(var c=!0,d=rb,e=a,f=b.length,g=[],k=[],l="",m=null,n=0;n<f;n++){var q=b[n];if('"'==q||"'"==q)m&&q!=m?l+=q:(m?m=null:m=q,l&&(k.push(l),l=""));else{if(!m){if("\r"==q||"\n"==q)q=";";if(" "==q||"\t"==q||";"==q){l&&(k.push(l),l="");";"==q&&k.length&&(g.push(k),k=[]);continue}}l+=q}}l&&k.push(l);k.length&&g.push(k);d[e]=g;qb(a)||(c=!1)}return c};window.enableEvents=$a;window.sendEvent=bb;})();//# sourceMappingURL=/tmp/pdpjs/1.35.0/pdp11-dbg.map
+window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==typeof b&&!rb[a]){for(var c=!0,d=rb,e=a,f=b.length,g=[],k=[],l="",m=null,n=0;n<f;n++){var q=b[n];if('"'==q||"'"==q)m&&q!=m?l+=q:(m?m=null:m=q,l&&(k.push(l),l=""));else{if(!m){if("\r"==q||"\n"==q)q=";";if(" "==q||"\t"==q||";"==q){l&&(k.push(l),l="");";"==q&&k.length&&(g.push(k),k=[]);continue}}l+=q}}l&&k.push(l);k.length&&g.push(k);d[e]=g;qb(a)||(c=!1)}return c};window.enableEvents=$a;window.sendEvent=bb;})();//# sourceMappingURL=/versions/pdpjs/1.35.0/pdp11-dbg.map
diff --git a/versions/pdpjs/1.35.0/pdp11-uncompiled.js b/versions/pdpjs/1.35.0/pdp11-uncompiled.js
new file mode 100644
index 000000000..5db408b32
--- /dev/null
+++ b/versions/pdpjs/1.35.0/pdp11-uncompiled.js
@@ -0,0 +1,31876 @@
+"use strict";
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/defines.js (C) Jeff Parsons 2012-2017
+ */
+
+/**
+ * @define {string}
+ */
+var APPVERSION = "1.x.x";       // this @define is overridden by the Closure Compiler with the version in package.json
+
+var XMLVERSION = null;          // this is set in non-COMPILED builds by embedMachine() if a version number was found in the machine XML
+
+var COPYRIGHT = "Copyright © 2012-2017 Jeff Parsons <Jeff@pcjs.org>";
+
+var LICENSE = "License: GPL version 3 or later <http://gnu.org/licenses/gpl.html>";
+
+var CSSCLASS = "pcjs";
+
+/**
+ * @define {string}
+ */
+var SITEHOST = "localhost:8088";// this @define is overridden by the Closure Compiler with "www.pcjs.org"
+
+/**
+ * @define {boolean}
+ */
+var COMPILED = false;           // this @define is overridden by the Closure Compiler (to true)
+
+/**
+ * @define {boolean}
+ */
+var DEBUG = true;               // this @define is overridden by the Closure Compiler (to false) to remove DEBUG-only code
+
+/**
+ * @define {boolean}
+ */
+var MAXDEBUG = false;           // this @define is overridden by the Closure Compiler (to false) to remove MAXDEBUG-only code
+
+/**
+ * @define {boolean}
+ */
+var PRIVATE = false;            // this @define is overridden by the Closure Compiler (to false) to enable PRIVATE code
+
+/*
+ * RS-232 DB-25 Pin Definitions, mapped to bits 1-25 in a 32-bit status value.
+ *
+ * SerialPorts in PCjs machines are considered DTE (Data Terminal Equipment), which means they should be "virtually"
+ * connected to each other via a null-modem cable, which assumes the following cross-wiring:
+ *
+ *     G       1  <->  1        G       (Ground)
+ *     TD      2  <->  3        RD      (Received Data)
+ *     RD      3  <->  2        TD      (Transmitted Data)
+ *     RTS     4  <->  5        CTS     (Clear To Send)
+ *     CTS     5  <->  4        RTS     (Request To Send)
+ *     DSR   6+8  <->  20       DTR     (Data Terminal Ready)
+ *     SG      7  <->  7        SG      (Signal Ground)
+ *     DTR    20  <->  6+8      DSR     (Data Set Ready + Carrier Detect)
+ *     RI     22  <->  22       RI      (Ring Indicator)
+ *
+ * TODO: Move these definitions to a more appropriate shared file at some point.
+ */
+var RS232 = {
+    RTS: {
+        PIN:  4,
+        MASK: 0x00000010
+    },
+    CTS: {
+        PIN:  5,
+        MASK: 0x00000020
+    },
+    DSR: {
+        PIN:  6,
+        MASK: 0x00000040
+    },
+    CD: {
+        PIN:  8,
+        MASK: 0x00000100
+    },
+    DTR: {
+        PIN:  20,
+        MASK: 0x00100000
+    },
+    RI: {
+        PIN:  22,
+        MASK: 0x00400000
+    }
+};
+
+/*
+ * NODE should be true if we're running under NodeJS (eg, command-line), false if not (eg, web browser)
+ */
+var NODE = false;
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/diskapi.js (C) Jeff Parsons 2012-2017
+ */
+
+/*
+ * Our "DiskIO API" looks like:
+ *
+ *      http://www.pcjs.org/api/v1/disk?action=open&volume=*10mb.img&mode=demandrw&chs=c:h:s&machine=xxx&user=yyy
+ */
+var DiskAPI = {
+    ENDPOINT:       "/api/v1/disk",
+    QUERY: {
+        ACTION:     "action",   // value is one of DiskAPI.ACTION.*
+        VOLUME:     "volume",   // value is path of a disk image
+        MODE:       "mode",     // value is one of DiskAPI.MODE.*
+        CHS:        "chs",      // value is cylinders:heads:sectors:bytes
+        ADDR:       "addr",     // value is cylinder:head:sector:count
+        MACHINE:    "machine",  // value is machine token
+        USER:       "user",     // value is user ID
+        DATA:       "data"      // value is data to be written
+    },
+    ACTION: {
+        OPEN:       "open",
+        READ:       "read",
+        WRITE:      "write",
+        CLOSE:      "close"
+    },
+    MODE: {
+        LOCAL:      "local",    // this mode implies no API (at best, localStorage backing only)
+        PRELOAD:    "preload",  // this mode implies use of the DumpAPI
+        DEMANDRW:   "demandrw",
+        DEMANDRO:   "demandro"
+    },
+    FAIL: {
+        BADACTION:  "invalid action",
+        BADUSER:    "invalid user",
+        BADVOL:     "invalid volume",
+        OPENVOL:    "unable to open volume",
+        CREATEVOL:  "unable to create volume",
+        WRITEVOL:   "unable to write volume",
+        REVOKED:    "access revoked"
+    }
+};
+
+/*
+ * TODO: Eventually, our tools will need to support looking up disk formats by "model" rather than by raw disk size,
+ * because obviously multiple disk geometries can yield the same raw disk size.  For each conflict that arises, I'll
+ * probably create a fake (approximate) disk size entry above, and then create a mapping to that approximate size below.
+ */
+DiskAPI.MODELS = {
+    "RL01": 5242880,
+    "RL02": 10485760
+};
+
+DiskAPI.MBR = {
+    PARTITIONS: {
+        OFFSET:     0x1BE,
+        ENTRY: {
+            STATUS:         0x00,   // 0x80 if active
+            CHS_FIRST:      0x01,   // 3-byte CHS specifier
+            TYPE:           0x04,   // see TYPE.*
+            CHS_LAST:       0x05,   // 3-byte CHS specifier
+            LBA_FIRST:      0x08,
+            LBA_TOTAL:      0x0C,
+            LENGTH:         0x10
+        },
+        STATUS: {
+            ACTIVE:         0x80
+        },
+        TYPE: {
+            EMPTY:          0x00,
+            FAT12_PRIMARY:  0x01,   // DOS 2.0 and up (12-bit FAT)
+            FAT16_PRIMARY:  0x04    // DOS 3.0 and up (16-bit FAT)
+        }
+    },
+    SIG_OFFSET:     0x1FE,
+    SIGNATURE:      0xAA55          // to be clear, the low byte (at offset 0x1FE) is 0x55 and the high byte (at offset 0x1FF) is 0xAA
+};
+
+/*
+ * Boot sector offsets (and assorted constants) in DOS-compatible boot sectors (DOS 2.0 and up)
+ *
+ * WARNING: I've heard apocryphal stories about SIGNATURE being improperly reversed on some systems
+ * (ie, 0x55AA instead 0xAA55) -- perhaps by a dyslexic programmer -- so be careful out there.
+ */
+DiskAPI.BOOT = {
+    JMP_OPCODE:     0x000,      // 1 byte for a JMP opcode, followed by a 1 or 2-byte offset
+    OEM_STRING:     0x003,      // 8 bytes
+    SIG_OFFSET:     0x1FE,
+    SIGNATURE:      0xAA55      // to be clear, the low byte (at offset 0x1FE) is 0x55 and the high byte (at offset 0x1FF) is 0xAA
+};
+
+/*
+ * BIOS Parameter Block (BPB) offsets in DOS-compatible boot sectors (DOS 2.x and up)
+ *
+ * NOTE: DOS 2.x OEM documentation says that the words starting at offset 0x018 (TRACK_SECS, TOTAL_HEADS, and HIDDEN_SECS)
+ * are optional, but even the DOS 2.0 FORMAT utility initializes all three of those words.  There may be some OEM media out
+ * there with BPBs that are only valid up to offset 0x018, but I've not run across any media like that.
+ *
+ * DOS 3.20 added LARGE_SECS, but unfortunately, it was added as a 2-byte value at offset 0x01E.  DOS 3.31 decided
+ * to make both HIDDEN_SECS and LARGE_SECS 4-byte values, which meant that LARGE_SECS had to move from 0x01E to 0x020.
+ */
+DiskAPI.BPB = {
+    SECTOR_BYTES:   0x00B,      // 2 bytes: bytes per sector (eg, 0x200 or 512)
+    CLUSTER_SECS:   0x00D,      // 1 byte: sectors per cluster (eg, 1)
+    RESERVED_SECS:  0x00E,      // 2 bytes: reserved sectors; ie, # sectors preceding the first FAT--usually just the boot sector (eg, 1)
+    TOTAL_FATS:     0x010,      // 1 byte: FAT copies (eg, 2)
+    ROOT_DIRENTS:   0x011,      // 2 bytes: root directory entries (eg, 0x40 or 64) 0x40 * 0x20 = 0x800 (1 sector is 0x200 bytes, total of 4 sectors)
+    TOTAL_SECS:     0x013,      // 2 bytes: number of sectors (eg, 0x140 or 320); if zero, refer to LARGE_SECS
+    MEDIA_TYPE:     0x015,      // 1 byte: media type (see DiskAPI.FAT.MEDIA_*)
+    FAT_SECS:       0x016,      // 2 bytes: sectors per FAT (eg, 1)
+    TRACK_SECS:     0x018,      // 2 bytes: sectors per track (eg, 8)
+    TOTAL_HEADS:    0x01A,      // 2 bytes: number of heads (eg, 1)
+    HIDDEN_SECS:    0x01C,      // 2 bytes (DOS 2.x) or 4 bytes (DOS 3.31 and up): number of hidden sectors (always 0 for non-partitioned media)
+    LARGE_SECS:     0x020       // 4 bytes (DOS 3.31 and up): number of sectors if TOTAL_SECS is zero
+};
+
+/*
+ * Common (supported) diskette geometries.
+ *
+ * Each entry in GEOMETRIES is an array of values in "CHS" order:
+ *
+ *      [# cylinders, # heads, # sectors/track, # bytes/sector, media type]
+ *
+ * If the 4th value is omitted, the sector size is assumed to be 512.  The order of these "geometric" values mirrors
+ * the structure of our JSON-encoded disk images, which consist of an array of cylinders, each of which is an array of
+ * heads, each of which is an array of sector objects.
+ */
+DiskAPI.GEOMETRIES = {
+    163840:  [40,1,8,,0xFE],    // media type 0xFE: 40 cylinders, 1 head (single-sided),   8 sectors/track, ( 320 total sectors x 512 bytes/sector ==  163840)
+    184320:  [40,1,9,,0xFC],    // media type 0xFC: 40 cylinders, 1 head (single-sided),   9 sectors/track, ( 360 total sectors x 512 bytes/sector ==  184320)
+    327680:  [40,2,8,,0xFF],    // media type 0xFF: 40 cylinders, 2 heads (double-sided),  8 sectors/track, ( 640 total sectors x 512 bytes/sector ==  327680)
+    368640:  [40,2,9,,0xFD],    // media type 0xFD: 40 cylinders, 2 heads (double-sided),  9 sectors/track, ( 720 total sectors x 512 bytes/sector ==  368640)
+    737280:  [80,2,9,,0xF9],    // media type 0xF9: 80 cylinders, 2 heads (double-sided),  9 sectors/track, (1440 total sectors x 512 bytes/sector ==  737280)
+    1228800: [80,2,15,,0xF9],   // media type 0xF9: 80 cylinders, 2 heads (double-sided), 15 sectors/track, (2400 total sectors x 512 bytes/sector == 1228800)
+    1474560: [80,2,18,,0xF0],   // media type 0xF0: 80 cylinders, 2 heads (double-sided), 18 sectors/track, (2880 total sectors x 512 bytes/sector == 1474560)
+    2949120: [80,2,36,,0xF0],   // media type 0xF0: 80 cylinders, 2 heads (double-sided), 36 sectors/track, (5760 total sectors x 512 bytes/sector == 2949120)
+    /*
+     * The following are some common disk sizes and their CHS values, since missing or bogus MBR and/or BPB values
+     * might mislead us when attempting to determine the exact disk geometry.
+     */
+    10653696:[306,4,17],        // PC XT 10Mb hard drive (type 3)
+    21411840:[615,4,17],        // PC AT 20Mb hard drive (type 2)
+    /*
+     * Assorted DEC disk formats.
+     */
+    256256:  [77, 1,26,128],    // RX01 single-platter diskette: 77 tracks, 1 head, 26 sectors/track, 128 bytes/sector, for a total of 256256 bytes
+    2494464: [203,2,12,512],    // RK03 single-platter disk cartridge: 203 tracks, 2 heads, 12 sectors/track, 512 bytes/sector, for a total of 2494464 bytes
+    5242880: [256,2,40,256],    // RL01K single-platter disk cartridge: 256 tracks, 2 heads, 40 sectors/track, 256 bytes/sector, for a total of 5242880 bytes
+    10485760:[512,2,40,256]     // RL02K single-platter disk cartridge: 512 tracks, 2 heads, 40 sectors/track, 256 bytes/sector, for a total of 10485760 bytes
+};
+
+/*
+ * Media descriptor bytes for DOS-compatible FAT-formatted disks (stored in the first byte of the FAT)
+ */
+DiskAPI.FAT = {
+    MEDIA_160KB:    0xFE,       // 5.25-inch, 1-sided,  8-sector, 40-track
+    MEDIA_180KB:    0xFC,       // 5.25-inch, 1-sided,  9-sector, 40-track
+    MEDIA_320KB:    0xFF,       // 5.25-inch, 2-sided,  8-sector, 40-track
+    MEDIA_360KB:    0xFD,       // 5.25-inch, 2-sided,  9-sector, 40-track
+    MEDIA_720KB:    0xF9,       //  3.5-inch, 2-sided,  9-sector, 80-track
+    MEDIA_1200KB:   0xF9,       //  3.5-inch, 2-sided, 15-sector, 80-track
+    MEDIA_FIXED:    0xF8,       // fixed disk (aka hard drive)
+    MEDIA_1440KB:   0xF0,       //  3.5-inch, 2-sided, 18-sector, 80-track
+    MEDIA_2880KB:   0xF0        //  3.5-inch, 2-sided, 36-sector, 80-track
+};
+
+/*
+ * Cluster constants for 12-bit FATs (CLUSNUM_FREE, CLUSNUM_RES and CLUSNUM_MIN are the same for all FATs)
+ */
+DiskAPI.FAT12 = {
+    MAX_CLUSTERS:   4084,
+    CLUSNUM_FREE:   0,          // this should NEVER appear in cluster chain (except at the start of an empty chain)
+    CLUSNUM_RES:    1,          // reserved; this should NEVER appear in cluster chain
+    CLUSNUM_MIN:    2,          // smallest valid cluster number
+    CLUSNUM_MAX:    0xFF6,      // largest valid cluster number
+    CLUSNUM_BAD:    0xFF7,      // bad cluster; this should NEVER appear in cluster chain
+    CLUSNUM_EOC:    0xFF8       // end of chain (actually, anything from 0xFF8-0xFFF indicates EOC)
+};
+
+/*
+ * Cluster constants for 16-bit FATs (CLUSNUM_FREE, CLUSNUM_RES and CLUSNUM_MIN are the same for all FATs)
+ */
+DiskAPI.FAT16 = {
+    MAX_CLUSTERS:   65524,
+    CLUSNUM_FREE:   0,          // this should NEVER appear in cluster chain (except at the start of an empty chain)
+    CLUSNUM_RES:    1,          // reserved; this should NEVER appear in cluster chain
+    CLUSNUM_MIN:    2,          // smallest valid cluster number
+    CLUSNUM_MAX:    0xFFF6,     // largest valid cluster number
+    CLUSNUM_BAD:    0xFFF7,     // bad cluster; this should NEVER appear in cluster chain
+    CLUSNUM_EOC:    0xFFF8      // end of chain (actually, anything from 0xFFF8-0xFFFF indicates EOC)
+};
+
+/*
+ * Directory Entry offsets (and assorted constants) in FAT disk images
+ *
+ * NOTE: Versions of DOS prior to 2.0 use INVALID exclusively to mark available directory entries; any entry marked
+ * UNUSED will actually be considered USED.  In DOS 2.0 and up, UNUSED was added to indicate that all remaining entries
+ * are unused, relieving it from having to initialize the rest of the sectors in the directory cluster(s).  And in fact,
+ * you WILL encounter garbage in subsequent directory sectors if you attempt to read past an UNUSED entry.
+ */
+DiskAPI.DIRENT = {
+    NAME:           0x000,      // 8 bytes
+    EXT:            0x008,      // 3 bytes
+    ATTR:           0x00B,      // 1 byte
+    MODTIME:        0x016,      // 2 bytes
+    MODDATE:        0x018,      // 2 bytes
+    CLUSTER:        0x01A,      // 2 bytes
+    SIZE:           0x01C,      // 4 bytes (typically zero for subdirectories)
+    LENGTH:         0x20,       // 32 bytes total
+    UNUSED:         0x00,       // indicates this and all subsequent directory entries are unused
+    INVALID:        0xE5        // indicates this directory entry is unused
+};
+
+/*
+ * Possible values for DIRENT.ATTR
+ */
+DiskAPI.ATTR = {
+    READONLY:       0x01,       // PC-DOS 2.0 and up
+    HIDDEN:         0x02,
+    SYSTEM:         0x04,
+    LABEL:          0x08,       // PC-DOS 2.0 and up
+    SUBDIR:         0x10,       // PC-DOS 2.0 and up
+    ARCHIVE:        0x20        // PC-DOS 2.0 and up
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/dumpapi.js (C) Jeff Parsons 2012-2017
+ */
+
+/*
+ * Our "DiskDump API", such as it was, used to look like:
+ *
+ *      http://jsmachines.net/bin/convdisk.php?disk=/disks/pc/dos/ibm/2.00/PCDOS200-DISK1.json&format=img
+ *
+ * To make it (a bit) more "REST-like", the above request now looks like:
+ *
+ *      http://www.pcjs.org/api/v1/dump?disk=/disks/pc/dos/ibm/2.00/PCDOS200-DISK1.json&format=img
+ *
+ * Similarly, our "FileDump API" used to look like:
+ *
+ *      http://jsmachines.net/bin/convrom.php?rom=/devices/pc/rom/5150/1981-04-24/PCBIOS-REV1.rom&format=json
+ *
+ * and that request now looks like:
+ *
+ *      http://www.pcjs.org/api/v1/dump?file=/devices/pc/rom/5150/1981-04-24/PCBIOS-REV1.rom&format=json
+ *
+ * I don't think it makes sense to avoid "query" parameters, because blending the path of a disk image with the
+ * the rest of the URL would be (a) confusing, and (b) more work to parse.
+ */
+var DumpAPI = {
+    ENDPOINT:       "/api/v1/dump",
+    QUERY: {
+        DIR:        "dir",      // value is path of a directory (DiskDump only)
+        DISK:       "disk",     // value is path of a disk image (DiskDump only)
+        FILE:       "file",     // value is path of a ROM image file (FileDump only)
+        IMG:        "img",      // alias for DISK
+        PATH:       "path",     // value is path of a one or more files (DiskDump only)
+        FORMAT:     "format",   // value is one of FORMAT values below
+        COMMENTS:   "comments", // value is either "true" or "false"
+        DECIMAL:    "decimal",  // value is either "true" to force all numbers to decimal, "false" or undefined otherwise
+        MBHD:       "mbhd",     // value is hard drive size in Mb (formerly "mbsize") (DiskDump only) (DEPRECATED)
+        SIZE:       "size"      // value is target disk size in Kb (supersedes "mbhd") (DiskDump only)
+    },
+    FORMAT: {
+        JSON:       "json",     // default
+        JSON_GZ:    "gz",       // gzip is currently used ONLY for compressed JSON
+        DATA:       "data",     // same as "json", but built without JSON.stringify() (DiskDump only)
+        HEX:        "hex",      // deprecated
+        OCTAL:      "octal",    // displays data as octal words
+        BYTES:      "bytes",    // displays data as hex bytes; normally used only when comments are enabled
+        WORDS:      "words",    // displays data as hex words; normally used only when comments are enabled
+        LONGS:      "longs",    // displays data as dwords
+        IMG:        "img",      // returns the raw disk data (ie, using a Buffer object) (DiskDump only)
+        ROM:        "rom"       // returns the raw file data (ie, using a Buffer object) (FileDump only)
+    }
+};
+
+/*
+ * Because we use an overloaded API endpoint (ie, one that's shared with the FileDump module), we must
+ * also provide a list of commands which, when combined with the endpoint, define a unique request.
+ */
+DumpAPI.asDiskCommands = [DumpAPI.QUERY.DIR, DumpAPI.QUERY.DISK, DumpAPI.QUERY.PATH];
+DumpAPI.asFileCommands = [DumpAPI.QUERY.FILE];
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/reportapi.js (C) Jeff Parsons 2012-2017
+ */
+
+var ReportAPI = {
+    ENDPOINT:       "/api/v1/report",
+    QUERY: {
+        APP:        "app",
+        VER:        "ver",
+        URL:        "url",
+        USER:       "user",
+        TYPE:       "type",
+        DATA:       "data"
+    },
+    TYPE: {
+        BUG:        "bug"
+    },
+    RES: {
+        OK:         "Thank you"
+    }
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/userapi.js (C) Jeff Parsons 2012-2017
+ */
+
+/*
+ * Examples of User API requests:
+ *
+ *      web.getHost() + UserAPI.ENDPOINT + '?' + UserAPI.QUERY.REQ + '=' + UserAPI.REQ.VERIFY + '&' + UserAPI.QUERY.USER + '=' + sUser;
+ */
+var UserAPI = {
+    ENDPOINT:       "/api/v1/user",
+    QUERY: {
+        REQ:        "req",      // specifies a request
+        USER:       "user",     // specifies a user ID
+        STATE:      "state",    // specifies a state ID
+        DATA:       "data"      // specifies state data
+    },
+    REQ: {
+        CREATE:     "create",   // creates a user ID
+        VERIFY:     "verify",   // requests verification of a user ID
+        STORE:      "store",    // stores a machine state on the server
+        LOAD:       "load"      // loads a machine state from the server
+    },
+    RES: {
+        CODE:       "code",
+        DATA:       "data"
+    },
+    CODE: {
+        OK:         "ok",
+        FAIL:       "error"
+    },
+    FAIL: {
+        DUPLICATE:  "user already exists",
+        VERIFY:     "unable to verify user",
+        BADSTATE:   "invalid state parameter",
+        NOSTATE:    "no machine state",
+        BADLOAD:    "unable to load machine state",
+        BADSTORE:   "unable to save machine state"
+    }
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/keys.js (C) Jeff Parsons 2012-2017
+ */
+
+var Keys = {
+    /*
+     * Keys and/or key combinations that generate common ASCII codes.
+     *
+     * NOTE: If you're looking for a general-purpose ASCII code table, see Str.ASCII in strlib.js;
+     * if something's missing, that's probably the more appropriate table to add it to.
+     *
+     * TODO: The Closure Compiler doesn't inline all references to these values, at least those with
+     * quoted property names, which is why I've 'unquoted' as many of them as possible.  One solution
+     * would be to add mnemonics for all of them, not just the non-printable ones (eg, SPACE instead
+     * of ' ', AMP instead of '&', etc.)
+     */
+    ASCII: {
+          BREAK:  0, CTRL_A:  1, CTRL_B:  2, CTRL_C:  3, CTRL_D:  4, CTRL_E:  5, CTRL_F:  6, CTRL_G:  7,
+         CTRL_H:  8, CTRL_I:  9, CTRL_J: 10, CTRL_K: 11, CTRL_L: 12, CTRL_M: 13, CTRL_N: 14, CTRL_O: 15,
+         CTRL_P: 16, CTRL_Q: 17, CTRL_R: 18, CTRL_S: 19, CTRL_T: 20, CTRL_U: 21, CTRL_V: 22, CTRL_W: 23,
+         CTRL_X: 24, CTRL_Y: 25, CTRL_Z: 26,
+            ' ': 32,    '!': 33,    '"': 34,    '#': 35,    '$': 36,    '%': 37,    '&': 38,    "'": 39,
+            '(': 40,    ')': 41,    '*': 42,    '+': 43,    ',': 44,    '-': 45,    '.': 46,    '/': 47,
+            '0': 48,    '1': 49,    '2': 50,    '3': 51,    '4': 52,    '5': 53,    '6': 54,    '7': 55,
+            '8': 56,    '9': 57,    ':': 58,    ';': 59,    '<': 60,    '=': 61,    '>': 62,    '?': 63,
+            '@': 64,     A:  65,     B:  66,     C:  67,     D:  68,     E:  69,     F:  70,     G:  71,
+             H:  72,     I:  73,     J:  74,     K:  75,     L:  76,     M:  77,     N:  78,     O:  79,
+             P:  80,     Q:  81,     R:  82,     S:  83,     T:  84,     U:  85,     V:  86,     W:  87,
+             X:  88,     Y:  89,     Z:  90,    '[': 91,    '\\':92,    ']': 93,    '^': 94,    '_': 95,
+            '`': 96,     a:  97,     b:  98,     c:  99,     d: 100,     e: 101,     f: 102,     g: 103,
+             h:  104,    i: 105,     j: 106,     k: 107,     l: 108,     m: 109,     n: 110,     o: 111,
+             p:  112,    q: 113,     r: 114,     s: 115,     t: 116,     u: 117,     v: 118,     w: 119,
+             x:  120,    y: 121,     z: 122,    '{':123,    '|':124,    '}':125,    '~':126,   DEL: 127
+    },
+    /*
+     * Browser keyCodes we must pay particular attention to.  For the most part, these are non-alphanumeric
+     * or function keys, some which may require special treatment (eg, preventDefault() if returning false on
+     * the initial keyDown event is insufficient).
+     *
+     * keyCodes for most common ASCII keys can simply use the appropriate ASCII code above.
+     *
+     * Most of these represent non-ASCII keys (eg, the LEFT arrow key), yet for some reason, browsers defined
+     * them using ASCII codes (eg, the LEFT arrow key uses the ASCII code for '%' or 37).
+     */
+    KEYCODE: {
+        /* 0x08 */ BS:          8,          // BACKSPACE        (ASCII.CTRL_H)
+        /* 0x09 */ TAB:         9,          // TAB              (ASCII.CTRL_I)
+        /* 0x0A */ LF:          10,         // LINE FEED        (ASCII.CTRL_J) (TODO: Determine if any key actually generates this)
+        /* 0x0D */ CR:          13,         // CARRIAGE RETURN  (ASCII.CTRL_M)
+        /* 0x10 */ SHIFT:       16,
+        /* 0x11 */ CTRL:        17,
+        /* 0x12 */ ALT:         18,
+        /* 0x13 */ PAUSE:       19,         // PAUSE/BREAK
+        /* 0x14 */ CAPS_LOCK:   20,
+        /* 0x1B */ ESC:         27,
+        /* 0x20 */ SPACE:       32,
+        /* 0x21 */ PGUP:        33,
+        /* 0x22 */ PGDN:        34,
+        /* 0x23 */ END:         35,
+        /* 0x24 */ HOME:        36,
+        /* 0x25 */ LEFT:        37,
+        /* 0x26 */ UP:          38,
+        /* 0x27 */ RIGHT:       39,
+        /* 0x27 */ FF_QUOTE:    39,
+        /* 0x28 */ DOWN:        40,
+        /* 0x2C */ FF_COMMA:    44,
+        /* 0x2C */ PRTSC:       44,
+        /* 0x2D */ INS:         45,
+        /* 0x2E */ DEL:         46,
+        /* 0x2E */ FF_PERIOD:   46,
+        /* 0x2F */ FF_SLASH:    47,
+        /* 0x30 */ ZERO:        48,
+        /* 0x31 */ ONE:         49,
+        /* 0x32 */ TWO:         50,
+        /* 0x33 */ THREE:       51,
+        /* 0x34 */ FOUR:        52,
+        /* 0x35 */ FIVE:        53,
+        /* 0x36 */ SIX:         54,
+        /* 0x37 */ SEVEN:       55,
+        /* 0x38 */ EIGHT:       56,
+        /* 0x39 */ NINE:        57,
+        /* 0x3B */ FF_SEMI:     59,
+        /* 0x3D */ FF_EQUALS:   61,
+        /* 0x5B */ CMD:         91,         // aka WIN
+        /* 0x5B */ FF_LBRACK:   91,
+        /* 0x5C */ FF_BSLASH:   92,
+        /* 0x5D */ RCMD:        93,         // aka MENU
+        /* 0x5D */ FF_RBRACK:   93,
+        /* 0x60 */ NUM_0:       96,
+        /* 0x60 */ NUM_INS:     96,
+        /* 0x60 */ FF_BQUOTE:   96,
+        /* 0x61 */ NUM_1:       97,
+        /* 0x61 */ NUM_END:     97,
+        /* 0x62 */ NUM_2:       98,
+        /* 0x62 */ NUM_DOWN:    98,
+        /* 0x63 */ NUM_3:       99,
+        /* 0x63 */ NUM_PGDN:    99,
+        /* 0x64 */ NUM_4:       100,
+        /* 0x64 */ NUM_LEFT:    100,
+        /* 0x65 */ NUM_5:       101,
+        /* 0x65 */ NUM_CENTER:  101,
+        /* 0x66 */ NUM_6:       102,
+        /* 0x66 */ NUM_RIGHT:   102,
+        /* 0x67 */ NUM_7:       103,
+        /* 0x67 */ NUM_HOME:    103,
+        /* 0x68 */ NUM_8:       104,
+        /* 0x68 */ NUM_UP:      104,
+        /* 0x69 */ NUM_9:       105,
+        /* 0x69 */ NUM_PGUP:    105,
+        /* 0x6A */ NUM_MUL:     106,
+        /* 0x6B */ NUM_ADD:     107,
+        /* 0x6D */ NUM_SUB:     109,
+        /* 0x6E */ NUM_DEL:     110,        // aka PERIOD
+        /* 0x6F */ NUM_DIV:     111,
+        /* 0x70 */ F1:          112,
+        /* 0x71 */ F2:          113,
+        /* 0x72 */ F3:          114,
+        /* 0x73 */ F4:          115,
+        /* 0x74 */ F5:          116,
+        /* 0x75 */ F6:          117,
+        /* 0x76 */ F7:          118,
+        /* 0x77 */ F8:          119,
+        /* 0x78 */ F9:          120,
+        /* 0x79 */ F10:         121,
+        /* 0x7A */ F11:         122,
+        /* 0x7B */ F12:         123,
+        /* 0x90 */ NUM_LOCK:    144,
+        /* 0x91 */ SCROLL_LOCK: 145,
+        /* 0xAD */ FF_DASH:     173,
+        /* 0xBA */ SEMI:        186,        // Firefox:  59 (FF_SEMI)
+        /* 0xBB */ EQUALS:      187,        // Firefox:  61 (FF_EQUALS)
+        /* 0xBC */ COMMA:       188,
+        /* 0xBD */ DASH:        189,        // Firefox: 173 (FF_DASH)
+        /* 0xBE */ PERIOD:      190,
+        /* 0xBF */ SLASH:       191,
+        /* 0xC0 */ BQUOTE:      192,
+        /* 0xDB */ LBRACK:      219,
+        /* 0xDC */ BSLASH:      220,
+        /* 0xDD */ RBRACK:      221,
+        /* 0xDE */ QUOTE:       222,
+        /* 0xE0 */ FF_CMD:      224,        // Firefox only (used for both CMD and RCMD)
+        //
+        // The following biases use what I'll call Decimal Coded Binary or DCB (the opposite of BCD),
+        // where the thousands digit is used to store the sum of "binary" digits 1 and/or 2 and/or 4.
+        //
+        // Technically, that makes it DCO (Decimal Coded Octal), but then again, BCD should have really
+        // been called HCD (Hexadecimal Coded Decimal), so if "they" can take liberties, so can I.
+        //
+        // ONDOWN is a bias we add to browser keyCodes that we want to handle on "down" rather than on "press".
+        //
+        ONDOWN:                 1000,
+        //
+        // ONRIGHT is a bias we add to browser keyCodes that need to check for a "right" location (default is "left")
+        //
+        ONRIGHT:                2000,
+        //
+        // FAKE is a bias we add to signal these are fake keyCodes corresponding to internal keystroke combinations.
+        // The actual values are for internal use only and merely need to be unique and used consistently.
+        //
+        FAKE:                   4000
+    },
+    /*
+     * The set of values that a browser may store in the 'location' property of a keyboard event object
+     * which we also support.
+     */
+    LOCATION: {
+        LEFT:                   1,
+        RIGHT:                  2,
+        NUMPAD:                 3
+    }
+};
+
+/*
+ * Check the event object's 'location' property for a non-zero value for the following ONRIGHT keys.
+ */
+Keys.KEYCODE.NUM_CR = Keys.KEYCODE.CR + Keys.KEYCODE.ONRIGHT;
+
+
+/*
+ * Maps Firefox keyCodes to their more common keyCode counterparts; a number of entries in this table
+ * are no longer valid (if indeed they ever were), so they've been commented out.  It's likely that I
+ * simply extended this table to resolve additional differences in other browsers (ie, Opera), but without
+ * browser-specific checks, it's not safe to perform all the mappings shown below.
+ */
+Keys.FF_KEYCODES = {};
+Keys.FF_KEYCODES[Keys.KEYCODE.FF_SEMI]   = Keys.KEYCODE.SEMI;           //  59 -> 186
+Keys.FF_KEYCODES[Keys.KEYCODE.FF_EQUALS] = Keys.KEYCODE.EQUALS;         //  61 -> 187
+Keys.FF_KEYCODES[Keys.KEYCODE.FF_DASH]   = Keys.KEYCODE.DASH;           // 173 -> 189
+Keys.FF_KEYCODES[Keys.KEYCODE.FF_CMD]    = Keys.KEYCODE.CMD;            // 224 -> 91
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_COMMA]  = Keys.KEYCODE.COMMA;       //  44 -> 188
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_PERIOD] = Keys.KEYCODE.PERIOD;      //  46 -> 190
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_SLASH]  = Keys.KEYCODE.SLASH;       //  47 -> 191
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_BQUOTE] = Keys.KEYCODE.BQUOTE;      //  96 -> 192
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_LBRACK  = Keys.KEYCODE.LBRACK;      //  91 -> 219
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_BSLASH] = Keys.KEYCODE.BSLASH;      //  92 -> 220
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_RBRACK] = Keys.KEYCODE.RBRACK;      //  93 -> 221
+// Keys.FF_KEYCODES[Keys.KEYCODE.FF_QUOTE]  = Keys.KEYCODE.QUOTE;       //  39 -> 222
+
+/*
+ * Maps non-ASCII keyCodes to their ASCII counterparts
+ */
+Keys.NONASCII_KEYCODES = {};
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.FF_DASH] = Keys.ASCII['-'];         // 173 -> 45
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.SEMI]    = Keys.ASCII[';'];         // 186 -> 59
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.EQUALS]  = Keys.ASCII['='];         // 187 -> 61
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.DASH]    = Keys.ASCII['-'];         // 189 -> 45
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.COMMA]   = Keys.ASCII[','];         // 188 -> 44
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.PERIOD]  = Keys.ASCII['.'];         // 190 -> 46
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.SLASH]   = Keys.ASCII['/'];         // 191 -> 47
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.BQUOTE]  = Keys.ASCII['`'];         // 192 -> 96
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.LBRACK]  = Keys.ASCII['['];         // 219 -> 91
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.BSLASH]  = Keys.ASCII['\\'];        // 220 -> 92
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.RBRACK]  = Keys.ASCII[']'];         // 221 -> 93
+Keys.NONASCII_KEYCODES[Keys.KEYCODE.QUOTE]   = Keys.ASCII["'"];         // 222 -> 39
+
+/*
+ * Maps unshifted keyCodes to their shifted counterparts; to be used when a shift-key is down.
+ * Alphabetic characters are handled in code, since they must also take CAPS_LOCK into consideration.
+ */
+Keys.SHIFTED_KEYCODES = {};
+Keys.SHIFTED_KEYCODES[Keys.ASCII['1']]     = Keys.ASCII['!'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['2']]     = Keys.ASCII['@'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['3']]     = Keys.ASCII['#'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['4']]     = Keys.ASCII['$'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['5']]     = Keys.ASCII['%'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['6']]     = Keys.ASCII['^'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['7']]     = Keys.ASCII['&'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['8']]     = Keys.ASCII['*'];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['9']]     = Keys.ASCII['('];
+Keys.SHIFTED_KEYCODES[Keys.ASCII['0']]     = Keys.ASCII[')'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.SEMI]   = Keys.ASCII[':'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.EQUALS] = Keys.ASCII['+'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.COMMA]  = Keys.ASCII['<'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.DASH]   = Keys.ASCII['_'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.PERIOD] = Keys.ASCII['>'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.SLASH]  = Keys.ASCII['?'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.BQUOTE] = Keys.ASCII['~'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.LBRACK] = Keys.ASCII['{'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.BSLASH] = Keys.ASCII['|'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.RBRACK] = Keys.ASCII['}'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.QUOTE]  = Keys.ASCII['"'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.FF_DASH]   = Keys.ASCII['_'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.FF_EQUALS] = Keys.ASCII['+'];
+Keys.SHIFTED_KEYCODES[Keys.KEYCODE.FF_SEMI]   = Keys.ASCII[':'];
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/strlib.js (C) Jeff Parsons 2012-2017
+ */
+
+class Str {
+    /**
+     * isValidInt(s, base)
+     *
+     * The built-in parseInt() function has the annoying feature of returning a partial value (ie,
+     * up to the point where it encounters an invalid character); eg, parseInt("foo", 16) returns 0xf.
+     *
+     * So it's best to use our own Str.parseInt() function, which will in turn use this function to
+     * validate the entire string.
+     *
+     * @param {string} s is the string representation of some number
+     * @param {number} [base] is the radix to use (default is 10); only 2, 8, 10 and 16 are supported
+     * @return {boolean} true if valid, false if invalid (or the specified base isn't supported)
+     */
+    static isValidInt(s, base)
+    {
+        if (!base || base == 10) return s.match(/^-?[0-9]+$/) !== null;
+        if (base == 16) return s.match(/^-?[0-9a-f]+$/i) !== null;
+        if (base == 8) return s.match(/^-?[0-7]+$/) !== null;
+        if (base == 2) return s.match(/^-?[01]+$/) !== null;
+        return false;
+    }
+
+    /**
+     * parseInt(s, base)
+     *
+     * This is a wrapper around the built-in parseInt() function.  Our wrapper recognizes certain prefixes
+     * ('$' or "0x" for hex, '#' or "0o" for octal) and suffixes ('.' for decimal, 'h' for hex, 'y' for
+     * binary), and then calls isValidInt() to ensure we don't convert strings that contain partial values;
+     * see isValidInt() for details.
+     *
+     * The use of multiple prefix/suffix combinations is undefined (although for the record, we process
+     * prefixes first).  We do NOT support the "0b" prefix to indicate binary UNLESS one or more commas are
+     * also present (because "0b" is also a valid hex sequence), and we do NOT support a single leading zero
+     * to indicate octal (because such a number could also be decimal or hex).  Any number of commas are
+     * allowed; we remove them all before calling the built-in parseInt().
+     *
+     * More recently, we've added support for "^D", "^O", and "^B" prefixes to accommodate the base overrides
+     * that the PDP-10's MACRO-10 assembly language supports (decimal, octal, and binary, respectively).
+     * If this support turns out to adversely affect other debuggers, then it will have to be "conditionalized".
+     * Similarly, we've added support for "K", "M", and "G" MACRO-10-style suffixes that add 3, 6, or 9 zeros
+     * to the value to be parsed, respectively.
+     *
+     * @param {string} s is the string representation of some number
+     * @param {number} [base] is the radix to use (default is 10); can be overridden by prefixes/suffixes
+     * @return {number|undefined} corresponding value, or undefined if invalid
+     */
+    static parseInt(s, base)
+    {
+        var value;
+
+        if (s) {
+            if (!base) base = 10;
+
+            var ch, chPrefix, chSuffix;
+            var fCommas = (s.indexOf(',') > 0);
+            if (fCommas) s = s.replace(/,/g, '');
+
+            ch = chPrefix = s.charAt(0);
+            if (chPrefix == '#') {
+                base = 8;
+                chPrefix = '';
+            }
+            else if (chPrefix == '$') {
+                base = 16;
+                chPrefix = '';
+            }
+            if (ch != chPrefix) {
+                s = s.substr(1);
+            }
+            else {
+                ch = chPrefix = s.substr(0, 2);
+                if (chPrefix == '0b' && fCommas || chPrefix == '^B') {
+                    base = 2;
+                    chPrefix = '';
+                }
+                else if (chPrefix == '0o' || chPrefix == '^O') {
+                    base = 8;
+                    chPrefix = '';
+                }
+                else if (chPrefix == '^D') {
+                    base = 10;
+                    chPrefix = '';
+                }
+                else if (chPrefix == '0x') {
+                    base = 16;
+                    chPrefix = '';
+                }
+                if (ch != chPrefix) s = s.substr(2);
+            }
+            ch = chSuffix = s.slice(-1);
+            if (chSuffix == 'Y' || chSuffix == 'y') {
+                base = 2;
+                chSuffix = '';
+            }
+            else if (chSuffix == '.') {
+                base = 10;
+                chSuffix = '';
+            }
+            else if (chSuffix == 'H' || chSuffix == 'h') {
+                base = 16;
+                chSuffix = '';
+            }
+            else if (chSuffix == 'K') {
+                chSuffix = '000';
+            }
+            else if (chSuffix == 'M') {
+                chSuffix = '000000';
+            }
+            else if (chSuffix == 'G') {
+                chSuffix = '000000000';
+            }
+            if (ch != chSuffix) s = s.slice(0, -1) + chSuffix;
+            /*
+             * This adds support for the MACRO-10 binary shifting (Bn) suffix, which must be stripped from the
+             * number before parsing, and then applied to the value after parsing.  If n is omitted, 35 is assumed,
+             * which is a net shift of zero.  If n < 35, then a left shift of (35 - n) is required; if n > 35, then
+             * a right shift of -(35 - n) is required.
+             */
+            var v, shift = 0;
+            if (base <= 10) {
+                var match = s.match(/(-?[0-9]+)B([0-9]*)/);
+                if (match) {
+                    s = match[1];
+                    shift = 35 - ((match[2] || 35) & 0xff);
+                }
+            }
+            if (Str.isValidInt(s, base) && !isNaN(v = parseInt(s, base))) {
+                /*
+                 * With the need to support larger (eg, 36-bit) integers, truncating to 32 bits is no longer helpful.
+                 *
+                 *      value = v|0;
+                 */
+                if (shift) {
+                    /*
+                     * Since binary shifting is a logical operation, and since shifting by division only works properly
+                     * with positive numbers, we must convert a negative value to a positive value, by computing the two's
+                     * complement.
+                     */
+                    if (v < 0) v += Math.pow(2, 36);
+                    if (shift > 0) {
+                        v *= Math.pow(2, shift);
+                    } else {
+                        v = Math.trunc(v / Math.pow(2, -shift));
+                    }
+                }
+                value = v;
+            }
+        }
+        return value;
+    }
+
+    /**
+     * toBase(n, radix, cch, sPrefix, nGrouping)
+     *
+     * Displays the given number as an unsigned integer using the specified radix and number of digits.
+     *
+     * @param {number|null|undefined} n
+     * @param {number} radix (ie, the base)
+     * @param {number} cch (the desired number of digits)
+     * @param {string} [sPrefix] (default is none)
+     * @param {number} [nGrouping]
+     * @return {string}
+     */
+    static toBase(n, radix, cch, sPrefix = "", nGrouping = 0)
+    {
+        /*
+         * An initial "falsey" check for null takes care of both null and undefined;
+         * we can't rely entirely on isNaN(), because isNaN(null) returns false, oddly enough.
+         *
+         * Alternatively, we could mask and shift n regardless of whether it's null/undefined/NaN,
+         * since JavaScript coerces such operands to zero, but I think there's "value" in seeing those
+         * values displayed differently.
+         */
+        var s = "";
+        if (isNaN(n)) {
+            n = null;
+        } else if (n != null) {
+            /*
+             * Callers that produced an input by dividing by a power of two rather than shifting (in order
+             * to access more than 32 bits) may produce a fractional result, which ordinarily we would simply
+             * ignore, but if the integer portion is zero and the sign is negative, we should probably treat
+             * this value as a sign-extension.
+             */
+            if (n < 0 && n > -1) n = -1;
+            /*
+             * Negative values should be two's complemented according to the number of digits; for example,
+             * 12 octal digits implies an upper limit 8^12.
+             */
+            if (n < 0) {
+                n += Math.pow(radix, cch);
+            }
+            if (n >= Math.pow(radix, cch)) {
+                cch = Math.ceil(Math.log(n) / Math.log(radix));
+            }
+        }
+        var g = nGrouping || -1;
+        while (cch-- > 0) {
+            if (!g) {
+                s = ',' + s;
+                g = nGrouping;
+            }
+            if (n == null) {
+                s = '?' + s;
+            } else {
+                var d = n % radix;
+                d += (d >= 0 && d <= 9? 0x30 : 0x41 - 10);
+                s = String.fromCharCode(d) + s;
+                n = Math.trunc(n / radix);
+            }
+            g--;
+        }
+        return sPrefix + s;
+    }
+
+    /**
+     * toBin(n, cch, nGrouping)
+     *
+     * Converts an integer to binary, with the specified number of digits (up to a maximum of 36).
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of binary digits (0 or undefined for default of either 8, 18, or 36)
+     * @param {number} [nGrouping]
+     * @return {string} the binary representation of n
+     */
+    static toBin(n, cch, nGrouping)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.LN2) || 1;
+            var v = Math.abs(n);
+            if (v <= 0b11111111) {
+                cch = 8;
+            } else if (v <= 0b111111111111111111) {
+                cch = 18;
+            } else {
+                cch = 36;
+            }
+        } else if (cch > 36) cch = 36;
+        return Str.toBase(n, 2, cch, "", nGrouping);
+    }
+
+    /**
+     * toBinBytes(n, cb, fPrefix)
+     *
+     * Converts an integer to binary, with the specified number of bytes (up to the default of 4).
+     *
+     * @param {number|null|undefined} n (interpreted as a 32-bit value)
+     * @param {number} [cb] is the desired number of binary bytes (4 is both the default and the maximum)
+     * @param {boolean} [fPrefix]
+     * @return {string} the binary representation of n
+     */
+    static toBinBytes(n, cb, fPrefix)
+    {
+        var s = "";
+        if (!cb || cb > 4) cb = 4;
+        for (var i = 0; i < cb; i++) {
+            if (s) s = ',' + s;
+            s = Str.toBin(n & 0xff, 8) + s;
+            n >>= 8;
+        }
+        return (fPrefix? "0b" : "") + s;
+    }
+
+    /**
+     * toOct(n, cch, fPrefix)
+     *
+     * Converts an integer to octal, with the specified number of digits (default of 6; max of 12)
+     *
+     * You might be tempted to use the built-in n.toString(8) instead, but it doesn't zero-pad and it
+     * doesn't properly convert negative values.  Moreover, if n is undefined, n.toString() will throw
+     * an exception, whereas this function will return '?' characters.
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of octal digits (0 or undefined for default of either 6, 8, or 12)
+     * @param {boolean} [fPrefix]
+     * @return {string} the octal representation of n
+     */
+    static toOct(n, cch, fPrefix)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.log(8)) || 1;
+            var v = Math.abs(n);
+            if (v <= 0o777777) {
+                cch = 6;
+            } else if (v <= 0o77777777) {
+                cch = 8;
+            } else {
+                cch = 12;
+            }
+        } else if (cch > 12) cch = 12;
+        return Str.toBase(n, 8, cch, fPrefix? "0o" : "");
+    }
+
+    /**
+     * toDec(n, cch)
+     *
+     * Converts an integer to decimal, with the specified number of digits (default of 5; max of 11)
+     *
+     * You might be tempted to use the built-in n.toString(10) instead, but it doesn't zero-pad and it
+     * doesn't properly convert negative values.  Moreover, if n is undefined, n.toString() will throw
+     * an exception, whereas this function will return '?' characters.
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of decimal digits (0 or undefined for default of either 5 or 11)
+     * @return {string} the decimal representation of n
+     */
+    static toDec(n, cch)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.LN10) || 1;
+            var v = Math.abs(n);
+            if (v <= 99999) {
+                cch = 5;
+            } else {
+                cch = 11;
+            }
+        } else if (cch > 11) cch = 11;
+        return Str.toBase(n, 10, cch);
+    }
+
+    /**
+     * toHex(n, cch, fPrefix)
+     *
+     * Converts an integer to hex, with the specified number of digits (default of 4 or 8, max of 9).
+     *
+     * You might be tempted to use the built-in n.toString(16) instead, but it doesn't zero-pad and it
+     * doesn't properly convert negative values; for example, if n is -2147483647, then n.toString(16)
+     * will return "-7fffffff" instead of "80000001".  Moreover, if n is undefined, n.toString() will
+     * throw an exception, whereas this function will return '?' characters.
+     *
+     * NOTE: The following work-around (adapted from code found on StackOverflow) would be another solution,
+     * taking care of negative values, zero-padding, and upper-casing, but not null/undefined/NaN values:
+     *
+     *      s = (n < 0? n + 0x100000000 : n).toString(16);
+     *      s = "00000000".substr(0, 8 - s.length) + s;
+     *      s = s.substr(0, cch).toUpperCase();
+     *
+     * @param {number|null|undefined} n (supports integers up to 36 bits now)
+     * @param {number} [cch] is the desired number of hex digits (0 or undefined for default of either 4, 8, or 9)
+     * @param {boolean} [fPrefix]
+     * @return {string} the hex representation of n
+     */
+    static toHex(n, cch, fPrefix)
+    {
+        if (!cch) {
+            // cch = Math.ceil(Math.log(Math.abs(n) + 1) / Math.log(16)) || 1;
+            var v = Math.abs(n);
+            if (v <= 0xffff) {
+                cch = 4;
+            } else if (v <= 0xffffffff) {
+                cch = 8;
+            } else {
+                cch = 9;
+            }
+        } else if (cch > 9) cch = 9;
+        return Str.toBase(n, 16, cch, fPrefix? "0x" : "");
+    }
+
+    /**
+     * toHexByte(b)
+     *
+     * Alias for Str.toHex(b, 2, true)
+     *
+     * @param {number|null|undefined} b is a byte value
+     * @return {string} the hex representation of b
+     */
+    static toHexByte(b)
+    {
+        return Str.toHex(b, 2, true);
+    }
+
+    /**
+     * toHexWord(w)
+     *
+     * Alias for Str.toHex(w, 4, true)
+     *
+     * @param {number|null|undefined} w is a word (16-bit) value
+     * @return {string} the hex representation of w
+     */
+    static toHexWord(w)
+    {
+        return Str.toHex(w, 4, true);
+    }
+
+    /**
+     * toHexLong(l)
+     *
+     * Alias for Str.toHex(l, 8, true)
+     *
+     * @param {number|null|undefined} l is a dword (32-bit) value
+     * @return {string} the hex representation of w
+     */
+    static toHexLong(l)
+    {
+        return Str.toHex(l, 8, true);
+    }
+
+    /**
+     * getBaseName(sFileName, fStripExt)
+     *
+     * This is a poor-man's version of Node's path.basename(), which Node-only components should use instead.
+     *
+     * Note that if fStripExt is true, this strips ANY extension, whereas path.basename() strips the extension only
+     * if it matches the second parameter (eg, path.basename("/foo/bar/baz/asdf/quux.html", ".html") returns "quux").
+     *
+     * @param {string} sFileName
+     * @param {boolean} [fStripExt]
+     * @return {string}
+     */
+    static getBaseName(sFileName, fStripExt)
+    {
+        var sBaseName = sFileName;
+
+        var i = sFileName.lastIndexOf('/');
+        if (i >= 0) sBaseName = sFileName.substr(i + 1);
+
+        /*
+         * This next bit is a kludge to clean up names that are part of a URL that includes unsightly query parameters.
+         */
+        i = sBaseName.indexOf('&');
+        if (i > 0) sBaseName = sBaseName.substr(0, i);
+
+        if (fStripExt) {
+            i = sBaseName.lastIndexOf(".");
+            if (i > 0) {
+                sBaseName = sBaseName.substring(0, i);
+            }
+        }
+        return sBaseName;
+    }
+
+    /**
+     * getExtension(sFileName)
+     *
+     * This is a poor-man's version of Node's path.extname(), which Node-only components should use instead.
+     *
+     * Note that we EXCLUDE the period from the returned extension, whereas path.extname() includes it.
+     *
+     * @param {string} sFileName
+     * @return {string} the filename's extension (in lower-case and EXCLUDING the "."), or an empty string
+     */
+    static getExtension(sFileName)
+    {
+        var sExtension = "";
+        var i = sFileName.lastIndexOf(".");
+        if (i >= 0) {
+            sExtension = sFileName.substr(i + 1).toLowerCase();
+        }
+        return sExtension;
+    }
+
+    /**
+     * endsWith(s, sSuffix)
+     *
+     * @param {string} s
+     * @param {string} sSuffix
+     * @return {boolean} true if s ends with sSuffix, false if not
+     */
+    static endsWith(s, sSuffix)
+    {
+        return s.indexOf(sSuffix, s.length - sSuffix.length) !== -1;
+    }
+
+    /**
+     * escapeHTML(sHTML)
+     *
+     * @param {string} sHTML
+     * @return {string} with HTML entities "escaped", similar to PHP's htmlspecialchars()
+     */
+    static escapeHTML(sHTML)
+    {
+        return sHTML.replace(/[&<>"']/g, function(m)
+        {
+            return Str.aHTMLEscapeMap[m];
+        });
+    }
+
+    /**
+     * replaceAll(sFind, sReplace, s)
+     *
+     * @param {string} sFind
+     * @param {string} sReplace
+     * @param {string} s
+     * @return {string}
+     */
+    static replaceAll(sFind, sReplace, s)
+    {
+        var a = {};
+        a[sFind] = sReplace;
+        return Str.replaceArray(a, s);
+    }
+
+    /**
+     * replaceArray(a, s)
+     *
+     * @param {Object} a
+     * @param {string} s
+     * @return {string}
+     */
+    static replaceArray(a, s)
+    {
+        var sMatch = "";
+        for (var k in a) {
+            /*
+             * As noted in:
+             *
+             *      http://www.regexguru.com/2008/04/escape-characters-only-when-necessary/
+             *
+             * inside character classes, only backslash, caret, hyphen and the closing bracket need to be
+             * escaped.  And in fact, if you ensure that the closing bracket is first, the caret is not first,
+             * and the hyphen is last, you can avoid escaping those as well.
+             */
+            k = k.replace(/([\\[\]*{}().+?])/g, "\\$1");
+            sMatch += (sMatch? '|' : '') + k;
+        }
+        return s.replace(new RegExp('(' + sMatch + ')', "g"), function(m)
+        {
+            return a[m];
+        });
+    }
+
+    /**
+     * pad(s, cch, fPadLeft)
+     *
+     * NOTE: the maximum amount of padding currently supported is 40 spaces.
+     *
+     * @param {string} s is a string
+     * @param {number} cch is desired length
+     * @param {boolean} [fPadLeft] (default is padding on the right)
+     * @return {string} the original string (s) with spaces padding it to the specified length
+     */
+    static pad(s, cch, fPadLeft)
+    {
+        var sPadding = "                                        ";
+        return fPadLeft? (sPadding + s).slice(-cch) : (s + sPadding).slice(0, cch);
+    }
+
+    /**
+     * stripLeadingZeros(s, fPad)
+     *
+     * @param {string} s
+     * @param {boolean} [fPad]
+     * @return {string}
+     */
+    static stripLeadingZeros(s, fPad)
+    {
+        var cch = s.length;
+        s = s.replace(/^0+([0-9A-F]+)$/i, "$1");
+        if (fPad) s = Str.pad(s, cch, true);
+        return s;
+    }
+
+    /**
+     * trim(s)
+     *
+     * @param {string} s
+     * @return {string}
+     */
+    static trim(s)
+    {
+        if (String.prototype.trim) {
+            return s.trim();
+        }
+        return s.replace(/^\s+|\s+$/g, "");
+    }
+
+    /**
+     * toASCIICode(b)
+     *
+     * @param {number} b
+     * @return {string}
+     */
+    static toASCIICode(b)
+    {
+        var s;
+        if (b != Str.ASCII.CR && b != Str.ASCII.LF) {
+            s = Str.aASCIICodes[b];
+        }
+        if (s) {
+            s = '<' + s + '>';
+        } else {
+            s = String.fromCharCode(b);
+        }
+        return s;
+    }
+}
+
+Str.aHTMLEscapeMap = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#039;'
+};
+
+/*
+ * Future home of a general-purpose ASCII table.  TODO: Flesh it out.
+ */
+Str.ASCII = {
+    LF:     0x0A,
+    CR:     0x0D
+};
+
+/*
+ * Table for converting "unprintable" ASCII codes into mnemonics, to more clearly see what's being printed.
+ */
+Str.aASCIICodes = {
+    0x00:   "NUL",
+    0x01:   "SOH",      // (CTRL_A) Start of Heading
+    0x02:   "STX",      // (CTRL_B) Start of Text
+    0x03:   "ETX",      // (CTRL_C) End of Text
+    0x04:   "EOT",      // (CTRL_D) End of Transmission
+    0x05:   "ENQ",      // (CTRL_E) Enquiry
+    0x06:   "ACK",      // (CTRL_F) Acknowledge
+    0x07:   "BEL",      // (CTRL_G) Bell
+    0x08:   "BS",       // (CTRL_H) Backspace
+    0x09:   "TAB",      // (CTRL_I) Horizontal Tab
+    0x0A:   "LF",       // (CTRL_J) Line Feed (New Line)
+    0x0B:   "VT",       // (CTRL_K) Vertical Tab
+    0x0C:   "FF",       // (CTRL_L) Form Feed (New Page)
+    0x0D:   "CR",       // (CTRL_M) Carriage Return
+    0x0E:   "SO",       // (CTRL_N) Shift Out
+    0x0F:   "SI",       // (CTRL_O) Shift In
+    0x10:   "DLE",      // (CTRL_P) Data Link Escape
+    0x11:   "XON",      // (CTRL_Q) Device Control 1 (aka DC1)
+    0x12:   "DC2",      // (CTRL_R) Device Control 2
+    0x13:   "XOFF",     // (CTRL_S) Device Control 3 (aka DC3)
+    0x14:   "DC4",      // (CTRL_T) Device Control 4
+    0x15:   "NAK",      // (CTRL_U) Negative Acknowledge
+    0x16:   "SYN",      // (CTRL_V) Synchronous Idle
+    0x17:   "ETB",      // (CTRL_W) End of Transmission Block
+    0x18:   "CAN",      // (CTRL_X) Cancel
+    0x19:   "EM",       // (CTRL_Y) End of Medium
+    0x1A:   "SUB",      // (CTRL_Z) Substitute
+    0x1B:   "ESC",      // Escape
+    0x1C:   "FS",       // File Separator
+    0x1D:   "GS",       // Group Separator
+    0x1E:   "RS",       // Record Separator
+    0x1F:   "US"        // Unit Separator
+};
+
+Str.TYPES = {
+    NULL:       0,
+    BYTE:       1,
+    WORD:       2,
+    DWORD:      3,
+    NUMBER:     4,
+    STRING:     5,
+    BOOLEAN:    6,
+    OBJECT:     7,
+    ARRAY:      8
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/usrlib.js (C) Jeff Parsons 2012-2017
+ */
+
+/**
+ * @typedef {{
+ *  mask:       number,
+ *  shift:      number
+ * }}
+ */
+var BitField;
+
+/**
+ * @typedef {Object.<BitField>}
+ */
+var BitFields;
+
+class Usr {
+    /**
+     * binarySearch(a, v, fnCompare)
+     *
+     * @param {Array} a is an array
+     * @param {number|string|Array|Object} v
+     * @param {function((number|string|Array|Object), (number|string|Array|Object))} [fnCompare]
+     * @return {number} the index of matching entry if non-negative, otherwise the index of the insertion point
+     */
+    static binarySearch(a, v, fnCompare)
+    {
+        var left = 0;
+        var right = a.length;
+        var found = 0;
+        if (fnCompare === undefined) {
+            fnCompare = function(a, b)
+            {
+                return a > b ? 1 : a < b ? -1 : 0;
+            };
+        }
+        while (left < right) {
+            var middle = (left + right) >> 1;
+            var compareResult;
+            compareResult = fnCompare(v, a[middle]);
+            if (compareResult > 0) {
+                left = middle + 1;
+            } else {
+                right = middle;
+                found = !compareResult;
+            }
+        }
+        return found ? left : ~left;
+    }
+
+    /**
+     * binaryInsert(a, v, fnCompare)
+     *
+     * If element v already exists in array a, the array is unchanged (we don't allow duplicates); otherwise, the
+     * element is inserted into the array at the appropriate index.
+     *
+     * @param {Array} a is an array
+     * @param {number|string|Array|Object} v is the value to insert
+     * @param {function((number|string|Array|Object), (number|string|Array|Object))} [fnCompare]
+     */
+    static binaryInsert(a, v, fnCompare)
+    {
+        var index = Usr.binarySearch(a, v, fnCompare);
+        if (index < 0) {
+            a.splice(-(index + 1), 0, v);
+        }
+    }
+
+    /**
+     * getTimestamp()
+     *
+     * @return {string} timestamp containing the current date and time ("yyyy-mm-dd hh:mm:ss")
+     */
+    static getTimestamp()
+    {
+        var date = new Date();
+        var padNum = function(n)
+        {
+            return (n < 10 ? "0" : "") + n;
+        };
+        return date.getFullYear() + "-" + padNum(date.getMonth() + 1) + "-" + padNum(date.getDate()) + " " + padNum(date.getHours()) + ":" + padNum(date.getMinutes()) + ":" + padNum(date.getSeconds());
+    }
+
+    /**
+     * getMonthDays(nMonth, nYear)
+     *
+     * Note that if we're being called on behalf of the RTC, its year is always truncated to two digits (mod 100),
+     * so we have no idea what century the year 0 might refer to.  When using the normal leap-year formula, 0 fails
+     * the mod 100 test but passes the mod 400 test, so as far as the RTC is concerned, every century year is a leap
+     * year.  Since we're most likely dealing with the year 2000, that's fine, since 2000 was also a leap year.
+     *
+     * TODO: There IS a separate CMOS byte that's supposed to be set to CMOS_ADDR.CENTURY_DATE; it's always BCD,
+     * so theoretically it will contain values like 0x19 or 0x20 (for the 20th and 21st centuries, respectively), and
+     * we could add that as another parameter to this function, to improve the accuracy, but that would go beyond what
+     * a real RTC actually does.
+     *
+     * @param {number} nMonth (1-12)
+     * @param {number} nYear (normally a 4-digit year, but it may also be mod 100)
+     * @return {number} the maximum (1-based) day allowed for the specified month and year
+     */
+    static getMonthDays(nMonth, nYear)
+    {
+        var nDays = Usr.aMonthDays[nMonth - 1];
+        if (nDays == 28) {
+            if ((nYear % 4) === 0 && ((nYear % 100) || (nYear % 400) === 0)) {
+                nDays++;
+            }
+        }
+        return nDays;
+    }
+
+    /**
+     * formatDate(sFormat, date)
+     *
+     * @param {string} sFormat (eg, "F j, Y", "Y-m-d H:i:s")
+     * @param {Date} [date] (default is the current time)
+     * @return {string}
+     *
+     * Supported identifiers in sFormat include:
+     *
+     *      a:  lowercase ante meridiem and post meridiem (am or pm)
+     *      d:  day of the month, 2 digits with leading zeros (01,...,31)
+     *      g:  hour in 12-hour format, without leading zeros (1,...,12)
+     *      i:  minutes, with leading zeros (00,...,59)
+     *      j:  day of the month, without leading zeros (1,...,31)
+     *      l:  day of the week ("Sunday",...,"Saturday")
+     *      m:  month, with leading zeros (01,...,12)
+     *      s:  seconds, with leading zeros (00,...,59)
+     *      F:  month ("January",...,"December")
+     *      H:  hour in 24-hour format, with leading zeros (00,...,23)
+     *      Y:  year (eg, 2014)
+     *
+     * For more inspiration, see: http://php.net/manual/en/function.date.php
+     */
+    static formatDate(sFormat, date)
+    {
+        var sDate = "";
+        if (!date) date = new Date();
+        var iHour = date.getHours();
+        var iDay = date.getDate();
+        var iMonth = date.getMonth() + 1;
+        for (var i = 0; i < sFormat.length; i++) {
+            var ch;
+            switch ((ch = sFormat.charAt(i))) {
+            case 'a':
+                sDate += (iHour < 12 ? "am" : "pm");
+                break;
+            case 'd':
+                sDate += ('0' + iDay).slice(-2);
+                break;
+            case 'g':
+                sDate += (!iHour ? 12 : (iHour > 12 ? iHour - 12 : iHour));
+                break;
+            case 'i':
+                sDate += ('0' + date.getMinutes()).slice(-2);
+                break;
+            case 'j':
+                sDate += iDay;
+                break;
+            case 'l':
+                sDate += Usr.asDays[date.getDay()];
+                break;
+            case 'm':
+                sDate += ('0' + iMonth).slice(-2);
+                break;
+            case 's':
+                sDate += ('0' + date.getSeconds()).slice(-2);
+                break;
+            case 'F':
+                sDate += Usr.asMonths[iMonth - 1];
+                break;
+            case 'H':
+                sDate += ('0' + iHour).slice(-2);
+                break;
+            case 'Y':
+                sDate += date.getFullYear();
+                break;
+            default:
+                sDate += ch;
+                break;
+            }
+        }
+        return sDate;
+    }
+
+    /**
+     * defineBitFields(bfs)
+     *
+     * Prepares a bit field definition for use with getBitField() and setBitField(); eg:
+     *
+     *      var bfs = Usr.defineBitFields({num:20, count:8, btmod:1, type:3});
+     *
+     * The above defines a set of bit fields containing four fields: num (bits 0-19), count (bits 20-27), btmod (bit 28), and type (bits 29-31).
+     *
+     *      Usr.setBitField(bfs.num, n, 1);
+     *
+     * The above set bit field "bfs.num" in numeric variable "n" to the value 1.
+     *
+     * @param {Object} bfs
+     * @return {BitFields}
+     */
+    static defineBitFields(bfs)
+    {
+        var bit = 0;
+        for (var f in bfs) {
+            var width = bfs[f];
+            var mask = ((1 << width) - 1) << bit;
+            bfs[f] = {mask: mask, shift: bit};
+            bit += width;
+        }
+        return bfs;
+    }
+
+    /**
+     * initBitFields(bfs, ...)
+     *
+     * @param {BitFields} bfs
+     * @param {...number} var_args
+     * @return {number} a value containing all supplied bit fields
+     */
+    static initBitFields(bfs, var_args)
+    {
+        var v = 0, i = 1;
+        for (var f in bfs) {
+            if (i >= arguments.length) break;
+            v = Usr.setBitField(bfs[f], v, arguments[i++]);
+        }
+        return v;
+    }
+
+    /**
+     * getBitField(bf, v)
+     *
+     * @param {BitField} bf
+     * @param {number} v is a value containing bit fields
+     * @return {number} the value of the bit field in v defined by bf
+     */
+    static getBitField(bf, v)
+    {
+        return (v & bf.mask) >> bf.shift;
+    }
+
+    /**
+     * setBitField(bf, v, n)
+     *
+     * @param {BitField} bf
+     * @param {number} v is a value containing bit fields
+     * @param {number} n is a value to store in v in the bit field defined by bf
+     * @return {number} updated v
+     */
+    static setBitField(bf, v, n)
+    {
+        return (v & ~bf.mask) | ((n << bf.shift) & bf.mask);
+    }
+
+    /**
+     * indexOf(a, t, i)
+     *
+     * Use this instead of Array.prototype.indexOf() if you can't be sure the browser supports it.
+     *
+     * @param {Array} a
+     * @param {*} t
+     * @param {number} [i]
+     * @returns {number}
+     */
+    static indexOf(a, t, i)
+    {
+        if (Array.prototype.indexOf) {
+            return a.indexOf(t, i);
+        }
+        i = i || 0;
+        if (i < 0) i += a.length;
+        if (i < 0) i = 0;
+        for (var n = a.length; i < n; i++) {
+            if (i in a && a[i] === t) return i;
+        }
+        return -1;
+    }
+}
+
+Usr.asDays = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
+Usr.asMonths = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
+Usr.aMonthDays = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+
+/**
+ * getTime()
+ *
+ * @return {number} the current time, in milliseconds
+ */
+Usr.getTime = Date.now || function() { return +new Date(); };
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/weblib.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * According to http://www.w3schools.com/jsref/jsref_obj_global.asp, these are the *global* properties
+ * and functions of JavaScript-in-the-Browser:
+ *
+ * Property             Description
+ * ---
+ * Infinity             A numeric value that represents positive/negative infinity
+ * NaN                  "Not-a-Number" value
+ * undefined            Indicates that a variable has not been assigned a value
+ *
+ * Function             Description
+ * ---
+ * decodeURI()          Decodes a URI
+ * decodeURIComponent() Decodes a URI component
+ * encodeURI()          Encodes a URI
+ * encodeURIComponent() Encodes a URI component
+ * escape()             Deprecated in version 1.5. Use encodeURI() or encodeURIComponent() instead
+ * eval()               Evaluates a string and executes it as if it was script code
+ * isFinite()           Determines whether a value is a finite, legal number
+ * isNaN()              Determines whether a value is an illegal number
+ * Number()             Converts an object's value to a number
+ * parseFloat()         Parses a string and returns a floating point number
+ * parseInt()           Parses a string and returns an integer
+ * String()             Converts an object's value to a string
+ * unescape()           Deprecated in version 1.5. Use decodeURI() or decodeURIComponent() instead
+ *
+ * And according to http://www.w3schools.com/jsref/obj_window.asp, these are the properties and functions
+ * of the *window* object.
+ *
+ * Property             Description
+ * ---
+ * closed               Returns a Boolean value indicating whether a window has been closed or not
+ * defaultStatus        Sets or returns the default text in the statusbar of a window
+ * document             Returns the Document object for the window (See Document object)
+ * frames               Returns an array of all the frames (including iframes) in the current window
+ * history              Returns the History object for the window (See History object)
+ * innerHeight          Returns the inner height of a window's content area
+ * innerWidth           Returns the inner width of a window's content area
+ * length               Returns the number of frames (including iframes) in a window
+ * location             Returns the Location object for the window (See Location object)
+ * name                 Sets or returns the name of a window
+ * navigator            Returns the Navigator object for the window (See Navigator object)
+ * opener               Returns a reference to the window that created the window
+ * outerHeight          Returns the outer height of a window, including toolbars/scrollbars
+ * outerWidth           Returns the outer width of a window, including toolbars/scrollbars
+ * pageXOffset          Returns the pixels the current document has been scrolled (horizontally) from the upper left corner of the window
+ * pageYOffset          Returns the pixels the current document has been scrolled (vertically) from the upper left corner of the window
+ * parent               Returns the parent window of the current window
+ * screen               Returns the Screen object for the window (See Screen object)
+ * screenLeft           Returns the x coordinate of the window relative to the screen
+ * screenTop            Returns the y coordinate of the window relative to the screen
+ * screenX              Returns the x coordinate of the window relative to the screen
+ * screenY              Returns the y coordinate of the window relative to the screen
+ * self                 Returns the current window
+ * status               Sets or returns the text in the statusbar of a window
+ * top                  Returns the topmost browser window
+ *
+ * Method               Description
+ * ---
+ * alert()              Displays an alert box with a message and an OK button
+ * atob()               Decodes a base-64 encoded string
+ * blur()               Removes focus from the current window
+ * btoa()               Encodes a string in base-64
+ * clearInterval()      Clears a timer set with setInterval()
+ * clearTimeout()       Clears a timer set with setTimeout()
+ * close()              Closes the current window
+ * confirm()            Displays a dialog box with a message and an OK and a Cancel button
+ * createPopup()        Creates a pop-up window
+ * focus()              Sets focus to the current window
+ * moveBy()             Moves a window relative to its current position
+ * moveTo()             Moves a window to the specified position
+ * open()               Opens a new browser window
+ * print()              Prints the content of the current window
+ * prompt()             Displays a dialog box that prompts the visitor for input
+ * resizeBy()           Resizes the window by the specified pixels
+ * resizeTo()           Resizes the window to the specified width and height
+ * scroll()             This method has been replaced by the scrollTo() method.
+ * scrollBy()           Scrolls the content by the specified number of pixels
+ * scrollTo()           Scrolls the content to the specified coordinates
+ * setInterval()        Calls a function or evaluates an expression at specified intervals (in milliseconds)
+ * setTimeout()         Calls a function or evaluates an expression after a specified number of milliseconds
+ * stop()               Stops the window from loading
+ */
+
+class Web {
+    /**
+     * log(s, type)
+     *
+     * For diagnostic output only.  DEBUG must be true (or "--debug" specified via the command-line)
+     * for Component.log() to display anything.
+     *
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     */
+    static log(s, type)
+    {
+        Component.log(s, type);
+    }
+
+    /**
+     * notice(s, fPrintOnly, id)
+     *
+     * @param {string} s is the message text
+     * @param {boolean} [fPrintOnly]
+     * @param {string} [id] is the caller's ID, if any
+     */
+    static notice(s, fPrintOnly, id)
+    {
+        Component.notice(s, fPrintOnly, id);
+    }
+
+    /**
+     * getResource(sURL, dataPost, fAsync, done)
+     *
+     * Request the specified resource (sURL), and once the request is complete, notify done().
+     *
+     * If fAsync is true, a done() callback should ALWAYS be supplied; otherwise, you'll have no
+     * idea when the request is complete or what the response was.  done() is passed three parameters:
+     *
+     *      done(sURL, sResource, nErrorCode)
+     *
+     * If nErrorCode is zero, sResource should contain the requested data; otherwise, an error occurred.
+     *
+     * If dataPost is set to a string, that string can be used to control the response format;
+     * by default, the response format is plain text, but you can specify "bytes" to request arbitrary
+     * binary data, which should come back as a string of bytes.
+     *
+     * TODO: The "bytes" option works by calling overrideMimeType(), which was never a best practice.
+     * Instead, we should implement supported response types ("text" and "arraybuffer", at a minimum)
+     * by setting xmlHTTP.responseType to one of those values before calling xmlHTTP.send().
+     *
+     * @param {string} sURL
+     * @param {string|Object|null} [dataPost] for a POST request (default is a GET request)
+     * @param {boolean} [fAsync] is true for an asynchronous request
+     * @param {function(string,string,number)} [done]
+     * @return {Array|null} Array containing [sResource, nErrorCode], or null if no response yet
+     */
+    static getResource(sURL, dataPost, fAsync = false, done)
+    {
+        var nErrorCode = 0, sResource = null, response = null;
+
+        if (typeof resources == 'object' && (sResource = resources[sURL])) {
+            if (done) done(sURL, sResource, nErrorCode);
+            return [sResource, nErrorCode];
+        }
+        else if (fAsync && typeof resources == 'function') {
+            resources(sURL, function(sResource, nErrorCode)
+            {
+                if (done) done(sURL, sResource, nErrorCode);
+            });
+            return response;
+        }
+
+        if (DEBUG) {
+            /*
+             * The larger resources we put on archive.pcjs.org should also be available locally...
+             */
+            sURL = sURL.replace(/^http:\/\/archive.pcjs.org(\/.*)\/([^\/]*)$/, "$1/archive/$2");
+        }
+
+
+        var xmlHTTP = (window.XMLHttpRequest? new window.XMLHttpRequest() : new window.ActiveXObject("Microsoft.XMLHTTP"));
+        if (fAsync) {
+            xmlHTTP.onreadystatechange = function()
+            {
+                if (xmlHTTP.readyState === 4) {
+                    /*
+                     * The following line was recommended for WebKit, as a work-around to prevent the handler firing multiple
+                     * times when debugging.  Unfortunately, that's not the only XMLHttpRequest problem that occurs when
+                     * debugging, so I think the WebKit problem is deeper than that.  When we have multiple XMLHttpRequests
+                     * pending, any debugging activity means most of them simply get dropped on floor, so what may actually be
+                     * happening are mis-notifications rather than redundant notifications.
+                     *
+                     *      xmlHTTP.onreadystatechange = undefined;
+                     */
+                    sResource = xmlHTTP.responseText;
+                    /*
+                     * The normal "success" case is an HTTP status code of 200, but when testing with files loaded
+                     * from the local file system (ie, when using the "file:" protocol), we have to be a bit more "flexible".
+                     */
+                    if (xmlHTTP.status == 200 || !xmlHTTP.status && sResource.length && Web.getHostProtocol() == "file:") {
+                        if (MAXDEBUG) Web.log("xmlHTTP.onreadystatechange(" + sURL + "): returned " + sResource.length + " bytes");
+                    }
+                    else {
+                        nErrorCode = xmlHTTP.status || -1;
+                        Web.log("xmlHTTP.onreadystatechange(" + sURL + "): error code " + nErrorCode);
+                    }
+                    if (done) done(sURL, sResource, nErrorCode);
+                }
+            };
+        }
+
+        if (dataPost && typeof dataPost == "object") {
+            var sDataPost = "";
+            for (var p in dataPost) {
+                if (!dataPost.hasOwnProperty(p)) continue;
+                if (sDataPost) sDataPost += "&";
+                sDataPost += p + '=' + encodeURIComponent(dataPost[p]);
+            }
+            sDataPost = sDataPost.replace(/%20/g, '+');
+            if (MAXDEBUG) Web.log("Web.getResource(POST " + sURL + "): " + sDataPost.length + " bytes");
+            xmlHTTP.open("POST", sURL, fAsync);     // ensure that fAsync is a valid boolean (Internet Explorer xmlHTTP functions insist on it)
+            xmlHTTP.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
+            xmlHTTP.send(sDataPost);
+        } else {
+            if (MAXDEBUG) Web.log("Web.getResource(GET " + sURL + ")");
+            xmlHTTP.open("GET", sURL, fAsync);      // ensure that fAsync is a valid boolean (Internet Explorer xmlHTTP functions insist on it)
+            if (dataPost == "bytes") {
+                xmlHTTP.overrideMimeType("text/plain; charset=x-user-defined");
+            }
+            xmlHTTP.send();
+        }
+
+        if (!fAsync) {
+            sResource = xmlHTTP.responseText;
+            if (xmlHTTP.status == 200) {
+                if (MAXDEBUG) Web.log("Web.getResource(" + sURL + "): returned " + sResource.length + " bytes");
+            } else {
+                nErrorCode = xmlHTTP.status || -1;
+                Web.log("Web.getResource(" + sURL + "): error code " + nErrorCode);
+            }
+            if (done) done(sURL, sResource, nErrorCode);
+            response = [sResource, nErrorCode];
+        }
+        return response;
+    }
+
+    /**
+     * parseMemoryResource(sURL, sData)
+     *
+     * This converts a variety of JSON-style data streams into an Object with the following properties:
+     *
+     *      aBytes
+     *      aSymbols
+     *      addrLoad
+     *      addrExec
+     *
+     * If the source data contains a 'bytes' array, it's passed through to 'aBytes'; alternatively, if
+     * it contains a 'words' array, the values are converted from 16-bit to 8-bit and stored in 'aBytes',
+     * and if it contains a 'longs' array, the values are converted from 32-bit longs into bytes and
+     * stored in 'aBytes'.
+     *
+     * Alternatively, if the source data contains a 'data' array, we simply pass that through to the output
+     * object as:
+     *
+     *      aData
+     *
+     * @param {string} sURL
+     * @param {string} sData
+     * @return {Object|null} (resource)
+     */
+    static parseMemoryResource(sURL, sData)
+    {
+        var i;
+        var resource = {
+            aBytes: null,
+            aSymbols: null,
+            addrLoad: null,
+            addrExec: null
+        };
+
+        if (sData.charAt(0) == "[" || sData.charAt(0) == "{") {
+            try {
+                var a, ib, data;
+
+                if (sData.substr(0, 1) == "<") {    // if the "data" begins with a "<"...
+                    /*
+                     * Early server configs reported an error (via the nErrorCode parameter) if a tape URL was invalid,
+                     * but more recent server configs now display a somewhat friendlier HTML error page.  The downside,
+                     * however, is that the original error has been buried, and we've received "data" that isn't actually
+                     * tape data.  So if the data we've received appears to be "HTML-like", we treat it as an error message.
+                     */
+                    throw new Error(sData);
+                }
+
+                /*
+                 * TODO: IE9 is rather unfriendly and restrictive with regard to how much data it's willing to
+                 * eval().  In particular, the 10Mb disk image we use for the Windows 1.01 demo config fails in
+                 * IE9 with an "Out of memory" exception.  One work-around would be to chop the data into chunks
+                 * (perhaps one track per chunk, using regular expressions) and then manually re-assemble it.
+                 *
+                 * However, it turns out that using JSON.parse(sDiskData) instead of eval("(" + sDiskData + ")")
+                 * is a much easier fix. The only drawback is that we must first quote any unquoted property names
+                 * and remove any comments, because while eval() was cool with them, JSON.parse() is more particular;
+                 * the following RegExp replacements take care of those requirements.
+                 *
+                 * The use of hex values is something else that eval() was OK with, but JSON.parse() is not, and
+                 * while I've stopped using hex values in DumpAPI responses (at least when "format=json" is specified),
+                 * I can't guarantee they won't show up in "legacy" images, and there's no simple RegExp replacement
+                 * for transforming hex values into decimal values, so I cop out and fall back to eval() if I detect
+                 * any hex prefixes ("0x") in the sequence.  Ditto for error messages, which appear like so:
+                 *
+                 *      ["unrecognized disk path: test.img"]
+                 */
+                if (sData.indexOf("0x") < 0 && sData.indexOf("0o") < 0 && sData.substr(0, 2) != '["') {
+                    data = JSON.parse(sData.replace(/([a-z]+):/gm, '"$1":').replace(/\/\/[^\n]*/gm, ""));
+                } else {
+                    data = eval("(" + sData + ")");
+                }
+
+                resource.addrLoad = data['load'];
+                resource.addrExec = data['exec'];
+
+                if (a = data['bytes']) {
+                    resource.aBytes = a;
+                }
+                else if (a = data['words']) {
+                    /*
+                     * Convert all words into bytes
+                     */
+                    resource.aBytes = new Array(a.length * 2);
+                    for (i = 0, ib = 0; i < a.length; i++) {
+                        resource.aBytes[ib++] = a[i] & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 8) & 0xff;
+
+                    }
+                }
+                else if (a = data['longs']) {
+                    /*
+                     * Convert all dwords (longs) into bytes
+                     */
+                    resource.aBytes = new Array(a.length * 4);
+                    for (i = 0, ib = 0; i < a.length; i++) {
+                        resource.aBytes[ib++] = a[i] & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 8) & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 16) & 0xff;
+                        resource.aBytes[ib++] = (a[i] >> 24) & 0xff;
+                    }
+                }
+                else if (a = data['data']) {
+                    resource.aData = a;
+                }
+                else {
+                    resource.aBytes = data;
+                }
+
+                if (resource.aBytes) {
+                    if (!resource.aBytes.length) {
+                        Component.error("Empty resource: " + sURL);
+                        resource = null;
+                    }
+                    else if (resource.aBytes.length == 1) {
+                        Component.error(resource.aBytes[0]);
+                        resource = null;
+                    }
+                }
+                resource.aSymbols = data['symbols'];
+
+            } catch (e) {
+                Component.error("Resource data error (" + sURL + "): " + e.message);
+                resource = null;
+            }
+        }
+        else {
+            /*
+             * Parse the data manually; we assume it's a series of hex byte-values separated by whitespace.
+             */
+            var ab = [];
+            var sHexData = sData.replace(/\n/gm, " ").replace(/ +$/, "");
+            var asHexData = sHexData.split(" ");
+            for (i = 0; i < asHexData.length; i++) {
+                var n = parseInt(asHexData[i], 16);
+                if (isNaN(n)) {
+                    Component.error("Resource data error (" + sURL + "): invalid hex byte (" + asHexData[i] + ")");
+                    break;
+                }
+                ab.push(n & 0xff);
+            }
+            if (i == asHexData.length) resource.aBytes = ab;
+        }
+        return resource;
+    }
+
+    /**
+     * sendReport(sApp, sVer, sURL, sUser, sType, sReport, sHostName)
+     *
+     * Send a report (eg, bug report) to the server.
+     *
+     * @param {string} sApp (eg, "PCjs")
+     * @param {string} sVer (eg, "1.02")
+     * @param {string} sURL (eg, "/devices/pc/machine/5150/mda/64kb/machine.xml")
+     * @param {string} sUser (ie, the user key, if any)
+     * @param {string} sType (eg, "bug"); one of ReportAPI.TYPE.*
+     * @param {string} sReport (eg, unparsed state data)
+     * @param {string} [sHostName] (default is http://SITEHOST)
+     */
+    static sendReport(sApp, sVer, sURL, sUser, sType, sReport, sHostName)
+    {
+        var dataPost = {};
+        dataPost[ReportAPI.QUERY.APP] = sApp;
+        dataPost[ReportAPI.QUERY.VER] = sVer;
+        dataPost[ReportAPI.QUERY.URL] = sURL;
+        dataPost[ReportAPI.QUERY.USER] = sUser;
+        dataPost[ReportAPI.QUERY.TYPE] = sType;
+        dataPost[ReportAPI.QUERY.DATA] = sReport;
+        var sReportURL = (sHostName? sHostName : "http://" + SITEHOST) + ReportAPI.ENDPOINT;
+        Web.getResource(sReportURL, dataPost, true);
+    }
+
+    /**
+     * getHost()
+     *
+     * @return {string}
+     */
+    static getHost()
+    {
+        return ("http://" + (window? window.location.host : SITEHOST));
+    }
+
+    /**
+     * getHostURL()
+     *
+     * @return {string|null}
+     */
+    static getHostURL()
+    {
+        return (window? window.location.href : null);
+    }
+
+    /**
+     * getHostProtocol()
+     *
+     * @return {string}
+     */
+    static getHostProtocol()
+    {
+        return (window? window.location.protocol : "file:");
+    }
+
+    /**
+     * getUserAgent()
+     *
+     * @return {string}
+     */
+    static getUserAgent()
+    {
+        return (window? window.navigator.userAgent : "");
+    }
+
+    /**
+     * hasLocalStorage
+     *
+     * true if localStorage support exists, is enabled, and works; false otherwise
+     *
+     * @return {boolean}
+     */
+    static hasLocalStorage()
+    {
+        if (Web.fLocalStorage == null) {
+            var f = false;
+            if (window) {
+                try {
+                    window.localStorage.setItem(Web.sLocalStorageTest, Web.sLocalStorageTest);
+                    f = (window.localStorage.getItem(Web.sLocalStorageTest) == Web.sLocalStorageTest);
+                    window.localStorage.removeItem(Web.sLocalStorageTest);
+                } catch (e) {
+                    Web.logLocalStorageError(e);
+                    f = false;
+                }
+            }
+            Web.fLocalStorage = f;
+        }
+        return Web.fLocalStorage;
+    }
+
+    /**
+     * logLocalStorageError(e)
+     *
+     * @param {Error} e is an exception
+     */
+    static logLocalStorageError(e)
+    {
+        Web.log(e.message, "localStorage error");
+    }
+
+    /**
+     * getLocalStorageItem(sKey)
+     *
+     * Returns the requested key value, or null if the key does not exist, or undefined if localStorage is not available
+     *
+     * @param {string} sKey
+     * @return {string|null|undefined} sValue
+     */
+    static getLocalStorageItem(sKey)
+    {
+        var sValue;
+        if (window) {
+            try {
+                sValue = window.localStorage.getItem(sKey);
+            } catch (e) {
+                Web.logLocalStorageError(e);
+            }
+        }
+        return sValue;
+    }
+
+    /**
+     * setLocalStorageItem(sKey, sValue)
+     *
+     * @param {string} sKey
+     * @param {string} sValue
+     * @return {boolean} true if localStorage is available, false if not
+     */
+    static setLocalStorageItem(sKey, sValue)
+    {
+        try {
+            window.localStorage.setItem(sKey, sValue);
+            return true;
+        } catch (e) {
+            Web.logLocalStorageError(e);
+        }
+        return false;
+    }
+
+    /**
+     * removeLocalStorageItem(sKey)
+     *
+     * @param {string} sKey
+     */
+    static removeLocalStorageItem(sKey)
+    {
+        try {
+            window.localStorage.removeItem(sKey);
+        } catch (e) {
+            Web.logLocalStorageError(e);
+        }
+    }
+
+    /**
+     * getLocalStorageKeys()
+     *
+     * @return {Array}
+     */
+    static getLocalStorageKeys()
+    {
+        var a = [];
+        try {
+            for (var i = 0, c = window.localStorage.length; i < c; i++) {
+                a.push(window.localStorage.key(i));
+            }
+        } catch (e) {
+            Web.logLocalStorageError(e);
+        }
+        return a;
+    }
+
+    /**
+     * reloadPage()
+     */
+    static reloadPage()
+    {
+        if (window) window.location.reload();
+    }
+
+    /**
+     * isUserAgent(s)
+     *
+     * Check the browser's user-agent string for the given substring; "iOS" and "MSIE" are special values you can
+     * use that will match any iOS or MSIE browser, respectively (even IE11, in the case of "MSIE").
+     *
+     * 2013-11-06: In a questionable move, MSFT changed the user-agent reported by IE11 on Windows 8.1, eliminating
+     * the "MSIE" string (which MSDN calls a "version token"; see http://msdn.microsoft.com/library/ms537503.aspx);
+     * they say "public websites should rely on feature detection, rather than browser detection, in order to design
+     * their sites for browsers that don't support the features used by the website." So, in IE11, we get a user-agent
+     * that tries to fool apps into thinking the browser is more like WebKit or Gecko:
+     *
+     *      Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
+     *
+     * That's a nice idea, but in the meantime, they hosed the XSL transform code in embed.js, which contained
+     * some very critical browser-specific code; turning on IE's "Compatibility Mode" didn't help either, because
+     * that's a sledgehammer solution which restores the old user-agent string but also disables other features like
+     * HTML5 canvas support. As an interim solution, I'm treating any "MSIE" check as a check for either "MSIE" or
+     * "Trident".
+     *
+     * UPDATE: I've since found ways to make the code in embed.js more browser-agnostic, so for now, there's isn't
+     * any code that cares about "MSIE", but I've left the change in place, because I wouldn't be surprised if I'll
+     * need more IE-specific code in the future, perhaps for things like copy/paste functionality, or mouse capture.
+     *
+     * @param {string} s is a substring to search for in the user-agent; as noted above, "iOS" and "MSIE" are special values
+     * @return {boolean} is true if the string was found, false if not
+     */
+    static isUserAgent(s)
+    {
+        if (window) {
+            var userAgent = Web.getUserAgent();
+            /*
+             * Here's one case where we have to be careful with Component, because when isUserAgent() is called by
+             * the init code below, component.js hasn't been loaded yet.  The simple solution for now is to remove the call.
+             *
+             *      Web.log("agent: " + userAgent);
+             *
+             * And yes, it would be pointless to use the conditional (?) operator below, if not for the Google Closure
+             * Compiler (v20130823) failing to detect the entire expression as a boolean.
+             */
+            return s == "iOS" && !!userAgent.match(/(iPod|iPhone|iPad)/) && !!userAgent.match(/AppleWebKit/) || s == "MSIE" && !!userAgent.match(/(MSIE|Trident)/) || (userAgent.indexOf(s) >= 0);
+        }
+        return false;
+    }
+
+    /**
+     * isMobile()
+     *
+     * Check the browser's user-agent string for the substring "Mobi", as per Mozilla recommendation:
+     *
+     *      https://developer.mozilla.org/en-US/docs/Browser_detection_using_the_user_agent
+     *
+     * @return {boolean} is true if the browser appears to be a mobile (ie, non-desktop) web browser, false if not
+     */
+    static isMobile()
+    {
+        return Web.isUserAgent("Mobi");
+    }
+
+    /**
+     * getURLParm(sParm)
+     *
+     * @param {string} sParm
+     * @return {string|undefined}
+     */
+    static getURLParm(sParm)
+    {
+        if (!Web.parmsURL) {
+            Web.parmsURL = Web.parseURLParms();
+        }
+        return Web.parmsURL[sParm];
+    }
+
+    /**
+     * parseURLParms(sParms)
+     *
+     * @param {string} [sParms] containing the parameter portion of a URL (ie, after the '?')
+     * @return {Object} containing properties for each parameter found
+     */
+    static parseURLParms(sParms)
+    {
+        var aParms = {};
+        if (window) {       // an alternative to "if (typeof module === 'undefined')" if require("defines") was used
+            if (!sParms) {
+                /*
+                 * Note that window.location.href returns the entire URL, whereas window.location.search
+                 * returns only the parameters, if any (starting with the '?', which we skip over with a substr() call).
+                 */
+                sParms = window.location.search.substr(1);
+            }
+            var match;
+            var pl = /\+/g; // RegExp for replacing addition symbol with a space
+            var search = /([^&=]+)=?([^&]*)/g;
+            var decode = function(s)
+            {
+                return decodeURIComponent(s.replace(pl, " "));
+            };
+
+            while ((match = search.exec(sParms))) {
+                aParms[decode(match[1])] = decode(match[2]);
+            }
+        }
+        return aParms;
+    }
+
+    /**
+     * downloadFile(sData, sType, fBase64, sFileName)
+     *
+     * @param {string} sData
+     * @param {string} sType
+     * @param {boolean} [fBase64]
+     * @param {string} [sFileName]
+     */
+    static downloadFile(sData, sType, fBase64, sFileName)
+    {
+        var link = null, sAlert;
+        var sURI = "data:application/" + sType + (fBase64? ";base64" : "") + ",";
+
+        if (!Web.isUserAgent("Firefox")) {
+            sURI += (fBase64? sData : encodeURI(sData));
+        } else {
+            sURI += (fBase64? sData : encodeURIComponent(sData));
+        }
+        if (sFileName) {
+            link = document.createElement('a');
+            if (typeof link.download != 'string') link = null;
+        }
+        if (link) {
+            link.href = sURI;
+            link.download = sFileName;
+            document.body.appendChild(link);    // Firefox allegedly requires the link to be in the body
+            link.click();
+            document.body.removeChild(link);
+            sAlert = 'Check your Downloads folder for ' + sFileName + '.';
+        } else {
+            window.open(sURI);
+            sAlert = 'Check your browser for a new window/tab containing the requested data' + (sFileName? (' (' + sFileName + ')') : '') + '.';
+        }
+        return sAlert;
+    }
+
+    /**
+     * onCountRepeat(n, fnRepeat, fnComplete, msDelay)
+     *
+     * Call fnRepeat() n times with an msDelay millisecond delay between calls,
+     * then call fnComplete() when n has been exhausted OR fnRepeat() returns false.
+     *
+     * @param {number} n
+     * @param {function()} fnRepeat
+     * @param {function()} fnComplete
+     * @param {number} [msDelay]
+     */
+    static onCountRepeat(n, fnRepeat, fnComplete, msDelay)
+    {
+        var fnTimeout = function doCountRepeat()
+        {
+            n -= 1;
+            if (n >= 0) {
+                if (!fnRepeat()) n = 0;
+            }
+            if (n > 0) {
+                setTimeout(fnTimeout, msDelay || 0);
+                return;
+            }
+            fnComplete();
+        };
+        fnTimeout();
+    }
+
+    /**
+     * onClickRepeat(e, msDelay, msRepeat, fn)
+     *
+     * Repeatedly call fn() with an initial msDelay, and an msRepeat delay thereafter,
+     * as long as HTML control Object e has an active "down" event and fn() returns true.
+     *
+     * @param {Object} e
+     * @param {number} msDelay
+     * @param {number} msRepeat
+     * @param {function(boolean)} fn is passed false on the first call, true on all repeated calls
+     */
+    static onClickRepeat(e, msDelay, msRepeat, fn)
+    {
+        var ms = 0, timer = null, fIgnoreMouseEvents = false;
+
+        var fnRepeat = function doClickRepeat()
+        {
+            if (fn(ms === msRepeat)) {
+                timer = setTimeout(fnRepeat, ms);
+                ms = msRepeat;
+            }
+        };
+        e.onmousedown = function()
+        {
+            // Web.log("onMouseDown()");
+            if (!fIgnoreMouseEvents) {
+                if (!timer) {
+                    ms = msDelay;
+                    fnRepeat();
+                }
+            }
+        };
+        e.ontouchstart = function()
+        {
+            // Web.log("onTouchStart()");
+            if (!timer) {
+                ms = msDelay;
+                fnRepeat();
+            }
+        };
+        e.onmouseup = e.onmouseout = function()
+        {
+            // Web.log("onMouseUp()/onMouseOut()");
+            if (timer) {
+                clearTimeout(timer);
+                timer = null;
+            }
+        };
+        e.ontouchend = e.ontouchcancel = function()
+        {
+            // Web.log("onTouchEnd()/onTouchCancel()");
+            if (timer) {
+                clearTimeout(timer);
+                timer = null;
+            }
+            /*
+             * Devices that generate ontouch* events ALSO generate onmouse* events,
+             * and generally do so immediately after all the touch events are complete,
+             * so unless we want double the action, we need to ignore mouse events.
+             */
+            fIgnoreMouseEvents = true;
+        };
+    }
+
+    /**
+     * onPageEvent(sName, fn)
+     *
+     * For 'onload', 'onunload', and 'onpageshow' events, most callers should NOT use this function, but
+     * instead use Web.onInit(), Web.onShow(), and Web.onExit(), respectively.
+     *
+     * The only components that should still use onPageEvent() are THIS component (see the bottom of this file)
+     * and components that need to capture other events (eg, the 'onresize' event in the Video component).
+     *
+     * This function creates a chain of callbacks, allowing multiple JavaScript modules to define handlers
+     * for the same event, which wouldn't be possible if everyone modified window['onload'], window['onunload'],
+     * etc, themselves.  However, that's less of a concern now, because assuming everyone else is now using
+     * onInit(), onExit(), etc, then there really IS only one component setting the window callback: this one.
+     *
+     * NOTE: It's risky to refer to obscure event handlers with "dot" names, because the Closure Compiler may
+     * erroneously replace them (eg, window.onpageshow is a good example).
+     *
+     * @param {string} sFunc
+     * @param {function()} fn
+     */
+    static onPageEvent(sFunc, fn)
+    {
+        if (window) {
+            var fnPrev = window[sFunc];
+            if (typeof fnPrev !== 'function') {
+                window[sFunc] = fn;
+            } else {
+                /*
+                 * TODO: Determine whether there's any value in receiving/sending the Event object that the
+                 * browser provides when it generates the original event.
+                 */
+                window[sFunc] = function onWindowEvent()
+                {
+                    if (fnPrev) fnPrev();
+                    fn();
+                };
+            }
+        }
+    };
+
+    /**
+     * onInit(fn)
+     *
+     * Use this instead of setting window.onload.  Allows multiple JavaScript modules to define their own 'onload' event handler.
+     *
+     * @param {function()} fn
+     */
+    static onInit(fn)
+    {
+        Web.aPageEventHandlers['init'].push(fn);
+    };
+
+    /**
+     * onShow(fn)
+     *
+     * @param {function()} fn
+     *
+     * Use this instead of setting window.onpageshow.  Allows multiple JavaScript modules to define their own 'onpageshow' event handler.
+     */
+    static onShow(fn)
+    {
+        Web.aPageEventHandlers['show'].push(fn);
+    };
+
+    /**
+     * onExit(fn)
+     *
+     * @param {function()} fn
+     *
+     * Use this instead of setting window.onunload.  Allows multiple JavaScript modules to define their own 'onunload' event handler.
+     */
+    static onExit(fn)
+    {
+        Web.aPageEventHandlers['exit'].push(fn);
+    };
+
+    /**
+     * doPageEvent(afn)
+     *
+     * @param {Array.<function()>} afn
+     */
+    static doPageEvent(afn)
+    {
+        if (Web.fPageEventsEnabled) {
+            try {
+                for (var i = 0; i < afn.length; i++) {
+                    afn[i]();
+                }
+            } catch (e) {
+                Web.notice("An unexpected exception occurred:\n\n" + e.message + "\n\nPlease send this information to support@pcjs.org. Thanks.");
+            }
+        }
+    };
+
+    /**
+     * enablePageEvents(fEnable)
+     *
+     * @param {boolean} fEnable is true to enable page events, false to disable (they're enabled by default)
+     */
+    static enablePageEvents(fEnable)
+    {
+        if (!Web.fPageEventsEnabled && fEnable) {
+            Web.fPageEventsEnabled = true;
+            if (Web.fPageLoaded) Web.sendPageEvent('init');
+            if (Web.fPageShowed) Web.sendPageEvent('show');
+            return;
+        }
+        Web.fPageEventsEnabled = fEnable;
+    }
+
+    /**
+     * sendPageEvent(sEvent)
+     *
+     * This allows us to manually trigger page events.
+     *
+     * @param {string} sEvent (one of 'init', 'show' or 'exit')
+     */
+    static sendPageEvent(sEvent)
+    {
+        if (Web.aPageEventHandlers[sEvent]) {
+            Web.doPageEvent(Web.aPageEventHandlers[sEvent]);
+        }
+    }
+}
+
+Web.parmsURL = null;            // initialized on first call to parseURLParms()
+
+Web.aPageEventHandlers = {
+    'init': [],                 // list of window 'onload' handlers
+    'show': [],                 // list of window 'onpageshow' handlers
+    'exit': []                  // list of window 'onunload' handlers (although we prefer to use 'onbeforeunload' if possible)
+};
+
+Web.fPageLoaded = false;        // set once the page's first 'onload' event has occurred
+Web.fPageShowed = false;        // set once the page's first 'onpageshow' event has occurred
+Web.fPageEventsEnabled = true;  // default is true, set to false (or true) by enablePageEvents()
+
+/**
+ * fLocalStorage
+ *
+ * true if localStorage support exists, is enabled, and works; "falsey" otherwise
+ *
+ * @type {boolean|null}
+ */
+Web.fLocalStorage = null;
+
+/**
+ * TODO: Is there any way to get the Closure Compiler to stop inlining this string?  This isn't cutting it.
+ *
+ * @const {string}
+ */
+Web.sLocalStorageTest = "PCjs.localStorage";
+
+Web.onPageEvent('onload', function onPageLoad() {
+    Web.fPageLoaded = true;
+    Web.doPageEvent(Web.aPageEventHandlers['init']);
+});
+
+Web.onPageEvent('onpageshow', function onPageShow() {
+    Web.fPageShowed = true;
+    Web.doPageEvent(Web.aPageEventHandlers['show']);
+});
+
+Web.onPageEvent(Web.isUserAgent("Opera") || Web.isUserAgent("iOS")? 'onunload' : 'onbeforeunload', function onPageUnload() {
+    Web.doPageEvent(Web.aPageEventHandlers['exit']);
+});
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/component.js (C) Jeff Parsons 2012-2017
+ */
+
+/*
+ * All PCjs components now use JSDoc types, primarily so that Google's Closure Compiler will compile
+ * everything with zero warnings when ADVANCED_OPTIMIZATIONS are enabled.  For more information about
+ * the JSDoc types supported by the Closure Compiler:
+ *
+ *      https://developers.google.com/closure/compiler/docs/js-for-compiler#types
+ *
+ * I also attempted to validate this code with JSLint, but it complained too much; eg, it didn't like
+ * "while (true)", a tried and "true" programming convention for decades, and it wanted me to replace
+ * all "++" and "--" operators with "+= 1" and "-= 1", use "(s || '')" instead of "(s? s : '')", etc.
+ *
+ * I prefer sticking with traditional C-style idioms, in part because they are more portable.  That
+ * does NOT mean I'm trying to write "portable JavaScript," but some of this code was ported from C code
+ * I'd written long ago, so portability is good, and I'm not going to throw that away if there's no need.
+ *
+ * UPDATE: I've since switched from JSLint to JSHint, which seems to have more reasonable defaults.
+ * And for new code, I have adopted some popular JavaScript idioms, like "(s || '')", although the need
+ * for those kinds of expressions will be reduced as I also start adopting some ES6 features, like
+ * default parameters.
+ */
+
+
+/**
+ * Since the Closure Compiler treats ES6 classes as @struct rather than @dict by default,
+ * it deters us from defining named properties on our components; eg:
+ *
+ *      this['exports'] = {...}
+ *
+ * results in an error:
+ *
+ *      Cannot do '[]' access on a struct
+ *
+ * So, in order to define 'exports', we must override the @struct assumption by annotating
+ * the class as @unrestricted (or @dict).  Note that this must be done both here and in the
+ * subclass (eg, SerialPort), because otherwise the Compiler won't allow us to *reference*
+ * the named property either.
+ *
+ * TODO: Consider marking ALL our classes unrestricted, because otherwise it forces us to
+ * define every single property the class uses in its constructor, which results in a fair
+ * bit of redundant initialization, since many properties aren't (and don't need to be) fully
+ * initialized until the appropriate init(), reset(), restore(), etc. function is called.
+ *
+ * The upside, however, may be that since the structure of the class is completely defined by
+ * the constructor, JavaScript engines may be able to optimize and run more efficiently.
+ *
+ * @unrestricted
+ */
+class Component {
+    /**
+     * Component(type, parms, bitsMessage)
+     *
+     * A Component object requires:
+     *
+     *      type: a user-defined type name (eg, "CPU")
+     *
+     * and accepts any or all of the following (parms) properties:
+     *
+     *      id: component ID (default is "")
+     *      name: component name (default is ""; if blank, toString() will use the type name only)
+     *      comment: component comment string (default is undefined)
+     *
+     * Component subclasses will usually have additional (parms) properties.
+     *
+     * @param {string} type
+     * @param {Object} [parms]
+     * @param {number} [bitsMessage] selects message(s) that the component wants to enable (default is 0)
+     */
+    constructor(type, parms, bitsMessage)
+    {
+        this.type = type;
+
+        if (!parms) parms = {'id': "", 'name': ""};
+
+        this.id = parms['id'] || "";
+        this.name = parms['name'];
+        this.comment = parms['comment'];
+        this.parms = parms;
+
+        /*
+         * The following Component properties need to be accessible by other machines and/or command scripts;
+         * well, OK, or we could have exported some new functions to walk the contents of these properties, as we
+         * did with findMachineComponent(), but this works just as well.
+         *
+         * Also, while the double-assignment looks silly (ie, using both dot and bracket property notation), it
+         * resolves a complaint from the Closure Compiler, because if we use ONLY bracket notation here, then the
+         * Compiler wants us to change all the other references to bracket notation as well.
+         */
+        this.exports = this['exports'] = {};
+        this.bindings = this['bindings'] = {};
+
+        var i = this.id.indexOf('.');
+        if (i < 0) {
+            this.idComponent = this.id;
+        } else {
+            this.idMachine = this.id.substr(0, i);
+            this.idComponent = this.id.substr(i + 1);
+        }
+
+        /*
+         * Gather all the various component flags (booleans) into a single "flags" object, and encourage
+         * subclasses to do the same, to reduce the property clutter we have to wade through while debugging.
+         */
+        this.flags = {
+            ready:      false,
+            busy:       false,
+            busyCancel: false,
+            powered:    false,
+            error:      false
+        };
+
+        this.fnReady = null;
+        this.clearError();
+        this.bitsMessage = bitsMessage || 0;
+
+        /** @type {Object|null} controlPrint is the HTML control, if any, that we can print to */
+        this.controlPrint = null;
+
+        this.cmp = null;
+        this.bus = null;
+        this.cpu = null;
+        this.dbg = null;
+
+        /*
+         * TODO: Consider adding another parameter to the Component() constructor that allows components to tell
+         * us if they support single or multiple instances per machine.  For example, there can be multiple SerialPort
+         * components per machine, but only one CPU component (some machines also support an FPU, but that component
+         * is considered separate from the CPU).
+         *
+         * It's not critical, but it would help catch machine configuration errors; for example, a machine that mistakenly
+         * includes two CPU components may, aside from wasting memory, end up with odd side-effects, like unresponsive
+         * CPU controls.
+         */
+        Component.add(this);
+    }
+
+    /**
+     * Component.add(component)
+     *
+     * @param {Component} component
+     */
+    static add(component)
+    {
+        /*
+         * This just generates a lot of useless noise, handy in the early days, not so much these days....
+         *
+         *      if (DEBUG) Component.log("Component.add(" + component.type + "," + component.id + ")");
+         */
+        Component.components.push(component);
+    }
+
+    /**
+     * Component.addMachine(idMachine)
+     *
+     * @param {string} idMachine
+     */
+    static addMachine(idMachine)
+    {
+        Component.machines[idMachine] = {};
+    }
+
+    /**
+     * Component.addMachineResource(idMachine, sName, data)
+     *
+     * @param {string} idMachine
+     * @param {string|null} sName (name of the resource)
+     * @param {*} data
+     */
+    static addMachineResource(idMachine, sName, data)
+    {
+        /*
+         * I used to assert(Component.machines[idMachine]), but when we're running as a Node app, embed.js is not used,
+         * so addMachine() is never called, so resources do not need to be recorded.
+         */
+        if (Component.machines[idMachine] && sName) {
+            Component.machines[idMachine][sName] = data;
+        }
+    }
+
+    /**
+     * Component.getMachineResources(idMachine)
+     *
+     * @param {string} idMachine
+     * @return {Object|undefined}
+     */
+    static getMachineResources(idMachine)
+    {
+        return Component.machines[idMachine];
+    }
+
+    /**
+     * Component.getTime()
+     *
+     * @return {number} the current time, in milliseconds
+     */
+    static getTime()
+    {
+        return Date.now() || +new Date();
+    }
+
+    /**
+     * Component.log(s, type)
+     *
+     * For diagnostic output only.
+     *
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     */
+    static log(s, type)
+    {
+        if (!COMPILED) {
+            if (s) {
+                var sElapsed = "", sMsg = (type? (type + ": ") : "") + s;
+                if (typeof Usr != "undefined") {
+                    if (Component.msStart === undefined) {
+                        Component.msStart = Component.getTime();
+                    }
+                    sElapsed = (Component.getTime() - Component.msStart) + "ms: ";
+                }
+                if (window && window.console) console.log(sElapsed + sMsg.replace(/\n/g, " "));
+            }
+        }
+    }
+
+    /**
+     * Component.assert(f, s)
+     *
+     * Verifies conditions that must be true (for DEBUG builds only).
+     *
+     * The Closure Compiler should automatically remove all references to Component.assert() in non-DEBUG builds.
+     * TODO: Add a task to the build process that "asserts" there are no instances of "assertion failure" in RELEASE builds.
+     *
+     * @param {boolean} f is the expression we are asserting to be true
+     * @param {string} [s] is description of the assertion on failure
+     */
+    static assert(f, s)
+    {
+        if (DEBUG) {
+            if (!f) {
+                if (!s) s = "assertion failure";
+                Component.log(s);
+                throw new Error(s);
+            }
+        }
+    }
+
+    /**
+     * Component.println(s, type, id)
+     *
+     * For non-diagnostic messages, which components may override to control the destination/appearance of their output.
+     *
+     * Components that inherit from this class should use the instance method, this.println(), rather than Component.println(),
+     * because if a Control Panel is loaded, it will override only the instance method, not the class method (overriding the class
+     * method would improperly affect any other machines loaded on the same page).
+     *
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     * @param {string} [id] is the caller's ID, if any
+     */
+    static println(s, type, id)
+    {
+        if (!COMPILED) {
+            Component.log((id? (id + ": ") : "") + (s? ("\"" + s + "\"") : ""), type);
+        }
+    }
+
+    /**
+     * Component.notice(s, fPrintOnly, id)
+     *
+     * notice() is like println() but implies a need for user notification, so we alert() as well.
+     *
+     * @param {string} s is the message text
+     * @param {boolean} [fPrintOnly]
+     * @param {string} [id] is the caller's ID, if any
+     */
+    static notice(s, fPrintOnly, id)
+    {
+        if (!COMPILED) {
+            Component.println(s, "notice", id);
+        }
+        if (!fPrintOnly) Component.alertUser((id? (id + ": ") : "") + s);
+    }
+
+    /**
+     * Component.warning(s)
+     *
+     * @param {string} s describes the warning
+     */
+    static warning(s)
+    {
+        if (!COMPILED) {
+            Component.println(s, "warning");
+        }
+        Component.alertUser(s);
+    }
+
+    /**
+     * Component.error(s)
+     *
+     * @param {string} s describes the error; an alert() is displayed as well
+     */
+    static error(s)
+    {
+        if (!COMPILED) {
+            Component.println(s, "error");
+        }
+        Component.alertUser(s);
+    }
+
+    /**
+     * Component.alertUser(sMessage)
+     *
+     * @param {string} sMessage
+     */
+    static alertUser(sMessage)
+    {
+        if (window) {
+            window.alert(sMessage);
+        } else {
+            Component.log(sMessage);
+        }
+    };
+
+    /**
+     * Component.confirmUser(sPrompt)
+     *
+     * @param {string} sPrompt
+     * @returns {boolean} true if the user clicked OK, false if Cancel/Close
+     */
+    static confirmUser(sPrompt)
+    {
+        var fResponse = false;
+        if (window) {
+            fResponse = window.confirm(sPrompt);
+        }
+        return fResponse;
+    }
+
+    /**
+     * Component.promptUser()
+     *
+     * @param {string} sPrompt
+     * @param {string} [sDefault]
+     * @returns {string|null}
+     */
+    static promptUser(sPrompt, sDefault)
+    {
+        var sResponse = null;
+        if (window) {
+            sResponse = window.prompt(sPrompt, sDefault === undefined? "" : sDefault);
+        }
+        return sResponse;
+    }
+
+    /**
+     * Component.getComponents(idRelated)
+     *
+     * We could store components as properties, using the component's ID, and change
+     * this linear lookup into a property lookup, but some components may have no ID.
+     *
+     * @param {string} [idRelated] of related component
+     * @return {Array} of components
+     */
+    static getComponents(idRelated)
+    {
+        var i;
+        var aComponents = [];
+        /*
+         * getComponentByID(id, idRelated)
+         *
+         * If idRelated is provided, we check it for a machine prefix, and use any
+         * existing prefix to constrain matches to IDs with the same prefix, in order to
+         * avoid matching components belonging to other machines.
+         */
+        if (idRelated) {
+            if ((i = idRelated.indexOf('.')) > 0)
+                idRelated = idRelated.substr(0, i + 1);
+            else
+                idRelated = "";
+        }
+        for (i = 0; i < Component.components.length; i++) {
+            var component = Component.components[i];
+            if (!idRelated || !component.id.indexOf(idRelated)) {
+                aComponents.push(component);
+            }
+        }
+        return aComponents;
+    }
+
+    /**
+     * Component.getComponentByID(id, idRelated)
+     *
+     * We could store components as properties, using the component's ID, and change
+     * this linear lookup into a property lookup, but some components may have no ID.
+     *
+     * @param {string} id of the desired component
+     * @param {string} [idRelated] of related component
+     * @return {Component|null}
+     */
+    static getComponentByID(id, idRelated)
+    {
+        if (id !== undefined) {
+            var i;
+            /*
+             * If idRelated is provided, we check it for a machine prefix, and use any
+             * existing prefix to constrain matches to IDs with the same prefix, in order to
+             * avoid matching components belonging to other machines.
+             */
+            if (idRelated && (i = idRelated.indexOf('.')) > 0) {
+                id = idRelated.substr(0, i + 1) + id;
+            }
+            for (i = 0; i < Component.components.length; i++) {
+                if (Component.components[i].id === id) {
+                    return Component.components[i];
+                }
+            }
+            if (Component.components.length) {
+                Component.log("Component ID '" + id + "' not found", "warning");
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Component.getComponentByType(sType, idRelated, componentPrev)
+     *
+     * @param {string} sType of the desired component
+     * @param {string} [idRelated] of related component
+     * @param {Component|null} [componentPrev] of previously returned component, if any
+     * @return {Component|null}
+     */
+    static getComponentByType(sType, idRelated, componentPrev)
+    {
+        if (sType !== undefined) {
+            var i;
+            /*
+             * If idRelated is provided, we check it for a machine prefix, and use any
+             * existing prefix to constrain matches to IDs with the same prefix, in order to
+             * avoid matching components belonging to other machines.
+             */
+            if (idRelated) {
+                if ((i = idRelated.indexOf('.')) > 0) {
+                    idRelated = idRelated.substr(0, i + 1);
+                } else {
+                    idRelated = "";
+                }
+            }
+            for (i = 0; i < Component.components.length; i++) {
+                if (componentPrev) {
+                    if (componentPrev == Component.components[i]) componentPrev = null;
+                    continue;
+                }
+                if (sType == Component.components[i].type && (!idRelated || !Component.components[i].id.indexOf(idRelated))) {
+                    return Component.components[i];
+                }
+            }
+            Component.log("Component type '" + sType + "' not found", "warning");
+        }
+        return null;
+    }
+
+    /**
+     * Component.getComponentParms(element)
+     *
+     * @param {Object} element from the DOM
+     */
+    static getComponentParms(element)
+    {
+        var parms = null;
+        var sParms = element.getAttribute("data-value");
+        if (sParms) {
+            try {
+                parms = eval("(" + sParms + ")");   // jshint ignore:line
+                /*
+                 * We can no longer invoke removeAttribute() because some components (eg, Panel) need
+                 * to run their initXXX() code more than once, to avoid initialization-order dependencies.
+                 *
+                 *      if (!DEBUG) {
+                 *          element.removeAttribute("data-value");
+                 *      }
+                 */
+            } catch(e) {
+                Component.error(e.message + " (" + sParms + ")");
+            }
+        }
+        return parms;
+    }
+
+    /**
+     * Component.bindExternalControl(component, sControl, sBinding, sType)
+     *
+     * @param {Component} component
+     * @param {string} sControl
+     * @param {string} sBinding
+     * @param {string} [sType] is the external component type
+     */
+    static bindExternalControl(component, sControl, sBinding, sType)
+    {
+        if (sControl) {
+            if (sType === undefined) sType = "Panel";
+            var target = Component.getComponentByType(sType, component.id);
+            if (target) {
+                var eBinding = target.bindings[sControl];
+                if (eBinding) {
+                    component.setBinding(null, sBinding, eBinding);
+                }
+            }
+        }
+    }
+
+    /**
+     * Component.bindComponentControls(component, element, sAppClass)
+     *
+     * @param {Component} component
+     * @param {Object} element from the DOM
+     * @param {string} sAppClass
+     */
+    static bindComponentControls(component, element, sAppClass)
+    {
+        var aeControls = Component.getElementsByClass(element.parentNode, sAppClass + "-control");
+
+        for (var iControl = 0; iControl < aeControls.length; iControl++) {
+
+            var aeChildNodes = aeControls[iControl].childNodes;
+
+            for (var iNode = 0; iNode < aeChildNodes.length; iNode++) {
+                var control = aeChildNodes[iNode];
+                if (control.nodeType !== 1 /* document.ELEMENT_NODE */) {
+                    continue;
+                }
+                var sClass = control.getAttribute("class");
+                if (!sClass) continue;
+                var aClasses = sClass.split(" ");
+                for (var iClass = 0; iClass < aClasses.length; iClass++) {
+                    var parms;
+                    sClass = aClasses[iClass];
+                    switch (sClass) {
+                        case sAppClass + "-binding":
+                            parms = Component.getComponentParms(control);
+                            if (parms && parms['binding']) {
+                                component.setBinding(parms['type'], parms['binding'], control, parms['value']);
+                            } else if (!parms || parms['type'] != "description") {
+                                Component.log("Component '" + component.toString() + "' missing binding" + (parms? " for " + parms['type'] : ""), "warning");
+                            }
+                            iClass = aClasses.length;
+                            break;
+                        default:
+                            // if (DEBUG) Component.log("Component.bindComponentControls(" + component.toString() + "): unrecognized control class \"" + sClass + "\"", "warning");
+                            break;
+                    }
+                }
+            }
+        }
+    }
+
+    /**
+     * Component.getElementsByClass(element, sClass, sObjClass)
+     *
+     * This is a cross-browser helper function, since not all browser's support getElementsByClassName()
+     *
+     * TODO: This should probably be moved into weblib.js at some point, along with the control binding functions above,
+     * to keep all the browser-related code together.
+     *
+     * @param {Object} element from the DOM
+     * @param {string} sClass
+     * @param {string} [sObjClass]
+     * @return {Array|NodeList}
+     */
+    static getElementsByClass(element, sClass, sObjClass)
+    {
+        if (sObjClass) sClass += '-' + sObjClass + "-object";
+        /*
+         * Use the browser's built-in getElementsByClassName() if it appears to be available
+         * (for example, it's not available in IE8, but it should be available in IE9 and up)
+         */
+        if (element.getElementsByClassName) {
+            return element.getElementsByClassName(sClass);
+        }
+        var i, j, ae = [];
+        var aeAll = element.getElementsByTagName("*");
+        var re = new RegExp('(^| )' + sClass + '( |$)');
+        for (i = 0, j = aeAll.length; i < j; i++) {
+            if (re.test(aeAll[i].className)) {
+                ae.push(aeAll[i]);
+            }
+        }
+        if (!ae.length) {
+            Component.log('No elements of class "' + sClass + '" found');
+        }
+        return ae;
+    }
+
+    /**
+     * Component.getScriptCommands(sScript)
+     *
+     * This is a simple parser that breaks sScript into an array of commands, where each command
+     * is an array of tokens, where tokens are sequences of characters separated by any of: tab, space,
+     * carriage-return (CR), line-feed (LF), semicolon, single-quote, or double-quote;  if a quote is
+     * used, all characters up to the next matching quote become part of the token, allowing any of the
+     * other separators to be part of the token.  CR, LF and semicolon also serve to terminate a command,
+     * with semicolon being preferred, because it's 1) more visible, and 2) essential when the entire
+     * script is a multi-line string where all CR/LF were replaced by spaces (which is what Jekyll does,
+     * and since we can't change Jekyll, it's what our own MarkDown Front Matter parser does as well;
+     * see convertMD() in markout.js, where the aCommandDefs array is built).
+     *
+     * Backslash sequences like \n, \r, and \\ have already been converted to LF, CR and backslash
+     * characters, since the entire script string is injected into a JavaScript function call, so any
+     * backslash sequence that JavaScript supports is automatically converted:
+     *
+     *      \0  \'  \"  \\  \n  \r  \v  \t  \b  \f  \uXXXX \xXX
+     *                      ^J  ^M  ^K  ^I  ^H  ^L
+     *
+     * To support any other non-printable 8-bit character, such as ESC, you should use \xXX, where XX
+     * is the ASCII code in hex.  For ESC, that would \x1B.
+     *
+     * @param {string} sScript
+     * @return {Array}
+     */
+    static getScriptCommands(sScript)
+    {
+        var cch = sScript.length;
+        var aCommands = [], aTokens = [], sToken = "", chQuote = null;
+        for (var i = 0; i < cch; i++) {
+            var ch = sScript[i];
+            if (ch == '"' || ch == "'") {
+                if (chQuote && ch != chQuote) {
+                    sToken += ch;
+                    continue;
+                }
+                if (!chQuote) {
+                    chQuote = ch;
+                } else {
+                    chQuote = null;
+                }
+                if (sToken) {
+                    aTokens.push(sToken);
+                    sToken = "";
+                }
+                continue;
+            }
+            if (!chQuote) {
+                if (ch == '\r' || ch == '\n') {
+                    ch = ';';
+                }
+                if (ch == ' ' || ch == '\t' || ch == ';') {
+                    if (sToken) {
+                        aTokens.push(sToken);
+                        sToken = "";
+                    }
+                    if (ch == ';' && aTokens.length) {
+                        aCommands.push(aTokens);
+                        aTokens = [];
+                    }
+                    continue;
+                }
+            }
+            sToken += ch;
+        }
+        if (sToken) {
+            aTokens.push(sToken);
+        }
+        if (aTokens.length) {
+            aCommands.push(aTokens);
+        }
+        return aCommands;
+    }
+
+    /**
+     * Component.processScript(idMachine, sScript)
+     *
+     * @param {string} idMachine
+     * @param {string} sScript
+     * @return {boolean}
+     */
+    static processScript(idMachine, sScript)
+    {
+        var fSuccess = false;
+        idMachine += ".machine";
+        if (typeof sScript == "string" && !Component.commands[idMachine]) {
+            fSuccess = true;
+            Component.commands[idMachine] = Component.getScriptCommands(sScript);
+            if (!Component.processCommands(idMachine)) {
+                fSuccess = false;
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * Component.processCommands(idMachine)
+     *
+     * @param {string} idMachine
+     * @return {boolean}
+     */
+    static processCommands(idMachine)
+    {
+        var fSuccess = true;
+        var aCommands = Component.commands[idMachine];
+
+     // var dbg = Component.getComponentByType("Debugger", idMachine);
+
+        while (aCommands && aCommands.length) {
+
+            var aTokens = aCommands.splice(0, 1)[0];
+            var sCommand = aTokens[0];
+
+            /*
+             * It's possible to route this output to the Debugger window with dbg.println()
+             * instead, but it's a bit too confusing mingling script output in a window that
+             * already mingles Debugger and machine output.
+             */
+            Component.println('script: ' + aTokens.join(' '));
+
+            var fnCallReady = null;
+            if (Component.asyncCommands.indexOf(sCommand) >= 0) {
+                fnCallReady = function processNextCommand() {
+                    return function() {
+                        Component.processCommands(idMachine);
+                    }
+                }();
+            }
+
+            var fnCommand = Component.globalCommands[sCommand];
+            if (fnCommand) {
+                if (!fnCallReady) {
+                    fSuccess = fnCommand(aTokens[1], aTokens[2], aTokens[3]);
+                } else {
+                    if (!fnCommand(fnCallReady, aTokens[1], aTokens[2], aTokens[3])) break;
+                }
+            }
+            else {
+                fSuccess = false;
+                var component = Component.getComponentByType(aTokens[1], idMachine);
+                if (component) {
+                    fnCommand = Component.componentCommands[sCommand];
+                    if (fnCommand) {
+                        fSuccess = fnCommand(component, aTokens[2], aTokens[3]);
+                    }
+                    else {
+                        var exports = component['exports'];
+                        if (exports) {
+                            fnCommand = exports[sCommand];
+                            if (fnCommand) {
+                                fSuccess = true;
+                                if (!fnCallReady) {
+                                    fSuccess = fnCommand.call(component, aTokens[2], aTokens[3]);
+                                } else {
+                                    if (!fnCommand.call(component, fnCallReady, aTokens[2], aTokens[3])) break;
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+
+            if (!fSuccess) {
+                Component.alertUser("Script error: " + sCommand + (fnCommand? " failed" : " unrecognized"));
+                break;
+            }
+        }
+
+        if (aCommands && !aCommands.length) {
+            delete Component.commands[idMachine];
+        }
+
+        return fSuccess;
+    }
+
+    /**
+     * Component.scriptAlert(sMessage)
+     *
+     * @param {string} sMessage
+     * @return {boolean}
+     */
+    static scriptAlert(sMessage)
+    {
+        Component.alertUser(sMessage);
+        return true;
+    }
+
+    /**
+     * Component.scriptSelect(component, sBinding, sValue)
+     *
+     * @param {Component} component
+     * @param {string} sBinding
+     * @param {string} sValue
+     * @return {boolean}
+     */
+    static scriptSelect(component, sBinding, sValue)
+    {
+        var fSuccess = false;
+        var aBindings = component['bindings'];
+        var control = aBindings[sBinding];
+        if (control) {
+            for (var i = 0; i < control.options.length; i++) {
+                if (control.options[i].textContent == sValue) {
+                    if (control.selectedIndex != i) {
+                        control.selectedIndex = i;
+                    }
+                    fSuccess = true;
+                    break;
+                }
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * Component.scriptSleep(fnCallback, sDelay)
+     *
+     * @param {function()} fnCallback
+     * @param {string} sDelay (in milliseconds)
+     * @return {boolean}
+     */
+    static scriptSleep(fnCallback, sDelay)
+    {
+        setTimeout(fnCallback, +sDelay);
+        return false;
+    }
+
+    /**
+     * toString()
+     *
+     * @this {Component}
+     * @return {string}
+     */
+    toString() {
+        return (this.name? this.name : (this.id || this.type));
+    }
+
+    /**
+     * getMachineNum()
+     *
+     * @this {Component}
+     * @return {number} unique machine number
+     */
+    getMachineNum() {
+        var nMachine = 1;
+        if (this.idMachine) {
+            var aDigits = this.idMachine.match(/\d+/);
+            if (aDigits !== null)
+                nMachine = parseInt(aDigits[0], 10);
+        }
+        return nMachine;
+    }
+
+    /**
+     * setBinding(sHTMLType, sBinding, control, sValue)
+     *
+     * Component's setBinding() method is intended to be overridden by subclasses.
+     *
+     * @this {Component}
+     * @param {string|null} sHTMLType is the type of the HTML control (eg, "button", "list", "text", "submit", "textarea", "canvas")
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "reset")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sHTMLType, sBinding, control, sValue) {
+        switch (sBinding) {
+        case "clear":
+            if (!this.bindings[sBinding]) {
+                this.bindings[sBinding] = control;
+                control.onclick = (function(component) {
+                    return function clearPanel() {
+                        if (component.bindings['print']) {
+                            component.bindings['print'].value = "";
+                        }
+                    };
+                }(this));
+            }
+            return true;
+        case "print":
+            if (!this.bindings[sBinding]) {
+                this.bindings[sBinding] = control;
+                /*
+                 * HACK: Save this particular HTML element so that the Debugger can access it, too
+                 */
+                this.controlPrint = control;
+                /*
+                 * This was added for Firefox (Safari automatically clears the <textarea> on a page reload,
+                 * but Firefox does not).
+                 */
+                control.value = "";
+                this.println = (function(control) {
+                    return function printPanel(s, type) {
+                        s = (type !== undefined? (type + ": ") : "") + (s || "");
+                        /*
+                         * Prevent the <textarea> from getting too large; otherwise, printing becomes slower and slower.
+                         */
+                        if (COMPILED) {
+                            if (control.value.length > 8192) {
+                                control.value = control.value.substr(control.value.length - 4096);
+                            }
+                        }
+                        control.value += s + "\n";
+                        control.scrollTop = control.scrollHeight;
+                        if (!COMPILED && window && window.console) console.log(s);
+                    };
+                }(control));
+                /**
+                 * Override this.notice() with a replacement function that eliminates the Component.alertUser() call
+                 *
+                 * @this {Component}
+                 * @param {string} s
+                 * @param {boolean} [fPrintOnly]
+                 * @param {string} [id]
+                 */
+                this.notice = function noticePanel(s, fPrintOnly, id) {
+                    this.println(s, this.idComponent);
+                };
+            }
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    /**
+     * log(s, type)
+     *
+     * For diagnostic output only.
+     *
+     * WARNING: Even though this function's body is completely wrapped in DEBUG, that won't prevent the Closure Compiler
+     * from including it, so all calls must still be prefixed with "if (DEBUG) ....".  For this reason, the class method,
+     * Component.log(), is preferred, because the compiler IS smart enough to remove those calls.
+     *
+     * @this {Component}
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     */
+    log(s, type) {
+        if (!COMPILED) {
+            Component.log(s, type || this.id || this.type);
+        }
+    }
+
+    /**
+     * assert(f, s)
+     *
+     * Verifies conditions that must be true (for DEBUG builds only).
+     *
+     * WARNING: Make sure you preface all calls to this.assert() with "if (DEBUG)", because unlike Component.assert(),
+     * the Closure Compiler can't be sure that this instance method hasn't been overridden, so it refuses to treat it as
+     * dead code in non-DEBUG builds.
+     *
+     * TODO: Add a task to the build process that "asserts" there are no instances of "assertion failure" in RELEASE builds.
+     *
+     * @this {Component}
+     * @param {boolean|number} f is the expression asserted to be true
+     * @param {string} [s] is a description of the assertion to be displayed or logged on failure
+     */
+    assert(f, s) {
+        if (DEBUG) {
+            if (!f) {
+                s = "assertion failure in " + (this.id || this.type) + (s? ": " + s : "");
+                if (DEBUGGER && this.dbg) {
+                    this.dbg.stopCPU();
+                    /*
+                     * Why do we throw an Error only to immediately catch and ignore it?  Simply to give
+                     * any IDE the opportunity to inspect the application's state.  Even when the IDE has
+                     * control, you should still be able to invoke Debugger commands from the IDE's REPL,
+                     * using the '$' global function that the Debugger constructor defines; eg:
+                     *
+                     *      $('r')
+                     *      $('dw 0:0')
+                     *      $('h')
+                     *      ...
+                     *
+                     * If you have no desire to stop on assertions, consider this a no-op.  However, another
+                     * potential benefit of creating an Error object is that, for browsers like Chrome, we get
+                     * a stack trace, too.
+                     */
+                    try {
+                        throw new Error(s);
+                    } catch(e) {
+                        this.println(e.stack || e.message);
+                    }
+                    return;
+                }
+                this.log(s);
+                throw new Error(s);
+            }
+        }
+    }
+
+    /**
+     * println(s, type)
+     *
+     * For non-diagnostic messages, which components may override to control the destination/appearance of their output.
+     *
+     * Components using this.println() should wait until after their constructor has run to display any messages, because
+     * if a Control Panel has been loaded, its override will not take effect until its own constructor has run.
+     *
+     * @this {Component}
+     * @param {string} [s] is the message text
+     * @param {string} [type] is the message type
+     * @param {string} [id] is the caller's ID, if any
+     */
+    println(s, type, id) {
+        Component.println(s, type, id || this.id);
+    }
+
+    /**
+     * status(s)
+     *
+     * status() is like println() but it also includes information about the component (ie, the component ID),
+     * which is why there is no corresponding Component.status() function.
+     *
+     * @param {string} s is the message text
+     */
+    status(s) {
+        this.println(this.idComponent + ": " + s);
+    }
+
+    /**
+     * notice(s, fPrintOnly)
+     *
+     * notice() is like println() but implies a need for user notification, so we alert() as well; however, if this.println()
+     * is overridden, this.notice will be replaced with a similar override, on the assumption that the override is taking care
+     * of alerting the user.
+     *
+     * @this {Component}
+     * @param {string} s is the message text
+     * @param {boolean} [fPrintOnly]
+     * @param {string} [id] is the caller's ID, if any
+     */
+    notice(s, fPrintOnly, id) {
+        Component.notice(s, fPrintOnly, id || this.type);
+    }
+
+    /**
+     * setError(s)
+     *
+     * Set a fatal error condition
+     *
+     * @this {Component}
+     * @param {string} s describes a fatal error condition
+     */
+    setError(s) {
+        this.flags.error = true;
+        this.notice(s);         // TODO: Any cases where we should still prefix this string with "Fatal error: "?
+    }
+
+    /**
+     * clearError()
+     *
+     * Clear any fatal error condition
+     *
+     * @this {Component}
+     */
+    clearError() {
+        this.flags.error = false;
+    }
+
+    /**
+     * isError()
+     *
+     * Report any fatal error condition
+     *
+     * @this {Component}
+     * @return {boolean} true if a fatal error condition exists, false if not
+     */
+    isError() {
+        if (this.flags.error) {
+            this.println(this.toString() + " error");
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * isReady(fnReady)
+     *
+     * Return the "ready" state of the component; if the component is not ready, it will queue the optional
+     * notification function, otherwise it will immediately call the notification function, if any, without queuing it.
+     *
+     * NOTE: Since only the Computer component actually cares about the "readiness" of other components, the so-called
+     * "queue" of notification functions supports exactly one function.  This keeps things nice and simple.
+     *
+     * @this {Component}
+     * @param {function()} [fnReady]
+     * @return {boolean} true if the component is in a "ready" state, false if not
+     */
+    isReady(fnReady) {
+        if (fnReady) {
+            if (this.flags.ready) {
+                fnReady();
+            } else {
+                if (MAXDEBUG) this.log("NOT ready");
+                this.fnReady = fnReady;
+            }
+        }
+        return this.flags.ready;
+    }
+
+    /**
+     * setReady(fReady)
+     *
+     * Set the "ready" state of the component to true, and call any queued notification functions.
+     *
+     * @this {Component}
+     * @param {boolean} [fReady] is assumed to indicate "ready" unless EXPLICITLY set to false
+     */
+    setReady(fReady) {
+        if (!this.flags.error) {
+            this.flags.ready = (fReady !== false);
+            if (this.flags.ready) {
+                if (MAXDEBUG /* || this.name */) this.log("ready");
+                var fnReady = this.fnReady;
+                this.fnReady = null;
+                if (fnReady) fnReady();
+            }
+        }
+    }
+
+    /**
+     * isBusy(fCancel)
+     *
+     * Return the "busy" state of the component
+     *
+     * @this {Component}
+     * @param {boolean} [fCancel] is set to true to cancel a "busy" state
+     * @return {boolean} true if "busy", false if not
+     */
+    isBusy(fCancel) {
+        if (this.flags.busy) {
+            if (fCancel) {
+                this.flags.busyCancel = true;
+            } else if (fCancel === undefined) {
+                this.println(this.toString() + " busy");
+            }
+        }
+        return this.flags.busy;
+    }
+
+    /**
+     * setBusy(fBusy)
+     *
+     * Update the current busy state; if a busyCancel request is pending, it will be honored now.
+     *
+     * @this {Component}
+     * @param {boolean} fBusy
+     * @return {boolean}
+     */
+    setBusy(fBusy) {
+        if (this.flags.busyCancel) {
+            this.flags.busy = false;
+            this.flags.busyCancel = false;
+            return false;
+        }
+        if (this.flags.error) {
+            this.println(this.toString() + " error");
+            return false;
+        }
+        this.flags.busy = fBusy;
+        return this.flags.busy;
+    }
+
+    /**
+     * powerUp(fSave)
+     *
+     * @this {Component}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower] is true if this is "repower" notification
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower) {
+        this.flags.powered = true;
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {Component}
+     * @param {boolean} fSave
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown) {
+        if (fShutdown) this.flags.powered = false;
+        return true;
+    }
+
+    /**
+     * messageEnabled(bitsMessage)
+     *
+     * If bitsMessage is not specified, the component's MESSAGE category is used.
+     *
+     * @this {Component}
+     * @param {number} [bitsMessage] is zero or more MESSAGE_* category flag(s)
+     * @return {boolean} true if all specified message enabled, false if not
+     */
+    messageEnabled(bitsMessage) {
+        if (DEBUGGER && this.dbg) {
+            if (this === this.dbg) {
+                bitsMessage |= 0;
+            } else {
+                bitsMessage = bitsMessage || this.bitsMessage;
+            }
+            var bitsEnabled = this.dbg.bitsMessage & bitsMessage;
+            return (!!bitsMessage && bitsEnabled === bitsMessage || !!(bitsEnabled & this.dbg.bitsWarning));
+        }
+        return false;
+    }
+
+    /**
+     * printMessage(sMessage, bitsMessage, fAddress)
+     *
+     * If bitsMessage is not specified, the component's MESSAGE category is used.
+     * If bitsMessage is true, the message is displayed regardless.
+     *
+     * @this {Component}
+     * @param {string} sMessage is any caller-defined message string
+     * @param {number|boolean} [bitsMessage] is zero or more MESSAGE_* category flag(s)
+     * @param {boolean} [fAddress] is true to display the current address
+     */
+    printMessage(sMessage, bitsMessage, fAddress) {
+        if (DEBUGGER && this.dbg) {
+            if (bitsMessage === true || this.messageEnabled(bitsMessage | 0)) {
+                this.dbg.message(sMessage, fAddress);
+            }
+        }
+    }
+
+    /**
+     * printMessageIO(port, bOut, addrFrom, name, bIn, bitsMessage)
+     *
+     * If bitsMessage is not specified, the component's MESSAGE category is used.
+     * If bitsMessage is true, the message is displayed as long as MESSAGE.PORT is enabled.
+     *
+     * @this {Component}
+     * @param {number} port
+     * @param {number|null} bOut if an output operation
+     * @param {number|null} [addrFrom]
+     * @param {string|null} [name] of the port, if any
+     * @param {number|null} [bIn] is the input value, if known, on an input operation
+     * @param {number|boolean} [bitsMessage] is zero or more MESSAGE_* category flag(s)
+     */
+    printMessageIO(port, bOut, addrFrom, name, bIn, bitsMessage) {
+        if (DEBUGGER && this.dbg) {
+            if (bitsMessage === true) {
+                bitsMessage = 0;
+            } else if (bitsMessage == null) {
+                bitsMessage = this.bitsMessage;
+            }
+            this.dbg.messageIO(this, port, bOut, addrFrom, name, bIn, bitsMessage);
+        }
+    }
+}
+
+/*
+ * Every component created on the current page is recorded in this array (see Component.add()),
+ * enabling any component to locate another component by ID (see Component.getComponentByID())
+ * or by type (see Component.getComponentByType()).
+ *
+ * Every machine on the page are now recorded as well, by their machine ID.  We then record the
+ * various resources used by that machine.
+ *
+ * Includes a fallback for non-browser-based environments (ie, Node).  TODO: This will need to be
+ * tailored to Node, probably using the global object instead of the window object, if we ever want
+ * to support multi-machine configs in that environment.
+ */
+if (window) {
+    if (!window['PCjs']) window['PCjs'] = {};
+    if (!window['PCjs']['Machines']) window['PCjs']['Machines'] = {};
+    if (!window['PCjs']['Components']) window['PCjs']['Components'] = [];
+    if (!window['PCjs']['Commands']) window['PCjs']['Commands'] = {};
+}
+Component.machines = window? window['PCjs']['Machines'] : {};
+Component.components = window? window['PCjs']['Components'] : [];
+Component.commands = window? window['PCjs']['Commands'] : {};
+
+Component.asyncCommands = [
+    'hold', 'sleep', 'wait'
+];
+Component.globalCommands = {
+    'alert': Component.scriptAlert,
+    'sleep': Component.scriptSleep
+};
+Component.componentCommands = {
+    'select':   Component.scriptSelect
+};
+
+/*
+ * The following polyfills provide ES5 functionality that's missing in older browsers (eg, IE8),
+ * allowing PCjs apps to run without slamming into exceptions; however, due to the lack of HTML5 canvas
+ * support in those browsers, all you're likely to see are "soft" errors (eg, "Missing <canvas> support").
+ *
+ * Perhaps we can implement a text-only faux video display for a fun retro-browser experience someday.
+ *
+ * TODO: Come up with a better place to put these polyfills.  We will likely have more if we decide to
+ * make the leap from ES5 to ES6 features.
+ */
+
+/*
+ * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/indexOf
+ */
+if (!Array.prototype.indexOf) {
+    Array.prototype.indexOf = function(obj, start) {
+        for (var i = (start || 0), j = this.length; i < j; i++) {
+            if (this[i] === obj) { return i; }
+        }
+        return -1;
+    }
+}
+
+/*
+ * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/isArray
+ */
+if (!Array.isArray) {
+    Array.isArray = function(arg) {
+        return Object.prototype.toString.call(arg) === '[object Array]';
+    };
+}
+
+/*
+ * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/bind
+ */
+if (!Function.prototype.bind) {
+    Function.prototype.bind = function(obj) {
+        if (typeof this != "function") {
+            // Closest thing possible to the ECMAScript 5 internal IsCallable function
+            throw new TypeError("Function.prototype.bind: non-callable object");
+        }
+        var args = Array.prototype.slice.call(arguments, 1);
+        var fToBind = this;
+        var fnNOP = /** @constructor */ (function() {});
+        var fnBound = function() {
+            return fToBind.apply(this instanceof fnNOP && obj? this : obj, args.concat(Array.prototype.slice.call(arguments)));
+        };
+        fnNOP.prototype = this.prototype;
+        fnBound.prototype = new fnNOP();
+        return fnBound;
+    };
+}
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/defines.js (C) Jeff Parsons 2012-2017
+ */
+
+/**
+ * @define {string}
+ */
+var APPCLASS = "pdp11";         // this @define is the default application class (eg, "pcx86", "c1pjs")
+
+/**
+ * APPNAME is used more for display purposes than anything else now.  APPCLASS is what matters in terms
+ * of folder and file names, CSS styles, etc.
+ *
+ * @define {string}
+ */
+var APPNAME = "PDPjs";          // this @define is the default application name (eg, "PCx86", "C1Pjs")
+
+/**
+ * WARNING: DEBUGGER needs to accurately reflect whether or not the Debugger component is (or will be) loaded.
+ * In the compiled case, we rely on the Closure Compiler to override DEBUGGER as appropriate.  When it's *false*,
+ * nearly all of debugger.js will be conditionally removed by the compiler, reducing it to little more than a
+ * "type skeleton", which also solves some type-related warnings we would otherwise have if we tried to remove
+ * debugger.js from the compilation process altogether.
+ *
+ * However, when we're in "development mode" and running uncompiled code in debugger-less configurations,
+ * I would like to skip loading debugger.js altogether.  When doing that, we must ALSO arrange for an additional file
+ * (nodebugger.js) to be loaded immediately after this file, which *explicitly* overrides DEBUGGER with *false*.
+ *
+ * @define {boolean}
+ */
+var DEBUGGER = true;            // this @define is overridden by the Closure Compiler to remove Debugger-related support
+
+/**
+ * BYTEARRAYS is a Closure Compiler compile-time option that allocates an Array of numbers for every Memory block,
+ * where each a number represents ONE byte; very wasteful, but potentially slightly faster.
+ *
+ * See the Memory component for details.
+ *
+ * @define {boolean}
+ */
+var BYTEARRAYS = false;
+
+/**
+ * TYPEDARRAYS enables use of typed arrays for Memory blocks.  This used to be a compile-time-only option, but I've
+ * added Memory access functions for typed arrays (see MemoryPDP11.afnTypedArray), so support can be enabled dynamically now.
+ *
+ * See the Memory component for details.
+ */
+var TYPEDARRAYS = (typeof ArrayBuffer !== 'undefined');
+
+/**
+ * MEMFAULT forces the Memory interfaces to signal a CPU fault when a word is accessed using an odd (unaligned) address.
+ *
+ * Since PDPjs inherited its Bus component from PCx86, it included support for both aligned and unaligned word accesses
+ * by default.  However, the PDP-11 adds a wrinkle: when an odd address is used to access a memory word, a BUS trap
+ * must be generated.  Note that odd IOPAGE word accesses are fine; this only affects the Memory component.
+ *
+ * When the MMU is enabled, these checks may also be performed at a higher level, eliminating the need for them at the
+ * physical memory level.
+ */
+var MEMFAULT = true;
+
+/**
+ * WORDBUS turns off support for unaligned memory words.  Whereas MEMFAULT necessarily slows down memory word accesses
+ * slightly, WORDBUS is able to speed them up slightly, by assuming that all word accesses (which didn't fault) must be
+ * aligned.  This affects all word accesses, even IOPAGE accesses, because it also eliminates cross-block boundary checks.
+ *
+ * Don't worry that the source code looks MORE complicated rather than LESS with the additional MEMFAULT and WORDBUS checks,
+ * because the Closure Compiler eliminates those checks and throws away the (unreachable) code blocks that deal with unaligned
+ * accesses.
+ */
+var WORDBUS = true;
+
+/*
+ * Combine all the shared globals and machine-specific globals into one machine-specific global object,
+ * which all machine components should start using; eg: "if (PDP11.DEBUG) ..." instead of "if (DEBUG) ...".
+ */
+var PDP11 = {
+    APPCLASS:   APPCLASS,
+    APPNAME:    APPNAME,
+    APPVERSION: APPVERSION,     // shared
+    BYTEARRAYS: BYTEARRAYS,
+    COMPILED:   COMPILED,       // shared
+    CSSCLASS:   CSSCLASS,       // shared
+    DEBUG:      DEBUG,          // shared
+    DEBUGGER:   DEBUGGER,
+    MAXDEBUG:   MAXDEBUG,       // shared
+    PRIVATE:    PRIVATE,        // shared
+    TYPEDARRAYS:TYPEDARRAYS,
+    MEMFAULT:   MEMFAULT,
+    WORDBUS:    WORDBUS,
+    SITEHOST:   SITEHOST,       // shared
+    XMLVERSION: XMLVERSION,     // shared
+
+    /*
+     * CPU model numbers (supported)
+     *
+     * The 11/20 includes the 11/10, which is not identified separately because there was
+     * nothing functionally different about it.
+     *
+     * The 11/40 added the MODE bits to the PSW (but only KERNEL=00 and USER=11) and 18-bit
+     * addressing via an MMU; there was still only one register set.
+     *
+     * The 11/45 added REGSET bit to the PSW (to support a second register set), SUPER=01
+     * mode to the existing KERNEL=00 and USER=11 modes, separate I/D spaces, and other MMU
+     * extensions (eg, MMR1 and MMR3).
+     *
+     * The 11/70 added 22-bit addressing and corresponding extensions to the MMU.
+     */
+    MODEL_1120: 1120,
+    MODEL_1140: 1140,
+    MODEL_1145: 1145,
+    MODEL_1170: 1170,
+
+    /*
+     * This constant is used to mark points in the code where the physical address being returned
+     * is invalid and should not be used.
+     *
+     * In a 32-bit CPU, -1 (ie, 0xffffffff) could actually be a valid address, so consider changing
+     * ADDR_INVALID to NaN or null (which is also why all ADDR_INVALID tests should use strict equality
+     * operators).
+     *
+     * The main reason I'm NOT using NaN or null now is my concern that, by mixing non-numbers
+     * (specifically, values outside the range of signed 32-bit integers), performance may suffer.
+     *
+     * WARNING: Like many of the properties defined here, ADDR_INVALID is a common constant, which the
+     * Closure Compiler will happily inline (with or without @const annotations; in fact, I've yet to
+     * see a @const annotation EVER improve automatic inlining).  However, if you don't make ABSOLUTELY
+     * certain that this file is included BEFORE the first reference to any of these properties, that
+     * automatic inlining will no longer occur.
+     */
+    ADDR_INVALID:   -1,
+    /*
+     * Processor modes
+     */
+    MODE: {
+        KERNEL:     0x0,        // 11/40 and higher
+        SUPER:      0x1,        // 11/45 and higher
+        UNUSED:     0x2,
+        USER:       0x3,        // 11/40 and higher
+        MASK:       0x3
+    },
+    /*
+     * Processor Status Word (stored in regPSW) at 177776
+     */
+    PSW: {
+        CF:         0x0001,     // bit  0     (000001)  Carry Flag
+        VF:         0x0002,     // bit  1     (000002)  Overflow Flag (aka OF on Intel processors)
+        ZF:         0x0004,     // bit  2     (000004)  Zero Flag
+        NF:         0x0008,     // bit  3     (000010)  Negative Flag (aka SF -- Sign Flag -- on Intel processors)
+        TF:         0x0010,     // bit  4     (000020)  Trap Flag
+        PRI:        0x00E0,     // bits 5-7   (000340)  Priority
+        UNUSED:     0x0700,     // bits 8-10  (003400)  UNUSED
+        /*
+         * The REGSET bit (and the alternate register set stored in regsAlt) came into existence
+         * with the 11/45; (ie, they were not present on the 11/10, 11/20, or 11/40).
+         */
+        REGSET:     0x0800,     // bit  11    (004000)  Register Set
+        /*
+         * The MODE bits came into existence with the 11/40 (eg, not present on the 11/10 or 11/20).
+         */
+        PMODE:      0x3000,     // bits 12-13 (030000)  Prev Mode (see PDP11.MODE)
+        CMODE:      0xC000,     // bits 14-15 (140000)  Curr Mode (see PDP11.MODE)
+        SHIFT: {
+            CF:     0,
+            VF:     1,
+            ZF:     2,
+            NF:     3,
+            TF:     4,
+            PRI:    5,
+            PMODE:  12,
+            CMODE:  14
+        }
+    },
+    /*
+     * Program Interrupt Register (stored in regPIR) at 177772
+     *
+     * The PIA bits at 5-7 are designed to align with PRI bits 5-7 in the PSW.
+     */
+    PIR: {
+        BITS:       0xFE00,     // bits 9-15 correspond to interrupt requests 1-7
+        PIA:        0x00EE,     // the PIA bits contain two copies of the corresponding interrupt request priority
+        PIA_INC:    0x0022,     // both sets of PIA bits can be incremented with this constant
+        SHIFT: {
+            BITS:   9
+        }
+    },
+    /*
+     * PDP-11 trap vectors
+     */
+    TRAP: {
+        UNDEFINED:  0x00,       // 000  (reserved)
+        BUS:        0x04,       // 004  unaligned address, non-existent memory, illegal instruction, etc
+        RESERVED:   0x08,       // 010  reserved instructions
+        BPT:        0x0C,       // 014  BPT: breakpoint trap (trace)
+        IOT:        0x10,       // 020  IOT: input/output trap
+        PF:         0x14,       // 024  power fail
+        EMT:        0x18,       // 030  EMT: emulator trap
+        TRAP:       0x1C,       // 034  TRAP instruction
+        PIRQ:       0xA0,       // 240  PIRQ: program interrupt request
+        MMU:        0xA8        // 250  MMU: aborts and traps
+    },
+    /*
+     * PDP-11 trap reasons; the reason may also be a non-negative address indicating a BUS memory error
+     * (unaligned address or non-existent memory).  Any reason >= RED (which includes BUS memory errors) generate
+     * immediate (thrown) traps, as they are considered ABORTs; the rest generate synchronous traps.
+     */
+    REASON: {
+        PANIC:      -1,         // immediate halt (internal error)
+        ABORT:      -2,         // immediate MMU fault
+        ILLEGAL:    -3,         // immediate invalid opcode (BUS)
+        RED:        -4,         // immediate stack overflow fault (BUS)
+        YELLOW:     -5,         // deferred stack overflow fault (BUS)
+        FAULT:      -6,         // deferred MMU fault
+        TRACE:      -7,         // deferred TF fault (BPT)
+        HALT:       -8,         // illegal HALT (BUS)
+        OPCODE:     -9,         // opcode-generated trap (eg, BPT, EMT, IOT, TRAP, or RESERVED opcode)
+        INTERRUPT:  -10,        // device-generated trap (vector is device-specific)
+    },
+    REASONS: [
+        "UNKNOWN",
+        "PANIC",
+        "ABORT",
+        "ILLEGAL",
+        "RED",
+        "YELLOW",
+        "FAULT",
+        "TRACE",
+        "HALT",
+        "OPCODE",
+        "INTERRUPT"
+    ],
+    /*
+     * Assorted common opcodes
+     */
+    OPCODE: {
+        HALT:       0x0000,
+        WAIT:       0x0001,
+        BPT:        0x0003,
+        IOT:        0x0004,
+        JSR_OP:     0x0800,
+        JSR_MASK:   0xFE00,
+        SOB_OP:     0x7E00,
+        SOB_MASK:   0xFE00,
+        EMT_OP:     0x8800,
+        EMT_MASK:   0xFF00,
+        TRAP_OP:    0x8900,
+        TRAP_MASK:  0xFF00,
+        INVALID:    0xFFFF      // far from the only invalid opcode, just a KNOWN invalid opcode
+    },
+    /*
+     * Internal operation state flags
+     */
+    OPFLAG: {
+        IRQ_DELAY:  0x0001,     // incremented until it becomes IRQ (set by SPL and traps)
+        IRQ:        0x0002,     // time to call checkInterrupts()
+        IRQ_MASK:   0x0003,
+        DEBUGGER:   0x0004,     // set if the Debugger wants to perform checks
+        WAIT:       0x0008,     // WAIT operation in progress
+        PRESERVE:   0x000F,     // OPFLAG bits to preserve prior to the next instruction
+        TRAP_TF:    0x0010,     // aka PDP11.PSW.TF (WARNING: do not change this bit, or you will likely break opRTI())
+        TRAP_SP:    0x0020,     // set for a deferred BUS trap (due to a "yellow" stack overflow condition)
+        TRAP_MMU:   0x0040,
+        TRAP_MASK:  0x0070,
+        TRAP_LAST:  0x0080,     // set if last operation was a trap (see trapLast for the vector, and trapReason for the reason)
+        TRAP_RED:   0x0100,     // set whenever a RED trap occurs, used to catch double RED traps (time to PANIC)
+    },
+    /*
+     * Opcode reg (opcode bits 2-0)
+     */
+    OPREG: {
+        MASK:       0x07
+    },
+    /*
+     * Opcode modes (opcode bits 5-3)
+     */
+    OPMODE: {
+        REG:        0x00,       // REGISTER                 (register is operand)
+        REGD:       0x08,       // REGISTER DEFERRED        (register is address of operand)
+        POSTINC:    0x10,       // AUTO-INCREMENT           (register is address of operand, register incremented)
+        POSTINCD:   0x18,       // AUTO-INCREMENT DEFERRED  (register is address of address of operand, register incremented)
+        PREDEC:     0x20,       // AUTO-DECREMENT           (register decremented, register is address of operand)
+        PREDECD:    0x28,       // AUTO-DECREMENT DEFERRED  (register decremented, register is address of address of operand)
+        INDEX:      0x30,       // INDEX                    (register + next word is address of operand)
+        INDEXD:     0x38,       // INDEX DEFERRED           (register + next word is address of address of operand)
+        MASK:       0x38,
+        SHIFT:      3
+    },
+    DSTMODE: {
+        REG:        0x0007,
+        MODE:       0x0038,
+        MASK:       0x003F,
+        SHIFT:      0
+    },
+    SRCMODE: {
+        REG:        0x01C0,
+        MODE:       0x0E00,
+        MASK:       0x0FC0,
+        SHIFT:      6
+    },
+    REG: {
+        SP:         6,
+        PC:         7,
+    },
+    /*
+     * Internal memory access flags
+     */
+    ACCESS: {
+        WORD:       0x00,
+        BYTE:       0x01,
+        READ:       0x02,
+        WRITE:      0x04,
+        UPDATE:     0x06,
+        VIRT:       0x08,       // getVirtualByMode() leaves bit 17 clear if this is set (otherwise the caller would have to clear it again)
+        ISPACE:     0x00000,
+        DSPACE:     0x10000     // getVirtualByMode() sets bit 17 in any 16-bit virtual address that refers to D space (as opposed to I space)
+    },
+    /*
+     * Internal flags passed to writeDstByte()
+     *
+     * The BYTE and SBYTE values have been chosen so that they can be used directly as masks.
+     */
+    WRITE: {
+        BYTE:       0xff,        // write byte normally
+        SBYTE:      0xffff       // sign-extend byte to word
+    },
+    CPUERR: {                   // 177766
+        RED:        0x0004,     // 000004 red zone stack limit
+        YELLOW:     0x0008,     // 000010 yellow zone stack limit
+        TIMEOUT:    0x0010,     // 000020 UNIBUS timeout error
+        NOMEMORY:   0x0020,     // 000040 non-existent memory error
+        ODDADDR:    0x0040,     // 000100 odd word address error (as in non-even, not strange)
+        BADHALT:    0x0080      // 000200 HALT attempted in USER or SUPER modes
+    },
+    MMR0: {                     // 177572
+        ENABLED:    0x0001,     // 000001 address relocation enabled
+        PAGE_NUM:   0x000E,     // 000016 page number of last fault
+        PAGE_D:     0x0010,     // 000020 last fault occurred in D space (11/45 and 11/70)
+        PAGE:       0x001E,     // 000176 (all of the PAGE bits)
+        MODE:       0x0060,     // 000140 processor mode as of last fault
+        COMPLETED:  0x0080,     // 000200 last instruction completed (R/O) (11/70)
+        MAINT:      0x0100,     // 000400 only destination mode references will be relocated
+        MMU_TRAPS:  0x0200,     // 001000 enable MMU traps (11/70)
+        UNUSED:     0x0C00,     // 006000
+        TRAP_MMU:   0x1000,     // 010000 trap: MMU (11/70)
+        ABORT_RO:   0x2000,     // 020000 abort: read-only
+        ABORT_PL:   0x4000,     // 040000 abort: page length
+        ABORT_NR:   0x8000,     // 100000 abort: non-resident
+        ABORT:      0xE000,     // 160000 (all of the ABORT bits)
+        UPDATE:     0xF0FE,     // Includes all of: ABORT, TRAP, COMPLETED, MODE, and PAGE bits
+        SHIFT: {
+            PAGE:   1,
+            MODE:   5
+        }
+    },
+    MMR1: {                     // 177574: general purpose auto-inc/auto-dec register (11/45 and 11/70)
+        REG1_NUM:   0x0007,     //
+        REG1_DELTA: 0x00F8,     //
+        REG2_NUM:   0x0700,     //
+        REG2_DELTA: 0xF800      //
+    },
+    MMR2: {                     // 177576: virtual program counter register
+    },
+    MMR3: {                     // 172516: mapping register (11/45 and 11/70)
+        USER_D:     0x0001,     // (000001)
+        SUPER_D:    0x0002,     // (000002)
+        KERNEL_D:   0x0004,     // (000004)
+        MMU_22BIT:  0x0010,     // (000020)
+        UNIBUS_MAP: 0x0020      // (000040) UNIBUS map relocation enabled
+    },
+    PDR: {
+        ACF: {
+            NR:     0x0,        // non-resident, abort all accesses
+            RO1:    0x1,        // read-only, abort on write attempt, memory management trap on read (11/70)
+            RO:     0x2,        // read-only, abort on write attempt
+            U1:     0x3,        // unused, abort all accesses--reserved for future use
+            RW1:    0x4,        // read/write, memory management trap upon completion of a read or write
+            RW2:    0x5,        // read/write, memory management trap upon completion of a write (11/70)
+            RW:     0x6,        // read/write, no system trap/abort action
+            U2:     0x7,        // unused, abort all accesses--reserved for future use
+            MASK:   0x7
+        },
+        ED:         0x0008,     // expansion direction (if set, the page expands downward from block number 127)
+        UNUSED:     0x0030,
+        MODIFIED:   0x0040,     // page has been written (bit cleared when either PDR or PAR is written)
+        ACCESSED:   0x0080,     // page has been accessed (bit cleared when either PDR or PAR is written) (11/70)
+        PLF:        0x7F00,     // page length field
+        BC:         0x8000      // bypass cache (11/44 only)
+    },
+    /*
+     * Assorted special (UNIBUS) addresses
+     *
+     * Within the PDP-11/45's 18-bit address space, of the 0x40000 possible addresses (256Kb), the top 0x2000
+     * (8Kb) is called the IOPAGE and is reserved for CPU and I/O registers.  The IOPAGE spans 0x3E000-0x3FFFF.
+     *
+     * Within the PDP-11/70's 22-bit address space, of the 0x400000 possible addresses (4Mb), the top 0x20000
+     * (256Kb) is mapped to the UNIBUS (not physical memory), and as before, the top 0x2000 (8Kb) of that is
+     * mapped to the IOPAGE.
+     *
+     * To map 18-bit UNIBUS addresses to 22-bit physical addresses, the 11/70 uses a UNIBUS relocation map.
+     * It consists of 31 double-word registers that each hold a 22-bit base address.  When UNIBUS relocation
+     * is enabled, the top 5 bits of an address select one of the 31 mapping registers, and the bottom 13 bits
+     * are then added to the contents of the selected mapping register.
+     *
+     * ES6 ALERT: By using octal constants, I'm finally dipping my toe into ES6 (aka ECMAScript 2015) waters.
+     * You'll even see a few binary constants below, too.  If you're loading this raw source code into your browser,
+     * then by now (2016) you're almost certainly using an ES6-aware browser.  Production sites should be using code
+     * compiled by Google's Closure Compiler, which we configure to produce code that's backward-compatible with ES5
+     * (for example, all binary, octal, and hex constants are converted to decimal values).
+     *
+     * For more details: https://github.com/google/closure-compiler/wiki/ECMAScript6
+     */
+    UNIBUS: {       //16-bit       18-bit     22-bit         Hex    Description
+        UNIMAP:     0o170200,   //                                  UNIBUS Mapping Registers (0-31) 64 words (ends at 0o170372)
+        SIPDR0:     0o172200,   //                                  Supervisor I Page Descriptor Register 0
+        SIPDR1:     0o172202,   //                                  Supervisor I Page Descriptor Register 1
+        SIPDR2:     0o172204,   //                                  Supervisor I Page Descriptor Register 2
+        SIPDR3:     0o172206,   //                                  Supervisor I Page Descriptor Register 3
+        SIPDR4:     0o172210,   //                                  Supervisor I Page Descriptor Register 4
+        SIPDR5:     0o172212,   //                                  Supervisor I Page Descriptor Register 5
+        SIPDR6:     0o172214,   //                                  Supervisor I Page Descriptor Register 6
+        SIPDR7:     0o172216,   //                                  Supervisor I Page Descriptor Register 7
+        SDPDR0:     0o172220,   //                                  Supervisor D Page Descriptor Register 0
+        SDPDR1:     0o172222,   //                                  Supervisor D Page Descriptor Register 1
+        SDPDR2:     0o172224,   //                                  Supervisor D Page Descriptor Register 2
+        SDPDR3:     0o172226,   //                                  Supervisor D Page Descriptor Register 3
+        SDPDR4:     0o172230,   //                                  Supervisor D Page Descriptor Register 4
+        SDPDR5:     0o172232,   //                                  Supervisor D Page Descriptor Register 5
+        SDPDR6:     0o172234,   //                                  Supervisor D Page Descriptor Register 6
+        SDPDR7:     0o172236,   //                                  Supervisor D Page Descriptor Register 7
+        SIPAR0:     0o172240,   //                                  Supervisor I Page Address Register 0
+        SIPAR1:     0o172242,   //                                  Supervisor I Page Address Register 1
+        SIPAR2:     0o172244,   //                                  Supervisor I Page Address Register 2
+        SIPAR3:     0o172246,   //                                  Supervisor I Page Address Register 3
+        SIPAR4:     0o172250,   //                                  Supervisor I Page Address Register 4
+        SIPAR5:     0o172252,   //                                  Supervisor I Page Address Register 5
+        SIPAR6:     0o172254,   //                                  Supervisor I Page Address Register 6
+        SIPAR7:     0o172256,   //                                  Supervisor I Page Address Register 7
+        SDPAR0:     0o172260,   //                                  Supervisor D Page Address Register 0
+        SDPAR1:     0o172262,   //                                  Supervisor D Page Address Register 1
+        SDPAR2:     0o172264,   //                                  Supervisor D Page Address Register 2
+        SDPAR3:     0o172266,   //                                  Supervisor D Page Address Register 3
+        SDPAR4:     0o172270,   //                                  Supervisor D Page Address Register 4
+        SDPAR5:     0o172272,   //                                  Supervisor D Page Address Register 5
+        SDPAR6:     0o172274,   //                                  Supervisor D Page Address Register 6
+        SDPAR7:     0o172276,   //                                  Supervisor D Page Address Register 7
+        KIPDR0:     0o172300,   //                                  Kernel I Page Descriptor Register 0
+        KIPDR1:     0o172302,   //                                  Kernel I Page Descriptor Register 1
+        KIPDR2:     0o172304,   //                                  Kernel I Page Descriptor Register 2
+        KIPDR3:     0o172306,   //                                  Kernel I Page Descriptor Register 3
+        KIPDR4:     0o172310,   //                                  Kernel I Page Descriptor Register 4
+        KIPDR5:     0o172312,   //                                  Kernel I Page Descriptor Register 5
+        KIPDR6:     0o172314,   //                                  Kernel I Page Descriptor Register 6
+        KIPDR7:     0o172316,   //                                  Kernel I Page Descriptor Register 7
+        KDPDR0:     0o172320,   //                                  Kernel D Page Descriptor Register 0
+        KDPDR1:     0o172322,   //                                  Kernel D Page Descriptor Register 1
+        KDPDR2:     0o172324,   //                                  Kernel D Page Descriptor Register 2
+        KDPDR3:     0o172326,   //                                  Kernel D Page Descriptor Register 3
+        KDPDR4:     0o172330,   //                                  Kernel D Page Descriptor Register 4
+        KDPDR5:     0o172332,   //                                  Kernel D Page Descriptor Register 5
+        KDPDR6:     0o172334,   //                                  Kernel D Page Descriptor Register 6
+        KDPDR7:     0o172336,   //                                  Kernel D Page Descriptor Register 7
+        KIPAR0:     0o172340,   //                                  Kernel I Page Address Register 0
+        KIPAR1:     0o172342,   //                                  Kernel I Page Address Register 1
+        KIPAR2:     0o172344,   //                                  Kernel I Page Address Register 2
+        KIPAR3:     0o172346,   //                                  Kernel I Page Address Register 3
+        KIPAR4:     0o172350,   //                                  Kernel I Page Address Register 4
+        KIPAR5:     0o172352,   //                                  Kernel I Page Address Register 5
+        KIPAR6:     0o172354,   //                                  Kernel I Page Address Register 6
+        KIPAR7:     0o172356,   //                                  Kernel I Page Address Register 7
+        KDPAR0:     0o172360,   //                                  Kernel D Page Address Register 0
+        KDPAR1:     0o172362,   //                                  Kernel D Page Address Register 1
+        KDPAR2:     0o172364,   //                                  Kernel D Page Address Register 2
+        KDPAR3:     0o172366,   //                                  Kernel D Page Address Register 3
+        KDPAR4:     0o172370,   //                                  Kernel D Page Address Register 4
+        KDPAR5:     0o172372,   //                                  Kernel D Page Address Register 5
+        KDPAR6:     0o172374,   //                                  Kernel D Page Address Register 6
+        KDPAR7:     0o172376,   //                                  Kernel D Page Address Register 7
+        MMR3:       0o172516,   // 772516   17772516
+        RLCS:       0o174400,   //                                  RL11 Control Status Register
+        RLBA:       0o174402,   //                                  RL11 Bus Address Register
+        RLDA:       0o174404,   //                                  RL11 Disk Address Register
+        RLMP:       0o174406,   //                                  RL11 Multi-Purpose Register
+        RLBE:       0o174410,   //                                  RL11 Bus (Address) Extension Register (RLV12 controller only)
+        DL11:       0o176500,   //                                  DL11 Additional Register Range (ends at 0o176676)
+        RXCS:       0o177170,   //                                  RX11 Command and Status Register
+        RXDB:       0o177172,   //                                  RX11 Data Buffer Register
+        RKDS:       0o177400,   //                                  RK11 Drive Status Register
+        RKER:       0o177402,   //                                  RK11 Error Register
+        RKCS:       0o177404,   //                                  RK11 Control Status Register
+        RKWC:       0o177406,   //                                  RK11 Word Count Register
+        RKBA:       0o177410,   //                                  RK11 Bus Address Register
+        RKDA:       0o177412,   //                                  RK11 Disk Address Register
+        RKUN:       0o177414,   //                                  RK11 UNUSED (just to make it clear we didn't forget something)
+        RKDB:       0o177416,   //                                  RK11 Data Buffer Register
+        LKS:        0o177546,   //                                  KW11-L Clock Status
+        PRS:        0o177550,   //                                  PC11 (and PR11) Reader Status Register
+        PRB:        0o177552,   //                                  PC11 (and PR11) Reader Buffer Register
+        PPS:        0o177554,   //                                  PC11 Punch Status Register
+        PPB:        0o177556,   //                                  PC11 Punch Buffer Register
+        RCSR:       0o177560,   //                                  DL11 Receiver Status Register
+        RBUF:       0o177562,   //                                  DL11 Receiver Data Buffer Register
+        XCSR:       0o177564,   //                                  DL11 Transmitter Status Register
+        XBUF:       0o177566,   //                                  DL11 Transmitter Data Buffer Register
+        CNSW:       0o177570,   //                                  Console (Front Panel) Switch/Display Register
+        MMR0:       0o177572,   // 777572   17777572
+        MMR1:       0o177574,   // 777574   17777574
+        MMR2:       0o177576,   // 777576   17777576
+        UIPDR0:     0o177600,   //                                  User I Page Descriptor Register 0
+        UIPDR1:     0o177602,   //                                  User I Page Descriptor Register 1
+        UIPDR2:     0o177604,   //                                  User I Page Descriptor Register 2
+        UIPDR3:     0o177606,   //                                  User I Page Descriptor Register 3
+        UIPDR4:     0o177610,   //                                  User I Page Descriptor Register 4
+        UIPDR5:     0o177612,   //                                  User I Page Descriptor Register 5
+        UIPDR6:     0o177614,   //                                  User I Page Descriptor Register 6
+        UIPDR7:     0o177616,   //                                  User I Page Descriptor Register 7
+        UDPDR0:     0o177620,   //                                  User D Page Descriptor Register 0
+        UDPDR1:     0o177622,   //                                  User D Page Descriptor Register 1
+        UDPDR2:     0o177624,   //                                  User D Page Descriptor Register 2
+        UDPDR3:     0o177626,   //                                  User D Page Descriptor Register 3
+        UDPDR4:     0o177630,   //                                  User D Page Descriptor Register 4
+        UDPDR5:     0o177632,   //                                  User D Page Descriptor Register 5
+        UDPDR6:     0o177634,   //                                  User D Page Descriptor Register 6
+        UDPDR7:     0o177636,   //                                  User D Page Descriptor Register 7
+        UIPAR0:     0o177640,   //                                  User I Page Address Register 0
+        UIPAR1:     0o177642,   //                                  User I Page Address Register 1
+        UIPAR2:     0o177644,   //                                  User I Page Address Register 2
+        UIPAR3:     0o177646,   //                                  User I Page Address Register 3
+        UIPAR4:     0o177650,   //                                  User I Page Address Register 4
+        UIPAR5:     0o177652,   //                                  User I Page Address Register 5
+        UIPAR6:     0o177654,   //                                  User I Page Address Register 6
+        UIPAR7:     0o177656,   //                                  User I Page Address Register 7
+        UDPAR0:     0o177660,   //                                  User D Page Address Register 0
+        UDPAR1:     0o177662,   //                                  User D Page Address Register 1
+        UDPAR2:     0o177664,   //                                  User D Page Address Register 2
+        UDPAR3:     0o177666,   //                                  User D Page Address Register 3
+        UDPAR4:     0o177670,   //                                  User D Page Address Register 4
+        UDPAR5:     0o177672,   //                                  User D Page Address Register 5
+        UDPAR6:     0o177674,   //                                  User D Page Address Register 6
+        UDPAR7:     0o177676,   //                                  User D Page Address Register 7
+        R0SET0:     0o177700,   //
+        R1SET0:     0o177701,   //
+        R2SET0:     0o177702,   //
+        R3SET0:     0o177703,   //
+        R4SET0:     0o177704,   //
+        R5SET0:     0o177705,   //
+        R6KERNEL:   0o177706,   //
+        R7KERNEL:   0o177707,   //
+        R0SET1:     0o177710,   //
+        R1SET1:     0o177711,   //
+        R2SET1:     0o177712,   //
+        R3SET1:     0o177713,   //
+        R4SET1:     0o177714,   //
+        R5SET1:     0o177715,   //
+        R6SUPER:    0o177716,   //
+        R6USER:     0o177717,   //
+        /*
+         * This next group of registers is largely ignored; all accesses are routed to regsControl[],
+         * and therefore are managed as a block of 8 "CTRL" registers.
+         */
+        CTRL:       0o177740,
+        LAERR:      0o177740,   //                                  Low Address Error                           (11/70 only)
+        HAERR:      0o177742,   //                                  High Address Error                          (11/70 only)
+        MEMERR:     0o177744,   //                                  Memory System Error                         (11/70 only)
+        CACHEC:     0o177746,   //                                  Cache Control                               (11/70 only)
+        MAINT:      0o177750,   //                                  Maintenance                                 (11/70 only)
+        HITMISS:    0o177752,   //                                  Hit/Miss                                    (11/70 only)
+        UNDEF1:     0o177754,   //
+        UNDEF2:     0o177756,   //
+        LSIZE:      0o177760,   //                                  Lower Size Register (last 64-byte block #)  (11/70 only)
+        HSIZE:      0o177762,   //                                  Upper Size Register (always zero)           (11/70 only)
+        SYSID:      0o177764,   //                                  System ID Register                          (11/70 only)
+        CPUERR:     0o177766,   //                                  CPU error                                   (11/70 only)
+        MB:         0o177770,   //                                  Microprogram break                          (11/70 only)
+        PIR:        0o177772,   //                                  Program Interrupt Request
+        SL:         0o177774,   //                                  Stack Limit Register
+        PSW:        0o177776    // 777776   17777776    0x3FFFFE    Processor Status Word
+    },
+    DL11: {                     // Serial Line Interface (program compatible with the KL11 for control of console teleprinters)
+        PRI:        4,
+        RVEC:       0o060,
+        XVEC:       0o064,
+        RCSR: {                 // 177560: DL11 Receiver Status Register
+            RE:     0x0001,     // Reader Enable (W/O)
+            DTR:    0x0002,     // Data Terminal Ready (R/W)
+            RTS:    0x0004,     // Request To Send (R/W)
+            STD:    0x0008,     // Secondary Transmitted Data (R/W)
+            DIE:    0x0020,     // Dataset Interrupt Enable (R/W)
+            RIE:    0x0040,     // Receiver Interrupt Enable (R/W)
+            RD:     0x0080,     // Receiver Done (R/O)
+            SRD:    0x0400,     // Secondary Received Data (R/O)
+            RA:     0x0800,     // Receiver Active (R/O)
+            CD:     0x1000,     // Carrier Detect (R/O)
+            CTS:    0x2000,     // Clear To Send (R/O)
+            RI:     0x4000,     // Ring Indicator (R/O)
+            DSC:    0x8000,     // Dataset Status Change (R/O)
+            RMASK:  0xFFFE,     // bits readable (TODO: All I know for sure is that bit 0 is NOT readable; see readRCSR())
+            WMASK:  0x006F,     // bits writable
+            RS232:  0x0006,     // bits affecting RS-232 status updates
+            BAUD:   9600
+        },
+        RBUF: {                 // 177562: DL11 Receiver Data Buffer Register
+            DATA:   0x00ff,     // Received Data (R/O)
+            PARITY: 0x1000,     // Received Data Parity (R/O)
+            FE:     0x2000,     // Framing Error (R/O)
+            OE:     0x4000,     // Overrun Error (R/O)
+            ERROR:  0x8000      // Error (R/O)
+        },
+        XCSR: {                 // 177564: DL11 Transmitter Status Register
+            BREAK:  0x0001,     // BREAK (R/W)
+            MAINT:  0x0004,     // Maintenance (R/W)
+            TIE:    0x0040,     // Transmitter Interrupt Enable (R/W)
+            READY:  0x0080,     // Transmitter Ready (R/O)
+            RMASK:  0x00C5,
+            WMASK:  0x0045,
+            BAUD:   9600
+        },
+        XBUF: {                 // 177566: DL11 Transmitter Data Buffer Register
+            DATA:   0x00FF      // Transmitted Data (W/O) (TODO: Determine why pdp11.js effectively defined this as 0x7F)
+        }
+    },
+    KW11: {                     // KW11-L Line Time Clock (60Hz; well, OK, or 50Hz, if you're in the UK, I suppose...)
+        PRI:        6,
+        VEC:        0o100,
+        DELAY:      0,
+        LKS: {                  // 177546: KW11-L Clock Status
+            IE:     0x0040,     // Interrupt Enable
+            MON:    0x0080,     // Monitor
+            MASK:   0x00C0      // these are the only bits that can read or written
+        }
+    },
+    PC11: {                     // High Speed Reader & Punch (PR11 is a Reader-only unit)
+        PRI:        4,          // NOTE: reader has precedence over punch
+        RVEC:       0o070,      // reader vector
+        PVEC:       0o074,      // punch vector
+        PRS: {                  // 177550: PC11 (and PR11) Reader Status Register
+            RE:     0x0001,     // (000001) Reader Enable (W/O)
+            IE:     0x0040,     // (000100) Reader Interrupt Enable (allows the DONE and ERROR bits to trigger an interrupt)
+            DONE:   0x0080,     // (000200) Done (R/O)
+            BUSY:   0x0800,     // (004000) Busy (R/O)
+            ERROR:  0x8000,     // (100000) Error (R/O)
+            CLEAR:  0x08C0,     // (004300) bits cleared on INIT
+            RMASK:  0xFFFE,     // (177776) bits readable (TODO: All I know for sure is that bit 0 is NOT readable; see readPRS())
+            WMASK:  0x0041,     // (000101) bits writable
+            BAUD:   3600
+        },
+        PRB: {                  // 177552: PC11 (and PR11) Reader Buffer Register
+            MASK:   0x00FF      // Data
+        },
+        PPS: {                  // 177554: PC11 Punch Status Register
+            IE:     0x0040,     // Interrupt Enable
+            RDY:    0x0080,     // Ready
+            ERROR:  0x8000,     // Error (eg, no tape in punch, or punch has no power)
+            WMASK:  0x0040,     // bits writable
+            BAUD:   600
+        },
+        PPB: {                  // 177556: PC11 Punch Buffer Register
+            MASK:   0x00FF      // Data
+        }
+    },
+    RK11: {                     // RK11 Disk Controller
+        PRI:        5,
+        VEC:        0o220,
+        DRIVES:     8,          // maximum of 8 drives
+        RKDS: {                 // 177400: Drive Status Register
+            SC:     0x000F,     // (000017) Sector Counter
+            SCESA:  0x0010,     // (000020) Sector Counter Equals Sector Address
+            WPS:    0x0020,     // (000040) Write Protected Status (set if write-protected)
+            RRDY:   0x0040,     // (000100) Read/Write/Seek Ready
+            DRDY:   0x0080,     // (000200) Drive Ready
+            SOK:    0x0100,     // (000400) Sector Counter OK
+            SIN:    0x0200,     // (001000) Seek Incomplete
+            DRU:    0x0400,     // (002000) Drive Unsafe
+            RK05:   0x0800,     // (004000) RK05 is the selected disk drive (always set)
+            DPL:    0x1000,     // (010000) Drive Power Low
+            ID:     0xE000,     // (160000) Drive ID (logical drive number of an interrupting drive)
+            SHIFT: {
+                ID:     13
+            }
+        },
+        RKER: {                 // 177402: Error Register
+            WCE:    0x0001,     // Write Check Error
+            CSE:    0x0002,     // Checksum Error
+            SE:     0x0003,     // Soft Error bits (cleared at the start of a new function)
+            UNUSED: 0x001C,     // unused (returns zero)
+            NXS:    0x0020,     // Non-Existent Sector
+            NXC:    0x0040,     // Non-Existent Cylinder
+            NXD:    0x0080,     // Non-Existent Disk
+            TE:     0x0100,     // Timing Error
+            DLT:    0x0200,     // Date Late
+            NXM:    0x0400,     // Non-Existent Memory
+            PGE:    0x0800,     // Programming Error
+            SKE:    0x1000,     // Seek Error
+            WLO:    0x2000,     // Write Lock-Out Violation
+            OVR:    0x4000,     // Overrun
+            DRE:    0x8000,     // Drive Error
+            HE:     0x7FE0      // Hard Error bits (cleared only by Bus RESET or RK11 CRESET function)
+        },
+        RKCS: {                 // 177404: Control Status Register
+            GO:     0x0001,     // (000001) Go (W/O)
+            FUNC:   0x000E,     // (000016) Function Code (F2,F1,F0) (R/W)
+            MEX:    0x0030,     // (000060) Memory Extension (R/W)
+            IE:     0x0040,     // (000100) Interrupt Enable (R/W)
+            CRDY:   0x0080,     // (000200) Controller Ready (R/O)
+            SSE:    0x0100,     // (000400) Stop on Soft Error (R/W)
+            EXB:    0x0200,     // (001000) Extra Bit (R/W)
+            FMT:    0x0400,     // (002000) Format (R/W)
+            IBA:    0x0800,     // (004000) Inhibit RKBA Increment (R/W)
+            SCP:    0x2000,     // (020000) Search Complete (R/O)
+            HE:     0x4000,     // (040000) Hard Error (R/O)
+            ERR:    0x8000,     // (100000) Composite Error (R/O) (set when any RKER bit is set)
+            UNUSED: 0x1200,     // (011000) unused
+            RMASK:  0xEFFE,     // (167776) bits readable
+            WMASK:  0x0F7F,     // (007577) bits writable
+            SHIFT: {
+                FUNC:   1,
+                MEX:    4
+            }
+        },
+        RKDA: {                 // 177412: Disk Address Register
+            SA:     0x000F,     // (000017) Sector Address
+            HS:     0x0010,     // (000020) Head Select (aka SUR: clear for upper disk head, set for lower)
+            CA:     0x1FE0,     // (017740) Cylinder Address (aka CYL ADDR)
+            DS:     0xE000,     // (160000) Drive Select (aka DR SEL)
+            SHIFT: {
+                HS:     4,
+                CA:     5,
+                DS:     13
+            }
+        },
+        FUNC: {
+            CRESET: 0b0000,     // (00) Controller Reset
+            WRITE:  0b0010,     // (02) Write
+            READ:   0b0100,     // (04) Read
+            WCHK:   0b0110,     // (06) Write Check
+            SEEK:   0b1000,     // (10) Seek
+            RCHK:   0b1010,     // (12) Read Check
+            DRESET: 0b1100,     // (14) Drive Reset
+            WLOCK:  0b1110      // (16) Write Lock
+        }
+    },
+    RL11: {                     // RL11 Disk Controller
+        PRI:        5,
+        VEC:        0o160,
+        DRIVES:     4,          // maximum of 4 drives
+        PREFIX:     "DY",
+        RLCS: {                 // 174400: Control Status Register
+            DRDY:   0x0001,     // (000001) Drive Ready (R/O)
+            FUNC:   0x000E,     // (000016) Function Code (F2,F1,F0) (R/W)
+            BAE:    0x0030,     // (000060) Bus Address Extension bits (BA17,BA16) (R/W)
+            IE:     0x0040,     // (000100) Interrupt Enable (R/W)
+            CRDY:   0x0080,     // (000200) Controller Ready (R/W)
+            DS:     0x0300,     // (001400) Drive Select (DS1,DS0) (R/W)
+            ERRC:   0x3C00,     // (036000) Error Code (R/O)
+            DE:     0x4000,     // (040000) Drive Error (R/O)
+            ERR:    0x8000,     // (100000) Composite Error (R/O)
+            CLEAR:  0x3F7E,     // (037576) bits cleared on INIT (bits 1-6 and 8-13 are cleared)
+            SET:    0x0080,     // (000200) bits set on INIT (bit 7 is set)
+            RMASK:  0xFFFF,     // (177777) no write-only bits
+            WMASK:  0x03FE,     // (001776) bits writable
+            SHIFT: {
+                FUNC:   1,
+                BAE:    4,
+                DS:     8
+            }
+        },
+        RLBA: {                 // 174402: Bus Address Register
+            WMASK:  0xFFFE      // bit 0 is effectively not writable (always zero)
+        },
+        /*
+         * This register has 3 formats: one for Seek, another for Read/Write, and a third for Get Status
+         */
+        RLDA: {                 // 174404: Disk Address Register
+            SEEK_CMD:   0x0001, // Seek: bit 0 must be set, bits 1 and 3 must be clear
+            SEEK_DIR:   0x0004, // Direction (clear to move heads away from spindle (lower cylinder), set to move to higher cylinder)
+            SEEK_HS:    0x0010, // Head Select (clear to select upper head, set to select lower head)
+            SEEK_CAD:   0xFF80, // Cylinder Address Difference
+            RW_SA:      0x003F, // Sector Address
+            RW_HS:      0x0040, // Head Select
+            RW_CA:      0xFF80, // Cylinder Address (RL01 has 256 cylinders, RL02 has 512)
+            GS_CMD:     0x0003, // Get Status: bit 0 must be set, bit 1 set, and bits 2 and 4-7 clear (bits 8-15 unused)
+            GS_RST:     0x0008, // Reset (when set, clears error register before sending status word to controller)
+            SHIFT: {
+                RW_HS:  6,
+                RW_CA:  7
+            }
+        },
+        /*
+         * This register has 3 formats: one for Read Header, another for Read/Write, and a third for Get Status
+         */
+        RLMP: {                 // 177406: Multi-Purpose Register
+            GS_ST: {            // Major State Code (of the drive)
+                LOADC:  0x0,    // Load Cartridge
+                SPINUP: 0x1,    // Spin-Up
+                BRUSHC: 0x2,    // Brush Cycle
+                LOADH:  0x3,    // Load Heads
+                SEEK:   0x4,    // Seek
+                LOCKON: 0x5,    // Lock On
+                UNLOADH:0x6,    // Unload Heads
+                SPINDN: 0x7     // Spin-Down
+            },
+            GS_BH:      0x0008, // Brushes Home
+            GS_HO:      0x0010, // Heads Out
+            GS_CO:      0x0020, // Cover Open (or dust cover is not in place)
+            GS_HS:      0x0040, // Head Selected (0 for upper head, 1 for lower head)
+            GS_DT:      0x0080, // Drive Type (0 for RL01, 1 for RL02)
+            GS_DSE:     0x0100, // Drive Select Error
+            GS_VC:      0x0200, // Volume Check (Set during transition from a head load state to a head-on-track state; cleared by execution of a Get Status command with Bit 3 asserted)
+            GS_WGE:     0x0400, // Write Gate Error
+            GS_SPE:     0x0800, // Spin Error
+            GS_SKTO:    0x1000, // Seek Time-Out
+            GS_WL:      0x2000, // Write Lock
+            GS_CHE:     0x4000, // Current Head Error
+            GS_WDE:     0x8000  // Write Data Error
+        },
+        RLBE: {                 // 174410: Bus (Address) Extension Register
+            MASK:   0x003F      // bits 5-0 correspond to bus address bits 21-16
+        },
+        ERRC: {                 // NOTE: These error codes are pre-shifted to read/write directly from/to RLCS.ERRC
+            OPI:    0x0400,     // Operation Incomplete
+            DCRC:   0x0800,     // Read Data CRC
+            WCE:    0x0800,     // Write Check Error
+            HCRC:   0x0C00,     // Header CRC
+            DLT:    0x1000,     // Data Late
+            HNF:    0x1400,     // Header Not Found
+            NXM:    0x2000,     // Non-Existent Memory
+            MPE:    0x2400      // Memory Parity Error (RLV12 only)
+        },
+        FUNC: {                 // NOTE: These function codes are pre-shifted to read/write directly from/to RLCS.FUNC
+            NOP:    0b0000,     // (00) No-Op
+            WCHK:   0b0010,     // (02) Write Check
+            STATUS: 0b0100,     // (04) Get Status
+            SEEK:   0b0110,     // (06) Seek
+            RHDR:   0b1000,     // (10) Read Header
+            WDATA:  0b1010,     // (12) Write Data
+            RDATA:  0b1100,     // (14) Read Data
+            RDNC:   0b1110      // (16) Read Data without Header Check
+        }
+    },
+    RX11: {                     // RX11 Disk Controller
+        PRI:        5,
+        VEC:        0o264,
+        DRIVES:     2,          // maximum of 2 drives
+        PREFIX:     "DX",
+        RXCS: {                 // 177170: Command and Status Register
+            GO:     0x0001,     // (000001) Go (W/O)
+            FUNC:   0x000E,     // (000016) Function Code (F2,F1,F0) (W/O)
+            UNIT:   0x0010,     // (000020) Unit Select (W/O)
+            DONE:   0x0020,     // (000040) Done (R/O)
+            IE:     0x0040,     // (000100) Interrupt Enable (R/W, cleared on INIT)
+            TR:     0x0080,     // (000200) Transfer Request (R/O)
+            INIT:   0x4000,     // (040000) RX11 Initialize (W/O)
+            ERR:    0x8000,     // (100000) Error (R/O, cleared on INIT or command)
+            UNUSED: 0x3F00,     // (037400) unused
+            RMASK:  0x80E0,     // (100340) bits readable
+            WMASK:  0x405F      // (040137) bits writable
+        },
+        RXDB: {                 // 177172: Data Buffer Register
+        },
+        RXTA: {
+            MASK:   0x007F
+        },
+        RXSA: {
+            MASK:   0x001F
+        },
+        RXES: {
+            /*
+             * The DRDY bit is only valid when retrieved via a Read Status function or at completion of Initialize when it indicates
+             * status of drive O.  It is asserted if the unit currently selected exists, is properly supplied with power, has a diskette
+             * installed correctly, has its door closed, and has a diskette up to speed.
+             *
+             * If the Error bit was set in the RXCS but Error bits are not set in the RXES, then specific error conditions can be accessed via
+             * a Read Error Register function.
+             */
+            CRC:    0x0001,     // CRC error (RXES is moved to the RXDB, and Error and Done are asserted)
+            PARITY: 0x0002,     // parity error (RXES is moved to the RXDB, and Error and Done are asserted)
+            ID:     0x0004,     // Initialize Done (following a programmable or UNIBUS initialization, or a power failure)
+            DEL:    0x0040,     // Deleted Data Detected
+            DRDY:   0x0080      // Drive Ready
+        },
+        FUNC: {                 // NOTE: These function codes are pre-shifted to read/write directly from/to RXCS.FUNC
+            FILL:   0b0000,     // Fill Buffer
+            EMPTY:  0b0010,     // Empty Buffer
+            WRITE:  0b0100,     // Write Sector
+            READ:   0b0110,     // Read Sector
+            UNUSED: 0b1000,     // UNUSED
+            RDSTAT: 0b1010,     // Read Status
+            WRDEL:  0b1100,     // Write Deleted Data Sector
+            RDERR:  0b1110      // Read Error Register
+        },
+        ERROR: {
+            HOME0:      0o0010, // Drive 0 failed to see home on Initialize
+            HOME1:      0o0020, // Drive 1 failed to see home on Initialize
+            BAD_HOME:   0o0030, // Found home when stepping out 10 tracks for INIT
+            NO_TRACK:   0o0040, // Tried to access a track greater than 77
+            FOUND_HOME: 0o0050, // Home was found before desired track was reached
+            SELF_DIAG:  0o0060, // Self-diagnostic error
+            NO_SECTOR:  0o0070, // Desired sector could not be found after looking at 52 headers (2 revolutions)
+            NO_SEP:     0o0110, // More than 40us and no SEP clock seen
+            NO_PREAM:   0o0120, // A preamble could not be found
+            NO_IOMARK:  0o0130, // Preamble found but no I/O mark found within allowable time span
+            CRC_HEADER: 0o0140, // CRC error on what we thought was a header
+            BAD_TRACK:  0o0150, // The header track address of a good header does not compare with the desired track
+            NO_ID:      0o0160, // Too many tries for an IDAM (identifies header)
+            NO_DATA:    0o0170, // Data AM not found in allotted time
+            CRC_DATA:   0o0200, // CRC error on reading the sector from the disk (No code appears in the ERREG).
+            BAD_PARITY: 0o0210  // All parity errors
+        }
+    },
+    VECTORS: {
+        0o060:  "DL11R",
+        0o064:  "DL11X",
+        0o070:  "PC11R",
+        0o074:  "PC11X",
+        0o100:  "KW11",
+        0o160:  "RL11",
+        0o220:  "RK11",
+        0o264:  "RX11"
+    }
+};
+
+PDP11.RX11.RX01 = [
+    "DX",
+    77,  1, 26, 128,            // disk geometry (CHSN: cylinders, heads, sectors/track, and bytes/sector)
+    1,   0,  0, 128,            // boot code location (cylinder, head, sector index (NOT sector number), and number of bytes)
+    0                           // default drive status
+];
+
+PDP11.RK11.RK05 = [
+    "RK",
+    203, 2, 12, 512,            // disk geometry (CHSN: cylinders, heads, sectors/track, and bytes/sector)
+    0,   0,  0, 512,            // boot code location (cylinder, head, sector index (NOT sector number), and number of bytes)
+    PDP11.RK11.RKDS.RK05 | PDP11.RK11.RKDS.SOK | PDP11.RK11.RKDS.RRDY
+];
+
+PDP11.RL11.RL02K = [
+    "RL",
+    512, 2, 40, 256,            // disk geometry (CHSN: cylinders, heads, sectors/track, and bytes/sector)
+    0,   0,  0, 256,            // boot code location (cylinder, head, sector index (NOT sector number), and number of bytes)
+    PDP11.RL11.RLMP.GS_ST.LOCKON | PDP11.RL11.RLMP.GS_BH | PDP11.RL11.RLMP.GS_HO
+];
+
+PDP11.ACCESS.READ_WORD   = PDP11.ACCESS.WORD | PDP11.ACCESS.READ;       // formerly READ_MODE (2)
+PDP11.ACCESS.READ_BYTE   = PDP11.ACCESS.BYTE | PDP11.ACCESS.READ;       // formerly READ_MODE (2) | BYTE_MODE (1)
+PDP11.ACCESS.WRITE_WORD  = PDP11.ACCESS.WORD | PDP11.ACCESS.WRITE;      // formerly WRITE_MODE (4)
+PDP11.ACCESS.WRITE_BYTE  = PDP11.ACCESS.BYTE | PDP11.ACCESS.WRITE;      // formerly WRITE_MODE (4) | BYTE_MODE (1)
+PDP11.ACCESS.UPDATE_WORD = PDP11.ACCESS.WORD | PDP11.ACCESS.UPDATE;     // formerly MODIFY_WORD (2 | 4)
+PDP11.ACCESS.UPDATE_BYTE = PDP11.ACCESS.BYTE | PDP11.ACCESS.UPDATE;     // formerly MODIFY_BYTE (1 | 2 | 4)
+
+/*
+ * PSW arithmetic flags are NOT stored directly into the PSW register; they are maintained across separate flag registers.
+ */
+PDP11.PSW.FLAGS         = (PDP11.PSW.NF | PDP11.PSW.ZF | PDP11.PSW.VF | PDP11.PSW.CF);
+
+/*
+ * Combine all the shared globals and machine-specific globals into one machine-specific global object,
+ * which all machine components should start using; eg: "if (PDP11.DEBUGGER)" instead of "if (DEBUGGER)".
+ */
+PDP11.APPCLASS          = APPCLASS;
+PDP11.APPNAME           = APPNAME;
+PDP11.DEBUGGER          = DEBUGGER;
+PDP11.BYTEARRAYS        = BYTEARRAYS;
+PDP11.TYPEDARRAYS       = TYPEDARRAYS;
+PDP11.MEMFAULT          = MEMFAULT;
+PDP11.WORDBUS           = WORDBUS;
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/messages.js (C) Jeff Parsons 2012-2017
+ */
+
+var MessagesPDP11 = {
+    CPU:        0x00000001,
+    TRAP:       0x00000002,
+    FAULT:      0x00000004,
+    INT:        0x00000008,
+    BUS:        0x00000010,
+    MEMORY:     0x00000020,
+    MMU:        0x00000040,
+    ROM:        0x00000080,
+    DEVICE:     0x00000100,
+    PANEL:      0x00000200,
+    KEYBOARD:   0x00000400,
+    KEYS:       0x00000800,
+    PC11:       0x00001000,
+    PAPER:      0x00001000,
+    DISK:       0x00002000,
+    READ:       0x00004000,
+    WRITE:      0x00008000,
+    RK11:       0x00010000,
+    RL11:       0x00020000,
+    RX11:       0x00040000,
+    DL11:       0x00100000,
+    SERIAL:     0x00100000,
+    KW11:       0x00200000,
+    TIMER:      0x00200000,
+    SPEAKER:    0x01000000,
+    COMPUTER:   0x02000000,
+    LOG:        0x10000000,
+    WARN:       0x20000000,
+    BUFFER:     0x40000000,
+    HALT:       0x80000000|0
+};
+
+/*
+ * Message categories supported by the messageEnabled() function and other assorted message
+ * functions. Each category has a corresponding bit value that can be combined (ie, OR'ed) as
+ * needed.  The Debugger's message command ("m") is used to turn message categories on and off,
+ * like so:
+ *
+ *      m port on
+ *      m port off
+ *      ...
+ *
+ * NOTE: The order of these categories can be rearranged, alphabetized, etc, as desired; just be
+ * aware that changing the bit values could break saved Debugger states (not a huge concern, just
+ * something to be aware of).
+ */
+MessagesPDP11.CATEGORIES = {
+    "cpu":      MessagesPDP11.CPU,
+    "trap":     MessagesPDP11.TRAP,
+    "fault":    MessagesPDP11.FAULT,
+    "int":      MessagesPDP11.INT,
+    "bus":      MessagesPDP11.BUS,
+    "memory":   MessagesPDP11.MEMORY,
+    "mmu":      MessagesPDP11.MMU,
+    "rom":      MessagesPDP11.ROM,
+    "device":   MessagesPDP11.DEVICE,
+    "panel":    MessagesPDP11.PANEL,
+    "keyboard": MessagesPDP11.KEYBOARD, // "kbd" is also allowed as shorthand for "keyboard"; see doMessages()
+    "key":      MessagesPDP11.KEYS,     // using "key" instead of "keys", since the latter is a method on JavasScript objects
+    "pc11":     MessagesPDP11.PC11,
+    "paper":    MessagesPDP11.PAPER,
+    "disk":     MessagesPDP11.DISK,
+    "read":     MessagesPDP11.READ,
+    "write":    MessagesPDP11.WRITE,
+    "rk11":     MessagesPDP11.RK11,
+    "rl11":     MessagesPDP11.RL11,
+    "rx11":     MessagesPDP11.RX11,
+    "dl11":     MessagesPDP11.DL11,
+    "serial":   MessagesPDP11.SERIAL,
+    "kw11":     MessagesPDP11.KW11,
+    "timer":    MessagesPDP11.TIMER,
+    "speaker":  MessagesPDP11.SPEAKER,
+    "computer": MessagesPDP11.COMPUTER,
+    "log":      MessagesPDP11.LOG,
+    "warn":     MessagesPDP11.WARN,
+    /*
+     * Now we turn to message actions rather than message types; for example, setting "halt"
+     * on or off doesn't enable "halt" messages, but rather halts the CPU on any message above.
+     *
+     * Similarly, "m buffer on" turns on message buffering, deferring the display of all messages
+     * until "m buffer off" is issued.
+     */
+    "buffer":   MessagesPDP11.BUFFER,
+    "halt":     MessagesPDP11.HALT
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/panel.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * Since the Closure Compiler treats ES6 classes as @struct rather than @dict by default,
+ * it deters us from defining named properties on our components; eg:
+ *
+ *      this['exports'] = {...}
+ *
+ * results in an error:
+ *
+ *      Cannot do '[]' access on a struct
+ *
+ * So, in order to define 'exports', we must override the @struct assumption by annotating
+ * the class as @unrestricted (or @dict).  Note that this must be done both here and in the
+ * Component class, because otherwise the Compiler won't allow us to *reference* the named
+ * property either.
+ *
+ * TODO: Consider marking ALL our classes unrestricted, because otherwise it forces us to
+ * define every single property the class uses in its constructor, which results in a fair
+ * bit of redundant initialization, since many properties aren't (and don't need to be) fully
+ * initialized until the appropriate init(), reset(), restore(), etc. function is called.
+ *
+ * The upside, however, may be that since the structure of the class is completely defined by
+ * the constructor, JavaScript engines may be able to optimize and run more efficiently.
+ *
+ * @unrestricted
+ */
+class PanelPDP11 extends Component {
+    /**
+     * PanelPDP11(parmsPanel)
+     *
+     * The PanelPDP11 component has no required (parmsPanel) properties.
+     *
+     * @param {Object} parmsPanel
+     * @param {boolean} fBindings (true if panel may have bindings, otherwise not)
+     */
+    constructor(parmsPanel, fBindings)
+    {
+        super("Panel", parmsPanel, MessagesPDP11.PANEL);
+
+        /*
+         * If there are any live registers, LEDs, etc, to display, this will provide a count.
+         * TODO: Add some UI for fDisplayLiveRegs (either an XML property, or a UI checkbox, or both).
+         */
+        this.cLiveRegs = 0;
+        this.nDisplayCount = 0;
+        this.nDisplayLimit = 60;
+        this.fDisplayLiveRegs = true;
+        this.fBindings = fBindings;
+
+        /*
+         * regSwitches contains the Front Panel (aka Console) SWITCH register, which is also available
+         * as a read-only register at 177570 (but only the low 16 bits).  regDisplay contains the DISPLAY
+         * register, a write-only register at the same address.
+         *
+         * regAddr is an internal register containing the contents of the Front Panel's ADDRESS display,
+         * and regData corresponds to the DATA display.  They are updated by updateAddr() and updateData(),
+         * which in turn take care of calling updateLEDArray().
+         *
+         * The state of ALL switches is maintained in this.switches, and likewise all LED states are
+         * maintained in this.leds, but for convenience, we also mirror some of those states in dedicated
+         * variables (eg, regSwitches for the SWITCH register, fLEDTest for the 'TEST' switch, etc).
+         */
+        this.regDisplay = 0;
+        this.regSwitches = 0;
+        this.regAddr = this.regData = 0;
+        this.ledAddr = this.ledData = -1;
+
+        /*
+         * The panel hardware has the following additional (supported) state; note that there are several
+         * settings on a real Front Panel that we don't support (eg, stepping one cycle vs. one instruction).
+         *
+         * While my initial intent is to eventually support all the ADDRSEL switch settings, I probably
+         * won't bother with any DATASEL switch settings; instead, I will automatically display the DISPLAY
+         * register (regDisplay) [the equivalent of selecting 'DISPLAY REGISTER'] except when data is being
+         * examined or deposited [the equivalent of selecting 'DATA PATHS'].
+         */
+        this.fLEDTest = false;              // LED (lamp) test in progress
+        this.fExamine = false;              // true if the previously pressed switch was the 'EXAM' switch
+        this.fDeposit = false;              // true if the previously pressed switch was the 'DEP' switch
+        this.nAddrSel = PanelPDP11.ADDRSEL.CONS_PHY;
+
+        /*
+         * Every LED has a simple numeric value, assigned when setBinding() is called:
+         *
+         *      zero if "off", non-zero if "on"
+         *
+         * initBus() will call displayLEDs() to ensure that every LED is set to its initial value.
+         */
+        this.leds = {};
+
+        /*
+         * Every switch has an array associated with it:
+         *
+         *      [0]: initial value of switch (0 if "down", 1 if "up")
+         *      [1]: current value of switch
+         *      [2]: true if the switch is momentary, false if not
+         *      [3]: true if the switch is currently pressed, false if released
+         *      [4]: optional handler to call whenever the switch is pressed or released
+         *      [5]: optional switch index (used with CNSW switches 'S0' through 'S21')
+         *
+         * initBus() will call displaySwitches() to ensure that every switch is the position represented below.
+         *
+         * NOTE: Not all switches have the same "process" criteria.  For example, 'TEST' will perform a LED test
+         * when it is momentarily pressed "up", whereas 'LOAD [ADRS]' will load the ADDRESS register from the
+         * SWITCH register when it is momentarily pressed "down".
+         *
+         * This means that processLEDTest(value) must act when value == 1 ("up"), whereas processLoadAddr(value)
+         * must act when value == 0 ("down").  You can infer all this from the table below, because the initial value
+         * of any momentary switch is its "inactive" value, so the opposite is its "active" value.
+         */
+        this.switches = {
+            'START':    [1, 1, true,  false, this.processStart],
+            'STEP':     [1, 1, false, false, this.processStep],
+            'ENABLE':   [1, 1, false, false, this.processEnable],
+            'CONT':     [1, 1, true,  false, this.processContinue],
+            'DEP':      [0, 0, true,  false, this.processDeposit],
+            'EXAM':     [1, 1, true,  false, this.processExamine],
+            'LOAD':     [1, 1, true,  false, this.processLoadAddr],
+            'TEST':     [0, 0, true,  false, this.processLEDTest]
+        };
+        for (var i = 0; i < 22; i++) {
+            this.switches['S'+i] = [0, 0, false, false, this.processSRSwitch, i];
+        }
+
+        /** @type {ComputerPDP11} */
+        this.cmp = null;
+
+        /** @type {BusPDP11} */
+        this.bus = null;
+
+        /** @type {CPUStatePDP11} */
+        this.cpu = null;
+
+        /** @type {DebuggerPDP11} */
+        this.dbg = null;
+
+        /*
+         * The 'hold' and 'toggle' exports, which map to holdSwitch() and toggleSwitch(), both press and release
+         * the specified switch, but processCommands() considers a 'hold' function to be asynchronous, which means
+         * that holdSwitch() will be passed a callback function that can be used to implement a delay between the
+         * press and the release, whereas toggleSwitch() will not.
+         *
+         * holdSwitch() only makes sense for momentary switches (eg, 'TEST'), where a visual delay might be nice.
+         * If the switch isn't momentary, or no delay is desired, then use toggleSwitch(); it will be more efficient.
+         *
+         * Finally, for switches that are toggles (eg, 'ENABLE'), you can use setSwitch() to set it to a specific
+         * state: zero for "off" and non-zero for "on".  setSwitch() also supports meta-switches like "SR", using
+         * the entire value to set a series of switches at once; the value is assumed to be octal unless overridden
+         * by a prefix (eg, "0x") or suffix (eg, ".").
+         */
+        this['exports'] = {
+            'hold': this.holdSwitch,
+            'toggle': this.toggleSwitch,
+            'reset': this.resetSwitches,
+            'set': this.setSwitch
+        };
+
+        this.setReady();
+    }
+
+    /**
+     * getAR()
+     *
+     * @this {PanelPDP11}
+     * @return {number} (current ADDRESS register)
+     */
+    getAR()
+    {
+        return this.regAddr;
+    }
+
+    /**
+     * setAR(value)
+     *
+     * @this {PanelPDP11}
+     * @param {number} value (new ADDRESS register)
+     */
+    setAR(value)
+    {
+        this.updateAddr(this.regAddr = value);
+    }
+
+    /**
+     * getDR()
+     *
+     * @this {PanelPDP11}
+     * @return {number} (current DISPLAY register)
+     */
+    getDR()
+    {
+        return this.regDisplay;
+    }
+
+    /**
+     * setDR(value)
+     *
+     * @this {PanelPDP11}
+     * @param {number} value (new DISPLAY register)
+     * @return {number}
+     */
+    setDR(value)
+    {
+        return this.updateData(this.regDisplay = value);
+    }
+
+    /**
+     * getSR()
+     *
+     * @this {PanelPDP11}
+     * @return {number} (current SWITCH register)
+     */
+    getSR()
+    {
+        return this.regSwitches;
+    }
+
+    /**
+     * setSR(value)
+     *
+     * @this {PanelPDP11}
+     * @param {number} value (new SWITCH register)
+     */
+    setSR(value)
+    {
+        this.setSRSwitches(value);
+    }
+
+    /**
+     * getSwitch(name)
+     *
+     * @this {PanelPDP11}
+     * @param {string} name
+     * @return {number|undefined} 0 if switch is off ("down"), 1 if on ("up"), or undefined if unrecognized
+     */
+    getSwitch(name)
+    {
+        return this.switches[name] && this.switches[name][1];
+    }
+
+    /**
+     * reset(fPowerUp)
+     *
+     * NOTE: Since we've registered our handler with the Bus component, we will be called twice whenever
+     * the entire machine is reset: once when the Computer's reset() handler calls the Bus's reset() handler,
+     * and again when the Computer's reset() handler calls us directly.  Multiple resets should be harmless.
+     *
+     * @this {PanelPDP11}
+     * @param {boolean} [fPowerUp]
+     */
+    reset(fPowerUp)
+    {
+        /*
+         * Simulate a call to our stop() handler, to update the panel's ADDRESS register with the current PC.
+         */
+        this.stop();
+        if (fPowerUp) this.setDR(0);
+    }
+
+    /**
+     * setBinding(sType, sBinding, control, sValue)
+     *
+     * Some panel layouts don't have bindings of their own, and even when they do, there may still be some
+     * components (eg, the CPU) that prefer to update their own bindings, so we pass along all binding requests
+     * to the Computer, CPU, Keyboard and Debugger components first.  The order shouldn't matter, since any
+     * component that doesn't recognize the specified binding should simply ignore it.
+     *
+     * @this {PanelPDP11}
+     * @param {string|null} sType is the type of the HTML control (eg, "button", "textarea", "register", "flag", "rled", etc)
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "reset")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sType, sBinding, control, sValue)
+    {
+        if (this.cmp && this.cmp.setBinding(sType, sBinding, control, sValue)) {
+            return true;
+        }
+        if (this.cpu && this.cpu.setBinding(sType, sBinding, control, sValue)) {
+            return true;
+        }
+        if (DEBUGGER && this.dbg && this.dbg.setBinding(sType, sBinding, control, sValue)) {
+            return true;
+        }
+
+        switch (sBinding) {
+        case 'R0':
+        case 'R1':
+        case 'R2':
+        case 'R3':
+        case 'R4':
+        case 'R5':
+        case 'R6':
+        case 'R7':
+        case 'NF':
+        case 'ZF':
+        case 'VF':
+        case 'CF':
+        case 'PS':
+            this.bindings[sBinding] = control;
+            this.cLiveRegs++;
+            return true;
+
+        default:
+            /*
+             * Square ("led") or round ("rled") LEDs are defined in machine XML files like so:
+             *
+             *      <control type="rled" binding="A3" value="1" width="100%" container="center"/>
+             *
+             * Only *type* and *binding* attributes are required; if *value* is omitted, the default value is 0 ("off").
+             */
+            if (sType == "led" || sType == "rled") {
+                this.bindings[sBinding] = control;
+                this.leds[sBinding] = sValue? 1 : 0;
+                this.cLiveRegs++;
+                return true;
+            }
+            /*
+             * Switches are defined in machine XML files like so:
+             *
+             *      <control type="switch" binding="S3" value="1" width="100%" container="center"/>
+             *
+             * Only *type* and *binding* attributes are required; if *value* is omitted, the default value is 0 ("down").
+             *
+             * Currently, there is no XML attribute to indicate whether a switch is "momentary"; only recognized switches
+             * in our internal table can have that attribute.
+             */
+            if (sType == "switch") {
+                /*
+                 * Like LEDs, we allow unrecognized switches to be defined as well, but they won't do anything useful,
+                 * since only recognized switches will have handlers that perform the appropriate operations.
+                 */
+                if (this.switches[sBinding] === undefined) {
+                    this.switches[sBinding] = [sValue? 1 : 0, sValue? 1 : 0];
+                }
+                this.bindings[sBinding] = control;
+                var parent = control.parentElement || control;
+                parent = parent.parentElement || parent;
+                parent.onmousedown = function(panel, sBinding) {
+                    return function onPressSwitch() {
+                        panel.pressSwitch(sBinding);
+                    };
+                }(this, sBinding);
+                parent.onmouseup = parent.onmouseout = function(panel, sBinding) {
+                    return function onReleaseSwitch() {
+                        panel.releaseSwitch(sBinding);
+                    };
+                }(this, sBinding);
+                parent.ontouchstart = function(panel, sBinding) {
+                    return function onPressSwitch(event) {
+                        panel.pressSwitch(sBinding);
+                        event.preventDefault();
+                    };
+                }(this, sBinding);
+                parent.ontouchend = function(panel, sBinding) {
+                    return function onReleaseSwitch() {
+                        panel.releaseSwitch(sBinding);
+                    };
+                }(this, sBinding);
+                return true;
+            }
+            return super.setBinding(sType, sBinding, control, sValue);
+        }
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {PanelPDP11}
+     * @param {ComputerPDP11} cmp
+     * @param {BusPDP11} bus
+     * @param {CPUStatePDP11} cpu
+     * @param {DebuggerPDP11} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cmp = cmp;
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+
+        bus.addIOTable(this, PanelPDP11.UNIBUS_IOTABLE);
+        bus.addResetHandler(this.reset.bind(this));
+
+        this.displayLEDs();
+        this.displaySwitches();
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {PanelPDP11}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            /*
+             * As noted in init(), our powerUp() method gives us a second opportunity to notify any
+             * components that that might care (eg, CPU, Keyboard, and Debugger) that we have some controls
+             * (ie, bindings) they might want to use.
+             */
+            if (this.fBindings) PanelPDP11.init();
+
+            if (!data) {
+                this.reset(true);
+            } else {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {PanelPDP11}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the PanelPDP11 component.
+     *
+     * @this {PanelPDP11}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, [
+            this.getAR(),
+            this.getDR(),
+            this.getSR()
+        ]);
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the PanelPDP11 component.
+     *
+     * @this {PanelPDP11}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        var a = data[0];
+        if (a) {
+            this.setAR(a[0]);
+            this.setDR(a[1]);
+            this.setSR(a[2]);
+        }
+        return true;
+    }
+
+    /**
+     * resetSwitches()
+     *
+     * @this {PanelPDP11}
+     * @return {boolean}
+     */
+    resetSwitches()
+    {
+        for (var sBinding in this.switches) {
+            var sw = this.switches[sBinding];
+            sw[1] = sw[0];
+        }
+        this.displaySwitches();
+        return true;
+    }
+
+    /**
+     * displayLED(sBinding, value)
+     *
+     * @this {PanelPDP11}
+     * @param {string} sBinding
+     * @param {boolean|number} value (true or non-zero if the LED should be on, false or zero if off)
+     */
+    displayLED(sBinding, value)
+    {
+        var control = this.bindings[sBinding];
+        if (control) {
+            /*
+             * TODO: Add support for user-definable LED colors?
+             */
+            control.style.backgroundColor = (value? "#ff0000" : "#000000");
+        }
+    }
+
+    /**
+     * displayLEDs(override)
+     *
+     * @this {PanelPDP11}
+     * @param {boolean|number|null} [override] (true turn on all LEDs, false to turn off all LEDs, null or undefined for normal LED activity)
+     */
+    displayLEDs(override)
+    {
+        for (var sBinding in this.leds) {
+            this.displayLED(sBinding, override != null? override : this.leds[sBinding]);
+        }
+    }
+
+    /**
+     * displaySwitch(sBinding, value)
+     *
+     * @this {PanelPDP11}
+     * @param {string} sBinding
+     * @param {boolean|number} value (true if the switch should be "up" (on), false if "down" (off))
+     */
+    displaySwitch(sBinding, value)
+    {
+        var control = this.bindings[sBinding];
+        if (control) {
+            control.style.marginTop = (value? "0px" : "20px");
+            control.style.backgroundColor = (value? "#00ff00" : "#228B22");
+        }
+    }
+
+    /**
+     * displaySwitches()
+     *
+     * @this {PanelPDP11}
+     */
+    displaySwitches()
+    {
+        for (var sBinding in this.switches) {
+            this.displaySwitch(sBinding, this.switches[sBinding][1]);
+        }
+    }
+
+    /**
+     * displayValue(sLabel, nValue, cch)
+     *
+     * This is principally for displaying register values, but in reality, it can be used to display any
+     * numeric value bound to the given label.
+     *
+     * @this {PanelPDP11}
+     * @param {string} sLabel
+     * @param {number} nValue
+     * @param {number} [cch]
+     */
+    displayValue(sLabel, nValue, cch)
+    {
+        if (this.bindings[sLabel]) {
+            var sVal;
+            var nBase = this.dbg && this.dbg.nBase || 8;
+            nValue = nValue || 0;
+            if (!this.cpu.isRunning() || this.fDisplayLiveRegs) {
+                sVal = nBase == 8? Str.toOct(nValue, cch) : Str.toHex(nValue, cch);
+            } else {
+                sVal = "--------".substr(0, cch || 4);
+            }
+            /*
+             * TODO: Determine if this test actually avoids any redrawing when a register hasn't changed, and/or if
+             * we should maintain our own (numeric) cache of displayed register values (to avoid creating these temporary
+             * string values that will have to garbage-collected), and/or if this is actually slower, and/or if I'm being
+             * too obsessive.
+             */
+            if (this.bindings[sLabel].textContent != sVal) this.bindings[sLabel].textContent = sVal;
+        }
+    }
+
+    /**
+     * holdSwitch(fnCallback, sBinding, sDelay)
+     *
+     * @this {PanelPDP11}
+     * @param {function()|null} fnCallback
+     * @param {string} sBinding
+     * @param {string} [sDelay]
+     * @return {boolean} false if wait required, true otherwise
+     */
+    holdSwitch(fnCallback, sBinding, sDelay)
+    {
+        if (this.pressSwitch(sBinding)) {
+            if (sDelay) {
+                var panel = this;
+                setTimeout(function() {
+                    panel.releaseSwitch(sBinding);
+                    if (fnCallback) fnCallback();
+                }, +sDelay);
+                return false;
+            } else {
+                this.releaseSwitch(sBinding);
+            }
+        }
+        return true;
+    }
+
+    /**
+     * setSwitch(sBinding, sValue)
+     *
+     * @this {PanelPDP11}
+     * @param {string} sBinding
+     * @param {string} sValue
+     * @return {boolean}
+     */
+    setSwitch(sBinding, sValue)
+    {
+        if (sBinding == "SR") {
+            return this.setSRSwitches(Str.parseInt(sValue, 8))
+        }
+        var sw = this.switches[sBinding];
+        if (sw) {
+            sw[1] = +sValue? 1 : 0;
+            this.displaySwitch(sBinding, sw[1]);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * toggleSwitch(sBinding)
+     *
+     * @this {PanelPDP11}
+     * @param {string} sBinding
+     * @return {boolean}
+     */
+    toggleSwitch(sBinding)
+    {
+        if (this.pressSwitch(sBinding)) {
+            this.releaseSwitch(sBinding);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * pressSwitch(sBinding)
+     *
+     * @this {PanelPDP11}
+     * @param {string} sBinding
+     * @return {boolean}
+     */
+    pressSwitch(sBinding)
+    {
+        var sw = this.switches[sBinding];
+        if (sw) {
+            /*
+             * Set the new switch value in sw[1] and then immediately display it
+             */
+            this.displaySwitch(sBinding, (sw[1] = 1 - sw[1]));
+
+            /*
+             * Mark the switch as "pressed"
+             */
+            sw[3] = true;
+
+            /*
+             * Call the appropriate process handler with the current switch value (sw[1])
+             */
+            if (sw[4]) sw[4].call(this, sw[1], sw[5]);
+
+            /*
+             * This helps the next 'DEP' or 'EXAM' press determine if the previous press was the same,
+             * while also ignoring any intervening 'STEP' presses (see processStep() for why we do that).
+             */
+            if (sBinding != PanelPDP11.SWITCH.STEP) {
+                this.fDeposit = (sBinding == PanelPDP11.SWITCH.DEP);
+                this.fExamine = (sBinding == PanelPDP11.SWITCH.EXAM);
+            }
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * releaseSwitch(sBinding)
+     *
+     * @this {PanelPDP11}
+     * @param {string} sBinding
+     * @return {boolean}
+     */
+    releaseSwitch(sBinding)
+    {
+        /*
+         * pressSwitch() is simple: flip the switch's current value in sw[1] and marked it "pressed" in sw[3].
+         *
+         * releaseSwitch() is more complicated, because we must handle both mouseUp and mouseOut events.  The first time
+         * we receive EITHER of those events AND the switch is marked momentary (sw[2]) AND the switch is pressed (sw[3]),
+         * then we must flip the switch back to its original value.
+         *
+         * Otherwise, the only thing we have to do is mark the switch as "released" (ie, set sw[3] to false).
+         */
+        var sw = this.switches[sBinding];
+        if (sw) {
+            if (sw[2] && sw[3]) {
+                /*
+                 * Set the new switch value in sw[1] and then immediately display it
+                 */
+                this.displaySwitch(sBinding, (sw[1] = sw[0]));
+
+                /*
+                 * Call the appropriate process handler with the current switch value (sw[1])
+                 */
+                if (sw[4]) sw[4].call(this, sw[1], sw[5]);
+            }
+            /*
+             * Mark the switch as "released"
+             */
+            sw[3] = false;
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * processStart(value, index)
+     *
+     * @this {PanelPDP11}
+     * @param {number} value
+     * @param {number} [index]
+     */
+    processStart(value, index)
+    {
+        if (!value && !this.cpu.isRunning()) {
+
+            this.cpu.setPC(this.regAddr);
+
+            /*
+             * TODO: Verify what the PDP-11/70 Handbook means when it says that when the 'START' switch
+             * is depressed, "the computer system will be cleared."  I take it to mean that it performs
+             * the equivalent of a RESET instruction.
+             */
+            this.cpu.resetCPU();
+
+            /*
+             * The PDP-11/70 Handbook goes on to say: "If the system needs to be initialized but execution
+             * is not wanted, the START switch should be depressed while the HALT/ENABLE switch is in the HALT
+             * position."
+             */
+            if (this.getSwitch(PanelPDP11.SWITCH.ENABLE)) {
+                this.cpu.startCPU();
+            }
+        }
+    }
+
+    /**
+     * processStep(value, index)
+     *
+     * If value == 1 (our initial value), then the 'STEP' switch is set to "S INST" (step one instruction);
+     * otherwise, it's set to "S BUS CYCLE" (step one bus cycle).
+     *
+     * However, since we can't currently support cycle-stepping, I've decided to innovate a little and
+     * change the meaning of this switch: the normal ("up") position means that successive 'EXAM' and 'DEP'
+     * operations will first add 2 to the ADDRESS register, while the opposite ("down") position means
+     * they will first subtract 2.
+     *
+     * See processLEDTest() for more of these exciting "innovations".  ;-)
+     *
+     * @this {PanelPDP11}
+     * @param {number} value
+     * @param {number} [index]
+     */
+    processStep(value, index)
+    {
+        /*
+         * There's really nothing for us to do here, because the normal press and release handlers
+         * already record the state of this switch, so it can be queried as needed, using getSwitch().
+         */
+    }
+
+    /**
+     * processEnable(value, index)
+     *
+     * If value == 1 (our initial value), then the 'ENABLE'/'HALT' switch is set to 'ENABLE', otherwise 'HALT'.
+     *
+     * @this {PanelPDP11}
+     * @param {number} value
+     * @param {number} [index]
+     */
+    processEnable(value, index)
+    {
+        /*
+         * The "down" (0) position is 'HALT', which stops the CPU; however, the "up" (1) position ('ENABLE')
+         * does NOT start the CPU.  You must press 'CONT' to continue execution, which will either continue for
+         * one instruction if this switch to set to 'HALT' or indefinitely if it is set to 'ENABLE'.
+         */
+        if (!value) {
+            this.cpu.stopCPU();
+        }
+    }
+
+    /**
+     * processContinue(value, index)
+     *
+     * @this {PanelPDP11}
+     * @param {number} value
+     * @param {number} [index]
+     */
+    processContinue(value, index)
+    {
+        if (!value && !this.cpu.isRunning()) {
+            /*
+             * TODO: Technically, we're also supposed to check the 'STEP' switch to determine if we should
+             * step one instruction or just one cycle, but we don't currently have the ability to do the latter.
+             */
+            if (!this.getSwitch(PanelPDP11.SWITCH.ENABLE)) {
+                /*
+                 * Using the Debugger's stepCPU() function is more convenient, and has the pleasant side-effect
+                 * of updating the debugger's display; however, not all machines with a Front Panel will necessarily
+                 * also have the Debugger loaded.
+                 */
+                var dbg = this.dbg;
+                if (dbg && !dbg.isBusy(true)) {
+                    dbg.setBusy(true);
+                    dbg.stepCPU(0, null);
+                    dbg.setBusy(false);
+                }
+                else {
+                    /*
+                     * For this tiny single-instruction burst, mimic what runCPU() does.
+                     */
+                    try {
+                        var nCyclesStep = this.cpu.stepCPU(1);
+                        if (nCyclesStep > 0) {
+                            this.cpu.updateTimers(nCyclesStep);
+                            this.cpu.addCycles(nCyclesStep, true);
+                            this.cpu.updateChecksum(nCyclesStep);
+                        }
+                    }
+                    catch(exception) {
+                        /*
+                         * We assume that any numeric exception was explicitly thrown by the CPU to interrupt the
+                         * current instruction.  For all other exceptions, we attempt a stack dump.
+                         */
+                        if (typeof exception != "number") {
+                            var e = exception;
+                            this.cpu.setError(e.stack || e.message);
+                        }
+                    }
+                }
+
+                /*
+                 * Simulate a call to our stop() handler, to update the panel's ADDRESS register with the new PC.
+                 */
+                this.stop();
+
+                /*
+                 * Going through the normal channels (ie, the Computer's updateDisplays() interface) ensures that
+                 * ALL updateDisplay() handlers will be called, including ours.
+                 *
+                 * NOTE: If we used the Debugger's stepCPU() function, then that includes a call to updateDisplay();
+                 * unfortunately, it will have happened BEFORE we called stop() to update the ADDRESS register, so
+                 * we still need to call it again.
+                 */
+                if (this.cmp) this.cmp.updateDisplays();
+            }
+            else {
+                this.cpu.startCPU();
+            }
+        }
+    }
+
+    /**
+     * processDeposit(value, index)
+     *
+     * @this {PanelPDP11}
+     * @param {number} value
+     * @param {number} [index]
+     */
+    processDeposit(value, index)
+    {
+        if (value && !this.cpu.isRunning()) {
+            if (this.fDeposit) this.advanceAddr();
+            /*
+             * This used to be updateData(), but that only updates regData, whereas setDR() updates both regData and regDisplay,
+             * and for these kinds of explicit Front Panel operations, I'm assuming the values should be synced.
+             */
+            var w = this.setDR(this.regSwitches);
+
+            if (this.nAddrSel == PanelPDP11.ADDRSEL.CONS_PHY) {
+                /*
+                 * TODO: Determine if this needs to take the UNIBUS map into consideration.
+                 */
+                this.bus.setWordDirect(this.regAddr, w);
+            } else {
+                /*
+                 * TODO: This code is obviously incomplete, since it doesn't take into account the precise ADDRSEL mode.
+                 */
+                this.cpu.setWordSafe(this.regAddr, w);
+            }
+        }
+    }
+
+    /**
+     * processExamine(value, index)
+     *
+     * @this {PanelPDP11}
+     * @param {number} value
+     * @param {number} [index]
+     */
+    processExamine(value, index)
+    {
+        if (!value && !this.cpu.isRunning()) {
+            var w;
+            if (this.fExamine) this.advanceAddr();
+            if (this.nAddrSel == PanelPDP11.ADDRSEL.CONS_PHY) {
+                /*
+                 * TODO: Determine if this needs to take the UNIBUS map into consideration.
+                 */
+                w = this.bus.getWordDirect(this.regAddr);
+            } else {
+                /*
+                 * TODO: This code is obviously incomplete, since it doesn't take into account the precise ADDRSEL mode.
+                 */
+                w = this.cpu.getWordSafe(this.regAddr);
+            }
+            /*
+             * This used to be updateData(), but that only updates regData, whereas setDR() updates both regData and regDisplay,
+             * and for these kinds of explicit Front Panel operations, I'm assuming the values should be synced.
+             */
+            this.setDR(w);
+        }
+    }
+
+    /**
+     * processLoadAddr(value, index)
+     *
+     * @this {PanelPDP11}
+     * @param {number} value
+     * @param {number} [index]
+     */
+    processLoadAddr(value, index)
+    {
+        if (!value && !this.cpu.isRunning()) {
+            this.updateAddr(this.regSwitches);
+        }
+    }
+
+    /**
+     * processLEDTest(value, index)
+     *
+     * @this {PanelPDP11}
+     * @param {number} value
+     * @param {number} [index]
+     */
+    processLEDTest(value, index)
+    {
+        if (value) {
+            this.fLEDTest = true;
+            this.displayLEDs(true);
+        } else {
+            this.fLEDTest = false;
+            this.displayLEDs();
+            /*
+             * This is another one of my "innovations": when you're done testing the LEDs, all the switches reset as well.
+             */
+            this.setSRSwitches(0);
+        }
+    }
+
+    /**
+     * processSRSwitch(value, index)
+     *
+     * @this {PanelPDP11}
+     * @param {number} value (normally 0 or 1, but we only depend on it being zero or non-zero)
+     * @param {number} index
+     */
+    processSRSwitch(value, index)
+    {
+        if (value) {
+            this.regSwitches |= 1 << index;
+        } else {
+            this.regSwitches &= ~(1 << index);
+        }
+    }
+
+    /**
+     * advanceAddr()
+     *
+     * This should also take care of the following Front Panel behaviors when the accessing the general-purpose
+     * registers:
+     *
+     *      1) ADDRESS display incremented by 1 (instead of 2)
+     *      2) The STEP after the last register is 177700, such that the addresses are looped
+     *
+     * A third behavior is NOT emulated: preventing the ADDRESS from stepping to the first General Register (177700)
+     * from 177676.
+     *
+     * @this {PanelPDP11}
+     * @return {number}
+     */
+    advanceAddr()
+    {
+        var nRegs = this.cpu.model <= PDP11.MODEL_1140? 8 : 16;
+        var fGenRegs = (this.regAddr >= PDP11.UNIBUS.R0SET0 /*177700*/ && this.regAddr < PDP11.UNIBUS.R0SET0 + nRegs);
+        var inc = fGenRegs? 1 : 2;
+        var mask = fGenRegs? 0xf : this.bus.nBusMask;
+        if (!this.getSwitch(PanelPDP11.SWITCH.STEP)) inc = -inc;
+        return this.updateAddr((this.regAddr & ~mask) | ((this.regAddr + inc) & mask));
+    }
+
+    /**
+     * updateAddr(value)
+     *
+     * @this {PanelPDP11}
+     * @param {number} value
+     * @return {number}
+     */
+    updateAddr(value)
+    {
+        this.regAddr = value & this.bus.nBusMask;
+        if (this.ledAddr !== this.regAddr) {
+            this.ledAddr = this.regAddr;
+            this.updateLEDArray("A", this.ledAddr, 22);
+        }
+        return this.regAddr;
+    }
+
+    /**
+     * updateData(value)
+     *
+     * @this {PanelPDP11}
+     * @param {number} value
+     * @return {number}
+     */
+    updateData(value)
+    {
+        this.regData = value & 0xffff;
+        if (this.ledData !== this.regData) {
+            this.ledData = this.regData;
+            this.updateLEDArray("D", this.ledData, 16);
+        }
+        return this.regData;
+    }
+
+    /**
+     * updateLED(sBinding, value)
+     *
+     * @this {PanelPDP11}
+     * @param {string} sBinding
+     * @param {number} value
+     * @return {number}
+     */
+    updateLED(sBinding, value)
+    {
+        this.leds[sBinding] = value;
+        if (!this.fLEDTest) this.displayLED(sBinding, value);
+        return value;
+    }
+
+    /**
+     * updateLEDArray(sPrefix, value, nLEDs)
+     *
+     * @this {PanelPDP11}
+     * @param {string} sPrefix
+     * @param {number} value
+     * @param {number} nLEDs
+     */
+    updateLEDArray(sPrefix, value, nLEDs)
+    {
+        for (var i = 0; i < nLEDs; i++) {
+            var sBinding = sPrefix + i;
+            this.updateLED(sBinding, value & (1 << i));
+        }
+    }
+
+    /**
+     * setSRSwitches(value)
+     *
+     * @this {PanelPDP11}
+     * @param {number|undefined} value
+     * @return {boolean}
+     */
+    setSRSwitches(value)
+    {
+        this.regSwitches = value | 0;
+        for (var i = 0; i < 22; i++) {
+            this.switches['S'+i][1] = (this.regSwitches & (1 << i))? 1 : 0;
+        }
+        /*
+         * This (re)displays ALL switches, not merely the SR switches, but that's OK.
+         */
+        this.displaySwitches();
+        return true;
+    }
+
+    /**
+     * stop(ms, nCycles)
+     *
+     * This is a notification handler, called by the Computer, to inform us the CPU has now stopped.
+     *
+     * @this {PanelPDP11}
+     * @param {number} [ms]
+     * @param {number} [nCycles]
+     */
+    stop(ms, nCycles)
+    {
+        this.updateAddr(this.cpu.regsGen[7]);
+    }
+
+    /**
+     * setAddr(value, fActive)
+     *
+     * This interface is for passing new addresses to the Front Panel.  However, whether or not this will become the
+     * ADDRESS actually displayed will depend on other settings (see updateStatus() for details).
+     *
+     * @this {PanelPDP11}
+     * @param {number} value
+     * @param {boolean} [fActive] (true if this should become the "active" ADDRESS regardless of other settings)
+     */
+    setAddr(value, fActive)
+    {
+        this.regAddr = value;
+    }
+
+    /**
+     * setData(value, fActive)
+     *
+     * This interface is for passing new data to the Front Panel.  However, whether or not this will become the
+     * DATA actually displayed will depend on the Front Panel's DATASEL switch setting, as well as the fActive flag.
+     *
+     * @this {PanelPDP11}
+     * @param {number} value
+     * @param {boolean} [fActive] (true if this should become the "active" DATA regardless of the DATASEL switch setting)
+     */
+    setData(value, fActive)
+    {
+        if (!fActive) {
+            this.regData = value;
+        } else {
+            this.regDisplay = value;
+        }
+    }
+
+    /**
+     * updateDisplay(nUpdate)
+     *
+     * Called by the Computer component at intervals to update registers, LEDs, etc.
+     *
+     * @this {PanelPDP11}
+     * @param {number} [nUpdate] (-2 for power on, -1 for forced, > 0 for periodic, 0 or undefined otherwise)
+     */
+    updateDisplay(nUpdate)
+    {
+        if (this.cLiveRegs) {
+
+            var fRunning = this.cpu.isRunning();
+            var fWaiting = this.cpu.isWaiting();
+
+            if (nUpdate < 0 || !fRunning || this.fDisplayLiveRegs) {
+
+                /*
+                 * We arbitrarily separate the display elements into two categories: cheap and expensive.
+                 *
+                 * LEDs are considered cheap, register displays are not.  So we'll skip the latter if this
+                 * is a periodic update AND our periodic update counter hasn't reached the periodic update limit.
+                 */
+                if (nUpdate <= 0 || (this.nDisplayCount += nUpdate) >= this.nDisplayLimit) {
+                    for (var i = 0; i < this.cpu.regsGen.length; i++) {
+                        this.displayValue('R'+i, this.cpu.regsGen[i]);
+                    }
+                    var regPSW = this.cpu.getPSW();
+                    this.displayValue("PS", regPSW);
+                    this.displayValue("NF", (regPSW & PDP11.PSW.NF)? 1 : 0, 1);
+                    this.displayValue("ZF", (regPSW & PDP11.PSW.ZF)? 1 : 0, 1);
+                    this.displayValue("VF", (regPSW & PDP11.PSW.VF)? 1 : 0, 1);
+                    this.displayValue("CF", (regPSW & PDP11.PSW.CF)? 1 : 0, 1);
+                    this.nDisplayCount = 0;
+                }
+
+                /*
+                 * Update the ADDRESS and DATA LEDs by selecting the appropriate values.
+                 *
+                 * TODO: There is currently no mechanism for selecting regData over regDisplay;
+                 * we are acting as if the DATASEL switch setting is locked to "DISPLAY REGISTER".
+                 */
+                if (nUpdate < -1) {
+                    this.regAddr = this.cpu.regsGen[7];
+                } else if (nUpdate > 0 && fRunning && !fWaiting) {
+                    this.regAddr = this.cpu.getLastAddr();
+                }
+
+                this.updateAddr(this.regAddr);
+                this.updateData(this.regDisplay);
+
+                var bits = this.cpu.getMMUState();
+                /*
+                 * Bit 0 set if 22-bit, bit 1 set if 18-bit, bit 2 set if 16-bit
+                 */
+                this.updateLED(PanelPDP11.LED.B22, bits & 1);
+                this.updateLED(PanelPDP11.LED.B18, bits & 2);
+                this.updateLED(PanelPDP11.LED.B16, bits & 4);
+            }
+        }
+    }
+
+    /**
+     * readCNSW(addr, fPreWrite)
+     *
+     * If fPreWrite, this is a read-before-write, so we must return the DISPLAY register (ie, regDisplay);
+     * otherwise, this a normal read, so we should return the SWITCH register (ie, regSwitches).
+     *
+     *
+     * @this {PanelPDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.CNSW or 177570)
+     * @param {boolean} [fPreWrite]
+     * @return {number}
+     */
+    readCNSW(addr, fPreWrite)
+    {
+        return (fPreWrite? this.regDisplay : this.regSwitches) & 0xffff;
+    }
+
+    /**
+     * writeCNSW(value, addr)
+     *
+     * Handles writes to the DISPLAY register (ie, regDisplay).
+     *
+     * @this {PanelPDP11}
+     * @param {number} value
+     * @param {number} addr (eg, PDP11.UNIBUS.CNSW or 177570)
+     */
+    writeCNSW(value, addr)
+    {
+        this.regDisplay = value;
+    }
+
+    /**
+     * PanelPDP11.init()
+     *
+     * This function operates on every HTML element of class "panel", extracting the
+     * JSON-encoded parameters for the PanelPDP11 constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a PanelPDP11 component, and then binding
+     * any associated HTML controls to the new component.
+     *
+     * NOTE: Unlike most other component init() functions, this one is designed to be
+     * called multiple times: once at load time, so that we can bind our print()
+     * function to the panel's output control ASAP, and again when the Computer component
+     * is verifying that all components are ready and invoking their powerUp() functions.
+     *
+     * Our powerUp() method gives us a second opportunity to notify any components that
+     * that might care (eg, CPU, Keyboard, and Debugger) that we have some controls they
+     * might want to use.
+     */
+    static init()
+    {
+        var aePanels = Component.getElementsByClass(document, PDP11.APPCLASS, "panel");
+        for (var iPanel=0; iPanel < aePanels.length; iPanel++) {
+            var ePanel = aePanels[iPanel];
+            var parmsPanel = Component.getComponentParms(ePanel);
+            var panel = Component.getComponentByID(parmsPanel['id']);
+            if (!panel) panel = new PanelPDP11(parmsPanel, true);
+            Component.bindComponentControls(panel, ePanel, PDP11.APPCLASS);
+        }
+    }
+}
+
+PanelPDP11.ADDRSEL = {
+    KERNEL_I:   0,      // use a 16-bit virtual address where bits 16 to 21 are always OFF
+    KERNEL_D:   1,      // use a 16-bit virtual address where bits 16 to 21 are always OFF
+    SUPER_I:    2,      // use a 16-bit virtual address where bits 16 to 21 are always OFF
+    SUPER_D:    3,      // use a 16-bit virtual address where bits 16 to 21 are always OFF
+    USER_I:     4,      // use a 16-bit virtual address where bits 16 to 21 are always OFF
+    USER_D:     5,      // use a 16-bit virtual address where bits 16 to 21 are always OFF
+    PROG_PHY:   6,      // display the 22-bit physical address of the current bus cycle generated by the MMU
+    CONS_PHY:   7       // use a 22-bit physical address to perform console operations (e.g., LOAD ADRS, EXAM, & DEP)
+};
+
+/*
+ * To get the current state of a switch; eg::
+ *
+ *      this.getSwitch(PanelPDP11.SWITCH.ENABLE)
+ *
+ * I haven't filled out this table, primarily it only needs to list switches we actually query
+ * (eg, non-momentary ones like 'ENABLE' and 'STEP', and 'EXAM' and 'DEP' since they have special
+ * "step" behavior when pressed more than once in a row).  Ditto for the LED table.
+ */
+PanelPDP11.SWITCH = {
+    DEP:    'DEP',
+    ENABLE: 'ENABLE',
+    EXAM:   'EXAM',
+    STEP:   'STEP'
+};
+
+PanelPDP11.LED = {
+    B16:    'B16',
+    B18:    'B18',
+    B22:    'B22'
+};
+
+PanelPDP11.UNIBUS_IOTABLE = {
+    [PDP11.UNIBUS.CNSW]:    /* 177570 */    [null, null, PanelPDP11.prototype.readCNSW, PanelPDP11.prototype.writeCNSW, "CNSW"]
+};
+
+/*
+ * Initialize every Panel module on the page.
+ */
+Web.onInit(PanelPDP11.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/bus.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * Data types used by scanMemory()
+ */
+
+/**
+ * This defines the BlockInfo bit fields used by scanMemory() when it creates the aBlocks array.
+ *
+ * @typedef {{
+ *  num:    BitField,
+ *  count:  BitField,
+ *  btmod:  BitField,
+ *  type:   BitField
+ * }}
+ */
+var BlockInfoPDP11 = Usr.defineBitFields({num:20, count:8, btmod:1, type:3});
+
+/**
+ * BusInfoPDP11 object definition (returned by scanMemory())
+ *
+ *  cbTotal:    total bytes allocated
+ *  cBlocks:    total Memory blocks allocated
+ *  aBlocks:    array of allocated Memory block numbers
+ *
+ * @typedef {{
+ *  cbTotal:    number,
+ *  cBlocks:    number,
+ *  aBlocks:    Array.<BlockInfoPDP11>
+ * }}
+ */
+var BusInfoPDP11;
+
+class BusPDP11 extends Component {
+    /**
+     * BusPDP11(parmsBus, cpu, dbg)
+     *
+     * The BusPDP11 component manages physical memory and I/O address spaces.
+     *
+     * The BusPDP11 component has no UI elements, so it does not require an init() handler,
+     * but it still inherits from the Component class and must be allocated like any
+     * other device component.  It's currently allocated by the Computer's init() handler,
+     * which then calls the initBus() method of all the other components.
+     *
+     * For memory beyond the simple needs of the ROM and RAM components (ie, memory-mapped
+     * devices), the address space must still be allocated through the BusPDP11 component via
+     * addMemory().  If the component needs something more than simple read/write storage,
+     * it must provide a custom controller.
+     *
+     * @param {Object} parmsBus
+     * @param {CPUStatePDP11} cpu
+     * @param {DebuggerPDP11} dbg
+     */
+    constructor(parmsBus, cpu, dbg)
+    {
+        super("Bus", parmsBus, MessagesPDP11.BUS);
+
+        this.cpu = cpu;
+        this.dbg = dbg;
+
+        /*
+         * Supported values for nBusWidth are 16 (default), 18, and 22.  This represents the maximum size
+         * of the bus for the life of the machine, regardless what memory management mode the CPU has enabled.
+         */
+        this.nBusWidth = +parmsBus['busWidth'] || 16;
+
+        /*
+         * Compute all BusPDP11 memory block parameters now, based on the width of the bus.
+         *
+         * Note that all PCjs machines divide their address space into blocks, using a block size appropriate for
+         * the machine's bus width.  This allows us to efficiently allocate the entire address space, by reusing blocks
+         * as appropriate, and to define to different address behaviors on a block-granular level.
+         *
+         * For PDPjs machines, the ideal block size is 8Kb (IOPAGE_LENGTH), the size of the IOPAGE on all PDP-11 machines;
+         * as a result, our IOController functions assume that all incoming offsets are within a single 8Kb block.
+         */
+        this.addrTotal = 1 << this.nBusWidth;
+        this.nBusMask = (this.addrTotal - 1);
+        this.nBlockSize = BusPDP11.IOPAGE_LENGTH;
+        this.nBlockShift = Math.log2(this.nBlockSize);      // ES6 ALERT (alternatively: Math.log(this.nBlockSize) / Math.LN2)
+        this.nBlockLen = this.nBlockSize >> 2;
+        this.nBlockLimit = this.nBlockSize - 1;
+        this.nBlockTotal = (this.addrTotal / this.nBlockSize) | 0;
+        this.nBlockMask = this.nBlockTotal - 1;
+
+
+        /*
+         * aIOHandlers is an array (ie, a hash) of I/O notification handlers, indexed by address, where each
+         * entry contains an array:
+         *
+         *      [0]: readByte(addr)
+         *      [1]: writeByte(b, addr)
+         *      [2]: readWord(addr)
+         *      [3]: writeWord(w, addr)
+         *
+         * Each of these 4-element arrays are similar to the memory access arrays assigned to entire Memory
+         * blocks, but these handlers generally target a specific address (or handful of addresses), while
+         * Memory access handlers must service the entire block; see the setAccess() function in the Memory
+         * component for details.
+         *
+         * Finally, for debugging purposes, if an I/O address has a symbolic name and message category,
+         * they will be saved here:
+         *
+         *      [4]: symbolic name of I/O address
+         *      [5]: message category
+         *
+         * UPDATE: The Debugger wants to piggy-back on these arrays to indicate addresses for which it wants
+         * notification.  In those cases, the following additional element will be set:
+         *
+         *      [6]: true to break on I/O, false to ignore I/O
+         *
+         * The false case is important if fIOBreakAll is set, because it allows the Debugger to selectively
+         * ignore specific addresses.
+         */
+        this.aIOHandlers = [];
+        this.fIOBreakAll = false;
+        this.nDisableFaults = 0;
+        this.fFault = false;
+
+        /*
+         * Array of RESET notification handlers registered by Device components.
+         */
+        this.afnReset = [];
+
+        /*
+         * Before we can add any memory blocks that declare our component as a custom memory controller,
+         * we must initialize the array that the getControllerAccess() method supplies to the Memory component.
+         */
+        this.afnIOPage = [
+            BusPDP11.IOController.readByte,
+            BusPDP11.IOController.writeByte,
+            BusPDP11.IOController.readWord,
+            BusPDP11.IOController.writeWord
+        ];
+
+        /*
+         * Define all the properties to be initialized by initMemory()
+         */
+        this.aBusBlocks = this.aMemBlocks = [];
+        this.iBlockIOPageBus = this.iBlockIOPageMem = 0;
+        this.addrIOPage = this.nIOPageRange = this.nMemMask = 0;
+
+        /*
+         * We're ready to allocate empty Memory blocks to span the entire physical address space, including the
+         * initial location of the IOPAGE.
+         */
+        this.initMemory();
+
+        this.setReady();
+    }
+
+    /**
+     * initMemory()
+     *
+     * Allocate enough (empty) Memory blocks to span the entire physical address space.
+     *
+     * Note that we now maintain two parallel arrays of these Memory blocks: aBusBlocks is for use by
+     * devices (or any component using the "direct" interfaces), while aMemBlocks is for use by the CPU.
+     *
+     * Whereas the Bus memory map is fixed at init time, the CPU's memory map will vary depending on MMU
+     * settings.  The CPU will call setIOPageRange() as needed to update the range of addressible memory,
+     * which in turn will determine where the IOPAGE can be accessed.
+     *
+     * @this {BusPDP11}
+     */
+    initMemory()
+    {
+        var block = new MemoryPDP11(this);
+        block.copyBreakpoints(this.dbg);
+
+        this.aBusBlocks = new Array(this.nBlockTotal);
+        this.aMemBlocks = new Array(this.nBlockTotal);
+        for (var iBlock = 0; iBlock < this.nBlockTotal; iBlock++) {
+            this.aBusBlocks[iBlock] = this.aMemBlocks[iBlock] = block;
+        }
+        /*
+         * NOTE: Don't confuse the Bus addrIOPage with the CPU's addrIOPage; ours is fixed,
+         * based on the machine's Bus width, whereas the CPU's varies according to the MMU setting.
+         */
+        this.addrIOPage = this.addrTotal - BusPDP11.IOPAGE_LENGTH;
+        this.addMemory(this.addrIOPage, BusPDP11.IOPAGE_LENGTH, MemoryPDP11.TYPE.CONTROLLER, this);
+
+        this.iBlockIOPageBus = (this.addrIOPage & this.nBusMask) >>> this.nBlockShift;
+        this.iBlockIOPageMem = this.iBlockIOPageBus;
+
+        this.nIOPageRange = 0;
+        this.nMemMask = this.nBusMask;
+    }
+
+    /**
+     * setIOPageRange(nRange)
+     *
+     * This function is responsible for syncing the CPU memory map (aMemBlocks) with the Bus memory map (aBusBlocks)
+     * and then updating the location of the IOPAGE within the CPU's memory map.  The location of the IOPAGE is always
+     * fixed at the top of the Bus address space, but it moves (logically) within the CPU's address space according
+     * to the CPU's current MMU settings, which nRange is a reflection of.
+     *
+     * @this {BusPDP11}
+     * @param {number} nRange (16, 18 or 22; 0 removes the IOPAGE altogether)
+     */
+    setIOPageRange(nRange)
+    {
+        if (nRange != this.nIOPageRange) {
+            for (var iBlock = 0; iBlock < this.nBlockTotal; iBlock++) {
+                this.aMemBlocks[iBlock] = this.aBusBlocks[iBlock];
+            }
+            this.nIOPageRange = 0;
+            this.nMemMask = this.nBusMask;
+            if (nRange) {
+                this.nIOPageRange = nRange;
+                var addr = (1 << nRange);
+                this.nMemMask = (addr - 1);
+                addr -= BusPDP11.IOPAGE_LENGTH;
+                this.iBlockIOPageMem = (addr & this.nMemMask) >>> this.nBlockShift;
+                this.aMemBlocks[this.iBlockIOPageMem] = this.aBusBlocks[this.iBlockIOPageBus];
+            }
+        }
+    }
+
+    /**
+     * getControllerBuffer(addr)
+     *
+     * Our Bus component also acts as custom memory controller for the IOPAGE, so it must also provide this function.
+     *
+     * @this {BusPDP11}
+     * @param {number} addr
+     * @return {Array} containing the buffer (and the offset within that buffer that corresponds to the requested block)
+     */
+    getControllerBuffer(addr)
+    {
+        /*
+         * No buffer is required for the IOPAGE; all accesses go to registered I/O handlers or to fault().
+         */
+        return [null, 0];
+    }
+
+    /**
+     * getControllerAccess()
+     *
+     * Our Bus component also acts as custom memory controller for the IOPAGE, so it must also provide this function.
+     *
+     * @this {BusPDP11}
+     * @return {Array.<function()>}
+     */
+    getControllerAccess()
+    {
+        return this.afnIOPage;
+    }
+
+    /**
+     * getWidth()
+     *
+     * @this {BusPDP11}
+     * @return {number}
+     */
+    getWidth()
+    {
+        return this.nBusWidth;
+    }
+
+    /**
+     * reset()
+     *
+     * Call all registered reset() handlers.
+     *
+     * @this {BusPDP11}
+     */
+    reset()
+    {
+        for (var i = 0; i < this.afnReset.length; i++) {
+            this.afnReset[i]();
+        }
+        this.setIOPageRange(16);
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {BusPDP11}
+     * @param {Object|null} data (always null because we supply no powerDown() handler)
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            if (!data) {
+                this.reset();
+            } else {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {BusPDP11}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * save()
+     *
+     * @this {BusPDP11}
+     * @return {Object|null}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, this.saveMemory());
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * @this {BusPDP11}
+     * @param {Object} data
+     * @return {boolean} true if restore successful, false if not
+     */
+    restore(data)
+    {
+        return this.restoreMemory(data[0]);
+    }
+
+    /**
+     * addMemory(addr, size, type, controller)
+     *
+     * Adds new Memory blocks to the specified address range.  Any Memory blocks previously
+     * added to that range must first be removed via removeMemory(); otherwise, you'll get
+     * an allocation conflict error.  This helps prevent address calculation errors, redundant
+     * allocations, etc.
+     *
+     * We've relaxed some of the original requirements (ie, that addresses must start at a
+     * block-granular address, or that sizes must be equal to exactly one or more blocks),
+     * because machines with large block sizes can make it impossible to load certain ROMs at
+     * their required addresses.  Every allocation still allocates a whole number of blocks.
+     *
+     * Even so, BusPDP11 memory management does NOT provide a general-purpose heap.  Most memory
+     * allocations occur during machine initialization and never change.  In particular, there
+     * is NO support for removing partial-block allocations.
+     *
+     * Each Memory block keeps track of a start address (addr) and length (used), indicating
+     * the used space within the block; any free space that precedes or follows that used space
+     * can be allocated later, by simply extending the beginning or ending of the previously used
+     * space.  However, any holes that might have existed between the original allocation and an
+     * extension are subsumed by the extension.
+     *
+     * @this {BusPDP11}
+     * @param {number} addr is the starting physical address of the request
+     * @param {number} size of the request, in bytes
+     * @param {number} type is one of the MemoryPDP11.TYPE constants
+     * @param {Object} [controller] is an optional memory controller component
+     * @return {boolean} true if successful, false if not
+     */
+    addMemory(addr, size, type, controller)
+    {
+        var addrNext = addr;
+        var sizeLeft = size;
+        var iBlock = addrNext >>> this.nBlockShift;
+
+        while (sizeLeft > 0 && iBlock < this.aBusBlocks.length) {
+
+            var block = this.aBusBlocks[iBlock];
+            var addrBlock = iBlock * this.nBlockSize;
+            var sizeBlock = this.nBlockSize - (addrNext - addrBlock);
+            if (sizeBlock > sizeLeft) sizeBlock = sizeLeft;
+
+            /*
+             * addMemory() will now happily replace an existing block when a memory controller is specified;
+             * this is a work-around to make life easier for setIOPageRange(), which otherwise would have to call
+             * removeMemory() first, which would just waste time and memory allocating more (empty) blocks.
+             */
+            if (!controller && block && block.size) {
+                if (block.type == type /* && block.controller == controller */) {
+                    /*
+                     * Where there is already a similar block with a non-zero size, we allow the allocation only if:
+                     *
+                     *   1) addrNext + sizeLeft <= block.addr (the request precedes the used portion of the current block), or
+                     *   2) addrNext >= block.addr + block.used (the request follows the used portion of the current block)
+                     */
+                    if (addrNext + sizeLeft <= block.addr) {
+                        block.used += (block.addr - addrNext);
+                        block.addr = addrNext;
+                        return true;
+                    }
+                    if (addrNext >= block.addr + block.used) {
+                        var sizeAvail = block.size - (addrNext - addrBlock);
+                        if (sizeAvail > sizeLeft) sizeAvail = sizeLeft;
+                        block.used = addrNext - block.addr + sizeAvail;
+                        addrNext = addrBlock + this.nBlockSize;
+                        sizeLeft -= sizeAvail;
+                        iBlock++;
+                        continue;
+                    }
+                }
+                return this.reportError(BusPDP11.ERROR.RANGE_INUSE, addrNext, sizeLeft);
+            }
+
+            var blockNew = new MemoryPDP11(this, addrNext, sizeBlock, this.nBlockSize, type, controller);
+            blockNew.copyBreakpoints(this.dbg, block);
+            this.aBusBlocks[iBlock++] = blockNew;
+
+            addrNext = addrBlock + this.nBlockSize;
+            sizeLeft -= sizeBlock;
+        }
+
+        if (sizeLeft <= 0) {
+            this.status("Added " + (size >> 10) + "Kb " + MemoryPDP11.TYPE_NAMES[type] + " at " + Str.toOct(addr));
+            return true;
+        }
+
+        return this.reportError(BusPDP11.ERROR.RANGE_INVALID, addr, size);
+    }
+
+    /**
+     * cleanMemory(addr, size)
+     *
+     * @this {BusPDP11}
+     * @param {number} addr
+     * @param {number} size
+     * @return {boolean} true if all blocks were clean, false if dirty; all blocks are cleaned in the process
+     */
+    cleanMemory(addr, size)
+    {
+        var fClean = true;
+        var iBlock = addr >>> this.nBlockShift;
+        while (size > 0 && iBlock < this.aBusBlocks.length) {
+            if (this.aBusBlocks[iBlock].fDirty) {
+                this.aBusBlocks[iBlock].fDirty = fClean = false;
+                this.aBusBlocks[iBlock].fDirtyEver = true;
+            }
+            size -= this.nBlockSize;
+            iBlock++;
+        }
+        return fClean;
+    }
+
+    /**
+     * zeroMemory(addr, size, pattern)
+     *
+     * @this {BusPDP11}
+     * @param {number} addr
+     * @param {number} size
+     * @param {number} [pattern]
+     */
+    zeroMemory(addr, size, pattern)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = addr >>> this.nBlockShift;
+        while (size > 0 && iBlock < this.aBusBlocks.length) {
+            this.aBusBlocks[iBlock].zero(off, size, pattern);
+            size -= this.nBlockSize;
+            iBlock++;
+            off = 0;
+        }
+    }
+
+    /**
+     * scanMemory(info, addr, size)
+     *
+     * Returns a BusInfoPDP11 object for the specified address range.
+     *
+     * @this {BusPDP11}
+     * @param {BusInfoPDP11} [info] previous BusInfoPDP11, if any
+     * @param {number} [addr] starting address of range (0 if none provided)
+     * @param {number} [size] size of range, in bytes (up to end of address space if none provided)
+     * @return {BusInfoPDP11} updated info (or new info if no previous info provided)
+     */
+    scanMemory(info, addr, size)
+    {
+        if (addr == null) addr = 0;
+        if (size == null) size = (this.addrTotal - addr) | 0;
+        if (info == null) info = {cbTotal: 0, cBlocks: 0, aBlocks: []};
+
+        var iBlock = addr >>> this.nBlockShift;
+        var iBlockMax = ((addr + size - 1) >>> this.nBlockShift);
+
+        info.cbTotal = 0;
+        info.cBlocks = 0;
+        while (iBlock <= iBlockMax) {
+            var block = this.aBusBlocks[iBlock];
+            info.cbTotal += block.size;
+            if (block.size) {
+                info.aBlocks.push(/** @type {BlockInfoPDP11} */ (Usr.initBitFields(BlockInfoPDP11, iBlock, 0, 0, block.type)));
+                info.cBlocks++
+            }
+            iBlock++;
+        }
+        return info;
+    }
+
+    /**
+     * removeMemory(addr, size)
+     *
+     * Replaces every block in the specified address range with empty Memory blocks that ignore all reads/writes.
+     *
+     * TODO: Update the removeMemory() interface to reflect the relaxed requirements of the addMemory() interface.
+     *
+     * @this {BusPDP11}
+     * @param {number} addr
+     * @param {number} size
+     * @return {boolean} true if successful, false if not
+     */
+    removeMemory(addr, size)
+    {
+        if (!(addr & this.nBlockLimit) && size && !(size & this.nBlockLimit)) {
+            var iBlock = addr >>> this.nBlockShift;
+            while (size > 0) {
+                var blockOld = this.aBusBlocks[iBlock];
+                var blockNew = new MemoryPDP11(this, addr);
+                blockNew.copyBreakpoints(this.dbg, blockOld);
+                this.aBusBlocks[iBlock++] = blockNew;
+                addr = iBlock * this.nBlockSize;
+                size -= this.nBlockSize;
+            }
+            return true;
+        }
+        return this.reportError(BusPDP11.ERROR.RANGE_INVALID, addr, size);
+    }
+
+    /**
+     * getMemoryBlocks(addr, size)
+     *
+     * @this {BusPDP11}
+     * @param {number} addr is the starting physical address
+     * @param {number} size of the request, in bytes
+     * @return {Array} of Memory blocks
+     */
+    getMemoryBlocks(addr, size)
+    {
+        var aBlocks = [];
+        var iBlock = addr >>> this.nBlockShift;
+        while (size > 0 && iBlock < this.aBusBlocks.length) {
+            aBlocks.push(this.aBusBlocks[iBlock++]);
+            size -= this.nBlockSize;
+        }
+        return aBlocks;
+    }
+
+    /**
+     * setMemoryAccess(addr, size, afn, fQuiet)
+     *
+     * Updates the access functions in every block of the specified address range.  Since the only components
+     * that should be dynamically modifying the memory access functions are those that use addMemory() with a custom
+     * memory controller, we require that the block(s) being updated do in fact have a controller.
+     *
+     * @this {BusPDP11}
+     * @param {number} addr
+     * @param {number} size
+     * @param {Array.<function()>} [afn]
+     * @param {boolean} [fQuiet] (true if any error should be quietly logged)
+     * @return {boolean} true if successful, false if not
+     */
+    setMemoryAccess(addr, size, afn, fQuiet)
+    {
+        if (!(addr & this.nBlockLimit) && size && !(size & this.nBlockLimit)) {
+            var iBlock = addr >>> this.nBlockShift;
+            while (size > 0) {
+                var block = this.aBusBlocks[iBlock];
+                if (!block.controller) {
+                    return this.reportError(BusPDP11.ERROR.NO_CONTROLLER, addr, size, fQuiet);
+                }
+                block.setAccess(afn, true);
+                size -= this.nBlockSize;
+                iBlock++;
+            }
+            return true;
+        }
+        return this.reportError(BusPDP11.ERROR.RANGE_INVALID, addr, size);
+    }
+
+    /**
+     * setMemoryBlocks(addr, size, aBlocks, type)
+     *
+     * If no type is specified, then specified address range uses all the provided blocks as-is;
+     * this form of setMemoryBlocks() is used for complete physical aliases.
+     *
+     * Otherwise, new blocks are allocated with the specified type; the underlying memory from the
+     * provided blocks is still used, but the new blocks may have different access to that memory.
+     *
+     * @this {BusPDP11}
+     * @param {number} addr is the starting physical address
+     * @param {number} size of the request, in bytes
+     * @param {Array} aBlocks as returned by getMemoryBlocks()
+     * @param {number} [type] is one of the MemoryPDP11.TYPE constants
+     */
+    setMemoryBlocks(addr, size, aBlocks, type)
+    {
+        var i = 0;
+        var iBlock = addr >>> this.nBlockShift;
+        while (size > 0 && iBlock < this.aBusBlocks.length) {
+            var block = aBlocks[i++];
+
+            if (!block) break;
+            if (type !== undefined) {
+                var blockNew = new MemoryPDP11(this, addr);
+                blockNew.clone(block, type, this.dbg);
+                block = blockNew;
+            }
+            this.aBusBlocks[iBlock++] = block;
+            size -= this.nBlockSize;
+        }
+    }
+
+    /**
+     * getByte(addr)
+     *
+     * @this {BusPDP11}
+     * @param {number} addr is a physical address
+     * @return {number} byte (8-bit) value at that address
+     */
+    getByte(addr)
+    {
+        return this.aMemBlocks[(addr & this.nMemMask) >>> this.nBlockShift].readByte(addr & this.nBlockLimit, addr);
+    }
+
+    /**
+     * getWord(addr)
+     *
+     * @this {BusPDP11}
+     * @param {number} addr is a physical address
+     * @return {number} word (16-bit) value at that address
+     */
+    getWord(addr)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = (addr & this.nMemMask) >>> this.nBlockShift;
+        if (!PDP11.WORDBUS && off == this.nBlockLimit) {
+            return this.aMemBlocks[iBlock++].readByte(off, addr) | (this.aMemBlocks[iBlock & this.nBlockMask].readByte(0, addr + 1) << 8);
+        }
+        return this.aMemBlocks[iBlock].readWord(off, addr);
+    }
+
+    /**
+     * setByte(addr, b)
+     *
+     * @this {BusPDP11}
+     * @param {number} addr is a physical address
+     * @param {number} b is the byte (8-bit) value to write
+     */
+    setByte(addr, b)
+    {
+
+        this.aMemBlocks[(addr & this.nMemMask) >>> this.nBlockShift].writeByte(addr & this.nBlockLimit, b, addr);
+    }
+
+    /**
+     * setWord(addr, w)
+     *
+     * @this {BusPDP11}
+     * @param {number} addr is a physical address
+     * @param {number} w is the word (16-bit) value to write
+     */
+    setWord(addr, w)
+    {
+        var off = addr & this.nBlockLimit;
+        var iBlock = (addr & this.nMemMask) >>> this.nBlockShift;
+        if (!PDP11.WORDBUS && off == this.nBlockLimit) {
+            this.aMemBlocks[iBlock++].writeByte(off, w & 0xff, addr);
+            this.aMemBlocks[iBlock & this.nBlockMask].writeByte(0, (w >> 8) & 0xff, addr + 1);
+            return;
+        }
+        this.aMemBlocks[iBlock].writeWord(off, w, addr);
+    }
+
+    /**
+     * getBlockDirect(addr)
+     *
+     * @this {BusPDP11}
+     * @param {number} addr is a physical address
+     * @return {MemoryPDP11}
+     */
+    getBlockDirect(addr)
+    {
+        return this.aBusBlocks[(addr & this.nBusMask) >>> this.nBlockShift];
+    }
+
+    /**
+     * getByteDirect(addr)
+     *
+     * This is used for device I/O and Debugger physical memory requests, not the CPU.
+     *
+     * @this {BusPDP11}
+     * @param {number} addr is a physical address
+     * @return {number} byte (8-bit) value at that address
+     */
+    getByteDirect(addr)
+    {
+        this.fFault = false;
+        this.nDisableFaults++;
+        var b = this.getBlockDirect(addr).readByteDirect(addr & this.nBlockLimit, addr);
+        this.nDisableFaults--;
+        return b;
+    }
+
+    /**
+     * getWordDirect(addr)
+     *
+     * This is used for device I/O and Debugger physical memory requests, not the CPU.
+     *
+     * @this {BusPDP11}
+     * @param {number} addr is a physical address
+     * @return {number} word (16-bit) value at that address
+     */
+    getWordDirect(addr)
+    {
+        var w;
+        this.fFault = false;
+        this.nDisableFaults++;
+        var off = addr & this.nBlockLimit;
+        var block = this.getBlockDirect(addr);
+        if (!PDP11.WORDBUS && off == this.nBlockLimit) {
+            w = block.readByteDirect(off, addr) | (this.getBlockDirect(addr + 1).readByteDirect(0, addr + 1) << 8);
+        } else {
+            w = block.readWordDirect(off, addr);
+        }
+        this.nDisableFaults--;
+        return w;
+    }
+
+    /**
+     * setByteDirect(addr, b)
+     *
+     * This is used for device I/O and Debugger physical memory requests, not the CPU.
+     *
+     * @this {BusPDP11}
+     * @param {number} addr is a physical address
+     * @param {number} b is the byte (8-bit) value to write (we truncate it to 8 bits to be safe)
+     */
+    setByteDirect(addr, b)
+    {
+        this.fFault = false;
+        this.nDisableFaults++;
+        this.getBlockDirect(addr).writeByteDirect(addr & this.nBlockLimit, b & 0xff, addr);
+        this.nDisableFaults--;
+    }
+
+    /**
+     * setWordDirect(addr, w)
+     *
+     * This is used for device I/O and Debugger physical memory requests, not the CPU.
+     *
+     * @this {BusPDP11}
+     * @param {number} addr is a physical address
+     * @param {number} w is the word (16-bit) value to write (we truncate it to 16 bits to be safe)
+     */
+    setWordDirect(addr, w)
+    {
+        this.fFault = false;
+        this.nDisableFaults++;
+        var off = addr & this.nBlockLimit;
+        var block = this.getBlockDirect(addr);
+        if (!PDP11.WORDBUS && off == this.nBlockLimit) {
+            block.writeByteDirect(off, w & 0xff, addr);
+            this.getBlockDirect(addr + 1).writeByteDirect(0, (w >> 8) & 0xff, addr + 1);
+        } else {
+            block.writeWordDirect(off, w & 0xffff, addr);
+        }
+        this.nDisableFaults--;
+    }
+
+    /**
+     * addMemBreak(addr, fWrite)
+     *
+     * @this {BusPDP11}
+     * @param {number} addr
+     * @param {boolean} fWrite is true for a memory write breakpoint, false for a memory read breakpoint
+     */
+    addMemBreak(addr, fWrite)
+    {
+        if (DEBUGGER) {
+            var iBlock = addr >>> this.nBlockShift;
+            this.aBusBlocks[iBlock].addBreakpoint(addr & this.nBlockLimit, fWrite);
+        }
+    }
+
+    /**
+     * removeMemBreak(addr, fWrite)
+     *
+     * @this {BusPDP11}
+     * @param {number} addr
+     * @param {boolean} fWrite is true for a memory write breakpoint, false for a memory read breakpoint
+     */
+    removeMemBreak(addr, fWrite)
+    {
+        if (DEBUGGER) {
+            var iBlock = addr >>> this.nBlockShift;
+            this.aBusBlocks[iBlock].removeBreakpoint(addr & this.nBlockLimit, fWrite);
+        }
+    }
+
+    /**
+     * saveMemory(fAll)
+     *
+     * The only memory blocks we save are those marked as dirty, but most likely all of RAM will have been marked dirty,
+     * and even if our dirty-memory flags were as smart as our dirty-sector flags (ie, were set only when a write changed
+     * what was already there), it's unlikely that would reduce the number of RAM blocks we must save/restore.  At least
+     * all the ROM blocks should be clean (except in the unlikely event that the Debugger was used to modify them).
+     *
+     * All dirty blocks will be stored in a single array, as pairs of block numbers and data arrays, like so:
+     *
+     *      [iBlock0, [dw0, dw1, ...], iBlock1, [dw0, dw1, ...], ...]
+     *
+     * In a normal 4Kb block, there will be 1K DWORD values in the data array.  Remember that each DWORD is a signed 32-bit
+     * integer (because they are formed using bitwise operator rather than floating-point math operators), so don't be
+     * surprised to see negative numbers in the data.
+     *
+     * The above example assumes "uncompressed" data arrays.  If we choose to use "compressed" data arrays, the data arrays
+     * will look like:
+     *
+     *      [count0, dw0, count1, dw1, ...]
+     *
+     * where each count indicates how many times the following DWORD value occurs.  A data array length less than 1K indicates
+     * that it's compressed, since we'll only store them in compressed form if they actually shrank, and we'll use State
+     * helper methods compress() and decompress() to create and expand the compressed data arrays.
+     *
+     * @this {BusPDP11}
+     * @param {boolean} [fAll] (true to save all non-ROM memory blocks, regardless of their dirty flags)
+     * @return {Array} a
+     */
+    saveMemory(fAll)
+    {
+        var i = 0;
+        var a = [];
+
+        for (var iBlock = 0; iBlock < this.nBlockTotal; iBlock++) {
+            var block = this.aBusBlocks[iBlock];
+            /*
+             * We have to check both fDirty and fDirtyEver, because we may have called cleanMemory() on some of
+             * the memory blocks (eg, video memory), and while cleanMemory() will clear a dirty block's fDirty flag,
+             * it also sets the dirty block's fDirtyEver flag, which is left set for the lifetime of the machine.
+             */
+            if (fAll && block.type != MemoryPDP11.TYPE.ROM || block.fDirty || block.fDirtyEver) {
+                a[i++] = iBlock;
+                a[i++] = State.compress(block.save());
+            }
+        }
+
+        return a;
+    }
+
+    /**
+     * restoreMemory(a)
+     *
+     * This restores the contents of all Memory blocks; called by CPUState.restore().
+     *
+     * In theory, we ONLY have to save/restore block contents.  Other block attributes,
+     * like the type, the memory controller (if any), and the active memory access functions,
+     * should already be restored, since every component (re)allocates all the memory blocks
+     * it was using when it's restored.  And since the CPU is guaranteed to be the last
+     * component to be restored, all those blocks (and their attributes) should be in place now.
+     *
+     * See saveMemory() for more information on how the memory block contents are saved.
+     *
+     * @this {BusPDP11}
+     * @param {Array} a
+     * @return {boolean} true if successful, false if not
+     */
+    restoreMemory(a)
+    {
+        var i;
+        for (i = 0; i < a.length - 1; i += 2) {
+            var iBlock = a[i];
+            var adw = a[i+1];
+            if (adw && adw.length < this.nBlockLen) {
+                adw = State.decompress(adw, this.nBlockLen);
+            }
+            var block = this.aBusBlocks[iBlock];
+            if (!block || !block.restore(adw)) {
+                /*
+                 * Either the block to restore hasn't been allocated, indicating a change in the machine
+                 * configuration since it was last saved (the most likely explanation) or there's some internal
+                 * inconsistency (eg, the block size is wrong).
+                 */
+                Component.error("Unable to restore memory block " + iBlock);
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * getMemoryLimit(type)
+     *
+     * @this {BusPDP11}
+     * @param {number} type is one of the MemoryPDP11.TYPE constants
+     * @return {number} (the limiting address of the specified memory type, zero if none)
+     */
+    getMemoryLimit(type)
+    {
+        var addr = 0;
+        for (var iBlock = 0; iBlock < this.aBusBlocks.length; iBlock++) {
+            var block = this.aBusBlocks[iBlock];
+            if (block.type == type) {
+                addr = block.addr + block.used;
+            }
+        }
+        return addr;
+    }
+
+    /**
+     * addIOHandlers(start, end, fnReadByte, fnWriteByte, fnReadWord, fnWriteWord, message, sName)
+     *
+     * Add I/O notification handlers to the master list (aIOHandlers).  The start and end addresses are typically
+     * relative to the starting IOPAGE address, but they can also be absolute; we simply mask all addresses with
+     * IOPAGE_MASK.
+     *
+     * CAVEATS: If a conflict is reported, a partial set of handlers may still have been added.  There is no mechanism
+     * for removing handlers, since this is considered an initialization function.  And finally, when a range of addresses
+     * is used, each successive address is advanced by 2, so if you really want to add a handler for a "+1" (usually odd)
+     * address, then you must add it individually.  Failure to do is not necessarily fatal, because the IOController's
+     * fallback behavior for an odd address is to call the byte handler for the preceding even address, but the byte
+     * handler must be prepared for that (the handlers installed by ROM component's addROM() function are a good example).
+     *
+     * @this {BusPDP11}
+     * @param {number} start address
+     * @param {number} end address
+     * @param {function(number)|null|undefined} fnReadByte
+     * @param {function(number,number)|null|undefined} fnWriteByte
+     * @param {function(number)|null|undefined} fnReadWord
+     * @param {function(number,number)|null|undefined} fnWriteWord
+     * @param {number} [message]
+     * @param {string} [sName]
+     * @return {boolean} (true if entire range successfully registered, false if any conflicts)
+     */
+    addIOHandlers(start, end, fnReadByte, fnWriteByte, fnReadWord, fnWriteWord, message, sName)
+    {
+        var index = (start == end? -1 : 0);
+        for (var addr = start; addr <= end; addr += 2) {
+            var off = addr & BusPDP11.IOPAGE_MASK;
+            if (this.aIOHandlers[off] !== undefined) {
+                Component.warning("I/O address already registered: " + Str.toHexLong(addr));
+                return false;
+            }
+            var s = sName || "unknown";
+            if (s && index >= 0) s += index++;
+            this.aIOHandlers[off] = [fnReadByte, fnWriteByte, fnReadWord, fnWriteWord, s, message || MessagesPDP11.BUS, false];
+            if (MAXDEBUG) this.log("addIOHandlers(" + Str.toHexLong(addr) + ")");
+        }
+        return true;
+    }
+
+    /**
+     * addIOTable(component, table, offReg)
+     *
+     * Add I/O notification handlers from the specified table (a batch version of addIOHandlers).
+     *
+     * @this {BusPDP11}
+     * @param {Component} component
+     * @param {Object} table
+     * @param {number} [offReg] (optional offset to add to all register addresses)
+     * @return {boolean} (true if entire range successfully registered, false if any conflicts)
+     */
+    addIOTable(component, table, offReg)
+    {
+        for (var reg in table) {
+            var addr = +reg + (offReg || 0);
+            var afn = table[reg];
+
+            /*
+             * Don't install (ie, ignore) handlers for I/O addresses that are defined with a model number
+             * that is "greater than" than the current model.
+             */
+            if (afn[6] && afn[6] > this.cpu.model) continue;
+
+            var fnReadByte = afn[0]? afn[0].bind(component) : null;
+            var fnWriteByte = afn[1]? afn[1].bind(component) : null;
+            var fnReadWord = afn[2]? afn[2].bind(component) : null;
+            var fnWriteWord = afn[3]? afn[3].bind(component) : null;
+
+            /*
+             * As discussed in the IOController comments below, when handlers are being registered for these
+             * BYTE-granular UNIBUS addresses, we must install custom fallback handlers for all BYTE accesses.
+             */
+            if (addr >= PDP11.UNIBUS.R0SET0 && addr <= PDP11.UNIBUS.R6USER) {
+                if (!fnReadByte && fnReadWord) {
+                    fnReadByte = function readByteIORegister(readWord) {
+                        return function(addr) {
+                            return readWord(addr) & 0xff;
+                        }.bind(component);
+                    }(fnReadWord);
+                }
+                if (!fnWriteByte && fnWriteWord) {
+                    fnWriteByte = function writeByteIORegister(writeWord) {
+                        return function(data, addr) {
+                            return writeWord(data, addr);
+                        }.bind(component);
+                    }(fnWriteWord);
+                }
+            }
+
+            var sReg = afn[4];
+            var nRegs = afn[5] || 1;
+
+            for (var iReg = 0; iReg < nRegs; iReg++, addr += 2) {
+                if (sReg && nRegs > 1) sReg = afn[4] + iReg;
+                if (!this.addIOHandlers(addr, addr, fnReadByte, fnWriteByte, fnReadWord, fnWriteWord, afn[7] || component.bitsMessage, sReg || component.idComponent)) {
+                    return false;
+                }
+            }
+        }
+        return true;
+    }
+
+    /**
+     * getAddrInfo(addr)
+     *
+     * Determine if the physical address is a known IOPAGE address, and return information about it (ie, the name).
+     *
+     * @this {BusPDP11}
+     * @param {number} addr (physical)
+     * @return {string|null}
+     */
+    getAddrInfo(addr)
+    {
+        var sName = null;
+        if (addr >= this.addrIOPage) {
+            var off = addr & BusPDP11.IOPAGE_MASK;
+            var afn = this.aIOHandlers[off];
+            if (afn) sName = afn[BusPDP11.IOHANDLER.REG_NAME];
+        }
+        return sName;
+    }
+
+    /**
+     * getAddrByName(sName)
+     *
+     * Determine if the specified name has a corresponding physical address.
+     *
+     * @this {BusPDP11}
+     * @param {string} sName
+     * @return {number|null}
+     */
+    getAddrByName(sName)
+    {
+        sName = sName.toUpperCase();
+        for (var i in this.aIOHandlers) {
+            var off = +i;
+            var afn = this.aIOHandlers[off];
+            if (afn[BusPDP11.IOHANDLER.REG_NAME] == sName) {
+                return this.addrIOPage + off;
+            }
+        }
+        return null;
+    }
+
+    /**
+     * addResetHandler(fnReset)
+     *
+     * @this {BusPDP11}
+     * @param {function()} fnReset
+     */
+    addResetHandler(fnReset)
+    {
+        this.afnReset.push(fnReset);
+    }
+
+    /**
+     * fault(addr, err, access)
+     *
+     * Bus interface for signaling alignment errors, invalid memory, etc.
+     *
+     * @this {BusPDP11}
+     * @param {number} addr
+     * @param {number} [err]
+     * @param {number} [access] (for diagnostic purposes only)
+     */
+    fault(addr, err, access)
+    {
+        this.fFault = true;
+        if (!this.nDisableFaults) {
+            if (DEBUGGER && this.dbg && this.dbg.messageEnabled(MessagesPDP11.FAULT)) {
+                this.dbg.printMessage("memory fault (" + access + ") on " + this.dbg.toStrBase(addr), true, true);
+            }
+            if (err) this.cpu.regErr |= err;
+            this.cpu.trap(PDP11.TRAP.BUS, 0, addr);
+        }
+    }
+
+    /**
+     * checkFault()
+     *
+     * This also serves as a clearFault() function.
+     *
+     * @this {BusPDP11}
+     * @return {boolean}
+     */
+    checkFault()
+    {
+        var f = this.fFault;
+        this.fFault = false;
+        return f;
+    }
+
+    /**
+     * reportError(errNum, addr, size, fQuiet)
+     *
+     * @this {BusPDP11}
+     * @param {number} errNum
+     * @param {number} addr
+     * @param {number} size
+     * @param {boolean} [fQuiet] (true if any error should be quietly logged)
+     * @return {boolean} false
+     */
+    reportError(errNum, addr, size, fQuiet)
+    {
+        var sError = "Memory block error (" + errNum + ": " + Str.toHex(addr) + "," + Str.toHex(size) + ")";
+        if (fQuiet) {
+            if (this.dbg) {
+                this.dbg.message(sError);
+            } else {
+                this.log(sError);
+            }
+        } else {
+            Component.error(sError);
+        }
+        return false;
+    }
+}
+
+BusPDP11.IOPAGE_16BIT   = 0x00E000; /*000160000*/               // eg, PDP-11/20
+BusPDP11.IOPAGE_18BIT   = 0x03E000; /*000760000*/               // eg, PDP-11/45
+BusPDP11.IOPAGE_22BIT   = 0x3FE000; /*017760000*/               // eg, PDP-11/70
+BusPDP11.IOPAGE_LENGTH  = 0x002000;                             // ie, 8Kb
+BusPDP11.IOPAGE_MASK    = BusPDP11.IOPAGE_LENGTH - 1;
+
+BusPDP11.MASK_18BIT     = 0x03FFFF; /*000777777*/
+
+BusPDP11.UNIBUS_22BIT   = 0x3C0000; /*017000000*/
+BusPDP11.MASK_22BIT     = 0x3FFFFF; /*017777777*/
+
+BusPDP11.ERROR = {
+    RANGE_INUSE:        1,
+    RANGE_INVALID:      2,
+    NO_CONTROLLER:      3
+};
+
+/*
+ * Every entry in the aIOHandlers table is an array with the following indexes:
+ */
+BusPDP11.IOHANDLER = {
+    READ_BYTE:          0,
+    WRITE_BYTE:         1,
+    READ_WORD:          2,
+    WRITE_WORD:         3,
+    REG_NAME:           4,
+    MSG_CATEGORY:       5,
+    DBG_BREAK:          6
+};
+
+/*
+ * These are our custom IOController functions for all IOPAGE accesses.  They look up the IOPAGE
+ * offset in the aIOHandlers table, and if an entry exists, they use the appropriate IOHANDLER indexes
+ * (above) to locate the registered read/write handlers.  If no handler is found, then fault() will
+ * be called, triggering a trap -- unless traps are disabled because direct access was requested
+ * (eg, by the Debugger).
+ *
+ * Handlers receive the original IOPAGE address that was used, although in most cases, it's ignored,
+ * because most handlers usually handle only one address.  Only handlers used for a range of addresses
+ * must pay attention to it.
+ *
+ * Note that these functions include fallbacks for byte reads when only word read handlers exist (by
+ * masking or shifting the result) and for word reads if only byte handlers exist (by combining bytes).
+ * Fallbacks for writes exist, too, but they are slightly more complicated, because a byte write using
+ * a word write handler requires reading the word first, and then updating the appropriate byte within
+ * that word.
+ *
+ * Those fallbacks may not always be appropriate; for example, byte writes to some device registers
+ * must be zero-extended to update the entire word.  For those cases, the fallback's "preliminary" read
+ * is issued with a fPreWrite flag so that the handler can distinguish a normal read from one of these
+ * preliminary reads (aka read-before-write), and return an appropriate value for the update (eg, zero).
+ *
+ * If none of these fallback behaviors are appropriate, the device has a simple recourse: register
+ * handlers for all possible addresses and sizes.
+ *
+ * Unlike regular Memory blocks, IOPAGE accesses permit word accesses on ODD addresses; that works
+ * just fine by registering WORD handlers for the appropriate ODD addresses.  For BYTE accesses, it
+ * depends.  For CPU register addresses, addIOHandlers() installs special byte handlers that perform
+ * either a simple word read or write.  Other addresses must be handled on a case-by-case basis.
+ *
+ * TODO: Another small potential improvement would be for addIOHandlers() to install fallbacks for ALL
+ * missing handlers, in both the ODD and EVEN cases, so there's never a need to check each function index
+ * before calling it.  However, since there's no avoiding checking aIOHandlers[off] (unless we FULLY populate
+ * the aIOHandlers array), and since these I/O accesses should be pretty infrequent relative to all other
+ * memory accesses, the benefit seems pretty minimal.  Plus, all our fallback assumptions still need to be
+ * verified, so let's wait until that's done before we start optimizing this code.
+ */
+BusPDP11.IOController = {
+    /**
+     * readByte(off, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readByte: function(off, addr)
+    {
+        var b = -1;
+        var bus = this.controller;
+        var afn = bus.aIOHandlers[off];
+
+        /*
+         * Since addr is primarily used to advise an I/O handler of the target IOPAGE address, and since we don't want
+         * our handlers to worry about the current IOPAGE location, we truncate addr to 16 bits (the IOPAGE's lowest location).
+         */
+        var addrMasked = addr & 0xffff;
+
+        if (afn) {
+            if (afn[BusPDP11.IOHANDLER.READ_BYTE]) {
+                b = afn[BusPDP11.IOHANDLER.READ_BYTE](addrMasked);
+            } else if (afn[BusPDP11.IOHANDLER.READ_WORD]) {
+                if (!(addrMasked & 0x1)) {
+                    b = afn[BusPDP11.IOHANDLER.READ_WORD](addrMasked) & 0xff;
+                } else {
+                    b = afn[BusPDP11.IOHANDLER.READ_WORD](addrMasked & ~0x1) >> 8;
+                }
+            }
+        } else if (addrMasked & 0x1) {
+            afn = bus.aIOHandlers[off & ~0x1];
+            if (afn) {
+                if (afn[BusPDP11.IOHANDLER.READ_WORD]) {
+                    b = afn[BusPDP11.IOHANDLER.READ_WORD](addrMasked & ~0x1) >> 8;
+                } else if (afn[BusPDP11.IOHANDLER.READ_BYTE]) {
+                    /*
+                     * WARNING: This is an unusual fall-back, because we're trying to read an ODD byte
+                     * access using a BYTE handler registered for EVEN bytes.  But if that's all we've got,
+                     * then presumably the handler is prepared for it (certainly, readROMByte() is).
+                     */
+                    b = afn[BusPDP11.IOHANDLER.READ_BYTE](addrMasked)
+                }
+            }
+        }
+        if (b >= 0) {
+            if (DEBUGGER && this.dbg && this.dbg.messageEnabled(MessagesPDP11.BUS | afn[BusPDP11.IOHANDLER.MSG_CATEGORY])) {
+                this.dbg.printMessage(afn[BusPDP11.IOHANDLER.REG_NAME] + ".readByte(" + this.dbg.toStrBase(addr) + "): " + this.dbg.toStrBase(b), true, !bus.nDisableFaults);
+            }
+            return b;
+        }
+        bus.fault(addr, PDP11.CPUERR.TIMEOUT, PDP11.ACCESS.READ_BYTE);
+        b = 0xff;
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(MessagesPDP11.BUS)) {
+            this.dbg.printMessage("warning: unconverted read access to byte @" + this.dbg.toStrBase(addr) + ": " + this.dbg.toStrBase(b), true, !bus.nDisableFaults);
+        }
+        return b;
+    },
+
+    /**
+     * writeByte(off, b, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} b (which should already be pre-masked to 8 bits)
+     * @param {number} addr
+     */
+    writeByte: function(off, b, addr)
+    {
+        var w;
+        var fWrite = false;
+        var bus = this.controller;
+        var afn = bus.aIOHandlers[off];
+
+        /*
+         * Since addr is primarily used to advise an I/O handler of the target IOPAGE address, and since we don't want
+         * our handlers to worry about the current IOPAGE location, we truncate addr to 16 bits (the IOPAGE's lowest location).
+         */
+        var addrMasked = addr & 0xffff;
+
+        if (afn) {
+            /*
+             * If a writeByte() handler exists, call it; we're done.
+             */
+            if (afn[BusPDP11.IOHANDLER.WRITE_BYTE]) {
+                afn[BusPDP11.IOHANDLER.WRITE_BYTE](b, addrMasked);
+                fWrite = true;
+            }
+            /*
+             * If a writeWord() handler exists, call the readWord() handler first to get the original data
+             * (with fPreWrite set to true) and call writeWord() with the new data inserted into the original data.
+             */
+            else if (afn[BusPDP11.IOHANDLER.WRITE_WORD]) {
+                w = afn[BusPDP11.IOHANDLER.READ_WORD]? afn[BusPDP11.IOHANDLER.READ_WORD](addrMasked, true) : 0;
+                if (!(addrMasked & 0x1)) {
+                    afn[BusPDP11.IOHANDLER.WRITE_WORD]((w & ~0xff) | b, addrMasked);
+                    fWrite = true;
+                } else {
+                    afn[BusPDP11.IOHANDLER.WRITE_WORD]((w & 0xff) | (b << 8), addrMasked & ~0x1);
+                    fWrite = true;
+                }
+            }
+        } else if (addrMasked & 0x1) {
+            /*
+             * If no handler existed, and this address was odd, then perhaps a handler exists for the even address;
+             * if so, call the readWord() handler first to get the original data (with fPreWrite set to true) and call
+             * writeWord() with the new data inserted into (the high byte of) the original data.
+             */
+            afn = bus.aIOHandlers[off & ~0x1];
+            if (afn) {
+                if (afn[BusPDP11.IOHANDLER.WRITE_WORD]) {
+                    addrMasked &= ~0x1;
+                    w = afn[BusPDP11.IOHANDLER.READ_WORD]? afn[BusPDP11.IOHANDLER.READ_WORD](addrMasked, true) : 0;
+                    afn[BusPDP11.IOHANDLER.WRITE_WORD]((w & 0xff) | (b << 8), addrMasked);
+                    fWrite = true;
+                } else if (afn[BusPDP11.IOHANDLER.WRITE_BYTE]) {
+                    /*
+                     * WARNING: This is an unusual fall-back, because we're trying to write an ODD byte
+                     * access using a BYTE handler registered for EVEN bytes.  But if that's all we've got,
+                     * then presumably the handler is prepared for it (certainly, writeROMByte() is).
+                     */
+                    afn[BusPDP11.IOHANDLER.WRITE_BYTE](b, addrMasked);
+                    fWrite = true;
+                }
+            }
+        }
+        if (fWrite) {
+            if (DEBUGGER && this.dbg && this.dbg.messageEnabled(MessagesPDP11.BUS | afn[BusPDP11.IOHANDLER.MSG_CATEGORY])) {
+                this.dbg.printMessage(afn[BusPDP11.IOHANDLER.REG_NAME] + ".writeByte(" + this.dbg.toStrBase(addr) + "," + this.dbg.toStrBase(b) + ")", true, !bus.nDisableFaults);
+            }
+            return;
+        }
+        bus.fault(addr, PDP11.CPUERR.TIMEOUT, PDP11.ACCESS.WRITE_BYTE);
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(MessagesPDP11.BUS)) {
+            this.dbg.printMessage("warning: unconverted write access to byte @" + this.dbg.toStrBase(addr) + ": " + this.dbg.toStrBase(b), true, !bus.nDisableFaults);
+        }
+    },
+
+    /**
+     * readWord(off, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readWord: function(off, addr)
+    {
+        var w = -1;
+        var bus = this.controller;
+        var afn = bus.aIOHandlers[off];
+
+        /*
+         * Since addr is primarily used to advise an I/O handler of the target IOPAGE address, and since we don't want
+         * our handlers to worry about the current IOPAGE location, we truncate addr to 16 bits (the IOPAGE's lowest location).
+         */
+        var addrMasked = addr & 0xffff;
+
+        if (afn) {
+            if (afn[BusPDP11.IOHANDLER.READ_WORD]) {
+                w = afn[BusPDP11.IOHANDLER.READ_WORD](addrMasked);
+            } else if (afn[BusPDP11.IOHANDLER.READ_BYTE]) {
+                w = afn[BusPDP11.IOHANDLER.READ_BYTE](addrMasked) | (afn[BusPDP11.IOHANDLER.READ_BYTE](addrMasked + 1) << 8);
+            }
+        }
+        if (w >= 0) {
+            if (DEBUGGER && this.dbg && this.dbg.messageEnabled(MessagesPDP11.BUS | afn[BusPDP11.IOHANDLER.MSG_CATEGORY])) {
+                this.dbg.printMessage(afn[BusPDP11.IOHANDLER.REG_NAME] + ".readWord(" + this.dbg.toStrBase(addr) + "): " + this.dbg.toStrBase(w), true, !bus.nDisableFaults);
+            }
+            return w;
+        }
+        bus.fault(addr, PDP11.CPUERR.TIMEOUT, PDP11.ACCESS.READ_WORD);
+        w = 0xffff;
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(MessagesPDP11.BUS)) {
+            this.dbg.printMessage("warning: unconverted read access to word @" + this.dbg.toStrBase(addr) + ": " + this.dbg.toStrBase(w), true, !bus.nDisableFaults);
+        }
+        return w;
+    },
+
+    /**
+     * writeWord(off, w, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} w (which should already be pre-masked to 16 bits)
+     * @param {number} addr
+     */
+    writeWord: function(off, w, addr)
+    {
+        var fWrite = false;
+        var bus = this.controller;
+        var afn = bus.aIOHandlers[off];
+
+        /*
+         * Since addr is primarily used to advise an I/O handler of the target IOPAGE address, and since we don't want
+         * our handlers to worry about the current IOPAGE location, we truncate addr to 16 bits (the IOPAGE's lowest location).
+         */
+        var addrMasked = addr & 0xffff;
+
+        if (afn) {
+            if (afn[BusPDP11.IOHANDLER.WRITE_WORD]) {
+                afn[BusPDP11.IOHANDLER.WRITE_WORD](w, addrMasked);
+                fWrite = true;
+            } else if (afn[BusPDP11.IOHANDLER.WRITE_BYTE]) {
+                afn[BusPDP11.IOHANDLER.WRITE_BYTE](w & 0xff, addrMasked);
+                afn[BusPDP11.IOHANDLER.WRITE_BYTE](w >> 8, addrMasked + 1);
+                fWrite = true;
+            }
+        }
+        if (fWrite) {
+            if (DEBUGGER && this.dbg && this.dbg.messageEnabled(MessagesPDP11.BUS | afn[BusPDP11.IOHANDLER.MSG_CATEGORY])) {
+                this.dbg.printMessage(afn[BusPDP11.IOHANDLER.REG_NAME] + ".writeWord(" + this.dbg.toStrBase(addr) + "," + this.dbg.toStrBase(w) + ")", true, !bus.nDisableFaults);
+            }
+            return;
+        }
+        bus.fault(addr, PDP11.CPUERR.TIMEOUT, PDP11.ACCESS.WRITE_WORD);
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(MessagesPDP11.BUS)) {
+            this.dbg.printMessage("warning: unconverted write access to word @" + this.dbg.toStrBase(addr) + ": " + this.dbg.toStrBase(w), true, !bus.nDisableFaults);
+        }
+    }
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/device.js (C) Jeff Parsons 2012-2017
+ */
+
+
+class DevicePDP11 extends Component {
+    /**
+     * DevicePDP11(parmsDevice)
+     *
+     * The Device component implements the following "default" devices:
+     *
+     *      KW11 (KW11-L Line Time Clock)
+     *
+     * as well providing access to all the MMU and CPU registers, PSW, etc.
+     *
+     * @param {Object} parmsDevice
+     */
+    constructor(parmsDevice)
+    {
+        super("Device", parmsDevice, MessagesPDP11.DEVICE);
+
+        this.kw11 = {               // KW11 registers
+            lks:        PDP11.KW11.LKS.MON,
+            timer:      -1          // initBus() will initialize this timer ID
+        };
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {DevicePDP11}
+     * @param {ComputerPDP11} cmp
+     * @param {BusPDP11} bus
+     * @param {CPUStatePDP11} cpu
+     * @param {DebuggerPDP11} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cmp = cmp;
+        this.cpu = cpu;
+        this.dbg = dbg;
+
+        var device = this;
+        this.kw11.timer = cpu.addTimer(function() {
+            device.interruptKW11();
+        });
+
+        this.kw11.irq = cpu.addIRQ(PDP11.KW11.VEC, PDP11.KW11.PRI, MessagesPDP11.KW11);
+
+        bus.addIOTable(this, DevicePDP11.UNIBUS_IOTABLE);
+        bus.addResetHandler(this.reset.bind(this));
+
+        if (DEBUGGER && dbg) {
+            dbg.messageDump(MessagesPDP11.MMU, function onDumpMMU(asArgs) {
+                device.dumpMMU(asArgs);
+            });
+        }
+        this.setReady();
+    }
+
+    /**
+     * dumpMMU(asArgs)
+     *
+     * @this {DevicePDP11}
+     * @param {Array.<string>} asArgs
+     */
+    dumpMMU(asArgs)
+    {
+        if (DEBUGGER) {
+            var cpu = this.cpu;
+            this.dumpRegs("KIPDR", cpu.regsPDR[0], 0, asArgs[0]);
+            this.dumpRegs("KDPDR", cpu.regsPDR[0], 8, asArgs[0]);
+            this.dumpRegs("KIPAR", cpu.regsPAR[0], 0, asArgs[0]);
+            this.dumpRegs("KDPAR", cpu.regsPAR[0], 8, asArgs[0], true);
+            this.dumpRegs("SIPDR", cpu.regsPDR[1], 0, asArgs[0]);
+            this.dumpRegs("SDPDR", cpu.regsPDR[1], 8, asArgs[0]);
+            this.dumpRegs("SIPAR", cpu.regsPAR[1], 0, asArgs[0]);
+            this.dumpRegs("SDPAR", cpu.regsPAR[1], 8, asArgs[0], true);
+            this.dumpRegs("UIPDR", cpu.regsPDR[3], 0, asArgs[0]);
+            this.dumpRegs("UDPDR", cpu.regsPDR[3], 8, asArgs[0]);
+            this.dumpRegs("UIPAR", cpu.regsPAR[3], 0, asArgs[0]);
+            this.dumpRegs("UDPAR", cpu.regsPAR[3], 8, asArgs[0], true);
+            if (cpu.regMMR3 & PDP11.MMR3.UNIBUS_MAP) {
+                this.dumpRegs("UNIMAP", cpu.regsUniMap, -1, asArgs[0]);
+            }
+        }
+    }
+
+    /**
+     * dumpRegs(sName, aRegs, offset, sFilter, fBreak)
+     *
+     * @this {DevicePDP11}
+     * @param {string} sName
+     * @param {Array.<number>} aRegs
+     * @param {number} offset
+     * @param {string} sFilter
+     * @param {boolean} [fBreak]
+     */
+    dumpRegs(sName, aRegs, offset, sFilter, fBreak)
+    {
+        if (DEBUGGER) {
+            var dbg = this.dbg;
+            if (sFilter && sName.indexOf(sFilter.toUpperCase()) < 0) return;
+            var nBits = 0;
+            var nRegs = 8;
+            var sDump = "";
+            var fIndex = false;
+            var nWidth = 8;
+            if (offset < 0) {
+                nBits = 22;
+                nRegs = aRegs.length;
+                offset = 0;
+                fIndex = true;
+                nWidth = 4;
+            }
+            for (var i = 0; i < nRegs; i++) {
+                if (i % nWidth == 0) {
+                    if (sDump) sDump += '\n';
+                    sDump += sName + (fIndex? ('[' + Str.toDec(i, 2) + ']') : '') + ':';
+                }
+                sDump += ' ' + dbg.toStrBase(aRegs[offset + i], nBits);
+            }
+            dbg.println(sDump + (fBreak? '\n' : ''));
+        }
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {DevicePDP11}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            if (!data) {
+                this.reset();
+            } else {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {DevicePDP11}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * reset()
+     *
+     * @this {DevicePDP11}
+     */
+    reset()
+    {
+        this.kw11.lks = PDP11.KW11.LKS.MON;
+        this.cpu.setTimer(this.kw11.timer, 1000/60, true);
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the DevicePDP11 component.
+     *
+     * @this {DevicePDP11}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, [
+            this.kw11.lks
+        ]);
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the DevicePDP11 component.
+     *
+     * @this {DevicePDP11}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        /*
+         * ES6 ALERT: A handy destructuring assignment, which makes it easy to perform the inverse
+         * of what save() does when it collects a bunch of object properties into an array.
+         */
+        [
+            this.kw11.lks
+        ] = data[0];
+
+        return true;
+    }
+
+    /**
+     * interruptKW11()
+     *
+     * We used to call this function only when the the KW11's "Interrupt Enable" bit was set,
+     * but now we call it at 60Hz regardless.  In part, this was so we could piggy-back on it
+     * to drive display updates, but more importantly, the KW11's "Monitor" bit is supposed to
+     * be set at the "line frequency" independent of whether KW11 interrupts are enabled or not.
+     *
+     * @this {DevicePDP11}
+     */
+    interruptKW11()
+    {
+        this.kw11.lks |= PDP11.KW11.LKS.MON;
+        if (this.kw11.lks & PDP11.KW11.LKS.IE) {
+            this.cpu.setIRQ(this.kw11.irq);
+        }
+        if (this.cmp) this.cmp.updateDisplays(1);
+        this.cpu.setTimer(this.kw11.timer, 1000/60);
+    }
+
+    /**
+     * readLKS(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.LKS or 177546)
+     * @return {number}
+     */
+    readLKS(addr)
+    {
+        /*
+         * NOTE: The original code always cleared LKS.MON (bit 7) after snapping the value for the read,
+         * but based on DEC's "Non-Interrupt Mode" programming examples, it's clear that's not how LKS.MON
+         * operates; if the caller wants to clear it, they must explicitly clear it with a write.
+         */
+        return this.kw11.lks;
+    }
+
+    /**
+     * writeLKS(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.LKS or 177546)
+     */
+    writeLKS(data, addr)
+    {
+        /*
+         * NOTE: The original code always cleared LKS.MON (bit 7) as part of any write, but based on DEC's
+         * "Non-Interrupt Mode" programming examples, which explicitly CLRB after TSTB reveals LKS.MON is set,
+         * I think that was wrong, and that all a write should do is mask off all the other (non-writable) bits.
+         */
+        this.kw11.lks = data & PDP11.KW11.LKS.MASK;
+        if (!(this.kw11.lks & PDP11.KW11.LKS.IE)) this.cpu.clearIRQ(this.kw11.irq);
+    }
+
+    /**
+     * readMMR0(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.MMR0 or 177572)
+     * @return {number}
+     */
+    readMMR0(addr)
+    {
+        return this.cpu.getMMR0();
+    }
+
+    /**
+     * writeMMR0(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.MMR0 or 177572)
+     */
+    writeMMR0(data, addr)
+    {
+        this.cpu.setMMR0((data & ~PDP11.MMR0.COMPLETED) | (this.cpu.regMMR0 & PDP11.MMR0.COMPLETED));
+    }
+
+    /**
+     * readMMR1(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.MMR1 or 177574)
+     * @return {number}
+     */
+    readMMR1(addr)
+    {
+        return this.cpu.getMMR1();
+    }
+
+    /**
+     * readMMR2(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.MMR2 or 177576)
+     * @return {number}
+     */
+    readMMR2(addr)
+    {
+        return this.cpu.getMMR2();
+    }
+
+    /**
+     * readMMR3(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.MMR3 or 172516)
+     * @return {number}
+     */
+    readMMR3(addr)
+    {
+        return this.cpu.getMMR3();
+    }
+
+    /**
+     * writeMMR3(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.MMR3 or 172516)
+     */
+    writeMMR3(data, addr)
+    {
+        this.cpu.setMMR3(data);
+    }
+
+    /**
+     * readUNIMAP(addr)
+     *
+     * NOTE: The UNIBUS map ("UNIMAP") is 32 registers spread across 64 words, so we first calculate the word index.
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.UNIMAP)
+     * @return {number}
+     */
+    readUNIMAP(addr)
+    {
+        var word = (addr >> 1) & 0x3f, reg = word >> 1;
+        var data = this.cpu.regsUniMap[reg];
+        return (word & 1)? (data >> 16) : (data & 0xffff);
+    }
+
+    /**
+     * writeUNIMAP(data, addr)
+     *
+     * NOTE: The UNIBUS map ("UNIMAP") is 32 registers spread across 64 words, so we first calculate the word index.
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.UNIMAP)
+     */
+    writeUNIMAP(data, addr)
+    {
+        var word = (addr >> 1) & 0x3f, reg = word >> 1;
+        if (word & 1) {
+            this.cpu.regsUniMap[reg] = (this.cpu.regsUniMap[reg] & 0xffff) | ((data & 0x003f) << 16);
+        } else {
+            this.cpu.regsUniMap[reg] = (this.cpu.regsUniMap[reg] & ~0xffff) | (data & 0xfffe);
+        }
+    }
+
+    /**
+     * readSIPDR(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.SIPDR0--SIPDR7 or 172200--172216)
+     * @return {number}
+     */
+    readSIPDR(addr)
+    {
+        var reg = (addr >> 1) & 7;
+        return this.cpu.regsPDR[1][reg];
+    }
+
+    /**
+     * writeSIPDR(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.SIPDR0--SIPDR7 or 172200--172216)
+     */
+    writeSIPDR(data, addr)
+    {
+        var reg = (addr >> 1) & 7;
+        this.cpu.regsPDR[1][reg] = data & 0xff0f;
+    }
+
+    /**
+     * readSDPDR(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.SDPDR0--SDPDR7 or 172220--172236)
+     * @return {number}
+     */
+    readSDPDR(addr)
+    {
+        var reg = ((addr >> 1) & 7) + 8;
+        return this.cpu.regsPDR[1][reg];
+    }
+
+    /**
+     * writeSDPDR(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.SDPDR0--SDPDR7 or 172220--172236)
+     */
+    writeSDPDR(data, addr)
+    {
+        var reg = ((addr >> 1) & 7) + 8;
+        this.cpu.regsPDR[1][reg] = data & 0xff0f;
+    }
+
+    /**
+     * readSIPAR(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.SIPAR0--SIPAR7 or 172240--172256)
+     * @return {number}
+     */
+    readSIPAR(addr)
+    {
+        var reg = (addr >> 1) & 7;
+        return this.cpu.regsPAR[1][reg];
+    }
+
+    /**
+     * writeSIPAR(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.SIPAR0--SIPAR7 or 172240--172256)
+     */
+    writeSIPAR(data, addr)
+    {
+        var reg = (addr >> 1) & 7;
+        this.cpu.regsPAR[1][reg] = data;
+        this.cpu.regsPDR[1][reg] &= 0xff0f;
+
+    }
+
+    /**
+     * readSDPAR(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.SDPAR0--SDPAR7 or 172260--172276)
+     * @return {number}
+     */
+    readSDPAR(addr)
+    {
+        var reg = ((addr >> 1) & 7) + 8;
+        return this.cpu.regsPAR[1][reg];
+    }
+
+    /**
+     * writeSDPAR(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.SDPAR0--SDPAR7 or 172260--172276)
+     */
+    writeSDPAR(data, addr)
+    {
+        var reg = ((addr >> 1) & 7) + 8;
+        this.cpu.regsPAR[1][reg] = data;
+        this.cpu.regsPDR[1][reg] &= 0xff0f;
+    }
+
+    /**
+     * readKIPDR(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.KIPDR0--KIPDR7 or 172300--172316)
+     * @return {number}
+     */
+    readKIPDR(addr)
+    {
+        var reg = (addr >> 1) & 7;
+        return this.cpu.regsPDR[0][reg];
+    }
+
+    /**
+     * writeKIPDR(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.KIPDR0--KIPDR7 or 172300--172316)
+     */
+    writeKIPDR(data, addr)
+    {
+        var reg = (addr >> 1) & 7;
+        this.cpu.regsPDR[0][reg] = data & 0xff0f;
+    }
+
+    /**
+     * readKDPDR(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.KDPDR0--KDPDR7 or 172320--172336)
+     * @return {number}
+     */
+    readKDPDR(addr)
+    {
+        var reg = ((addr >> 1) & 7) + 8;
+        return this.cpu.regsPDR[0][reg];
+    }
+
+    /**
+     * writeKDPDR(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.KDPDR0--KDPDR7 or 172320--172336)
+     */
+    writeKDPDR(data, addr)
+    {
+        var reg = ((addr >> 1) & 7) + 8;
+        this.cpu.regsPDR[0][reg] = data & 0xff0f;
+    }
+
+    /**
+     * readKIPAR(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.KIPAR0--KIPAR7 or 172340--172356)
+     * @return {number}
+     */
+    readKIPAR(addr)
+    {
+        var reg = (addr >> 1) & 7;
+        return this.cpu.regsPAR[0][reg];
+    }
+
+    /**
+     * writeKIPAR(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.KIPAR0--KIPAR7 or 172340--172356)
+     */
+    writeKIPAR(data, addr)
+    {
+        var reg = (addr >> 1) & 7;
+        this.cpu.regsPAR[0][reg] = data;
+        this.cpu.regsPDR[0][reg] &= 0xff0f;
+
+    }
+
+    /**
+     * readKDPAR(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.KDPAR0--KDPAR7 or 172360--172376)
+     * @return {number}
+     */
+    readKDPAR(addr)
+    {
+        var reg = ((addr >> 1) & 7) + 8;
+        return this.cpu.regsPAR[0][reg];
+    }
+
+    /**
+     * writeKDPAR(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.KDPAR0--KDPAR7 or 172360--172376)
+     */
+    writeKDPAR(data, addr)
+    {
+        var reg = ((addr >> 1) & 7) + 8;
+        this.cpu.regsPAR[0][reg] = data;
+        this.cpu.regsPDR[0][reg] &= 0xff0f;
+    }
+
+    /**
+     * readUIPDR(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.UIPDR0--UIPDR7 or 177600--177616)
+     * @return {number}
+     */
+    readUIPDR(addr)
+    {
+        var reg = (addr >> 1) & 7;
+        return this.cpu.regsPDR[3][reg];
+    }
+
+    /**
+     * writeUIPDR(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.UIPDR0--UIPDR7 or 177600--177616)
+     */
+    writeUIPDR(data, addr)
+    {
+        var reg = (addr >> 1) & 7;
+        this.cpu.regsPDR[3][reg] = data & 0xff0f;
+    }
+
+    /**
+     * readUDPDR(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.UDPDR0--UDPDR7 or 177620--177636)
+     * @return {number}
+     */
+    readUDPDR(addr)
+    {
+        var reg = ((addr >> 1) & 7) + 8;
+        return this.cpu.regsPDR[3][reg];
+    }
+
+    /**
+     * writeUDPDR(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.UDPDR0--UDPDR7 or 177620--177636)
+     */
+    writeUDPDR(data, addr)
+    {
+        var reg = ((addr >> 1) & 7) + 8;
+        this.cpu.regsPDR[3][reg] = data & 0xff0f;
+    }
+
+    /**
+     * readUIPAR(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.UIPAR0--UIPAR7 or 177640--177656)
+     * @return {number}
+     */
+    readUIPAR(addr)
+    {
+        var reg = (addr >> 1) & 7;
+        return this.cpu.regsPAR[3][reg];
+    }
+
+    /**
+     * writeUIPAR(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.UIPAR0--UIPAR7 or 177640--177656)
+     */
+    writeUIPAR(data, addr)
+    {
+        var reg = (addr >> 1) & 7;
+        this.cpu.regsPAR[3][reg] = data;
+        this.cpu.regsPDR[3][reg] &= 0xff0f;
+
+    }
+
+    /**
+     * readUDPAR(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.UDPAR0--UDPAR7 or 177660--177676)
+     * @return {number}
+     */
+    readUDPAR(addr)
+    {
+        var reg = ((addr >> 1) & 7) + 8;
+        return this.cpu.regsPAR[3][reg];
+    }
+
+    /**
+     * writeUDPAR(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.UDPAR0--UDPAR7 or 177660--177676)
+     */
+    writeUDPAR(data, addr)
+    {
+        var reg = ((addr >> 1) & 7) + 8;
+        this.cpu.regsPAR[3][reg] = data;
+        this.cpu.regsPDR[3][reg] &= 0xff0f;
+    }
+
+    /**
+     * readRSET0(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.R0SET0--R5SET0 or 177700--177705)
+     * @return {number}
+     */
+    readRSET0(addr)
+    {
+        var data;
+        var reg = addr & 7;
+        if (this.cpu.regPSW & PDP11.PSW.REGSET) {
+            data = this.cpu.regsAlt[reg];
+        } else {
+            data = this.cpu.regsGen[reg];
+        }
+        return data;
+    }
+
+    /**
+     * writeRSET0(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.R0SET0--R5SET0 or 177700--177705)
+     */
+    writeRSET0(data, addr)
+    {
+        var reg = addr & 7;
+        if (this.cpu.regPSW & PDP11.PSW.REGSET) {
+            this.cpu.regsAlt[reg] = data;
+        } else {
+            this.cpu.regsGen[reg] = data;
+        }
+    }
+
+    /**
+     * readR6KERNEL(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.R6KERNEL or 177706)
+     * @return {number}
+     */
+    readR6KERNEL(addr)
+    {
+        var data;
+        if (!(this.cpu.regPSW & PDP11.PSW.CMODE)) {         // Kernel Mode
+            data = this.cpu.regsGen[6];
+        } else {
+            data = this.cpu.regsAltStack[0];
+        }
+        return data;
+    }
+
+    /**
+     * writeR6KERNEL(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.R6KERNEL or 177706)
+     */
+    writeR6KERNEL(data, addr)
+    {
+        if (!(this.cpu.regPSW & PDP11.PSW.CMODE)) {         // Kernel Mode
+            this.cpu.regsGen[6] = data;
+        } else {
+            this.cpu.regsAltStack[0] = data;
+        }
+    }
+
+    /**
+     * readR7KERNEL(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.R7KERNEL or 177707)
+     * @return {number}
+     */
+    readR7KERNEL(addr)
+    {
+        return this.cpu.regsGen[7];
+    }
+
+    /**
+     * writeR7KERNEL(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.R7KERNEL or 177707)
+     */
+    writeR7KERNEL(data, addr)
+    {
+        this.cpu.regsGen[7] = data;
+    }
+
+    /**
+     * readRSET1(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.R0SET1--R5SET1 or 177710--177715)
+     * @return {number}
+     */
+    readRSET1(addr)
+    {
+        var data;
+        var reg = addr & 7;
+        if (this.cpu.regPSW & PDP11.PSW.REGSET) {
+            data = this.cpu.regsGen[reg];
+        } else {
+            data = this.cpu.regsAlt[reg];
+        }
+        return data;
+    }
+
+    /**
+     * writeRSET1(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.R0SET1--R5SET1 or 177710--177715)
+     */
+    writeRSET1(data, addr)
+    {
+        var reg = addr & 7;
+        if (this.cpu.regPSW & PDP11.PSW.REGSET) {
+            this.cpu.regsGen[reg] = data;
+        } else {
+            this.cpu.regsAlt[reg] = data;
+        }
+    }
+
+    /**
+     * readR6SUPER(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.R6SUPER or 177716)
+     * @return {number}
+     */
+    readR6SUPER(addr)
+    {
+        var data;
+        if (((this.cpu.regPSW & PDP11.PSW.CMODE) >> PDP11.PSW.SHIFT.CMODE) == PDP11.MODE.SUPER) {
+            data = this.cpu.regsGen[6];
+        } else {
+            data = this.cpu.regsAltStack[1];
+        }
+        return data;
+    }
+
+    /**
+     * writeR6SUPER(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.R6SUPER or 177716)
+     */
+    writeR6SUPER(data, addr)
+    {
+        if (((this.cpu.regPSW & PDP11.PSW.CMODE) >> PDP11.PSW.SHIFT.CMODE) == PDP11.MODE.SUPER) {
+            this.cpu.regsGen[6] = data;
+        } else {
+            this.cpu.regsAltStack[1] = data;
+        }
+    }
+
+    /**
+     * readR6USER(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.R6USER or 177717)
+     * @return {number}
+     */
+    readR6USER(addr)
+    {
+        var data;
+        if (((this.cpu.regPSW & PDP11.PSW.CMODE) >> PDP11.PSW.SHIFT.CMODE) == PDP11.MODE.USER) {
+            data = this.cpu.regsGen[6];
+        } else {
+            data = this.cpu.regsAltStack[3];
+        }
+        return data;
+    }
+
+    /**
+     * writeR6USER(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.R6USER or 177717)
+     */
+    writeR6USER(data, addr)
+    {
+        if (((this.cpu.regPSW & PDP11.PSW.CMODE) >> PDP11.PSW.SHIFT.CMODE) == PDP11.MODE.USER) {
+            this.cpu.regsGen[6] = data;
+        } else {
+            this.cpu.regsAltStack[3] = data;
+        }
+    }
+
+    /**
+     * readCTRL(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.LAERR--UNDEF2 or 177740--177756)
+     * @return {number}
+     */
+    readCTRL(addr)
+    {
+        var reg = (addr - PDP11.UNIBUS.CTRL) >> 1;
+        return this.cpu.regsControl[reg];
+    }
+
+    /**
+     * writeCTRL(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.LAERR--UNDEF2 or 177740--177756)
+     */
+    writeCTRL(data, addr)
+    {
+        var reg = (addr - PDP11.UNIBUS.CTRL) >> 1;
+        this.cpu.regsControl[reg] = data;
+    }
+
+    /**
+     * readSIZE(addr)
+     *
+     * We're adhering to DEC's documentation, which says:
+     *
+     *      This read-only register specifies the memory size of the system. It is defined to indicate the
+     *      last addressable block of 32 words in memory (bit 0 is equivalent to bit 6 of the Physical Address).
+     *
+     * Looking at the Memory Clear "toggle-in" code in /devices/pdp11/machine/1170/panel/debugger/README.md, the
+     * memory loop gives up when the block number stored in KIPAR0 is >= LSIZE, suggesting that LSIZE is actually
+     * the total number of 64-byte blocks, rather than the block number of the last block.  But that code is
+     * not conclusive, since it writes 8192 bytes at a time rather than 64, so it doesn't really matter if LSIZE
+     * is off by one.
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.LSIZE--HSIZE or 177760--177762)
+     * @return {number}
+     */
+    readSIZE(addr)
+    {
+        return addr == PDP11.UNIBUS.LSIZE? ((this.bus.getMemoryLimit(MemoryPDP11.TYPE.RAM) >> 6) - 1) : 0;
+    }
+
+    /**
+     * writeSIZE(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.LSIZE--HSIZE or 177760--177762)
+     */
+    writeSIZE(data, addr)
+    {
+    }
+
+    /**
+     * readSYSID(addr)
+     *
+     * TODO: For SYSID, we currently ignore writes and return 1 on reads
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.SYSID or 177764)
+     * @return {number}
+     */
+    readSYSID(addr)
+    {
+        return 1;
+    }
+
+    /**
+     * writeSYSID(data, addr)
+     *
+     * TODO: For SYSID, we currently ignore writes and return 1 on reads
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.SYSID or 177764)
+     */
+    writeSYSID(data, addr)
+    {
+    }
+
+    /**
+     * readCPUERR(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.CPUERR or 177766)
+     * @return {number}
+     */
+    readCPUERR(addr)
+    {
+        return this.cpu.regErr;
+    }
+
+    /**
+     * writeCPUERR(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.CPUERR or 177766)
+     */
+    writeCPUERR(data, addr)
+    {
+        this.cpu.regErr = 0;        // TODO: Confirm that writes always zero the register
+    }
+
+    /**
+     * readMBR(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.MB or 177770)
+     * @return {number}
+     */
+    readMBR(addr)
+    {
+        return this.cpu.regMBR;
+    }
+
+    /**
+     * writeMBR(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.MB or 177770)
+     */
+    writeMBR(data, addr)
+    {
+        if (!(addr & 0x1)) {
+            data &= 0xff;           // required for KB11-CM without MFPT instruction
+        }
+        this.cpu.regMBR = data;
+    }
+
+    /**
+     * readPIR(addr, fPreWrite)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.PIR or 177772)
+     * @param {boolean} [fPreWrite]
+     * @return {number}
+     */
+    readPIR(addr, fPreWrite)
+    {
+        if (fPreWrite) return 0;
+        return this.cpu.getPIR();
+    }
+
+    /**
+     * writePIR(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.PIR or 177772)
+     */
+    writePIR(data, addr)
+    {
+        this.cpu.setPIR(data);
+    }
+
+    /**
+     * readSLR(addr, fPreWrite)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.SL or 177774)
+     * @param {boolean} [fPreWrite]
+     * @return {number}
+     */
+    readSLR(addr, fPreWrite)
+    {
+        if (fPreWrite) return 0;
+        return this.cpu.getSLR();
+    }
+
+    /**
+     * writeSLR(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.SL or 177774)
+     */
+    writeSLR(data, addr)
+    {
+        this.cpu.setSLR(data);
+    }
+
+    /**
+     * readPSW(addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.PSW or 177776)
+     * @return {number}
+     */
+    readPSW(addr)
+    {
+        return this.cpu.getPSW();
+    }
+
+    /**
+     * writePSW(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.PSW or 177776)
+     */
+    writePSW(data, addr)
+    {
+        /*
+         * pdp11.js disallowed PSW.TF in addition to PSW.UNUSED, but DEC's "TRAP TEST" expects the
+         * following instruction to trap:
+         *
+         *      004174: 052767 000020 173574   BIS   #20,177776
+         *
+         * Since that test was written for the PDP-11/20, it's possible that newer machines have a different
+         * behavior, but for now, we assume that all machines allow setting PSW.TF.
+         *
+         * Moreover, we have changed setPSW() to disallow the setting of any bits not supported by the current
+         * CPU model, so it seems rather pointless to do any masking of bits here.
+         */
+        this.cpu.setPSW(data);
+    }
+
+    /**
+     * writeIgnored(data, addr)
+     *
+     * @this {DevicePDP11}
+     * @param {number} data
+     * @param {number} addr
+     */
+    writeIgnored(data, addr)
+    {
+        if (this.messageEnabled()) {
+            this.printMessage("writeIgnored(" + Str.toOct(addr) + "): " + Str.toOct(data), true, true);
+        }
+    }
+
+    /**
+     * DevicePDP11.init()
+     *
+     * This function operates on every HTML element of class "device", extracting the
+     * JSON-encoded parameters for the DevicePDP11 constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a DevicePDP11 component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeDevice = Component.getElementsByClass(document, PDP11.APPCLASS, "device");
+        for (var iDevice = 0; iDevice < aeDevice.length; iDevice++) {
+            var device;
+            var eDevice = aeDevice[iDevice];
+            var parmsDevice = Component.getComponentParms(eDevice);
+            switch(parmsDevice['type']) {
+            case 'default':
+                device = new DevicePDP11(parmsDevice);
+                Component.bindComponentControls(device, eDevice, PDP11.APPCLASS);
+                break;
+            case 'pc11':
+                device = new PC11(parmsDevice);
+                Component.bindComponentControls(device, eDevice, PDP11.APPCLASS);
+                break;
+            case 'rl11':
+                device = new RL11(parmsDevice);
+                Component.bindComponentControls(device, eDevice, PDP11.APPCLASS);
+                break;
+            case 'rk11':
+                device = new RK11(parmsDevice);
+                Component.bindComponentControls(device, eDevice, PDP11.APPCLASS);
+                break;
+            case 'rx11':
+                device = new RX11(parmsDevice);
+                Component.bindComponentControls(device, eDevice, PDP11.APPCLASS);
+                break;
+            }
+        }
+    }
+}
+
+/*
+ * ES6 ALERT: As you can see below, I've finally started using computed property names.
+ */
+DevicePDP11.UNIBUS_IOTABLE = {
+    [PDP11.UNIBUS.UNIMAP]:  /* 170200 */    [null, null, DevicePDP11.prototype.readUNIMAP,  DevicePDP11.prototype.writeUNIMAP,  "UNIMAP",   64, PDP11.MODEL_1170],
+    [PDP11.UNIBUS.SIPDR0]:  /* 172200 */    [null, null, DevicePDP11.prototype.readSIPDR,   DevicePDP11.prototype.writeSIPDR,   "SIPDR",    8,  PDP11.MODEL_1145, MessagesPDP11.MMU],
+    [PDP11.UNIBUS.SDPDR0]:  /* 172220 */    [null, null, DevicePDP11.prototype.readSDPDR,   DevicePDP11.prototype.writeSDPDR,   "SDPDR",    8,  PDP11.MODEL_1145, MessagesPDP11.MMU],
+    [PDP11.UNIBUS.SIPAR0]:  /* 172240 */    [null, null, DevicePDP11.prototype.readSIPAR,   DevicePDP11.prototype.writeSIPAR,   "SIPAR",    8,  PDP11.MODEL_1145, MessagesPDP11.MMU],
+    [PDP11.UNIBUS.SDPAR0]:  /* 172260 */    [null, null, DevicePDP11.prototype.readSDPAR,   DevicePDP11.prototype.writeSDPAR,   "SDPAR",    8,  PDP11.MODEL_1145, MessagesPDP11.MMU],
+    [PDP11.UNIBUS.KIPDR0]:  /* 172300 */    [null, null, DevicePDP11.prototype.readKIPDR,   DevicePDP11.prototype.writeKIPDR,   "KIPDR",    8,  PDP11.MODEL_1140, MessagesPDP11.MMU],
+    [PDP11.UNIBUS.KDPDR0]:  /* 172320 */    [null, null, DevicePDP11.prototype.readKDPDR,   DevicePDP11.prototype.writeKDPDR,   "KDPDR",    8,  PDP11.MODEL_1145, MessagesPDP11.MMU],
+    [PDP11.UNIBUS.KIPAR0]:  /* 172340 */    [null, null, DevicePDP11.prototype.readKIPAR,   DevicePDP11.prototype.writeKIPAR,   "KIPAR",    8,  PDP11.MODEL_1140, MessagesPDP11.MMU],
+    [PDP11.UNIBUS.KDPAR0]:  /* 172360 */    [null, null, DevicePDP11.prototype.readKDPAR,   DevicePDP11.prototype.writeKDPAR,   "KDPAR",    8,  PDP11.MODEL_1145, MessagesPDP11.MMU],
+    [PDP11.UNIBUS.MMR3]:    /* 172516 */    [null, null, DevicePDP11.prototype.readMMR3,    DevicePDP11.prototype.writeMMR3,    "MMR3",     1,  PDP11.MODEL_1145, MessagesPDP11.MMU],
+    [PDP11.UNIBUS.LKS]:     /* 177546 */    [null, null, DevicePDP11.prototype.readLKS,     DevicePDP11.prototype.writeLKS,     "LKS"],
+    [PDP11.UNIBUS.MMR0]:    /* 177572 */    [null, null, DevicePDP11.prototype.readMMR0,    DevicePDP11.prototype.writeMMR0,    "MMR0",     1,  PDP11.MODEL_1140, MessagesPDP11.MMU],
+    [PDP11.UNIBUS.MMR1]:    /* 177574 */    [null, null, DevicePDP11.prototype.readMMR1,    DevicePDP11.prototype.writeIgnored, "MMR1",     1,  PDP11.MODEL_1145, MessagesPDP11.MMU],
+    [PDP11.UNIBUS.MMR2]:    /* 177576 */    [null, null, DevicePDP11.prototype.readMMR2,    DevicePDP11.prototype.writeIgnored, "MMR2",     1,  PDP11.MODEL_1140, MessagesPDP11.MMU],
+    [PDP11.UNIBUS.UIPDR0]:  /* 177600 */    [null, null, DevicePDP11.prototype.readUIPDR,   DevicePDP11.prototype.writeUIPDR,   "UIPDR",    8,  PDP11.MODEL_1140, MessagesPDP11.MMU],
+    [PDP11.UNIBUS.UDPDR0]:  /* 177620 */    [null, null, DevicePDP11.prototype.readUDPDR,   DevicePDP11.prototype.writeUDPDR,   "UDPDR",    8,  PDP11.MODEL_1145, MessagesPDP11.MMU],
+    [PDP11.UNIBUS.UIPAR0]:  /* 177640 */    [null, null, DevicePDP11.prototype.readUIPAR,   DevicePDP11.prototype.writeUIPAR,   "UIPAR",    8,  PDP11.MODEL_1140, MessagesPDP11.MMU],
+    [PDP11.UNIBUS.UDPAR0]:  /* 177660 */    [null, null, DevicePDP11.prototype.readUDPAR,   DevicePDP11.prototype.writeUDPAR,   "UDPAR",    8,  PDP11.MODEL_1145, MessagesPDP11.MMU],
+    [PDP11.UNIBUS.R0SET0]:  /* 177700 */    [null, null, DevicePDP11.prototype.readRSET0,   DevicePDP11.prototype.writeRSET0,   "R0SET0"],
+    [PDP11.UNIBUS.R1SET0]:  /* 177701 */    [null, null, DevicePDP11.prototype.readRSET0,   DevicePDP11.prototype.writeRSET0,   "R1SET0"],
+    [PDP11.UNIBUS.R2SET0]:  /* 177702 */    [null, null, DevicePDP11.prototype.readRSET0,   DevicePDP11.prototype.writeRSET0,   "R2SET0"],
+    [PDP11.UNIBUS.R3SET0]:  /* 177703 */    [null, null, DevicePDP11.prototype.readRSET0,   DevicePDP11.prototype.writeRSET0,   "R3SET0"],
+    [PDP11.UNIBUS.R4SET0]:  /* 177704 */    [null, null, DevicePDP11.prototype.readRSET0,   DevicePDP11.prototype.writeRSET0,   "R4SET0"],
+    [PDP11.UNIBUS.R5SET0]:  /* 177705 */    [null, null, DevicePDP11.prototype.readRSET0,   DevicePDP11.prototype.writeRSET0,   "R5SET0"],
+    [PDP11.UNIBUS.R6KERNEL]:/* 177706 */    [null, null, DevicePDP11.prototype.readR6KERNEL,DevicePDP11.prototype.writeR6KERNEL,"R6KERNEL"],
+    [PDP11.UNIBUS.R7KERNEL]:/* 177707 */    [null, null, DevicePDP11.prototype.readR7KERNEL,DevicePDP11.prototype.writeR7KERNEL,"R7KERNEL"],
+    [PDP11.UNIBUS.R0SET1]:  /* 177710 */    [null, null, DevicePDP11.prototype.readRSET1,   DevicePDP11.prototype.writeRSET1,   "R0SET1",   1,  PDP11.MODEL_1145],
+    [PDP11.UNIBUS.R1SET1]:  /* 177711 */    [null, null, DevicePDP11.prototype.readRSET1,   DevicePDP11.prototype.writeRSET1,   "R1SET1",   1,  PDP11.MODEL_1145],
+    [PDP11.UNIBUS.R2SET1]:  /* 177712 */    [null, null, DevicePDP11.prototype.readRSET1,   DevicePDP11.prototype.writeRSET1,   "R2SET1",   1,  PDP11.MODEL_1145],
+    [PDP11.UNIBUS.R3SET1]:  /* 177713 */    [null, null, DevicePDP11.prototype.readRSET1,   DevicePDP11.prototype.writeRSET1,   "R3SET1",   1,  PDP11.MODEL_1145],
+    [PDP11.UNIBUS.R4SET1]:  /* 177714 */    [null, null, DevicePDP11.prototype.readRSET1,   DevicePDP11.prototype.writeRSET1,   "R4SET1",   1,  PDP11.MODEL_1145],
+    [PDP11.UNIBUS.R5SET1]:  /* 177715 */    [null, null, DevicePDP11.prototype.readRSET1,   DevicePDP11.prototype.writeRSET1,   "R5SET1",   1,  PDP11.MODEL_1145],
+    [PDP11.UNIBUS.R6SUPER]: /* 177716 */    [null, null, DevicePDP11.prototype.readR6SUPER, DevicePDP11.prototype.writeR6SUPER, "R6SUPER",  1,  PDP11.MODEL_1145],
+    [PDP11.UNIBUS.R6USER]:  /* 177717 */    [null, null, DevicePDP11.prototype.readR6USER,  DevicePDP11.prototype.writeR6USER,  "R6USER",   1,  PDP11.MODEL_1145],
+    [PDP11.UNIBUS.CTRL]:    /* 177740 */    [null, null, DevicePDP11.prototype.readCTRL,    DevicePDP11.prototype.writeCTRL,    "CTRL",     8,  PDP11.MODEL_1170],
+    [PDP11.UNIBUS.LSIZE]:   /* 177760 */    [null, null, DevicePDP11.prototype.readSIZE,    DevicePDP11.prototype.writeSIZE,    "LSIZE",    1,  PDP11.MODEL_1170],
+    [PDP11.UNIBUS.HSIZE]:   /* 177762 */    [null, null, DevicePDP11.prototype.readSIZE,    DevicePDP11.prototype.writeSIZE,    "HSIZE",    1,  PDP11.MODEL_1170],
+    [PDP11.UNIBUS.SYSID]:   /* 177764 */    [null, null, DevicePDP11.prototype.readSYSID,   DevicePDP11.prototype.writeSYSID,   "SYSID",    1,  PDP11.MODEL_1170],
+    [PDP11.UNIBUS.CPUERR]:  /* 177766 */    [null, null, DevicePDP11.prototype.readCPUERR,  DevicePDP11.prototype.writeCPUERR,  "ERR",      1,  PDP11.MODEL_1170],
+    [PDP11.UNIBUS.MB]:      /* 177770 */    [null, null, DevicePDP11.prototype.readMBR,     DevicePDP11.prototype.writeMBR,     "MBR",      1,  PDP11.MODEL_1170],
+    [PDP11.UNIBUS.PIR]:     /* 177772 */    [null, null, DevicePDP11.prototype.readPIR,     DevicePDP11.prototype.writePIR,     "PIR"],
+    [PDP11.UNIBUS.SL]:      /* 177774 */    [null, null, DevicePDP11.prototype.readSLR,     DevicePDP11.prototype.writeSLR,     "SLR"],
+    [PDP11.UNIBUS.PSW]:     /* 177776 */    [null, null, DevicePDP11.prototype.readPSW,     DevicePDP11.prototype.writePSW,     "PSW"]
+};
+
+/*
+ * Initialize all the DevicePDP11 modules on the page.
+ */
+Web.onInit(DevicePDP11.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/memory.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * @class DataView
+ * @property {function(number,boolean):number} getUint8
+ * @property {function(number,number,boolean)} setUint8
+ * @property {function(number,boolean):number} getUint16
+ * @property {function(number,number,boolean)} setUint16
+ * @property {function(number,boolean):number} getInt32
+ * @property {function(number,number,boolean)} setInt32
+ */
+class MemoryPDP11 {
+    /**
+     * MemoryPDP11(bus, addr, used, size, type, controller)
+     *
+     * The Bus component allocates Memory objects so that each has a memory buffer with a
+     * block-granular starting address and an address range equal to bus.nBlockSize; however,
+     * the size of any given Memory object's underlying buffer can be either zero or bus.nBlockSize;
+     * memory read/write functions for empty (buffer-less) blocks are mapped to readNone/writeNone.
+     *
+     * The Bus allocates empty blocks for the entire address space during initialization, so that
+     * any reads/writes to undefined addresses will have no effect.  Later, the ROM and RAM
+     * components will ask the Bus to allocate memory for specific ranges, and the Bus will allocate
+     * as many new blockSize Memory objects as the ranges require.  Partial Memory blocks could
+     * also be supported in theory, but in practice, they're not.
+     *
+     * Because Memory blocks now allow us to have a "sparse" address space, we could choose to
+     * take the memory hit of allocating 4K arrays per block, where each element stores only one byte,
+     * instead of the more frugal but slightly slower approach of allocating arrays of 32-bit dwords
+     * (LONGARRAYS) and shifting/masking bytes/words to/from dwords; in theory, byte accesses would
+     * be faster and word accesses somewhat less faster.
+     *
+     * However, preliminary testing of that feature (BYTEARRAYS) did not yield significantly faster
+     * performance, so it is OFF by default to minimize our memory consumption.  Using TYPEDARRAYS
+     * would seem best, but as discussed in defines.js, it's off by default, because it doesn't perform
+     * as well as LONGARRAYS; the other advantage of TYPEDARRAYS is that it should theoretically use
+     * about 1/2 the memory of LONGARRAYS (32-bit elements vs 64-bit numbers), but I value speed over
+     * size at this point.  Also, not all JavaScript implementations support TYPEDARRAYS (IE9 is probably
+     * the only real outlier: it lacks typed arrays but otherwise has all the necessary HTML5 support).
+     *
+     * WARNING: Since Memory blocks are low-level objects that have no UI requirements, they
+     * do not inherit from the Component class, so if you want to use any Component class methods,
+     * such as Component.assert(), use the corresponding Debugger methods instead (assuming a debugger
+     * is available).
+     *
+     * @param {BusPDP11} bus
+     * @param {number|null} [addr] of lowest used address in block
+     * @param {number} [used] portion of block in bytes (0 for none); must be a multiple of 4
+     * @param {number} [size] of block's buffer in bytes (0 for none); must be a multiple of 4
+     * @param {number} [type] is one of the MemoryPDP11.TYPE constants (default is MemoryPDP11.TYPE.NONE)
+     * @param {Object} [controller] is an optional memory controller component
+     */
+    constructor(bus, addr, used, size, type, controller)
+    {
+        var a, i;
+        this.bus = bus;
+        this.id = (MemoryPDP11.idBlock += 2);
+        this.adw = null;
+        this.offset = 0;
+        this.addr = addr;
+        this.used = used;
+        this.size = size || 0;
+        this.type = type || MemoryPDP11.TYPE.NONE;
+        this.fReadOnly = (type == MemoryPDP11.TYPE.ROM);
+        this.controller = null;
+        this.dbg = null;
+        this.readByte = this.readByteDirect = this.readNone;
+        this.readWord = this.readWordDirect = this.readWordDefault;
+        this.writeByte = this.writeByteDirect = this.writeNone;
+        this.writeWord = this.writeWordDirect = this.writeWordDefault;
+        this.cReadBreakpoints = this.cWriteBreakpoints = 0;
+        this.copyBreakpoints();     // initialize the block's Debugger info; the caller will reinitialize
+
+        /*
+         * TODO: Study the impact of dirty block tracking.  The original purposes were to allow saveMemory()
+         * to save only dirty blocks, and to enable the Video component to quickly detect changes to the video buffer.
+         * But the benefit to saveMemory() is minimal, and the Video component has other options; for example, it can
+         * now use a custom memory controller that performs its own dirty block tracking.
+         *
+         * However, a quick test with dirty block tracking disabled didn't yield a noticeable improvement in performance,
+         * so I think the overhead of our block-based architecture is swamping the impact of these micro-updates.
+         */
+        this.fDirty = this.fDirtyEver = false;
+
+        /*
+         * For empty memory blocks, all we need to do is ensure all access functions are mapped to "none" handlers.
+         */
+        if (!this.size) {
+            this.setAccess();
+            return;
+        }
+
+        /*
+         * When a controller is specified, the controller must provide a buffer, via getControllerBuffer(),
+         * and memory access functions, via getControllerAccess().
+         */
+        if (controller) {
+            this.controller = controller;
+            a = controller.getControllerBuffer(addr);
+            this.adw = a[0];
+            this.offset = a[1];
+            this.setAccess(controller.getControllerAccess());
+            return;
+        }
+
+        /*
+         * This is the normal case: allocate a buffer that provides 8 bits of data per address;
+         * no controller is required because our default memory access functions (see afnMemory)
+         * know how to deal with this simple 1-1 mapping of addresses to bytes and words.
+         *
+         * TODO: Consider initializing the memory array to random (or pseudo-random) values in DEBUG
+         * mode; pseudo-random might be best, to help make any bugs reproducible.
+         */
+        if (TYPEDARRAYS) {
+            this.buffer = new ArrayBuffer(this.size);
+            this.dv = new DataView(this.buffer, 0, this.size);
+            /*
+             * If littleEndian is true, we can use ab[], aw[] and adw[] directly; well, we can use them
+             * whenever the offset is a multiple of 1, 2 or 4, respectively.  Otherwise, we must fallback to
+             * dv.getUint8()/dv.setUint8(), dv.getUint16()/dv.setUint16() and dv.getInt32()/dv.setInt32().
+             */
+            this.ab = new Uint8Array(this.buffer, 0, this.size);
+            this.aw = new Uint16Array(this.buffer, 0, this.size >> 1);
+            this.adw = new Int32Array(this.buffer, 0, this.size >> 2);
+            this.setAccess(littleEndian? MemoryPDP11.afnArrayLE : MemoryPDP11.afnArrayBE);
+        } else {
+            /*
+             * NOTE: An ArrayBuffer is defined as being zero-initialized, but the elements of a new
+             * Array are not, so this code path takes care of zero-initialization ourselves.
+             */
+            if (BYTEARRAYS) {
+                a = this.ab = new Array(this.size);
+            } else {
+                /*
+                 * NOTE: This used to be the default mode of operation (!TYPEDARRAYS && !BYTEARRAYS), because
+                 * it seemed to provide the best performance; however, that was then, and this is now.  TYPEDARRAYS
+                 * is more efficient.
+                 */
+                a = this.adw = new Array(this.size >> 2);
+            }
+            for (i = 0; i < a.length; i++) a[i] = 0;
+            this.setAccess(MemoryPDP11.afnMemory);
+        }
+    }
+
+    /**
+     * init(addr)
+     *
+     * Quick reinitializer when reusing a Memory block.
+     *
+     * @this {MemoryPDP11}
+     * @param {number} addr
+     */
+    init(addr)
+    {
+        this.addr = addr;
+    }
+
+    /**
+     * clone(mem, type, dbg)
+     *
+     * Converts the current Memory block (this) into a clone of the given Memory block (mem),
+     * and optionally overrides the current block's type with the specified type.
+     *
+     * @this {MemoryPDP11}
+     * @param {MemoryPDP11} mem
+     * @param {number} [type]
+     * @param {DebuggerPDP11} [dbg]
+     */
+    clone(mem, type, dbg)
+    {
+        /*
+         * Original memory block IDs are even; cloned memory block IDs are odd;
+         * the original ID of the current block is lost, but that's OK, since it was presumably
+         * produced merely to become a clone.
+         */
+        this.id = mem.id | 0x1;
+        this.used = mem.used;
+        this.size = mem.size;
+        if (type) {
+            this.type = type;
+            this.fReadOnly = (type == MemoryPDP11.TYPE.ROM);
+        }
+        if (TYPEDARRAYS) {
+            this.buffer = mem.buffer;
+            this.dv = mem.dv;
+            this.ab = mem.ab;
+            this.aw = mem.aw;
+            this.adw = mem.adw;
+            this.setAccess(littleEndian? MemoryPDP11.afnArrayLE : MemoryPDP11.afnArrayBE);
+        } else {
+            if (BYTEARRAYS) {
+                this.ab = mem.ab;
+            } else {
+                this.adw = mem.adw;
+            }
+            this.setAccess(MemoryPDP11.afnMemory);
+        }
+        this.copyBreakpoints(dbg, mem);
+    }
+
+    /**
+     * save()
+     *
+     * This gets the contents of a Memory block as an array of 32-bit values; used by Bus.saveMemory(),
+     * which in turn is called by CPUState.save().
+     *
+     * Memory blocks with custom memory controllers do NOT save their contents; that's the responsibility
+     * of the controller component.
+     *
+     * @this {MemoryPDP11}
+     * @return {Array|Int32Array|null}
+     */
+    save()
+    {
+        var adw, i;
+        if (this.controller) {
+            adw = null;
+        }
+        else if (BYTEARRAYS) {
+            adw = new Array(this.size >> 2);
+            var off = 0;
+            for (i = 0; i < adw.length; i++) {
+                adw[i] = this.ab[off] | (this.ab[off + 1] << 8) | (this.ab[off + 2] << 16) | (this.ab[off + 3] << 24);
+                off += 4;
+            }
+        }
+        else if (TYPEDARRAYS) {
+            /*
+             * It might be tempting to just return a copy of Int32Array(this.buffer, 0, this.size >> 2),
+             * but we can't be sure of the "endianness" of an Int32Array -- which would be OK if the array
+             * was always saved/restored on the same machine, but there's no guarantee of that, either.
+             * So we use getInt32() and require little-endian values.
+             *
+             * Moreover, an Int32Array isn't treated by JSON.stringify() and JSON.parse() exactly like
+             * a normal array; it's serialized as an Object rather than an Array, so it lacks a "length"
+             * property and causes problems for State.store() and State.parse().
+             */
+            adw = new Array(this.size >> 2);
+            for (i = 0; i < adw.length; i++) {
+                adw[i] = this.dv.getInt32(i << 2, true);
+            }
+        }
+        else {
+            adw = this.adw;
+        }
+        return adw;
+    }
+
+    /**
+     * restore(adw)
+     *
+     * This restores the contents of a Memory block from an array of 32-bit values;
+     * used by Bus.restoreMemory(), which is called by CPUState.restore(), after all other
+     * components have been restored and thus all Memory blocks have been allocated
+     * by their respective components.
+     *
+     * @this {MemoryPDP11}
+     * @param {Array|null} adw
+     * @return {boolean} true if successful, false if block size mismatch
+     */
+    restore(adw)
+    {
+        if (this.controller) {
+            return (adw == null);
+        }
+        /*
+         * At this point, it's a consistency error for adw to be null; it's happened once already,
+         * when there was a restore bug in the Video component that added the frame buffer at the video
+         * card's "spec'ed" address instead of the programmed address, so there were no controller-owned
+         * memory blocks installed at the programmed address, and so we arrived here at a block with
+         * no controller AND no data.
+         */
+
+
+        if (adw && this.size == adw.length << 2) {
+            var i;
+            if (BYTEARRAYS) {
+                var off = 0;
+                for (i = 0; i < adw.length; i++) {
+                    this.ab[off] = adw[i] & 0xff;
+                    this.ab[off + 1] = (adw[i] >> 8) & 0xff;
+                    this.ab[off + 2] = (adw[i] >> 16) & 0xff;
+                    this.ab[off + 3] = (adw[i] >> 24) & 0xff;
+                    off += 4;
+                }
+            } else if (TYPEDARRAYS) {
+                for (i = 0; i < adw.length; i++) {
+                    this.dv.setInt32(i << 2, adw[i], true);
+                }
+            } else {
+                this.adw = adw;
+            }
+            this.fDirty = true;
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * zero(off, len, pattern)
+     *
+     * Zeros the block.  Supporting off and len parameters is probably overkill, and makes more
+     * work in the non-TYPEDARRAY, non-BYTEARRAY case, but that's not the typical case.  The other
+     * exception is controller-based blocks, which may not have any array backing at all.
+     *
+     * @this {MemoryPDP11}
+     * @param {number} [off] (optional starting byte offset within block)
+     * @param {number} [len] (optional maximum number of bytes; default is the entire block)
+     * @param {number} [pattern]
+     */
+    zero(off, len, pattern)
+    {
+        var i;
+        off = off || 0;
+        pattern = (pattern || 0) & 0xff;        // pattern & 0xff wasn't good enough for the Closure Compiler
+        /*
+         * NOTE: If len happens to be larger than the block, that's OK, because we also bounds-check the index.
+         */
+        if (len === undefined) len = this.size;
+
+        if ((TYPEDARRAYS || BYTEARRAYS) && this.ab) {
+            for (i = off; len-- && i < this.ab.length; i++) this.ab[i] = pattern;
+        } else {
+            for (i = off; len-- && i < this.size; i++) this.writeByteDirect(off, pattern, this.addr + off);
+        }
+    }
+
+    /**
+     * setAccess(afn, fDirect)
+     *
+     * The afn parameter should be a 4-entry function table containing two byte handlers and
+     * two word handlers.  See the static afnMemory table for an example.
+     *
+     * If no function table is specified, a default is selected based on the Memory type;
+     * similarly, any undefined entries in the table are filled with default handlers that fall
+     * back to the byte handlers, and if one or both byte handlers are undefined, they default
+     * to handlers that simply ignore the access.
+     *
+     * fDirect indicates that both the default AND the direct handlers should be updated.  Direct
+     * handlers normally match the default handlers, except when "checked" handlers are installed;
+     * this allows "checked" handlers to know where to dispatch the call after performing checks.
+     * Examples of checks are read/write breakpoints, but it's really up to the Debugger to decide
+     * what the check consists of.
+     *
+     * @this {MemoryPDP11}
+     * @param {Array.<function()>} [afn] function table
+     * @param {boolean} [fDirect] (true to update direct access functions as well; default is true)
+     */
+    setAccess(afn, fDirect)
+    {
+        if (!afn) {
+
+            afn = MemoryPDP11.afnNone;
+        }
+        this.setReadAccess(afn, fDirect);
+        this.setWriteAccess(afn, fDirect);
+    }
+
+    /**
+     * setReadAccess(afn, fDirect)
+     *
+     * @this {MemoryPDP11}
+     * @param {Array.<function()>} afn
+     * @param {boolean} [fDirect]
+     */
+    setReadAccess(afn, fDirect)
+    {
+        if (!fDirect || !this.cReadBreakpoints) {
+            this.readByte = afn[0] || this.readNone;
+            this.readWord = afn[2] || this.readWordDefault;
+        }
+        if (fDirect || fDirect === undefined) {
+            this.readByteDirect = afn[0] || this.readNone;
+            this.readWordDirect = afn[2] || this.readWordDefault;
+        }
+    }
+
+    /**
+     * setWriteAccess(afn, fDirect)
+     *
+     * @this {MemoryPDP11}
+     * @param {Array.<function()>} afn
+     * @param {boolean} [fDirect]
+     */
+    setWriteAccess(afn, fDirect)
+    {
+        if (!fDirect || !this.cWriteBreakpoints) {
+            this.writeByte = !this.fReadOnly && afn[1] || this.writeNone;
+            this.writeWord = !this.fReadOnly && afn[3] || this.writeWordDefault;
+        }
+        if (fDirect || fDirect === undefined) {
+            this.writeByteDirect = afn[1] || this.writeNone;
+            this.writeWordDirect = afn[3] || this.writeWordDefault;
+        }
+    }
+
+    /**
+     * resetReadAccess()
+     *
+     * @this {MemoryPDP11}
+     */
+    resetReadAccess()
+    {
+        this.readByte = this.readByteDirect;
+        this.readWord = this.readWordDirect;
+    }
+
+    /**
+     * resetWriteAccess()
+     *
+     * @this {MemoryPDP11}
+     */
+    resetWriteAccess()
+    {
+        this.writeByte = this.fReadOnly? this.writeNone : this.writeByteDirect;
+        this.writeWord = this.fReadOnly? this.writeWordDefault : this.writeWordDirect;
+    }
+
+    /**
+     * printAddr(sMessage)
+     *
+     * @this {MemoryPDP11}
+     * @param {string} sMessage
+     */
+    printAddr(sMessage)
+    {
+        if (DEBUG && this.dbg && this.dbg.messageEnabled(MessagesPDP11.MEMORY)) {
+            this.dbg.printMessage(sMessage + ' ' + (this.addr != null? ('@' + this.dbg.toStrBase(this.addr)) : '#' + this.id), true);
+        }
+    }
+
+    /**
+     * addBreakpoint(off, fWrite)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {boolean} fWrite
+     */
+    addBreakpoint(off, fWrite)
+    {
+        if (!fWrite) {
+            if (this.cReadBreakpoints++ === 0) {
+                this.setReadAccess(MemoryPDP11.afnChecked, false);
+            }
+            if (DEBUG) this.printAddr("read breakpoint added to memory block");
+        }
+        else {
+            if (this.cWriteBreakpoints++ === 0) {
+                this.setWriteAccess(MemoryPDP11.afnChecked, false);
+            }
+            if (DEBUG) this.printAddr("write breakpoint added to memory block");
+        }
+    }
+
+    /**
+     * removeBreakpoint(off, fWrite)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {boolean} fWrite
+     */
+    removeBreakpoint(off, fWrite)
+    {
+        if (!fWrite) {
+            if (--this.cReadBreakpoints === 0) {
+                this.resetReadAccess();
+                if (DEBUG) this.printAddr("all read breakpoints removed from memory block");
+            }
+
+        }
+        else {
+            if (--this.cWriteBreakpoints === 0) {
+                this.resetWriteAccess();
+                if (DEBUG) this.printAddr("all write breakpoints removed from memory block");
+            }
+
+        }
+    }
+
+    /**
+     * copyBreakpoints(dbg, mem)
+     *
+     * @this {MemoryPDP11}
+     * @param {DebuggerPDP11} [dbg]
+     * @param {MemoryPDP11} [mem] (outgoing MemoryPDP11 block to copy breakpoints from, if any)
+     */
+    copyBreakpoints(dbg, mem)
+    {
+        this.dbg = dbg;
+        this.cReadBreakpoints = this.cWriteBreakpoints = 0;
+        if (mem) {
+            if ((this.cReadBreakpoints = mem.cReadBreakpoints)) {
+                this.setReadAccess(MemoryPDP11.afnChecked, false);
+            }
+            if ((this.cWriteBreakpoints = mem.cWriteBreakpoints)) {
+                this.setWriteAccess(MemoryPDP11.afnChecked, false);
+            }
+        }
+    }
+
+    /**
+     * readNone(off, addr)
+     *
+     * Previously, this always returned 0x00, but the initial memory probe by the COMPAQ DeskPro 386 ROM BIOS
+     * writes 0x0000 to the first word of every 64Kb block in the nearly 16Mb address space it supports, and
+     * if it reads back 0x0000, it will initially think that LOTS of RAM exists, only to be disappointed later
+     * when it performs a more exhaustive memory test, generating unwanted error messages in the process.
+     *
+     * TODO: Determine if we should have separate readByteNone(), readWordNone() and readLongNone() functions
+     * to return 0xff, 0xffff and 0xffffffff|0, respectively.  This seems sufficient for now, as it seems unlikely
+     * that a system would require nonexistent memory locations to return ALL bits set.  However, another factor
+     * is whether or not ODDADDR faults take precedence over NOMEMORY faults; if they do, then we need separate
+     * interfaces.
+     *
+     * Also, I'm reluctant to address that potential issue by simply returning -1, because to date, the above
+     * Memory interfaces have always returned values that are properly masked to 8, 16 or 32 bits, respectively.
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readNone(off, addr)
+    {
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(MessagesPDP11.MEMORY) /* && !off */) {
+            this.dbg.printMessage("attempt to read invalid address " + this.dbg.toStrBase(addr), true);
+        }
+        this.bus.fault(addr, PDP11.CPUERR.NOMEMORY, PDP11.ACCESS.READ);
+        return 0xff;
+    }
+
+    /**
+     * writeNone(off, v, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} v (could be either a byte or word value, since we use the same handler for both kinds of accesses)
+     * @param {number} addr
+     */
+    writeNone(off, v, addr)
+    {
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(MessagesPDP11.MEMORY) /* && !off */) {
+            this.dbg.printMessage("attempt to write " + this.dbg.toStrBase(v) + " to invalid addresses " + this.dbg.toStrBase(addr), true);
+        }
+        this.bus.fault(addr, PDP11.CPUERR.NOMEMORY, PDP11.ACCESS.WRITE);
+    }
+
+    /**
+     * readWordDefault(off, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readWordDefault(off, addr)
+    {
+        return this.readByte(off++, addr++) | (this.readByte(off, addr) << 8);
+    }
+
+    /**
+     * writeWordDefault(off, w, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} w
+     * @param {number} addr
+     */
+    writeWordDefault(off, w, addr)
+    {
+        this.writeByte(off++, w & 0xff, addr++);
+        this.writeByte(off, w >> 8, addr);
+    }
+
+    /**
+     * readByteMemory(off, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readByteMemory(off, addr)
+    {
+        if (BYTEARRAYS) {
+            return this.ab[off];
+        }
+        return ((this.adw[off >> 2] >>> ((off & 0x3) << 3)) & 0xff);
+    }
+
+    /**
+     * readWordMemory(off, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readWordMemory(off, addr)
+    {
+        if (PDP11.MEMFAULT && (off & 0x1)) {
+            this.bus.fault(addr, PDP11.CPUERR.ODDADDR, PDP11.ACCESS.READ_WORD);
+        }
+        if (BYTEARRAYS) {
+            return this.ab[off] | (this.ab[off + 1] << 8);
+        }
+        var w;
+        var idw = off >> 2;
+        var nShift = (off & 0x3) << 3;
+        var dw = (this.adw[idw] >> nShift);
+        if (nShift < 24) {
+            w = dw & 0xffff;
+        } else {
+            w = (dw & 0xff) | ((this.adw[idw + 1] & 0xff) << 8);
+        }
+        return w;
+        }
+
+    /**
+     * writeByteMemory(off, b, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} b
+     * @param {number} addr
+     */
+    writeByteMemory(off, b, addr)
+    {
+        if (BYTEARRAYS) {
+            this.ab[off] = b;
+        } else {
+            var idw = off >> 2;
+            var nShift = (off & 0x3) << 3;
+            this.adw[idw] = (this.adw[idw] & ~(0xff << nShift)) | (b << nShift);
+        }
+        this.fDirty = true;
+    }
+
+    /**
+     * writeWordMemory(off, w, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} w
+     * @param {number} addr
+     */
+    writeWordMemory(off, w, addr)
+    {
+        if (PDP11.MEMFAULT && (off & 0x1)) {
+            this.bus.fault(addr, PDP11.CPUERR.ODDADDR, PDP11.ACCESS.WRITE_WORD);
+        }
+        if (BYTEARRAYS) {
+            this.ab[off] = (w & 0xff);
+            this.ab[off + 1] = (w >> 8);
+        } else {
+            var idw = off >> 2;
+            var nShift = (off & 0x3) << 3;
+            if (nShift < 24) {
+                this.adw[idw] = (this.adw[idw] & ~(0xffff << nShift)) | (w << nShift);
+            } else {
+                this.adw[idw] = (this.adw[idw] & 0x00ffffff) | (w << 24);
+                idw++;
+                this.adw[idw] = (this.adw[idw] & (0xffffff00|0)) | (w >> 8);
+            }
+        }
+        this.fDirty = true;
+    }
+
+    /**
+     * readByteChecked(off, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readByteChecked(off, addr)
+    {
+        if (DEBUGGER && this.dbg && this.addr != null) {
+            this.dbg.checkMemoryRead(this.addr + off);
+        }
+        return this.readByteDirect(off, addr);
+    }
+
+    /**
+     * readWordChecked(off, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readWordChecked(off, addr)
+    {
+        if (DEBUGGER && this.dbg && this.addr != null) {
+            this.dbg.checkMemoryRead(this.addr + off, 2);
+        }
+        return this.readWordDirect(off, addr);
+    }
+
+    /**
+     * writeByteChecked(off, b, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} b
+     * @param {number} addr
+     */
+    writeByteChecked(off, b, addr)
+    {
+        if (DEBUGGER && this.dbg && this.addr != null) {
+            this.dbg.checkMemoryWrite(this.addr + off);
+        }
+        if (this.fReadOnly) this.writeNone(off, b, addr); else this.writeByteDirect(off, b, addr);
+    }
+
+    /**
+     * writeWordChecked(off, w, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} w
+     * @param {number} addr
+     */
+    writeWordChecked(off, w, addr)
+    {
+        if (DEBUGGER && this.dbg && this.addr != null) {
+            this.dbg.checkMemoryWrite(this.addr + off, 2)
+        }
+        if (this.fReadOnly) this.writeNone(off, w, addr); else this.writeWordDirect(off, w, addr);
+    }
+
+    /**
+     * readByteBE(off, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readByteBE(off, addr)
+    {
+        return this.ab[off];
+    }
+
+    /**
+     * readByteLE(off, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readByteLE(off, addr)
+    {
+        var b = this.ab[off];
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(MessagesPDP11.MEMORY)) {
+            this.dbg.printMessage("Memory.readByte(" + this.dbg.toStrBase(addr) + "): " + this.dbg.toStrBase(b), true);
+        }
+        return b;
+    }
+
+    /**
+     * readWordBE(off, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readWordBE(off, addr)
+    {
+        if (PDP11.MEMFAULT && (off & 0x1)) {
+            this.bus.fault(addr, PDP11.CPUERR.ODDADDR, PDP11.ACCESS.READ_WORD);
+        }
+        return this.dv.getUint16(off, true);
+    }
+
+    /**
+     * readWordLE(off, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} addr
+     * @return {number}
+     */
+    readWordLE(off, addr)
+    {
+        var w;
+        if (PDP11.MEMFAULT && (off & 0x1)) {
+            this.bus.fault(addr, PDP11.CPUERR.ODDADDR, PDP11.ACCESS.READ_WORD);
+        }
+        /*
+         * TODO: For non-WORDBUS machines, it remains to be seen if there's any advantage to checking the offset
+         * for an aligned read vs. always reading the bytes separately.
+         */
+        if (PDP11.WORDBUS || !(off & 0x1)) {
+            w = this.aw[off >> 1];
+        } else {
+            w = this.ab[off] | (this.ab[off+1] << 8);
+        }
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(MessagesPDP11.MEMORY)) {
+            this.dbg.printMessage("Memory.readWord(" + this.dbg.toStrBase(addr) + "): " + this.dbg.toStrBase(w), true);
+        }
+        return w;
+    }
+
+    /**
+     * writeByteBE(off, b, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} b
+     * @param {number} addr
+     */
+    writeByteBE(off, b, addr)
+    {
+        this.ab[off] = b;
+        this.fDirty = true;
+    }
+
+    /**
+     * writeByteLE(off, b, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} b
+     * @param {number} addr
+     */
+    writeByteLE(off, b, addr)
+    {
+        this.ab[off] = b;
+        this.fDirty = true;
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(MessagesPDP11.MEMORY)) {
+            this.dbg.printMessage("Memory.writeByte(" + this.dbg.toStrBase(addr) + "," + this.dbg.toStrBase(b) + ")", true);
+        }
+    }
+
+    /**
+     * writeWordBE(off, w, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} w
+     * @param {number} addr
+     */
+    writeWordBE(off, w, addr)
+    {
+        if (PDP11.MEMFAULT && (off & 0x1)) {
+            this.bus.fault(addr, PDP11.CPUERR.ODDADDR, PDP11.ACCESS.WRITE_WORD);
+        }
+        this.dv.setUint16(off, w, true);
+        this.fDirty = true;
+    }
+
+    /**
+     * writeWordLE(off, w, addr)
+     *
+     * @this {MemoryPDP11}
+     * @param {number} off
+     * @param {number} w
+     * @param {number} addr
+     */
+    writeWordLE(off, w, addr)
+    {
+        if (PDP11.MEMFAULT && (off & 0x1)) {
+            this.bus.fault(addr, PDP11.CPUERR.ODDADDR, PDP11.ACCESS.WRITE_WORD);
+        }
+        /*
+         * TODO: For non-WORDBUS machines, it remains to be seen if there's any advantage to checking the offset
+         * for an aligned write vs. always writing the bytes separately.
+         */
+        if (PDP11.WORDBUS || !(off & 0x1)) {
+            this.aw[off >> 1] = w;
+        } else {
+            this.ab[off] = w;
+            this.ab[off+1] = w >> 8;
+        }
+        this.fDirty = true;
+        if (DEBUGGER && this.dbg && this.dbg.messageEnabled(MessagesPDP11.MEMORY)) {
+            this.dbg.printMessage("Memory.writeWord(" + this.dbg.toStrBase(addr) + "," + this.dbg.toStrBase(w) + ")", true);
+        }
+    }
+}
+
+/*
+ * Basic memory types
+ *
+ * RAM is the most conventional memory type, providing full read/write capability to x86-compatible (ie,
+ * 'little endian") storage.  ROM is equally conventional, except that the fReadOnly property is set,
+ * disabling writes.  VIDEO is treated exactly like RAM, unless a controller is provided.  Both RAM and
+ * VIDEO memory are always considered writable, and even ROM can be written using the Bus setByteDirect()
+ * interface (which in turn uses the Memory writeByteDirect() interface), allowing the ROM component to
+ * initialize its own memory.  The CONTROLLER type is used to identify memory-mapped devices that do not
+ * need any default storage and always provide their own controller.
+ *
+ * Unallocated regions of the address space contain a special memory block of type NONE that contains
+ * no storage.  Mapping every addressible location to a memory block allows all accesses to be routed in
+ * exactly the same manner, without resorting to any range or processor checks.
+ *
+ * These types are not mutually exclusive.  For example, VIDEO memory could be allocated as RAM, with or
+ * without a custom controller (the original Monochrome and CGA video cards used read/write storage that
+ * was indistinguishable from RAM), and CONTROLLER memory could be allocated as an empty block of any type,
+ * with a custom controller.  A few types are required for certain features (eg, ROM is required if you want
+ * read-only memory), but the larger purpose of these types is to help document the caller's intent and to
+ * provide the Control Panel with the ability to highlight memory regions accordingly.
+ */
+MemoryPDP11.TYPE = {
+    NONE:       0,
+    RAM:        1,
+    ROM:        2,
+    VIDEO:      3,
+    CONTROLLER: 4
+};
+MemoryPDP11.TYPE_COLORS = ["black", "blue", "green", "cyan"];
+MemoryPDP11.TYPE_NAMES  = ["NONE",  "RAM",  "ROM",   "VID",  "H/W"];
+
+/*
+ * Last used block ID (used for debugging only)
+ */
+MemoryPDP11.idBlock = 0;
+
+/*
+ * This is the effective definition of afnNone, but we need not fully define it, because setAccess()
+ * uses these defaults when any of the 4 handlers (ie, 2 byte handlers and 2 word handlers) are undefined.
+ *
+MemoryPDP11.afnNone = [
+    MemoryPDP11.prototype.readNone,
+    MemoryPDP11.prototype.writeNone,
+    MemoryPDP11.prototype.readWordDefault,
+    MemoryPDP11.prototype.writeWordDefault
+];
+ */
+MemoryPDP11.afnNone = [];
+
+MemoryPDP11.afnMemory = [
+    MemoryPDP11.prototype.readByteMemory,
+    MemoryPDP11.prototype.writeByteMemory,
+    MemoryPDP11.prototype.readWordMemory,
+    MemoryPDP11.prototype.writeWordMemory
+];
+
+MemoryPDP11.afnChecked = [
+    MemoryPDP11.prototype.readByteChecked,
+    MemoryPDP11.prototype.writeByteChecked,
+    MemoryPDP11.prototype.readWordChecked,
+    MemoryPDP11.prototype.writeWordChecked
+];
+
+if (TYPEDARRAYS) {
+    MemoryPDP11.afnArrayBE = [
+        MemoryPDP11.prototype.readByteBE,
+        MemoryPDP11.prototype.writeByteBE,
+        MemoryPDP11.prototype.readWordBE,
+        MemoryPDP11.prototype.writeWordBE
+    ];
+
+    MemoryPDP11.afnArrayLE = [
+        MemoryPDP11.prototype.readByteLE,
+        MemoryPDP11.prototype.writeByteLE,
+        MemoryPDP11.prototype.readWordLE,
+        MemoryPDP11.prototype.writeWordLE
+    ];
+}
+
+var littleEndian = (TYPEDARRAYS? (function() {
+    var buffer = new ArrayBuffer(2);
+    new DataView(buffer).setUint16(0, 256, true);
+    return new Uint16Array(buffer)[0] === 256;
+})() : false);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/cpu.js (C) Jeff Parsons 2012-2017
+ */
+
+
+class CPUPDP11 extends Component {
+    /**
+     * CPUPDP11(parmsCPU, nCyclesDefault)
+     *
+     * The CPUPDP11 class supports the following (parmsCPU) properties:
+     *
+     *      cycles: the machine's base cycles per second; the CPUStatePDP11 constructor
+     *      will provide us with a default (based on the CPU model) to use as a fallback.
+     *
+     *      multiplier: base cycle multiplier; default is 1.
+     *
+     *      autoStart: true to automatically start, false to not, or null if "it depends";
+     *      null is the default, which means do not autostart UNLESS there is no Debugger
+     *      and no "Run" button (ie, no way to manually start the machine).
+     *
+     *      csStart: the number of cycles that runCPU() must wait before generating
+     *      checksum records; -1 if disabled. checksum records are a diagnostic aid
+     *      used to help compare one CPU run to another.
+     *
+     *      csInterval: the number of cycles that runCPU() must execute before generating
+     *      a checksum record; -1 if disabled.
+     *
+     *      csStop: the number of cycles to stop generating checksum records.
+     *
+     * This component is primarily responsible for interfacing the CPU with the outside
+     * world (eg, Panel and Debugger components), and managing overall CPU operation.
+     *
+     * It is extended by the CPUStatePDP11 component, where the simulation control logic resides.
+     *
+     * @param {Object} parmsCPU
+     * @param {number} nCyclesDefault
+     */
+    constructor(parmsCPU, nCyclesDefault)
+    {
+        super("CPU", parmsCPU, MessagesPDP11.CPU);
+
+        var nCycles = +parmsCPU['cycles'] || nCyclesDefault;
+
+        var nMultiplier = +parmsCPU['multiplier'] || 1;
+
+        this.nDisplayCount = 0;
+        this.nDisplayLimit = 30;
+        this.nCyclesPerSecond = nCycles;
+
+        /*
+         * nCyclesMultiplier replaces the old "speed" variable (0, 1, 2) and eliminates the need for
+         * the constants (SPEED_SLOW, SPEED_FAST and SPEED_MAX).  The UI simply doubles the multiplier
+         * until we've exceeded the host's speed limit and then starts the multiplier over at 1.
+         */
+        this.nCyclesMultiplier = nMultiplier;
+        this.mhzDefault = Math.round(this.nCyclesPerSecond / 10000) / 100;
+        this.mhzTarget = this.mhzDefault * this.nCyclesMultiplier;
+        this.msPerYield = this.nCyclesPerYield = this.nCyclesNextYield = this.nCyclesRecalc = 0;
+
+        /*
+         * We add a number of flags to the set initialized by Component
+         */
+        this.flags.running = this.flags.starting = false;
+        this.flags.autoStart = parmsCPU['autoStart'];
+        if (typeof this.flags.autoStart == "string") this.flags.autoStart = (this.flags.autoStart == "true");
+
+        /*
+         * Get checksum parameters, if any. runCPU() behavior is not affected until fChecksum
+         * is true, which won't happen until resetChecksum() is called with nCyclesChecksumInterval
+         * ("csInterval") set to a positive value.
+         *
+         * As above, any of these parameters can also be set with the Debugger's execution options
+         * command ("x"); for example, "x cs int 5000" will set nCyclesChecksumInterval to 5000
+         * and call resetChecksum().
+         */
+        this.flags.checksum = false;
+        this.nChecksum = this.nCyclesChecksumNext = 0;
+        this.nCyclesChecksumStart = +parmsCPU["csStart"];
+        this.nCyclesChecksumInterval = +parmsCPU["csInterval"];
+        this.nCyclesChecksumStop = +parmsCPU["csStop"];
+
+        /*
+         * Array of countdown timers managed by addTimer() and setTimer().
+         */
+        this.aTimers = [];
+
+        this.onRunTimeout = this.runCPU.bind(this); // function onRunTimeout() { cpu.runCPU(); };
+
+        /*
+         * Define the rest of the properties used by the class
+         */
+        this.mhz = 0;
+        this.nYieldsSinceStatusUpdate = 0;
+        this.msStartRun = this.msStartThisRun = this.msEndThisRun = this.nCyclesThisRun = 0;
+        this.nTotalCycles = this.nRunCycles = this.nBurstCycles = this.nStepCycles = this.nSnapCycles = 0;
+        this.panel = null;
+
+        this.setReady();
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {CPUPDP11}
+     * @param {ComputerPDP11} cmp
+     * @param {BusPDP11} bus
+     * @param {CPUPDP11} cpu
+     * @param {DebuggerPDP11} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cmp = cmp;
+        this.bus = bus;
+        this.dbg = dbg;
+        this.panel = cmp.panel;
+        for (var i = 0; i < CPUPDP11.BUTTONS.length; i++) {
+            var control = this.bindings[CPUPDP11.BUTTONS[i]];
+            if (control) this.cmp.setBinding(null, CPUPDP11.BUTTONS[i], control);
+        }
+        this.setReady();
+    }
+
+    /**
+     * reset()
+     *
+     * Stub for reset notification (overridden by the CPUStatePDP11 component).
+     *
+     * @this {CPUPDP11}
+     */
+    reset()
+    {
+    }
+
+    /**
+     * save()
+     *
+     * Stub for save support (overridden by the CPUStatePDP11 component).
+     *
+     * @this {CPUPDP11}
+     * @return {Object|null}
+     */
+    save()
+    {
+        return null;
+    }
+
+    /**
+     * restore(data)
+     *
+     * Stub for restore support (overridden by the CPUStatePDP11 component).
+     *
+     * @this {CPUPDP11}
+     * @param {Object} data
+     * @return {boolean} true if restore successful, false if not
+     */
+    restore(data)
+    {
+        return false;
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {CPUPDP11}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        /*
+         * We've already saved the parmsCPU 'autoStart' setting, but there may be a machine (or URL) override.
+         */
+        var sAutoStart = this.cmp.getMachineParm('autoStart');
+        if (sAutoStart != null) {
+            this.flags.autoStart = (sAutoStart == "true"? true : (sAutoStart  == "false"? false : !!sAutoStart));
+        }
+        else if (this.flags.autoStart == null) {
+            /*
+             * If there's no explicit parmsCPU setting either, then we will autoStart if there's no Debugger and
+             * no "Run" button.
+             */
+            this.flags.autoStart = ((!DEBUGGER || !this.dbg) && this.bindings["run"] === undefined);
+        }
+
+        if (!fRepower) {
+            if (!data) {
+                this.reset();
+            } else {
+                this.resetCycles();
+                if (!this.restore(data)) return false;
+                this.resetChecksum();
+            }
+            /*
+             * Give the Debugger a chance to do/print something once we've powered up.
+             */
+            if (DEBUGGER && this.dbg) {
+                this.dbg.init(this.flags.autoStart);
+            } else {
+                /*
+                 * The Computer (this.cmp) knows if there's a Control Panel (this.panel), and the Control Panel
+                 * knows if there's a "print" control (this.panel.controlPrint), and if there IS a "print" control
+                 * but no debugger, the machine is probably misconfigured (most likely, the page simply neglected to
+                 * load the Debugger component).
+                 *
+                 * However, we don't actually need to check all that; it's always safe use println(), regardless whether
+                 * a Control Panel with a "print" control is present or not.
+                 */
+                this.status("No debugger detected");
+            }
+            if (!this.flags.autoStart) {
+                this.println("CPU will not be auto-started " + (this.panel? "(click Run to start)" : "(type 'go' to start)"));
+            }
+        }
+        /*
+         * The Computer component (which is responsible for all powerDown and powerUp notifications)
+         * is now responsible for managing a component's fPowered flag, not us.
+         *
+         *      this.flags.powered = true;
+         */
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {CPUPDP11}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * autoStart()
+     *
+     * @this {CPUPDP11}
+     * @return {boolean} true if started, false if not
+     */
+    autoStart()
+    {
+        if (this.flags.running) {
+            return true;
+        }
+        if (this.flags.autoStart) {
+            /*
+             * We used to also set fUpdateFocus when calling startCPU(), on the assumption that in the "auto-starting"
+             * context, a machine without focus is like a day without sunshine, but in reality, focus should only be
+             * forced when the user takes some other machine-related action.
+             */
+            this.startCPU();
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * isPowered()
+     *
+     * @this {CPUPDP11}
+     * @return {boolean}
+     */
+    isPowered()
+    {
+        if (!this.flags.powered) {
+            this.println(this.toString() + " not powered");
+            return false;
+        }
+        return true;
+    }
+
+    /**
+     * isRunning()
+     *
+     * @this {CPUPDP11}
+     * @return {boolean}
+     */
+    isRunning()
+    {
+        return this.flags.running;
+    }
+
+    /**
+     * getChecksum()
+     *
+     * This will be implemented by the CPUStatePDP11 component.
+     *
+     * @this {CPUPDP11}
+     * @return {number} a 32-bit summation of key elements of the current CPU state (used by the CPU checksum code)
+     */
+    getChecksum()
+    {
+        return 0;
+    }
+
+    /**
+     * resetChecksum()
+     *
+     * If checksum generation is enabled (fChecksum is true), this resets the running 32-bit checksum and the
+     * cycle counter that will trigger the next displayChecksum(); called by resetCycles(), which is called whenever
+     * the CPU is reset or restored.
+     *
+     * @this {CPUPDP11}
+     * @return {boolean} true if checksum generation enabled, false if not
+     */
+    resetChecksum()
+    {
+        if (this.nCyclesChecksumStart === undefined) this.nCyclesChecksumStart = 0;
+        if (this.nCyclesChecksumInterval === undefined) this.nCyclesChecksumInterval = -1;
+        if (this.nCyclesChecksumStop === undefined) this.nCyclesChecksumStop = -1;
+        this.flags.checksum = (this.nCyclesChecksumStart >= 0 && this.nCyclesChecksumInterval > 0);
+        if (this.flags.checksum) {
+            this.nChecksum = 0;
+            this.nCyclesChecksumNext = this.nCyclesChecksumStart - this.nTotalCycles;
+            /*
+             *  this.nCyclesChecksumNext = this.nCyclesChecksumStart + this.nCyclesChecksumInterval -
+             *      (this.nTotalCycles % this.nCyclesChecksumInterval);
+             */
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * updateChecksum(nCycles)
+     *
+     * When checksum generation is enabled (fChecksum is true), runCPU() asks stepCPU() to execute a minimum
+     * number of cycles (1), effectively limiting execution to a single instruction, and then we're called with
+     * the exact number cycles that were actually executed.  This should give us instruction-granular checksums
+     * at precise intervals that are 100% repeatable.
+     *
+     * @this {CPUPDP11}
+     * @param {number} nCycles
+     */
+    updateChecksum(nCycles)
+    {
+        if (this.flags.checksum) {
+            /*
+             * Get a 32-bit summation of the current CPU state and add it to our running 32-bit checksum
+             */
+            var fDisplay = false;
+            this.nChecksum = (this.nChecksum + this.getChecksum())|0;
+            this.nCyclesChecksumNext -= nCycles;
+            if (this.nCyclesChecksumNext <= 0) {
+                this.nCyclesChecksumNext += this.nCyclesChecksumInterval;
+                fDisplay = true;
+            }
+            if (this.nCyclesChecksumStop >= 0) {
+                if (this.nCyclesChecksumStop <= this.getCycles()) {
+                    this.nCyclesChecksumInterval = this.nCyclesChecksumStop = -1;
+                    this.resetChecksum();
+                    this.stopCPU();
+                    fDisplay = true;
+                }
+            }
+            if (fDisplay) this.displayChecksum();
+        }
+    }
+
+    /**
+     * displayChecksum()
+     *
+     * When checksum generation is enabled (fChecksum is true), this is called to provide a crude log of all
+     * checksums generated at the specified cycle intervals, as specified by the "csStart" and "csInterval" parmsCPU
+     * properties).
+     *
+     * @this {CPUPDP11}
+     */
+    displayChecksum()
+    {
+        this.println(this.getCycles() + " cycles: " + "checksum=" + Str.toHex(this.nChecksum));
+    }
+
+    /**
+     * setBinding(sType, sBinding, control, sValue)
+     *
+     * @this {CPUPDP11}
+     * @param {string|null} sType is the type of the HTML control (eg, "button", "textarea", "register", "flag", "rled", etc)
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "run")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sType, sBinding, control, sValue)
+    {
+        var cpu = this;
+
+        switch (sBinding) {
+        case "power":
+        case "reset":
+            /*
+             * The "power" and "reset" buttons are functions of the entire computer, not just the CPU,
+             * but it's not always convenient to stick a power button in the Computer component definition,
+             * so we record those bindings here and pass them on to the Computer component in initBus().
+             */
+            this.bindings[sBinding] = control;
+            return true;
+
+        case "run":
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickRun() {
+                if (!cpu.cmp || !cpu.cmp.checkPower()) return;
+                /*
+                 * We no longer pass true to these startCPU()/stopCPU() calls, on the theory that if the "run"
+                 * control is visible, then the computer is probably sufficiently visible as well; the problem
+                 * with setting fUpdateFocus to true is that it can jerk the web page around in annoying ways.
+                 */
+                if (!cpu.flags.running)
+                    cpu.startCPU();
+                else
+                    cpu.stopCPU();
+            };
+            return true;
+
+        case "speed":
+            this.bindings[sBinding] = control;
+            return true;
+
+        case "setSpeed":
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickSetSpeed() {
+                cpu.setSpeed(cpu.nCyclesMultiplier << 1, true);
+            };
+            control.textContent = this.getSpeedTarget();
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * updateDisplays(nUpdate)
+     *
+     * Simpler wrapper around the Computer's updateDisplays() method.
+     *
+     * @this {CPUPDP11}
+     * @param {number} [nUpdate] (1 for periodic, -1 for forced, 0 or undefined otherwise)
+     */
+    updateDisplays(nUpdate)
+    {
+        if (this.cmp) this.cmp.updateDisplays(nUpdate);
+    }
+
+    /**
+     * updateDisplay(nUpdate)
+     *
+     * Some of the CPU bindings provide feedback and therefore need to be updated periodically.
+     * However, this should be called via the Computer's updateDisplays() interface, not directly.
+     *
+     * @this {CPUPDP11}
+     * @param {number} [nUpdate] (1 for periodic, -1 for forced, 0 otherwise)
+     */
+    updateDisplay(nUpdate)
+    {
+        var controlSpeed = this.bindings["speed"];
+        if (controlSpeed) {
+            if (nUpdate <= 0 || (this.nDisplayCount += nUpdate) >= this.nDisplayLimit) {
+                controlSpeed.textContent = this.getSpeedCurrent();
+                this.nDisplayCount = 0;
+            }
+        }
+    }
+
+    /**
+     * addCycles(nCycles, fEndStep)
+     *
+     * @this {CPUPDP11}
+     * @param {number} nCycles
+     * @param {boolean} [fEndStep]
+     */
+    addCycles(nCycles, fEndStep)
+    {
+        this.nTotalCycles += nCycles;
+        if (fEndStep) {
+            this.nBurstCycles = this.nStepCycles = this.nSnapCycles = 0;
+        }
+    }
+
+    /**
+     * calcCycles(fRecalc)
+     *
+     * Calculate the number of cycles to process for each "burst" of CPU activity.  The size of a burst
+     * is driven by YIELDS_PER_SECOND (eg, 30).
+     *
+     * At the end of each burst, we subtract burst cycles from the yield cycle "threshold" counter.
+     * Whenever the "next yield" cycle counter goes to (or below) zero, we compare elapsed time to the time
+     * we expected the virtual hardware to take (eg, 1000ms/50 or 20ms), and if we still have time remaining,
+     * we sleep the remaining time (or 0ms if there's no remaining time), and then restart runCPU().
+     *
+     * @this {CPUPDP11}
+     * @param {boolean} [fRecalc] is true if the caller wants to recalculate thresholds based on the most recent
+     * speed calculation (see calcSpeed).
+     */
+    calcCycles(fRecalc)
+    {
+        /*
+         * Calculate "per" yield values.
+         */
+        var vMultiplier = 1;
+        if (fRecalc) {
+            if (this.nCyclesMultiplier > 1 && this.mhz) {
+                vMultiplier = (this.mhz / this.mhzDefault);
+            }
+        }
+
+        this.msPerYield = Math.round(1000 / CPUPDP11.YIELDS_PER_SECOND);
+        this.nCyclesPerYield = Math.floor(this.nCyclesPerSecond / CPUPDP11.YIELDS_PER_SECOND * vMultiplier);
+
+        /*
+         * And initialize "next" yield values to the "per" values.
+         */
+        if (!fRecalc) this.nCyclesNextYield = this.nCyclesPerYield;
+        this.nCyclesRecalc = 0;
+    }
+
+    /**
+     * getCycles(fScaled)
+     *
+     * getCycles() returns the number of cycles executed so far.  Note that we can be called after
+     * runCPU() OR during runCPU(), perhaps from a handler triggered during the current run's stepCPU(),
+     * so nRunCycles must always be adjusted by number of cycles stepCPU() was asked to run (nBurstCycles),
+     * less the number of cycles it has yet to run (nStepCycles).
+     *
+     * nRunCycles is zeroed whenever the CPU is halted or the CPU speed is changed, which is why we also
+     * have nTotalCycles, which accumulates all nRunCycles before we zero it.  However, nRunCycles and
+     * nTotalCycles eventually get reset by calcSpeed(), to avoid overflow, so components that rely on
+     * getCycles() returning steadily increasing values should also be prepared for a reset at any time.
+     *
+     * @this {CPUPDP11}
+     * @param {boolean} [fScaled] is true if the caller wants a cycle count relative to a multiplier of 1
+     * @return {number}
+     */
+    getCycles(fScaled)
+    {
+        var nCycles = this.nTotalCycles + this.nRunCycles + this.nBurstCycles - this.nStepCycles;
+        if (fScaled && this.nCyclesMultiplier > 1 && this.mhz > this.mhzDefault) {
+            /*
+             * We could scale the current cycle count by the current effective speed (this.mhz); eg:
+             *
+             *      nCycles = Math.round(nCycles / (this.mhz / this.mhzDefault));
+             *
+             * but that speed will fluctuate somewhat: large fluctuations at first, but increasingly smaller
+             * fluctuations after each burst of instructions that runCPU() executes.
+             *
+             * Alternatively, we can scale the cycle count by the multiplier, which is good in that the
+             * multiplier doesn't vary once the user changes it, but a potential downside is that the
+             * multiplier might be set too high, resulting in a target speed that's higher than the effective
+             * speed is able to reach.
+             *
+             * Also, if multipliers were always limited to a power-of-two, then this could be calculated
+             * with a simple shift.  However, only the "setSpeed" UI binding limits it that way; the Debugger
+             * interface allows any value, as does the CPU "multiplier" parmsCPU property (from the machine's
+             * XML file).
+             */
+            nCycles = Math.round(nCycles / this.nCyclesMultiplier);
+        }
+        return nCycles;
+    }
+
+    /**
+     * getCyclesPerSecond()
+     *
+     * This returns the CPU's "base" speed (ie, the original cycles per second defined for the machine)
+     *
+     * @this {CPUPDP11}
+     * @return {number}
+     */
+    getCyclesPerSecond()
+    {
+        return this.nCyclesPerSecond;
+    }
+
+    /**
+     * resetCycles()
+     *
+     * Resets speed and cycle information as part of any reset() or restore(); this typically occurs during powerUp().
+     * It's important that this be called BEFORE the actual restore() call, because restore() may want to call setSpeed(),
+     * which in turn assumes that all the cycle counts have been initialized to sensible values.
+     *
+     * @this {CPUPDP11}
+     */
+    resetCycles()
+    {
+        this.mhz = 0;
+        this.nYieldsSinceStatusUpdate = 0;
+        this.nTotalCycles = this.nRunCycles = this.nBurstCycles = this.nStepCycles = this.nSnapCycles = 0;
+        this.resetChecksum();
+        this.setSpeed(1);
+    }
+
+    /**
+     * getSpeed()
+     *
+     * @this {CPUPDP11}
+     * @return {number} the current speed multiplier
+     */
+    getSpeed()
+    {
+        return this.nCyclesMultiplier;
+    }
+
+    /**
+     * getSpeedCurrent()
+     *
+     * @this {CPUPDP11}
+     * @return {string} the current speed, in mhz, as a string formatted to two decimal places
+     */
+    getSpeedCurrent()
+    {
+        /*
+         * TODO: Has toFixed() been "fixed" in all browsers (eg, IE) to return a rounded value now?
+         */
+        return ((this.flags.running)? (this.mhz.toFixed(2) + "Mhz") : "Stopped");
+    }
+
+    /**
+     * getSpeedTarget()
+     *
+     * @this {CPUPDP11}
+     * @return {string} the target speed, in mhz, as a string formatted to two decimal places
+     */
+    getSpeedTarget()
+    {
+        /*
+         * TODO: Has toFixed() been "fixed" in all browsers (eg, IE) to return a rounded value now?
+         */
+        return this.mhzTarget.toFixed(2) + "Mhz";
+    }
+
+    /**
+     * setSpeed(nMultiplier, fUpdateFocus)
+     *
+     * NOTE: This used to return the target speed, in mhz, but no callers appear to care at this point.
+     *
+     * @desc Whenever the speed is changed, the running cycle count and corresponding start time must be reset,
+     * so that the next effective speed calculation obtains sensible results.  In fact, when runCPU() initially calls
+     * setSpeed() with no parameters, that's all this function does (it doesn't change the current speed setting).
+     *
+     * @this {CPUPDP11}
+     * @param {number} [nMultiplier] is the new proposed multiplier (reverts to 1 if the target was too high)
+     * @param {boolean} [fUpdateFocus] is true to update Computer focus
+     * @return {boolean} true if successful, false if not
+     */
+    setSpeed(nMultiplier, fUpdateFocus)
+    {
+        var fSuccess = false;
+        if (nMultiplier !== undefined) {
+            /*
+             * If we haven't reached 80% (0.8) of the current target speed, revert to a multiplier of one (1).
+             */
+            if (this.mhz / this.mhzTarget < 0.8) {
+                nMultiplier = 1;
+            } else {
+                fSuccess = true;
+            }
+            this.nCyclesMultiplier = nMultiplier;
+            var mhz = this.mhzDefault * this.nCyclesMultiplier;
+            if (this.mhzTarget != mhz) {
+                this.mhzTarget = mhz;
+                var sSpeed = this.getSpeedTarget();
+                var controlSpeed = this.bindings["setSpeed"];
+                if (controlSpeed) controlSpeed.textContent = sSpeed;
+                this.println("target speed: " + sSpeed);
+            }
+            if (fUpdateFocus && this.cmp) this.cmp.setFocus();
+        }
+        this.addCycles(this.nRunCycles);
+        this.nRunCycles = 0;
+        this.msStartRun = Component.getTime();
+        this.msEndThisRun = 0;
+        this.calcCycles();
+        return fSuccess;
+    }
+
+    /**
+     * calcSpeed(nCycles, msElapsed)
+     *
+     * @this {CPUPDP11}
+     * @param {number} nCycles
+     * @param {number} msElapsed
+     */
+    calcSpeed(nCycles, msElapsed)
+    {
+        if (msElapsed) {
+            this.mhz = Math.round(nCycles / (msElapsed * 10)) / 100;
+            if (msElapsed >= 86400000) {
+                this.nTotalCycles = 0;
+                this.setSpeed();        // reset all counters once per day so that we never have to worry about overflow
+            }
+        }
+    }
+
+    /**
+     * calcStartTime()
+     *
+     * @this {CPUPDP11}
+     */
+    calcStartTime()
+    {
+        if (this.nCyclesRecalc >= this.nCyclesPerSecond) {
+            this.calcCycles(true);
+        }
+        this.nCyclesThisRun = 0;
+        this.msStartThisRun = Component.getTime();
+
+        /*
+         * Try to detect situations where the browser may have throttled us, such as when the user switches
+         * to a different tab; in those situations, Chrome and Safari may restrict setTimeout() callbacks
+         * to roughly one per second.
+         *
+         * Another scenario: the user resizes the browser window.  setTimeout() callbacks are not throttled,
+         * but there can still be enough of a lag between the callbacks that CPU speed will be noticeably
+         * erratic if we don't compensate for it here.
+         *
+         * We can detect throttling/lagging by verifying that msEndThisRun (which was set at the end of the
+         * previous run and includes any requested sleep time) is comparable to the current msStartThisRun;
+         * if the delta is significant, we compensate by bumping msStartRun forward by that delta.
+         *
+         * This shouldn't be triggered when the Debugger halts the CPU, because setSpeed() -- which is called
+         * whenever the CPU starts running again -- zeroes msEndThisRun.
+         *
+         * This also won't do anything about other internal delays; for example, Debugger message() calls.
+         * By the time the message() function has called yieldCPU(), the cost of the message has already been
+         * incurred, so it will be end up being charged against the instruction(s) that triggered it.
+         *
+         * TODO: Consider calling yieldCPU() sooner from message(), so that it can arrange for the msEndThisRun
+         * "snapshot" to occur sooner; it's unclear, however, whether that will really improve the CPU's ability
+         * to hit its target speed, since you would expect any instruction that displays a message to be an
+         * EXTREMELY slow instruction.
+         */
+        if (this.msEndThisRun) {
+            var msDelta = this.msStartThisRun - this.msEndThisRun;
+            if (msDelta > this.msPerYield) {
+                if (MAXDEBUG) this.println("large time delay: " + msDelta + "ms");
+                this.msStartRun += msDelta;
+                /*
+                 * Bumping msStartRun forward should NEVER cause it to exceed msStartThisRun; however, just
+                 * in case, I make absolutely sure it cannot happen, since doing so could result in negative
+                 * speed calculations.
+                 */
+
+                if (this.msStartRun > this.msStartThisRun) {
+                    this.msStartRun = this.msStartThisRun;
+                }
+            }
+        }
+    }
+
+    /**
+     * calcRemainingTime()
+     *
+     * @this {CPUPDP11}
+     * @return {number}
+     */
+    calcRemainingTime()
+    {
+        this.msEndThisRun = Component.getTime();
+
+        var msYield = this.msPerYield;
+        if (this.nCyclesThisRun) {
+            /*
+             * Normally, we would assume we executed a full quota of work over msPerYield, but since the CPU
+             * now has the option of calling yieldCPU(), that might not be true.  If nCyclesThisRun is correct, then
+             * the ratio of nCyclesThisRun/nCyclesPerYield should represent the percentage of work we performed,
+             * and so applying that percentage to msPerYield should give us a better estimate of work vs. time.
+             */
+            msYield = Math.round(msYield * this.nCyclesThisRun / this.nCyclesPerYield);
+        }
+
+        var msElapsedThisRun = this.msEndThisRun - this.msStartThisRun;
+        var msRemainsThisRun = msYield - msElapsedThisRun;
+
+        /*
+         * We could pass only "this run" results to calcSpeed():
+         *
+         *      nCycles = this.nCyclesThisRun;
+         *      msElapsed = msElapsedThisRun;
+         *
+         * but it seems preferable to use longer time periods and hopefully get a more accurate speed.
+         *
+         * Also, if msRemainsThisRun >= 0 && this.nCyclesMultiplier == 1, we could pass these results instead:
+         *
+         *      nCycles = this.nCyclesThisRun;
+         *      msElapsed = this.msPerYield;
+         *
+         * to insure that we display a smooth, constant N Mhz.  But for now, I prefer seeing any fluctuations.
+         */
+        var nCycles = this.nRunCycles;
+        var msElapsed = this.msEndThisRun - this.msStartRun;
+
+        if (MAXDEBUG && msRemainsThisRun < 0 && this.nCyclesMultiplier > 1) {
+            this.println("warning: updates @" + msElapsedThisRun + "ms (prefer " + Math.round(msYield) + "ms)");
+        }
+
+        this.calcSpeed(nCycles, msElapsed);
+
+        if (msRemainsThisRun < 0 || this.mhz < this.mhzTarget) {
+            /*
+             * Try "throwing out" the effects of large anomalies, by moving the overall run start time up;
+             * ordinarily, this should only happen when the someone is using an external Debugger or some other
+             * tool or feature that is interfering with our overall execution.
+             */
+            if (msRemainsThisRun < -1000) {
+                this.msStartRun -= msRemainsThisRun;
+            }
+            /*
+             * If the last burst took MORE time than we allotted (ie, it's taking more than 1 second to simulate
+             * nCyclesPerSecond), all we can do is yield for as little time as possible (ie, 0ms) and hope that the
+             * simulation is at least usable.
+             */
+            msRemainsThisRun = 0;
+        }
+
+        /*
+         * Last but not least, update nCyclesRecalc, so that when runCPU() starts up again and calls calcStartTime(),
+         * it'll be ready to decide if calcCycles() should be called again.
+         */
+        this.nCyclesRecalc += this.nCyclesThisRun;
+
+        if (DEBUG && this.messageEnabled(MessagesPDP11.LOG) && msRemainsThisRun) {
+            this.log("calcRemainingTime: " + msRemainsThisRun + "ms to sleep after " + this.msEndThisRun + "ms");
+        }
+
+        this.msEndThisRun += msRemainsThisRun;
+        return msRemainsThisRun;
+    }
+
+    /**
+     * addTimer(callBack)
+     *
+     * Components that want to have timers that periodically fire after some number of milliseconds call
+     * addTimer() to create the timer, and then setTimer() every time they want to arm it.  There is currently
+     * no removeTimer() because these are generally used for the entire lifetime of a component.
+     *
+     * Internally, each timer entry is a preallocated Array with two entries: a cycle countdown in element [0]
+     * and a callback function in element [1].  A timer is initially dormant; dormant timers have a countdown
+     * value of -1 (although any negative number will suffice) and active timers have a non-negative value.
+     *
+     * Why not use JavaScript's setTimeout() instead?  Good question.  For a good answer, see setTimer() below.
+     *
+     * TODO: Consider making the addTimer() and setTimer() interfaces more like the addIRQ() and setIRQ()
+     * interfaces (which return the underlying object instead of an array index) and maintaining a separate list
+     * of active timers, in order of highest to lowest cycle countdown values, as this could speed up
+     * getBurstCycles() and updateTimers() functions ever so slightly.
+     *
+     * @this {CPUPDP11}
+     * @param {function()} callBack
+     * @return {number} timer index
+     */
+    addTimer(callBack)
+    {
+        var iTimer = this.aTimers.length;
+        this.aTimers.push([-1, callBack]);
+        return iTimer;
+    }
+
+    /**
+     * setTimer(iTimer, ms, fReset)
+     *
+     * Using the timer index from a previous addTimer() call, this sets that timer to fire after the
+     * specified number of milliseconds.
+     *
+     * This is preferred over JavaScript's setTimeout(), because all our timers are effectively paused when
+     * the CPU is paused (eg, when the Debugger halts execution).  Moreover, setTimeout() handlers only run after
+     * runCPU() yields, which is far too granular for some components (eg, when the SerialPort tries to simulate
+     * interrupts at 9600 baud).
+     *
+     * Ideally, the only function that would use setTimeout() is runCPU(), while the rest of the components
+     * use setTimer(); however, due to legacy code (ie, code that predates these functions) and/or laziness,
+     * that may not be the case.
+     *
+     * @this {CPUPDP11}
+     * @param {number} iTimer
+     * @param {number} ms (converted into a cycle countdown internally)
+     * @param {boolean} [fReset] (true if the timer should be reset even if already armed)
+     * @return {number} (number of cycles used to arm timer, or -1 if error)
+     */
+    setTimer(iTimer, ms, fReset)
+    {
+        var nCycles = -1;
+        if (iTimer >= 0 && iTimer < this.aTimers.length) {
+            if (fReset || this.aTimers[iTimer][0] < 0) {
+                nCycles = this.getMSCycles(ms);
+                /*
+                 * We must now confront the following problem: if the CPU is currently executing a burst of cycles,
+                 * the number of cycles it has executed in that burst so far must NOT be charged against the cycle
+                 * timeout we're about to set.  The simplest way to resolve that is to immediately call endBurst()
+                 * and bias the cycle timeout by the number of cycles that the burst executed.
+                 */
+                if (this.flags.running) {
+                    nCycles += this.endBurst();
+                }
+                this.aTimers[iTimer][0] = nCycles;
+            }
+        }
+        return nCycles;
+    }
+
+    /**
+     * getMSCycles(ms)
+     *
+     * @this {CPUPDP11}
+     * @param {number} ms
+     * @return {number} number of corresponding cycles
+     */
+    getMSCycles(ms)
+    {
+        return ((this.nCyclesPerSecond * this.nCyclesMultiplier) / 1000 * ms)|0;
+    }
+
+    /**
+     * getBurstCycles(nCycles)
+     *
+     * Used by runCPU() to get min(nCycles,[timer cycle counts])
+     *
+     * @this {CPUPDP11}
+     * @param {number} nCycles (number of cycles about to execute)
+     * @return {number} (either nCycles or less if a timer needs to fire)
+     */
+    getBurstCycles(nCycles)
+    {
+        for (var i = this.aTimers.length - 1; i >= 0; i--) {
+            var timer = this.aTimers[i];
+
+            if (timer[0] < 0) continue;
+            if (nCycles > timer[0]) {
+                nCycles = timer[0];
+            }
+        }
+        return nCycles;
+    }
+
+    /**
+     * saveTimers()
+     *
+     * @this {CPUPDP11}
+     * @return {Array.<number>}
+     */
+    saveTimers()
+    {
+        var aTimerCycles = [];
+        for (var i = 0; i < this.aTimers.length; i++) {
+            var timer = this.aTimers[i];
+            aTimerCycles.push(timer[0]);
+        }
+        return aTimerCycles;
+    }
+
+    /**
+     * restoreTimers(aTimerCycles)
+     *
+     * @this {CPUPDP11}
+     * @param {Array.<number>} aTimerCycles
+     */
+    restoreTimers(aTimerCycles)
+    {
+
+        for (var i = 0; i < this.aTimers.length && i < aTimerCycles.length; i++) {
+            var timer = this.aTimers[i];
+            timer[0] = aTimerCycles[i];
+        }
+    }
+
+    /**
+     * updateTimers(nCycles)
+     *
+     * Used by runCPU() to reduce all active timer countdown values by the number of cycles just executed;
+     * this is the function that actually "fires" any timer(s) whose countdown has reached (or dropped below)
+     * zero, invoking their callback function.
+     *
+     * @this {CPUPDP11}
+     * @param {number} nCycles (number of cycles actually executed)
+     */
+    updateTimers(nCycles)
+    {
+        for (var i = this.aTimers.length - 1; i >= 0; i--) {
+            var timer = this.aTimers[i];
+
+            if (timer[0] < 0) continue;
+            timer[0] -= nCycles;
+            if (timer[0] <= 0) {
+                timer[0] = -1;      // zero is technically an "active" value, so ensure the timer is dormant now
+                timer[1]();         // safe to invoke the callback function now
+            }
+        }
+    }
+
+    /**
+     * endBurst(fReset)
+     *
+     * @this {CPUPDP11}
+     * @param {boolean} [fReset]
+     * @return {number} (number of cycles executed in the most recent burst)
+     */
+    endBurst(fReset)
+    {
+        var nCycles = this.nBurstCycles -= this.nStepCycles;
+        /*
+         * In addition to zeroing nStepCycles, it's important that we also zero nSnapCycles, because if a CPU
+         * burst is being ended after nStepCycles has been "snapped" (because a certain opcode has an unusual timing
+         * calculation that must be based on a "snapped" cycle count rather the opcode's starting cycle count), we
+         * could inadvertently undo the endBurst() if the original "snapped" value was used to update nStepCycles.
+         */
+        this.nStepCycles = this.nSnapCycles = 0;
+        if (fReset) this.nBurstCycles = 0;
+        return nCycles;
+    }
+
+    /**
+     * runCPU()
+     *
+     * @this {CPUPDP11}
+     */
+    runCPU()
+    {
+        if (!this.flags.running) return;
+
+        /*
+         *  calcStartTime() initializes the cycle counter and timestamp for this runCPU() invocation, and optionally
+         *  recalculates the the maximum number of cycles for each burst if the nCyclesRecalc threshold has been reached.
+         */
+        this.calcStartTime();
+
+        try {
+            do {
+                /*
+                 * nCycles is how many cycles we WANT to run on each iteration of stepCPU(), and may be as
+                 * HIGH as nCyclesPerYield, but it may be significantly less.  getBurstCycles() will adjust
+                 * nCycles downward if any CPU timers need to fire during the next burst.
+                 */
+                var nCycles = this.getBurstCycles(this.flags.checksum? 1 : this.nCyclesPerYield);
+
+                /*
+                 * Execute the burst.
+                 */
+                try {
+                    this.stepCPU(nCycles);
+                }
+                catch(exception) {
+                    /*
+                     * We assume that any numeric exception was explicitly thrown by the CPU to interrupt the
+                     * current instruction (and by extension, the current burst, but not the current run).  All
+                     * other exceptions are re-thrown to the catch below, which will attempt a stack dump.
+                     */
+                    if (typeof exception != "number") throw exception;
+                }
+
+                /*
+                 * Terminate the burst, returning the number of cycles that stepCPU() actually ran.
+                 */
+                nCycles = this.endBurst(true);
+
+                /*
+                 * Add nCycles to nCyclesThisRun, as well as nRunCycles (the cycle count since the CPU started).
+                 */
+                this.nCyclesThisRun += nCycles;
+                this.nRunCycles += nCycles;
+                this.updateChecksum(nCycles);
+
+                /*
+                 * Update any/all timers, firing those whose cycle countdowns have reached (or dropped below) zero.
+                 */
+                this.updateTimers(nCycles);
+
+                this.nCyclesNextYield -= nCycles;
+                if (this.nCyclesNextYield <= 0) {
+                    this.nCyclesNextYield += this.nCyclesPerYield;
+                    if (++this.nYieldsSinceStatusUpdate >= CPUPDP11.YIELDS_PER_STATUS) {
+                        this.updateDisplays();
+                        this.nYieldsSinceStatusUpdate = 0;
+                    }
+                    break;
+                }
+            } while (this.flags.running);
+        }
+        catch (e) {
+            this.stopCPU();
+            if (this.cmp) this.cmp.stop(Component.getTime(), this.getCycles());
+            this.setError(e.stack || e.message);
+            return;
+        }
+
+        if (this.flags.running) setTimeout(this.onRunTimeout, this.calcRemainingTime());
+    }
+
+    /**
+     * startCPU(fUpdateFocus)
+     *
+     * For use by any component that wants to start the CPU.
+     *
+     * @param {boolean} [fUpdateFocus]
+     * @return {boolean}
+     */
+    startCPU(fUpdateFocus)
+    {
+        if (this.isError()) {
+            return false;
+        }
+        if (this.flags.running) {
+            this.println(this.toString() + " busy");
+            return false;
+        }
+        /*
+         * setSpeed() without a speed parameter leaves the selected speed in place, but also resets the
+         * cycle counter and timestamp for the current series of runCPU() calls, calculates the maximum number
+         * of cycles for each burst based on the last known effective CPU speed, and resets the nCyclesRecalc
+         * threshold counter.
+         */
+        this.setSpeed();
+        this.flags.running = true;
+        this.flags.starting = true;
+        var controlRun = this.bindings["run"];
+        if (controlRun) controlRun.textContent = "Halt";
+        if (this.cmp) {
+            if (fUpdateFocus) this.cmp.setFocus(true);
+            this.cmp.start(this.msStartRun, this.getCycles());
+        }
+        if (!this.dbg) this.status("Started");
+        setTimeout(this.onRunTimeout, 0);
+        return true;
+    }
+
+    /**
+     * stepCPU(nMinCycles)
+     *
+     * This will be implemented by the CPUStatePDP11 component.
+     *
+     * @this {CPUPDP11}
+     * @param {number} nMinCycles (0 implies a single-step, and therefore breakpoints should be ignored)
+     * @return {number} of cycles executed; 0 indicates that the last instruction was not executed
+     */
+    stepCPU(nMinCycles)
+    {
+        return 0;
+    }
+
+    /**
+     * stopCPU(fComplete)
+     *
+     * For use by any component that wants to stop the CPU.
+     *
+     * This similar to yieldCPU(), but it doesn't need to zero nCyclesNextYield to break out of runCPU();
+     * it simply needs to clear fRunning (well, "simply" may be oversimplifying a bit....)
+     *
+     * @this {CPUPDP11}
+     * @param {boolean} [fComplete]
+     * @return {boolean} true if the CPU was stopped, false if it was already stopped
+     */
+    stopCPU(fComplete)
+    {
+        var fStopped = false;
+        if (this.flags.running) {
+            this.endBurst();
+            this.addCycles(this.nRunCycles);
+            this.nRunCycles = 0;
+            this.flags.running = false;
+            var controlRun = this.bindings["run"];
+            if (controlRun) controlRun.textContent = "Run";
+            if (this.cmp) {
+                this.cmp.stop(Component.getTime(), this.getCycles());
+            }
+            fStopped = true;
+            if (!this.dbg) this.status("Stopped");
+        }
+        this.flags.complete = fComplete;
+        return fStopped;
+    }
+
+    /**
+     * yieldCPU()
+     *
+     * Similar to stopCPU() with regard to how it resets various cycle countdown values, but the CPU
+     * remains in a "running" state.
+     *
+     * @this {CPUPDP11}
+     */
+    yieldCPU()
+    {
+        this.endBurst();                    // this will break us out of stepCPU()
+        this.nCyclesNextYield = 0;          // this will break us out of runCPU(), once we break out of stepCPU()
+        /*
+         * The Debugger calls yieldCPU() after every message() to ensure browser responsiveness, but it looks
+         * odd for those messages to show CPU state changes if the Control Panel, Video display, etc, does not,
+         * so I've added this call to try to keep things looking synchronized.
+         */
+        this.updateDisplays();
+    }
+}
+
+/*
+ * Constants that control the frequency at which various updates should occur.
+ *
+ * These values do NOT control the simulation directly.  Instead, they are used by
+ * calcCycles(), which uses the nCyclesPerSecond passed to the constructor as a starting
+ * point and computes the following variables:
+ *
+ *      this.nCyclesPerYield:    (this.nCyclesPerSecond / CPUPDP11.YIELDS_PER_SECOND)
+ *
+ * The above variables are also multiplied by any cycle multiplier in effect, via setSpeed(),
+ * and then they're used to initialize another set of variables for each runCPU() iteration:
+ *
+ *      this.nCyclesNextYield:   this.nCyclesPerYield
+ */
+CPUPDP11.YIELDS_PER_SECOND      = 30;           // just a gut feeling for the MINIMUM number of yields per second
+CPUPDP11.YIELDS_PER_STATUS      = 15;           // every 15 yields (ie, twice per second), perform CPU status updates
+
+CPUPDP11.BUTTONS = ["power", "reset"];
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/cpustate.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * Overview of Device Interrupt Support
+ *
+ * Originally, the CPU maintained a queue of requested interrupts.  Entries in this queue recorded a device's
+ * priority, vector, and delay (ie, a number of instructions to execute before dispatching the interrupt).  This
+ * queue would constantly grow and shrink as requests were issued and dispatched, and as long as there was something
+ * in the queue, the CPU was constantly examining it.
+ *
+ * Now we are trying something more efficient.  First, for devices that require delays (like the SerialPort's receiver
+ * and transmitter buffer registers, which are supposed to "clock" the data in and out at a specific baud rate), the
+ * CPU offers timer services that will "fire" a callback after a specified delay, which are much more efficient than
+ * requiring the CPU to dive into an interrupt queue and decrement delay counts on every instruction.
+ *
+ * Second, devices that generate interrupts will allocate an IRQ object during initialization; we will no longer
+ * be creating and destroying interrupt event objects and inserting/deleting them in a constantly changing queue.
+ * Each IRQ contains properties that never change (eg, the vector and priority), along with a "next" pointer that's
+ * only used when the IRQ is active.
+ *
+ * When a device decides it's time to interrupt (either at the end of some I/O operation or when a timer has fired),
+ * it will simply set the IRQ, which basically means that the IRQ will be linked onto a list of active IRQs, in
+ * priority order, so that when the CPU is ready to acknowledge interrupts, it need only check the top of the active
+ * IRQ list.
+ */
+
+/**
+ * @typedef {{
+ *  vector: number,
+ *  priority: number,
+ *  message: number,
+ *  next: (IRQ|null)
+ * }}
+ */
+var IRQ;
+
+class CPUStatePDP11 extends CPUPDP11 {
+    /**
+     * CPUStatePDP11(parmsCPU)
+     *
+     * The CPUStatePDP11 class uses the following (parmsCPU) properties:
+     *
+     *      model: a number (eg, 1170) that should match one of the PDP11.MODEL_* values
+     *      addrReset: reset address (default is 0)
+     *
+     * This extends the CPU class and passes any remaining parmsCPU properties to the CPU class
+     * constructor, along with a default speed (cycles per second) based on the specified
+     * (or default) CPU model number.
+     *
+     * After looking over the timings of PDP-11/70 instructions, nearly all of them appear
+     * to be multiples of 150ns.  So that's what we'll consider a cycle.  How many 150ns are
+     * in one second?  Approximately 6666667.  So by way of comparison to other PCjs machines,
+     * that makes the PDP-11 (or at least the PDP-11/70) look like a 6.67Mhz machine.
+     *
+     * I've started with the PDP-11/70, since that's what Paul Nankervis started with.  When
+     * I go back and add support for earlier PDP-11 models (primarily by neutering functions
+     * that didn't exist), I will no doubt have to tweak some instruction cycle counts, too.
+     *
+     * Examples of operations that take 1 extra cycle (150ns): single and double operand byte
+     * instructions with an odd address (except MOV/MTPI/MTPD/JMP/JRS), ADD/SUB/BIC/BIS/MOVB/CMP/BIT
+     * instructions with src of R1-R7 and dst of R6-R7, RORB/ASRB with an odd address, and each
+     * shift of ASH/ASHC.  As you can see, the rules are not simple.
+     *
+     * We're not simulating cache hardware, but our timings should be optimistic and assume 100%
+     * cache hits; for cache hits, each read cycle is 300ns.  As for write cycles, they are always
+     * 750ns.  My initial take on DEC's timings is that they are including the write time as part
+     * of the total EF (execute/fetch) time.  So, for instructions that write to memory, it looks
+     * like we'll normally need to add 5 cycles (750/150) to the instruction's base time, but
+     * we'll need to keep an eye out for exceptions.
+     *
+     * @param {Object} parmsCPU
+     */
+    constructor(parmsCPU)
+    {
+        var nCyclesDefault = 0;
+        var model = +parmsCPU['model'] || PDP11.MODEL_1170;
+
+        switch(model) {
+        case PDP11.MODEL_1170:
+        default:
+            nCyclesDefault = 6666667;
+            break;
+        }
+
+        /*
+         * ES6 ALERT: Classes cannot access "this" until all superclasses have been initialized as well.
+         */
+        super(parmsCPU, nCyclesDefault);
+
+        this.model = model;
+        this.addrReset = +parmsCPU['addrReset'] || 0;
+
+        /*
+         * These properties will be initialized by initCPU()
+         */
+        this.flagC = this.flagV = this.flagZ = this.flagN = 0;
+        this.regPSW = this.pswMode = 0;
+        this.pswTrap = 0;
+        this.regsGen = this.regsAlt = this.regsAltStack = [];
+        this.regsPAR = this.regsPDR = this.regsUniMap = this.regsControl = [];
+        this.opFlags = 0;
+
+        /*
+         * These properties will be initialized by initMMU()
+         */
+        this.regMMR0 = this.regMMR1 = this.regMMR2 = this.regMMR3 = 0;
+        this.regErr = this.regMBR = this.regPIR = this.regSLR = 0;
+        this.mmuEnable = this.mmuLastMode = this.mmuLastPage = this.mmuMask = 0;
+        this.addrLast = this.opLast = this.addrInvalid = 0;
+
+        this.mapMMR3 = [4,2,0,1];   // map from mode to MMR3 I/D bit
+
+        /*
+         * Initialize processor operation to match the requested model.
+         *
+         * offRegSrc is a bias added to the register index calculated in readSrcWord() and readSrcByte(),
+         * and by default has no effect on the register index, UNLESS this is a PDP-11/20, in which case the
+         * bias is changed to 8 and we return one of the negative values you see above.  Those negative values
+         * act as signals to writeDstWord() and writeDstByte(), effectively delaying evaluation of the register
+         * until then.
+         */
+        this.offRegSrc = 0;
+        this.maskRegSrcByte = 0xff;
+
+        if (this.model <= PDP11.MODEL_1120) {
+            this.opDecode = PDP11.op1120.bind(this);
+            this.checkStackLimit = this.checkStackLimit1120;
+            this.offRegSrc = 8;
+            this.maskRegSrcByte = -1;
+            this.pswUsed = ~(PDP11.PSW.UNUSED | PDP11.PSW.REGSET | PDP11.PSW.PMODE | PDP11.PSW.CMODE) & 0xffff;
+            this.pswRegSet = 0;
+        } else {
+            this.opDecode = PDP11.op1140.bind(this);
+            this.checkStackLimit = this.checkStackLimit1140;
+            /*
+             * The alternate register set (REGSET) doesn't exist on the 11/20 or 11/40; it's available on the 11/45 and 11/70.
+             * Ditto for separate I/D spaces, SUPER mode, and the instructions MFPD, MTPD, and SPL.
+             */
+            this.pswUsed = ~(PDP11.PSW.UNUSED | (this.model <= PDP11.MODEL_1140? PDP11.PSW.REGSET : 0)) & 0xffff;
+            this.pswRegSet = (this.model > PDP11.MODEL_1140? PDP11.PSW.REGSET : 0);
+        }
+
+        this.nDisableTraps = 0;
+        this.trapVector = this.trapReason = 0;
+
+        /** @type {IRQ|null} */
+        this.irqNext = null;        // the head of the active IRQ list, in priority order
+
+        /** @type {Array.<IRQ>} */
+        this.aIRQs = [];            // list of all IRQs, active or not (to be used for auto-configuration)
+
+        this.getByte = this.getByteDirect = this.getByteChecked;
+        this.getWord = this.getWordDirect = this.getWordChecked;
+        this.setByte = this.setByteDirect = this.setByteChecked;
+        this.setWord = this.setWordDirect = this.setWordChecked;
+        this.nReadBreaks = this.nWriteBreaks = 0;
+
+        this.addrDSpace = this.addrIOPage = 0;
+        this.getAddr = this.getVirtualAddrByMode;
+        this.readWord = this.readWordFromVirtual;
+        this.writeWord = this.writeWordToVirtual;
+
+        this.srcMode = this.srcReg = 0;
+        this.dstMode = this.dstReg = this.dstAddr = 0;
+
+        this.flags.complete = false;
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * Called once the Bus has been initialized.
+     *
+     * @this {CPUStatePDP11}
+     * @param {ComputerPDP11} cmp
+     * @param {BusPDP11} bus
+     * @param {CPUPDP11} cpu
+     * @param {DebuggerPDP11} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        super.initBus(cmp, bus, cpu, dbg);
+        this.getByteDirect = bus.getByte.bind(bus);
+        this.getWordDirect = bus.getWord.bind(bus);
+        this.setByteDirect = bus.setByte.bind(bus);
+        this.setWordDirect = bus.setWord.bind(bus);
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * We hook the powerUp() notification only because it's our best opportunity to take care of any
+     * floating vector assignments.
+     *
+     * @this {CPUStatePDP11}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        var vectorFloating = 0o300;
+        for (var i = 0; i < this.aIRQs.length; i++) {
+            var irq = this.aIRQs[i];
+            if (irq.vector < 0) {
+                irq.vector = vectorFloating;
+                vectorFloating += 4;
+            }
+        }
+        return super.powerUp(data, fRepower);
+    }
+
+    /**
+     * reset()
+     *
+     * @this {CPUStatePDP11}
+     */
+    reset()
+    {
+        this.status("Model " + this.model);
+        if (this.flags.running) this.stopCPU();
+        this.initCPU();
+        this.resetCycles();
+        this.clearError();          // clear any fatal error/exception that setError() may have flagged
+        super.reset();
+    }
+
+    /**
+     * initCPU()
+     *
+     * WARNING: It's tempting to call this function as early as the constructor() or initBus() calls, but
+     * but we actually need to wait until our reset() or restore() function is called by the powerUp() handler,
+     * ensuring that all device memory allocations have finished.  Only then is it safe to make the first call
+     * to initCPU() -> initMMU() -> setMemoryAccess() -> Bus.setIOPageRange() and sync the Bus memory map with
+     * the CPU memory map.
+     *
+     * @this {CPUStatePDP11}
+     */
+    initCPU()
+    {
+        /*
+         * TODO: Verify the initial state of all PDP-11 flags and registers (are they well-documented?)
+         */
+        var f = 0xffff;
+        this.flagC = 0x10000;       // PSW C bit
+        this.flagV  = 0x8000;       // PSW V bit
+        this.flagZ  = f;            // PSW Z bit        (TODO: Why do we clear instead of set Z, like other flags?)
+        this.flagN  = 0x8000;       // PSW N bit
+        this.regPSW = 0x000f;       // PSW other bits   (TODO: What's the point of setting the flag bits here, too?)
+
+        this.regsGen = [            // General R0-R7
+            0, 0, 0, 0, 0, 0, 0, this.addrReset, -1, -2, -3, -4, -5, -6, -7, -8
+        ];
+        this.regsAlt = [            // Alternate R0-R5
+            0, 0, 0, 0, 0, 0
+        ];
+        this.regsAltStack = [       // Alternate R6 stack pointers (KERNEL, SUPER, UNUSED, USER)
+            0, 0, 0, 0
+        ];
+        this.regsPAR = [            // memory management PAR registers by mode
+            [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],   // KERNEL (8 KIPAR regs followed by 8 KDPAR regs)
+            [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],   // SUPER  (8 SIPDR regs followed by 8 SDPDR regs)
+            [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],   // mode 2 (not used)
+            [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]    // USER   (8 UIPDR regs followed by 8 UDPDR regs)
+        ];
+        this.regsPDR = [            // memory management PDR registers by mode
+            [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],   // KERNEL (8 KIPDR regs followed by 8 KDPDR regs)
+            [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],   // SUPER  (8 SIPDR regs followed by 8 SDPDR regs)
+            [f, f, f, f, f, f, f, f, f, f, f, f, f, f, f, f],   // mode 2 (not used)
+            [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]    // USER   (8 UIPDR regs followed by 8 UDPDR regs)
+        ];
+        this.regsUniMap = [         // 32 UNIBUS map registers
+            0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+        ];
+        this.regsControl = [        // various control registers (177740-177756) we don't really care about
+            0, 0, 0, 0, 0, 0, 0, 0
+        ];
+
+        this.pswMode = 0;           // current memory management mode (see PDP11.MODE.KERNEL | SUPER | UNUSED | USER)
+        this.pswTrap = -1;
+        this.regMBR = 0;
+
+        /*
+         * opFlags contains various conditions that stepCPU() needs to be aware of.
+         */
+        this.opFlags = 0;
+
+        /*
+         * srcMode and srcReg are set by SRCMODE decodes, and dstMode and dstReg are set for DSTMODE decodes,
+         * indicating to the opcode handlers the mode(s) and register(s) used as part of the current opcode, so
+         * that they can calculate the correct number of cycles.  dstAddr is set for byte operations that also
+         * need to know the effective address for their cycle calculation.
+         */
+        this.srcMode = this.srcReg = 0;
+        this.dstMode = this.dstReg = this.dstAddr = 0;
+
+        this.initMMU();
+    }
+
+    /**
+     * initMMU()
+     *
+     * Reset all registers required as part of a RESET instruction.
+     *
+     * TODO: Do we ever need to automatically clear regErr, or is it cleared manually?
+     *
+     * @this {CPUStatePDP11}
+     */
+    initMMU()
+    {
+        this.regMMR0 = 0;           // 177572
+        this.regMMR1 = 0;           // 177574
+        this.regMMR2 = 0;           // 177576
+        this.regMMR3 = 0;           // 172516
+        this.regErr = 0;            // 177766
+        this.regPIR = 0;            // 177772
+        this.regSLR = 0xff;         // 177774
+        this.mmuEnable = 0;         // MMU enabled for PDP11.ACCESS.READ or PDP11.ACCESS.WRITE
+        this.mmuLastMode = 0;
+        this.mmuLastPage = 0;
+        this.mmuMask = 0x3ffff;
+
+        /*
+         * This is queried and displayed by the Panel when it's not displaying its own ADDRESS register
+         * (which takes precedence when, for example, you've manually halted the CPU and are independently
+         * examining the contents of other addresses).
+         *
+         * We initialize it to whatever the current PC is, because according to @paulnank's pdp11.js: "Reset
+         * displays next instruction address" and initMMU() is called on a RESET.
+         */
+        this.addrLast = this.regsGen[7];
+
+        /*
+         * This stores the PC in the lower 16 bits, and any auto-incs or auto-decs from the last opcode in the
+         * upper 16 bits;  the lower 16 bits are used to update MMR2, and the upper 16 bits are used to update MMR1.
+         * The upper bits are automatically zeroed at the start of every operation when the PC is copied to opLast.
+         */
+        this.opLast = 0;
+
+        this.resetIRQs();
+
+        /*
+         * As initCPU() explains, we shouldn't be calling this function until well after initBus() has been
+         * called, but we still make absolutely sure we have Bus access.
+         */
+        if (this.bus) {
+            this.setMemoryAccess();
+            this.addrInvalid = this.bus.getMemoryLimit(MemoryPDP11.TYPE.RAM);
+        }
+    }
+
+    /**
+     * getMMUState()
+     *
+     * Returns bit 0 set if 22-bit, bit 1 set if 18-bit, or bit 2 set if 16-bit; used by the Panel component.
+     *
+     * @this {CPUStatePDP11}
+     * @return {number}
+     */
+    getMMUState()
+    {
+        return this.mmuEnable? ((this.regMMR3 & PDP11.MMR3.MMU_22BIT)? 1 : 2) : 4;
+    }
+
+    /**
+     * resetCPU()
+     *
+     * @this {CPUStatePDP11}
+     */
+    resetCPU()
+    {
+        this.bus.reset();
+        this.initMMU();
+    }
+
+    /**
+     * setMemoryAccess()
+     *
+     * Define handlers and DSPACE setting appropriate for the current MMU mode, in order to eliminate unnecessary calls
+     * to mapVirtualToPhysical().
+     *
+     * @this {CPUStatePDP11}
+     */
+    setMemoryAccess()
+    {
+        this.getByte = this.getByteDirect;
+        this.getWord = this.getWordDirect;
+        this.setByte = this.setByteDirect;
+        this.setWord = this.setWordDirect;
+        if (this.nReadBreaks) {
+            this.getByte = this.getByteChecked;
+            this.getWord = this.getWordChecked;
+        }
+        if (this.nWriteBreaks) {
+            this.setByte = this.setByteChecked;
+            this.setWord = this.setWordChecked;
+        }
+        if (this.mmuEnable) {
+            this.addrDSpace = PDP11.ACCESS.DSPACE;
+            this.addrIOPage = (this.regMMR3 & PDP11.MMR3.MMU_22BIT)? BusPDP11.IOPAGE_22BIT : BusPDP11.IOPAGE_18BIT;
+            this.getAddr = this.getVirtualAddrByMode;
+            this.readWord = this.nReadBreaks? this.readWordFromVirtualChecked : this.readWordFromVirtual;
+            this.writeWord = this.nWriteBreaks? this.writeWordToVirtualChecked : this.writeWordToVirtual;
+            this.bus.setIOPageRange((this.regMMR3 & PDP11.MMR3.MMU_22BIT)? 22 : 18);
+        } else {
+            this.addrDSpace = 0;
+            this.addrIOPage = BusPDP11.IOPAGE_16BIT;
+            this.getAddr = this.getPhysicalAddrByMode;
+            this.readWord = this.nReadBreaks? this.readWordFromPhysicalChecked : this.readWordFromPhysical;
+            this.writeWord = this.nWriteBreaks? this.writeWordToPhysicalChecked : this.writeWordToPhysical;
+            this.bus.setIOPageRange(16);
+        }
+    }
+
+    /**
+     * getMMR0()
+     *
+     * NOTE: It's OK to bypass this function if you're only interested in bits that always stored directly in MMR0.
+     *
+     * 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 MMR0
+     * nonr leng read trap unus unus ena mnt cmp  -mode- i/d  --page--   enable
+     *
+     * @this {CPUStatePDP11}
+     * @return {number}
+     */
+    getMMR0()
+    {
+        var data = this.regMMR0;
+        if (!(data & PDP11.MMR0.ABORT)) {
+            data = (data & ~(PDP11.MMR0.UNUSED | PDP11.MMR0.PAGE | PDP11.MMR0.MODE)) | (this.mmuLastMode << 5) | (this.mmuLastPage << 1);
+        }
+        return data;
+    }
+
+    /**
+     * setMMR0()
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} newMMR0
+     */
+    setMMR0(newMMR0)
+    {
+        newMMR0 &= ~PDP11.MMR0.UNUSED;
+
+        if (this.regMMR0 != newMMR0) {
+            if (newMMR0 & PDP11.MMR0.ABORT) {
+                /*
+                 * If updates to MMR0[1-7], MMR1, and MMR2 are being shut off (ie, MMR0.ABORT bits are transitioning
+                 * from clear to set), then do one final sync with their real-time counterparts in opLast.
+                 */
+                if (!(this.regMMR0 & PDP11.MMR0.ABORT)) {
+                    this.regMMR1 = (this.opLast >> 16) & 0xffff;
+                    this.regMMR2 = this.opLast & 0xffff;
+                }
+            }
+            /*
+             * NOTE: We are not protecting the read-only state of the COMPLETED bit here; that's handled by writeMMR0().
+             */
+            this.regMMR0 = newMMR0;
+            this.mmuLastMode = (newMMR0 & PDP11.MMR0.MODE) >> PDP11.MMR0.SHIFT.MODE;
+            this.mmuLastPage = (newMMR0 & PDP11.MMR0.PAGE) >> PDP11.MMR0.SHIFT.PAGE;
+            var mmuEnable = 0;
+            if (newMMR0 & (PDP11.MMR0.ENABLED | PDP11.MMR0.MAINT)) {
+                mmuEnable = PDP11.ACCESS.WRITE;
+                if (newMMR0 & PDP11.MMR0.ENABLED) mmuEnable |= PDP11.ACCESS.READ;
+            }
+            if (this.mmuEnable != mmuEnable) {
+                this.mmuEnable = mmuEnable;
+                this.setMemoryAccess();
+            }
+        }
+    }
+
+    /**
+     * getMMR1()
+     *
+     * @this {CPUStatePDP11}
+     * @return {number}
+     */
+    getMMR1()
+    {
+        /*
+         * If updates to MMR1 have not been shut off (ie, MMR0.ABORT bits are clear), then we are allowed
+         * to sync MMR1 with its real-time counterpart in opLast.
+         *
+         * UPDATE: Apparently, I was mistaken that this register would only be updated when the MMR0 ENABLED
+         * bit was set.
+         *
+         *      if ((this.regMMR0 & (PDP11.MMR0.ABORT | PDP11.MMR0.ENABLED)) == PDP11.MMR0.ENABLED)
+         */
+        if (!(this.regMMR0 & PDP11.MMR0.ABORT)) {
+            this.regMMR1 = (this.opLast >> 16) & 0xffff;
+        }
+        var result = this.regMMR1;
+        if (result & 0xff00) {
+            result = ((result << 8) | (result >> 8)) & 0xffff;
+        }
+        return result;
+    }
+
+    /**
+     * getMMR2()
+     *
+     * @this {CPUStatePDP11}
+     * @return {number}
+     */
+    getMMR2()
+    {
+        /*
+         * If updates to MMR2 have not been shut off (ie, MMR0.ABORT bits are clear), then we are allowed
+         * to sync MMR2 with its real-time counterpart in opLast.
+         *
+         * UPDATE: Apparently, I was mistaken that this register would only be updated when the MMR0 ENABLED
+         * bit was set.
+         *
+         *      if ((this.regMMR0 & (PDP11.MMR0.ABORT | PDP11.MMR0.ENABLED)) == PDP11.MMR0.ENABLED)
+         */
+        if (!(this.regMMR0 & PDP11.MMR0.ABORT)) {
+            this.regMMR2 = this.opLast & 0xffff;
+        }
+        return this.regMMR2;
+    }
+
+    /**
+     * getMMR3()
+     *
+     * @this {CPUStatePDP11}
+     * @return {number}
+     */
+    getMMR3()
+    {
+        return this.regMMR3;
+    }
+
+    /**
+     * setMMR3()
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} newMMR3
+     */
+    setMMR3(newMMR3)
+    {
+        /*
+         * Don't allow non-11/70 models to use 22-bit addressing or the UNIBUS map.
+         */
+        if (this.model < PDP11.MODEL_1170) {
+            newMMR3 &= ~(PDP11.MMR3.MMU_22BIT | PDP11.MMR3.UNIBUS_MAP);
+        }
+        if (this.regMMR3 != newMMR3) {
+            this.regMMR3 = newMMR3;
+            this.mmuMask = (newMMR3 & PDP11.MMR3.MMU_22BIT)? BusPDP11.MASK_22BIT : BusPDP11.MASK_18BIT;
+            this.setMemoryAccess();
+        }
+    }
+
+    /**
+     * setReset(addr, fStart, bUnit, addrStack)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addr
+     * @param {boolean} [fStart] (true if a "startable" image was just loaded, false if not)
+     * @param {number} [bUnit] (boot unit #)
+     * @param {number} [addrStack]
+     */
+    setReset(addr, fStart, bUnit, addrStack)
+    {
+        this.addrReset = addr;
+
+        this.setPC(addr);
+        this.setPSW(0);
+
+        this.resetCPU();
+
+        if (fStart) {
+            this.regsGen[0] = bUnit || 0;
+            for (var i = 1; i <= 5; i++) this.regsGen[i] = 0;
+            this.regsGen[6] = addrStack || 0o2000;
+            if (!this.flags.powered) {
+                this.flags.autoStart = true;
+            }
+            else if (!this.flags.running) {
+                this.startCPU();
+            }
+        }
+        else {
+            if (this.dbg && this.flags.powered) {
+                /*
+                 * TODO: Review the decision to always stop the CPU if the Debugger is loaded.  Note that
+                 * when stopCPU() stops a running CPU, the Debugger gets notified, so no need to notify it again.
+                 *
+                 * TODO: There are more serious problems to deal with if another component is slamming a new PC down
+                 * the CPU's throat (presumably while also dropping some new code into RAM) while the CPU is running;
+                 * we should probably force a complete reset, but for now, it's up to the user to hit the reset button
+                 * themselves.
+                 */
+                if (!this.stopCPU() && !this.cmp.flags.reset) {
+                    this.dbg.updateStatus();
+                    this.cmp.updateDisplays(-1);
+                }
+            }
+            else if (fStart === false) {
+                this.stopCPU();
+            }
+        }
+        if (!this.isRunning() && this.panel) this.panel.stop();
+    }
+
+    /**
+     * getChecksum()
+     *
+     * TODO: Implement
+     *
+     * @this {CPUStatePDP11}
+     * @return {number} a 32-bit summation of key elements of the current CPU state (used by the CPU checksum code)
+     */
+    getChecksum()
+    {
+        return 0;
+    }
+
+    /**
+     * save()
+     *
+     * @this {CPUStatePDP11}
+     * @return {Object|null}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, [
+            this.regsGen,
+            this.regsAlt,
+            this.regsAltStack,
+            this.regsPAR,
+            this.regsPDR,
+            this.regsUniMap,
+            this.regsControl,
+            this.regErr,
+            this.regMBR,
+            this.regPIR,
+            this.regSLR,
+            this.mmuLastMode,
+            this.mmuLastPage,
+            this.addrLast,
+            this.opFlags,
+            this.opLast,
+            this.pswTrap,
+            this.trapReason,
+            this.trapVector,
+            this.addrReset
+        ]);
+        state.set(1, [this.getPSW(),this.getMMR0(),this.getMMR1(),this.getMMR2(),this.getMMR3()]);
+        state.set(2, [this.nTotalCycles, this.getSpeed(), this.flags.autoStart]);
+        state.set(3, this.saveIRQs());
+        state.set(4, this.saveTimers());
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * @this {CPUStatePDP11}
+     * @param {Object} data
+     * @return {boolean} true if restore successful, false if not
+     */
+    restore(data)
+    {
+        /*
+         * ES6 ALERT: A handy destructuring assignment, which makes it easy to perform the inverse
+         * of what save() does when it collects a bunch of object properties into an array.
+         */
+        [
+            this.regsGen,
+            this.regsAlt,
+            this.regsAltStack,
+            this.regsPAR,
+            this.regsPDR,
+            this.regsUniMap,
+            this.regsControl,
+            this.regErr,
+            this.regMBR,
+            this.regPIR,
+            this.regSLR,
+            this.mmuLastMode,
+            this.mmuLastPage,
+            this.addrLast,
+            this.opFlags,
+            this.opLast,
+            this.pswTrap,
+            this.trapReason,
+            this.trapVector,
+            this.addrReset
+        ] = data[0];
+
+        var a = data[1];
+        this.setPSW(a[0]);
+        this.setMMR0(a[1]);
+        this.regMMR1 = a[2];
+        this.regMMR2 = a[3];
+        this.setMMR3(a[4]);
+
+        a = data[2];
+        this.nTotalCycles = a[0];
+        this.setSpeed(a[1]);
+        this.flags.autoStart = a[2];
+
+        this.restoreIRQs(data[3]);
+        this.restoreTimers(data[4]);
+        return true;
+    }
+
+    /**
+     * clearCF()
+     *
+     * @this {CPUStatePDP11}
+     */
+    clearCF()
+    {
+        this.flagC = 0;
+    }
+
+    /**
+     * getCF()
+     *
+     * @this {CPUStatePDP11}
+     * @return {number} 0 or PDP11.PSW.CF
+     */
+    getCF()
+    {
+        return (this.flagC & 0x10000)? PDP11.PSW.CF: 0;
+    }
+
+    /**
+     * setCF()
+     *
+     * @this {CPUStatePDP11}
+     */
+    setCF()
+    {
+        this.flagC = 0x10000;
+    }
+
+    /**
+     * clearVF()
+     *
+     * @this {CPUStatePDP11}
+     */
+    clearVF()
+    {
+        this.flagV = 0;
+    }
+
+    /**
+     * getVF()
+     *
+     * @this {CPUStatePDP11}
+     * @return {number} 0 or PDP11.PSW.VF
+     */
+    getVF()
+    {
+        return (this.flagV & 0x8000)? PDP11.PSW.VF: 0;
+    }
+
+    /**
+     * setVF()
+     *
+     * @this {CPUStatePDP11}
+     */
+    setVF()
+    {
+        this.flagV = 0x8000;
+    }
+
+    /**
+     * clearZF()
+     *
+     * @this {CPUStatePDP11}
+     */
+    clearZF()
+    {
+        this.flagZ = 1;
+    }
+
+    /**
+     * getZF()
+     *
+     * @this {CPUStatePDP11}
+     * @return {number} 0 or PDP11.PSW.ZF
+     */
+    getZF()
+    {
+        return (this.flagZ & 0xffff)? 0 : PDP11.PSW.ZF;
+    }
+
+    /**
+     * setZF()
+     *
+     * @this {CPUStatePDP11}
+     */
+    setZF()
+    {
+        this.flagZ = 0;
+    }
+
+    /**
+     * clearNF()
+     *
+     * @this {CPUStatePDP11}
+     */
+    clearNF()
+    {
+        this.flagN = 0;
+    }
+
+    /**
+     * getNF()
+     *
+     * @this {CPUStatePDP11}
+     * @return {number} 0 or PDP11.PSW.NF
+     */
+    getNF()
+    {
+        return (this.flagN & 0x8000)? PDP11.PSW.NF : 0;
+    }
+
+    /**
+     * setNF()
+     *
+     * @this {CPUStatePDP11}
+     */
+    setNF()
+    {
+        this.flagN = 0x8000;
+    }
+
+    /**
+     * getOpcode()
+     *
+     * @this {CPUStatePDP11}
+     * @return {number}
+     */
+    getOpcode()
+    {
+        var pc = this.opLast = this.regsGen[PDP11.REG.PC];
+        /*
+         * If PC is unaligned, a BUS trap will be generated, and because it will generate an
+         * exception, the next line (the equivalent of advancePC(2)) will not be executed, ensuring that
+         * original unaligned PC will be pushed onto the stack by trap().
+         */
+        var opCode = this.readWord(pc);
+        this.regsGen[PDP11.REG.PC] = (pc + 2) & 0xffff;
+        return opCode;
+    }
+
+    /**
+     * advancePC(off)
+     *
+     * NOTE: This function is nothing more than a convenience, and we fully expect it to be inlined at runtime.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} off
+     * @return {number} (original PC)
+     */
+    advancePC(off)
+    {
+        var pc = this.regsGen[PDP11.REG.PC];
+        this.regsGen[PDP11.REG.PC] = (pc + off) & 0xffff;
+        return pc;
+    }
+
+    /**
+     * branch(opCode)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} opCode
+     * @param {boolean|number} condition
+     */
+    branch(opCode, condition)
+    {
+        if (condition) {
+            var off = ((opCode << 24) >> 23);
+            if (DEBUG && DEBUGGER && this.dbg && off == -2) {
+                this.dbg.stopInstruction("branch to self");
+            }
+            this.setPC(this.getPC() + off);
+            this.nStepCycles -= 2;
+        }
+        this.nStepCycles -= (2 + 1);
+    }
+
+    /**
+     * getPC()
+     *
+     * NOTE: This function is nothing more than a convenience, and we fully expect it to be inlined at runtime.
+     *
+     * @this {CPUStatePDP11}
+     * @return {number}
+     */
+    getPC()
+    {
+        return this.regsGen[PDP11.REG.PC];
+    }
+
+    /**
+     * getLastAddr()
+     *
+     * @this {CPUStatePDP11}
+     * @return {number}
+     */
+    getLastAddr()
+    {
+        return this.addrLast;
+    }
+
+    /**
+     * getLastPC()
+     *
+     * @this {CPUStatePDP11}
+     * @return {number}
+     */
+    getLastPC()
+    {
+        return this.opLast & 0xffff;
+    }
+
+    /**
+     * setPC()
+     *
+     * NOTE: Unlike other PCjs emulators, such as PCx86, where all PC updates MUST go through the setPC()
+     * function, this function is nothing more than a convenience, because in the PDP-11, the PC can be loaded
+     * like any other general register.  We fully expect this function to be inlined at runtime.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addr
+     */
+    setPC(addr)
+    {
+        this.regsGen[PDP11.REG.PC] = addr & 0xffff;
+    }
+
+    /**
+     * getSP()
+     *
+     * NOTE: This function is nothing more than a convenience, and we fully expect it to be inlined at runtime.
+     *
+     * @this {CPUStatePDP11}
+     * @return {number}
+     */
+    getSP()
+    {
+        return this.regsGen[PDP11.REG.SP];
+    }
+
+    /**
+     * setSP()
+     *
+     * NOTE: Unlike other PCjs emulators, such as PCx86, where all SP updates MUST go through the setSP()
+     * function, this function is nothing more than a convenience, because in the PDP-11, the PC can be loaded
+     * like any other general register.  We fully expect this function to be inlined at runtime.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addr
+     */
+    setSP(addr)
+    {
+        this.regsGen[PDP11.REG.SP] = addr & 0xffff;
+    }
+
+    /**
+     * addIRQ(vector, priority, message)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} vector (-1 for floating vector)
+     * @param {number} priority
+     * @param {number} [message]
+     * @return {IRQ}
+     */
+    addIRQ(vector, priority, message)
+    {
+        var irq = {vector: vector, priority: priority, message: message || 0, name: PDP11.VECTORS[vector], next: null};
+        this.aIRQs.push(irq);
+        return irq;
+    }
+
+    /**
+     * insertIRQ(irq)
+     *
+     * @this {CPUStatePDP11}
+     * @param {IRQ} irq
+     */
+    insertIRQ(irq)
+    {
+        if (irq != this.irqNext) {
+            var irqPrev = this.irqNext;
+            if (!irqPrev || irqPrev.priority <= irq.priority) {
+                irq.next = irqPrev;
+                this.irqNext = irq;
+            } else {
+                do {
+                    var irqNext = irqPrev.next;
+                    if (!irqNext || irqNext.priority <= irq.priority) {
+                        irq.next = irqNext;
+                        irqPrev.next = irq;
+                        break;
+                    }
+                    irqPrev = irqNext;
+                } while (irqPrev);
+            }
+        }
+        /*
+         * See the writeXCSR() function for an explanation of why signalling an IRQ hardware interrupt
+         * should be done using IRQ_DELAY rather than setting IRQ directly.
+         */
+        this.opFlags |= PDP11.OPFLAG.IRQ_DELAY;
+    }
+
+    /**
+     * removeIRQ(irq)
+     *
+     * @this {CPUStatePDP11}
+     * @param {IRQ} irq
+     */
+    removeIRQ(irq)
+    {
+        var irqPrev = this.irqNext;
+        if (irqPrev == irq) {
+            this.irqNext = irq.next;
+        } else {
+            while (irqPrev) {
+                var irqNext = irqPrev.next;
+                if (irqNext == irq) {
+                    irqPrev.next = irqNext.next;
+                    break;
+                }
+                irqPrev = irqNext;
+            }
+        }
+        /*
+         * We could also set irq.next to null now, but strictly speaking, that shouldn't be necessary.
+         *
+         * Last but not least, if there's still an IRQ on the active IRQ list, we need to make sure IRQ_DELAY
+         * is still set.
+         */
+        if (this.irqNext) {
+            this.opFlags |= PDP11.OPFLAG.IRQ_DELAY;
+        }
+    }
+
+    /**
+     * setIRQ(irq)
+     *
+     * @this {CPUStatePDP11}
+     * @param {IRQ|null} irq
+     */
+    setIRQ(irq)
+    {
+        if (irq) {
+            this.insertIRQ(irq);
+            if (irq.message && this.messageEnabled(irq.message | MessagesPDP11.INT)) {
+                this.printMessage("setIRQ(vector=" + Str.toOct(irq.vector) + ",priority=" + irq.priority + ")", true, true);
+            }
+        }
+    }
+
+    /**
+     * clearIRQ(irq)
+     *
+     * @this {CPUStatePDP11}
+     * @param {IRQ|null} irq
+     */
+    clearIRQ(irq)
+    {
+        if (irq) {
+            this.removeIRQ(irq);
+            if (irq.message && this.messageEnabled(irq.message | MessagesPDP11.INT)) {
+                this.printMessage("clearIRQ(vector=" + Str.toOct(irq.vector) + ",priority=" + irq.priority + ")", true, true);
+            }
+        }
+    }
+
+    /**
+     * findIRQ(vector)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} vector
+     * @return {IRQ|null}
+     */
+    findIRQ(vector)
+    {
+        for (var i = 0; i < this.aIRQs.length; i++) {
+            var irq = this.aIRQs[i];
+            if (irq.vector === vector) return irq;
+        }
+        return null;
+    }
+
+    /**
+     * checkIRQs(priority)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} priority
+     * @return {IRQ|null}
+     */
+    checkIRQs(priority)
+    {
+        return (this.irqNext && this.irqNext.priority > priority)? this.irqNext : null;
+    }
+
+    /**
+     * resetIRQs(priority)
+     *
+     * @this {CPUStatePDP11}
+     */
+    resetIRQs()
+    {
+        this.irqNext = null;
+    }
+
+    /**
+     * saveIRQs()
+     *
+     * @this {CPUStatePDP11}
+     * @return {Array.<number>}
+     */
+    saveIRQs()
+    {
+        var aIRQVectors = [];
+        var irq = this.irqNext;
+        while (irq) {
+            aIRQVectors.push(irq.vector);
+            irq = irq.next;
+        }
+        return aIRQVectors;
+    }
+
+    /**
+     * restoreIRQs(aIRQVectors)
+     *
+     * @this {CPUStatePDP11}
+     * @param {Array.<number>} aIRQVectors
+     */
+    restoreIRQs(aIRQVectors)
+    {
+        for (var i = aIRQVectors.length - 1; i >= 0; i--) {
+            var irq = this.findIRQ(aIRQVectors[i]);
+
+            if (irq) {
+                irq.next = this.irqNext;
+                this.irqNext = irq;
+            }
+        }
+    }
+
+    /**
+     * checkInterrupts()
+     *
+     * @this {CPUStatePDP11}
+     * @return {boolean} true if an interrupt was dispatched, false if not
+     */
+    checkInterrupts()
+    {
+        var fInterrupt = false;
+
+        if (this.opFlags & PDP11.OPFLAG.IRQ) {
+
+            var vector = PDP11.TRAP.PIRQ;
+            var priority = (this.regPIR & PDP11.PSW.PRI) >> PDP11.PSW.SHIFT.PRI;
+
+            var irq = this.checkIRQs(priority);
+            if (irq) {
+                vector = irq.vector;
+                priority = irq.priority;
+            }
+
+            if (this.dispatchInterrupt(vector, priority)) {
+                if (irq) this.removeIRQ(irq);
+                fInterrupt = true;
+            }
+
+            if (!this.irqNext && !this.regPIR) {
+                this.opFlags &= ~PDP11.OPFLAG.IRQ;
+            }
+        }
+        else if (this.opFlags & PDP11.OPFLAG.IRQ_DELAY) {
+            /*
+             * We know that IRQ (bit 2) is clear, so since IRQ_DELAY (bit 0) is set, incrementing opFlags
+             * will eventually transform IRQ_DELAY into IRQ, without affecting any other (higher) bits.
+             */
+            this.opFlags++;
+        }
+        return fInterrupt;
+    }
+
+    /**
+     * dispatchInterrupt(vector, priority)
+     *
+     * TODO: The process of dispatching an interrupt MUST cost some cycles; either trap() needs to assess
+     * that cost, or we do.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} vector
+     * @param {number} priority
+     * @return {boolean} (true if dispatched, false if not)
+     */
+    dispatchInterrupt(vector, priority)
+    {
+        var priorityCPU = (this.regPSW & PDP11.PSW.PRI) >> PDP11.PSW.SHIFT.PRI;
+        if (priority > priorityCPU) {
+            if (this.opFlags & PDP11.OPFLAG.WAIT) {
+                this.advancePC(2);
+                this.opFlags &= ~PDP11.OPFLAG.WAIT;
+            }
+            this.trap(vector, 0, PDP11.REASON.INTERRUPT);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * checkTraps()
+     *
+     * NOTE: The following code processes these "deferred" traps in priority order.  Unfortunately, that
+     * order seems to have changed since the 11/20.  For reference, here's the priority list for the 11/20:
+     *
+     *      1. Bus Errors
+     *      2. Instruction Traps
+     *      3. Trace Trap
+     *      4. Stack Overflow Trap
+     *      5. Power Failure Trap
+     *
+     * and for the 11/70:
+     *
+     *      1. HALT (Instruction, Switch, or Command)
+     *      2. MMU Faults
+     *      3. Parity Errors
+     *      4. Bus Errors (including stack overflow traps?)
+     *      5. Floating Point Traps
+     *      6. TRAP Instruction
+     *      7. TRACE Trap
+     *      8. OVFL Trap
+     *      9. Power Fail Trap
+     *     10. Console Bus Request (Front Panel Operation)
+     *     11. PIR 7, BR 7, PIR 6, BR 6, PIR 5, BR 5, PIR 4, BR 4, PIR 3, BR 3, PIR 2, PIR 1
+     *     12. WAIT Loop
+     *
+     * TODO: Determine 1) if the 11/20 Handbook was wrong, or 2) if the 11/70 really has different priorities.
+     *
+     * Also, as the PDP-11/20 Handbook (1971), p.100, notes:
+     *
+     *      If a bus error is caused by the trap process handling instruction traps, trace traps, stack overflow
+     *      traps, or a previous bus error, the processor is halted.
+     *
+     *      If a stack overflow is caused by the trap process in handling bus errors, instruction traps, or trace traps,
+     *      the process is completed and then the stack overflow trap is sprung.
+     *
+     * TODO: Based on the above notes, we should probably be halting the CPU when a bus error occurs during a trap.
+     *
+     * @this {CPUStatePDP11}
+     * @return {boolean} (true if dispatched, false if not)
+     */
+    checkTraps()
+    {
+        if (this.opFlags & PDP11.OPFLAG.TRAP_MMU) {
+            this.trap(PDP11.TRAP.MMU, PDP11.OPFLAG.TRAP_MMU, PDP11.REASON.FAULT);
+            return true;
+        }
+        if (this.opFlags & PDP11.OPFLAG.TRAP_SP) {
+            this.trap(PDP11.TRAP.BUS, PDP11.OPFLAG.TRAP_SP, PDP11.REASON.YELLOW);
+            return true;
+        }
+        if (this.opFlags & PDP11.OPFLAG.TRAP_TF) {
+            this.trap(PDP11.TRAP.BPT, PDP11.OPFLAG.TRAP_TF, PDP11.REASON.TRACE);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * isWaiting()
+     *
+     * @this {CPUStatePDP11}
+     * @return {boolean} (true if OPFLAG.WAIT is set, false otherwise)
+     */
+    isWaiting()
+    {
+        return !!(this.opFlags & PDP11.OPFLAG.WAIT);
+    }
+
+    /**
+     * getPSW()
+     *
+     * @this {CPUStatePDP11}
+     * @return {number}
+     */
+    getPSW()
+    {
+        var mask = PDP11.PSW.CMODE | PDP11.PSW.PMODE | PDP11.PSW.REGSET | PDP11.PSW.PRI | PDP11.PSW.TF;
+        return this.regPSW = (this.regPSW & mask) | this.getNF() | this.getZF() | this.getVF() | this.getCF();
+    }
+
+    /**
+     * setPSW(newPSW)
+     *
+     * This updates the CPU Processor Status Word.  The PSW should generally be written through
+     * this routine so that changes can be tracked properly, for example the correct register set,
+     * the current memory management mode, etc.  An exception is SPL which writes the priority directly.
+     * Note that that N, Z, V, and C flags are actually stored separately for performance reasons.
+     *
+     * PSW    15 14 13 12 11 10  9  8  7  6  5  4  3  2  1  0
+     *        CMODE PMODE RS -------- PRIORITY  T  N  Z  V  C
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} newPSW
+     */
+    setPSW(newPSW)
+    {
+        newPSW &= this.pswUsed;
+        this.flagN = newPSW << 12;
+        this.flagZ = (~newPSW) & 4;
+        this.flagV = newPSW << 14;
+        this.flagC = newPSW << 16;
+        if ((newPSW ^ this.regPSW) & this.pswRegSet) {
+            /*
+             * Swap register sets
+             */
+            for (var i = this.regsAlt.length; --i >= 0;) {
+                var tmp = this.regsGen[i];
+                this.regsGen[i] = this.regsAlt[i];
+                this.regsAlt[i] = tmp;
+            }
+        }
+        this.pswMode = (newPSW >> PDP11.PSW.SHIFT.CMODE) & PDP11.MODE.MASK;
+        var oldMode = (this.regPSW >> PDP11.PSW.SHIFT.CMODE) & PDP11.MODE.MASK;
+        if (this.pswMode != oldMode) {
+            /*
+             * Swap stack pointers
+             */
+            this.regsAltStack[oldMode] = this.regsGen[6];
+            this.regsGen[6] = this.regsAltStack[this.pswMode];
+        }
+        this.regPSW = newPSW;
+
+        /*
+         * Trigger a call to checkInterrupts(), just in case.  If there's an active IRQ, then setting
+         * OPFLAG.IRQ is a no-brainer, but even if not, we set IRQ_DELAY in case the priority was lowered
+         * enough to permit a programmed interrupt (via regPIR).
+         */
+        this.opFlags &= ~PDP11.OPFLAG.IRQ;
+        this.opFlags |= (this.irqNext? PDP11.OPFLAG.IRQ : PDP11.OPFLAG.IRQ_DELAY);
+    }
+
+    /**
+     * getSLR()
+     *
+     * @this {CPUStatePDP11}
+     * @return {number}
+     */
+    getSLR()
+    {
+        return this.regSLR & 0xff00;
+    }
+
+    /**
+     * setSLR(newSL)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} newSLR
+     */
+    setSLR(newSLR)
+    {
+        this.regSLR = newSLR | 0xff;
+    }
+
+    /**
+     * getPIR()
+     *
+     * @this {CPUStatePDP11}
+     * @return {number}
+     */
+    getPIR()
+    {
+        return this.regPIR;
+    }
+
+    /**
+     * setPIR(newPIR)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} newPIR
+     */
+    setPIR(newPIR)
+    {
+        newPIR &= PDP11.PIR.BITS;
+        if (newPIR) {
+            var bits = newPIR >> PDP11.PIR.SHIFT.BITS;
+            do {
+                newPIR += PDP11.PIR.PIA_INC;
+            } while (bits >>= 1);
+            this.opFlags |= PDP11.OPFLAG.IRQ_DELAY;
+        }
+        this.regPIR = newPIR;
+    }
+
+    /**
+     * updateNZVFlags(result)
+     *
+     * NOTE: Only N and Z are updated based on the result; V is zeroed, C is unchanged.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} result
+     */
+    updateNZVFlags(result)
+    {
+        this.flagN = this.flagZ = result;
+        this.flagV = 0;
+    }
+
+    /**
+     * updateNZVCFlags(result)
+     *
+     * NOTE: Only N and Z are updated based on the result; both V and C are simply zeroed.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} result
+     */
+    updateNZVCFlags(result)
+    {
+        this.flagN = this.flagZ = result;
+        this.flagV = this.flagC = 0;
+    }
+
+    /**
+     * updateAllFlags(result, overflow)
+     *
+     * NOTE: The V flag is simply zeroed, unless a specific value is provided (eg, by NEG).
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} result
+     * @param {number} [overflow]
+     */
+    updateAllFlags(result, overflow)
+    {
+        this.flagN = this.flagZ = this.flagC = result;
+        this.flagV = overflow || 0;
+    }
+
+    /**
+     * updateAddFlags(result, src, dst)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} result (dst + src)
+     * @param {number} src
+     * @param {number} dst
+     */
+    updateAddFlags(result, src, dst)
+    {
+        this.flagN = this.flagZ = this.flagC = result;
+        this.flagV = (src ^ result) & (dst ^ result);
+    }
+
+    /**
+     * updateDecFlags(result, dst)
+     *
+     * NOTE: We could have used updateSubFlags() if not for the fact that the C flag must be preserved.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} result (dst - src, where src is an implied 1)
+     * @param {number} dst
+     */
+    updateDecFlags(result, dst)
+    {
+        this.flagN = this.flagZ = result;
+        /*
+         * Because src is always 1 (with a zero sign bit), it can be optimized out of this calculation.
+         */
+        this.flagV = (/* src ^ */ dst) & (dst ^ result);
+    }
+
+    /**
+     * updateIncFlags(result, dst)
+     *
+     * NOTE: We could have used updateAddFlags() if not for the fact that the C flag must be preserved.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} result (dst + src, where src is an implied 1)
+     * @param {number} dst
+     */
+    updateIncFlags(result, dst)
+    {
+        this.flagN = this.flagZ = result;
+        /*
+         * Because src is always 1 (with a zero sign bit), it can be optimized out of this calculation.
+         */
+        this.flagV = (/* src ^ */ result) & (dst ^ result);
+    }
+
+    /**
+     * updateMulFlags(result)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} result
+     */
+    updateMulFlags(result)
+    {
+        this.flagN = result >> 16;
+        this.flagZ = this.flagN | result;
+        this.flagV = 0;
+        this.flagC = (result < -32768 || result > 32767)? 0x10000 : 0;
+    }
+
+    /**
+     * updateShiftFlags(result)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} result
+     */
+    updateShiftFlags(result)
+    {
+        this.flagN = this.flagZ = this.flagC = result;
+        this.flagV = this.flagN ^ (this.flagC >> 1);
+    }
+
+    /**
+     * updateSubFlags(result, src, dst)
+     *
+     * NOTE: CMP operations calculate (src - dst) rather than (dst - src), so when they call updateSubFlags(),
+     * they must reverse the order of the src and dst parameters.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} result (dst - src)
+     * @param {number} src
+     * @param {number} dst
+     */
+    updateSubFlags(result, src, dst)
+    {
+        this.flagN = this.flagZ = this.flagC = result;
+        this.flagV = (src ^ dst) & (dst ^ result);
+    }
+
+    /**
+     * trap(vector, flag, reason)
+     *
+     * trap() handles all the trap/abort functions.  It reads the trap vector from kernel
+     * D space, changes mode to reflect the new PSW and PC, and then pushes the old PSW and
+     * PC onto the new mode stack.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} vector
+     * @param {number} flag
+     * @param {number} [reason] (for diagnostic purposes only)
+     */
+    trap(vector, flag, reason)
+    {
+        if (DEBUG && this.dbg) {
+            if (this.messageEnabled(MessagesPDP11.TRAP)) {
+                var sReason = reason < 0? PDP11.REASONS[-reason] : this.dbg.toStrBase(reason);
+                this.printMessage("trap to vector " + this.dbg.toStrBase(vector, 8) + " (" + sReason + ")", MessagesPDP11.TRAP, true);
+            }
+        }
+
+        if (this.nDisableTraps) return;
+
+        if (this.pswTrap < 0) {
+            this.pswTrap = this.getPSW();
+        } else if (!this.pswMode) {
+            reason = PDP11.REASON.RED;      // double-fault (nested trap) forces a RED condition
+        }
+
+        if (reason == PDP11.REASON.RED) {
+            if (this.opFlags & PDP11.OPFLAG.TRAP_RED) {
+                reason = PDP11.REASON.PANIC;
+            }
+            this.opFlags |= PDP11.OPFLAG.TRAP_RED;
+            /*
+             * The next two lines used to be deferred until after the setPSW() below, but
+             * I'm not seeing any dependencies on these registers, so I'm consolidating the code.
+             */
+            this.regErr |= PDP11.CPUERR.RED;
+            this.regsGen[6] = vector = 4;
+        }
+
+        if (reason != PDP11.REASON.PANIC) {
+            /*
+             * NOTE: Pre-setting the auto-dec values for MMR1 to 0xF6F6 is a work-around for an "EKBEE1"
+             * diagnostic (PC 056710), which tests what happens when a misaligned read triggers a BUS trap,
+             * and that trap then triggers an MMU trap during the first pushWord() below.
+             *
+             * One would think it would be fine to zero those bits by setting opLast to vector alone,
+             * and then letting each of the pushWord() calls below shift their own 0xF6 auto-dec value into
+             * opLast.  When the first pushWord() triggers an MMU trap, we obviously won't get to the second
+             * pushWord(), yet the diagnostic expects TWO auto-decs to be recorded.  I'm puzzled why the
+             * hardware apparently indicates TWO auto-decs, if SP wasn't actually decremented twice, but who
+             * am I to judge.
+             */
+            this.opLast = vector | 0xf6f60000;
+
+            /*
+             * Read from kernel D space
+             */
+            this.pswMode = 0;
+            var newPC = this.readWord(vector | this.addrDSpace);
+            var newPSW = this.readWord(((vector + 2) & 0xffff) | this.addrDSpace);
+
+            /*
+             * Set new PSW with previous mode
+             */
+            this.setPSW((newPSW & ~PDP11.PSW.PMODE) | ((this.pswTrap >> 2) & PDP11.PSW.PMODE));
+
+            this.pushWord(this.pswTrap);
+            this.pushWord(this.regsGen[7]);
+            this.setPC(newPC);
+        }
+
+        /*
+         * TODO: Determine the appropriate number of cycles for traps; all I've done for now is move the
+         * cycle charge from opTrap() to here, and reduced the amount the other opcode handlers that call
+         * trap() charge by a corresponding amount (5).
+         */
+        this.nStepCycles -= (4 + 1);
+
+        /*
+         * DEC's "TRAP TEST" (MAINDEC-11-D0NA-PB) triggers a RESERVED trap with an invalid opcode and the
+         * stack deliberately set too low, and expects the stack overflow trap to be "sprung" immediately
+         * afterward, so we only want to "lose interest" in the TRAP flag(s) that were set on entry, not ALL
+         * of them.
+         *
+         *      this.opFlags &= ~PDP11.OPFLAG.TRAP_MASK;    // lose interest in traps after an abort
+         *
+         * Well, OK, we're also supposed to "lose interest" in the TF flag, too; otherwise, DEC tests fail.
+         *
+         * Finally, setPSW() likes to always set IRQ, to force a check of hardware interrupts prior to
+         * the next instruction, just in case the PSW priority was lowered.  However, there are "TRAP TEST"
+         * tests like this one:
+         *
+         *      005640: 012706 007700          MOV   #7700,SP
+         *      005644: 012767 000340 172124   MOV   #340,177776
+         *      005652: 012767 000100 171704   MOV   #100,177564
+         *      005660: 012767 005712 172146   MOV   #5712,000034   ; set TRAP vector (its PSW is already zero)
+         *      005666: 012767 005714 172170   MOV   #5714,000064   ; set hardware interrupt vector (its PSW is already zero)
+         *      005674: 012767 005716 172116   MOV   #5716,000020   ; set IOT vector
+         *      005702: 012767 000340 172112   MOV   #340,000022    ; set IOT PSW
+         *      005710: 104400                 TRAP  000
+         *      005712: 000004                 IOT
+         *      005714: 000000                 HALT
+         *
+         * where, after "TRAP 000" has executed, a hardware interrupt will be acknowledged, and instead of
+         * executing the IOT, we'll execute the HALT and fail the test.  We avoid that by relying on the same
+         * trick that the SPL instruction uses: setting IRQ_DELAY instead of IRQ, which effectively delays
+         * IRQ detection for one instruction, which is just long enough to allow the diagnostic to pass.
+         */
+        this.opFlags &= ~(flag | PDP11.OPFLAG.TRAP_TF | PDP11.OPFLAG.IRQ_MASK);
+        this.opFlags |= PDP11.OPFLAG.IRQ_DELAY | PDP11.OPFLAG.TRAP_LAST;
+
+        this.pswTrap = -1;                                  // reset flag that we have a trap within a trap
+
+        /*
+         * These next properties (in conjunction with setting PDP11.OPFLAG.TRAP_LAST) are purely an aid for the Debugger;
+         * see getTrapStatus().
+         */
+        this.trapReason = reason;
+        this.trapVector = vector;
+
+        if (reason == PDP11.REASON.PANIC) {
+            this.stopCPU();
+        }
+        if (reason >= PDP11.REASON.RED) throw vector;
+    }
+
+    /**
+     * trapReturn()
+     *
+     * @this {CPUStatePDP11}
+     */
+    trapReturn()
+    {
+        /*
+         * This code used to defer updating regsGen[6] (SP) until after BOTH words had been popped, which seems
+         * safer, but if we're going to do pushes in trap(), then I see no reason to avoid doing pops in trapReturn().
+         */
+        var addr = this.popWord();
+        var newPSW = this.popWord();
+        if (this.regPSW & PDP11.PSW.CMODE) {
+            /*
+             * Keep SPL and allow lower only for modes and register set.
+             *
+             * TODO: Review, because it seems a bit odd to only CLEAR the PRI bits in the new PSW, and then to OR in
+             * CMODE, PMODE, and REGSET bits from the current PSW.
+             */
+            newPSW = (newPSW & ~PDP11.PSW.PRI) | (this.regPSW & (PDP11.PSW.PRI | PDP11.PSW.REGSET | PDP11.PSW.PMODE | PDP11.PSW.CMODE));
+        }
+        this.setPC(addr);
+        this.setPSW(newPSW);
+        this.opFlags &= ~PDP11.OPFLAG.TRAP_TF;
+    }
+
+    /**
+     * getTrapStatus()
+     *
+     * @this {CPUStatePDP11}
+     * @return {number}
+     */
+    getTrapStatus()
+    {
+        return (this.opFlags & PDP11.OPFLAG.TRAP_LAST)? (this.trapVector | this.trapReason << 8) : 0;
+    }
+
+    /**
+     * mapUnibus(addr)
+     *
+     * Used to convert 18-bit addresses to 22-bit addresses.  Since mapUnibus() only looks at the low 18 bits of addr,
+     * there's no need to mask addr first.  Note that if bits 13-17 are all set, then the 18-bit address points to the
+     * top 8Kb of its 256Kb range, and mapUnibus() will return addr unchanged, since it should already be pointing to
+     * the top 8Kb of the 4Mb 22-bit range.
+     *
+     * Also, when bits 18-21 of addr are ALL set (which callers check using addr >= BusPDP11.UNIBUS_22BIT aka 0x3C0000),
+     * then we have a 22-bit address pointing to the top 256Kb range, so if the UNIBUS relocation map is enabled, we again
+     * pass the lower 18 bits of that address through the map.
+     *
+     * From the PDP-11/70 Handbook:
+     *
+     *      On the 11/44 and 11/70, there are a total of 31 mapping registers for address relocation.  Each register is
+     *      composed of a double 16-bit PDP-11 word (in consecutive locations) that holds the 22-bit base address.  These
+     *      registers have UNIBUS addresses in the range 770200 to 770372.
+     *
+     *      If the UNIBUS map relocation is not enabled, an incoming 18-bit UNIBUS address has 4 leading zeroes added for
+     *      referencing a 22-bit physical address. The lower 18 bits are the same. No relocation is performed.
+     *
+     *      If UNIBUS map relocation is enabled, the five high order bits of the UNIBUS address are used to select one of the
+     *      31 mapping registers.  The low-order 13 bits of the incoming address are used as an offset from the base address
+     *      contained in the 22-bit mapping register.  To form the physical address, the 13 low-order bits of the UNIBUS
+     *      address are added to 22 bits of the selected mapping register to produce the 22-bit physical address.  The lowest
+     *      order bit of all mapping registers is always a zero, since relocation is always on word boundaries.
+     *
+     * Sadly, because these mappings occur at a word-granular level, we can't implement the mappings by simply shuffling
+     * the underlying block around in the Bus component; it would be much more efficient if we could.  That's how we move
+     * the IOPAGE in response to addressing changes.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addr
+     * @return {number}
+     */
+    mapUnibus(addr)
+    {
+        var idx = (addr >> 13) & 0x1F;
+        if (idx < 31) {
+            if (this.regMMR3 & PDP11.MMR3.UNIBUS_MAP) {
+                /*
+                 * The UNIBUS map relocation is enabled
+                 */
+                addr = (this.regsUniMap[idx] + (addr & 0x1FFF)) & BusPDP11.MASK_22BIT;
+                /*
+                 * TODO: Review this assertion.
+                 *
+                 *
+                 */
+            } else {
+                /*
+                 * Since UNIBUS map relocation is NOT enabled, then as explained above:
+                 *
+                 *      If the UNIBUS map relocation is not enabled, an incoming 18-bit UNIBUS address has 4 leading zeroes added for
+                 *      referencing a 22-bit physical address. The lower 18 bits are the same. No relocation is performed.
+                 */
+                addr &= ~BusPDP11.UNIBUS_22BIT;
+            }
+        }
+        return addr;
+    }
+
+    /**
+     * getAddrInfo(addr, fPhysical)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addr
+     * @param {boolean} [fPhysical]
+     * @return {Array}
+     */
+    getAddrInfo(addr, fPhysical)
+    {
+        var a = [];
+        var addrPhysical;
+
+        if (fPhysical) {
+            addrPhysical = this.mapUnibus(addr);
+            var idx = (addr >> 13) & 0x1F;
+            a.push(addrPhysical);
+            a.push(idx);
+            if (this.regMMR3 & PDP11.MMR3.UNIBUS_MAP) {
+                a.push(this.regsUniMap[idx]);
+                a.push(addr & 0x1FFF);
+            }
+        }
+        else if (!this.mmuEnable) {
+            addrPhysical = addr & 0xffff;
+            if (addrPhysical >= BusPDP11.IOPAGE_16BIT) addrPhysical |= this.addrIOPage;
+            a.push(addrPhysical);
+        }
+        else {
+            var mode = this.pswMode << 1;
+            var page = addr >> 13;
+            if (page > 7) mode |= 1;
+            if (!(this.regMMR3 & this.mapMMR3[this.pswMode])) page &= 7;
+            var pdr = this.regsPDR[this.pswMode][page];
+            var off = addr & 0x1fff;
+            var paf = (this.regsPAR[this.pswMode][page] << 6);
+            addrPhysical = (paf + off) & this.mmuMask;
+            if (addrPhysical >= BusPDP11.UNIBUS_22BIT) addrPhysical = this.mapUnibus(addrPhysical);
+            a.push(addrPhysical);   // a[0]
+            a.push(off);            // a[1]
+            a.push(mode);           // a[2] (0=KI, 1=KD, 2=SI, 3=SD, 4=??, 5=??, 6=UI, 7=UD)
+            a.push(page & 7);       // a[3]
+            a.push(paf);            // a[4]
+            a.push(this.mmuMask);   // a[5]
+        }
+        return a;
+    }
+
+    /**
+     * mapVirtualToPhysical(addrVirtual, access)
+     *
+     * mapVirtualToPhysical() does memory management.  It converts a 17-bit I/D virtual address to a
+     * 22-bit physical address.  A real PDP 11/70 memory management unit can be enabled separately for
+     * read and write for diagnostic purposes.  This is handled here by having an enable mask (mmuEnable)
+     * which is tested against the operation access mask (access).  If there is no match, then the virtual
+     * address is simply mapped as a 16 bit physical address with the upper page going to the IO address
+     * space.  Significant access mask values used are PDP11.ACCESS.READ and PDP11.ACCESS.WRITE.
+     *
+     * When doing mapping, pswMode is used to decide what address space is to be used (0 = kernel,
+     * 1 = supervisor, 2 = illegal, 3 = user).  Normally, pswMode is set by the setPSW() function, but
+     * there are exceptions for instructions which move data between address spaces (MFPD, MFPI, MTPD,
+     * and MTPI) and trap().  These will modify pswMode outside of setPSW() and then restore it again if
+     * all worked.  If however something happens to cause a trap then no restore is done as setPSW()
+     * will have been invoked as part of the trap, which will resynchronize pswMode.
+     *
+     * A PDP-11/70 is different from other PDP-11s in that the highest 18 bit space (017000000 & above)
+     * maps directly to UNIBUS space - including low memory. This doesn't appear to be particularly useful
+     * as it restricts maximum system memory - although it does appear to allow software testing of the
+     * UNIBUS map.  This feature also appears to confuse some OSes which test consecutive memory locations
+     * to find maximum memory -- and on a full memory system find themselves accessing low memory again at
+     * high addresses.
+     *
+     * Construction of a Physical Address
+     * ----------------------------------
+     *
+     *      Virtual Addr (VA)                                  12 11 10  9  8  7  6  5  4  3  2  1  0
+     *    + Page Addr Field (PAF)   15 14 13 12 11 10  9  8  7  6  5  4  3  2  1  0
+     *                              -----------------------------------------------------------------
+     *    = Physical Addr (PA)      21 20 19 18 17 16 15 14 13 12 11 10  9  8  7  6  5  4  3  2  1  0
+     *
+     * The Page Address Field (PAF) comes from a Page Address Register (PAR) that is selected by Virtual
+     * Address (VA) bits 15-13.  You can see from the above alignments that the VA contributes to the low
+     * 13 bits, providing an 8Kb range.
+     *
+     * VA bits 0-5 pass directly through to the PA; those are also called the DIB (Displacement in Block) bits.
+     * VA bits 6-12 are added to the low 7 bits of the PAF and are also called the BN (Block Number) bits.
+     *
+     * You can also think of the entire PAF as a block number, where each block is 64 bytes.  This is consistent
+     * with the LSIZE register at 177760, which is supposed to contain the block number of the last 64-byte block
+     * of memory installed.
+     *
+     * Note that if a PAR is initialized to zero, successively adding 0200 (0x80) to the PAR will advance the
+     * base physical address to the next 8Kb page.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addrVirtual
+     * @param {number} access
+     * @return {number}
+     */
+    mapVirtualToPhysical(addrVirtual, access)
+    {
+        var page, pdr, addr;
+
+        /*
+         * This can happen when the MAINT bit of MMR0 is set but not the ENABLED bit.
+         */
+        if (!(access & this.mmuEnable)) {
+            addr = addrVirtual & 0xffff;
+            if (addr >= BusPDP11.IOPAGE_16BIT) addr |= this.addrIOPage;
+            return addr;
+        }
+
+        page = addrVirtual >> 13;
+        if (!(this.regMMR3 & this.mapMMR3[this.pswMode])) page &= 7;
+        pdr = this.regsPDR[this.pswMode][page];
+        addr = ((this.regsPAR[this.pswMode][page] << 6) + (addrVirtual & 0x1fff)) & this.mmuMask;
+
+        if (addr >= BusPDP11.UNIBUS_22BIT) addr = this.mapUnibus(addr);
+
+        if (this.nDisableTraps) return addr;
+
+        /*
+         * TEST #122 ("KT BEND") in the "EKBEE1" diagnostic (PC 076060) triggers a NOMEMORY error using
+         * this instruction:
+         *
+         *      076170: 005037 140100          CLR   @#140100
+         *
+         * It also triggers an ODDADDR error using this instruction:
+         *
+         *      076356: 005037 140001          CLR   @#140001
+         *
+         * @paulnank: So it turns out that the memory management unit that does odd address and non-existent
+         * memory trapping: who knew? :-)  I thought these would have been handled at access time.
+         *
+         * @jeffpar: We're assuming, at least, that the MMU does its "NEXM" (NOMEMORY) non-existent memory test
+         * very simplistically, by range-checking the address against something like the memory SIZE registers,
+         * because otherwise the MMU would have to wait for a bus time-out: something so prohibitively expensive
+         * that the MMU could not afford to do it.  I rely on addrInvalid, which is derived from the same Bus
+         * getMemoryLimit() service that the SIZE registers (177760--177762) use to derive their value.
+         */
+        if (addr >= this.addrInvalid && addr < this.addrIOPage) {
+            this.regErr |= PDP11.CPUERR.NOMEMORY;
+            this.trap(PDP11.TRAP.BUS, 0, addr);
+        }
+        else if ((addr & 0x1) && !(access & PDP11.ACCESS.BYTE)) {
+            this.regErr |= PDP11.CPUERR.ODDADDR;
+            this.trap(PDP11.TRAP.BUS, 0, addr);
+        }
+
+        var newMMR0 = 0;
+        switch (pdr & PDP11.PDR.ACF.MASK) {
+
+        case PDP11.PDR.ACF.RO1:     // 0x1: read-only, abort on write attempt, memory management trap on read (11/70 only)
+            newMMR0 = PDP11.MMR0.TRAP_MMU;
+            /* falls through */
+
+        case PDP11.PDR.ACF.RO:      // 0x2: read-only, abort on write attempt
+            pdr |= PDP11.PDR.ACCESSED;
+            if (access & PDP11.ACCESS.WRITE) {
+                newMMR0 = PDP11.MMR0.ABORT_RO;
+            }
+            break;
+
+        case PDP11.PDR.ACF.RW1:     // 0x4: read/write, memory management trap upon completion of a read or write
+            newMMR0 = PDP11.MMR0.TRAP_MMU;
+            /* falls through */
+
+        case PDP11.PDR.ACF.RW2:     // 0x5: read/write, memory management trap upon completion of a write (11/70 only)
+            if (access & PDP11.ACCESS.WRITE) {
+                newMMR0 = PDP11.MMR0.TRAP_MMU;
+            }
+            /* falls through */
+
+        case PDP11.PDR.ACF.RW:      // 0x6: read/write, no system trap/abort action
+            pdr |= ((access & PDP11.ACCESS.WRITE) ? (PDP11.PDR.ACCESSED | PDP11.PDR.MODIFIED) : PDP11.PDR.ACCESSED);
+            break;
+
+        default:                    // 0x0 (non-resident, abort all accesses) or 0x3 or 0x7 (unused, abort all accesses)
+            newMMR0 = PDP11.MMR0.ABORT_NR;
+            break;
+        }
+
+        if ((pdr & (PDP11.PDR.PLF | PDP11.PDR.ED)) != PDP11.PDR.PLF) {      // skip checking most common case (hopefully)
+            /*
+             * The Page Descriptor Register (PDR) Page Length Field (PLF) is a 7-bit block number, where a block
+             * is 64 bytes.  Since the bit 0 of the block number is located at bit 8 of the PDR, we shift the PDR
+             * right 2 bits and then clear the bottom 6 bits by masking it with 0x1FC0.
+             */
+            if (pdr & PDP11.PDR.ED) {
+                if (pdr & PDP11.PDR.PLF) {
+                    if ((addrVirtual & 0x1FC0) < ((pdr >> 2) & 0x1FC0)) {
+                        newMMR0 |= PDP11.MMR0.ABORT_PL;
+                    }
+                }
+            } else {
+                if ((addrVirtual & 0x1FC0) > ((pdr >> 2) & 0x1FC0)) {
+                    newMMR0 |= PDP11.MMR0.ABORT_PL;
+                }
+            }
+        }
+
+        /*
+         * Aborts and traps: log FIRST trap and MOST RECENT abort
+         */
+        this.regsPDR[this.pswMode][page] = pdr;
+        if (addr != ((BusPDP11.IOPAGE_22BIT | PDP11.UNIBUS.MMR0) & this.mmuMask) || this.pswMode) {
+            this.mmuLastMode = this.pswMode;
+            this.mmuLastPage = page;
+        }
+
+        if (newMMR0) {
+            if (newMMR0 & PDP11.MMR0.ABORT) {
+                if (this.pswTrap >= 0) {
+                    newMMR0 |= PDP11.MMR0.COMPLETED;
+                }
+                if (!(this.regMMR0 & PDP11.MMR0.ABORT)) {
+                    newMMR0 |= (this.regMMR0 & PDP11.MMR0.TRAP_MMU) | (this.mmuLastMode << 5) | (this.mmuLastPage << 1);
+
+                    this.setMMR0((this.regMMR0 & ~PDP11.MMR0.UPDATE) | (newMMR0 & PDP11.MMR0.UPDATE));
+                }
+                /*
+                 * NOTE: In unusual circumstances, if regMMR0 already indicated an ABORT condition above,
+                 * we run the risk of infinitely looping; eg, we call trap(), which calls mapVirtualToPhysical()
+                 * on the trap vector, which faults again, etc.
+                 *
+                 * TODO: Determine what a real PDP-11 does in that situation; in our case, trap() deals with it
+                 * by checking an internal OPFLAG (TRAP_RED) and turning the next trap into a PANIC, triggering an
+                 * immediate HALT.
+                 */
+                this.trap(PDP11.TRAP.MMU, PDP11.OPFLAG.TRAP_MMU, PDP11.REASON.ABORT);
+            }
+            if (!(this.regMMR0 & (PDP11.MMR0.ABORT | PDP11.MMR0.TRAP_MMU))) {
+                /*
+                 * TODO: Review the code below, because the address range seems over-inclusive.
+                 */
+                if (addr < ((BusPDP11.IOPAGE_22BIT | PDP11.UNIBUS.SIPDR0) & this.mmuMask) ||
+                    addr > ((BusPDP11.IOPAGE_22BIT | PDP11.UNIBUS.UDPAR7 | 0x1) & this.mmuMask)) {
+                    this.regMMR0 |= PDP11.MMR0.TRAP_MMU;
+                    if (this.regMMR0 & PDP11.MMR0.MMU_TRAPS) this.opFlags |= PDP11.OPFLAG.TRAP_MMU;
+                }
+            }
+        }
+        return addr;
+    }
+
+    /**
+     * popWord()
+     *
+     * @this {CPUStatePDP11}
+     * @return {number}
+     */
+    popWord()
+    {
+        var result = this.readWord(this.regsGen[6] | this.addrDSpace);
+        this.regsGen[6] = (this.regsGen[6] + 2) & 0xffff;
+        return result;
+    }
+
+    /**
+     * pushWord(data)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} data
+     */
+    pushWord(data)
+    {
+        var addrVirtual = (this.regsGen[6] - 2) & 0xffff;
+        this.regsGen[6] = addrVirtual;              // BSD needs SP updated before any fault :-(
+        this.opLast = (this.opLast & 0xffff) | ((this.opLast & ~0xffff) << 8) | (0x00f6 << 16);
+        if (!(this.opFlags & PDP11.OPFLAG.TRAP_RED)) this.checkStackLimit(PDP11.ACCESS.WRITE_WORD, -2, addrVirtual);
+        this.writeWord(addrVirtual, data);
+    }
+
+    /**
+     * getAddrByMode(mode, reg, access)
+     *
+     * getAddrByMode() maps a six bit operand to a 17 bit I/D virtual address space.
+     *
+     * Instruction operands are six bits in length - three bits for the mode and three
+     * for the register. The 17th I/D bit in the resulting virtual address represents
+     * whether the reference is to Instruction space or Data space - which depends on
+     * combination of the mode and whether the register is the Program Counter (R7).
+     *
+     * The eight modes are:-
+     * 	    0   R           no valid virtual address
+     * 	    1   (R)         operand from I/D depending if R = 7
+     * 	    2   (R)+        operand from I/D depending if R = 7
+     * 	    3   @(R)+       address from I/D depending if R = 7 and operand from D space
+     * 	    4   -(R)        operand from I/D depending if R = 7
+     * 	    5   @-(R)       address from I/D depending if R = 7 and operand from D space
+     * 	    6   x(R)        x from I space but operand from D space
+     * 	    7   @x(R)       x from I space but address and operand from D space
+     *
+     * Also need to keep MMR1 updated as this stores which registers have been
+     * incremented and decremented so that the OS can reset and restart an instruction
+     * if a page fault occurs.
+     *
+     * Stack Overflow Traps
+     * --------------------
+     * On the PDP-11/20, stack overflow traps occur when an address below 400 is referenced
+     * by SP in either mode 4 (auto-decrement) or 5 (auto-decrement deferred).  The instruction
+     * is allowed to complete before the trap is issued.  NOTE: This information comes
+     * directly from the PDP-11/20 Handbook (1971), but the 11/20 diagnostics apparently only
+     * test mode 4, not mode 5, because when I later removed stack limit checks for mode 5 on
+     * the 11/70, none of the 11/20 tests complained.
+     *
+     * TODO: Find some independent confirmation as to whether ANY PDP-11 models check for
+     * stack overflow on mode 5 (auto-decrement deferred); if they do, then further tweaks to
+     * checkStackLimit functions may be required.
+     *
+     * On the PDP-11/70, the stack limit register (177774) allows a variable boundary for the
+     * kernel stack.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} mode
+     * @param {number} reg
+     * @param {number} access
+     * @return {number}
+     */
+    getAddrByMode(mode, reg, access)
+    {
+        var addrVirtual, step;
+        var addrDSpace = (access & PDP11.ACCESS.VIRT)? 0 : this.addrDSpace;
+
+        /*
+         * Modes that need to auto-increment or auto-decrement will break, in order to perform
+         * the update; others will return an address immediately.
+         */
+        switch (mode) {
+        /*
+         * Mode 0: Registers don't have a virtual address, so trap.
+         *
+         * NOTE: Most instruction code paths never call getAddrByMode() when the mode is zero;
+         * JMP and JSR instructions are exceptions, but that's OK, because those are documented as
+         * ILLEGAL instructions which produce a BUS trap (as opposed to UNDEFINED instructions
+         * that cause a RESERVED trap).
+         */
+        case 0:
+            this.trap(PDP11.TRAP.BUS, 0, PDP11.REASON.ILLEGAL);
+            return 0;
+
+        /*
+         * Mode 1: (R)
+         */
+        case 1:
+            if (reg == 6) this.checkStackLimit(access, 0, this.regsGen[6]);
+            this.nStepCycles -= (2 + 1);
+            return (reg == 7? this.regsGen[reg] : (this.regsGen[reg] | addrDSpace));
+
+        /*
+         * Mode 2: (R)+
+         */
+        case 2:
+            step = 2;
+            addrVirtual = this.regsGen[reg];
+            if (reg == 6) this.checkStackLimit(access, step, addrVirtual);
+            if (reg != 7) {
+                addrVirtual |= addrDSpace;
+                if (reg < 6 && (access & PDP11.ACCESS.BYTE)) step = 1;
+            }
+            this.nStepCycles -= (2 + 1);
+            break;
+
+        /*
+         * Mode 3: @(R)+
+         */
+        case 3:
+            step = 2;
+            addrVirtual = this.regsGen[reg];
+            if (reg != 7) addrVirtual |= addrDSpace;
+            addrVirtual = this.readWord(addrVirtual);
+            addrVirtual |= addrDSpace;
+            this.nStepCycles -= (5 + 2);
+            break;
+
+        /*
+         * Mode 4: -(R)
+         */
+        case 4:
+            step = -2;
+            if (reg < 6 && (access & PDP11.ACCESS.BYTE)) step = -1;
+            addrVirtual = (this.regsGen[reg] + step) & 0xffff;
+            if (reg == 6) this.checkStackLimit(access, step, addrVirtual);
+            if (reg != 7) addrVirtual |= addrDSpace;
+            this.nStepCycles -= (3 + 1);
+            break;
+
+        /*
+         * Mode 5: @-(R)
+         */
+        case 5:
+            step = -2;
+            addrVirtual = (this.regsGen[reg] - 2) & 0xffff;
+            if (reg != 7) addrVirtual |= addrDSpace;
+            addrVirtual = this.readWord(addrVirtual) | addrDSpace;
+            this.nStepCycles -= (6 + 2);
+            break;
+
+        /*
+         * Mode 6: d(R)
+         */
+        case 6:
+            addrVirtual = this.readWord(this.advancePC(2));
+            addrVirtual = (addrVirtual + this.regsGen[reg]) & 0xffff;
+            if (reg == 6) this.checkStackLimit(access, 0, addrVirtual);
+            this.nStepCycles -= (4 + 2);
+            return addrVirtual | addrDSpace;
+
+        /*
+         * Mode 7: @d(R)
+         */
+        case 7:
+            addrVirtual = this.readWord(this.advancePC(2));
+            addrVirtual = (addrVirtual + this.regsGen[reg]) & 0xffff;
+            addrVirtual = this.readWord(addrVirtual | this.addrDSpace);
+            this.nStepCycles -= (7 + 3);
+            return addrVirtual | addrDSpace;
+        }
+
+        this.regsGen[reg] = (this.regsGen[reg] + step) & 0xffff;
+        this.opLast = (this.opLast & 0xffff) | ((this.opLast & ~0xffff) << 8) | ((((step << 3) & 0xf8) | reg) << 16);
+
+        return addrVirtual;
+    }
+
+    /**
+     * checkStackLimit1120(access, step, addr)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} access
+     * @param {number} step
+     * @param {number} addr
+     */
+    checkStackLimit1120(access, step, addr)
+    {
+        /*
+         * NOTE: DEC's "TRAP TEST" (MAINDEC-11-D0NA-PB) expects "TST -(SP)" to trap when SP is 150,
+         * so we ignore the access parameter.  Also, strangely, it does NOT expect this instruction
+         * to trap:
+         *
+         *      R0=006302 R1=000000 R2=000000 R3=000000 R4=000000 R5=000776
+         *      SP=000000 PC=006346 PS=000344 IR=000000 SL=000377 T0 N0 Z1 V0 C0
+         *      006346: 112667 171426          MOVB  (SP)+,000000
+         *
+         * so if the step parameter is positive, we let it go.
+         */
+        if (!this.pswMode && step <= 0 && addr <= this.regSLR) {
+            /*
+             * On older machines (eg, the PDP-11/20), there is no "YELLOW" and "RED" distinction, and the
+             * instruction is always allowed to complete, so the trap must always be issued in this fashion.
+             */
+            this.opFlags |= PDP11.OPFLAG.TRAP_SP;
+        }
+    }
+
+    /**
+     * checkStackLimit1140(access, step, addr)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} access
+     * @param {number} step
+     * @param {number} addr
+     */
+    checkStackLimit1140(access, step, addr)
+    {
+        if (!this.pswMode) {
+            /*
+             * NOTE: The 11/70 CPU Instruction Exerciser does NOT expect reads to trigger a stack overflow,
+             * so we check the access parameter.
+             *
+             * Moreover, TEST 40 of diagnostic EKBBF0 executes this instruction:
+             *
+             *      R0=177777 R1=032435 R2=152110 R3=000024 R4=153352 R5=001164
+             *      SP=177776 PC=020632 PS=000350 IR=000000 SL=000377 T0 N1 Z0 V0 C0
+             *      020632: 005016                 CLR   @SP                    ;cycles=7
+             *
+             * expecting a RED stack overflow trap.  Yes, using *any* addresses in the IOPAGE for the stack isn't
+             * a good idea, but who said it was illegal?  For now, we're going to restrict overflows to the highest
+             * address tested by the diagnostic (0xFFFE, aka the PSW), by making that address negative.
+             */
+            if (addr >= 0xFFFE) addr |= ~0xFFFF;
+            if ((access & PDP11.ACCESS.WRITE) && addr <= this.regSLR) {
+                /*
+                 * regSLR can never fall below 0xFF, so this subtraction can never go negative, so this comparison
+                 * is always safe.
+                 */
+                if (addr <= this.regSLR - 32) {
+                    this.trap(PDP11.TRAP.BUS, 0, PDP11.REASON.RED);
+                } else {
+                    this.regErr |= PDP11.CPUERR.YELLOW;
+                    this.opFlags |= PDP11.OPFLAG.TRAP_SP;
+                }
+            }
+        }
+    }
+
+    /**
+     * getByteChecked(addr)
+     *
+     * This is the getByte() handler whenever the Debugger has one or more virtual memory READ breakpoints set;
+     * otherwise, getByte() is bound to Bus.getByte().
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addr
+     * @return {number}
+     */
+    getByteChecked(addr)
+    {
+        if (DEBUGGER && this.dbg) {
+            this.dbg.checkMemoryRead(addr, 1);
+        }
+        return this.getByteDirect(addr);
+    }
+
+    /**
+     * getWordChecked(addr)
+     *
+     * This is the getWord() handler whenever the Debugger has one or more virtual memory READ breakpoints set;
+     * otherwise, getWord() is bound to Bus.getWord().
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addr
+     * @return {number}
+     */
+    getWordChecked(addr)
+    {
+        if (DEBUGGER && this.dbg) {
+            this.dbg.checkMemoryRead(addr, 2);
+        }
+        return this.getWordDirect(addr);
+    }
+
+    /**
+     * setByteChecked(addr, data)
+     *
+     * This is the setByte() handler whenever the Debugger has one or more virtual memory WRITE breakpoints set;
+     * otherwise, setByte() is bound to Bus.setByte().
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addr
+     * @param {number} data
+     */
+    setByteChecked(addr, data)
+    {
+        if (DEBUGGER && this.dbg) {
+            this.dbg.checkMemoryWrite(addr, 1);
+        }
+        this.setByteDirect(addr, data);
+    }
+
+    /**
+     * setWordChecked(addr, data)
+     *
+     * This is the setWord() handler whenever the Debugger has one or more virtual memory WRITE breakpoints set;
+     * otherwise, setWord() is bound to Bus.setWord().
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addr
+     * @param {number} data
+     */
+    setWordChecked(addr, data)
+    {
+        if (DEBUGGER && this.dbg) {
+            this.dbg.checkMemoryWrite(addr, 2);
+        }
+        this.setWordDirect(addr, data);
+    }
+
+    /**
+     * getByteSafe(addr)
+     *
+     * This interface is expressly for the Debugger, to access virtual memory without faulting.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addr
+     * @return {number}
+     */
+    getByteSafe(addr)
+    {
+        this.nDisableTraps++;
+        var b = this.bus.getByte(this.mapVirtualToPhysical(addr, PDP11.ACCESS.READ_BYTE));
+        this.nDisableTraps--;
+        return b;
+    }
+
+    /**
+     * getWordSafe(addr)
+     *
+     * This interface is expressly for the Debugger, to access virtual memory without faulting.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addr
+     * @return {number}
+     */
+    getWordSafe(addr)
+    {
+        this.nDisableTraps++;
+        var w = this.bus.getWord(this.mapVirtualToPhysical(addr, PDP11.ACCESS.READ_WORD));
+        this.nDisableTraps--;
+        return w;
+    }
+
+    /**
+     * setByteSafe(addr, data)
+     *
+     * This interface is expressly for the Debugger, to access virtual memory without faulting.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addr
+     * @param {number} data
+     */
+    setByteSafe(addr, data)
+    {
+        this.nDisableTraps++;
+        this.bus.setByte(this.mapVirtualToPhysical(addr, PDP11.ACCESS.WRITE_BYTE), data);
+        this.nDisableTraps--;
+    }
+
+    /**
+     * setWordSafe(addr, data)
+     *
+     * This interface is expressly for the Debugger, to access virtual memory without faulting.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addr
+     * @param {number} data
+     */
+    setWordSafe(addr, data)
+    {
+        this.nDisableTraps++;
+        this.bus.setWord(this.mapVirtualToPhysical(addr, PDP11.ACCESS.WRITE_WORD), data);
+        this.nDisableTraps--;
+    }
+
+    /**
+     * addMemBreak(addr, fWrite)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addr
+     * @param {boolean} fWrite is true for a memory write breakpoint, false for a memory read breakpoint
+     */
+    addMemBreak(addr, fWrite)
+    {
+        if (DEBUGGER) {
+            var nBreaks = fWrite? this.nWriteBreaks++ : this.nReadBreaks++;
+
+            if (!nBreaks) this.setMemoryAccess();
+        }
+    }
+
+    /**
+     * removeMemBreak(addr, fWrite)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addr
+     * @param {boolean} fWrite is true for a memory write breakpoint, false for a memory read breakpoint
+     */
+    removeMemBreak(addr, fWrite)
+    {
+        if (DEBUGGER) {
+            var nBreaks = fWrite? --this.nWriteBreaks : --this.nReadBreaks;
+
+            if (!nBreaks) this.setMemoryAccess();
+        }
+    }
+
+    /**
+     * getPhysicalAddrByMode(mode, reg, access)
+     *
+     * This is a handler set up by setMemoryAccess().  All calls should go through getAddr().
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} mode
+     * @param {number} reg
+     * @param {number} access
+     * @return {number}
+     */
+    getPhysicalAddrByMode(mode, reg, access)
+    {
+        return this.getAddrByMode(mode, reg, access);
+    }
+
+    /**
+     * getVirtualAddrByMode(mode, reg, access)
+     *
+     * This is a handler set up by setMemoryAccess().  All calls should go through getAddr().
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} mode
+     * @param {number} reg
+     * @param {number} access
+     * @return {number}
+     */
+    getVirtualAddrByMode(mode, reg, access)
+    {
+        return this.mapVirtualToPhysical(this.getAddrByMode(mode, reg, access), access);
+    }
+
+    /**
+     * readWordFromPhysical(addr)
+     *
+     * This is a handler set up by setMemoryAccess().  All calls should go through readWord().
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addr
+     * @return {number}
+     */
+    readWordFromPhysical(addr)
+    {
+        return this.bus.getWord(this.addrLast = addr);
+    }
+
+    /**
+     * readWordFromPhysicalChecked(addr)
+     *
+     * This is a handler set up by setMemoryAccess().  All calls should go through readWord().
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addr
+     * @return {number}
+     */
+    readWordFromPhysicalChecked(addr)
+    {
+        if (DEBUGGER && this.dbg) {
+            this.dbg.checkMemoryRead(addr, 2);
+        }
+        return this.readWordFromPhysical(addr);
+    }
+
+    /**
+     * readWordFromVirtual(addrVirtual)
+     *
+     * This is a handler set up by setMemoryAccess().  All calls should go through readWord().
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addrVirtual (input address is 17 bit (I&D))
+     * @return {number}
+     */
+    readWordFromVirtual(addrVirtual)
+    {
+        return this.bus.getWord(this.addrLast = this.mapVirtualToPhysical(addrVirtual, PDP11.ACCESS.READ_WORD));
+    }
+
+    /**
+     * readWordFromVirtualChecked(addrVirtual)
+     *
+     * This is a handler set up by setMemoryAccess().  All calls should go through readWord().
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addrVirtual (input address is 17 bit (I&D))
+     * @return {number}
+     */
+    readWordFromVirtualChecked(addrVirtual)
+    {
+        if (DEBUGGER && this.dbg) {
+            this.dbg.checkMemoryRead(addrVirtual, 2);
+        }
+        return this.readWordFromVirtual(addrVirtual);
+    }
+
+    /**
+     * writeWordToPhysical(addr, data)
+     *
+     * This is a handler set up by setMemoryAccess().  All calls should go through writeWord().
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addr
+     * @param {number} data
+     */
+    writeWordToPhysical(addr, data)
+    {
+        this.bus.setWord(this.addrLast = addr, data);
+    }
+
+    /**
+     * writeWordToPhysicalChecked(addr, data)
+     *
+     * This is a handler set up by setMemoryAccess().  All calls should go through writeWord().
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addr
+     * @param {number} data
+     */
+    writeWordToPhysicalChecked(addr, data)
+    {
+        if (DEBUGGER && this.dbg) {
+            this.dbg.checkMemoryWrite(addr, 2);
+        }
+        this.writeWordToPhysical(addr, data);
+    }
+
+    /**
+     * writeWordToVirtual(addrVirtual, data)
+     *
+     * This is a handler set up by setMemoryAccess().  All calls should go through writeWord().
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addrVirtual (input address is 17 bit (I&D))
+     * @param {number} data
+     */
+    writeWordToVirtual(addrVirtual, data)
+    {
+        this.bus.setWord(this.addrLast = this.mapVirtualToPhysical(addrVirtual, PDP11.ACCESS.WRITE_WORD), data);
+    }
+
+    /**
+     * writeWordToVirtualChecked(addrVirtual, data)
+     *
+     * This is a handler set up by setMemoryAccess().  All calls should go through writeWord().
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} addrVirtual (input address is 17 bit (I&D))
+     * @param {number} data
+     */
+    writeWordToVirtualChecked(addrVirtual, data)
+    {
+        if (DEBUGGER && this.dbg) {
+            this.dbg.checkMemoryWrite(addrVirtual, 2);
+        }
+        this.writeWordToVirtual(addrVirtual, data);
+    }
+
+    /**
+     * readWordFromPrevSpace(opCode, access)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} opCode
+     * @param {number} access (really just PDP11.ACCESS.DSPACE or PDP11.ACCESS.ISPACE)
+     * @return {number}
+     */
+    readWordFromPrevSpace(opCode, access)
+    {
+        var data;
+        var reg = this.dstReg = opCode & PDP11.OPREG.MASK;
+        var mode = this.dstMode = (opCode & PDP11.OPMODE.MASK) >> PDP11.OPMODE.SHIFT;
+        if (!mode) {
+            if (reg != 6 || ((this.regPSW >> 2) & PDP11.PSW.PMODE) === (this.regPSW & PDP11.PSW.PMODE)) {
+                data = this.regsGen[reg];
+            } else {
+                data = this.regsAltStack[(this.regPSW >> 12) & 3];
+            }
+        } else {
+            var addr = this.getAddrByMode(mode, reg, PDP11.ACCESS.READ_WORD);
+            if (!(access & PDP11.ACCESS.DSPACE)) {
+                if ((this.regPSW & 0xf000) !== 0xf000) addr &= 0xffff;
+            }
+            this.pswMode = (this.regPSW >> 12) & 3;
+            data = this.readWord(addr | (access & this.addrDSpace));
+            this.pswMode = (this.regPSW >> 14) & 3;
+        }
+        return data;
+    }
+
+    /**
+     * writeWordToPrevSpace(opCode, access, data)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} opCode
+     * @param {number} access (really just PDP11.ACCESS.DSPACE or PDP11.ACCESS.ISPACE)
+     * @param {number} data
+     */
+    writeWordToPrevSpace(opCode, access, data)
+    {
+        this.opLast = (this.opLast & 0xffff) | (0x0016 << 16);
+        var reg = this.dstReg = opCode & PDP11.OPREG.MASK;
+        var mode = this.dstMode = (opCode & PDP11.OPMODE.MASK) >> PDP11.OPMODE.SHIFT;
+        if (!mode) {
+            if (reg != 6 || ((this.regPSW >> 2) & PDP11.PSW.PMODE) === (this.regPSW & PDP11.PSW.PMODE)) {
+                this.regsGen[reg] = data;
+            } else {
+                this.regsAltStack[(this.regPSW >> 12) & 3] = data;
+            }
+        } else {
+            var addr = this.getAddrByMode(mode, reg, PDP11.ACCESS.WRITE_WORD);
+            if (!(access & PDP11.ACCESS.DSPACE)) addr &= 0xffff;
+            /*
+             * TODO: Consider replacing the following code with writeWord(), by adding optional pswMode
+             * parameters for each of the discrete mapVirtualToPhysical() and setWord() operations, because
+             * as it stands, this is the only remaining call to mapVirtualToPhysical() outside of our
+             * setMemoryAccess() handlers.
+             */
+            this.pswMode = (this.regPSW >> 12) & 3;
+            addr = this.mapVirtualToPhysical(addr | (access & PDP11.ACCESS.DSPACE), PDP11.ACCESS.WRITE);
+            this.pswMode = (this.regPSW >> 14) & 3;
+            this.setWord(addr, data);
+        }
+    }
+
+    /**
+     * readSrcByte(opCode)
+     *
+     * WARNING: If the SRC operand is a register, offRegSrc ensures we return a negative register number
+     * rather than the register value, because on the PDP-11/20, the final value of the register must be
+     * resolved AFTER the DST operand has been decoded and any pre-decrement or post-increment operations
+     * affecting the SRC register have been completed.  See readSrcWord() for more details.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} opCode
+     * @return {number}
+     */
+    readSrcByte(opCode)
+    {
+        var result;
+        opCode >>= PDP11.SRCMODE.SHIFT;
+        var reg = this.srcReg = opCode & PDP11.OPREG.MASK;
+        var mode = this.srcMode = (opCode & PDP11.OPMODE.MASK) >> PDP11.OPMODE.SHIFT;
+        if (!mode) {
+            result = this.regsGen[reg + this.offRegSrc] & this.maskRegSrcByte;
+        } else {
+            result = this.getByte(this.getAddr(mode, reg, PDP11.ACCESS.READ_BYTE));
+        }
+        return result;
+    }
+
+    /**
+     * readSrcWord(opCode)
+     *
+     * WARNING: If the SRC operand is a register, offRegSrc ensures we return a negative register number
+     * rather than the register value, because on the PDP-11/20, the final value of the register must be
+     * resolved AFTER the DST operand has been decoded and any pre-decrement or post-increment operations
+     * affecting the SRC register have been completed.
+     *
+     * Here's an example from DEC's "TRAP TEST" (MAINDEC-11-D0NA-PB):
+     *
+     *      007200: 012700 006340          MOV   #6340,R0
+     *      007204: 010020                 MOV   R0,(R0)+
+     *      007206: 026727 177126 006342   CMP   006340,#6342
+     *      007214: 001401                 BEQ   007220
+     *      007216: 000000                 HALT
+     *
+     * If this function returned the value of R0 for the SRC operand of "MOV R0,(R0)+", then the operation
+     * would write 6340 to the destination, rather than 6342.
+     *
+     * Most callers don't need to worry about this, because if they pass the result from readSrcWord() directly
+     * to writeDstWord() or updateDstWord(), those functions will take care of converting any negative register
+     * number back into the current register value.  The exceptions are opcodes that don't modify the DST operand
+     * (BIT, BITB, CMP, and CMPB); those opcode handlers must deal with negative register numbers themselves.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} opCode
+     * @return {number}
+     */
+    readSrcWord(opCode)
+    {
+        var result;
+        opCode >>= PDP11.SRCMODE.SHIFT;
+        var reg = this.srcReg = opCode & PDP11.OPREG.MASK;
+        var mode = this.srcMode = (opCode & PDP11.OPMODE.MASK) >> PDP11.OPMODE.SHIFT;
+        if (!mode) {
+            result = this.regsGen[reg + this.offRegSrc];
+        } else {
+            result = this.getWord(this.getAddr(mode, reg, PDP11.ACCESS.READ_WORD));
+        }
+        return result;
+    }
+
+    /**
+     * readDstAddr(opCode)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} opCode
+     * @return {number}
+     */
+    readDstAddr(opCode)
+    {
+        var reg = this.dstReg = opCode & PDP11.OPREG.MASK;
+        var mode = this.dstMode = (opCode & PDP11.OPMODE.MASK) >> PDP11.OPMODE.SHIFT;
+        return this.getAddrByMode(mode, reg, PDP11.ACCESS.VIRT);
+    }
+
+    /**
+     * readDstByte(opCode)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} opCode
+     * @return {number}
+     */
+    readDstByte(opCode)
+    {
+        var result;
+        var reg = this.dstReg = opCode & PDP11.OPREG.MASK;
+        var mode = this.dstMode = (opCode & PDP11.OPMODE.MASK) >> PDP11.OPMODE.SHIFT;
+        if (!mode) {
+            result = this.regsGen[reg] & 0xff;
+        } else {
+            result = this.getByte(this.getAddr(mode, reg, PDP11.ACCESS.READ_BYTE));
+        }
+        return result;
+    }
+
+    /**
+     * readDstWord(opCode)
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} opCode
+     * @return {number}
+     */
+    readDstWord(opCode)
+    {
+        var result;
+        var reg = this.dstReg = opCode & PDP11.OPREG.MASK;
+        var mode = this.dstMode = (opCode & PDP11.OPMODE.MASK) >> PDP11.OPMODE.SHIFT;
+        if (!mode) {
+            result = this.regsGen[reg];
+        } else {
+            result = this.getWord(this.getAddr(mode, reg, PDP11.ACCESS.READ_WORD));
+        }
+        return result;
+    }
+
+    /**
+     * updateDstByte(opCode, data, fnOp)
+     *
+     * Used whenever the DST operand (as described by opCode) needs to be read before writing.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} opCode
+     * @param {number} data
+     * @param {function(number,number)} fnOp
+     */
+    updateDstByte(opCode, data, fnOp)
+    {
+        var reg = this.dstReg = opCode & PDP11.OPREG.MASK;
+        var mode = this.dstMode = (opCode & PDP11.OPMODE.MASK) >> PDP11.OPMODE.SHIFT;
+        if (!mode) {
+            var dst = this.regsGen[reg];
+            data = (data < 0? (this.regsGen[-data-1] & 0xff) : data);
+            this.regsGen[reg] = (dst & 0xff00) | fnOp.call(this, data, dst & 0xff);
+        } else {
+            var addr = this.dstAddr = this.getAddr(mode, reg, PDP11.ACCESS.UPDATE_BYTE);
+            data = (data < 0? (this.regsGen[-data-1] & 0xff) : data);
+            this.setByte(addr, fnOp.call(this, data, this.getByte(addr)));
+            if (addr & 1) this.nStepCycles--;
+        }
+    }
+
+    /**
+     * updateDstWord(opCode, data, fnOp)
+     *
+     * Used whenever the DST operand (as described by opCode) needs to be read before writing.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} opCode
+     * @param {number} data
+     * @param {function(number,number)} fnOp
+     */
+    updateDstWord(opCode, data, fnOp)
+    {
+        var reg = this.dstReg = opCode & PDP11.OPREG.MASK;
+        var mode = this.dstMode = (opCode & PDP11.OPMODE.MASK) >> PDP11.OPMODE.SHIFT;
+
+
+
+        if (!mode) {
+            this.regsGen[reg] = fnOp.call(this, data < 0? this.regsGen[-data-1] : data, this.regsGen[reg]);
+        } else {
+            var addr = this.getAddr(mode, reg, PDP11.ACCESS.UPDATE_WORD);
+            this.setWord(addr, fnOp.call(this, data < 0? this.regsGen[-data-1] : data, this.getWord(addr)));
+        }
+    }
+
+    /**
+     * writeDstByte(opCode, data, writeFlags, fnFlags)
+     *
+     * Used whenever the DST operand (as described by opCode) does NOT need to be read before writing.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} opCode
+     * @param {number} data
+     * @param {number} writeFlags (WRITE.BYTE aka 0xff, or WRITE.SBYTE aka 0xffff)
+     * @param {function(number)} fnFlags
+     */
+    writeDstByte(opCode, data, writeFlags, fnFlags)
+    {
+
+        var reg = this.dstReg = opCode & PDP11.OPREG.MASK;
+        var mode = this.dstMode = (opCode & PDP11.OPMODE.MASK) >> PDP11.OPMODE.SHIFT;
+        if (!mode) {
+            if (!data) {
+                /*
+                 * Potentially worthless optimization (but it looks good on "paper").
+                 */
+                this.regsGen[reg] &= ~writeFlags;
+            } else {
+                /*
+                 * Potentially worthwhile optimization: skipping the sign-extending data shifts
+                 * if writeFlags is WRITE.BYTE (but that requires an extra test and separate code paths).
+                 */
+                data = (data < 0? (this.regsGen[-data-1] & 0xff): data);
+                this.regsGen[reg] = (this.regsGen[reg] & ~writeFlags) | (((data << 24) >> 24) & writeFlags);
+            }
+            fnFlags.call(this, data << 8);
+        } else {
+            var addr = this.getAddr(mode, reg, PDP11.ACCESS.WRITE_BYTE);
+            fnFlags.call(this, (data = data < 0? (this.regsGen[-data-1] & 0xff) : data) << 8);
+            this.setByte(addr, data);
+            if (addr & 1) this.nStepCycles--;
+        }
+    }
+
+    /**
+     * writeDstWord(opCode, data, fnFlags)
+     *
+     * Used whenever the DST operand (as described by opCode) does NOT need to be read before writing.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} opCode
+     * @param {number} data
+     * @param {function(number)} fnFlags
+     */
+    writeDstWord(opCode, data, fnFlags)
+    {
+        var reg = this.dstReg = opCode & PDP11.OPREG.MASK;
+        var mode = this.dstMode = (opCode & PDP11.OPMODE.MASK) >> PDP11.OPMODE.SHIFT;
+
+
+
+        if (!mode) {
+            this.regsGen[reg] = (data = data < 0? this.regsGen[-data-1] : data);
+            fnFlags.call(this, data);
+        } else {
+            var addr = this.getAddr(mode, reg, PDP11.ACCESS.WRITE_WORD);
+            fnFlags.call(this, (data = data < 0? this.regsGen[-data-1] : data));
+            this.setWord(addr, data);
+        }
+    }
+
+    /**
+     * stepCPU(nMinCycles)
+     *
+     * NOTE: Single-stepping should not be confused with the Trap flag; single-stepping is a Debugger
+     * operation that's completely independent of Trap status.  The CPU can go in and out of Trap mode,
+     * in and out of h/w interrupt service routines (ISRs), etc, but from the Debugger's perspective,
+     * they're all one continuous stream of instructions that can be stepped or run at will.  Moreover,
+     * stepping vs. running should never change the behavior of the simulation.
+     *
+     * @this {CPUStatePDP11}
+     * @param {number} nMinCycles (0 implies a single-step, and therefore breakpoints should be ignored)
+     * @return {number} of cycles executed; 0 indicates a pre-execution condition (ie, an execution breakpoint
+     * was hit), -1 indicates a post-execution condition (eg, a read or write breakpoint was hit), and a positive
+     * number indicates successful completion of that many cycles (which should always be >= nMinCycles).
+     */
+    stepCPU(nMinCycles)
+    {
+        /*
+         * The Debugger uses complete to determine if the instruction completed (true) or was interrupted
+         * by a breakpoint or some other exceptional condition (false).  NOTE: this does NOT include JavaScript
+         * exceptions, which stepCPU() expects the caller to catch using its own exception handler.
+         *
+         * The CPU relies on the use of stopCPU() rather than complete, because the CPU never single-steps
+         * (ie, nMinCycles is always some large number), whereas the Debugger does.  And conversely, when the
+         * Debugger is single-stepping (even when performing multiple single-steps), fRunning is never set,
+         * so stopCPU() would have no effect as far as the Debugger is concerned.
+         */
+        this.flags.complete = true;
+
+        /*
+         * nDebugCheck is 1 if we want the Debugger's checkInstruction() to check every instruction,
+         * -1 if we want it to check just the first instruction, and 0 if there's no need for any checks.
+         */
+        var nDebugCheck = (DEBUGGER && this.dbg)? (this.dbg.checksEnabled()? 1 : (this.flags.starting? -1 : 0)) : 0;
+
+        /*
+         * nDebugState is needed only when nDebugCheck is non-zero; it is -1 if this is a single-step, 0 if
+         * this is the start of a new run, and 1 if this is a continuation of a previous run.  It is used by
+         * checkInstruction() to determine if it should skip breakpoint checks and/or HALT instructions (ie,
+         * if nDebugState is <= zero).
+         */
+        var nDebugState = (!nMinCycles)? -1 : (this.flags.starting? 0 : 1);
+        this.flags.starting = false;        // we've moved beyond "starting" and have officially "started" now
+
+        /*
+         * We move the minimum cycle count to nStepCycles (the number of cycles left to step), so that other
+         * functions have the ability to force that number to zero (eg, stopCPU()), and thus we don't have to check
+         * any other criteria to determine whether we should continue stepping or not.
+         */
+        this.nBurstCycles = this.nStepCycles = nMinCycles;
+
+        /*
+         * And finally, move the nDebugCheck state to an OPFLAG bit, so that the loop need check only one variable.
+         */
+        this.opFlags = (this.opFlags & ~PDP11.OPFLAG.DEBUGGER) | (nDebugCheck? PDP11.OPFLAG.DEBUGGER : 0);
+
+        do {
+            if (this.opFlags) {
+                /*
+                 * NOTE: We still check DEBUGGER to ensure that this code will be compiled out of existence in
+                 * non-DEBUGGER builds.
+                 */
+                if (DEBUGGER && (this.opFlags & PDP11.OPFLAG.DEBUGGER)) {
+                    if (this.dbg.checkInstruction(this.getPC(), nDebugState)) {
+                        this.stopCPU();
+                        break;
+                    }
+                    if (!++nDebugCheck) this.opFlags &= ~PDP11.OPFLAG.DEBUGGER;
+                    if (!nDebugState) nDebugState++;
+                }
+                /*
+                 * If we're in the IRQ or WAIT state, check for any pending interrupts.
+                 *
+                 * NOTE: It's no coincidence that we're checking this BEFORE any pending traps, because in rare
+                 * cases (including some presented by those pesky "TRAP TEST" diagnostics), the process of dispatching
+                 * an interrupt can trigger a TRAP_SP stack overflow condition, which must be dealt with BEFORE we
+                 * execute the first instruction of the interrupt handler.
+                 */
+                if ((this.opFlags & (PDP11.OPFLAG.IRQ_MASK | PDP11.OPFLAG.WAIT)) /* && nDebugState >= 0 */) {
+                    if (this.checkInterrupts()) {
+                        if ((this.opFlags & PDP11.OPFLAG.DEBUGGER) && this.dbg.checkInstruction(this.getPC(), nDebugState)) {
+                            this.stopCPU();
+                            break;
+                        }
+                        /*
+                         * Since an interrupt was just dispatched, altering the normal flow of time and changing
+                         * the future as we knew it, let's break out immediately if we're single-stepping, so that
+                         * the Debugger gets to see the first instruction of the interrupt handler.  NOTE: This
+                         * assumes that we've still commented out the nDebugState check above that used to bypass
+                         * checkInterrupts() when single-stepping.
+                         */
+                        if (nDebugState < 0) break;
+                    }
+                }
+                /*
+                 * Next, check for any pending traps (which, as noted above, must be done after checkInterrupts()).
+                 *
+                 * I've moved this TRAP_MASK check BEFORE we decode the next instruction instead of immediately AFTER,
+                 * just in case the last instruction threw an exception that kicked us out before we reached the bottom
+                 * of the stepCPU() loop.
+                 */
+                if (this.opFlags & PDP11.OPFLAG.TRAP_MASK) {
+                    if (this.checkTraps()) {
+                        if ((this.opFlags & PDP11.OPFLAG.DEBUGGER) && this.dbg.checkInstruction(this.getPC(), nDebugState)) {
+                            this.stopCPU();
+                            break;
+                        }
+                        if (nDebugState < 0) break;
+                    }
+                }
+            }
+
+            /*
+             * Snapshot the TF bit in opFlags, while clearing all other opFlags (except those in PRESERVE);
+             * we'll check the TRAP_TF bit in opFlags when we come back around for another opcode.
+             */
+            this.opFlags = (this.opFlags & PDP11.OPFLAG.PRESERVE) | (this.regPSW & PDP11.PSW.TF);
+
+            var opCode = this.getOpcode();
+            this.opDecode(opCode);
+
+        } while (this.nStepCycles > 0);
+
+        return (this.flags.complete? this.nBurstCycles - this.nStepCycles : (this.flags.complete === false? -1 : 0));
+    }
+
+    /**
+     * CPUStatePDP11.init()
+     *
+     * This function operates on every HTML element of class "cpu", extracting the
+     * JSON-encoded parameters for the CPUStatePDP11 constructor from the element's "data-value"
+     * attribute, invoking the constructor (which in turn invokes the CPU constructor)
+     * to create a CPUStatePDP11 component, and then binding any associated HTML controls to the
+     * new component.
+     */
+    static init()
+    {
+        var aeCPUs = Component.getElementsByClass(document, PDP11.APPCLASS, "cpu");
+        for (var iCPU = 0; iCPU < aeCPUs.length; iCPU++) {
+            var eCPU = aeCPUs[iCPU];
+            var parmsCPU = Component.getComponentParms(eCPU);
+            var cpu = new CPUStatePDP11(parmsCPU);
+            Component.bindComponentControls(cpu, eCPU, PDP11.APPCLASS);
+        }
+    }
+}
+
+/*
+ * Initialize every CPU module on the page
+ */
+Web.onInit(CPUStatePDP11.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/cpuops.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * Decoding starts near the bottom of this file, in op1120() and op1140().  Obviously, there are
+ * MANY more PDP-11 models than the 11/20 and 11/40, but for the broad model categories that PDPjs
+ * supports (ie, MODEL_1120, MODEL_1140, MODEL_1145, and MODEL_1170), the biggest differences are
+ * between MODEL_1120 and MODEL_1140, so decoding is divided into those two categories, and all
+ * other differences are handled inside the opcode handlers.
+ *
+ * The basic decoding approach is to dispatch on the top 4 bits of the opcode, and if further
+ * decoding is required, the dispatched function will dispatch on the next 4 bits, and so on
+ * (although some of the intermediate levels dispatch only on 2 bits, which could also be handled
+ * with a switch statement).
+ *
+ * Eventually, every opcode should end up either in an opXXX() function or opUndefined().  For
+ * opcodes that perform a simple read or write operation, the entire operation is handled by
+ * the opXXX() function.  For opcodes that perform a more extensive read/modify/write operation
+ * (also known as an update operation), those opXXX() functions usually rely on a corresponding
+ * fnXXX() helper function.
+ *
+ * For example, opADD() passes the helper function fnADD() to the appropriate update method.  This
+ * allows the update method to perform the entire read/modify/write operation, because the modify
+ * step is performed internally, via the fnXXX() helper function.
+ *
+ * For the handful of instructions in the 1140 tables that actually exist only on the 11/45 and
+ * 11/70 (ie, MFPD, MTPD, and SPL), those opcode handlers perform their own model checks.  That's
+ * simpler than creating additional tables, and seems fine for instructions that are not commonly
+ * executed.
+ */
+
+/**
+ * fnADD(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src
+ * @param {number} dst
+ * @return {number} (dst + src)
+ */
+PDP11.fnADD = function(src, dst)
+{
+    var result = dst + src;
+    this.updateAddFlags(result, src, dst);
+    return result & 0xffff;
+};
+
+/**
+ * fnADDB(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src
+ * @param {number} dst
+ * @return {number} (dst + src)
+ */
+PDP11.fnADDB = function(src, dst)
+{
+    var result = dst + src;
+    this.updateAddFlags(result << 8, src << 8, dst << 8);
+    return result & 0xff;
+};
+
+/**
+ * fnASL(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src (ignored)
+ * @param {number} dst
+ * @return {number} (dst << 1)
+ */
+PDP11.fnASL = function(src, dst)
+{
+    var result = dst << 1;
+    this.updateShiftFlags(result);
+    return result & 0xffff;
+};
+
+/**
+ * fnASLB(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src (ignored)
+ * @param {number} dst
+ * @return {number} (dst << 1)
+ */
+PDP11.fnASLB = function(src, dst)
+{
+    var result = dst << 1;
+    this.updateShiftFlags(result << 8);
+    return result & 0xff;
+};
+
+/**
+ * fnASR(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src (ignored)
+ * @param {number} dst
+ * @return {number} (dst >> 1)
+ */
+PDP11.fnASR = function(src, dst)
+{
+    var result = (dst & 0x8000) | (dst >> 1) | (dst << 16);
+    this.updateShiftFlags(result);
+    return result & 0xffff;
+};
+
+/**
+ * fnASRB(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src (ignored)
+ * @param {number} dst
+ * @return {number} (dst >> 1)
+ */
+PDP11.fnASRB = function(src, dst)
+{
+    var result = (dst & 0x80) | (dst >> 1) | (dst << 8);
+    this.updateShiftFlags(result << 8);
+    return result & 0xff;
+};
+
+/**
+ * fnBIC(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src
+ * @param {number} dst
+ * @return {number} (~src & dst)
+ */
+PDP11.fnBIC = function(src, dst)
+{
+    var result = dst & ~src;
+    this.updateNZVFlags(result);
+    return result;
+};
+
+/**
+ * fnBICB(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src
+ * @param {number} dst
+ * @return {number} (~src & dst)
+ */
+PDP11.fnBICB = function(src, dst)
+{
+    var result = dst & ~src;
+    this.updateNZVFlags(result << 8);
+    return result;
+};
+
+/**
+ * fnBIS(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src
+ * @param {number} dst
+ * @return {number} (dst | src)
+ */
+PDP11.fnBIS = function(src, dst)
+{
+    var result = dst | src;
+    this.updateNZVFlags(result);
+    return result;
+};
+
+/**
+ * fnBISB(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src
+ * @param {number} dst
+ * @return {number} (dst | src)
+ */
+PDP11.fnBISB = function(src, dst)
+{
+    var result = dst | src;
+    this.updateNZVFlags(result << 8);
+    return result;
+};
+
+/**
+ * fnCOM(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src (ignored)
+ * @param {number} dst
+ * @return {number} (~dst)
+ */
+PDP11.fnCOM = function(src, dst)
+{
+    var result = ~dst | 0x10000;
+    this.updateAllFlags(result);
+    return result & 0xffff;
+};
+
+/**
+ * fnCOMB(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src (ignored)
+ * @param {number} dst
+ * @return {number} (~dst)
+ */
+PDP11.fnCOMB = function(src, dst)
+{
+    var result = ~dst | 0x100;
+    this.updateAllFlags(result << 8);
+    return result & 0xff;
+};
+
+/**
+ * fnDEC(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src (ie, 1)
+ * @param {number} dst
+ * @return {number} (dst - src)
+ */
+PDP11.fnDEC = function(src, dst)
+{
+    var result = dst - src;
+    this.updateDecFlags(result, dst);
+    return result & 0xffff;
+};
+
+/**
+ * fnDECB(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src (ie, 1)
+ * @param {number} dst
+ * @return {number} (dst - src)
+ */
+PDP11.fnDECB = function(src, dst)
+{
+    var result = dst - src;
+    this.updateDecFlags(result << 8, dst << 8);
+    return result & 0xff;
+};
+
+/**
+ * fnINC(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src (ie, 1)
+ * @param {number} dst
+ * @return {number} (dst + src)
+ */
+PDP11.fnINC = function(src, dst)
+{
+    var result = dst + src;
+    this.updateIncFlags(result, dst);
+    return result & 0xffff;
+};
+
+/**
+ * fnINCB(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src (ie, 1)
+ * @param {number} dst
+ * @return {number} (dst + src)
+ */
+PDP11.fnINCB = function(src, dst)
+{
+    var result = dst + src;
+    this.updateIncFlags(result << 8, dst << 8);
+    return result & 0xff;
+};
+
+/**
+ * fnNEG(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src (ignored)
+ * @param {number} dst
+ * @return {number} (-dst)
+ */
+PDP11.fnNEG = function(src, dst)
+{
+    var result = -dst;
+    /*
+     * If the sign bit of both dst and result are set, the original value must have been 0x8000, triggering overflow.
+     */
+    this.updateAllFlags(result, result & dst & 0x8000);
+    return result & 0xffff;
+};
+
+/**
+ * fnNEGB(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src (ignored)
+ * @param {number} dst
+ * @return {number} (-dst)
+ */
+PDP11.fnNEGB = function(src, dst)
+{
+    var result = -dst;
+    /*
+     * If the sign bit of both dst and result are set, the original value must have been 0x80, which triggers overflow.
+     */
+    this.updateAllFlags(result << 8, (result & dst & 0x80) << 8);
+    return result & 0xff;
+};
+
+/**
+ * fnROL(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src (ignored)
+ * @param {number} dst
+ * @return {number} (dst >> 1)
+ */
+PDP11.fnROL = function(src, dst)
+{
+    var result = (dst << 1) | ((this.flagC >> 16) & 1);
+    this.updateShiftFlags(result);
+    return result & 0xffff;
+};
+
+/**
+ * fnROLB(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src (ignored)
+ * @param {number} dst
+ * @return {number} (dst >> 1)
+ */
+PDP11.fnROLB = function(src, dst)
+{
+    var result = (dst << 1) | ((this.flagC >> 16) & 1);
+    this.updateShiftFlags(result << 8);
+    return result & 0xff;
+};
+
+/**
+ * fnROR(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src (ignored)
+ * @param {number} dst
+ * @return {number} (dst >> 1)
+ */
+PDP11.fnROR = function(src, dst)
+{
+    var result = (((this.flagC & 0x10000) | dst) >> 1) | (dst << 16);
+    this.updateShiftFlags(result);
+    return result & 0xffff;
+};
+
+/**
+ * fnRORB(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src (ignored)
+ * @param {number} dst
+ * @return {number} (dst >> 1)
+ */
+PDP11.fnRORB = function(src, dst)
+{
+    var result = ((((this.flagC & 0x10000) >> 8) | dst) >> 1) | (dst << 8);
+    this.updateShiftFlags(result << 8);
+    return result & 0xff;
+};
+
+/**
+ * fnSUB(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src
+ * @param {number} dst
+ * @return {number} (dst - src)
+ */
+PDP11.fnSUB = function(src, dst)
+{
+    var result = dst - src;
+    this.updateSubFlags(result, src, dst);
+    return result & 0xffff;
+};
+
+/**
+ * fnSUBB(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src
+ * @param {number} dst
+ * @return {number} (dst - src)
+ */
+PDP11.fnSUBB = function(src, dst)
+{
+    var result = dst - src;
+    this.updateSubFlags(result << 8, src << 8, dst << 8);
+    return result & 0xff;
+};
+
+/**
+ * fnSWAB(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src (ignored)
+ * @param {number} dst
+ * @return {number} (dst with bytes swapped)
+ */
+PDP11.fnSWAB = function(src, dst)
+{
+    var result = (dst << 8) | (dst >> 8);
+    /*
+     * N and Z are based on the low byte of the result, which is the same as the high byte of dst.
+     */
+    this.updateNZVCFlags(dst & 0xff00);
+    return result & 0xffff;
+};
+
+/**
+ * fnXOR(src, dst)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} src
+ * @param {number} dst
+ * @return {number} (dst ^ src)
+ */
+PDP11.fnXOR = function(src, dst)
+{
+    var result = dst ^ src;
+    this.updateNZVFlags(result);
+    return result & 0xffff;
+};
+
+/**
+ * opADC(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opADC = function(opCode)
+{
+    this.updateDstWord(opCode, this.getCF()? 1 : 0, PDP11.fnADD);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opADCB(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opADCB = function(opCode)
+{
+    this.updateDstByte(opCode, this.getCF()? 1 : 0, PDP11.fnADDB);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opADD(opCode)
+ *
+ * From the PDP-11/20 Processor HandBook (1971), p. 61:
+ *
+ *     Add src,dst (06SSDD)
+ *
+ *     Operation:
+ *          (dst) = (src) + (dst)
+ *
+ *     Condition Codes:
+ *          N: set if result < 0; cleared otherwise
+ *          Z: set if result = 0; cleared otherwise
+ *          V: set if there was arithmetic overflow as a result of the operation, that is both operands
+ *             were of the same sign and the result was of the opposite sign; cleared otherwise
+ *          C: set if there was a carry from the most significant bit of the result; cleared otherwise
+ *
+ *     Description:
+ *          Adds the source operand to the destination operand and stores the result at the destination address.
+ *          The original contents of the destination are lost. The contents of the source are not affected.
+ *          Two's complement addition is performed.
+ *
+ *     Examples:
+ *          Add to register:            ADD 20,R0
+ *          Add to memory:              ADD R1,XXX
+ *          Add register to register:   ADD R1,R2
+ *          Add memory to memory:       ADD @#17750,XXX
+ *
+ *          XXX is a programmer-defined mnemonic for a memory location.
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opADD = function(opCode)
+{
+    this.updateDstWord(opCode, this.readSrcWord(opCode), PDP11.fnADD);
+    this.nStepCycles -= (this.dstMode? (8 + 1) + (this.srcReg && this.dstReg >= 6? 1 : 0) : (this.srcMode? (3 + 2) : (2 + 1)) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opASH(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opASH = function(opCode)
+{
+    var src = this.readDstWord(opCode);
+    var reg = (opCode >> 6) & 7;
+    var result = this.regsGen[reg];
+    if (result & 0x8000) result |= 0xffff0000;
+    this.flagC = this.flagV = 0;
+    src &= 0x3F;
+    if (src & 0x20) {
+        src = 64 - src;         // shift right
+        if (src > 16) src = 16;
+        this.flagC = result << (17 - src);
+        result = result >> src;
+    } else if (src) {
+        if (src > 16) {         // shift left
+            this.flagV = result;
+            result = 0;
+        } else {
+            result = result << src;
+            this.flagC = result;
+            var dst = (result >> 15) & 0xffff;  // check successive sign bits
+            if (dst && dst !== 0xffff) this.flagV = 0x8000;
+        }
+    }
+    this.regsGen[reg] = result & 0xffff;
+    this.flagN = this.flagZ = result;
+    this.nStepCycles -= (this.dstMode? (5 + 1) : (6 + 1)) + src;
+};
+
+/**
+ * opASHC(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opASHC = function(opCode)
+{
+    var src = this.readDstWord(opCode);
+    var reg = (opCode >> 6) & 7;
+    var dst = (this.regsGen[reg] << 16) | this.regsGen[reg | 1];
+    this.flagC = this.flagV = 0;
+    src &= 0x3F;
+    if (src & 0x20) {
+        src = 64 - src;         // shift right
+        if (src > 32) src = 32;
+        var result = dst >> (src - 1);
+        this.flagC = result << 16;
+        result >>= 1;
+        if (dst & 0x80000000) result |= 0xffffffff << (32 - src);
+    } else {
+        if (src) {              // shift left
+            result = dst << (src - 1);
+            this.flagC = result >> 15;
+            result <<= 1;
+            if (src > 32) src = 32;
+            dst = dst >> (32 - src);
+            if (dst) {
+                dst |= (0xffffffff << src) & 0xffffffff;
+                if (dst !== 0xffffffff) this.flagV = 0x8000;
+            }
+        } else {
+            result = dst;
+        }
+    }
+    this.regsGen[reg] = (result >> 16) & 0xffff;
+    this.regsGen[reg | 1] = result & 0xffff;
+    this.flagN = result >> 16;
+    this.flagZ = result >> 16 | result;
+    this.nStepCycles -= (this.dstMode? (5 + 1) : (6 + 1)) + src;
+};
+
+/**
+ * opASL(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opASL = function(opCode)
+{
+    this.updateDstWord(opCode, 0, PDP11.fnASL);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opASLB(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opASLB = function(opCode)
+{
+    this.updateDstByte(opCode, 0, PDP11.fnASLB);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opASR(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opASR = function(opCode)
+{
+    this.updateDstWord(opCode, 0, PDP11.fnASR);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opASRB(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opASRB = function(opCode)
+{
+    this.updateDstByte(opCode, 0, PDP11.fnASRB);
+    this.nStepCycles -= (this.dstMode? (8 + 1) + (this.dstAddr & 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opBCC(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBCC = function(opCode)
+{
+    this.branch(opCode, !this.getCF());
+};
+
+/**
+ * opBCS(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBCS = function(opCode)
+{
+    this.branch(opCode, this.getCF());
+};
+
+/**
+ * opBIC(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBIC = function(opCode)
+{
+    this.updateDstWord(opCode, this.readSrcWord(opCode), PDP11.fnBIC);
+    this.nStepCycles -= (this.dstMode? (8 + 1) + (this.srcReg && this.dstReg >= 6? 1 : 0) : (this.srcMode? (3 + 2) : (2 + 1)) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opBICB(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBICB = function(opCode)
+{
+    this.updateDstByte(opCode, this.readSrcByte(opCode), PDP11.fnBICB);
+    this.nStepCycles -= (this.dstMode? (8 + 1) + (this.srcReg && this.dstReg >= 6? 1 : 0) : (this.srcMode? (3 + 2) : (2 + 1)) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opBIS(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBIS = function(opCode)
+{
+    this.updateDstWord(opCode, this.readSrcWord(opCode), PDP11.fnBIS);
+    this.nStepCycles -= (this.dstMode? (8 + 1) + (this.srcReg && this.dstReg >= 6? 1 : 0) : (this.srcMode? (3 + 2) : (2 + 1)) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opBISB(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBISB = function(opCode)
+{
+    this.updateDstByte(opCode, this.readSrcByte(opCode), PDP11.fnBISB);
+    this.nStepCycles -= (this.dstMode? (8 + 1) + (this.srcReg && this.dstReg >= 6? 1 : 0) : (this.srcMode? (3 + 2) : (2 + 1)) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opBIT(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBIT = function(opCode)
+{
+    var src = this.readSrcWord(opCode);
+    var dst = this.readDstWord(opCode);
+    this.updateNZVFlags((src < 0? this.regsGen[-src-1] : src) & dst);
+    this.nStepCycles -= (this.dstMode? (3 + 1) + (this.srcReg && this.dstReg >= 6? 1 : 0) : (this.srcMode? (3 + 1) : (2 + 1)) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opBITB(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBITB = function(opCode)
+{
+    var src = this.readSrcByte(opCode);
+    var dst = this.readDstByte(opCode);
+    this.updateNZVFlags(((src < 0? (this.regsGen[-src-1] & 0xff) : src) & dst) << 8);
+    this.nStepCycles -= (this.dstMode? (3 + 1) + (this.srcReg && this.dstReg >= 6? 1 : 0) : (this.srcMode? (3 + 1) : (2 + 1)) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opBEQ(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBEQ = function(opCode)
+{
+    this.branch(opCode, this.getZF());
+};
+
+/**
+ * opBGE(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBGE = function(opCode)
+{
+    this.branch(opCode, !this.getNF() == !this.getVF());
+};
+
+/**
+ * opBGT(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBGT = function(opCode)
+{
+    this.branch(opCode, !this.getZF() && (!this.getNF() == !this.getVF()));
+};
+
+/**
+ * opBHI(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBHI = function(opCode)
+{
+    this.branch(opCode, !this.getCF() && !this.getZF());
+};
+
+/**
+ * opBLE(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBLE = function(opCode)
+{
+    this.branch(opCode, this.getZF() || (!this.getNF() != !this.getVF()));
+};
+
+/**
+ * opBLOS(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBLOS = function(opCode)
+{
+    this.branch(opCode, this.getCF() || this.getZF());
+};
+
+/**
+ * opBLT(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBLT = function(opCode)
+{
+    this.branch(opCode, !this.getNF() != !this.getVF());
+};
+
+/**
+ * opBMI(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBMI = function(opCode)
+{
+    this.branch(opCode, this.getNF());
+};
+
+/**
+ * opBNE(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBNE = function(opCode)
+{
+    this.branch(opCode, !this.getZF());
+};
+
+/**
+ * opBPL(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBPL = function(opCode)
+{
+    this.branch(opCode, !this.getNF());
+};
+
+/**
+ * opBPT(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBPT = function(opCode)
+{
+    this.trap(PDP11.TRAP.BPT, 0, PDP11.REASON.OPCODE);
+};
+
+/**
+ * opBR(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBR = function(opCode)
+{
+    this.branch(opCode, true);
+};
+
+/**
+ * opBVC(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBVC = function(opCode)
+{
+    this.branch(opCode, !this.getVF());
+};
+
+/**
+ * opBVS(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opBVS = function(opCode)
+{
+    this.branch(opCode, this.getVF());
+};
+
+/**
+ * opCLR(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opCLR = function(opCode)
+{
+    this.writeDstWord(opCode, 0, this.updateAllFlags);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opCLRB(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opCLRB = function(opCode)
+{
+    this.writeDstByte(opCode, 0, PDP11.WRITE.BYTE, this.updateAllFlags);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opCLC(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opCLC = function(opCode)
+{
+    this.clearCF();
+    this.nStepCycles -= (4 + 1);
+};
+
+/**
+ * opCLN(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opCLN = function(opCode)
+{
+    this.clearNF();
+    this.nStepCycles -= (4 + 1);
+};
+
+/**
+ * opCLV(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opCLV = function(opCode)
+{
+    this.clearVF();
+    this.nStepCycles -= (4 + 1);
+};
+
+/**
+ * opCLZ(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opCLZ = function(opCode)
+{
+    this.clearZF();
+    this.nStepCycles -= (4 + 1);
+};
+
+/**
+ * opCLx(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opCLx = function(opCode)
+{
+    if (opCode & 0x1) this.clearCF();
+    if (opCode & 0x2) this.clearVF();
+    if (opCode & 0x4) this.clearZF();
+    if (opCode & 0x8) this.clearNF();
+    /*
+     * TODO: Review whether this class of undocumented instructions really has a constant cycle time.
+     */
+    this.nStepCycles -= (4 + 1);
+};
+
+/**
+ * opCMP(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opCMP = function(opCode)
+{
+    var src = this.readSrcWord(opCode);
+    var dst = this.readDstWord(opCode);
+    var result = (src = (src < 0? this.regsGen[-src-1] : src)) - dst;
+    /*
+     * NOTE: CMP calculates (src - dst) rather than (dst - src), so src and dst updateSubFlags() parms must be reversed.
+     */
+    this.updateSubFlags(result, dst, src);
+    this.nStepCycles -= (this.dstMode? (3 + 1) + (this.srcReg && this.dstReg >= 6? 1 : 0) : (this.srcMode? (3 + 1) : (2 + 1)) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opCMPB(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opCMPB = function(opCode)
+{
+    var src = this.readSrcByte(opCode);
+    var dst = this.readDstByte(opCode);
+    var result = (src = (src < 0? (this.regsGen[-src-1] & 0xff): src) << 8) - (dst <<= 8);
+    /*
+     * NOTE: CMP calculates (src - dst) rather than (dst - src), so src and dst updateSubFlags() parms must be reversed.
+     */
+    this.updateSubFlags(result, dst, src);
+    this.nStepCycles -= (this.dstMode? (3 + 1) + (this.srcReg && this.dstReg >= 6? 1 : 0) : (this.srcMode? (3 + 1) : (2 + 1)) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opCOM(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opCOM = function(opCode)
+{
+    this.updateDstWord(opCode, 0, PDP11.fnCOM);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opCOMB(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opCOMB = function(opCode)
+{
+    this.updateDstByte(opCode, 0, PDP11.fnCOMB);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opDEC(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opDEC = function(opCode)
+{
+    this.updateDstWord(opCode, 1, PDP11.fnDEC);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opDECB(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opDECB = function(opCode)
+{
+    this.updateDstByte(opCode, 1, PDP11.fnDECB);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opDIV(opCode)
+ *
+ * The instruction "DIV SRC,Rn" determines SRC using the DSTMODE portion of the opcode and Rn using
+ * the SRCMODE portion; Rn can only be a register (and it should be an EVEN-numbered register, lest you
+ * get unexpected results).  The dividend (DST) is then calculated as:
+ *
+ *      DST = (regs[Rn] << 16) | (regs[Rn|1])
+ *
+ * DST is divided by SRC, and the quotient is stored in regs[Rn] and the remainder in regs[Rn|1].
+ *
+ * For example:
+ *
+ *      DIV     R4,R0
+ *
+ * where R4 = 006400 and R0,R1 = 000000,015000 will result in R0,R1 = 000002,000000.
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opDIV = function(opCode)
+{
+    /*
+     * TODO: Review and determine if flag updates can be encapsulated in an updateDivFlags() function.
+     */
+    var src = this.readDstWord(opCode);
+    if (!src) {
+        this.flagN = 0;         // NZVC
+        this.flagZ = 0;
+        this.flagV = 0x8000;
+        this.flagC = 0x10000;   // divide by zero
+        this.nStepCycles -= (6 + 1);
+    } else {
+        var reg = (opCode >> 6) & 7;
+        var dst = (this.regsGen[reg] << 16) | this.regsGen[reg | 1];
+        this.flagC = this.flagV = 0;
+        if (src & 0x8000) src |= ~0xffff;
+        var result = ~~(dst / src);
+        if (result >= -32768 && result <= 32767) {
+            this.regsGen[reg] = result & 0xffff;
+            this.regsGen[reg | 1] = (dst - (result * src)) & 0xffff;
+            this.flagZ = (result >> 16) | result;
+            this.flagN = result >> 16;
+        } else {
+            this.flagV = 0x8000;                                // overflow - following are indeterminate
+            this.flagZ = (result >> 15) | result;               // dodgy
+            this.flagN = dst >> 16;                             // just as dodgy
+            if (src === -1 && this.regsGen[reg] === 0xfffe) {
+                this.regsGen[reg] = this.regsGen[reg | 1] = 1;  // etc
+            }
+        }
+        this.nStepCycles -= (52 + 1);                           // 52 is the average of the shortest and longest times
+    }
+};
+
+/**
+ * opEMT(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opEMT = function(opCode)
+{
+    this.trap(PDP11.TRAP.EMT, 0, PDP11.REASON.OPCODE);
+    this.nStepCycles -= (22 + 3 - 5);
+};
+
+/**
+ * opHALT(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opHALT = function(opCode)
+{
+    if (this.regPSW & PDP11.PSW.CMODE) {
+        this.regErr |= PDP11.CPUERR.BADHALT;
+        this.trap(PDP11.TRAP.BUS, 0, PDP11.REASON.HALT);
+    } else {
+        if (this.panel) {
+            /*
+             * The PDP-11/20 Handbook (1971) says that HALT does the following:
+             *
+             *      Causes the processor operation to cease. The console is given control of the bus.
+             *      The console data lights display the contents of RO; the console address lights display
+             *      the address after the halt instruction. Transfers on the UNIBUS are terminated immediately.
+             *      The PC points to the next instruction to be executed. Pressing the continue key on the
+             *      console causes processor operation to resume. No INIT signal is given.
+             *
+             * However, the PDP-11/70 Handbook (1979) suggests some slight differences:
+             *
+             *      Causes the processor operation to cease. The console is given control of the processor.
+             *      The data lights display the contents of the PC (which is the address of the HALT instruction
+             *      plus 2). Transfers on the UNIBUS are terminated immediately. Pressing the continue key on
+             *      the console causes processor operation to resume.
+             *
+             * Given that the 11/70 doesn't saying anything about displaying R0 on a HALT, and also given that
+             * the 11/70 CPU EXERCISER diagnostic writes a value to the Console Switch/Display Register immediately
+             * before HALT'ing, I'm going to assume that updating the data display with R0 is unique to the 11/20.
+             *
+             * Also, I'm a little suspicious of the 11/70 comment that the "data lights display the contents of
+             * the PC," since previous models display the PC on the ADDRESS lights, not the DATA lights.  And as
+             * I already explained, doing anything to the data lights at this point would undo what the 11/70
+             * diagnostics do.
+             */
+            if (this.model == PDP11.MODEL_1120) {
+                this.panel.setData(this.regsGen[0], true);
+            }
+        }
+        if (!this.dbg) {
+            /*
+             * This will leave the PC exactly where it's supposed to be: at the address of the HALT + 2.
+             */
+            this.stopCPU();
+        } else {
+            /*
+             * When the Debugger is present, this call will rewind PC by 2 so that the HALT instruction is
+             * displayed, making it clear why the processor stopped; the user could also use the "dh" command
+             * to dump the Debugger's instruction history buffer to see why it stopped, assuming the history
+             * buffer is enabled, but that's more work.
+             *
+             * Because rewinding is not normal CPU behavior, attempting to Run again (or use the Debugger's
+             * "g" command) would cause an immediate HALT again -- except that checkInstruction() checks for that
+             * precise condition, so if the CPU starts on a HALT, checkInstruction() will skip over it.
+             */
+            this.dbg.stopInstruction();
+        }
+    }
+    this.nStepCycles -= 7;
+};
+
+/**
+ * opINC(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opINC = function(opCode)
+{
+    this.updateDstWord(opCode, 1, PDP11.fnINC);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opINCB(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opINCB = function(opCode)
+{
+    this.updateDstByte(opCode, 1, PDP11.fnINCB);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opIOT(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opIOT = function(opCode)
+{
+    this.trap(PDP11.TRAP.IOT, 0, PDP11.REASON.OPCODE);
+    this.nStepCycles -= (22 + 3 - 5);
+};
+
+PDP11.JMP_CYCLES = [
+    0, 6 + 1, 6 + 1, 8 + 2, 6 + 1, 9 + 2, 7 + 2, 10 + 3
+];
+
+/**
+ * opJMP(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opJMP = function(opCode)
+{
+    /*
+     * Since JMP and JSR opcodes have their own unique timings for the various dst modes, we must snapshot
+     * nStepCycles before decoding the mode, and then use that to update nStepCycles.
+     */
+    this.nSnapCycles = this.nStepCycles;
+    this.setPC(this.readDstAddr(opCode));
+    this.nStepCycles = this.nSnapCycles - PDP11.JMP_CYCLES[this.dstMode];
+};
+
+PDP11.JSR_CYCLES = [
+    0, 13 + 1, 13 + 1, 15 + 2, 13 + 1, 16 + 2, 14 + 2, 17 + 3
+];
+
+/**
+ * opJSR(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opJSR = function(opCode)
+{
+    /*
+     * Since JMP and JSR opcodes have their own unique timings for the various dst modes, we must
+     * snapshot nStepCycles before decoding the mode, and then use that to update nStepCycles.
+     */
+    this.nSnapCycles = this.nStepCycles;
+    var addr = this.readDstAddr(opCode);
+    /*
+     * As per the WARNING in readSrcWord(), reading the SRC register AFTER decoding the DST operand
+     * is entirely appropriate.
+     */
+    var reg = (opCode >> PDP11.SRCMODE.SHIFT) & PDP11.OPREG.MASK;
+    this.pushWord(this.regsGen[reg]);
+    this.regsGen[reg] = this.getPC();
+    this.setPC(addr);
+    this.nStepCycles = this.nSnapCycles - PDP11.JSR_CYCLES[this.dstMode];
+};
+
+/**
+ * opMARK(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opMARK = function(opCode)
+{
+    var addr = (this.getPC() + ((opCode & 0x3F) << 1)) & 0xffff;
+    var src = this.readWord(addr | this.addrDSpace);
+    this.setPC(this.regsGen[5]);
+    this.setSP(addr + 2);
+    this.regsGen[5] = src;
+    this.nStepCycles -= (6 + 2);
+};
+
+/**
+ * opMFPD(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opMFPD = function(opCode)
+{
+    var data = this.readWordFromPrevSpace(opCode, PDP11.ACCESS.DSPACE);
+    this.updateNZVFlags(data);
+    this.pushWord(data);
+    this.nStepCycles -= (10 + 1);
+};
+
+/**
+ * opMFPI(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opMFPI = function(opCode)
+{
+    var data = this.readWordFromPrevSpace(opCode, PDP11.ACCESS.ISPACE);
+    this.updateNZVFlags(data);
+    this.pushWord(data);
+    this.nStepCycles -= (10 + 1);
+};
+
+/**
+ * opMFPS(opCode)
+ *
+ *      1067XX  MFPS - Move Byte From PSW
+ *
+ *      The 8-bit contents of the PS are moved to the effective destination.  If destination is mode 0,
+ *      PS bit 7 is sign extended through the upper byte of the register.  The destination operand is treated
+ *      as a byte address.  11/34A only.
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opMFPS = function(opCode)
+{
+    PDP11.opUndefined.call(this, opCode);
+};
+
+/**
+ * opMFPT(opCode)
+ *
+ *      000007  MFPT - Move From Processor Type
+ *
+ *      Loads R0 with a value indicating the processor type.
+ *
+ *      R0  Hardware
+ *       1  PDP-11/44
+ *       3  PDP-11/24 (should be 2)
+ *       3  PDP-11/23
+ *       4  SBC-11/21
+ *       5  All J11 chips including 11/73, 11/83, 11/93
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opMFPT = function(opCode)
+{
+    PDP11.opUndefined.call(this, opCode);
+};
+
+PDP11.MOV_CYCLES = [
+    2 + 1, 8 + 1, 8 + 1, 11 + 2, 9 + 1, 12 + 2, 10 + 2, 13 + 3,
+    3 + 1, 8 + 1, 8 + 1, 11 + 2, 9 + 1, 12 + 2, 11 + 2, 14 + 3
+];
+
+/**
+ * opMOV(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opMOV = function(opCode)
+{
+    /*
+     * Since MOV opcodes have their own unique timings for the various dst modes, we must snapshot
+     * nStepCycles after decoding the src mode, and then use that to update nStepCycles.
+     */
+    var data = this.readSrcWord(opCode);
+    this.nSnapCycles = this.nStepCycles;
+    this.writeDstWord(opCode, data, this.updateNZVFlags);
+    this.nStepCycles = this.nSnapCycles - PDP11.MOV_CYCLES[(this.srcMode? 8 : 0) + this.dstMode] + (this.dstReg == 7 && !this.dstMode? 2 : 0);
+};
+
+/**
+ * opMOVB(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opMOVB = function(opCode)
+{
+    var data = this.readSrcByte(opCode);
+    this.writeDstByte(opCode, data, PDP11.WRITE.SBYTE, this.updateNZVFlags);
+    this.nStepCycles -= (this.dstMode? (8 + 1) + (this.srcReg && this.dstReg >= 6? 1 : 0) : (this.srcMode? (3 + 2) : (2 + 1)) + (this.dstReg == 7? 2 : 0));
+};
+
+PDP11.MTP_CYCLES = [
+    6 + 1, 11 + 2, 11 + 2, 14 + 3, 12 + 2, 15 + 3, 14 + 3, 17 + 4
+];
+
+/**
+ * opMTPD(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opMTPD = function(opCode)
+{
+    /*
+     * Since MTPD and MTPI opcodes have their own unique timings for the various dst modes, we must snapshot
+     * nStepCycles before decoding the mode, and then use that to update nStepCycles.
+     */
+    var data = this.popWord();
+    this.nSnapCycles = this.nStepCycles;
+    this.updateNZVFlags(data);
+    this.writeWordToPrevSpace(opCode, PDP11.ACCESS.DSPACE, data);
+    this.nStepCycles = this.nSnapCycles - PDP11.MTP_CYCLES[this.dstMode];
+};
+
+/**
+ * opMTPI(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opMTPI = function(opCode)
+{
+    /*
+     * Since MTPD and MTPI opcodes have their own unique timings for the various dst modes, we must snapshot
+     * nStepCycles before decoding the mode, and then use that to update nStepCycles.
+     */
+    var data = this.popWord();
+    this.nSnapCycles = this.nStepCycles;
+    this.updateNZVFlags(data);
+    this.writeWordToPrevSpace(opCode, PDP11.ACCESS.ISPACE, data);
+    this.nStepCycles = this.nSnapCycles - PDP11.MTP_CYCLES[this.dstMode];
+};
+
+/**
+ * opMTPS(opCode)
+ *
+ *      1064XX  MTPS - Move Byte To PSW
+ *
+ *      The 8 bits of the effective operand replace the current contents of the PS <0:7>.  The source operand
+ *      address is treated as a byte address.  Note that PS bit 4 cannot be set with this instruction.  The
+ *      src operand remains unchanged.  11/34A only.
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opMTPS = function(opCode)
+{
+    PDP11.opUndefined.call(this, opCode);
+};
+
+/**
+ * opMUL(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opMUL = function(opCode)
+{
+    var src = this.readDstWord(opCode);
+    var reg = (opCode >> 6) & 7;
+    var dst = this.regsGen[reg];
+    var result = ((src << 16) >> 16) * ((dst << 16) >> 16);
+    this.regsGen[reg] = (result >> 16) & 0xffff;
+    this.regsGen[reg | 1] = result & 0xffff;
+    this.updateMulFlags(result|0);
+    this.nStepCycles -= (22 + 1);
+};
+
+/**
+ * opNEG(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opNEG = function(opCode)
+{
+    this.updateDstWord(opCode, 0, PDP11.fnNEG);
+    this.nStepCycles -= (this.dstMode? (10 + 1) : (5 + 1));
+};
+
+/**
+ * opNEGB(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opNEGB = function(opCode)
+{
+    this.updateDstByte(opCode, 0, PDP11.fnNEGB);
+    this.nStepCycles -= (this.dstMode? (10 + 1) : (5 + 1));
+};
+
+/**
+ * opNOP(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opNOP = function(opCode)
+{
+    this.nStepCycles -= (4 + 1);        // TODO: Review (this is just a guess based on CLC)
+};
+
+/**
+ * opRESET(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opRESET = function(opCode)
+{
+    if (!(this.regPSW & PDP11.PSW.CMODE)) {
+        this.resetCPU();
+
+        if (this.panel) {
+            /*
+             * The PDP-11/70 XXDP test "EKBBF0" reports the following, with PANEL messages on ("m panel on"):
+             *
+             *      CNSW.writeWord(177570,000101) @033502
+             *      CNSW.readWord(177570): 000000 @032114
+             *      LOOK AT THE CONSOLE LIGHTS
+             *      THE DATA LIGHTS SHOULD READ 166667
+             *      THE ADDRESS LIGHTS SHOULD READ  CNSW.readWord(177570): 000000 @032150
+             *      032236
+             *      CHANGE SWITCH 7 TO CONTINUE
+             *      CNSW.readWord(177570): 000000 @032236
+             *      stopped (31518011 instructions, 358048873 cycles, 58644 ms, 6105465 hz)
+             *      R0=166667 R1=002362 R2=000000 R3=000000 R4=000000 R5=026642
+             *      SP=001074 PC=032236 PS=000344 SR=00000000 T0 N0 Z1 V0 C0
+             *      032236: 032737 000200 177570   BIT   #200,@#177570
+             *      >> tr
+             *      CNSW.readWord(177570): 000000 @032236 (cpu halted)
+             *      R0=166667 R1=002362 R2=000000 R3=000000 R4=000000 R5=026642
+             *      SP=001074 PC=032244 PS=000344 SR=00000000 T0 N0 Z1 V0 C0
+             *      032244: 001773                 BEQ   032234                 ;cycles=0
+             *      >> tr
+             *      R0=166667 R1=002362 R2=000000 R3=000000 R4=000000 R5=026642
+             *      SP=001074 PC=032234 PS=000344 SR=00000000 T0 N0 Z1 V0 C0
+             *      032234: 000005                 RESET                        ;cycles=5
+             *
+             * It's a little hard to see why the DATA lights should read 166667, since the PANEL messages indicate
+             * that the last CNSW.writeWord(177570) was for 000101, not 166667.  So I'm guessing that the RESET
+             * instruction is supposed to propagate R0 to the console's DISPLAY register.
+             *
+             * This is similar to what we do for the HALT instruction (but only if this.model == PDP11.MODEL_1120).
+             * These Console features do not seem to be very well documented, assuming they exist.
+             *
+             * UPDATE: This behavior appears to be confirmed by remarks in the PDP-11/20 Processor Handbook (1971),
+             * p. 141:
+             *
+             *      HALT - displays processor register R0 when bus control is transferred to console during a HALT
+             *      instruction.
+             *
+             *      RESET - displays register R0 for during [duration?] of RESET (70 msec).
+             *
+             * I haven't found similar remarks in the PDP-11/70 Processor Handbooks, so I'm not sure if that's an
+             * oversight or if 11/70 panels are slightly different in this regard.  It's also not clear what they meant
+             * by "for duration of RESET".  Is something supposed to happen to the DATA lights after the RESET is done?
+             */
+            this.panel.setData(this.regsGen[0], true);
+        }
+    }
+    this.nStepCycles -= 667;            // TODO: Review (but it's definitely a big number)
+};
+
+/**
+ * opROL(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opROL = function(opCode)
+{
+    this.updateDstWord(opCode, 0, PDP11.fnROL);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opROLB(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opROLB = function(opCode)
+{
+    this.updateDstByte(opCode, 0, PDP11.fnROLB);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opROR(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opROR = function(opCode)
+{
+    this.updateDstWord(opCode, 0, PDP11.fnROR);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opRORB(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opRORB = function(opCode)
+{
+    this.updateDstByte(opCode, 0, PDP11.fnRORB);
+    this.nStepCycles -= (this.dstMode? (8 + 1) + (this.dstAddr & 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opRTI(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opRTI = function(opCode)
+{
+    this.trapReturn();
+    /*
+     * Unlike RTT, RTI permits an immediate trace, which we resolve by propagating PSW.TF to OPFLAG.TRAP_TF
+     * (which, as written below, requires that both flags have the same bit value; see defines.js).
+     *
+     * NOTE: This RTI trace behavior is NEW for machines that have both RTI and RTT.  Early models didn't have RTT,
+     * so the old RTI behaved exactly like the new RTT.  Which is why the 11/20 jump table below calls opRTT() instead
+     * of opRTI() for RTI.
+     */
+    this.opFlags |= (this.regPSW & PDP11.PSW.TF);
+    this.nStepCycles -= (10 + 3);
+};
+
+/**
+ * opRTS(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opRTS = function(opCode)
+{
+    if (opCode & 0x08) {
+        PDP11.opUndefined.call(this, opCode);
+        return;
+    }
+    var src = this.popWord();
+    var reg = opCode & PDP11.OPREG.MASK;
+    /*
+     * When the popular "RTS PC" form is used, we might as well eliminate the useless setting of PC...
+     */
+    if (reg == PDP11.REG.PC) {
+        this.setPC(src);
+    } else {
+        this.setPC(this.regsGen[reg]);
+        this.regsGen[reg] = src;
+    }
+    this.nStepCycles -= (7 + 2);
+};
+
+/**
+ * opRTT(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opRTT = function(opCode)
+{
+    this.trapReturn();
+    this.nStepCycles -= (10 + 3);
+};
+
+/**
+ * opSBC(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opSBC = function(opCode)
+{
+    this.updateDstWord(opCode, this.getCF()? 1 : 0, PDP11.fnSUB);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opSBCB(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opSBCB = function(opCode)
+{
+    this.updateDstByte(opCode, this.getCF()? 1 : 0, PDP11.fnSUBB);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opSEC(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opSEC = function(opCode)
+{
+    this.setCF();
+    this.nStepCycles -= (4 + 1);
+};
+
+/**
+ * opSEN(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opSEN = function(opCode)
+{
+    this.setNF();
+    this.nStepCycles -= (4 + 1);
+};
+
+/**
+ * opSEV(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opSEV = function(opCode)
+{
+    this.setVF();
+    this.nStepCycles -= (4 + 1);
+};
+
+/**
+ * opSEZ(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opSEZ = function(opCode)
+{
+    this.setZF();
+    this.nStepCycles -= (4 + 1);
+};
+
+/**
+ * opSEx(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opSEx = function(opCode)
+{
+    if (opCode & 0x1) this.setCF();
+    if (opCode & 0x2) this.setVF();
+    if (opCode & 0x4) this.setZF();
+    if (opCode & 0x8) this.setNF();
+    /*
+     * TODO: Review whether this class of undocumented instructions really has a constant cycle time.
+     */
+    this.nStepCycles -= (4 + 1);
+};
+
+/**
+ * opSOB(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode (077Rnn)
+ */
+PDP11.opSOB = function(opCode)
+{
+    var reg = (opCode & PDP11.SRCMODE.REG) >> PDP11.SRCMODE.SHIFT;
+    if ((this.regsGen[reg] = ((this.regsGen[reg] - 1) & 0xffff))) {
+        this.setPC(this.getPC() - ((opCode & PDP11.DSTMODE.MASK) << 1));
+        this.nStepCycles += 1;          // unlike normal branches, taking this branch is actually 1 cycle faster
+    }
+    this.nStepCycles -= (5 + 1);
+};
+
+/**
+ * opSPL(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opSPL = function(opCode)
+{
+    if (!(opCode & 0x08) || this.model < PDP11.MODEL_1145) {
+        PDP11.opUndefined.call(this, opCode);
+        return;
+    }
+    if (!(this.regPSW & PDP11.PSW.CMODE)) {
+        this.regPSW = (this.regPSW & ~PDP11.PSW.PRI) | ((opCode & 0x7) << PDP11.PSW.SHIFT.PRI);
+        this.opFlags |= PDP11.OPFLAG.IRQ_DELAY;
+        this.opFlags &= ~PDP11.OPFLAG.IRQ;
+    }
+    this.nStepCycles -= (4 + 1);
+};
+
+/**
+ * opSUB(opCode)
+ *
+ * From the PDP-11/20 Processor HandBook (1971), p. 62:
+ *
+ *     Subtract src,dst (16SSDD)
+ *
+ *     Operation:
+ *          (dst) = (dst) - (src) [in detail, (dst) + ~(src) + 1 (dst)]
+ *
+ *     Condition Codes:
+ *          N: set if result < 0; cleared otherwise
+ *          Z: set if result = 0; cleared otherwise
+ *          V: set if there was arithmetic overflow as a result of the operation, that is if operands were of
+ *             opposite signs and the sign of the source was the same as the sign of the result; cleared otherwise
+ *          C: cleared if there was a carry from the most significant bit of the result; set otherwise
+ *
+ *     Description:
+ *          Subtracts the source operand from the destination operand and leaves the result at the destination address.
+ *          The orignial [sic] contents of the destination are lost. The contents of the source are not affected.
+ *          In double-precision arithmetic the C-bit, when set, indicates a "borrow".
+ *
+ *     Example:
+ *                  SUB R1,R2
+ *
+ *              BEFORE          AFTER
+ *          (R1) = 011111   (R2) = 012345
+ *          (R1) = 011111   (R2) = 001234
+ *
+ *              NZVC            NZVC
+ *              1111            0001
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opSUB = function(opCode)
+{
+    this.updateDstWord(opCode, this.readSrcWord(opCode), PDP11.fnSUB);
+    this.nStepCycles -= (this.dstMode? (8 + 1) + (this.srcReg && this.dstReg >= 6? 1 : 0) : (this.srcMode? (3 + 2) : (2 + 1)) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opSWAB(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opSWAB = function(opCode)
+{
+    this.updateDstWord(opCode, 0, PDP11.fnSWAB);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opSXT(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opSXT = function(opCode)
+{
+    this.writeDstWord(opCode, this.getNF()? 0xffff : 0, this.updateNZVFlags);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opTRAP(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opTRAP = function(opCode)
+{
+    this.trap(PDP11.TRAP.TRAP, 0, PDP11.REASON.OPCODE);
+};
+
+/**
+ * opTST(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opTST = function(opCode)
+{
+    var result = this.readDstWord(opCode);
+
+    this.updateAllFlags(result);
+    this.nStepCycles -= (this.dstMode? (3 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opTSTB(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opTSTB = function(opCode)
+{
+    var result = this.readDstByte(opCode);
+
+    this.updateAllFlags(result << 8);
+    this.nStepCycles -= (this.dstMode? (3 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opWAIT(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opWAIT = function(opCode)
+{
+    /*
+     * The original PDP-11 emulation code would actually stop emulating instructions now, relying on assorted
+     * setTimeout() callbacks, setInterval() callbacks, device XHR (XMLHttpRequest) callbacks, etc, to eventually
+     * call interrupt(), which would then transition the CPU out of its "wait" state and kickstart emulate() again.
+     *
+     * That approach isn't compatible with PCjs emulators, which prefer to rely on the simulated CPU clock to
+     * drive all simulated device updates.  This means components should call the CPU's setTimer() function, which
+     * invokes the provided callback when the number of CPU cycles that correspond to the requested number of
+     * milliseconds have elapsed.  This also gives us the ability to scale device response times as needed if the
+     * user decides to crank up CPU speed, and to freeze them along with the CPU whenever the user halts the machine.
+     *
+     * However, the PCjs approach requires the CPU to continue running.  One simple solution to this dilemma:
+     *
+     *      1) opWAIT() sets a new opFlags bit (OPFLAG.WAIT)
+     *      2) Rewind the PC back to the WAIT instruction
+     *      3) Whenever stepCPU() detects OPFLAG.WAIT, call checkInterrupts()
+     *      4) If checkInterrupts() detects an interrupt, advance PC past the WAIT and then dispatch the interrupt
+     *
+     * Technically, the PC is already exactly where it's supposed to be, so why are we wasting time with steps
+     * 2 and 4?  It's largely for the Debugger's sake, so that as long as execution is "blocked" by a WAIT, that's
+     * what you'll see in the Debugger.  I could make those steps conditioned on the presence of the Debugger,
+     * but I feel it's better to keep all code paths the same.
+     *
+     * NOTE: It's almost always a bad idea to add more checks to the inner stepCPU() loop, because every additional
+     * check can have a measurable (negative) impact on performance.  Which is why it's important to use opFlags bits
+     * whenever possible, since we can test for multiple (up to 32) exceptional conditions with a single check.
+     *
+     * We also used to update the machine's display(s) whenever transitioning to the WAIT state.  However, that
+     * caused this instruction to generate enormous overhead, and it's no longer necessary, since we now rely on
+     * a timer (the PDP-11's own KW11 60Hz Line Clock timer, to be precise) to generate periodic display updates.
+     *
+     *      if (!(this.opFlags & PDP11.OPFLAG.WAIT) && this.cmp) this.cmp.updateDisplays();
+     *
+     * Finally, it's been noted several places online that the WAIT instruction puts the contents of R0 into the
+     * Front Panel's "DATA PATH" (and possibly even directly into the "DISPLAY REGISTER", making the DATASEL switch
+     * setting irrelevant).  I can't find any supporting DEC documentation regarding this, but for now, we'll go
+     * with popular lore and propagate R0 to the panel's "active" data register.
+     */
+    if (this.panel) {
+        this.panel.setAddr(this.regsGen[7], true);
+        this.panel.setData(this.regsGen[0], true);
+    }
+    this.opFlags |= PDP11.OPFLAG.WAIT;
+    this.advancePC(-2);
+    this.nStepCycles -= 3;
+};
+
+/**
+ * opXOR(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opXOR = function(opCode)
+{
+    var reg = (opCode >> PDP11.SRCMODE.SHIFT) & PDP11.OPREG.MASK;
+    this.updateDstWord(opCode, this.regsGen[reg + this.offRegSrc], PDP11.fnXOR);
+    this.nStepCycles -= (this.dstMode? (8 + 1) : (2 + 1) + (this.dstReg == 7? 2 : 0));
+};
+
+/**
+ * opUndefined(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.opUndefined = function(opCode)
+{
+    if (DEBUGGER && this.dbg) {
+        if (this.dbg.undefinedInstruction(opCode)) return;
+    }
+    this.trap(PDP11.TRAP.RESERVED, 0, PDP11.REASON.OPCODE);
+};
+
+/**
+ * op1120(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op1120 = function(opCode)
+{
+    PDP11.aOpXnnn_1120[opCode >> 12].call(this, opCode);
+};
+
+/**
+ * op0Xnn_1120(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op0Xnn_1120 = function(opCode)
+{
+    PDP11.aOp0Xnn_1120[(opCode >> 8) & 0xf].call(this, opCode);
+};
+
+/**
+ * op0AXn_1120(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op0AXn_1120 = function(opCode)
+{
+    PDP11.aOp0AXn_1120[(opCode >> 6) & 0x3].call(this, opCode);
+};
+
+/**
+ * op0BXn_1120(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op0BXn_1120 = function(opCode)
+{
+    PDP11.aOp0BXn_1120[(opCode >> 6) & 0x3].call(this, opCode);
+};
+
+/**
+ * op0CXn_1120(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op0CXn_1120 = function(opCode)
+{
+    PDP11.aOp0CXn_1120[(opCode >> 6) & 0x3].call(this, opCode);
+};
+
+/**
+ * op00Xn_1120(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op00Xn_1120 = function(opCode)
+{
+    PDP11.aOp00Xn_1120[(opCode >> 4) & 0xf].call(this, opCode);
+};
+
+/**
+ * op00AX_1120(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op00AX_1120 = function(opCode)
+{
+    PDP11.aOp00AX_1120[opCode & 0xf].call(this, opCode);
+};
+
+/**
+ * op00BX_1120(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op00BX_1120 = function(opCode)
+{
+    PDP11.aOp00BX_1120[opCode & 0xf].call(this, opCode);
+};
+
+/**
+ * op000X_1120(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op000X_1120 = function(opCode)
+{
+    PDP11.aOp000X_1120[opCode & 0xf].call(this, opCode);
+};
+
+/**
+ * op8Xnn_1120(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op8Xnn_1120 = function(opCode)
+{
+    PDP11.aOp8Xnn_1120[(opCode >> 8) & 0xf].call(this, opCode);
+};
+
+/**
+ * op8AXn_1120(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op8AXn_1120 = function(opCode)
+{
+    PDP11.aOp8AXn_1120[(opCode >> 6) & 0x3].call(this, opCode);
+};
+
+/**
+ * op8BXn_1120(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op8BXn_1120 = function(opCode)
+{
+    PDP11.aOp8BXn_1120[(opCode >> 6) & 0x3].call(this, opCode);
+};
+
+/**
+ * op8CXn_1120(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op8CXn_1120 = function(opCode)
+{
+    PDP11.aOp8CXn_1120[(opCode >> 6) & 0x3].call(this, opCode);
+};
+
+PDP11.aOpXnnn_1120 = [
+    PDP11.op0Xnn_1120,          // 0x0nnn
+    PDP11.opMOV,                // 0x1nnn   01SSDD          11/20+  2.3
+    PDP11.opCMP,                // 0x2nnn   02SSDD          11/20+  2.3*
+    PDP11.opBIT,                // 0x3nnn   03SSDD          11/20+  2.9*
+    PDP11.opBIC,                // 0x4nnn   04SSDD          11/20+  2.9
+    PDP11.opBIS,                // 0x5nnn   05SSDD          11/20+  2.3
+    PDP11.opADD,                // 0x6nnn   06SSDD          11/20+  2.3
+    PDP11.opUndefined,          // 0x7nnn
+    PDP11.op8Xnn_1120,          // 0x8nnn
+    PDP11.opMOVB,               // 0x9nnn   11SSDD          11/20+  2.3
+    PDP11.opCMPB,               // 0xAnnn   12SSDD          11/20+  2.3
+    PDP11.opBITB,               // 0xBnnn   13SSDD          11/20+  2.9
+    PDP11.opBICB,               // 0xCnnn   14SSDD          11/20+  2.9
+    PDP11.opBISB,               // 0xDnnn   15SSDD          11/20+  2.3
+    PDP11.opSUB,                // 0xEnnn   16SSDD          11/20+  2.3
+    PDP11.opUndefined           // 0xFnnn
+];
+
+PDP11.aOp0Xnn_1120 = [
+    PDP11.op00Xn_1120,          // 0x00nn
+    PDP11.opBR,                 // 0x01nn   0004XX          11/20+  2.6
+    PDP11.opBNE,                // 0x02nn   0010XX          11/20+  2.6**
+    PDP11.opBEQ,                // 0x03nn   0014XX          11/20+  2.6**
+    PDP11.opBGE,                // 0x04nn   0020XX          11/20+  2.6**
+    PDP11.opBLT,                // 0x05nn   0024XX          11/20+  2.6**
+    PDP11.opBGT,                // 0x06nn   0030XX          11/20+  2.6**
+    PDP11.opBLE,                // 0x07nn   0034XX          11/20+  2.6**
+    PDP11.opJSR,                // 0x08nn   004RDD          11/20+  4.4
+    PDP11.opJSR,                // 0x09nn   004RDD          11/20+  4.4
+    PDP11.op0AXn_1120,          // 0x0Ann
+    PDP11.op0BXn_1120,          // 0x0Bnn
+    PDP11.op0CXn_1120,          // 0x0Cnn
+    PDP11.opUndefined,          // 0x0Dnn
+    PDP11.opUndefined,          // 0x0Enn
+    PDP11.opUndefined           // 0x0Fnn
+];
+
+PDP11.aOp0AXn_1120 = [
+    PDP11.opCLR,                // 0x0A0n   0050DD          11/20+  2.3
+    PDP11.opCOM,                // 0x0A4n   0051DD          11/20+  2.3
+    PDP11.opINC,                // 0x0A8n   0052DD          11/20+  2.3
+    PDP11.opDEC                 // 0x0ACn   0053DD          11/20+  2.3
+];
+
+PDP11.aOp0BXn_1120 = [
+    PDP11.opNEG,                // 0x0B0n   0054DD          11/20+  2.3
+    PDP11.opADC,                // 0x0B4n   0055DD          11/20+  2.3
+    PDP11.opSBC,                // 0x0B8n   0056DD          11/20+  2.3
+    PDP11.opTST                 // 0x0BCn   0057DD          11/20+  2.3*
+];
+
+PDP11.aOp0CXn_1120 = [
+    PDP11.opROR,                // 0x0C0n   0060DD          11/20+  2.3*
+    PDP11.opROL,                // 0x0C4n   0061DD          11/20+  2.3*
+    PDP11.opASR,                // 0x0C8n   0062DD          11/20+  2.3*
+    PDP11.opASL                 // 0x0CCn   0063DD          11/20+  2.3*
+];
+
+PDP11.aOp00Xn_1120 = [
+    PDP11.op000X_1120,          // 0x000n   000000-000017
+    PDP11.opUndefined,          // 0x001n   000020-000037
+    PDP11.opUndefined,          // 0x002n   000040-000057
+    PDP11.opUndefined,          // 0x003n   000060-000077
+    PDP11.opJMP,                // 0x004n   0001DD          11/20+  1.2
+    PDP11.opJMP,                // 0x005n   0001DD          11/20+  1.2
+    PDP11.opJMP,                // 0x006n   0001DD          11/20+  1.2
+    PDP11.opJMP,                // 0x007n   0001DD          11/20+  1.2
+    PDP11.opRTS,                // 0x008n   00020R          11/20+  3.5 (opRTS() will also confirm that bit 3 is clear)
+    PDP11.opUndefined,          // 0x009n   00023N
+    PDP11.op00AX_1120,          // 0x00An   000240-000257
+    PDP11.op00BX_1120,          // 0x00Bn   000260-000277
+    PDP11.opSWAB,               // 0x00Cn   0003DD          11/20+  2.3
+    PDP11.opSWAB,               // 0x00Dn   0003DD          11/20+  2.3
+    PDP11.opSWAB,               // 0x00En   0003DD          11/20+  2.3
+    PDP11.opSWAB                // 0x00Fn   0003DD          11/20+  2.3
+];
+
+PDP11.aOp000X_1120 = [
+    PDP11.opHALT,               // 0x0000   000000          11/20+  1.8
+    PDP11.opWAIT,               // 0x0001   000001          11/20+  1.8
+    PDP11.opRTT,                // 0x0002   000002          11/20+  4.8 (this is really RTI, but on the 11/20, it behaves like RTT)
+    PDP11.opBPT,                // 0x0003
+    PDP11.opIOT,                // 0x0004   000004          11/20+  9.3
+    PDP11.opRESET,              // 0x0005   000005          11/20+  20ms
+    PDP11.opUndefined,          // 0x0006
+    PDP11.opUndefined,          // 0x0007
+    PDP11.opUndefined,          // 0x0008
+    PDP11.opUndefined,          // 0x0009
+    PDP11.opUndefined,          // 0x000A
+    PDP11.opUndefined,          // 0x000B
+    PDP11.opUndefined,          // 0x000C
+    PDP11.opUndefined,          // 0x000D
+    PDP11.opUndefined,          // 0x000E
+    PDP11.opUndefined           // 0x000F
+];
+
+PDP11.aOp00AX_1120 = [
+    PDP11.opNOP,                // 0x00A0   000240          11/20+  1.5
+    PDP11.opCLC,                // 0x00A1   000241          11/20+  1.5
+    PDP11.opCLV,                // 0x00A2   000242          11/20+  1.5
+    PDP11.opCLx,                // 0x00A3   000243          11/20+  1.5
+    PDP11.opCLZ,                // 0x00A4   000244          11/20+  1.5
+    PDP11.opCLx,                // 0x00A5   000245          11/20+  1.5
+    PDP11.opCLx,                // 0x00A6   000246          11/20+  1.5
+    PDP11.opCLx,                // 0x00A7   000247          11/20+  1.5
+    PDP11.opCLN,                // 0x00A8   000250          11/20+  1.5
+    PDP11.opCLx,                // 0x00A9   000251          11/20+  1.5
+    PDP11.opCLx,                // 0x00AA   000252          11/20+  1.5
+    PDP11.opCLx,                // 0x00AB   000253          11/20+  1.5
+    PDP11.opCLx,                // 0x00AC   000254          11/20+  1.5
+    PDP11.opCLx,                // 0x00AD   000255          11/20+  1.5
+    PDP11.opCLx,                // 0x00AE   000256          11/20+  1.5
+    PDP11.opCLx                 // 0x00AF   000257          11/20+  1.5
+];
+
+PDP11.aOp00BX_1120 = [
+    PDP11.opNOP,                // 0x00B0   000260          11/20+  1.5
+    PDP11.opSEC,                // 0x00B1   000261          11/20+  1.5
+    PDP11.opSEV,                // 0x00B2   000262          11/20+  1.5
+    PDP11.opSEx,                // 0x00B3   000263          11/20+  1.5
+    PDP11.opSEZ,                // 0x00B4   000264          11/20+  1.5
+    PDP11.opSEx,                // 0x00B5   000265          11/20+  1.5
+    PDP11.opSEx,                // 0x00B6   000266          11/20+  1.5
+    PDP11.opSEx,                // 0x00B7   000267          11/20+  1.5
+    PDP11.opSEN,                // 0x00B8   000270          11/20+  1.5
+    PDP11.opSEx,                // 0x00B9   000271          11/20+  1.5
+    PDP11.opSEx,                // 0x00BA   000272          11/20+  1.5
+    PDP11.opSEx,                // 0x00BB   000273          11/20+  1.5
+    PDP11.opSEx,                // 0x00BC   000274          11/20+  1.5
+    PDP11.opSEx,                // 0x00BD   000275          11/20+  1.5
+    PDP11.opSEx,                // 0x00BE   000276          11/20+  1.5
+    PDP11.opSEx                 // 0x00BF   000277          11/20+  1.5
+];
+
+PDP11.aOp8Xnn_1120 = [
+    PDP11.opBPL,                // 0x80nn   1000XX          11/20+  2.6**
+    PDP11.opBMI,                // 0x81nn   1004XX          11/20+  2.6**
+    PDP11.opBHI,                // 0x82nn   1010XX          11/20+  2.6**
+    PDP11.opBLOS,               // 0x83nn   1014XX          11/20+  2.6**
+    PDP11.opBVC,                // 0x84nn   1020XX          11/20+  2.6**
+    PDP11.opBVS,                // 0x85nn   1024XX          11/20+  2.6**
+    PDP11.opBCC,                // 0x86nn   1030XX          11/20+  2.6**
+    PDP11.opBCS,                // 0x87nn   1034XX          11/20+  2.6**
+    PDP11.opEMT,                // 0x88nn   104000-104377   11/20+  9.3
+    PDP11.opTRAP,               // 0x89nn   104400-104777   11/20+  9.3
+    PDP11.op8AXn_1120,          // 0x8Ann
+    PDP11.op8BXn_1120,          // 0x8Bnn
+    PDP11.op8CXn_1120,          // 0x8Cnn
+    PDP11.opUndefined,          // 0x8Dnn
+    PDP11.opUndefined,          // 0x8Enn
+    PDP11.opUndefined           // 0x8Fnn
+];
+
+PDP11.aOp8AXn_1120 = [
+    PDP11.opCLRB,               // 0x8A0n   1050DD          11/20+  2.3
+    PDP11.opCOMB,               // 0x8A4n   1051DD          11/20+  2.3
+    PDP11.opINCB,               // 0x8A8n   1052DD          11/20+  2.3
+    PDP11.opDECB                // 0x8ACn   1053DD          11/20+  2.3
+];
+
+PDP11.aOp8BXn_1120 = [
+    PDP11.opNEGB,               // 0x8B0n   1054DD          11/20+  2.3
+    PDP11.opADCB,               // 0x8B4n   1055DD          11/20+  2.3
+    PDP11.opSBCB,               // 0x8B8n   1056DD          11/20+  2.3
+    PDP11.opTSTB                // 0x8BCn   1057DD          11/20+  2.3*
+];
+
+PDP11.aOp8CXn_1120 = [
+    PDP11.opRORB,               // 0x8C0n   1060DD          11/20+  2.3*
+    PDP11.opROLB,               // 0x8C4n   1061DD          11/20+  2.3*
+    PDP11.opASRB,               // 0x8C8n   1062DD          11/20+  2.3*
+    PDP11.opASLB                // 0x8CCn   1063DD          11/20+  2.3*
+];
+
+/**
+ * op1140(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op1140 = function(opCode)
+{
+    PDP11.aOpXnnn_1140[opCode >> 12].call(this, opCode);
+};
+
+/**
+ * op0Xnn_1140(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op0Xnn_1140 = function(opCode)
+{
+    PDP11.aOp0Xnn_1140[(opCode >> 8) & 0xf].call(this, opCode);
+};
+
+/**
+ * op0DXn_1140(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op0DXn_1140 = function(opCode)
+{
+    PDP11.aOp0DXn_1140[(opCode >> 6) & 0x3].call(this, opCode);
+};
+
+/**
+ * op00Xn_1140(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op00Xn_1140 = function(opCode)
+{
+    PDP11.aOp00Xn_1140[(opCode >> 4) & 0xf].call(this, opCode);
+};
+
+/**
+ * op000X_1140(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op000X_1140 = function(opCode)
+{
+    PDP11.aOp000X_1140[opCode & 0xf].call(this, opCode);
+};
+
+/**
+ * op7Xnn_1140(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op7Xnn_1140 = function(opCode)
+{
+    PDP11.aOp7Xnn_1140[(opCode >> 8) & 0xf].call(this, opCode);
+};
+
+/**
+ * op8Xnn_1140(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op8Xnn_1140 = function(opCode)
+{
+    PDP11.aOp8Xnn_1140[(opCode >> 8) & 0xf].call(this, opCode);
+};
+
+/**
+ * op8DXn_1140(opCode)
+ *
+ * @this {CPUStatePDP11}
+ * @param {number} opCode
+ */
+PDP11.op8DXn_1140 = function(opCode)
+{
+    if (this.model < PDP11.MODEL_1145) {
+        PDP11.opUndefined.call(this, opCode);
+        return;
+    }
+    PDP11.aOp8DXn_1140[(opCode >> 6) & 0x3].call(this, opCode);
+};
+
+PDP11.aOpXnnn_1140 = [
+    PDP11.op0Xnn_1140,          // 0x0nnn
+    PDP11.opMOV,                // 0x1nnn   01SSDD          11/20+  2.3
+    PDP11.opCMP,                // 0x2nnn   02SSDD          11/20+  2.3*
+    PDP11.opBIT,                // 0x3nnn   03SSDD          11/20+  2.9*
+    PDP11.opBIC,                // 0x4nnn   04SSDD          11/20+  2.9
+    PDP11.opBIS,                // 0x5nnn   05SSDD          11/20+  2.3
+    PDP11.opADD,                // 0x6nnn   06SSDD          11/20+  2.3
+    PDP11.op7Xnn_1140,          // 0x7nnn
+    PDP11.op8Xnn_1140,          // 0x8nnn
+    PDP11.opMOVB,               // 0x9nnn   11SSDD          11/20+  2.3
+    PDP11.opCMPB,               // 0xAnnn   12SSDD          11/20+  2.3
+    PDP11.opBITB,               // 0xBnnn   13SSDD          11/20+  2.9
+    PDP11.opBICB,               // 0xCnnn   14SSDD          11/20+  2.9
+    PDP11.opBISB,               // 0xDnnn   15SSDD          11/20+  2.3
+    PDP11.opSUB,                // 0xEnnn   16SSDD          11/20+  2.3
+    PDP11.opUndefined           // 0xFnnn
+];
+
+PDP11.aOp0Xnn_1140 = [
+    PDP11.op00Xn_1140,          // 0x00nn
+    PDP11.opBR,                 // 0x01nn   0004XX          11/20+  2.6
+    PDP11.opBNE,                // 0x02nn   0010XX          11/20+  2.6**
+    PDP11.opBEQ,                // 0x03nn   0014XX          11/20+  2.6**
+    PDP11.opBGE,                // 0x04nn   0020XX          11/20+  2.6**
+    PDP11.opBLT,                // 0x05nn   0024XX          11/20+  2.6**
+    PDP11.opBGT,                // 0x06nn   0030XX          11/20+  2.6**
+    PDP11.opBLE,                // 0x07nn   0034XX          11/20+  2.6**
+    PDP11.opJSR,                // 0x08nn   004RDD          11/20+  4.4
+    PDP11.opJSR,                // 0x09nn   004RDD          11/20+  4.4
+    PDP11.op0AXn_1120,          // 0x0Ann
+    PDP11.op0BXn_1120,          // 0x0Bnn
+    PDP11.op0CXn_1120,          // 0x0Cnn
+    PDP11.op0DXn_1140,          // 0x0Dnn
+    PDP11.opUndefined,          // 0x0Enn
+    PDP11.opUndefined           // 0x0Fnn
+];
+
+PDP11.aOp0DXn_1140 = [
+    PDP11.opMARK,               // 0x0D0n                   11/40+          LEIS
+    PDP11.opMFPI,               // 0x0D4n                   11/40+
+    PDP11.opMTPI,               // 0x0D8n                   11/40+
+    PDP11.opSXT                 // 0x0DCn                   11/40+          LEIS
+];
+
+PDP11.aOp00Xn_1140 = [
+    PDP11.op000X_1140,          // 0x000n   000000-000017
+    PDP11.opUndefined,          // 0x001n   000020-000037
+    PDP11.opUndefined,          // 0x002n   000040-000057
+    PDP11.opUndefined,          // 0x003n   000060-000077
+    PDP11.opJMP,                // 0x004n   0001DD          11/20+  1.2
+    PDP11.opJMP,                // 0x005n   0001DD          11/20+  1.2
+    PDP11.opJMP,                // 0x006n   0001DD          11/20+  1.2
+    PDP11.opJMP,                // 0x007n   0001DD          11/20+  1.2
+    PDP11.opRTS,                // 0x008n   00020R          11/20+  3.5 (opRTS() will also confirm that bit 3 is clear)
+    PDP11.opSPL,                // 0x009n   00023N          11/45+      (opSPL() will also confirm that bit 3 is set)
+    PDP11.op00AX_1120,          // 0x00An   000240-000257
+    PDP11.op00BX_1120,          // 0x00Bn   000260-000277
+    PDP11.opSWAB,               // 0x00Cn   0003DD          11/20+  2.3
+    PDP11.opSWAB,               // 0x00Dn   0003DD          11/20+  2.3
+    PDP11.opSWAB,               // 0x00En   0003DD          11/20+  2.3
+    PDP11.opSWAB                // 0x00Fn   0003DD          11/20+  2.3
+];
+
+PDP11.aOp000X_1140 = [
+    PDP11.opHALT,               // 0x0000   000000          11/20+  1.8
+    PDP11.opWAIT,               // 0x0001   000001          11/20+  1.8
+    PDP11.opRTI,                // 0x0002   000002          11/20+  4.8
+    PDP11.opBPT,                // 0x0003   000003
+    PDP11.opIOT,                // 0x0004   000004          11/20+  9.3
+    PDP11.opRESET,              // 0x0005   000005          11/20+  20ms
+    PDP11.opRTT,                // 0x0006   000006          11/40+          LEIS
+    PDP11.opMFPT,               // 0x0007   000007          11/44+
+    PDP11.opUndefined,          // 0x0008
+    PDP11.opUndefined,          // 0x0009
+    PDP11.opUndefined,          // 0x000A
+    PDP11.opUndefined,          // 0x000B
+    PDP11.opUndefined,          // 0x000C
+    PDP11.opUndefined,          // 0x000D
+    PDP11.opUndefined,          // 0x000E
+    PDP11.opUndefined           // 0x000F
+];
+
+PDP11.aOp7Xnn_1140 = [
+    PDP11.opMUL,                // 0x70nn                   11/40+          EIS
+    PDP11.opMUL,                // 0x71nn                   11/40+          EIS
+    PDP11.opDIV,                // 0x72nn                   11/40+          EIS
+    PDP11.opDIV,                // 0x73nn                   11/40+          EIS
+    PDP11.opASH,                // 0x74nn                   11/40+          EIS
+    PDP11.opASH,                // 0x75nn                   11/40+          EIS
+    PDP11.opASHC,               // 0x76nn                   11/40+          EIS
+    PDP11.opASHC,               // 0x77nn                   11/40+          EIS
+    PDP11.opXOR,                // 0x78nn                   11/40+          LEIS
+    PDP11.opXOR,                // 0x79nn                   11/40+          LEIS
+    PDP11.opUndefined,          // 0x7Ann
+    PDP11.opUndefined,          // 0x7Bnn
+    PDP11.opUndefined,          // 0x7Cnn
+    PDP11.opUndefined,          // 0x7Dnn
+    PDP11.opSOB,                // 0x7Enn                   11/40+          LEIS
+    PDP11.opSOB                 // 0x7Fnn                   11/40+          LEIS
+];
+
+PDP11.aOp8Xnn_1140 = [
+    PDP11.opBPL,                // 0x80nn   1000XX          11/20+  2.6**
+    PDP11.opBMI,                // 0x81nn   1004XX          11/20+  2.6**
+    PDP11.opBHI,                // 0x82nn   1010XX          11/20+  2.6**
+    PDP11.opBLOS,               // 0x83nn   1014XX          11/20+  2.6**
+    PDP11.opBVC,                // 0x84nn   1020XX          11/20+  2.6**
+    PDP11.opBVS,                // 0x85nn   1024XX          11/20+  2.6**
+    PDP11.opBCC,                // 0x86nn   1030XX          11/20+  2.6**
+    PDP11.opBCS,                // 0x87nn   1034XX          11/20+  2.6**
+    PDP11.opEMT,                // 0x88nn   104000-104377   11/20+  9.3
+    PDP11.opTRAP,               // 0x89nn   104400-104777   11/20+  9.3
+    PDP11.op8AXn_1120,          // 0x8Ann   1050XX
+    PDP11.op8BXn_1120,          // 0x8Bnn   1054XX
+    PDP11.op8CXn_1120,          // 0x8Cnn   1060XX
+    PDP11.op8DXn_1140,          // 0x8Dnn   106400-106777
+    PDP11.opUndefined,          // 0x8Enn   1070XX
+    PDP11.opUndefined           // 0x8Fnn   1074XX
+];
+
+PDP11.aOp8DXn_1140 = [
+    PDP11.opMTPS,               // 0x8D0n   1064XX          11/34A only
+    PDP11.opMFPD,               // 0x8D4n   1065XX          11/45+
+    PDP11.opMTPD,               // 0x8D8n   1066XX          11/45+
+    PDP11.opMFPS                // 0x8DCn   1067XX          11/34A only
+];
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/rom.js (C) Jeff Parsons 2012-2017
+ */
+
+
+class ROMPDP11 extends Component {
+    /**
+     * ROMPDP11(parmsROM)
+     *
+     * The ROMPDP11 component expects the following (parmsROM) properties:
+     *
+     *      addr: physical address of ROM
+     *      size: amount of ROM, in bytes
+     *      alias: physical alias address (null if none)
+     *      file: name of ROM data file
+     *
+     * NOTE: The ROM data will not be copied into place until the Bus is ready (see initBus()) AND
+     * the ROM data file has finished loading (see finishLoad()).
+     *
+     * Also, while the size parameter may seem redundant, I consider it useful to confirm that the ROM
+     * you received is the ROM you expected.
+     *
+     * @param {Object} parmsROM
+     */
+    constructor(parmsROM)
+    {
+        super("ROM", parmsROM, MessagesPDP11.ROM);
+
+        this.abInit = null;
+        this.aSymbols = null;
+
+        this.addrROM = +parmsROM['addr'];
+        this.sizeROM = +parmsROM['size'];
+        this.fRetainROM = false;
+
+        /*
+         * The new 'alias' property can now be EITHER a single physical address (like 'addr') OR an array of
+         * physical addresses; eg:
+         *
+         *      [0xf0000,0xffff0000,0xffff8000]
+         *
+         * We could have overloaded 'addr' to accomplish the same thing, but I think it's better to have any
+         * aliased locations listed under a separate property.
+         *
+         * Most ROMs are not aliased, in which case the 'alias' property should have the default value of null.
+         */
+        this.addrAlias = parmsROM['alias'];
+        if (typeof this.addrAlias == "string") {
+            this.addrAlias = eval(this.addrAlias);
+        }
+
+        this.sFilePath = parmsROM['file'];
+        this.sFileName = Str.getBaseName(this.sFilePath);
+
+        if (this.sFilePath) {
+            var sFileURL = this.sFilePath;
+            if (DEBUG) this.log('load("' + sFileURL + '")');
+            /*
+             * If the selected ROM file has a ".json" extension, then we assume it's pre-converted
+             * JSON-encoded ROM data, so we load it as-is; ditto for ROM files with a ".hex" extension.
+             * Otherwise, we ask our server-side ROM converter to return the file in a JSON-compatible format.
+             */
+            var sFileExt = Str.getExtension(this.sFileName);
+            if (sFileExt != DumpAPI.FORMAT.JSON && sFileExt != DumpAPI.FORMAT.HEX) {
+                sFileURL = Web.getHost() + DumpAPI.ENDPOINT + '?' + DumpAPI.QUERY.FILE + '=' + this.sFilePath + '&' + DumpAPI.QUERY.FORMAT + '=' + DumpAPI.FORMAT.BYTES + '&' + DumpAPI.QUERY.DECIMAL + '=true';
+            }
+            var rom = this;
+            Web.getResource(sFileURL, null, true, function doneLoad(sURL, sResponse, nErrorCode) {
+                rom.finishLoad(sURL, sResponse, nErrorCode);
+            });
+        }
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {ROMPDP11}
+     * @param {ComputerPDP11} cmp
+     * @param {BusPDP11} bus
+     * @param {CPUStatePDP11} cpu
+     * @param {DebuggerPDP11} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+        this.initROM();
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {ROMPDP11}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (this.aSymbols) {
+            if (this.dbg) {
+                this.dbg.addSymbols(this.id, this.addrROM, this.sizeROM, this.aSymbols);
+            }
+            /*
+             * Our only role in the handling of symbols is to hand them off to the Debugger at our
+             * first opportunity. Now that we've done that, our copy of the symbols, if any, are toast.
+             */
+            delete this.aSymbols;
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * Since we have nothing to do on powerDown(), and no state to return, we could simply omit
+     * this function.  But it doesn't hurt anything, and maybe we'll use our state to save something
+     * useful down the road, like user-defined symbols (ie, symbols that the Debugger may have
+     * created, above and beyond those symbols we automatically loaded, if any, along with the ROM).
+     *
+     * @this {ROMPDP11}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return true;
+    }
+
+    /**
+     * finishLoad(sURL, sData, nErrorCode)
+     *
+     * @this {ROMPDP11}
+     * @param {string} sURL
+     * @param {string} sData
+     * @param {number} nErrorCode (response from server if anything other than 200)
+     */
+    finishLoad(sURL, sData, nErrorCode)
+    {
+        if (nErrorCode) {
+            this.notice("Unable to load ROM resource (error " + nErrorCode + ": " + sURL + ")");
+            this.sFilePath = null;
+        }
+        else {
+            Component.addMachineResource(this.idMachine, sURL, sData);
+            var resource = Web.parseMemoryResource(sURL, sData);
+            if (resource) {
+                this.abInit = resource.aBytes;
+                this.aSymbols = resource.aSymbols;
+            } else {
+                this.sFilePath = null;
+            }
+        }
+        this.initROM();
+    }
+
+    /**
+     * initROM()
+     *
+     * This function is called by both initBus() and finishLoad(), but it cannot copy the initial data into place
+     * until after initBus() has received the Bus component AND finishLoad() has received the data.  When both those
+     * criteria are satisfied, the component becomes "ready".
+     *
+     * @this {ROMPDP11}
+     */
+    initROM()
+    {
+        if (!this.isReady()) {
+            if (this.sFilePath) {
+                /*
+                 * Too early...
+                 */
+                if (!this.abInit || !this.bus) return;
+
+                /*
+                 * If no explicit size was specified, then use whatever the actual size is.
+                 */
+                if (!this.sizeROM) {
+                    this.sizeROM = this.abInit.length;
+                }
+                if (this.abInit.length != this.sizeROM) {
+                    /*
+                     * Note that setError() sets the component's fError flag, which in turn prevents setReady() from
+                     * marking the component ready.  TODO: Revisit this decision.  On the one hand, it sounds like a
+                     * good idea to stop the machine in its tracks whenever a setError() occurs, but there may also be
+                     * times when we'd like to forge ahead anyway.
+                     */
+                    this.setError("ROM size (" + Str.toHexLong(this.abInit.length) + ") does not match specified size (" + Str.toHexLong(this.sizeROM) + ")");
+                }
+                else if (this.addROM(this.addrROM)) {
+
+                    var aliases = [];
+                    if (typeof this.addrAlias == "number") {
+                        aliases.push(this.addrAlias);
+                    } else if (this.addrAlias != null && this.addrAlias.length) {
+                        aliases = this.addrAlias;
+                    }
+                    for (var i = 0; i < aliases.length; i++) {
+                        this.cloneROM(aliases[i]);
+                    }
+                    /*
+                     * We used to hang onto the initial ROM data so that we could restore any bytes the CPU overwrote,
+                     * using memory write-notification handlers, but with the introduction of read-only memory blocks, that's
+                     * no longer necessary.
+                     *
+                     * TODO: Consider an option to retain the ROM data, and give the user some way of restoring ROMs.
+                     * That may be useful for "resumable" machines that save/restore all dirty block of memory, regardless
+                     * whether they're ROM or RAM.  However, the only way to modify a machine's ROM is with the Debugger,
+                     * and Debugger users should know better.
+                     */
+                    if (!this.fRetainROM) {
+                        delete this.abInit;
+                    }
+                }
+            }
+            this.setReady();
+        }
+    }
+
+    /**
+     * addROM(addr)
+     *
+     * @this {ROMPDP11}
+     * @param {number} addr
+     * @return {boolean}
+     */
+    addROM(addr)
+    {
+        if (addr >= BusPDP11.IOPAGE_16BIT && addr < BusPDP11.IOPAGE_16BIT + BusPDP11.IOPAGE_LENGTH) {
+            /*
+             * This code has been added as a work-around to effectively allow us to install small ROMs into portions
+             * of the IOPAGE address space, by installing I/O handlers for the entire range that return the corresponding
+             * bytes of the current ROM image on reads, and ignore any writes (which I'm only assuming is how a typical
+             * ROM "device" deals with writes; we could remove the write handler, but then writes would fault).
+             *
+             * TODO: It would be more efficient if we parsed ROM data as words rather than bytes, and then installed
+             * only word handlers instead of only byte handlers.  It was done this way purely for historical reasons (ie,
+             * because that's how other PCjs machines parse their ROMs).  For now, all this means is that executing code
+             * out of ROM will be slower than out of RAM -- although that's often true in the real world as well.
+             */
+            var IOTable = {
+                [addr]: [ROMPDP11.prototype.readROMByte, ROMPDP11.prototype.writeROMByte, null, null, null, this.sizeROM >> 1]
+            };
+            if (this.bus.addIOTable(this, IOTable)) {
+                this.status("Added " + this.sizeROM + "-byte ROM at " + Str.toOct(addr));
+                this.fRetainROM = true;
+                return true;
+            }
+        }
+        else if (this.bus.addMemory(addr, this.sizeROM, MemoryPDP11.TYPE.ROM)) {
+            if (DEBUG) this.log("addROM(): copying ROM to " + Str.toHexLong(addr) + " (" + Str.toHexLong(this.abInit.length) + " bytes)");
+            var i;
+            for (i = 0; i < this.abInit.length; i++) {
+                this.bus.setByteDirect(addr + i, this.abInit[i]);
+            }
+            return true;
+        }
+
+        /*
+         * We don't need to report an error here, because addMemory() already takes care of that.
+         */
+        return false;
+    }
+
+    /**
+     * cloneROM(addr)
+     *
+     * For ROMs with one or more alias addresses, we used to call addROM() for each address.  However,
+     * that obviously wasted memory, since each alias was an independent copy, and if you used the
+     * Debugger to edit the ROM in one location, the changes would not appear in the other location(s).
+     *
+     * Now that the Bus component provides low-level getMemoryBlocks() and setMemoryBlocks() methods
+     * to manually get and set the blocks of any memory range, it is now possible to create true aliases.
+     *
+     * @this {ROMPDP11}
+     * @param {number} addr
+     */
+    cloneROM(addr)
+    {
+        var aBlocks = this.bus.getMemoryBlocks(this.addrROM, this.sizeROM);
+        this.bus.setMemoryBlocks(addr, this.sizeROM, aBlocks);
+    }
+
+    /**
+     * readROMByte(addr)
+     *
+     * @this {ROMPDP11}
+     * @param {number} addr
+     * @return {number}
+     */
+    readROMByte(addr)
+    {
+        var i = (addr - this.addrROM);
+        return this.abInit[i];
+    }
+
+    /**
+     * writeROMByte(data, addr)
+     *
+     * This handler exists simply to ignore any writes, so that they don't cause faults.
+     *
+     * TODO: Another possible use for this would be to allow the Debugger to alter ROM contents,
+     * if the Debugger were to provide an interface indicating whether or not it was responsible
+     * for this write.
+     *
+     * @this {ROMPDP11}
+     * @param {number} data
+     * @param {number} addr
+     */
+    writeROMByte(data, addr)
+    {
+    }
+
+    /**
+     * ROMPDP11.init()
+     *
+     * This function operates on every HTML element of class "rom", extracting the
+     * JSON-encoded parameters for the ROMPDP11 constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a ROMPDP11 component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeROM = Component.getElementsByClass(document, PDP11.APPCLASS, "rom");
+        for (var iROM = 0; iROM < aeROM.length; iROM++) {
+            var eROM = aeROM[iROM];
+            var parmsROM = Component.getComponentParms(eROM);
+            var rom = new ROMPDP11(parmsROM);
+            Component.bindComponentControls(rom, eROM, PDP11.APPCLASS);
+        }
+    }
+}
+
+/*
+ * NOTE: There's currently no need for this component to have a reset() function, since
+ * once the ROM data is loaded, it can't be changed, so there's nothing to reinitialize.
+ *
+ * OK, well, I take that back, because the Debugger, if installed, has the ability to modify
+ * ROM contents, so in that case, having a reset() function that restores the original ROM data
+ * might be useful; then again, it might not, depending on what you're trying to debug.
+ *
+ * If we do add reset(), then we'll want to change initROM() to hang onto the original
+ * ROM data; currently, we release it after copying it into the read-only memory allocated
+ * via bus.addMemory().
+ */
+
+/*
+ * Initialize all the ROMPDP11 modules on the page.
+ */
+Web.onInit(ROMPDP11.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/ram.js (C) Jeff Parsons 2012-2017
+ */
+
+
+class RAMPDP11 extends Component {
+    /**
+     * RAMPDP11(parmsRAM)
+     *
+     * The RAMPDP11 component expects the following (parmsRAM) properties:
+     *
+     *      addr: starting physical address of RAM (default is 0)
+     *      size: amount of RAM, in bytes (default is 0, which means defer to motherboard switch settings)
+     *      file: name of optional data file to load into RAM (default is "")
+     *      load: optional file load address (overrides any load address specified in the data file; default is null)
+     *      exec: optional file exec address (overrides any exec address specified in the data file; default is null)
+     *
+     * NOTE: We make a note of the specified size, but no memory is initially allocated for the RAM until the
+     * Computer component calls powerUp().
+     *
+     * TODO: I seem to recall a PDP-11 diagnostic that failed if total RAM wasn't a multiple of 16Kb; our Bus
+     * component defaults to a block size that matches BusPDP11.IOPAGE_LENGTH (ie, 8Kb), and we even allow partial
+     * block allocations, so internally, we don't have that requirement, but for better compatibility, perhaps we
+     * should display a non-fatal warning if addr or size don't fall on 16Kb boundaries.
+     *
+     * @param {Object} parmsRAM
+     */
+    constructor(parmsRAM)
+    {
+        super("RAM", parmsRAM);
+
+        this.abInit = null;
+        this.aSymbols = null;
+
+        this.addrRAM = +parmsRAM['addr'];
+        this.sizeRAM = +parmsRAM['size'];
+
+        this.addrLoad = parmsRAM['load'];
+        this.addrExec = parmsRAM['exec'];
+        if (this.addrLoad != null) this.addrLoad = +this.addrLoad;
+        if (this.addrExec != null) this.addrExec = +this.addrExec;
+
+        this.fInstalled = (!!this.sizeRAM); // 0 is the default value for 'size' when none is specified
+        this.fAllocated = this.fReset = false;
+
+        this.sFilePath = parmsRAM['file'];
+        this.sFileName = Str.getBaseName(this.sFilePath);
+
+        if (this.sFilePath) {
+            var sFileURL = this.sFilePath;
+            if (DEBUG) this.log('load("' + sFileURL + '")');
+            /*
+             * If the selected data file has a ".json" extension, then we assume it's pre-converted
+             * JSON-encoded data, so we load it as-is; ditto for ROM files with a ".hex" extension.
+             * Otherwise, we ask our server-side converter to return the file in a JSON-compatible format.
+             */
+            var sFileExt = Str.getExtension(this.sFileName);
+            if (sFileExt != DumpAPI.FORMAT.JSON && sFileExt != DumpAPI.FORMAT.HEX) {
+                sFileURL = Web.getHost() + DumpAPI.ENDPOINT + '?' + DumpAPI.QUERY.FILE + '=' + this.sFilePath + '&' + DumpAPI.QUERY.FORMAT + '=' + DumpAPI.FORMAT.BYTES + '&' + DumpAPI.QUERY.DECIMAL + '=true';
+            }
+            var ram = this;
+            Web.getResource(sFileURL, null, true, function doneLoad(sURL, sResponse, nErrorCode) {
+                ram.finishLoad(sURL, sResponse, nErrorCode);
+            });
+        }
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {RAMPDP11}
+     * @param {ComputerPDP11} cmp
+     * @param {BusPDP11} bus
+     * @param {CPUStatePDP11} cpu
+     * @param {DebuggerPDP11} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+        this.initRAM();
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {RAMPDP11}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (this.aSymbols) {
+            if (this.dbg) {
+                this.dbg.addSymbols(this.id, this.addrRAM, this.sizeRAM, this.aSymbols);
+            }
+            /*
+             * Our only role in the handling of symbols is to hand them off to the Debugger at our
+             * first opportunity. Now that we've done that, our copy of the symbols, if any, are toast.
+             */
+            delete this.aSymbols;
+        }
+        if (!fRepower) {
+            /*
+             * Since we use the Bus to allocate all our memory, memory contents are already restored for us,
+             * so we don't save any state, and therefore no state should be restored.  Just do a reset().
+             */
+
+            this.reset();
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {RAMPDP11}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        /*
+         * The Computer powers down the CPU first, at which point CPUState state is saved,
+         * which includes the Bus state, and since we use the Bus component to allocate all
+         * our memory, memory contents are already saved for us, so we don't need the usual
+         * save logic.
+         */
+        return true;
+    }
+
+    /**
+     * finishLoad(sURL, sData, nErrorCode)
+     *
+     * @this {RAMPDP11}
+     * @param {string} sURL
+     * @param {string} sData
+     * @param {number} nErrorCode (response from server if anything other than 200)
+     */
+    finishLoad(sURL, sData, nErrorCode)
+    {
+        if (nErrorCode) {
+            this.notice("Unable to load RAM resource (error " + nErrorCode + ": " + sURL + ")");
+            this.sFilePath = null;
+        }
+        else {
+            Component.addMachineResource(this.idMachine, sURL, sData);
+            var resource = Web.parseMemoryResource(sURL, sData);
+            if (resource) {
+                this.abInit = resource.aBytes;
+                this.aSymbols = resource.aSymbols;
+                if (this.addrLoad == null) this.addrLoad = resource.addrLoad;
+                if (this.addrExec == null) this.addrExec = resource.addrExec;
+            } else {
+                this.sFilePath = null;
+            }
+        }
+        this.initRAM();
+    }
+
+    /**
+     * initRAM()
+     *
+     * This function is called by both initBus() and finishLoad(), but it cannot copy the initial data into place
+     * until after initBus() has received the Bus component AND finishLoad() has received the data.  When both those
+     * criteria are satisfied, the component becomes "ready".
+     *
+     * @this {RAMPDP11}
+     */
+    initRAM()
+    {
+        if (!this.bus) return;
+
+        if (!this.fAllocated && this.sizeRAM) {
+            if (this.bus.addMemory(this.addrRAM, this.sizeRAM, MemoryPDP11.TYPE.RAM)) {
+                this.fAllocated = true;
+            } else {
+                this.sizeRAM = 0;           // don't bother trying again (it just results in redundant error messages)
+            }
+        }
+        if (!this.isReady()) {
+            if (!this.fAllocated) {
+                Component.error("No RAM allocated");
+            }
+            else if (this.sFilePath) {
+                /*
+                 * Too early...
+                 */
+                if (!this.abInit) return;
+
+                if (this.loadImage(this.abInit, this.addrLoad, this.addrExec, this.addrRAM)) {
+                    this.status('Loaded image "' + this.sFileName + '"');
+                } else {
+                    this.notice('Error loading image "' + this.sFileName + '"');
+                }
+
+                /*
+                 * NOTE: We now retain this data, so that reset() can return the RAM to its predefined state.
+                 *
+                 *      delete this.abInit;
+                 */
+            }
+            this.fReset = true;
+            this.setReady();
+        }
+    }
+
+    /**
+     * reset()
+     *
+     * @this {RAMPDP11}
+     */
+    reset()
+    {
+        if (this.fAllocated && !this.fReset) {
+            /*
+             * TODO: Add a configuration parameter for selecting the byte pattern on reset?
+             * Note that when memory blocks are originally created, they are currently always
+             * zero-initialized, so this would only affect resets.
+             */
+            this.bus.zeroMemory(this.addrRAM, this.sizeRAM, 0);
+            if (this.abInit) {
+                this.loadImage(this.abInit, this.addrLoad, this.addrExec, this.addrRAM, !this.dbg);
+            }
+        }
+        this.fReset = false;
+    }
+
+    /**
+     * loadImage(aBytes, addrLoad, addrExec, addrInit, fStart)
+     *
+     * If the array contains a PAPER tape image in the "Absolute Format," load it as specified
+     * by the format; otherwise, load it as-is using the address(es) supplied.
+     *
+     * @this {RAMPDP11}
+     * @param {Array|Uint8Array} aBytes
+     * @param {number|null} [addrLoad]
+     * @param {number|null} [addrExec] (this CAN override any starting address INSIDE the image)
+     * @param {number|null} [addrInit]
+     * @param {boolean} [fStart]
+     * @return {boolean} (true if loaded, false if not)
+     */
+    loadImage(aBytes, addrLoad, addrExec, addrInit, fStart)
+    {
+        var fStop = false;
+        var fLoaded = false;
+        /*
+         * Data on tapes in the "Absolute Format" is organized into blocks; each block begins with
+         * a 6-byte header:
+         *
+         *      2-byte signature (0x0001)
+         *      2-byte block length (N + 6, because it includes the 6-byte header)
+         *      2-byte load address
+         *
+         * followed by N data bytes.  If N is zero, then the 2-byte load address is the exec address,
+         * unless the address is odd (usually 1).  DEC's Absolute Loader jumps to the exec address
+         * in former case, halts in the latter.
+         *
+         * All values are stored "little endian" (low byte followed by high byte), just like the
+         * PDP-11's memory architecture.
+         *
+         * After the data bytes, there is a single checksum byte.  The 8-bit sum of all the bytes in
+         * the block (including the header bytes and checksum byte) should be zero.
+         *
+         * ANOMALIES: Tape files don't always begin with a signature word, so I allow any number of
+         * leading zeros before the first signature.  Tape files don't always end cleanly either, so as
+         * soon as I see an invalid signature, I break out of the loop without signalling an error, as
+         * long as at least ONE block was successfully processed.  In fact, it's possible that as
+         * soon as a block with ZERO data bytes is encountered, processing is supposed to stop, but
+         * I haven't examined enough tapes (or the Absolute Loader code) to know for sure.
+         */
+        if (addrLoad == null) {
+            var off = 0, fError = false;
+            while (off < aBytes.length - 1) {
+                var w = (aBytes[off] & 0xff) | ((aBytes[off+1] & 0xff) << 8);
+                if (!w) {           // ignore pairs of leading zeros
+                    off += 2;
+                    continue;
+                }
+                if (!(w & 0xff)) {  // as well as single bytes of zero
+                    off++;
+                    continue;
+                }
+                var offBlock = off;
+                if (w != 0x0001) {
+                    this.printMessage("invalid signature (" + Str.toHexWord(w) + ") at offset " + Str.toHexWord(offBlock), MessagesPDP11.PAPER);
+                    break;
+                }
+                if (off + 6 >= aBytes.length) {
+                    this.printMessage("invalid block at offset " + Str.toHexWord(offBlock), MessagesPDP11.PAPER);
+                    break;
+                }
+                off += 2;
+                var checksum = w;
+                var len = (aBytes[off++] & 0xff) | ((aBytes[off++] & 0xff) << 8);
+                var addr = (aBytes[off++] & 0xff) | ((aBytes[off++] & 0xff) << 8);
+                checksum += (len & 0xff) + (len >> 8) + (addr & 0xff) + (addr >> 8);
+                var offData = off, cbData = len -= 6;
+                while (len > 0 && off < aBytes.length) {
+                    checksum += aBytes[off++] & 0xff;
+                    len--;
+                }
+                if (len != 0 || off >= aBytes.length) {
+                    this.printMessage("insufficient data for block at offset " + Str.toHexWord(offBlock), MessagesPDP11.PAPER);
+                    break;
+                }
+                checksum += aBytes[off++] & 0xff;
+                if (checksum & 0xff) {
+                    this.printMessage("invalid checksum (" + Str.toHexByte(checksum) + ") for block at offset " + Str.toHexWord(offBlock), MessagesPDP11.PAPER);
+                    break;
+                }
+                if (!cbData) {
+                    if (addr & 0x1) {
+                        fStop = true;
+                    } else {
+                        if (addrExec == null) addrExec = addr;
+                    }
+                    if (addrExec != null) this.printMessage("starting address: " + Str.toHexWord(addrExec), MessagesPDP11.PAPER);
+                } else {
+                    this.printMessage("loading " + Str.toHexWord(cbData) + " bytes at " + Str.toHexWord(addr) + "-" + Str.toHexWord(addr + cbData), MessagesPDP11.PAPER);
+                    while (cbData--) {
+                        this.bus.setByteDirect(addr++, aBytes[offData++] & 0xff);
+                    }
+                }
+                fLoaded = true;
+            }
+        }
+        if (!fLoaded) {
+            if (addrLoad == null) addrLoad = addrInit;
+            if (addrLoad != null) {
+                for (var i = 0; i < aBytes.length; i++) {
+                    this.bus.setByteDirect(addrLoad + i, aBytes[i]);
+                }
+                fLoaded = true;
+            }
+        }
+        if (fLoaded) {
+            /*
+             * Set the start address to whatever the caller provided, or failing that, whatever start
+             * address was specified inside the image.
+             *
+             * For example, the diagnostic "MAINDEC-11-D0AA-PB" doesn't include a start address inside the
+             * image, but we know that the directions for that diagnostic say to "Start and Restart at 200",
+             * so we have manually inserted an "exec":128 in the JSON containing the image.
+             */
+            if (addrExec == null || fStop) {
+                this.cpu.stopCPU();
+                fStart = false;
+            }
+            if (addrExec != null) {
+                this.cpu.setReset(addrExec, fStart);
+            }
+        }
+        return fLoaded;
+    }
+
+    /**
+     * RAMPDP11.init()
+     *
+     * This function operates on every HTML element of class "ram", extracting the
+     * JSON-encoded parameters for the RAMPDP11 constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a RAMPDP11 component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeRAM = Component.getElementsByClass(document, PDP11.APPCLASS, "ram");
+        for (var iRAM = 0; iRAM < aeRAM.length; iRAM++) {
+            var eRAM = aeRAM[iRAM];
+            var parmsRAM = Component.getComponentParms(eRAM);
+            var ram = new RAMPDP11(parmsRAM);
+            Component.bindComponentControls(ram, eRAM, PDP11.APPCLASS);
+        }
+    }
+}
+
+/*
+ * Initialize all the RAMPDP11 modules on the page.
+ */
+Web.onInit(RAMPDP11.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/keyboard.js (C) Jeff Parsons 2012-2017
+ */
+
+
+class KeyboardPDP11 extends Component {
+    /**
+     * KeyboardPDP11(parmsKbd)
+     *
+     * @param {Object} parmsKbd
+     */
+    constructor(parmsKbd)
+    {
+        super("Keyboard", parmsKbd, MessagesPDP11.KEYBOARD);
+
+        this.setReady();
+    }
+
+    /**
+     * setBinding(sType, sBinding, control, sValue)
+     *
+     * @this {KeyboardPDP11}
+     * @param {string|null} sType is the type of the HTML control (eg, "button", "textarea", "register", "flag", "rled", etc)
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "esc")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sType, sBinding, control, sValue)
+    {
+        return false;
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {KeyboardPDP11}
+     * @param {ComputerPDP11} cmp
+     * @param {BusPDP11} bus
+     * @param {CPUStatePDP11} cpu
+     * @param {DebuggerPDP11} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cmp = cmp;
+        this.cpu = cpu;
+        this.dbg = dbg;         // NOTE: The "dbg" property must be set for the message functions to work
+    }
+
+    /**
+     * KeyboardPDP11.init()
+     *
+     * This function operates on every HTML element of class "keyboard", extracting the
+     * JSON-encoded parameters for the Keyboard constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a Keyboard component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeKbd = Component.getElementsByClass(document, PDP11.APPCLASS, "keyboard");
+        for (var iKbd = 0; iKbd < aeKbd.length; iKbd++) {
+            var eKbd = aeKbd[iKbd];
+            var parmsKbd = Component.getComponentParms(eKbd);
+            var kbd = new KeyboardPDP11(parmsKbd);
+            Component.bindComponentControls(kbd, eKbd, PDP11.APPCLASS);
+        }
+    }
+}
+
+KeyboardPDP11.MINPRESSTIME = 100;            // 100ms
+
+/*
+ * Initialize every Keyboard module on the page.
+ */
+Web.onInit(KeyboardPDP11.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/serial.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * Since the Closure Compiler treats ES6 classes as @struct rather than @dict by default,
+ * it deters us from defining named properties on our components; eg:
+ *
+ *      this['exports'] = {...}
+ *
+ * results in an error:
+ *
+ *      Cannot do '[]' access on a struct
+ *
+ * So, in order to define 'exports', we must override the @struct assumption by annotating
+ * the class as @unrestricted (or @dict).  Note that this must be done both here and in the
+ * Component class, because otherwise the Compiler won't allow us to *reference* the named
+ * property either.
+ *
+ * TODO: Consider marking ALL our classes unrestricted, because otherwise it forces us to
+ * define every single property the class uses in its constructor, which results in a fair
+ * bit of redundant initialization, since many properties aren't (and don't need to be) fully
+ * initialized until the appropriate init(), reset(), restore(), etc. function is called.
+ *
+ * The upside, however, may be that since the structure of the class is completely defined by
+ * the constructor, JavaScript engines may be able to optimize and run more efficiently.
+ *
+ * @unrestricted
+ */
+class SerialPortPDP11 extends Component {
+    /**
+     * SerialPortPDP11(parmsSerial)
+     *
+     * The SerialPort component has the following component-specific (parmsSerial) properties:
+     *
+     *      adapter: adapter number; 0 if not defined (the PCx86 SerialPort component uses this
+     *      value to set the device's internal COM number, which in turn determines other properties,
+     *      such as I/O ports and IRQ; for the PDP-11, this currently has no defined use)
+     *
+     *      baudReceive: the default number of bits/second that the device should receive data at;
+     *      0 means use the device default (PDP11.DL11.RCSR.BAUD)
+     *
+     *      baudTransmit: the default number of bits/second that the device should transmit data at;
+     *      0 means use the device default (PDP11.DL11.XCSR.BAUD)
+     *
+     *      binding: name of a control (based on its "binding" attribute) to bind to this port's I/O
+     *
+     *      tabSize: set to a non-zero number to convert tabs to spaces (applies only to output to
+     *      the above binding); default is 0 (no conversion)
+     *
+     *      upperCase: if true, all received input is upper-cased; it is normally the responsibility
+     *      of the sending device to ensure this, but sometimes it's more convenient to enforce
+     *      on the receiving end.
+     *
+     * NOTE: Since the XSL file defines the 'adapter' and 'baud' properties as numbers, not strings,
+     * there's no need to use parseInt(), and as an added benefit, we don't need to worry about whether
+     * a hex or decimal format was used.
+     *
+     * @param {Object} parmsSerial
+     */
+    constructor(parmsSerial)
+    {
+        super("SerialPort", parmsSerial, MessagesPDP11.SERIAL);
+
+        this.iAdapter = +parmsSerial['adapter'];
+        this.nBaudReceive = +parmsSerial['baudReceive'] || PDP11.DL11.RCSR.BAUD;
+        this.nBaudTransmit = +parmsSerial['baudTransmit'] || PDP11.DL11.XCSR.BAUD;
+        this.fUpperCase = parmsSerial['upperCase'];
+        if (typeof this.fUpperCase == "string") this.fUpperCase = (this.fUpperCase == "true");
+        /**
+         * consoleOutput becomes a string that records serial port output if the 'binding' property is set to the
+         * reserved name "console".  Nothing is written to the console, however, until a linefeed (0x0A) is output
+         * or the string length reaches a threshold (currently, 1024 characters).
+         *
+         * @type {string|null}
+         */
+        this.consoleOutput = null;
+
+        /**
+         * controlIOBuffer is a DOM element bound to the port (currently used for output only; see transmitByte()).
+         *
+         * Example: CTTY COM2
+         *
+         * The CTTY DOS command redirects all CON I/O to the specified serial port (eg, COM2), which it assumes is
+         * connected to a serial terminal, and therefore anything it *transmits* via COM2 will be displayed by the
+         * terminal.  It further assumes that anything typed on such a terminal is NOT displayed, so as DOS *receives*
+         * serial input, DOS *transmits* the appropriate characters back to the terminal via COM2.
+         *
+         * As a result, controlIOBuffer only needs to be updated by the transmitByte() function.
+         *
+         * @type {Object}
+         */
+        this.controlIOBuffer = null;
+
+        /*
+         * If controlIOBuffer is being used AND 'tabSize' is set, then we make an attempt to monitor the characters
+         * being echoed via transmitByte(), maintain a logical column position, and convert any tabs into the appropriate
+         * number of spaces.
+         *
+         * charBOL, if nonzero, is a character to automatically output at the beginning of every line.  This probably
+         * isn't generally useful; I use it internally to preformat serial output.
+         */
+        this.tabSize = +parmsSerial['tabSize'];
+        this.charBOL = +parmsSerial['charBOL'];
+        this.iLogicalCol = 0;
+        this.fNullModem = true;
+
+        this.irqReceiver = this.irqTransmitter = null;
+        this.timerReceiveInterrupt = this.timerTransmitInterrupt = -1;
+
+        this.regRBUF = this.regRCSR = this.regXCSR = 0;
+        this.abReceive = [];
+
+        var sBinding = parmsSerial['binding'];
+        if (sBinding == "console") {
+            this.consoleOutput = "";
+        } else {
+            /*
+             * NOTE: If sBinding is not the name of a valid Control Panel DOM element, this call does nothing.
+             */
+            Component.bindExternalControl(this, sBinding, SerialPortPDP11.sIOBuffer);
+        }
+
+        /*
+         * No connection until initConnection() is called.
+         */
+        this.sDataReceived = "";
+        this.connection = this.sendData = this.updateStatus = null;
+
+        /*
+         * Export all functions required by initConnection().
+         */
+        this['exports'] = {
+            'connect': this.initConnection,
+            'receiveData': this.receiveData,
+            'receiveStatus': this.receiveStatus,
+            'setConnection': this.setConnection
+        };
+    }
+
+    /**
+     * setBinding(sType, sBinding, control, sValue)
+     *
+     * @this {SerialPortPDP11}
+     * @param {string|null} sType is the type of the HTML control (eg, "button", "textarea", "register", "flag", "rled", etc)
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "buffer")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sType, sBinding, control, sValue)
+    {
+        var serial = this;
+
+        switch (sBinding) {
+        case SerialPortPDP11.sIOBuffer:
+            this.bindings[sBinding] = this.controlIOBuffer = control;
+
+            /*
+             * An onkeydown handler is required for certain keys that browsers tend to consume themselves;
+             * for example, BACKSPACE is often defined as going back to the previous web page, and certain
+             * CTRL keys are often used for browser shortcuts (usually on Windows-based browsers).
+             *
+             * NOTE: We don't bother with a keyUp handler, because for the most part, we're only intercepting
+             * keys that require special treatment; in general, we're content with keyPress events.
+             */
+            control.onkeydown = function onKeyDown(event) {
+                event = event || window.event;
+                var bASCII = 0;
+                var keyCode = event.keyCode;
+                /*
+                 * Perform the same remapping of BACKSPACE and DELETE that our VT100 emulation performs,
+                 * for PCjs-wide consistency; see the KEYMAP table in /modules/pc8080/lib/keyboard.js for
+                 * the rationale.  Ditto for ALT-DELETE; see onKeyDown() in /modules/pc8080/lib/keyboard.js
+                 * for details.
+                 *
+                 * NOTE: keyDown (and keyUp) events supply us with KEYCODE values, which are NOT the same as
+                 * ASCII values, which is why we are comparing with KEYCODE values but assigning ASCII values,
+                 * because receiveData() requires ASCII values.
+                 */
+                if (keyCode == Keys.KEYCODE.BS) {
+                    bASCII = event.altKey? Keys.ASCII.CTRL_H : Keys.ASCII.DEL;
+                }
+                else if (keyCode == Keys.KEYCODE.DEL) {
+                    bASCII = Keys.ASCII.CTRL_H;
+                }
+                else if (event.ctrlKey && keyCode >= Keys.ASCII.A && keyCode <= Keys.ASCII.Z) {
+                    bASCII = keyCode - (Keys.ASCII.A - Keys.ASCII.CTRL_A);
+                }
+                if (bASCII) {
+                    if (event.preventDefault) event.preventDefault();
+                    serial.receiveData(bASCII);
+                }
+                return true;
+            };
+
+            control.onkeypress = function onKeyPress(event) {
+                /*
+                 * NOTE: Unlike keyDown events, keyPress events generally supply us with ASCII values,
+                 * despite the fact that, as above, they come to us via the keyCode property.  Yes, it's
+                 * brilliant (or rather, the opposite of brilliant), but that's life.
+                 */
+                event = event || window.event;
+                /*
+                 * Not sure why COMMAND-key combinations are coming through here (on Safari at least),
+                 * but in any case, let's make sure we don't act on them.
+                 */
+                if (!event.metaKey) {
+                    var bASCII = event.which || event.keyCode;
+                    /*
+                     * Perform the same remapping of ALT-ENTER (to LINE-FEED) that our VT100 emulation performs,
+                     * for PCjs-wide consistency; see onKeyDown() in /modules/pc8080/lib/keyboard.js for details.
+                     */
+                    if (event.altKey) {
+                        if (bASCII == Keys.ASCII.CTRL_M) {
+                            bASCII = Keys.ASCII.CTRL_J;
+                        }
+                    }
+                    serial.receiveData(bASCII);
+                    /*
+                     * Since we're going to remove the "readonly" attribute from the <textarea> control
+                     * (so that the soft keyboard activates on iOS), instead of calling preventDefault() for
+                     * selected keys (eg, the SPACE key, whose default behavior is to scroll the page), we must
+                     * now call it for *all* keys, so that the keyCode isn't added to the control immediately,
+                     * on top of whatever the machine is echoing back, resulting in double characters.
+                     */
+                    if (event.preventDefault) event.preventDefault();
+                }
+                return true;
+            };
+
+            control.onpaste = function onKeyPress(event) {
+                if (event.stopPropagation) event.stopPropagation();
+                if (event.preventDefault) event.preventDefault();
+                var clipboardData = event.clipboardData || window.clipboardData;
+                if (clipboardData) {
+                    /*
+                     * NOTE: Multiple lines of pasted text will (at least on macOS) contain LFs instead of CRs;
+                     * this is dealt with in receiveData() whenever it receives a string of characters.
+                     */
+                    serial.receiveData(clipboardData.getData('Text'));
+                }
+            };
+
+            /*
+             * Now that we've added an onkeypress handler that calls preventDefault() for ALL keys, the control
+             * itself no longer needs the "readonly" attribute; we primarily need to remove it for iOS browsers,
+             * so that the soft keyboard will activate, but it shouldn't hurt to remove the attribute for all browsers.
+             */
+            control.removeAttribute("readonly");
+
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {SerialPortPDP11}
+     * @param {ComputerPDP11} cmp
+     * @param {BusPDP11} bus
+     * @param {CPUStatePDP11} cpu
+     * @param {DebuggerPDP11} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cmp = cmp;
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+
+        var serial = this;
+
+        this.irqReceiver = this.cpu.addIRQ(this.iAdapter? -1 : PDP11.DL11.RVEC, PDP11.DL11.PRI, MessagesPDP11.DL11);
+
+        this.timerReceiveInterrupt = this.cpu.addTimer(function readyReceiver() {
+            var b = serial.receiveByte();
+            if (b >= 0) {
+                serial.regRBUF = b;
+                if (!(serial.regRCSR & PDP11.DL11.RCSR.RD)) {
+                    serial.regRCSR |= PDP11.DL11.RCSR.RD;
+                } else {
+                    serial.regRBUF |= PDP11.DL11.RBUF.OE | PDP11.DL11.RBUF.ERROR;
+                }
+                if (serial.regRCSR & PDP11.DL11.RCSR.RIE) {
+                    cpu.setIRQ(serial.irqReceiver);
+                }
+            }
+        });
+
+        this.irqTransmitter = this.cpu.addIRQ(this.iAdapter? -1 : PDP11.DL11.XVEC, PDP11.DL11.PRI, MessagesPDP11.DL11);
+
+        this.timerTransmitInterrupt = this.cpu.addTimer(function readyTransmitter() {
+            serial.regXCSR |= PDP11.DL11.XCSR.READY;
+            if (serial.regXCSR & PDP11.DL11.XCSR.TIE) {
+                cpu.setIRQ(serial.irqTransmitter);
+            }
+        });
+
+        bus.addIOTable(this, SerialPortPDP11.UNIBUS_IOTABLE, this.iAdapter? ((PDP11.UNIBUS.DL11 + (this.iAdapter - 1) * 8) - PDP11.UNIBUS.RCSR) : 0);
+        bus.addResetHandler(this.reset.bind(this));
+
+        this.setReady();
+    }
+
+    /**
+     * initConnection(fNullModem)
+     *
+     * If a machine 'connection' parameter exists of the form "{sourcePort}->{targetMachine}.{targetPort}",
+     * and "{sourcePort}" matches our idComponent, then look for a component with id "{targetMachine}.{targetPort}".
+     *
+     * If the target component is found, then verify that it has exported functions with the following names:
+     *
+     *      receiveData(data): called when we have data to transmit; aliased internally to sendData(data)
+     *      receiveStatus(pins): called when our control signals have changed; aliased internally to updateStatus(pins)
+     *
+     * For now, we're not going to worry about communication in the other direction, because when the target component
+     * performs its own initConnection(), it will find our receiveData() and receiveStatus() functions, at which point
+     * communication in both directions should be established, and the circle of life complete.
+     *
+     * For added robustness, if the target machine initializes much more slowly than we do, and our connection attempt
+     * fails, that's OK, because when it finally initializes, its initConnection() will call our initConnection();
+     * if we've already initialized, no harm done.
+     *
+     * @this {SerialPortPDP11}
+     * @param {boolean} [fNullModem] (caller's null-modem setting, to ensure our settings are in agreement)
+     */
+    initConnection(fNullModem)
+    {
+        if (!this.connection) {
+            var sConnection = this.cmp.getMachineParm("connection");
+            if (sConnection) {
+                var asParts = sConnection.split('->');
+                if (asParts.length == 2) {
+                    var sSourceID = Str.trim(asParts[0]);
+                    if (sSourceID != this.idComponent) return;  // this connection string is intended for another instance
+                    var sTargetID = Str.trim(asParts[1]);
+                    this.connection = Component.getComponentByID(sTargetID);
+                    if (this.connection) {
+                        var exports = this.connection['exports'];
+                        if (exports) {
+                            var fnConnect = exports['connect'];
+                            if (fnConnect) fnConnect.call(this.connection, this.fNullModem);
+                            this.sendData = exports['receiveData'];
+                            if (this.sendData) {
+                                this.fNullModem = fNullModem;
+                                this.updateStatus = exports['receiveStatus'];
+                                this.status("Connected " + this.idMachine + '.' + sSourceID + " to " + sTargetID);
+                                return;
+                            }
+                        }
+                    }
+                }
+                /*
+                 * Changed from notice() to status() because sometimes a connection fails simply because one of us is a laggard.
+                 */
+                this.status("Unable to establish connection: " + sConnection);
+            }
+        }
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {SerialPortPDP11}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+
+            /*
+             * This is as late as we can currently wait to make our first inter-machine connection attempt;
+             * even so, the target machine's initialization process may still be ongoing, so any connection
+             * may be not fully resolved until the target machine performs its own initConnection(), which will
+             * in turn invoke our initConnection() again.
+             */
+            this.initConnection(this.fNullModem);
+
+            if (!data) {
+                this.reset();
+            } else {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {SerialPortPDP11}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * reset()
+     *
+     * @this {SerialPortPDP11}
+     */
+    reset()
+    {
+        this.initState();
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the SerialPort component.
+     *
+     * @this {SerialPortPDP11}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, this.saveRegisters());
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the SerialPort component.
+     *
+     * @this {SerialPortPDP11}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        return this.initState(data[0]);
+    }
+
+    /**
+     * initState(a)
+     *
+     * @this {SerialPortPDP11}
+     * @param {Array} [a]
+     * @return {boolean} true if successful, false if failure
+     */
+    initState(a)
+    {
+        if (!a) {
+            a = [0, PDP11.DL11.RCSR.CTS, PDP11.DL11.XCSR.READY, this.abReceive];
+        }
+
+        /*
+         * ES6 ALERT: A handy destructuring assignment, which makes it easy to perform the inverse
+         * of what saveRegisters() does when it collects a bunch of object properties into an array.
+         */
+        [
+            this.regRBUF,
+            this.regRCSR,
+            this.regXCSR,
+            this.abReceive
+        ] = a;
+
+        return true;
+    }
+
+    /**
+     * saveRegisters()
+     *
+     * Basically, the inverse of initState().
+     *
+     * @this {SerialPortPDP11}
+     * @return {Array}
+     */
+    saveRegisters()
+    {
+        return [
+            this.regRBUF,
+            this.regRCSR,
+            this.regXCSR,
+            this.abReceive
+        ];
+    }
+
+    /**
+     * getBaudTimeout(nBaud)
+     *
+     * Based on the selected baud rate (nBaud), convert that rate into a millisecond delay.
+     *
+     * @this {SerialPortPDP11}
+     * @param {number} nBaud
+     * @return {number} (number of milliseconds per byte)
+     */
+    getBaudTimeout(nBaud)
+    {
+        /*
+         * TODO: Do a better job computing this, based on actual numbers of start, stop and parity bits,
+         * instead of hard-coding the total number of bits per byte to 10.
+         */
+        var nBytesPerSecond = Math.round(nBaud / 10);
+        return 1000 / nBytesPerSecond;
+    }
+
+    /**
+     * receiveData(data)
+     *
+     * This replaces the old sendRBR() function, which expected an Array of bytes.  We still support that,
+     * but in order to support connections with other SerialPort components (ie, the PC8080 SerialPort), we
+     * have added support for numbers and strings as well.
+     *
+     * @this {SerialPortPDP11}
+     * @param {number|string|Array} data
+     * @return {boolean} true if received, false if not
+     */
+    receiveData(data)
+    {
+        if (typeof data == "number") {
+            this.abReceive.push(data);
+        }
+        else if (typeof data == "string") {
+            var bASCII = 0, bASCIIPrev;
+            for (var i = 0; i < data.length; i++) {
+                bASCIIPrev = bASCII;
+                bASCII = data.charCodeAt(i);
+                /*
+                 * NOTE: Multiple lines of pasted text will (at least on macOS) contain LFs instead of CRs;
+                 * we convert them to CRs below.  Windows may do something different, but in the worst case,
+                 * even if we receive CR/LF pairs, this code should keep the CRs and lose the LFs.
+                 */
+                if (bASCII == Str.ASCII.LF) {
+                    if (bASCIIPrev == Str.ASCII.CR) continue;
+                    bASCII = Str.ASCII.CR;
+                }
+                this.abReceive.push(bASCII);
+            }
+        }
+        else {
+            this.abReceive = this.abReceive.concat(data);
+        }
+
+        this.cpu.setTimer(this.timerReceiveInterrupt, this.getBaudTimeout(this.nBaudReceive));
+
+        return true;                // for now, return true regardless, since we're buffering everything anyway
+    }
+
+    /**
+     * receiveByte()
+     *
+     * @this {SerialPortPDP11}
+     * @return {number} (0x00-0xff if byte available, -1 if not)
+     */
+    receiveByte()
+    {
+        var b = -1;
+        if (this.abReceive.length) {
+            /*
+             * Here, as elsewhere (eg, the PC11 component), even if I trusted all incoming data
+             * to be byte values (which I don't), there's also the risk that it could be signed data
+             * (eg, -128 to 127, instead of 0 to 255).  Both risks are good reasons to always mask
+             * the data assigned to RBUF with 0xff.
+             */
+            b = this.abReceive.shift() & 0xff;
+            this.printMessage("receiveByte(" + Str.toHexByte(b) + ")");
+            if (this.fUpperCase) {
+                /*
+                 * Automatically transform lower-case ASCII codes to upper-case; fUpperCase should
+                 * only be set when a terminal or some sort of pseudo-display is being used and we don't
+                 * trust it to have its CAPS-LOCK setting correct.
+                 */
+                if (b >= 0x61 && b < 0x7A) b -= 0x20;
+            }
+            this.cpu.setTimer(this.timerReceiveInterrupt, this.getBaudTimeout(this.nBaudReceive));
+        }
+        return b;
+    }
+
+    /**
+     * receiveStatus(pins)
+     *
+     * @this {SerialPortPDP11}
+     * @param {number} pins
+     */
+    receiveStatus(pins)
+    {
+        var oldRCSR = this.regRCSR;
+        this.regRCSR &= ~(PDP11.DL11.RCSR.CTS | PDP11.DL11.RCSR.CD);
+        if (pins & RS232.CTS.MASK) {
+            this.regRCSR |= PDP11.DL11.RCSR.CTS;
+        }
+        if (pins & RS232.CD.MASK) {
+            this.regRCSR |= PDP11.DL11.RCSR.CD;
+        }
+        if (oldRCSR != this.regRCSR) {
+            this.regRCSR |= PDP11.DL11.RCSR.DSC;
+            if (this.regRCSR & PDP11.DL11.RCSR.DIE) {
+                this.cpu.setIRQ(this.irqReceiver);
+            }
+        }
+    }
+
+    /**
+     * setConnection(component, fn)
+     *
+     * @this {SerialPortPDP11}
+     * @param {Object|null} component
+     * @param {function(number)} fn
+     * @return {boolean}
+     */
+    setConnection(component, fn)
+    {
+        if (!this.connection) {
+            this.connection = component;
+            this.sendData = fn;
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * transmitByte(b)
+     *
+     * @this {SerialPortPDP11}
+     * @param {number} b
+     * @return {boolean} true if transmitted, false if not
+     */
+    transmitByte(b)
+    {
+        var fTransmitted = false;
+
+        if (MAXDEBUG) this.printMessage("transmitByte(" + Str.toHexByte(b) + ")");
+
+        if (this.sendData) {
+            if (this.sendData.call(this.connection, b)) {
+                fTransmitted = true;
+            }
+        }
+
+        /*
+         * TODO: Why do DEC diagnostics like to output bytes with bit 7 set?
+         */
+        b &= 0x7F;
+
+        if (this.controlIOBuffer) {
+            if (b == 0x0D) {
+                this.iLogicalCol = 0;
+            }
+            else if (b == 0x08) {
+                this.controlIOBuffer.value = this.controlIOBuffer.value.slice(0, -1);
+                /*
+                 * TODO: Back up the correct number of columns if the character erased was a tab.
+                 */
+                if (this.iLogicalCol > 0) this.iLogicalCol--;
+            }
+            else if (b) {
+                /*
+                 * RT-11 outputs lots of NULL characters, at least after a "D 56=5015" (0x0A0D) command has
+                 * been issued, hence the "if (b)" check above.
+                 *
+                 * TODO: Also consider a check for Keys.ASCII.CTRL_C, because by default, RT-11 outputs "raw"
+                 * CTRL_C characters, which we capture below and render as <ETX>.  RT-11 does this for other keys
+                 * as well, such as CTRL_K (<VT>) and CTRL_L (<FF>).
+                 */
+                var s = Str.toASCIICode(b); // formerly: String.fromCharCode(b);
+                var nChars = s.length;      // formerly: (b >= 0x20? 1 : 0);
+                if (b < 0x20 && nChars == 1) nChars = 0;
+                if (b == 0x09) {
+                    var tabSize = this.tabSize || 8;
+                    nChars = tabSize - (this.iLogicalCol % tabSize);
+                    if (this.tabSize) s = Str.pad("", nChars);
+                }
+                if (this.charBOL && !this.iLogicalCol && nChars) s = String.fromCharCode(this.charBOL) + s;
+                this.controlIOBuffer.value += s;
+                this.controlIOBuffer.scrollTop = this.controlIOBuffer.scrollHeight;
+                this.iLogicalCol += nChars;
+            }
+            fTransmitted = true;
+        }
+        else if (this.consoleOutput != null) {
+            if (b == 0x0A || this.consoleOutput.length >= 1024) {
+                this.println(this.consoleOutput);
+                this.consoleOutput = "";
+            }
+            if (b != 0x0A) {
+                this.consoleOutput += String.fromCharCode(b);
+            }
+            fTransmitted = true;
+        }
+
+        /*
+         * NOTE: When debugging issues involving the SerialPort, such as debugging code between a pair of
+         * transmitted bytes, you can pass 0 instead of getBaudTimeout() to setTimer() to minimize the amount
+         * of time spent waiting for XCSR.READY to be set again.
+         */
+        this.cpu.setTimer(this.timerTransmitInterrupt, this.getBaudTimeout(this.nBaudTransmit));
+
+        return fTransmitted;
+    }
+
+    /**
+     * readRCSR(addr)
+     *
+     * @this {SerialPortPDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.RCSR or 177560)
+     * @return {number}
+     */
+    readRCSR(addr)
+    {
+        var data = this.regRCSR & PDP11.DL11.RCSR.RMASK;
+        this.regRCSR &= ~PDP11.DL11.RCSR.DSC;
+        return data;
+    }
+
+    /**
+     * writeRCSR(data, addr)
+     *
+     * @this {SerialPortPDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.RCSR or 177560)
+     */
+    writeRCSR(data, addr)
+    {
+        var delta = (data ^ this.regRCSR);
+        this.regRCSR = (this.regRCSR & ~PDP11.DL11.RCSR.WMASK) | (data & PDP11.DL11.RCSR.WMASK);
+        /*
+         * Whenever DTR or RTS changes, we also want to notify any connected machine, via updateStatus().
+         */
+        if (this.updateStatus) {
+            if (delta & PDP11.DL11.RCSR.RS232) {
+                var pins = 0;
+                if (this.fNullModem) {
+                    pins |= (data & PDP11.DL11.RCSR.RTS)? RS232.CTS.MASK : 0;
+                    pins |= (data & PDP11.DL11.RCSR.DTR)? (RS232.DSR.MASK | RS232.CD.MASK): 0;
+                } else {
+                    pins |= (data & PDP11.DL11.RCSR.RTS)? RS232.RTS.MASK : 0;
+                    pins |= (data & PDP11.DL11.RCSR.DTR)? RS232.DTR.MASK : 0;
+                }
+                this.updateStatus.call(this.connection, pins);
+            }
+        }
+    }
+
+    /**
+     * readRBUF(addr)
+     *
+     * @this {SerialPortPDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.RBUF or 177562)
+     * @return {number}
+     */
+    readRBUF(addr)
+    {
+        this.regRCSR &= ~PDP11.DL11.RCSR.RD;
+        return this.regRBUF;
+    }
+
+    /**
+     * writeRBUF(data, addr)
+     *
+     * @this {SerialPortPDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.RBUF or 177562)
+     */
+    writeRBUF(data, addr)
+    {
+    }
+
+    /**
+     * readXCSR(addr)
+     *
+     * @this {SerialPortPDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.XCSR or 177564)
+     * @return {number}
+     */
+    readXCSR(addr)
+    {
+        return this.regXCSR;
+    }
+
+    /**
+     * writeXCSR(data, addr)
+     *
+     * @this {SerialPortPDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.XCSR or 177564)
+     */
+    writeXCSR(data, addr)
+    {
+        /*
+         * If the device is READY, and TIE is being set, then request a hardware interrupt.
+         *
+         * Conversely, if TIE is being cleared, remove the request; this resolves a problem within
+         * MAINDEC TEST 15, where the Transmitter Interrupt Enable (TIE) bit is cleared, set, and cleared
+         * in rapid succession, with the expectation that NO interrupt will be generated.  Note that
+         * this fix also requires a complementary change in setIRQ(), to request hardware interrupts with
+         * IRQ_DELAY rather than IRQ.
+         */
+        if (this.regXCSR & PDP11.DL11.XCSR.READY) {
+            if (data & PDP11.DL11.XCSR.TIE) {
+                this.cpu.setIRQ(this.irqTransmitter);
+            } else {
+                this.cpu.clearIRQ(this.irqTransmitter);
+            }
+        }
+        this.regXCSR = (this.regXCSR & ~PDP11.DL11.XCSR.WMASK) | (data & PDP11.DL11.XCSR.WMASK);
+    }
+
+    /**
+     * readXBUF(addr)
+     *
+     * @this {SerialPortPDP11}
+     * @param {number} addr (eg, PDP11.UNIBUS.XBUF or 177566)
+     * @return {number}
+     */
+    readXBUF(addr)
+    {
+        return 0;
+    }
+
+    /**
+     * writeXBUF(data, addr)
+     *
+     * @this {SerialPortPDP11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.XBUF or 177566)
+     */
+    writeXBUF(data, addr)
+    {
+        this.transmitByte(data & PDP11.DL11.XBUF.DATA);
+        this.regXCSR &= ~PDP11.DL11.XCSR.READY;
+    }
+
+    /**
+     * SerialPortPDP11.init()
+     *
+     * This function operates on every HTML element of class "serial", extracting the
+     * JSON-encoded parameters for the SerialPort constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a SerialPort component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeSerial = Component.getElementsByClass(document, PDP11.APPCLASS, "serial");
+        for (var iSerial = 0; iSerial < aeSerial.length; iSerial++) {
+            var eSerial = aeSerial[iSerial];
+            var parmsSerial = Component.getComponentParms(eSerial);
+            var serial = new SerialPortPDP11(parmsSerial);
+            Component.bindComponentControls(serial, eSerial, PDP11.APPCLASS);
+        }
+    }
+}
+
+/*
+ * Internal name used for the I/O buffer control, if any, that we bind to the SerialPort.
+ *
+ * Alternatively, if SerialPort wants to use another component's control (eg, the Panel's
+ * "print" control), it can specify the name of that control with the 'binding' property.
+ *
+ * For that binding to succeed, we also need to know the target component; for now, that's
+ * been hard-coded to "Panel", in part because that's one of the few components we can rely
+ * upon initializing before we do, but it would be a simple matter to include a component type
+ * or ID as part of the 'binding' property as well, if we need more flexibility later.
+ */
+SerialPortPDP11.sIOBuffer = "buffer";
+
+/*
+ * ES6 ALERT: As you can see below, I've finally started using computed property names.
+ */
+SerialPortPDP11.UNIBUS_IOTABLE = {
+    [PDP11.UNIBUS.RCSR]:    /* 177560 */    [null, null, SerialPortPDP11.prototype.readRCSR,    SerialPortPDP11.prototype.writeRCSR,    "RCSR"],
+    [PDP11.UNIBUS.RBUF]:    /* 177562 */    [null, null, SerialPortPDP11.prototype.readRBUF,    SerialPortPDP11.prototype.writeRBUF,    "RBUF"],
+    [PDP11.UNIBUS.XCSR]:    /* 177564 */    [null, null, SerialPortPDP11.prototype.readXCSR,    SerialPortPDP11.prototype.writeXCSR,    "XCSR"],
+    [PDP11.UNIBUS.XBUF]:    /* 177566 */    [null, null, SerialPortPDP11.prototype.readXBUF,    SerialPortPDP11.prototype.writeXBUF,    "XBUF"]
+};
+
+/*
+ * Initialize every SerialPort module on the page.
+ */
+Web.onInit(SerialPortPDP11.init);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/pc11.js (C) Jeff Parsons 2012-2017
+ */
+
+
+class PC11 extends Component {
+    /**
+     * PC11(parms)
+     *
+     * The PC11 component has the following component-specific (parms) properties:
+     *
+     *      autoMount: a JSON-encoded object containing 'name' and 'path' properties, describing a
+     *      tape resource to automatically load at startup (only the "load" operation is supported
+     *      for autoMount; if you want to "read" a tape image directly into RAM at startup, you must
+     *      ask the RAM component to do that).
+     *
+     *      baudReceive: the default number of bits/second that the device should receive data at;
+     *      0 means use the device default (PDP11.PC11.PRS.BAUD)
+     *
+     *      baudTransmit: the default number of bits/second that the device should transmit data at;
+     *      0 means use the device default (PDP11.PC11.PPS.BAUD); currently ignored, since punch
+     *      support isn't implemented yet.
+     *
+     * NOTE: Since the XSL file defines the 'baud' properties as numbers, not strings, there's no need to
+     * use parseInt(), and as an added benefit, we don't need to worry about whether a hex or decimal format
+     * was used.
+     *
+     * @param {Object} parms
+     */
+    constructor(parms)
+    {
+        super("PC11", parms, MessagesPDP11.PC11);
+
+        this.sDevice = "PTR";                   // TODO: Make the device name configurable
+
+        /*
+         * We preliminarily parse and record any 'autoMount' object now, but we no longer process it
+         * until initBus(), because the Computer's getMachineParm() service may have an override for us.
+         */
+        this.configMount = this.parseConfig(parms['autoMount']);
+        this.cAutoMount = 0;
+        this.nBaudReceive = +parms['baudReceive'] || PDP11.PC11.PRS.BAUD;
+
+        this.regPRS = 0;                        // PRS register
+        this.regPRB = 0;                        // PRB register
+        this.regPPS = PDP11.PC11.PPS.ERROR;     // PPS register (TODO: Stop signaling error once punch is implemented)
+        this.regPPB = 0;                        // PPB register
+        this.iTapeData = 0;                     // buffer index
+        this.aTapeData = [];                    // buffer for the PRB register
+        this.sTapeSource = PC11.SOURCE.NONE;
+        this.nTapeTarget = PC11.TARGET.NONE;
+        this.sTapeName = this.sTapePath = "";
+
+        /*
+         * These next few variables simply keep track of the previous parameters to parseTape(),
+         * so that we can easily reparse the previous tape as needed.
+         */
+        this.aBytes = this.addrLoad = this.addrExec = null;
+
+        this.nLastPercent = -1;     // ensure the first displayProgress() displays something
+
+        /*
+         * Support for local tape images is currently limited to desktop browsers with FileReader support;
+         * when this flag is set, setBinding() allows local tape bindings and informs initBus() to update the
+         * "listTapes" binding accordingly.
+         */
+        this.fLocalTapes = (!Web.isMobile() && window && 'FileReader' in window);
+
+        this.irqReader = null;
+        this.timerReader = -1;
+        this.ram = null;
+    }
+
+    /**
+     * parseConfig(config)
+     *
+     * @this {PC11}
+     * @param {*} config
+     * @return {*}
+     */
+    parseConfig(config)
+    {
+        if (config && typeof config == "string") {
+            try {
+                /*
+                 * The most likely source of any exception will be right here, where we're parsing
+                 * this JSON-encoded data.
+                 */
+                config = eval("(" + config + ")");
+            } catch (e) {
+                Component.error(this.type + " auto-mount error: " + e.message + " (" + config + ")");
+                config = null;
+            }
+        }
+        return config || {};
+    }
+
+    /**
+     * setBinding(sType, sBinding, control, sValue)
+     *
+     * @this {PC11}
+     * @param {string|null} sType is the type of the HTML control (eg, "button", "list", "text", etc)
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "listTapes")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sType, sBinding, control, sValue)
+    {
+        var pc11 = this;
+        var nTapeTarget = PC11.TARGET.NONE;
+
+        switch (sBinding) {
+
+        case "listTapes":
+            this.bindings[sBinding] = control;
+            control.onchange = function onChangeListTapes(event) {
+                var controlDesc = pc11.bindings["descTape"];
+                var controlOption = control.options[control.selectedIndex];
+                if (controlDesc && controlOption) {
+                    var dataValue = {};
+                    var sValue = controlOption.getAttribute("data-value");
+                    if (sValue) {
+                        try {
+                            dataValue = eval("(" + sValue + ")");
+                        } catch (e) {
+                            Component.error("PC11 option error: " + e.message);
+                        }
+                    }
+                    var sHTML = dataValue['desc'];
+                    if (sHTML === undefined) sHTML = "";
+                    var sHRef = dataValue['href'];
+                    if (sHRef !== undefined) sHTML = "<a href=\"" + sHRef + "\" target=\"_blank\">" + sHTML + "</a>";
+                    controlDesc.innerHTML = sHTML;
+                }
+            };
+            return true;
+
+        case "descTape":
+            this.bindings[sBinding] = control;
+            return true;
+
+        /*
+         * "readTape" operation must do pretty much everything that the "loadTape" does, but whereas the load
+         * operation records the bytes in aTapeData, the read operation stuffs them directly into the machine's memory;
+         * the former sets nTapeTarget to TARGET.READER, while the latter sets it to TARGET.MEMORY.
+         */
+        case "readTape":
+            nTapeTarget = PC11.TARGET.MEMORY;
+            /* falls through */
+
+        case "loadTape":
+            if (!nTapeTarget) nTapeTarget = PC11.TARGET.READER;
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickReadTape(event) {
+                var controlTapes = pc11.bindings["listTapes"];
+                if (controlTapes) {
+                    var sTapeName = controlTapes.options[controlTapes.selectedIndex].text;
+                    var sTapePath = controlTapes.value;
+                    pc11.loadSelectedTape(sTapeName, sTapePath, nTapeTarget);
+                }
+            };
+            return true;
+
+        case "mountTape":
+            if (!this.fLocalTapes) {
+                if (DEBUG) this.log("Local tape support not available");
+                /*
+                 * We could also simply hide the control; eg:
+                 *
+                 *      control.style.display = "none";
+                 *
+                 * but removing the control altogether seems better.
+                 */
+                control.parentNode.removeChild(/** @type {Node} */ (control));
+                return false;
+            }
+
+            this.bindings[sBinding] = control;
+
+            /*
+             * Enable "Mount" button only if a file is actually selected
+             */
+            control.addEventListener('change', function() {
+                var fieldset = control.children[0];
+                var files = fieldset.children[0].files;
+                var submit = fieldset.children[1];
+                submit.disabled = !files.length;
+            });
+
+            control.onsubmit = function(event) {
+                var file = event.currentTarget[1].files[0];
+                if (file) {
+                    var sTapePath = file.name;
+                    var sTapeName = Str.getBaseName(sTapePath, true);
+                    /*
+                     * TODO: Provide a way to mount tapes into MEMORY as well as READER.
+                     */
+                    pc11.loadSelectedTape(sTapeName, sTapePath, PC11.TARGET.READER, file);
+                }
+                /*
+                 * Prevent reloading of web page after form submission
+                 */
+                return false;
+            };
+            return true;
+
+        case PC11.BINDING.READ_PROGRESS:
+            this.bindings[sBinding] = control;
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {PC11}
+     * @param {ComputerPDP11} cmp
+     * @param {BusPDP11} bus
+     * @param {CPUStatePDP11} cpu
+     * @param {DebuggerPDP11} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cmp = cmp;
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+        this.ram = /** @type {RAMPDP11} */ (cmp.getMachineComponent("RAM"));
+
+        var pc11 = this;
+
+        var configMount = this.parseConfig(this.cmp.getMachineParm('autoMount'));
+
+        /*
+         * Add only devices from the machine-wide autoMount configuration that match devices managed by this component.
+         */
+        if (configMount) {
+            for (var sDevice in configMount) {
+                if (sDevice != this.sDevice) continue;
+                this.configMount[sDevice] = configMount[sDevice];
+            }
+        }
+
+        this.irqReader = this.cpu.addIRQ(PDP11.PC11.RVEC, PDP11.PC11.PRI, MessagesPDP11.PC11);
+
+        this.timerReader = this.cpu.addTimer(function readyReader() {
+            pc11.advanceReader();
+        });
+
+        bus.addIOTable(this, PC11.UNIBUS_IOTABLE);
+        bus.addResetHandler(this.reset.bind(this));
+
+        this.addTape("None", PC11.SOURCE.NONE, true);
+        if (this.fLocalTapes) this.addTape("Local Tape", PC11.SOURCE.LOCAL);
+        this.addTape("Remote Tape", PC11.SOURCE.REMOTE);
+
+        if (!this.autoMount()) this.setReady();
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {PC11}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            if (!data) {
+                this.reset();
+            } else {
+                if (!this.restore(data)) return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {PC11}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * reset()
+     *
+     * TODO: Consider making our reset() handler ALSO restore the original loaded tape, in much the same
+     * way the RAM component now restores the original predefined memory or tape image after resetting the RAM.
+     *
+     * @this {PC11}
+     */
+    reset()
+    {
+        this.regPRS &= ~PDP11.PC11.PRS.CLEAR;
+        this.regPRB = 0;
+    }
+
+    /**
+     * autoMount(fRemount)
+     *
+     * @this {PC11}
+     * @param {boolean} [fRemount] is true if we're remounting all auto-mounted tapes
+     * @return {boolean} true if one or more tape images are being auto-mounted, false if none
+     */
+    autoMount(fRemount)
+    {
+        if (!fRemount) this.cAutoMount = 0;
+        var configMount = this.configMount[this.sDevice];
+        if (configMount) {
+            var sTapePath = configMount['path'] || "";
+            var sTapeName = configMount['name'] || this.findTape(sTapePath);
+            if (sTapePath && sTapeName) {
+                /*
+                 * TODO: Provide a way to autoMount tapes into MEMORY as well as READER.
+                 */
+                if (!this.loadTape(sTapeName, sTapePath, PC11.TARGET.READER, true) && fRemount) {
+                    this.setReady(false);
+                }
+            } else {
+                /*
+                 * This likely happened because there was no autoMount setting (or it was overridden with an empty value),
+                 * so just make sure the current selection is set to "None".
+                 */
+                this.displayTape();
+            }
+        }
+        return !!this.cAutoMount;
+    }
+
+    /**
+     * loadSelectedTape(sTapeName, sTapePath, nTapeTarget, file)
+     *
+     * @this {PC11}
+     * @param {string} sTapeName
+     * @param {string} sTapePath
+     * @param {number} nTapeTarget
+     * @param {File} [file] is set if there's an associated File object
+     */
+    loadSelectedTape(sTapeName, sTapePath, nTapeTarget, file)
+    {
+        if (!sTapePath) {
+            this.unloadTape(false);
+            return;
+        }
+
+        if (sTapePath == PC11.SOURCE.LOCAL) {
+            this.notice('Use "Choose File" and "Mount" to select and load a local tape.');
+            return;
+        }
+
+        /*
+         * If the special PC11.SOURCE.REMOTE path is selected, then we want to prompt the user for a URL.
+         * Oh, and make sure we pass an empty string as the 2nd parameter to prompt(), so that IE won't display
+         * "undefined" -- because after all, undefined and "undefined" are EXACTLY the same thing, right?
+         *
+         * TODO: This is literally all I've done to support remote tape images. There's probably more
+         * I should do, like dynamically updating "listTapes" to include new entries, and adding new entries
+         * to the save/restore data.
+         */
+        if (sTapePath == PC11.SOURCE.REMOTE) {
+            sTapePath = window.prompt("Enter the URL of a remote tape image.", "") || "";
+            if (!sTapePath) return;
+            sTapeName = Str.getBaseName(sTapePath);
+            this.status("Attempting to load " + sTapePath + " as \"" + sTapeName + "\"");
+            this.sTapeSource = PC11.SOURCE.REMOTE;
+        }
+        else {
+            this.sTapeSource = sTapePath;
+        }
+
+        this.loadTape(sTapeName, sTapePath, nTapeTarget, false, file);
+    }
+
+    /**
+     * loadTape(sTapeName, sTapePath, nTapeTarget, fAutoMount, file)
+     *
+     * NOTE: If sTapePath is already loaded, nothing needs to be done.
+     *
+     * @this {PC11}
+     * @param {string} sTapeName
+     * @param {string} sTapePath
+     * @param {number} nTapeTarget
+     * @param {boolean} [fAutoMount]
+     * @param {File} [file] is set if there's an associated File object
+     * @return {number} 1 if tape loaded, 0 if queued up (or busy), -1 if already loaded
+     */
+    loadTape(sTapeName, sTapePath, nTapeTarget, fAutoMount, file)
+    {
+        var nResult = -1;
+
+        if (this.sTapePath.toLowerCase() != sTapePath.toLowerCase() || this.nTapeTarget != nTapeTarget) {
+
+            nResult++;
+            this.unloadTape(true);
+
+            if (this.flags.busy) {
+                this.notice("PC11 busy");
+            }
+            else {
+                // this.status("tape queued: " + sTapeName);
+                if (fAutoMount) {
+                    this.cAutoMount++;
+                    if (this.messageEnabled()) this.printMessage("auto-loading tape: " + sTapeName);
+                }
+                if (this.load(sTapeName, sTapePath, nTapeTarget, file)) {
+                    nResult++;
+                } else {
+                    this.flags.busy = true;
+                }
+            }
+        }
+        if (nResult) {
+            /*
+             * Now that we're calling parseTape() again (so that the current tape can either be restarted on
+             * the reader or reloaded into RAM), we can also rely on it to display an appropriate status message, too.
+             *
+             *      this.status(this.nTapeTarget == PC11.TARGET.READER? "tape loaded" : "tape read");
+             */
+            this.parseTape(this.sTapeName, this.sTapePath, this.nTapeTarget, this.aBytes, this.addrLoad, this.addrExec);
+        }
+        return nResult;
+    }
+
+    /**
+     * load(sTapeName, sTapePath, nTapeTarget, file)
+     *
+     * @this {PC11}
+     * @param {string} sTapeName
+     * @param {string} sTapePath
+     * @param {number} nTapeTarget
+     * @param {File} [file] is set if there's an associated File object
+     * @return {boolean} true if load completed (successfully or not), false if queued
+     */
+    load(sTapeName, sTapePath, nTapeTarget, file)
+    {
+        var pc11 = this;
+        var sTapeURL = sTapePath;
+
+        if (DEBUG) {
+            var sMessage = 'load("' + sTapeName + '","' + sTapePath + '")';
+            this.printMessage(sMessage);
+        }
+
+        if (file) {
+            var reader = new FileReader();
+            reader.onload = function doneRead() {
+                pc11.finishRead(sTapeName, sTapePath, nTapeTarget, reader.result);
+            };
+            reader.readAsArrayBuffer(file);
+            return false;
+        }
+
+        /*
+         * If there's an occurrence of API_ENDPOINT anywhere in the path, we assume we can use it as-is;
+         * ie, that the user has already formed a URL of the type we use ourselves for unconverted tape images.
+         */
+        if (sTapePath.indexOf(DumpAPI.ENDPOINT) < 0) {
+            /*
+             * If the selected tape image has a "json" extension, then we assume it's a pre-converted
+             * JSON-encoded tape image, so we load it as-is; otherwise, we ask our server-side tape image
+             * converter to return the corresponding JSON-encoded data.
+             */
+            var sTapeExt = Str.getExtension(sTapePath);
+            if (sTapeExt == DumpAPI.FORMAT.JSON || sTapeExt == DumpAPI.FORMAT.JSON_GZ) {
+                sTapeURL = encodeURI(sTapePath);
+            } else {
+                var sTapeParm = DumpAPI.QUERY.PATH;
+                sTapeURL = Web.getHost() + DumpAPI.ENDPOINT + '?' + sTapeParm + '=' + encodeURIComponent(sTapePath) + "&" + DumpAPI.QUERY.FORMAT + "=" + DumpAPI.FORMAT.JSON;
+            }
+        }
+
+        return !!Web.getResource(sTapeURL, null, true, function doneLoad(sURL, sResponse, nErrorCode) {
+            pc11.finishLoad(sTapeName, sTapePath, nTapeTarget, sResponse, sURL, nErrorCode);
+        });
+    }
+
+    /**
+     * finishLoad(sTapeName, sTapePath, sTapeData, nTapeTarget, sURL, nErrorCode)
+     *
+     * @this {PC11}
+     * @param {string} sTapeName
+     * @param {string} sTapePath
+     * @param {string} sTapeData
+     * @param {number} nTapeTarget
+     * @param {string} sURL
+     * @param {number} nErrorCode (response from server if anything other than 200)
+     */
+    finishLoad(sTapeName, sTapePath, nTapeTarget, sTapeData, sURL, nErrorCode)
+    {
+        var fPrintOnly = (nErrorCode < 0 && !!this.cmp && !this.cmp.flags.powered);
+
+        if (nErrorCode) {
+            /*
+             * This can happen for innocuous reasons, such as the user switching away too quickly, forcing
+             * the request to be cancelled.  And unfortunately, the browser cancels XMLHttpRequest requests
+             * BEFORE it notifies any page event handlers, so if the Computer's being powered down, we won't know
+             * that yet.  For now, we rely on the lack of a specific error (nErrorCode < 0), and suppress the
+             * notify() alert if there's no specific error AND the computer is not powered up yet.
+             */
+            this.notice("Unable to load tape \"" + sTapeName + "\" (error " + nErrorCode + ": " + sURL + ")", fPrintOnly);
+        }
+        else {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage('finishLoad("' + sTapePath + '")');
+            }
+            Component.addMachineResource(this.idMachine, sURL, sTapeData);
+            var resource = Web.parseMemoryResource(sURL, sTapeData);
+            if (resource) {
+                this.parseTape(sTapeName, sTapePath, nTapeTarget, resource.aBytes, resource.addrLoad, resource.addrExec);
+            }
+        }
+        this.flags.busy = false;
+        if (this.cAutoMount) {
+            this.cAutoMount--;
+            if (!this.cAutoMount) this.setReady();
+        }
+        this.displayTape();
+    }
+
+    /**
+     * finishRead(sTapeName, sTapePath, nTapeTarget, buffer)
+     *
+     * @this {PC11}
+     * @param {string} sTapeName
+     * @param {string} sTapePath
+     * @param {number} nTapeTarget
+     * @param {?} buffer (we KNOW this is an ArrayBuffer, but we can't seem to convince the Closure Compiler)
+     */
+    finishRead(sTapeName, sTapePath, nTapeTarget, buffer)
+    {
+        if (buffer) {
+            var aBytes = new Uint8Array(buffer, 0, buffer.byteLength);
+            this.parseTape(sTapeName, sTapePath, nTapeTarget, aBytes);
+            this.sTapeSource = PC11.SOURCE.LOCAL;
+        }
+        this.flags.busy = false;
+        this.displayTape();
+    }
+
+    /**
+     * addTape(sName, sPath, fTop)
+     *
+     * @this {PC11}
+     * @param {string} sName
+     * @param {string} sPath
+     * @param {boolean} [fTop] (default is bottom)
+     */
+    addTape(sName, sPath, fTop)
+    {
+        var controlTapes = this.bindings["listTapes"];
+        if (controlTapes && controlTapes.options) {
+            for (var i = 0; i < controlTapes.options.length; i++) {
+                if (controlTapes.options[i].value == sPath) return;
+            }
+            var controlOption = document.createElement("option");
+            controlOption.text = sName;
+            controlOption.value = sPath;
+            if (fTop && controlTapes.childNodes[0]) {
+                controlTapes.insertBefore(controlOption, controlTapes.childNodes[0]);
+            } else {
+                controlTapes.appendChild(controlOption);
+            }
+        }
+    }
+
+    /**
+     * findTape(sPath)
+     *
+     * This is used to deal with mount requests (eg, autoMount) that supply a path without a name;
+     * if we can find the path in the "listTapes" control, then we return the associated tape name.
+     *
+     * @this {PC11}
+     * @param {string} sPath
+     * @return {string|null}
+     */
+    findTape(sPath)
+    {
+        var controlTapes = this.bindings["listTapes"];
+        if (controlTapes && controlTapes.options) {
+            for (var i = 0; i < controlTapes.options.length; i++) {
+                var control = controlTapes.options[i];
+                if (control.value == sPath) return control.text;
+            }
+        }
+        return Str.getBaseName(sPath, true);
+    }
+
+    /**
+     * displayTape()
+     *
+     * @this {PC11}
+     */
+    displayTape()
+    {
+        var controlTapes = this.bindings["listTapes"];
+        if (controlTapes && controlTapes.options) {
+            var sTargetPath = this.sTapeSource || this.sTapePath;
+            for (var i = 0; i < controlTapes.options.length; i++) {
+                if (controlTapes.options[i].value == sTargetPath) {
+                    if (controlTapes.selectedIndex != i) {
+                        controlTapes.selectedIndex = i;
+                    }
+                    break;
+                }
+            }
+            if (i == controlTapes.options.length) controlTapes.selectedIndex = 0;
+        }
+    }
+
+    /**
+     * displayProgress(nPercent)
+     *
+     * @this {PC11}
+     * @param {number} nPercent
+     */
+    displayProgress(nPercent)
+    {
+        nPercent |= 0;
+        if (nPercent !== this.nLastPercent) {
+            var control = this.bindings[PC11.BINDING.READ_PROGRESS];
+            if (control) {
+                var aeControls = Component.getElementsByClass(control, PC11.CSSCLASS.PROGRESS_BAR);
+                var controlBar = aeControls && aeControls[0];
+                if (controlBar && controlBar.style) {
+                    controlBar.style.width = nPercent + "%";
+                }
+            }
+            this.nLastPercent = nPercent;
+        }
+    }
+
+    /**
+     * parseTape(sTapeName, sTapePath, nTapeTarget, aBytes, addrLoad, addrExec)
+     *
+     * @this {PC11}
+     * @param {string} sTapeName
+     * @param {string} sTapePath
+     * @param {number} nTapeTarget
+     * @param {Array|Uint8Array} aBytes
+     * @param {number|null} [addrLoad]
+     * @param {number|null} [addrExec]
+     */
+    parseTape(sTapeName, sTapePath, nTapeTarget, aBytes, addrLoad, addrExec)
+    {
+        this.sTapeName = sTapeName;
+        this.sTapePath = sTapePath;
+        this.nTapeTarget = nTapeTarget;
+        this.aBytes = aBytes;
+        this.addrLoad = addrLoad;
+        this.addrExec = addrExec;
+
+        if (nTapeTarget == PC11.TARGET.MEMORY) {
+            /*
+             * Use the RAM component's loadImage() service to do our dirty work.  If the load succeeds, then
+             * depending on whether there was also exec address, either the CPU will be stopped or the PC wil be
+             * reset.
+             *
+             * NOTE: Some tapes are not in the Absolute Loader format, so if the JSON-encoded tape resource file
+             * we downloaded didn't ALSO include a load address, the load will fail.
+             *
+             * For example, the "Absolute Loader" tape is NOT itself in the Absolute Loader format.  You just have
+             * to know that in order to load that tape, you must first load the appropriate "Bootstrap Loader" (which
+             * DOES include its own hard-coded load address), load the "Absolute Loader" tape, and then run the
+             * "Bootstrap Loader".
+             */
+            if (!this.ram || !this.ram.loadImage(aBytes, addrLoad, addrExec, null, false)) {
+                /*
+                 * This doesn't seem to serve any purpose, other than to be annoying, because perhaps you accidentally
+                 * clicked "Read" instead of "Load"....
+                 *
+                 *      this.sTapeName = "";
+                 *      this.sTapePath = "";
+                 *      this.sTapeSource = PC11.SOURCE.NONE;
+                 *      this.nTapeTarget = PC11.TARGET.NONE;
+                 */
+                this.notice('No valid memory address for tape "' + sTapeName + '"');
+                return;
+            }
+            this.status('Read tape "' + sTapeName + '"');
+            return;
+        }
+
+        this.iTapeData = 0;
+        this.aTapeData = aBytes;
+        this.regPRS &= ~PDP11.PC11.PRS.ERROR;
+
+        this.status('Loaded tape "' + sTapeName + '" (' + aBytes.length + " bytes)");
+        this.displayProgress(0);
+    }
+
+    /**
+     * unloadTape(fLoading)
+     *
+     * @this {PC11}
+     * @param {boolean} [fLoading]
+     */
+    unloadTape(fLoading)
+    {
+        if (this.sTapePath || fLoading === false) {
+            this.sTapeName = "";
+            this.sTapePath = "";
+            /*
+             * Avoid any unnecessary hysteresis regarding the display if this unload is merely a prelude to another load.
+             */
+            if (!fLoading) {
+                if (this.nTapeTarget) this.status(this.nTapeTarget == PC11.TARGET.READER? "tape detached" : "tape unloaded");
+                this.sTapeSource = PC11.SOURCE.NONE;
+                this.nTapeTarget = PC11.TARGET.NONE;
+                this.displayTape();
+            }
+        }
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the PC11 component.
+     *
+     * @this {PC11}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the PC11 component.
+     *
+     * @this {PC11}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        return true;
+    }
+
+    /**
+     * getBaudTimeout(nBaud)
+     *
+     * Based on the selected baud rate (nBaud), convert that rate into a millisecond delay.
+     *
+     * @this {PC11}
+     * @param {number} nBaud
+     * @return {number} (number of milliseconds per byte)
+     */
+    getBaudTimeout(nBaud)
+    {
+        /*
+         * TODO: Do a better job computing this, based on actual numbers of start, stop and parity bits,
+         * instead of hard-coding the total number of bits per byte to 10.
+         */
+        var nBytesPerSecond = Math.round(nBaud / 10);
+        return 1000 / nBytesPerSecond;
+    }
+
+    /**
+     * advanceReader()
+     *
+     * If the reader is enabled (RE is set) and there is no exceptional condition (ie, ERROR is set),
+     * and if the buffer register is empty (DONE is clear), then if we have more data in our internal buffer,
+     * store it in the buffer register, and optionally trigger an interrupt if device interrupts are enabled.
+     *
+     * @this {PC11}
+     */
+    advanceReader()
+    {
+        if ((this.regPRS & (PDP11.PC11.PRS.RE | PDP11.PC11.PRS.ERROR)) == PDP11.PC11.PRS.RE) {
+            if (!(this.regPRS & PDP11.PC11.PRS.DONE)) {
+                if (this.iTapeData < this.aTapeData.length) {
+                    /*
+                     * Here, as elsewhere (eg, the DL11 component), even if I trusted all incoming data
+                     * to be byte values (which I don't), there's also the risk that it could be signed data
+                     * (eg, -128 to 127, instead of 0 to 255).  Both risks are good reasons to always mask
+                     * the data assigned to PRB with 0xff.
+                     */
+                    this.regPRB = this.aTapeData[this.iTapeData] & 0xff;
+                    if (this.messageEnabled()) this.printMessage(this.type + ".advanceReader(" + this.iTapeData + "): " + Str.toHexByte(this.regPRB), true);
+                    this.iTapeData++;
+                    this.displayProgress(this.iTapeData / this.aTapeData.length * 100);
+                }
+                else {
+                    this.regPRS |= PDP11.PC11.PRS.ERROR;
+                }
+                this.regPRS |= PDP11.PC11.PRS.DONE;
+                this.regPRS &= ~PDP11.PC11.PRS.BUSY;
+                if (this.regPRS & PDP11.PC11.PRS.IE) {
+                    this.cpu.setIRQ(this.irqReader);
+                }
+            }
+        }
+    }
+
+    /**
+     * readPRS(addr)
+     *
+     * NOTE: We use the PRS RMASK to honor the "write-only" behavior of bit 0, the reader enable bit (RE), because
+     * DEC's tiny Bootstrap Loader (/apps/pdp11/boot/bootstrap/BOOTSTRAP-16KB.lst) repeatedly enables the reader using
+     * the INC instruction, which causes the PRS to be read, incremented, and written, so if bit 0 isn't always read
+     * as zero, the INC instruction would clear RE instead of setting it.
+     *
+     * @this {PC11}
+     * @param {number} addr (eg, PDP11.UNIBUS.PRS or 177550)
+     * @return {number}
+     */
+    readPRS(addr)
+    {
+        return this.regPRS & PDP11.PC11.PRS.RMASK;     // RMASK honors the "write-only" nature of the RE bit by returning zero on reads
+    }
+
+    /**
+     * writePRS(data, addr)
+     *
+     * @this {PC11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.PRS or 177550)
+     */
+    writePRS(data, addr)
+    {
+        if (data & PDP11.PC11.PRS.RE) {
+            /*
+             * From the 1976 Peripherals Handbook, p. 4-378:
+             *
+             *      Set [RE] to allow the Reader to fetch one character. The setting of this bit clears Done,
+             *      sets Busy, and clears the Reader Buffer (PRB). Operation of this bit is disabled if Error = 1;
+             *      attempting to set it when Error = 1 will cause an immediate interrupt if Interrupt Enable = 1.
+             */
+            if (this.regPRS & PDP11.PC11.PRS.ERROR) {
+                data &= ~PDP11.PC11.PRS.RE;
+                if (this.regPRS & PDP11.PC11.PRS.IE) {
+                    this.cpu.setIRQ(this.irqReader);
+                }
+            } else {
+                this.regPRS &= ~PDP11.PC11.PRS.DONE;
+                this.regPRS |= PDP11.PC11.PRS.BUSY;
+                this.regPRB = 0;
+                /*
+                 * The PC11, by virtue of its "high speed", is supposed to deliver characters at 300 CPS, so
+                 * that's the rate we'll choose as well (ie, 1000ms / 300).  As an aside, the original "low speed"
+                 * version of the reader ran at 10 CPS.
+                 */
+                this.cpu.setTimer(this.timerReader, this.getBaudTimeout(this.nBaudReceive));
+            }
+        }
+        this.regPRS = (this.regPRS & ~PDP11.PC11.PRS.WMASK) | (data & PDP11.PC11.PRS.WMASK);
+    }
+
+    /**
+     * readPRB(addr)
+     *
+     * @this {PC11}
+     * @param {number} addr (eg, PDP11.UNIBUS.PRB or 177552)
+     * @return {number}
+     */
+    readPRB(addr)
+    {
+        /*
+         * I'm guessing that the DONE and BUSY bits always remain more-or-less inverses of each other.  They definitely
+         * start out that way when writePRS() sets the reader enable (RE) bit, and so that's how we treat them elsewhere, too.
+         */
+        this.regPRS &= ~PDP11.PC11.PRS.DONE;
+        this.regPRS |= PDP11.PC11.PRS.BUSY;
+        return this.regPRB;
+    }
+
+    /**
+     * writePRB(data, addr)
+     *
+     * @this {PC11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.PRB or 177552)
+     */
+    writePRB(data, addr)
+    {
+    }
+
+    /**
+     * readPPS(addr)
+     *
+     * @this {PC11}
+     * @param {number} addr (eg, PDP11.UNIBUS.PPS or 177554)
+     * @return {number}
+     */
+    readPPS(addr)
+    {
+        return this.regPPS;
+    }
+
+    /**
+     * writePPS(data, addr)
+     *
+     * NOTE: This was originally added ONLY because when RT-11 v4.0 copies from device "PC:" (the paper tape reader),
+     * it executes the following code:
+     *
+     *      016010: 005037 177550          CLR   @#177550               ;history=2 PRS
+     *      016014: 005037 177554          CLR   @#177554               ;history=1
+     *
+     * and as you can see, without this PPS handler, a TRAP to 4 would normally occur.  I guess since we claim to be
+     * a PC11, that makes sense.  But what about PDP-11 machines with only a PR11 (ie, a reader-only unit)?
+     *
+     * @this {PC11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.PPS or 177554)
+     */
+    writePPS(data, addr)
+    {
+        this.regPPS = (this.regPPS & ~PDP11.PC11.PPS.WMASK) | (data & PDP11.PC11.PPS.WMASK);
+    }
+
+    /**
+     * readPPB(addr)
+     *
+     * @this {PC11}
+     * @param {number} addr (eg, PDP11.UNIBUS.PPB or 177556)
+     * @return {number}
+     */
+    readPPB(addr)
+    {
+        return this.regPPB;
+    }
+
+    /**
+     * writePPB(data, addr)
+     *
+     * @this {PC11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.PPB or 177556)
+     */
+    writePPB(data, addr)
+    {
+        this.regPPB = (data & PDP11.PC11.PPB.MASK);
+    }
+}
+
+/*
+ * There's nothing super special about these values, except that NONE should be falsey and the others should not.
+ */
+PC11.SOURCE = {
+    NONE:   "",
+    LOCAL:  "?",
+    REMOTE: "??"
+};
+
+PC11.TARGET = {
+    NONE:   0,
+    READER: 1,
+    MEMORY: 2
+};
+
+PC11.BINDING = {
+    READ_PROGRESS:  "readProgress"
+};
+
+PC11.CSSCLASS = {
+    PROGRESS_BAR:   PDP11.CSSCLASS + "-progress-bar"
+};
+
+/*
+ * ES6 ALERT: As you can see below, I've finally started using computed property names.
+ */
+PC11.UNIBUS_IOTABLE = {
+    [PDP11.UNIBUS.PRS]:     /* 177550 */    [null, null, PC11.prototype.readPRS,    PC11.prototype.writePRS,    "PRS"],
+    [PDP11.UNIBUS.PRB]:     /* 177552 */    [null, null, PC11.prototype.readPRB,    PC11.prototype.writePRB,    "PRB"],
+    [PDP11.UNIBUS.PPS]:     /* 177554 */    [null, null, PC11.prototype.readPPS,    PC11.prototype.writePPS,    "PPS"],
+    [PDP11.UNIBUS.PPB]:     /* 177556 */    [null, null, PC11.prototype.readPPB,    PC11.prototype.writePPB,    "PPB"]
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/disk.js (C) Jeff Parsons 2012-2017
+ */
+
+/*
+ *  The DiskPDP11 component provides methods for:
+ *
+ *      1) creating an empty disk: create()
+ *      2) loading a disk image: load()
+ *      3) getting disk information: info()
+ *      4) seeking a disk sector: seek()
+ *      5) reading data from a sector: read()
+ *      6) writing data to a sector: write()
+ *      7) save disk deltas: save()
+ *      8) restore disk deltas: restore()
+ *      9) converting disk contents: toJSON()
+ *
+ *  More functionality may be factored out of the disk controller components later and moved here,
+ *  to further reduce some of the duplication between them, but the above functionality is a good start.
+ */
+
+
+/**
+ * Every Sector object (once loaded, parsed, and "normalized") should have ALL of the following named properties:
+ *
+ *      'sector':   sector number
+ *      'length':   size of the sector, in bytes
+ *      'data':     array of dwords
+ *      'pattern':  dword pattern to use for empty or partial sectors (or null if sector still needs to be loaded)
+ *
+ * initSector() also sets the following properties, to help us quickly identify its location within aDiskData:
+ *
+ *      iCylinder
+ *      iHead
+ *
+ * In addition, we will maintain the following information on a per-sector basis, as sectors are modified:
+ *
+ *      iModify:    index of first modified dword in sector
+ *      cModify:    number of modified dwords in sector
+ *      fDirty:     true if sector is dirty, false if clean (or cleaning in progress)
+ *
+ * @typedef {{
+ *  sector:     number,
+ *  length:     number,
+ *  data:       Array.<number>,
+ *  pattern:    (number|null),
+ *  iCylinder:  number,
+ *  iHead:      number,
+ *  iModify:    number,
+ *  cModify:    number
+ * }}
+ */
+var SectorInfo;
+
+class DiskPDP11 extends Component {
+    /**
+     * DiskPDP11(controller, drive, mode)
+     *
+     * Disk contents are stored as an array (aDiskData) of cylinders, each of which is an array of
+     * heads, each of which is an array of sector objects; the latter contain sector numbers and
+     * sector data, where sector data is an array of dwords.  The format does not impose any
+     * limitations on number of cylinders, number of heads, sectors per track, or bytes per sector.
+     *
+     * WARNING: All accesses to disk sector properties must be via their string names, not their
+     * "dot" names, otherwise code will break after it's been processed by the Closure Compiler,
+     * and any dumped disks may be unmountable.  This is a side-effect of how we mount and dump
+     * disk images (ie, as JSON-encoded streams).
+     *
+     * This means, for example, that all references to "track[iSector].data" must actually appear as
+     * "track[iSector]['data']".
+     *
+     * @param {DriveController|RK11|RL11} controller
+     * @param {Object} drive
+     * @param {string} mode
+     */
+    constructor(controller, drive, mode)
+    {
+        super("Disk", {'id': controller.idMachine + ".disk" + Str.toHex(++DiskPDP11.nDisks, 4)}, MessagesPDP11.DISK);
+
+        /*
+         * Route all non-Debugger messages (eg, notice() and println() calls) through
+         * this.controller (eg, controller.notice() and controller.println()), because
+         * the Computer component is unaware of any Disk objects and therefore will not
+         * set up the usual overrides when a Control Panel is installed.
+         */
+        this.controller = controller;
+        this.cmp = controller.cmp;
+        this.dbg = controller.dbg;
+        this.drive = drive;
+
+        /*
+         * We pull out a number of drive properties that we may or may not need as defaults.
+         */
+        this.sDiskName = drive.name;
+        this.sDiskPath = this.sDiskFile = "";
+        this.fRemovable = drive.fRemovable;
+
+        /*
+         * Initialize the disk contents
+         */
+        this.mode = 0;
+        this.nCylinders = this.nHeads = this.nSectors = this.cbSector = 0;
+        this.aDiskData = [];
+        this.dwChecksum = null;
+        this.fWriteProtected = false;
+        this.create(mode, drive.nCylinders, drive.nHeads, drive.nSectors, drive.cbSector);
+
+        this.fnNotify = this.controllerNotify = null;
+
+        this.setReady();
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * We have no real interest in this notification, other than to obtain a reference to the Debugger
+     * for every disk loaded BEFORE the initBus() phase; any disk loaded AFTER that point will get its Debugger
+     * reference, if any, from the disk controller passed to the DiskPDP11() constructor.
+     *
+     * @this {DiskPDP11}
+     * @param {ComputerPDP11} cmp
+     * @param {BusPDP11} bus
+     * @param {CPUStatePDP11} cpu
+     * @param {DebuggerPDP11} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.dbg = dbg;
+    }
+
+    /**
+     * create()
+     *
+     * @this {DiskPDP11}
+     * @param {string} mode
+     * @param {number} nCylinders
+     * @param {number} nHeads
+     * @param {number} nSectors (per track)
+     * @param {number} cbSector
+     *
+     * Initializes the disk contents according to the current drive mode and parameters.
+     */
+    create(mode, nCylinders, nHeads, nSectors, cbSector)
+    {
+        this.mode = mode;
+        this.nCylinders = nCylinders;
+        this.nHeads = nHeads;
+        this.nSectors = nSectors;
+        this.cbSector = cbSector;
+        this.aDiskData = [];
+        /*
+         * If the drive is using PRELOAD mode, then it will use the load()/mount() process to initialize the disk contents;
+         * it wouldn't hurt to let create() do its thing, too, but it's a waste of time.
+         */
+        if (this.mode != DiskAPI.MODE.PRELOAD) {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage("blank disk for \"" + this.sDiskName + "\": " + this.nCylinders + " cylinders, " + this.nHeads + " head(s)");
+            }
+            var aCylinders = new Array(this.nCylinders);
+            for (var iCylinder = 0; iCylinder < aCylinders.length; iCylinder++) {
+                var aHeads = new Array(this.nHeads);
+                for (var iHead = 0; iHead < aHeads.length; iHead++) {
+                    var aSectors = new Array(this.nSectors);
+                    for (var iSector = 1; iSector <= aSectors.length; iSector++) {
+                        /*
+                         * Now that our read() and write() functions can deal with unallocated data
+                         * arrays, and can read/write the specified pattern on-the-fly, we no longer need
+                         * to pre-allocate and pre-initialize the 'data' array.
+                         */
+                        aSectors[iSector - 1] = this.initSector(null, iCylinder, iHead, iSector, this.cbSector, 0);
+                    }
+                    aHeads[iHead] = aSectors;
+                }
+                aCylinders[iCylinder] = aHeads;
+            }
+            this.aDiskData = aCylinders;
+        }
+        this.dwChecksum = null;
+    }
+
+    /**
+     * load(sDiskName, sDiskPath, file, fnNotify)
+     *
+     * TODO: Figure out how we can strongly type fnNotify, because the Closure Compiler has issues with:
+     *
+     *      param {function(Component,Object,Disk,string,string)} fnNotify
+     *
+     * for:
+     *
+     *     this.fnNotify.call(this.controller, this.drive, disk, this.sDiskName, this.sDiskPath);
+     *
+     * Also, while we're at it, learn if there are ways to:
+     *
+     *      1) declare a function taking NO parameters (ie, generate a warning if any parameters are specified)
+     *      2) declare a type for a function's return value
+     *
+     * @this {DiskPDP11}
+     * @param {string} sDiskName
+     * @param {string} sDiskPath
+     * @param {File} [file] is set if there's an associated File object
+     * @param {function(...)} [fnNotify]
+     * @param {Component} [controller]
+     * @return {boolean} true if load completed (successfully or not), false if queued
+     */
+    load(sDiskName, sDiskPath, file, fnNotify, controller)
+    {
+        var sDiskURL = sDiskPath;
+
+        /*
+         * We could use this.log() as well, but it wouldn't display which component initiated the load.
+         */
+        if (DEBUG) {
+            var sMessage = 'load("' + sDiskName + '","' + sDiskPath + '")';
+            this.controller.log(sMessage);
+            this.printMessage(sMessage);
+        }
+
+        if (this.fnNotify) {
+            if (DEBUG) this.controller.log('too many load requests for "' + sDiskName + '" (' + sDiskPath + ')');
+            return true;
+        }
+
+        this.sDiskName = sDiskName;
+        this.sDiskPath = sDiskPath;
+        this.sDiskFile = Str.getBaseName(sDiskPath);
+
+        var disk = this;
+        this.fnNotify = fnNotify;
+        this.controllerNotify = controller || this.controller;
+
+        if (file) {
+            var reader = new FileReader();
+            reader.onload = function() {
+                disk.build(reader.result, true);
+            };
+            reader.readAsArrayBuffer(file);
+            return true;
+        }
+
+        /*
+         * If there's an occurrence of API_ENDPOINT anywhere in the path, we assume we can use it as-is;
+         * ie, that the user has already formed a URL of the type we use ourselves for unconverted disk images.
+         */
+        if (sDiskPath.indexOf(DumpAPI.ENDPOINT) < 0) {
+            /*
+             * If the selected disk image has a "json" extension, then we assume it's a pre-converted
+             * JSON-encoded disk image, so we load it as-is; otherwise, we ask our server-side disk image
+             * converter to return the corresponding JSON-encoded data.
+             */
+            var sDiskExt = Str.getExtension(sDiskPath);
+            if (sDiskExt == DumpAPI.FORMAT.JSON || sDiskExt == DumpAPI.FORMAT.JSON_GZ) {
+                sDiskURL = encodeURI(sDiskPath);
+            } else {
+                var sDiskParm = DumpAPI.QUERY.PATH;
+                var sSizeParm = '&' + DumpAPI.QUERY.MBHD + "=10";
+                /*
+                 * 'mbhd' is a new parm added for hard drive support.  In the case of 'file' or 'dir' requests,
+                 * 'mbhd' informs DumpAPI.ENDPOINT that it should create a hard disk image, and one not larger than
+                 * the specified size (eg, 10mb).  In fact, until DumpAPI.ENDPOINT is changed to create custom hard
+                 * disk BPBs, you'll always get a standard PC XT 10mb disk image, so if the 'file' or 'dir' contains
+                 * more than 10mb of data, the request will fail.  Ultimately, I want to honor the controller's
+                 * driveConfig 'size' parm, or to match the capacity required by the driveConfig 'type' parameter.
+                 *
+                 * If a 'disk' is specified, we pass mbhd=0, because the actual size will depend on the image.
+                 * However, I don't currently have any "dsk" or "img" files containing hard disk images; those formats
+                 * were really intended for floppy disk images.  If I never create any hard disk image files, then
+                 * we can simply eliminate sSizeParm in the 'disk' case.
+                 *
+                 * Added more extensions to the list of paths-treated-as-disk-images, so that URLs to files located here:
+                 *
+                 *      ftp://ftp.oldskool.org/pub/TOPBENCH/dskimage/
+                 *
+                 * can be used as-is.  TODO: There's a TODO in netlib.getFile() regarding remote support that needs
+                 * to be resolved first; DiskDump relies on that function for its remote requests, and it currently
+                 * supports only HTTP.
+                 */
+                if (!sDiskPath.indexOf("http:") || !sDiskPath.indexOf("ftp:") || ["dsk", "ima", "img", "360", "720", "12", "144"].indexOf(sDiskExt) >= 0) {
+                    sDiskParm = DumpAPI.QUERY.DISK;
+                    sSizeParm = '&' + DumpAPI.QUERY.MBHD + "=0";
+                } else if (Str.endsWith(sDiskPath, '/')) {
+                    sDiskParm = DumpAPI.QUERY.DIR;
+                }
+                sDiskURL = Web.getHost() + DumpAPI.ENDPOINT + '?' + sDiskParm + '=' + encodeURIComponent(sDiskPath) + (this.fRemovable ? "" : sSizeParm) + "&" + DumpAPI.QUERY.FORMAT + "=" + DumpAPI.FORMAT.JSON;
+            }
+        }
+        return !!Web.getResource(sDiskURL, null, true, function(sURL, sResponse, nErrorCode) {
+            disk.doneLoad(sURL, sResponse, nErrorCode);
+        });
+    }
+
+    /**
+     * build(buffer, fModified)
+     *
+     * Builds a disk image from an ArrayBuffer (eg, from a FileReader object), rather than from JSON-encoded data.
+     *
+     * @this {DiskPDP11}
+     * @param {?} buffer (we KNOW this is an ArrayBuffer, but we can't seem to convince the Closure Compiler)
+     * @param {boolean} [fModified] is true if we should mark the entire disk modified (to ensure that we save/restore it)
+     */
+    build(buffer, fModified)
+    {
+        var disk;
+        var cbDiskData = buffer? buffer.byteLength : 0;
+        var diskFormat = DiskAPI.GEOMETRIES[cbDiskData];
+
+        if (diskFormat) {
+            this.nCylinders = diskFormat[0];
+            this.nHeads = diskFormat[1];
+            this.nSectors = diskFormat[2];
+            this.cbSector = (diskFormat[3] || 512);
+
+            var cdw = this.cbSector >> 2, dwPattern = 0, dwChecksum = 0;
+            var ib = 0;
+            var dv = new DataView(buffer, 0, cbDiskData);
+
+            this.aDiskData = new Array(this.nCylinders);
+            for (var iCylinder = 0; iCylinder < this.aDiskData.length; iCylinder++) {
+                var cylinder = this.aDiskData[iCylinder] = new Array(this.nHeads);
+                for (var iHead = 0; iHead < cylinder.length; iHead++) {
+                    var head = cylinder[iHead] = new Array(this.nSectors);
+                    for (var iSector = 0; iSector < head.length; iSector++) {
+                        var sector = this.initSector(null, iCylinder, iHead, iSector + 1, this.cbSector, dwPattern);
+                        var adw = sector['data'];
+                        for (var idw = 0; idw < cdw; idw++, ib += 4) {
+                            var dw = adw[idw] = dv.getInt32(ib, true);
+                            dwChecksum = (dwChecksum + dw) & (0xffffffff|0);
+                        }
+                        if (fModified) sector.cModify = cdw;
+                        head[iSector] = sector;
+                    }
+                }
+            }
+            this.dwChecksum = dwChecksum;
+            disk = this;
+        } else {
+            this.notice("Unrecognized disk format (" + cbDiskData + " bytes)");
+        }
+
+        if (this.fnNotify) {
+            this.fnNotify.call(this.controller, this.drive, disk, this.sDiskName, this.sDiskPath);
+            this.fnNotify = null;
+        }
+    }
+
+    /**
+     * doneLoad(sURL, sDiskData, nErrorCode)
+     *
+     * This function was originally called mount().  If the mount is successful, we pass the Disk object to the
+     * caller's fnNotify handler; otherwise, we pass null.
+     *
+     * @this {DiskPDP11}
+     * @param {string} sURL
+     * @param {string|null} sDiskData
+     * @param {number} nErrorCode (response from server if anything other than 200)
+     */
+    doneLoad(sURL, sDiskData, nErrorCode)
+    {
+        var disk = null;
+        var fPrintOnly = (nErrorCode < 0 && !!this.cmp && !this.cmp.flags.powered);
+
+        this.fWriteProtected = false;
+
+        if (nErrorCode) {
+            /*
+             * This can happen for innocuous reasons, such as the user switching away too quickly, forcing
+             * the request to be cancelled.  And unfortunately, the browser cancels XMLHttpRequest requests
+             * BEFORE it notifies any page event handlers, so if the Computer's being powered down, we won't know
+             * that yet.  For now, we rely on the lack of a specific error (nErrorCode < 0), and suppress the
+             * notify() alert if there's no specific error AND the computer is not powered up yet.
+             */
+            this.controller.notice("Unable to load disk \"" + this.sDiskName + "\" (error " + nErrorCode + ": " + sURL + ")", fPrintOnly);
+        } else {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage('doneLoad("' + this.sDiskPath + '")');
+            }
+
+            Component.addMachineResource(this.controller.idMachine, sURL, sDiskData);
+
+            try {
+                /*
+                 * The following code was a hack to turn on write-protection for a disk image if there was
+                 * an initial comment line containing the string "write-protected".  However, since comments
+                 * are technically not allowed in JSON, I needed an alternative solution.  So, if the basename
+                 * contains the suffix "-readonly", then I'll turn on write-protection for that disk as well.
+                 *
+                 * TODO: Provide some UI for turning write-protection on/off for disks at will, and provide
+                 * an XML-based solution (ie, a per-disk XML configuration option) for controlling it as well.
+                 */
+                var sBaseName = Str.getBaseName(this.sDiskFile, true).toLowerCase();
+                if (sBaseName.indexOf("-readonly") > 0) {
+                    this.fWriteProtected = true;
+                } else {
+                    var iEOL = sDiskData.indexOf("\n");
+                    if (iEOL > 0 && iEOL < 1024) {
+                        var sConfig = sDiskData.substring(0, iEOL);
+                        if (sConfig.indexOf("write-protected") > 0) {
+                            this.fWriteProtected = true;
+                        }
+                    }
+                }
+                /*
+                 * The most likely source of any exception will be here, where we're parsing the disk data.
+                 */
+                var aDiskData;
+                if (sDiskData.substr(0, 1) == "<") {        // if the "data" begins with a "<"...
+                    /*
+                     * Early server configs reported an error (via the nErrorCode parameter) if a disk URL was invalid,
+                     * but more recent server configs now display a somewhat friendlier HTML error page.  The downside,
+                     * however, is that the original error has been buried, and we've received "data" that isn't actually
+                     * disk data.
+                     *
+                     * So, if the data we've received appears to be "HTML-like", all we can really do is assume that the
+                     * disk image is missing.  And so we pretend we received an error message to that effect.
+                     */
+                    aDiskData = ["Missing disk image: " + this.sDiskName];
+                } else {
+                    /*
+                     * TODO: IE9 is rather unfriendly and restrictive with regard to how much data it's willing to
+                     * eval().  In particular, the 10Mb disk image we use for the Windows 1.01 demo config fails in
+                     * IE9 with an "Out of memory" exception.  One work-around would be to chop the data into chunks
+                     * (perhaps one track per chunk, using regular expressions) and then manually re-assemble it.
+                     *
+                     * However, it turns out that using JSON.parse(sDiskData) instead of eval("(" + sDiskData + ")")
+                     * is a much easier fix. The only drawback is that we must first quote any unquoted property names
+                     * and remove any comments, because while eval() was cool with them, JSON.parse() is more particular;
+                     * the following RegExp replacements take care of those requirements.
+                     *
+                     * The use of hex values is something else that eval() was OK with, but JSON.parse() is not, and
+                     * while I've stopped using hex values in DumpAPI responses (at least when "format=json" is specified),
+                     * I can't guarantee they won't show up in "legacy" images, and there's no simple RegExp replacement
+                     * for transforming hex values into decimal values, so I cop out and fall back to eval() if I detect
+                     * any hex prefixes ("0x") in the sequence.  Ditto for error messages, which appear like so:
+                     *
+                     *      ["unrecognized disk path: test.img"]
+                     */
+                    if (sDiskData.indexOf("0x") < 0 && sDiskData.substr(0, 2) != "[\"") {
+                        aDiskData = JSON.parse(sDiskData.replace(/([a-z]+):/gm, "\"$1\":").replace(/\/\/[^\n]*/gm, ""));
+                    } else {
+                        aDiskData = eval("(" + sDiskData + ")");
+                    }
+                }
+
+                if (!aDiskData.length) {
+                    Component.error("Empty disk image: " + this.sDiskName);
+                }
+                else if (aDiskData.length == 1) {
+                    Component.error(aDiskData[0]);
+                }
+                /*
+                 * aDiskData is an array of cylinders, each of which is an array of heads, each of which
+                 * is an array of sector objects.  The format does not impose any limitations on number of
+                 * cylinders, number of heads, or number of bytes in any of the sector object byte-arrays.
+                 *
+                 * WARNING: All accesses to sector object properties must be via their string names, not their
+                 * "dot" names, otherwise code will break after it's been processed by the Closure Compiler.
+                 *
+                 * Sector object properties include:
+                 *
+                 *      'sector'    the sector number (1-based, not required to be sequential)
+                 *      'length'    the byte-length (ie, formatted length) of the sector
+                 *      'data'      the dword-array containing the sector data
+                 *      'pattern'   if the dword-array length is less than 'length'/4, this value must be used
+                 *                  to pad out the sector; if no 'pattern' is specified, it's assumed to be zero
+                 *
+                 * We still support the older JSON encoding, where sector data was encoded as an array of 'bytes'
+                 * rather than a dword 'data' array.  However, our support is strictly limited to an on-the-fly
+                 * conversion to a forward-compatible 'data' array.
+                 */
+                else {
+                    if (DEBUG && this.messageEnabled(MessagesPDP11.DISK | MessagesPDP11.LOG)) {
+                        var sCylinders = aDiskData.length + " track" + (aDiskData.length > 1 ? "s" : "");
+                        var nHeads = aDiskData[0].length;
+                        var sHeads = nHeads + " head" + (nHeads > 1 ? "s" : "");
+                        var nSectorsPerTrack = aDiskData[0][0].length;
+                        var sSectorsPerTrack = nSectorsPerTrack + " sector" + (nSectorsPerTrack > 1 ? "s" : "") + "/track";
+                        this.printMessage(sCylinders + ", " + sHeads + ", " + sSectorsPerTrack);
+                    }
+                    /*
+                     * Before the image is usable, we must "normalize" all the sectors.  In the past, this meant
+                     * "inflating" them all.  However, that's no longer strictly necessary.  Mainly, it just means
+                     * setting 'length', 'data', and 'pattern' properties, so that all the sectors are well-defined.
+                     * This includes detecting sector data in older formats (eg, the old array of 'bytes' instead
+                     * of the new 'data' array of dwords) and converting them on-the-fly to the current format.
+                     */
+                    this.nCylinders = aDiskData.length;
+                    this.nHeads = aDiskData[0].length;
+                    this.nSectors = aDiskData[0][0].length;
+                    var sector = aDiskData[0][0][0];
+                    this.cbSector = (sector && sector['length']) || 512;
+
+                    var dwChecksum = 0;
+                    for (var iCylinder = 0; iCylinder < this.nCylinders; iCylinder++) {
+                        for (var iHead = 0; iHead < this.nHeads; iHead++) {
+                            for (var iSector = 0; iSector < this.nSectors; iSector++) {
+                                sector = aDiskData[iCylinder][iHead][iSector];
+                                if (!sector) continue;          // non-standard (eg, XDF) disk images may have "unused" (null) sectors
+                                var length = sector['length'];
+                                if (length === undefined) {     // provide backward-compatibility with older JSON...
+                                    length = sector['length'] = 512;
+                                }
+                                length >>= 2;                   // convert length from a byte-length to a dword-length
+                                var dwPattern = sector['pattern'];
+                                if (dwPattern === undefined) {
+                                    dwPattern = sector['pattern'] = 0;
+                                }
+                                var adw = sector['data'];
+                                if (adw === undefined) {
+                                    var ab = sector['bytes'];
+                                    if (ab === undefined || !ab.length) {
+                                        /*
+                                         * It would be odd if there was neither a 'bytes' nor 'data' array; I'm just
+                                         * being paranoid.  It's more likely that the 'bytes' array is simply empty,
+                                         * in which case we need only create an empty 'data' array and turn the byte
+                                         * pattern, if any, into a dword pattern.
+                                         */
+                                        adw = [];
+
+                                        dwPattern = sector['pattern'] = (dwPattern | (dwPattern << 8) | (dwPattern << 16) | (dwPattern << 24));
+                                        sector['data'] = adw;
+                                    } else {
+                                        /*
+                                         * To keep the conversion code simple, we'll do any necessary pattern-filling first,
+                                         * to fully "inflate" the sector, eliminating the possibility of partial dwords and
+                                         * saving any code downstream from dealing with byte-size patterns.
+                                         */
+                                        var cb = length << 2;
+                                        for (var ib = ab.length; ib < cb; ib++) {
+                                            ab[ib] = dwPattern; // the pattern for byte-arrays was only a byte
+                                        }
+                                        this.fill(sector, ab, 0);
+                                    }
+                                    delete sector['bytes'];
+                                }
+                                this.initSector(sector, iCylinder, iHead);
+                                /*
+                                 * For the disk as a whole, we maintain a checksum of the original unmodified data:
+                                 *
+                                 *      dwChecksum: summation of all dwords in all non-empty sectors
+                                 *
+                                 * Pattern-filling of sectors is deferred until absolutely necessary (eg, when a sector is
+                                 * being written).  So all we need to do at this point is checksum all the initial sector data.
+                                 */
+                                for (var idw = 0; idw < adw.length; idw++) {
+                                    dwChecksum = (dwChecksum + adw[idw]) & (0xffffffff|0);
+                                }
+                            }
+                        }
+                    }
+                    this.aDiskData = aDiskData;
+                    this.dwChecksum = dwChecksum;
+                    disk = this;
+                }
+            } catch (e) {
+                Component.error("Disk image error (" + sURL + "): " + e.message);
+            }
+        }
+
+        if (this.fnNotify) {
+            this.fnNotify.call(this.controllerNotify, this.drive, disk, this.sDiskName, this.sDiskPath);
+            this.fnNotify = null;
+        }
+    }
+
+    /**
+     * getSectorString(sector, off, len)
+     *
+     * WARNING: This function is restricted to reading a string contained ENTIRELY within the specified sector.
+     *
+     * @this {DiskPDP11}
+     * @param {Object} sector
+     * @param {number} off (byte offset)
+     * @param {number} len (use -1 to read a null-terminated string)
+     * @return {string}
+     */
+    getSectorString(sector, off, len)
+    {
+        var s = "";
+        while (len--) {
+            var b = this.read(sector, off++);
+            if (b <= 0) break;
+            s += String.fromCharCode(b);
+        }
+        return s;
+    }
+
+    /**
+     * initSector(sector, iCylinder, iHead, iSector, cbSector, dwPattern)
+     *
+     * Ensures every sector has ALL the properties of a proper Sector object; ie:
+     *
+     *      'sector':   sector number
+     *      'length':   size of the sector, in bytes
+     *      'data':     array of dwords
+     *      'pattern':  dword pattern to use for empty or partial sectors
+     *
+     * In addition, we will maintain the following information on a per-sector basis,
+     * as sectors are modified:
+     *
+     *      iModify:    index of first modified dword in sector
+     *      cModify:    number of modified dwords in sector
+     *      fDirty:     true if sector is dirty, false if clean (or cleaning in progress)
+     *
+     * @this {DiskPDP11}
+     * @param {Object} sector
+     * @param {number} iCylinder
+     * @param {number} iHead
+     * @param {number} [iSector]
+     * @param {number} [cbSector]
+     * @param {number|null} [dwPattern]
+     * @return {Object}
+     */
+    initSector(sector, iCylinder, iHead, iSector, cbSector, dwPattern)
+    {
+        if (!sector) {
+            sector = {'sector': iSector, 'length': cbSector, 'data': [], 'pattern': dwPattern};
+        }
+        sector.iCylinder = iCylinder;
+        sector.iHead = iHead;
+        sector.iModify = sector.cModify = 0;
+        sector.fDirty = false;
+        return sector;
+    }
+
+    /**
+     * info()
+     *
+     * TODO: Decide whether deprecate this in favor of accessing the nCylinders, nHeads, nSectors, and cbSector
+     * properties of the Disk object directly.
+     *
+     * @this {DiskPDP11}
+     * @return {Array} containing: [nCylinders, nHeads, nSectorsPerTrack, nBytesPerSector]
+     */
+    info()
+    {
+        if (!this.aDiskData.length) {
+            return [0, 0, 0, 0];
+        }
+        return [this.aDiskData.length, this.aDiskData[0].length, this.aDiskData[0][0].length, this.aDiskData[0][0][0]['length']];
+    }
+
+    /**
+     * seek(iCylinder, iHead, iSector, fWrite, done)
+     *
+     * TODO: There's some dodgy code in seek() that allows floppy images to be dynamically
+     * reconfigured with more heads and/or sectors/track, and it does so by peeking at more drive
+     * properties.  That code used to be in the FDC component, where it was perfectly reasonable
+     * to access those properties.  We need a cleaner interface back to the drive, similar to the
+     * info() interface we provide to the controller.
+     *
+     * Whether or not the "dynamic reconfiguration" feature itself is perfectly reasonable is,
+     * of course, a separate question.
+     *
+     * @this {DiskPDP11}
+     * @param {number} iCylinder
+     * @param {number} iHead
+     * @param {number} iSector
+     * @param {boolean} [fWrite]
+     * @param {function(Object,boolean)} [done]
+     * @return {Object|null} is the requested sector, or null if not found (or not available yet)
+     */
+    seek(iCylinder, iHead, iSector, fWrite, done)
+    {
+        var sector = null;
+        var drive = this.drive;
+        var cylinder = this.aDiskData[iCylinder];
+        if (cylinder) {
+            var i;
+            var track = cylinder[iHead];
+            /*
+             * The following code allows a single-sided diskette image to be reformatted (ie, "expanded")
+             * as a double-sided image, provided the drive has more than one head (see drive.nHeads).
+             */
+            if (!track && drive.bFormatting && iHead < drive.nHeads) {
+                track = cylinder[iHead] = new Array(drive.bSectorEnd);
+                for (i = 0; i < track.length; i++) {
+                    track[i] = this.initSector(null, iCylinder, iHead, i + 1, drive.nBytes, 0);
+                }
+            }
+            if (track) {
+                for (i = 0; i < track.length; i++) {
+                    if (track[i] && track[i]['sector'] == iSector) {
+                        /*
+                         * If the sector's pattern is null, then this sector's true contents have not yet
+                         * been fetched from the server.
+                         */
+                        sector = track[i];
+                        break;
+                    }
+                }
+                /*
+                 * The following code allows an 8-sector track to be reformatted (ie, "expanded") as a 9-sector track.
+                 */
+                if (!sector && drive.bFormatting && drive.bSector == 9) {
+                    sector = track[i] = this.initSector(null, iCylinder, iHead, drive.bSector, drive.nBytes, 0);
+                }
+            }
+        }
+        if (done) done(sector, false);
+        return sector;
+    }
+
+    /**
+     * fill(sector, ab, off)
+     *
+     * @this {DiskPDP11}
+     * @param {Object} sector
+     * @param {*} ab (technically, this should be typed as Array.<number> but I'm having trouble coercing JSON.parse() to that)
+     * @param {number} off
+     */
+    fill(sector, ab, off)
+    {
+        var cdw = sector['length'] >> 2;
+        var adw = new Array(cdw);
+        for (var idw = 0; idw < cdw; idw++) {
+            adw[idw] = ab[off] | (ab[off + 1] << 8) | (ab[off + 2] << 16) | (ab[off + 3] << 24);
+            off += 4;
+        }
+        sector['data'] = adw;
+        /*
+         * TODO: Consider taking this opportunity to shrink 'data' down by the number of dwords at the end of the buffer that
+         * contain the same pattern, and setting 'pattern' accordingly.
+         */
+    }
+
+    /**
+     * toBytes(sector)
+     *
+     * @this {DiskPDP11}
+     * @param {Object} sector
+     * @return {Array.<number>} is an array of bytes
+     */
+    toBytes(sector)
+    {
+        var cb = sector['length'];
+        var ab = new Array(cb);
+        var ib = 0;
+        var cdw = cb >> 2;
+        var adw = sector['data'];
+        var dwPattern = sector['pattern'];
+        for (var idw = 0; idw < cdw; idw++) {
+            var dw = (idw < adw.length? adw[idw] : dwPattern);
+            ab[ib++] = dw & 0xff;
+            ab[ib++] = (dw >> 8) & 0xff;
+            ab[ib++] = (dw >> 16) & 0xff;
+            ab[ib++] = (dw >> 24) & 0xff;
+        }
+        return ab;
+    }
+
+    /**
+     * read(sector, ibSector, fCompare)
+     *
+     * @this {DiskPDP11}
+     * @param {Object} sector (returned from a previous seek)
+     * @param {number} ibSector a byte index within the given sector
+     * @param {boolean} [fCompare] is true if this write-compare read
+     * @return {number} the specified (unsigned) byte, or -1 if no more data in the sector
+     */
+    read(sector, ibSector, fCompare)
+    {
+        var b = -1;
+        if (sector) {
+            if (ibSector < sector['length']) {
+                var adw = sector['data'];
+                var idw = ibSector >> 2;
+                var dw = (idw < adw.length ? adw[idw] : sector['pattern']);
+                b = ((dw >> ((ibSector & 0x3) << 3)) & 0xff);
+            }
+            if (DEBUG && !fCompare && this.messageEnabled()) {
+                this.printMessage('read("' + this.sDiskFile + '",CHS=' + sector.iCylinder + ':' + sector.iHead + ':' + sector['sector'] + ',index=' + ibSector + ',value=' + Str.toHexByte(b) + ')');
+            }
+        }
+        return b;
+    }
+
+    /**
+     * write(sector, ibSector, b)
+     *
+     * @this {DiskPDP11}
+     * @param {Object} sector (returned from a previous seek)
+     * @param {number} ibSector a byte index within the given sector
+     * @param {number} b the byte value to write
+     * @return {boolean|null} true if write successful, false if write-protected, null if out of bounds
+     */
+    write(sector, ibSector, b)
+    {
+        if (this.fWriteProtected)
+            return false;
+
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage('write("' + this.sDiskFile + '",CHS=' + sector.iCylinder + ':' + sector.iHead + ':' + sector['sector'] + ',index=' + ibSector + ',value=' + Str.toHexByte(b) + ')');
+        }
+
+        if (ibSector < sector['length']) {
+            if (b != this.read(sector, ibSector, true)) {
+                var adw = sector['data'];
+                var dwPattern = sector['pattern'];
+                var idw = ibSector >> 2;
+                var nShift = (ibSector & 0x3) << 3;
+
+                /*
+                 * Ensure every byte up to the specified byte is properly initialized.
+                 */
+                for (var i = adw.length; i <= idw; i++) adw[i] = dwPattern;
+
+                if (!sector.cModify) {
+                    sector.iModify = idw;
+                    sector.cModify = 1;
+                } else if (idw < sector.iModify) {
+                    sector.cModify += sector.iModify - idw;
+                    sector.iModify = idw;
+                } else if (idw >= sector.iModify + sector.cModify) {
+                    sector.cModify += idw - (sector.iModify + sector.cModify) + 1;
+                }
+                adw[idw] = (adw[idw] & ~(0xff << nShift)) | (b << nShift);
+            }
+            return true;
+        }
+        return null;
+    }
+
+    /**
+     * getSector(pba)
+     *
+     * @this {DiskPDP11}
+     * @param {number} pba (physical block address)
+     * @return {Object|null} sector
+     */
+    getSector(pba)
+    {
+        var nSectorsPerCylinder = this.nHeads * this.nSectors;
+        var iCylinder = (pba / nSectorsPerCylinder) | 0;
+        if (iCylinder < this.nCylinders) {
+            var nSectorsRemaining = (pba % nSectorsPerCylinder);
+            var iHead = (nSectorsRemaining / this.nSectors) | 0;
+            /*
+             * PBA numbers are 0-based, but the sector numbers in CHS addressing are 1-based, so add one to iSector
+             */
+            var iSector = (nSectorsRemaining % this.nSectors) + 1;
+            return this.seek(iCylinder, iHead, iSector);
+        }
+        return null;
+    }
+
+    /**
+     * getSectorData(sector, off, len)
+     *
+     * WARNING: This function is restricted to reading data contained ENTIRELY within the specified sector.
+     *
+     * NOTE: Yes, this function is not the most efficient way to read a byte/word/dword value from within a sector,
+     * but given the different states a sector may be in, it's certainly the simplest and safest, and since this is
+     * only used by buildFileTable() and its progeny, it's not clear that we need to be superfast anyway.
+     *
+     * @this {DiskPDP11}
+     * @param {Object} sector
+     * @param {number} off (byte offset)
+     * @param {number} len (1 to 4 bytes)
+     * @return {number}
+     */
+    getSectorData(sector, off, len)
+    {
+        var dw = 0;
+        var nShift = 0;
+
+        while (len--) {
+
+            var b = this.read(sector, off++);
+
+            if (b < 0) break;
+            dw |= (b << nShift);
+            nShift += 8;
+        }
+        return dw;
+    }
+
+    /**
+     * encodeAsBase64()
+     *
+     * @this {DiskPDP11}
+     * @return {string}
+     */
+    encodeAsBase64()
+    {
+        /*
+         * Gross, but simple; more importantly, it works -- at least for disks of typical floppy magnitude.
+         */
+        var s = "", pba = 0, sector;
+        while ((sector = this.getSector(pba++))) {
+            for (var off = 0, len = sector['length']; off < len; off++) {
+                s += String.fromCharCode(this.getSectorData(sector, off, 1));
+            }
+        }
+        return btoa(s);
+    }
+
+    /**
+     * save()
+     *
+     * The first array entry contains some disk information:
+     *
+     *      [sDiskPath, dwChecksum, nCylinders, nHeads, nSectors, cbSector]
+     *
+     * Each subsequent entry in the returned array contains the following:
+     *
+     *      [iCylinder, iHead, iSector, iModify, [...]]
+     *
+     * where [...] is an array of modified dword(s) in the corresponding sector.
+     *
+     * @this {DiskPDP11}
+     * @return {Array} of modified sectors
+     */
+    save()
+    {
+        var i = 0;
+        var deltas = [];
+        deltas[i++] = [this.sDiskPath, this.dwChecksum, this.nCylinders, this.nHeads, this.nSectors, this.cbSector];
+        if (!this.fWriteProtected) {
+            var aDiskData = this.aDiskData;
+            for (var iCylinder = 0; iCylinder < aDiskData.length; iCylinder++) {
+                for (var iHead = 0; iHead < aDiskData[iCylinder].length; iHead++) {
+                    for (var iSector = 0; iSector < aDiskData[iCylinder][iHead].length; iSector++) {
+                        var sector = aDiskData[iCylinder][iHead][iSector];
+                        if (sector && sector.cModify) {
+                            var mods = [], n = 0;
+                            var iModify = sector.iModify, iModifyLimit = sector.iModify + sector.cModify;
+                            while (iModify < iModifyLimit) {
+                                mods[n++] = sector['data'][iModify++];
+                            }
+                            deltas[i++] = [iCylinder, iHead, iSector, sector.iModify, mods];
+                        }
+                    }
+                }
+            }
+        }
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage('save("' + this.sDiskName + '"): saved ' + (deltas.length - 1) + ' change(s)');
+        }
+        return deltas;
+    }
+
+    /**
+     * restore(deltas)
+     *
+     * The first array entry contains some disk information:
+     *
+     *      [sDiskPath, dwChecksum, nCylinders, nHeads, nSectors, cbSector]
+     *
+     * Each subsequent entry in the supplied array contains the following:
+     *
+     *      [iCylinder, iHead, iSector, iModify, [...]]
+     *
+     * where [...] is an array of modified dword(s) in the corresponding sector.
+     *
+     * @this {DiskPDP11}
+     * @param {Array} deltas
+     * @return {number} 0 if no changes applied, -1 if an error occurred, otherwise the number of sectors modified
+     */
+    restore(deltas)
+    {
+        /*
+         * If deltas is undefined, that's not necessarily an error;  the controller may simply be (re)initializing
+         * itself (although neither controller should be calling restore() under those conditions anymore).
+         */
+        var nChanges = 0;
+        var sReason = "unsupported restore format";
+        /*
+         * I originally added a check for aDiskData here on the assumption that if there was an error loading
+         * a disk image, we will have already notified the user, so any additional errors about differing checksums,
+         * failure to restore the disk state, etc, would just be annoying.  HOWEVER, HDC will create an empty disk
+         * image if its initialization code discovers that no disk was loaded earlier (see verifyDrive).  So while
+         * checking aDiskData is still a good idea, be aware that it won't necessarily avoid redundant error messages
+         * (at least in the case of HDC).
+         */
+        if (deltas && deltas.length > 0) {
+
+            var i = 0;
+            var aDiskInfo = deltas[i++];
+
+            if (aDiskInfo && aDiskInfo.length >= 2) {
+                /*
+                 * Before getting to the checksum, we have to deal with a new situation: restoring an uninitialized
+                 * disk image from a complete set of deltas.  And that is only possible if the disk was saved with the
+                 * original disk geometry.
+                 */
+                if (!this.aDiskData.length && aDiskInfo.length >= 6) {
+                    this.create(DiskAPI.MODE.LOCAL, aDiskInfo[2], aDiskInfo[3], aDiskInfo[4], aDiskInfo[5]);
+                    /*
+                     * TODO: Consider setting a flag here that we can check at the end of the restore() function
+                     * that indicates we should recalculate dwChecksum, because we currently have an inconsistency
+                     * between local disks that are mounted via build() and the same disks that are "remounted"
+                     * later by this code; the former has the correct checksum, while the latter has a null checksum.
+                     *
+                     * As you can see below, we currently deal with this by simply ignoring null checksums....
+                     */
+                }
+                /*
+                 * v1.01 failed to indicate an error if either one of these failure conditions occurred.  Although maybe that's
+                 * just as well, since v1.01 also failed to properly deal with situations where the user mounted different diskette(s)
+                 * prior to exiting (hopefully fixed in v1.02).
+                 */
+                else if (aDiskInfo[1] != null && this.dwChecksum != null && aDiskInfo[1] != this.dwChecksum) {
+                    sReason = "original checksum (" + aDiskInfo[1] + ") differs from current checksum (" + this.dwChecksum + ")";
+                    nChanges = -2;
+                }
+                /*
+                 * Checksum is more important than disk path, and for now, I want the flexibility to move disk images.
+                 *
+                else if (aDiskInfo[0] != this.sDiskPath) {
+                    sReason = "original path '" + aDiskInfo[0] + "' differs from current path '" + this.sDiskPath + "'";
+                    nChanges = -1;
+                }
+                 */
+            }
+
+            if (!this.aDiskData.length) nChanges = -1;
+
+            while (i < deltas.length && nChanges >= 0) {
+                var m = 0;
+                var mod = deltas[i++];
+                var iCylinder = mod[m++];
+                var iHead = mod[m++];
+                var iSector = mod[m++];
+                /*
+                 * Note the buried test for write-protection.  Yes, an invariant condition should be tested
+                 * outside the loop, not inside, but (a) it's a trivial test, (b) the test should never fail
+                 * because save() should never generate any mods for a write-protected disk, and (c) it
+                 * centralizes all the failure conditions we're currently checking (which, admittedly, ain't much).
+                 */
+                if (iCylinder >= this.aDiskData.length || iHead >= this.aDiskData[iCylinder].length || iSector >= this.aDiskData[iCylinder][iHead].length) {
+                    sReason = "sector (CHS=" + iCylinder + ':' + iHead + ':' + iSector + ") out of range (" + nChanges + " changes applied)";
+                    nChanges = -1;
+                    break;
+                }
+                if (this.fWriteProtected) {
+                    sReason = "unable to modify write-protected disk";
+                    nChanges = -1;
+                    break;
+                }
+                var iModify = mod[m++];
+                var mods = mod[m++];
+                var iModifyLimit = iModify + mods.length;
+                var sector = this.aDiskData[iCylinder][iHead][iSector];
+                if (!sector) continue;
+                /*
+                 * Since write() now deals with empty/partial sectors, we no longer need to completely "inflate"
+                 * the sector prior to applying modifications.  So let's just make sure that the sector is "inflated"
+                 * up to iModify.
+                 */
+                var idw = sector['data'].length;
+                while (idw < iModify) {
+                    sector['data'][idw++] = sector['pattern'];
+                }
+                var n = 0;
+                sector.iModify = iModify;
+                sector.cModify = mods.length;
+                while (iModify < iModifyLimit) {
+                    sector['data'][iModify++] = mods[n++];
+                }
+                nChanges++;
+            }
+        }
+
+        if (nChanges < 0) {
+            /*
+             * We're suppressing checksum messages for the general public for now....
+             */
+            if (DEBUG || nChanges != -2) {
+                this.controller.notice("Unable to restore disk '" + this.sDiskName + ": " + sReason);
+            }
+        } else {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage('restore("' + this.sDiskName + '"): restored ' + nChanges + ' change(s)');
+            }
+        }
+        return nChanges;
+    }
+
+    /**
+     * toJSON()
+     *
+     * We perform some RegExp massaging on the JSON data to eliminate unnecessary properties
+     * (eg, 'length' values of 512, 'pattern' values of 0, since those are defaults).
+     *
+     * In addition, we first check every sector to see if it can be "deflated".  Sectors that were
+     * initially "deflated" should remain that way unless/until they were modified, so technically,
+     * we could call deflateSector() just for modified sectors, but this isn't a common operation,
+     * so it doesn't hurt to check every sector.
+     *
+     * @this {DiskPDP11}
+     * @return {string} containing the entire disk image as JSON-encoded data
+     */
+    toJSON()
+    {
+        var s, pba = 0, sector, sectorLast;
+
+        while ((sector = this.getSector(pba++))) {
+            this.deflateSector(sector);
+        }
+
+        s = JSON.stringify(this.aDiskData, function(key, value) {
+            /*
+             * If BACKTRACK support is enabled, we have to filter out any 'file' properties that may
+             * be attached to the sector objects, lest we risk blowing the stack due to circular references.
+             */
+            if (key == 'file') {
+                return undefined;
+            }
+            return value;
+        });
+
+        /*
+         * Eliminate unnecessary default properties (eg, 'length' values of 512, 'pattern' values of 0).
+         */
+        s = s.replace(/,"length":512/gm, "").replace(/,"pattern":0/gm, "");
+
+        /*
+         * I don't really want to strip quotes from disk image property names, since I would have to put them
+         * back again during mount() -- or whenever JSON.parse() is used instead of eval().  But I still remove
+         * them temporarily, so that any remaining property names (eg, "iModify", "cModify", "fDirty") can
+         * easily be stripped out, by virtue of their being the only quoted properties left.  We then "requote"
+         * all the property names that remain.
+         */
+        s = s.replace(/"(sector|length|data|pattern)":/gm, "$1:");
+
+        /*
+         * The next line will remove any other numeric or boolean properties that were added at runtime, although
+         * they may have completely different ("minified") names if the code has been compiled.
+         */
+        s = s.replace(/,"[^"]*":([0-9]+|true|false)/gm, "");
+        s = s.replace(/(sector|length|data|pattern):/gm, "\"$1\":");
+
+        /*
+         * Last but not least, insert line breaks after every object definition, to ease the pain on text editors.
+         */
+        s = s.replace(/([\]}]),/gm, "$1,\n");
+        return s;
+    }
+
+    /**
+     * deflateSector(sector)
+     *
+     * This is just the first revision: it currently looks only at fully inflated sectors.
+     *
+     * @this {DiskPDP11}
+     * @param {Object} sector
+     */
+    deflateSector(sector)
+    {
+        var adw = sector['data'];
+        var cdw = adw.length;
+        if ((cdw << 2) == sector['length']) {
+            var idw = cdw - 1;
+            var dwPattern = adw[idw], cDupes = 0;
+            while (idw--) {
+                if (adw[idw] !== dwPattern) break;
+                cDupes++;
+            }
+            if (cDupes++) {
+                adw.length = cdw - cDupes;
+                sector['pattern'] = dwPattern;
+            }
+        }
+    }
+
+    /**
+     * dumpSector(sector, pba, sDesc)
+     *
+     * @this {DiskPDP11}
+     * @param {Object} sector (returned from a previous seek)
+     * @param {number} [pba]
+     * @param {string} [sDesc]
+     * @return {string}
+     */
+    dumpSector(sector, pba, sDesc)
+    {
+        var sDump = "";
+        if (DEBUG && sector) {
+            if (pba != null) sDump += "sector " + pba + (sDesc? (" for " + sDesc) : "") + ':';
+            var sBytes = "", sChars = "";
+            var cbSector = sector['length'];
+            var cdwData = sector['data'].length;
+            var dw = 0;
+            for (var i = 0; i < cbSector; i++) {
+                if ((i % 16) === 0) {
+                    if (sDump) sDump += sBytes + ' ' + sChars + '\n';
+                    sDump += Str.toHex(i, 4) + ": ";
+                    sBytes = sChars = "";
+                }
+                if ((i % 4) === 0) {
+                    var idw = i >> 2;
+                    dw = (idw < cdwData? sector['data'][idw] : sector['pattern']);
+                }
+                var b = dw & 0xff;
+                dw >>>= 8;
+                sBytes += Str.toHex(b, 2) + (i % 16 == 7? "-" : " ");
+                sChars += (b >= 32 && b < 128? String.fromCharCode(b) : ".");
+            }
+            if (sBytes) sDump += sBytes + ' ' + sChars;
+        }
+        return sDump;
+    }
+}
+
+/*
+ * A global disk count, used to form unique Disk component IDs (totally optional; for debugging purposes only)
+ */
+DiskPDP11.nDisks = 0;
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/drive.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * @typedef {{
+ *  PRI:        number,
+ *  VEC:        number,
+ *  DRIVES:     number
+ * }}
+ */
+var Config;
+
+/**
+ * Since the Closure Compiler treats ES6 classes as @struct rather than @dict by default,
+ * it deters us from defining named properties on our components; eg:
+ *
+ *      this['exports'] = {...}
+ *
+ * results in an error:
+ *
+ *      Cannot do '[]' access on a struct
+ *
+ * So, in order to define 'exports', we must override the @struct assumption by annotating
+ * the class as @unrestricted (or @dict).  Note that this must be done both here and in the
+ * Component class, because otherwise the Compiler won't allow us to *reference* the named
+ * property either.
+ *
+ * TODO: Consider marking ALL our classes unrestricted, because otherwise it forces us to
+ * define every single property the class uses in its constructor, which results in a fair
+ * bit of redundant initialization, since many properties aren't (and don't need to be) fully
+ * initialized until the appropriate init(), reset(), restore(), etc. function is called.
+ *
+ * The upside, however, may be that since the structure of the class is completely defined by
+ * the constructor, JavaScript engines may be able to optimize and run more efficiently.
+ *
+ * @unrestricted
+ */
+class DriveController extends Component {
+    /**
+     * DriveController(type, parms, bitsMessage, configDC, configDrive, configIO)
+     *
+     * The DriveController component has the following component-specific (parms) properties:
+     *
+     *      autoMount: one or more JSON-encoded objects, each containing 'name' and 'path' properties
+     *
+     * @param {string} type
+     * @param {Object} parms
+     * @param {number} bitsMessage
+     * @param {Config} configDC
+     * @param {Array} configDrive
+     * @param {Object} configIO
+     */
+    constructor(type, parms, bitsMessage, configDC, configDrive, configIO)
+    {
+        super(type, parms, bitsMessage);
+
+        /*
+         * We preliminarily parse and record any 'autoMount' object now, but we no longer process it
+         * until initBus(), because the Computer's getMachineParm() service may have an override for us.
+         */
+        this.configMount = this.parseConfig(parms['autoMount']);
+        this.cAutoMount = 0;
+
+        this.configDC = configDC;
+        this.configDrive = configDrive;
+        this.configIO = configIO;
+
+        this.nDrives = configDC.DRIVES;
+        this.aDrives = new Array(this.nDrives);
+        this.fLocalDisks = (!Web.isMobile() && window && 'FileReader' in window);
+        this.sDiskSource = DriveController.SOURCE.NONE;
+
+        /*
+         * The following array keeps track of every disk image we've ever mounted.  Each entry in the
+         * array is another array whose elements are:
+         *
+         *      [0]: name of disk
+         *      [1]: path of disk
+         *      [2]: array of deltas, uninitialized until the disk is unmounted and/or all state is saved
+         *
+         * See functions addDiskHistory() and updateDiskHistory().
+         */
+        this.aDiskHistory = [];
+
+        this.irq = null;
+
+        this['exports'] = {
+            'bootDisk': this.bootSelectedDisk,
+            'loadDisk': this.loadSelectedDrive,
+            'selectDrive': this.selectDrive,
+            'wait': this.waitDrives
+        };
+    }
+
+    /**
+     * parseConfig(config)
+     *
+     * @this {DriveController}
+     * @param {*} config
+     * @return {*}
+     */
+    parseConfig(config)
+    {
+        if (config && typeof config == "string") {
+            try {
+                /*
+                 * The most likely source of any exception will be right here, where we're parsing
+                 * this JSON-encoded data.
+                 */
+                config = eval("(" + config + ")");
+            } catch (e) {
+                Component.error(this.type + " auto-mount error: " + e.message + " (" + config + ")");
+                config = null;
+            }
+        }
+        return config || {};
+    }
+
+    /**
+     * setBinding(sType, sBinding, control, sValue)
+     *
+     * @this {DriveController}
+     * @param {string|null} sType is the type of the HTML control (eg, "button", "list", "text", etc)
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "listDisks")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sType, sBinding, control, sValue)
+    {
+        var dc = this;
+
+        switch (sBinding) {
+
+        case "listDisks":
+            this.bindings[sBinding] = control;
+            control.onchange = function onChangeListDisks(event) {
+                dc.updateSelectedDisk();
+            };
+            return true;
+
+        case "descDisk":
+        case "listDrives":
+            this.bindings[sBinding] = control;
+            /*
+             * I tried going with onclick instead of onchange, so that if you wanted to confirm what's
+             * loaded in a particular drive, you could click the drive control without having to change it.
+             * However, that doesn't seem to work for all browsers, so I've reverted to onchange.
+             */
+            control.onchange = function onChangeListDrives(event) {
+                var iDrive = Str.parseInt(control.value, 10);
+                if (iDrive != null) dc.displayDisk(iDrive);
+            };
+            return true;
+
+        case "loadDisk":
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickLoadDrive(event) {
+                dc.loadSelectedDrive();
+            };
+            return true;
+
+        case "bootDisk":
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickBootDisk(event) {
+                dc.bootSelectedDisk();
+            };
+            return true;
+
+        case "saveDisk":
+            /*
+             * Yes, technically, this feature does not require "Local disk support" (which is really a reference
+             * to FileReader support), but since fLocalDisks is also false for all mobile devices, and since there
+             * is an "orthogonality" to disabling both features in tandem, let's just let it slide, OK?
+             */
+            if (!this.fLocalDisks) {
+                if (DEBUG) this.log("Local disk support not available");
+                /*
+                 * We could also simply hide the control; eg:
+                 *
+                 *      control.style.display = "none";
+                 *
+                 * but removing the control altogether seems better.
+                 */
+                control.parentNode.removeChild(/** @type {Node} */ (control));
+                return false;
+            }
+
+            this.bindings[sBinding] = control;
+
+            control.onclick = function onClickSaveDrive(event) {
+                var controlDrives = dc.bindings["listDrives"];
+                if (controlDrives && controlDrives.options && dc.aDrives) {
+                    var iDriveSelected = Str.parseInt(controlDrives.value, 10) || 0;
+                    var drive = dc.aDrives[iDriveSelected];
+                    if (drive) {
+                        /*
+                         * Note the similarity (and hence factoring opportunity) between this code and the HDC's "saveHD*" binding.
+                         */
+                        var disk = drive.disk;
+                        if (disk) {
+                            if (DEBUG) dc.println("saving disk " + disk.sDiskPath + "...");
+                            var sAlert = Web.downloadFile(disk.encodeAsBase64(), "octet-stream", true, disk.sDiskFile.replace(".json", ".img"));
+                            Component.alertUser(sAlert);
+                        } else {
+                            dc.notice("No disk loaded in drive.");
+                        }
+                    } else {
+                        dc.notice("No disk drive selected.");
+                    }
+                }
+            };
+            return true;
+
+        case "mountDisk":
+            if (!this.fLocalDisks) {
+                if (DEBUG) this.log("Local disk support not available");
+                /*
+                 * We could also simply hide the control; eg:
+                 *
+                 *      control.style.display = "none";
+                 *
+                 * but removing the control altogether seems better.
+                 */
+                control.parentNode.removeChild(/** @type {Node} */ (control));
+                return false;
+            }
+
+            this.bindings[sBinding] = control;
+
+            /*
+             * Enable "Mount" button only if a file is actually selected
+             */
+            control.addEventListener('change', function() {
+                var fieldset = control.children[0];
+                var files = fieldset.children[0].files;
+                var submit = fieldset.children[1];
+                submit.disabled = !files.length;
+            });
+
+            control.onsubmit = function(event) {
+                var file = event.currentTarget[1].files[0];
+                if (file) {
+                    var sDiskPath = file.name;
+                    var sDiskName = Str.getBaseName(sDiskPath, true);
+                    dc.loadSelectedDrive(sDiskName, sDiskPath, file);
+                }
+                /*
+                 * Prevent reloading of web page after form submission
+                 */
+                return false;
+            };
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * initBus(cmp, bus, cpu, dbg)
+     *
+     * @this {DriveController}
+     * @param {ComputerPDP11} cmp
+     * @param {BusPDP11} bus
+     * @param {CPUStatePDP11} cpu
+     * @param {DebuggerPDP11} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.cmp = cmp;
+        this.bus = bus;
+        this.cpu = cpu;
+        this.dbg = dbg;
+
+        var configMount = this.parseConfig(this.cmp.getMachineParm('autoMount'));
+
+        /*
+         * Add only drives from the machine-wide autoMount configuration that match drives managed by this component.
+         */
+        if (configMount) {
+            for (var sDrive in configMount) {
+                if (sDrive.substr(0, 2) != this.type.substr(0, 2)) continue;
+                this.configMount[sDrive] = configMount[sDrive];
+            }
+        }
+
+        /*
+         * If we didn't need auto-mount support, we could defer controller and drive initialization until we received
+         * a powerUp() notification, at which point reset() would call initController(), or restore() would restore the
+         * controller.
+         */
+        this.reset();
+
+        this.irq = this.cpu.addIRQ(this.configDC.VEC, this.configDC.PRI, this.bitsMessage);
+
+        bus.addIOTable(this, this.configIO);
+        bus.addResetHandler(this.reset.bind(this));
+
+        this.addDisk("None", DriveController.SOURCE.NONE, true);
+        if (this.fLocalDisks) this.addDisk("Local Disk", DriveController.SOURCE.LOCAL);
+        this.addDisk("Remote Disk", DriveController.SOURCE.REMOTE);
+
+        if (!this.autoMount()) this.setReady();
+    }
+
+    /**
+     * getDriveName(iDrive)
+     *
+     * Form a drive name using the two-letter controller type prefix and the drive number.
+     *
+     * @this {DriveController}
+     * @param {number} iDrive
+     * @return {string}
+     */
+    getDriveName(iDrive)
+    {
+        var drive = this.aDrives[iDrive];
+        return drive.sName || "---";
+    }
+
+    /**
+     * getDriveNumber(sDrive)
+     *
+     * @this {DriveController}
+     * @param {string} sDrive
+     * @return {number} (0-3, or -1 if error)
+     */
+    getDriveNumber(sDrive)
+    {
+        var iDrive = -1;
+        if (sDrive) {
+            iDrive = sDrive.charCodeAt(sDrive.length - 1) - 0x30;
+            if (iDrive < 0 || iDrive > 9) iDrive = -1;
+        }
+        return iDrive;
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {DriveController}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            if (!data) {
+                this.reset();
+                if (this.cmp.fReload) {
+                    /*
+                     * If the computer's fReload flag is set, we're required to toss all currently
+                     * loaded disks and remount all disks specified in the auto-mount configuration.
+                     */
+                    this.unloadAllDrives(true);
+                    this.autoMount(true);
+                }
+            } else {
+                if (!this.restore(data)) return false;
+            }
+            /*
+             * Populate the HTML controls to match the actual (well, um, specified) number of floppy drives.
+             */
+            var controlDrives;
+            if ((controlDrives = this.bindings['listDrives'])) {
+                while (controlDrives.firstChild) {
+                    controlDrives.removeChild(controlDrives.firstChild);
+                }
+                controlDrives.value = "";
+                for (var iDrive = 0; iDrive < this.nDrives; iDrive++) {
+                    var controlOption = document.createElement("option");
+                    controlOption.value = iDrive;
+                    controlOption.text = this.getDriveName(iDrive);
+                    controlDrives.appendChild(controlOption);
+                }
+                if (this.nDrives > 0) {
+                    controlDrives.value = "0";
+                    this.displayDisk(0);
+                }
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {DriveController}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean} component state if fSave; otherwise, true if successful, false if failure
+     */
+    powerDown(fSave, fShutdown)
+    {
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * reset()
+     *
+     * @this {DriveController}
+     */
+    reset()
+    {
+        this.initController();
+        this.initDrives();
+    }
+
+    /**
+     * save()
+     *
+     * This implements save support for the DriveController component.
+     *
+     * @this {DriveController}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, this.saveController());
+        state.set(1, this.saveHistory());
+        state.set(2, this.saveDrives());
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements restore support for the DriveController component.
+     *
+     * @this {DriveController}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        var fSuccess = true;
+        if (!this.initController(data[0])) fSuccess = false;
+        if (!this.initHistory(data[1])) fSuccess = false;
+        if (!this.initDrives(data[2])) fSuccess = false;
+        return fSuccess;
+    }
+
+    /**
+     * initController(aRegs)
+     *
+     * Placeholder for subclasses.
+     *
+     * @this {DriveController}
+     * @param {Array} [aRegs]
+     * @return {boolean} true if successful, false if failure
+     */
+    initController(aRegs)
+    {
+        return true;
+    }
+
+    /**
+     * saveController()
+     *
+     * Placeholder for subclasses.
+     *
+     * @this {DriveController}
+     * @return {Array}
+     */
+    saveController()
+    {
+        return [];
+    }
+
+    /**
+     * initDrive(drive, iDrive, configDrive, configDisk)
+     *
+     * @this {DriveController}
+     * @param {Object} drive
+     * @param {number} iDrive
+     * @param {Array} configDrive
+     * @param {Array} [configDisk]
+     * @return {boolean} true if successful, false if failure
+     */
+    initDrive(drive, iDrive, configDrive, configDisk)
+    {
+        var i = 0;
+        var fSuccess = true;
+
+        drive.iDrive = iDrive;
+        drive.name = this.idComponent;
+        drive.fBusy = drive.fLocal = false;
+        drive.fnCallReady = null;
+        drive.fRemovable = true;
+
+        /*
+         * NOTE: We initialize the following drive properties to their MAXIMUMs; disks may have
+         * these or SMALLER values (subject to the limits of what the controller supports, of course).
+         */
+        drive.sName = configDrive[i++] + iDrive;
+        drive.nCylinders = configDrive[i++];
+        drive.nHeads = configDrive[i++];
+        drive.nSectors = configDrive[i++];
+        drive.cbSector = configDrive[i++];
+        drive.iCylinderBoot = configDrive[i++];
+        drive.iHeadBoot = configDrive[i++];
+        drive.iSectorBoot = configDrive[i++];
+        drive.cbSectorBoot = configDrive[i++];
+        drive.status = configDrive[i++];
+
+        /*
+         * The next group of properties are set by various controller command sequences.
+         */
+        drive.bHead = 0;
+        drive.bCylinder = 0;
+        drive.bSector = 1;
+        drive.bSectorEnd = drive.nSectors;      // aka EOT
+        drive.nBytes = drive.cbSector;
+
+        /*
+         * The next group of properties are managed by worker functions (eg, doRead()) to maintain state across DMA requests.
+         */
+        drive.ibSector = 0;
+        drive.sector = null;
+
+        if (!drive.disk) {
+            drive.sDiskPath = "";               // ensure this is initialized to a default that displayDisk() can deal with
+        }
+
+        if (configDisk) {
+            var fLocal = configDisk[0];
+            var sDiskName = configDisk[1];
+            var sDiskPath = configDisk[2];
+            /*
+             * If we're restoring a local disk image, then the entire disk contents should be captured in aDiskHistory,
+             * so all we have to do is mount a blank disk and let disk.restore() do the rest; ie, there's nothing to
+             * "load" (it's a purely synchronous operation).
+             *
+             * Otherwise, we must call loadDrive(); in the common case, loadDrive() will have already "auto-mounted"
+             * the disk, so it will return true, and then we restore any deltas to the current image.
+             *
+             * However, if loadDrive() returns false, then it has initiated the load for a *different* disk image,
+             * so we must mark ourselves as "not ready" again, and add another "wait for ready" test in Computer before
+             * finally powering the CPU.
+             */
+            if (fLocal) {
+                this.mountDrive(iDrive, sDiskName, sDiskPath);
+            }
+            else if (this.loadDrive(iDrive, sDiskName, sDiskPath, true)) {
+                if (drive.disk) {
+                    if (sDiskPath) {
+                        this.addDiskHistory(sDiskName, sDiskPath, drive.disk);
+                    } else {
+                        if (MAXDEBUG) Component.warning("Disk '" + (drive.disk.sDiskName || sDiskName) + "' not recorded properly in drive " + iDrive);
+                    }
+                }
+            } else {
+                this.setReady(false);
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * initDrives(aConfigDisks)
+     *
+     * @this {DriveController}
+     * @param {Array} [aConfigDisks]
+     * @return {boolean} true if successful, false if failure
+     */
+    initDrives(aConfigDisks)
+    {
+        var fSuccess = true;
+        for (var iDrive = 0; iDrive < this.aDrives.length; iDrive++) {
+            var drive = this.aDrives[iDrive];
+            if (drive === undefined) {
+                drive = this.aDrives[iDrive] = {};
+            }
+            var configDisk = aConfigDisks && aConfigDisks[iDrive];
+            if (!this.initDrive(drive, iDrive, this.configDrive, configDisk)) {
+                fSuccess = false;
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * saveDrive(drive)
+     *
+     * @this {DriveController}
+     * @param {Object} drive
+     * @return {Array}
+     */
+    saveDrive(drive)
+    {
+        return [
+            drive.fLocal,
+            drive.sDiskName,
+            drive.sDiskPath
+        ]
+    }
+
+    /**
+     * saveDrives()
+     *
+     * @this {DriveController}
+     * @return {Array}
+     */
+    saveDrives()
+    {
+        var data = [];
+        for (var iDrive = 0; iDrive < this.aDrives.length; iDrive++) {
+            data.push(this.saveDrive(this.aDrives[iDrive]));
+        }
+        return data;
+    }
+
+    /**
+     * initHistory(aHistory)
+     *
+     * @this {DriveController}
+     * @param {Array} [aHistory]
+     * @return {boolean} true if successful, false if failure
+     */
+    initHistory(aHistory)
+    {
+        /*
+         * Initialize the disk history (if available) before initializing the drives, so that any disk deltas can be
+         * applied to disk images that are already loaded.
+         */
+        if (aHistory) this.aDiskHistory = aHistory;
+
+        return true;
+    }
+
+    /**
+     * saveHistory()
+     *
+     * This returns an array of entries, one for each disk image we've ever mounted, including any deltas; ie:
+     *
+     *      [name, path, deltas]
+     *
+     * aDiskHistory contains exactly that, except that deltas may not be up-to-date for any currently mounted
+     * disk image(s), so we call updateHistory() for all those disks, and then aDiskHistory is ready to be saved.
+     *
+     * @this {DriveController}
+     * @return {Array}
+     */
+    saveHistory()
+    {
+        for (var iDrive = 0; iDrive < this.aDrives.length; iDrive++) {
+            var drive = this.aDrives[iDrive];
+            if (drive.disk) {
+                this.updateDiskHistory(drive.sDiskName, drive.sDiskPath, drive.disk);
+            }
+        }
+        return this.aDiskHistory;
+    }
+
+    /**
+     * autoMount(fRemount)
+     *
+     * @this {DriveController}
+     * @param {boolean} [fRemount] is true if we're remounting all auto-mounted disks
+     * @return {boolean} true if one or more disk images are being auto-mounted, false if none
+     */
+    autoMount(fRemount)
+    {
+        if (!fRemount) this.cAutoMount = 0;
+        for (var sDrive in this.configMount) {
+            var configDisk = this.configMount[sDrive];
+            var sDiskPath = configDisk['path'] || "";
+            var sDiskName = configDisk['name'] || this.findDisk(sDiskPath);
+            if (sDiskPath && sDiskName) {
+                var iDrive = this.getDriveNumber(sDrive);
+                if (iDrive >= 0 && iDrive < this.aDrives.length) {
+                    if (!this.loadDrive(iDrive, sDiskName, sDiskPath, true) && fRemount) {
+                        this.setReady(false);
+                    }
+                    continue;
+                }
+            }
+            this.notice("Incorrect auto-mount settings for drive " + sDrive + " (" + JSON.stringify(configDisk) + ")");
+        }
+        return !!this.cAutoMount;
+    }
+
+    /**
+     * loadSelectedDrive(sDiskName, sDiskPath, file)
+     *
+     * @this {DriveController}
+     * @param {string} [sDiskName]
+     * @param {string} [sDiskPath]
+     * @param {File} [file] is set if there's an associated File object
+     * @return {boolean}
+     */
+    loadSelectedDrive(sDiskName, sDiskPath, file)
+    {
+        if (!sDiskName && !sDiskPath) {
+            var controlDisks = this.bindings["listDisks"];
+            if (controlDisks && controlDisks.options) {
+                sDiskName = controlDisks.options[controlDisks.selectedIndex].text;
+                sDiskPath = controlDisks.value;
+            }
+        }
+
+        var controlDrives = this.bindings["listDrives"];
+        var iDrive = controlDrives && Str.parseInt(controlDrives.value, 10);
+
+        if (iDrive === undefined || iDrive < 0 || iDrive >= this.aDrives.length) {
+            this.notice("Unable to load the selected drive");
+            return false;
+        }
+
+        if (!sDiskPath) {
+            this.unloadDrive(iDrive);
+            return true;
+        }
+
+        if (sDiskPath == DriveController.SOURCE.LOCAL) {
+            this.notice('Use "Choose File" and "Mount" to select and load a local disk.');
+            return false;
+        }
+
+        /*
+         * If the special DriveController.SOURCE.REMOTE path is selected, then we want to prompt the user for a URL.
+         * Oh, and make sure we pass an empty string as the 2nd parameter to prompt(), so that IE won't display
+         * "undefined" -- because after all, undefined and "undefined" are EXACTLY the same thing, right?
+         *
+         * TODO: This is literally all I've done to support remote disk images. There's probably more
+         * I should do, like dynamically updating "listDisks" to include new entries, and adding new entries
+         * to the save/restore data.
+         */
+        if (sDiskPath == DriveController.SOURCE.REMOTE) {
+            sDiskPath = window.prompt("Enter the URL of a remote disk image.", "") || "";
+            if (!sDiskPath) return false;
+            sDiskName = Str.getBaseName(sDiskPath);
+            this.status("Attempting to load " + sDiskPath + " as \"" + sDiskName + "\"");
+            this.sDiskSource = DriveController.SOURCE.REMOTE;
+        }
+        else {
+            this.sDiskSource = sDiskPath;
+        }
+
+        this.loadDrive(iDrive, sDiskName, sDiskPath, false, file);
+        return true;
+    }
+
+    /**
+     * bootSelectedDisk()
+     *
+     * @this {DriveController}
+     * @return {boolean}
+     */
+    bootSelectedDisk()
+    {
+        var drive;
+        var controlDrives = this.bindings["listDrives"];
+        var iDrive = controlDrives && Str.parseInt(controlDrives.value, 10);
+
+        if (iDrive == null || iDrive < 0 || iDrive >= this.aDrives.length || !(drive = this.aDrives[iDrive])) {
+            this.notice("Unable to boot the selected drive");
+            return false;
+        }
+
+        if (!drive.disk) {
+            this.notice("Load a disk into the drive first");
+            return false;
+        }
+
+        /*
+         * NOTE: We're calling setReset() BEFORE reading the boot code in order to eliminate any side-effects
+         * of the previous state of either the controller OR the CPU; for example, we don't want any previous MMU
+         * or UNIBUS Map registers affecting the simulated readData() call.  Also, some boot code (eg, RSTS/E)
+         * expects the controller to be in a READY state; since setReset() triggers a call to our reset() handler,
+         * a READY state is assured, and the readData() call shouldn't do anything to change that.
+         */
+        this.cpu.setReset(0, true, iDrive);
+
+        var err = this.readData(drive, drive.iCylinderBoot, drive.iHeadBoot, drive.iSectorBoot, drive.cbSectorBoot, 0x0000, 2);
+        if (err) {
+            this.notice("Unable to read the boot sector (" + err + ")");
+            return false;
+        }
+        return true;
+    }
+
+    /**
+     * mountDrive(iDrive, sDiskName, sDiskPath)
+     *
+     * @this {DriveController}
+     * @param {number} iDrive
+     * @param {string} sDiskName
+     * @param {string} sDiskPath
+     */
+    mountDrive(iDrive, sDiskName, sDiskPath)
+    {
+        var drive = this.aDrives[iDrive];
+        this.unloadDrive(iDrive, true);
+        drive.fLocal = true;
+        var disk = new DiskPDP11(this, drive, DiskAPI.MODE.PRELOAD);
+        this.finishLoadDrive(drive, disk, sDiskName, sDiskPath, true);
+    }
+
+    /**
+     * loadDrive(iDrive, sDiskName, sDiskPath, fAutoMount, file)
+     *
+     * NOTE: If sDiskPath is already loaded, nothing needs to be done.
+     *
+     * @this {DriveController}
+     * @param {number} iDrive
+     * @param {string} sDiskName
+     * @param {string} sDiskPath
+     * @param {boolean} [fAutoMount]
+     * @param {File} [file] is set if there's an associated File object
+     * @return {number} 1 if disk loaded, 0 if queued up (or busy), -1 if already loaded
+     */
+    loadDrive(iDrive, sDiskName, sDiskPath, fAutoMount, file)
+    {
+        var nResult = -1;
+        var drive = this.aDrives[iDrive];
+
+        if (drive.sDiskPath.toLowerCase() != sDiskPath.toLowerCase()) {
+
+            nResult++;
+            this.unloadDrive(iDrive, true);
+
+            if (drive.fBusy) {
+                this.notice(this.type + " busy");
+            }
+            else {
+                // this.status("disk queued: " + sDiskName);
+                drive.fBusy = true;
+                if (fAutoMount) {
+                    drive.fAutoMount = true;
+                    this.cAutoMount++;
+                    if (this.messageEnabled()) this.printMessage("auto-loading disk: " + sDiskName);
+                }
+                drive.fLocal = !!file;
+                var disk = new DiskPDP11(this, drive, DiskAPI.MODE.PRELOAD);
+                if (disk.load(sDiskName, sDiskPath, file, this.finishLoadDrive)) {
+                    nResult++;
+                }
+            }
+        }
+        return nResult;
+    }
+
+    /**
+     * finishLoadDrive(drive, disk, sDiskName, sDiskPath, fAutoMount)
+     *
+     * The disk parameter is set if the disk was successfully loaded, null if not.
+     *
+     * @this {DriveController}
+     * @param {Object} drive
+     * @param {DiskPDP11} disk
+     * @param {string} sDiskName
+     * @param {string} sDiskPath
+     * @param {boolean} [fAutoMount]
+     */
+    finishLoadDrive(drive, disk, sDiskName, sDiskPath, fAutoMount)
+    {
+        drive.fBusy = false;
+
+        if (disk) {
+            /*
+             * TODO: While this is a perfectly reasonable thing to do, one wonders if the Disk object shouldn't
+             * have done this itself, since we passed our Drive object to it (it already knows the drive's limits).
+             */
+            if (disk.nCylinders > drive.nCylinders || disk.nHeads > drive.nHeads /* || disk.nSectors > drive.nSectors */) {
+                this.notice("Disk \"" + sDiskName + "\" too large for drive " + this.getDriveName(drive.iDrive));
+                disk = null;
+            }
+        }
+
+        if (disk) {
+            drive.disk = disk;
+            drive.sDiskName = sDiskName;
+            drive.sDiskPath = sDiskPath;
+
+            /*
+             * Inform the controller implementation (eg, RX11) of the disk change.
+             */
+            this.notifyLoad(drive.iDrive);
+
+            /*
+             * Adding local disk image names to the disk list seems like a nice idea, but it's too confusing,
+             * because then it looks like the "Mount" button should be able to (re)load them, and that can NEVER
+             * happen, for security reasons; local disk images can ONLY be loaded via the "Mount" button after
+             * the user has selected them via the "Choose File" button.
+             *
+             *      this.addDisk(sDiskName, sDiskPath);
+             *
+             * So we're going to take a different approach: when displayDisk() is asked to display the name
+             * of a local disk image, it will map all such disks to "Local Disk", and any attempt to "Mount" such
+             * a disk, will essentially result in a "Disk not found" error.
+             */
+            this.addDiskHistory(sDiskName, sDiskPath, disk);
+
+            /*
+             * With the addition of notify(), users are now "alerted" whenever a disk has finished loading;
+             * notify() is selective about its output, using print() if a print window is open, alert() otherwise.
+             */
+            this.notice("Loaded disk \"" + sDiskName + "\" in drive " + this.getDriveName(drive.iDrive), drive.fAutoMount || fAutoMount);
+
+            /*
+             * Since you usually want the Computer to have focus again after loading a new disk, let's try automatically
+             * updating the focus after a successful load.
+             */
+            if (this.cmp) this.cmp.setFocus();
+        }
+        else {
+            drive.fLocal = false;
+        }
+
+        if (drive.fAutoMount) {
+            drive.fAutoMount = false;
+            if (!--this.cAutoMount) this.setReady();
+        }
+
+        this.displayDisk(drive.iDrive);
+
+        if (drive.fnCallReady) {
+            drive.fnCallReady();
+            drive.fnCallReady = null;
+        }
+    }
+
+    /**
+     * addDisk(sName, sPath, fTop)
+     *
+     * @this {DriveController}
+     * @param {string} sName
+     * @param {string} sPath
+     * @param {boolean} [fTop] (default is bottom)
+     */
+    addDisk(sName, sPath, fTop)
+    {
+        var controlDisks = this.bindings["listDisks"];
+        if (controlDisks && controlDisks.options) {
+            for (var i = 0; i < controlDisks.options.length; i++) {
+                if (controlDisks.options[i].value == sPath) return;
+            }
+            var controlOption = document.createElement("option");
+            controlOption.text = sName;
+            controlOption.value = sPath;
+            if (fTop && controlDisks.childNodes[0]) {
+                controlDisks.insertBefore(controlOption, controlDisks.childNodes[0]);
+            } else {
+                controlDisks.appendChild(controlOption);
+            }
+        }
+    }
+
+    /**
+     * findDisk(sPath)
+     *
+     * This is used to deal with mount requests (eg, autoMount) that supply a path without a name;
+     * if we can find the path in the "listDisks" control, then we return the associated disk name.
+     *
+     * @this {DriveController}
+     * @param {string} sPath
+     * @return {string|null}
+     */
+    findDisk(sPath)
+    {
+        var controlDisks = this.bindings["listDisks"];
+        if (controlDisks && controlDisks.options) {
+            for (var i = 0; i < controlDisks.options.length; i++) {
+                var control = controlDisks.options[i];
+                if (control.value == sPath) return control.text;
+            }
+        }
+        return Str.getBaseName(sPath, true);
+    }
+
+    /**
+     * displayDisk(iDrive, fUpdateDrive)
+     *
+     * This ensures that the selected disk matches the drive's sDiskPath property, and if fUpdateDrive is set,
+     * it also ensures that the selected drive matches the specified drive number.
+     *
+     * @this {DriveController}
+     * @param {number} iDrive (unvalidated)
+     * @param {boolean} [fUpdateDrive] is true to update the drive list to match the specified drive (eg, the auto-mount case)
+     * @return {boolean} true if successful, false if not
+     */
+    displayDisk(iDrive, fUpdateDrive)
+    {
+        /*
+         * First things first: validate iDrive.
+         */
+        var fSuccess = false;
+        if (iDrive >= 0 && iDrive < this.aDrives.length) {
+            var drive = this.aDrives[iDrive];
+            var controlDisks = this.bindings["listDisks"];
+            var controlDrives = this.bindings["listDrives"];
+            /*
+             * Next, make sure controls for both drives and disks exist.
+             */
+            if (controlDisks && controlDrives && controlDisks.options && controlDrives.options) {
+                /*
+                 * Next, update the drive if the caller has requested it.
+                 */
+                var i;
+                if (fUpdateDrive) {
+
+                    for (i = 0; i < controlDrives.options.length; i++) {
+                        if (Str.parseInt(controlDrives.options[i].value, 10) == drive.iDrive) {
+                            if (controlDrives.selectedIndex != i) {
+                                controlDrives.selectedIndex = i;
+                            }
+                            fSuccess = true;
+                            break;
+                        }
+                    }
+                }
+                /*
+                 * Next, make sure the drive whose disk we're updating is the currently selected drive.
+                 */
+                var iDriveSelected = Str.parseInt(controlDrives.value, 10);
+                var sTargetPath = (drive.fLocal? DriveController.SOURCE.LOCAL : drive.sDiskPath);
+                if (!isNaN(iDriveSelected) && iDriveSelected == iDrive) {
+                    for (i = 0; i < controlDisks.options.length; i++) {
+                        if (controlDisks.options[i].value == sTargetPath) {
+                            if (controlDisks.selectedIndex != i) {
+                                controlDisks.selectedIndex = i;
+                            }
+                            fSuccess = true;
+                            break;
+                        }
+                    }
+                    if (i == controlDisks.options.length) controlDisks.selectedIndex = 0;
+                }
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * selectDrive(sDrive)
+     *
+     * Used to select a drive by name.
+     *
+     * @this {DriveController}
+     * @param {number} sDrive
+     * @return {boolean} true if successful, false if not
+     */
+    selectDrive(sDrive)
+    {
+        var controlDrives = this.bindings["listDrives"];
+        if (controlDrives && controlDrives.options) {
+            var nDrives = controlDrives.options.length;
+            for (var i = 0; i < nDrives; i++) {
+                if (controlDrives.options[i].textContent == sDrive) {
+                    var iDrive = Str.parseInt(controlDrives.options[i].value, 10);
+                    if (iDrive >= 0) {
+                        return this.displayDisk(iDrive, true);
+                    }
+                }
+            }
+        }
+        return false;
+    }
+
+    /**
+     * updateSelectedDisk()
+     *
+     * @this {DriveController}
+     */
+    updateSelectedDisk()
+    {
+        var control = this.bindings["listDisks"];
+        var controlDesc = this.bindings["descDisk"];
+        var controlOption = control.options && control.options[control.selectedIndex];
+        if (controlDesc && controlOption) {
+            var dataValue = {};
+            var sValue = controlOption.getAttribute("data-value");
+            if (sValue) {
+                try {
+                    dataValue = eval("(" + sValue + ")");
+                } catch (e) {
+                    Component.error(this.type + " option error: " + e.message);
+                }
+            }
+            var sHTML = dataValue['desc'];
+            if (sHTML === undefined) sHTML = "";
+            var sHRef = dataValue['href'];
+            if (sHRef !== undefined) sHTML = "<a href=\"" + sHRef + "\" target=\"_blank\">" + sHTML + "</a>";
+            controlDesc.innerHTML = sHTML;
+        }
+    }
+
+    /**
+     * waitDrives(fnCallReady)
+     *
+     * @this {DriveController}
+     * @param {function()|null} fnCallReady
+     * @return {boolean} false if wait required, true otherwise
+     */
+    waitDrives(fnCallReady)
+    {
+        for (var iDrive = 0; iDrive < this.aDrives.length; iDrive++) {
+            var drive = this.aDrives[iDrive];
+            if (drive && drive.fBusy) {
+                if (!drive.fnCallReady) drive.fnCallReady = fnCallReady;
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * unloadDrive(iDrive, fLoading)
+     *
+     * @this {DriveController}
+     * @param {number} iDrive
+     * @param {boolean} [fLoading]
+     */
+    unloadDrive(iDrive, fLoading)
+    {
+        var drive = this.aDrives[iDrive];
+
+        if (drive.disk || fLoading === false) {
+
+            /*
+             * Before we toss the disk's information, capture any deltas that may have occurred.
+             */
+            this.updateDiskHistory(drive.sDiskName, drive.sDiskPath, drive.disk);
+
+            drive.sDiskName = "";
+            drive.sDiskPath = "";
+            drive.disk = null;
+            drive.fLocal = false;
+
+            if (!fLoading) {
+                this.notice("Drive " + this.getDriveName(iDrive) + " unloaded", fLoading);
+                this.sDiskSource = DriveController.SOURCE.NONE;
+                this.displayDisk(iDrive);
+            }
+
+            /*
+             * Inform the controller implementation (eg, RX11) of the disk removal.
+             */
+            this.notifyUnload(iDrive);
+        }
+    }
+
+    /**
+     * unloadAllDrives(fDiscard)
+     *
+     * @this {DriveController}
+     * @param {boolean} fDiscard to discard all disk history before unloading
+     */
+    unloadAllDrives(fDiscard)
+    {
+        if (fDiscard) this.aDiskHistory = [];
+
+        for (var iDrive = 0; iDrive < this.aDrives.length; iDrive++) {
+            this.unloadDrive(iDrive, true);
+        }
+    }
+
+    /**
+     * addDiskHistory(sDiskName, sDiskPath, disk)
+     *
+     * @this {DriveController}
+     * @param {string} sDiskName
+     * @param {string} sDiskPath
+     * @param {DiskPDP11} disk containing corresponding disk image
+     */
+    addDiskHistory(sDiskName, sDiskPath, disk)
+    {
+        var i;
+
+        for (i = 0; i < this.aDiskHistory.length; i++) {
+            if (this.aDiskHistory[i][1] == sDiskPath) {
+                var nChanges = disk.restore(this.aDiskHistory[i][2]);
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage("disk '" + sDiskName + "' restored from history (" + nChanges + " changes)");
+                }
+                return;
+            }
+        }
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("disk '" + sDiskName + "' added to history (nothing to restore)");
+        }
+        this.aDiskHistory[i] = [sDiskName, sDiskPath, []];
+    }
+
+    /**
+     * removeDiskHistory(sDiskName, sDiskPath)
+     *
+     * @this {DriveController}
+     * @param {string} sDiskName
+     * @param {string} sDiskPath
+     */
+    removeDiskHistory(sDiskName, sDiskPath)
+    {
+        var i;
+        for (i = 0; i < this.aDiskHistory.length; i++) {
+            if (this.aDiskHistory[i][1] == sDiskPath) {
+                this.aDiskHistory.splice(i, 1);
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage("disk '" + sDiskName + "' removed from history");
+                }
+                return;
+            }
+        }
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("unable to remove disk '" + sDiskName + "' from history (" + sDiskPath + ")");
+        }
+    }
+
+    /**
+     * updateDiskHistory(sDiskName, sDiskPath, disk)
+     *
+     * @this {DriveController}
+     * @param {string} sDiskName
+     * @param {string} sDiskPath
+     * @param {DiskPDP11} disk containing corresponding disk image, with possible deltas
+     */
+    updateDiskHistory(sDiskName, sDiskPath, disk)
+    {
+        var i;
+        for (i = 0; i < this.aDiskHistory.length; i++) {
+            if (this.aDiskHistory[i][1] == sDiskPath) {
+                this.aDiskHistory[i][2] = disk.save();
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage("disk '" + sDiskName + "' updated in history");
+                }
+                return;
+            }
+        }
+        /*
+         * I used to report this as an error (at least in the DEBUG release), but it's no longer really
+         * an error, because if we're trying to re-mount a clean copy of a disk, we toss its history, then
+         * unload, and then reload/remount.  And since unloadDrive's normal behavior is to call updateDiskHistory()
+         * before unloading, the fact that the disk is no longer listed here can't be treated as an error.
+         */
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("unable to update disk '" + sDiskName + "' in history (" + sDiskPath + ")");
+        }
+    }
+
+    /**
+     * notifyLoad(iDrive)
+     *
+     * Placeholder for subclasses.  Called whenever DriveController has loaded a new disk into the specified drive.
+     *
+     * @this {RX11}
+     * @param {number} iDrive
+     */
+    notifyLoad(iDrive)
+    {
+    }
+
+    /**
+     * notifyUnload(iDrive)
+     *
+     * Placeholder for subclasses.  Called whenever DriveController has unloaded a disk from the specified drive.
+     *
+     * @this {RX11}
+     * @param {number} iDrive
+     */
+    notifyUnload(iDrive)
+    {
+    }
+
+    /**
+     * readData(drive, iCylinder, iHead, iSector, nWords, addr, inc, fCheck, done)
+     *
+     * Placeholder for subclasses.  Implementation is optional, but the automatic BOOT feature will be unavailable.
+     *
+     * @this {DriveController}
+     * @param {Object} drive
+     * @param {number} iCylinder
+     * @param {number} iHead
+     * @param {number} iSector
+     * @param {number} nWords
+     * @param {number} addr
+     * @param {number} inc (normally 2, unless inhibited, in which case it's 0)
+     * @param {boolean} [fCheck]
+     * @param {function(...)} [done]
+     * @return {boolean|number} true if complete, false if queued (or if no done() is supplied, the error code, if any)
+     */
+    readData(drive, iCylinder, iHead, iSector, nWords, addr, inc, fCheck, done)
+    {
+        return -1;
+    }
+
+    /**
+     * writeData(drive, iCylinder, iHead, iSector, nWords, addr, inc, fCheck, done)
+     *
+     * Placeholder for subclasses.  Implementation is optional.
+     *
+     * @this {DriveController}
+     * @param {Object} drive
+     * @param {number} iCylinder
+     * @param {number} iHead
+     * @param {number} iSector
+     * @param {number} nWords
+     * @param {number} addr
+     * @param {number} inc (normally 2, unless inhibited, in which case it's 0)
+     * @param {boolean} [fCheck]
+     * @param {function(...)} [done]
+     * @return {boolean|number} true if complete, false if queued (or if no done() is supplied, the error code, if any)
+     */
+    writeData(drive, iCylinder, iHead, iSector, nWords, addr, inc, fCheck, done)
+    {
+        return -1;
+    }
+}
+
+/*
+ * There's nothing super special about these values, except that NONE should be falsey and the others should not.
+ */
+DriveController.SOURCE = {
+    NONE:   "",
+    LOCAL:  "?",
+    REMOTE: "??"
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/rk11.js (C) Jeff Parsons 2012-2017
+ */
+
+
+class RK11 extends DriveController {
+    /**
+     * RK11(parms)
+     *
+     * The RK11 component has the following component-specific (parms) properties:
+     *
+     *      autoMount: one or more JSON-encoded objects, each containing 'name' and 'path' properties
+     *
+     * The RK11 Disk Controller controls up to eight RK05 disk drives, which in turn read/write RK03-KA
+     * disk cartridges.  See [RK11 Disk Controller Configuration Files](/devices/pdp11/rk11/).
+     *
+     * RK03 (or more precisely, RK03-KA) disks are single-platter cartridges with 203 tracks per side,
+     * 12 sectors per track, and a sector size of 256 words (512 bytes), for a total capacity of 2.38Mb
+     * (2,494,464 bytes).  See [RK03-KA Disk Images](/disks/dec/rk03/).
+     *
+     * @param {Object} parms
+     */
+    constructor(parms)
+    {
+        super("RK11", parms, MessagesPDP11.RK11, PDP11.RK11, PDP11.RK11.RK05, RK11.UNIBUS_IOTABLE);
+
+        /*
+         * Define all the registers required for this controller.
+         *
+         * TODO: Determine what we should really be doing with the RKDB register.
+         */
+        this.regRKDS = this.regRKER = this.regRKCS = this.regRKWC = this.regRKBA = this.regRKDA = this.regRKDB = 0;
+    }
+
+    /**
+     * initController(aRegs)
+     *
+     * @this {RK11}
+     * @param {Array} [aRegs]
+     * @return {boolean} true if successful, false if failure
+     */
+    initController(aRegs)
+    {
+        if (!aRegs) {
+            aRegs = [(RK11.RKDS.RK05 | RK11.RKDS.SOK | RK11.RKDS.RRDY), 0, (RK11.RKCS.CRDY), 0, 0, 0, 0];
+        }
+
+        /*
+         * ES6 ALERT: A handy destructuring assignment, which makes it easy to perform the inverse
+         * of what saveController() does when it collects a bunch of object properties into an array.
+         */
+        [
+            this.regRKDS,
+            this.regRKER,
+            this.regRKCS,
+            this.regRKWC,
+            this.regRKBA,
+            this.regRKDA,
+            this.regRKDB
+        ] = aRegs;
+
+        return true;
+    }
+
+    /**
+     * saveController()
+     *
+     * Basically, the inverse of initController().
+     *
+     * @this {RK11}
+     * @return {Array}
+     */
+    saveController()
+    {
+        return [
+            this.regRKDS,
+            this.regRKER,
+            this.regRKCS,
+            this.regRKWC,
+            this.regRKBA,
+            this.regRKDA,
+            this.regRKDB
+        ];
+    }
+
+    /**
+     * processCommand()
+     *
+     * @this {RK11}
+     */
+    processCommand()
+    {
+        var fInterrupt = true;
+        var fnReadWrite, func, sFunc = "";
+        var iDrive = (this.regRKDA & RK11.RKDA.DS) >> RK11.RKDA.SHIFT.DS;
+        var drive = this.aDrives[iDrive];
+        var iCylinder, iHead, iSector, nWords, addr, inc;
+
+        this.regRKCS &= ~(RK11.RKCS.CRDY | RK11.RKCS.SCP);
+        this.regRKER &= ~(RK11.RKER.SE);
+
+        switch(func = this.regRKCS & RK11.RKCS.FUNC) {
+
+        case RK11.FUNC.CRESET:
+            if (this.messageEnabled()) this.printMessage(this.type + ": CRESET(" + iDrive + ")", true);
+            this.regRKER = this.regRKDA = 0;
+            this.regRKCS = RK11.RKCS.CRDY;
+            break;
+
+        case RK11.FUNC.RCHK:
+            sFunc = "RCHK";
+            /* falls through */
+
+        case RK11.FUNC.READ:
+            if (!sFunc) sFunc = "READ";
+            fnReadWrite = this.readData;
+            /* falls through */
+
+        case RK11.FUNC.WCHK:
+            if (!sFunc) sFunc = "WCHK";
+            /* falls through */
+
+        case RK11.FUNC.WRITE:
+            if (!sFunc) sFunc = "WRITE";
+            if (!fnReadWrite) fnReadWrite = this.writeData;
+
+            iCylinder = (this.regRKDA & RK11.RKDA.CA) >> RK11.RKDA.SHIFT.CA;
+            iHead = (this.regRKDA & RK11.RKDA.HS) >> RK11.RKDA.SHIFT.HS;
+            iSector = this.regRKDA & RK11.RKDA.SA;
+            nWords = (0x10000 - this.regRKWC) & 0xffff;
+            addr = (((this.regRKCS & RK11.RKCS.MEX)) << (16 - RK11.RKCS.SHIFT.MEX)) | this.regRKBA;
+            inc = (this.regRKCS & RK11.RKCS.IBA)? 0 : 2;
+
+            if (this.messageEnabled()) this.printMessage(this.type + ": " + sFunc + "(" + iCylinder + ":" + iHead + ":" + iSector + ") " + Str.toOct(addr) + "--" + Str.toOct(addr + (nWords << 1)), true, true);
+
+            if (iCylinder >= drive.nCylinders) {
+                this.regRKER |= RK11.RKER.NXC;
+                break;
+            }
+            if (iSector >= drive.nSectors) {
+                this.regRKER |= RK11.RKER.NXS;
+                break;
+            }
+
+            fInterrupt = fnReadWrite.call(this, drive, iCylinder, iHead, iSector, nWords, addr, inc, (func >= RK11.FUNC.WCHK), this.doneReadWrite.bind(this));
+            break;
+
+        case RK11.FUNC.SEEK:
+            iCylinder = (this.regRKDA & RK11.RKDA.CA) >> RK11.RKDA.SHIFT.CA;
+            if (this.messageEnabled()) this.printMessage(this.type + ": SEEK(" + iCylinder + ")", true);
+            if (iCylinder < drive.nCylinders) {
+                this.regRKCS |= RK11.RKCS.SCP;
+            } else {
+                this.regRKER |= RK11.RKER.NXC;
+            }
+            break;
+
+        case RK11.FUNC.DRESET:
+            if (this.messageEnabled()) this.printMessage(this.type + ": DRESET(" + iDrive + ")");
+            this.regRKER = this.regRKDA = 0;
+            this.regRKCS = RK11.RKCS.CRDY | RK11.RKCS.SCP;
+            break;
+
+        default:
+            if (this.messageEnabled()) this.printMessage(this.type + ": UNSUPPORTED(" + func + ")");
+            break;
+        }
+
+        this.regRKDS = drive.status | (drive.disk? RK11.RKDS.DRDY : 0) | (iDrive << RK11.RKDS.SHIFT.ID) | (this.regRKDA & RK11.RKDS.SC);
+
+        this.updateErrors();
+
+        if (fInterrupt) {
+            this.regRKCS &= ~RK11.RKCS.GO;
+            this.regRKCS |= RK11.RKCS.CRDY;
+            if (this.regRKCS & RK11.RKCS.IE) this.cpu.setIRQ(this.irq);
+        }
+    }
+
+    /**
+     * readData(drive, iCylinder, iHead, iSector, nWords, addr, inc, fCheck, done)
+     *
+     * @this {RK11}
+     * @param {Object} drive
+     * @param {number} iCylinder
+     * @param {number} iHead
+     * @param {number} iSector
+     * @param {number} nWords
+     * @param {number} addr
+     * @param {number} inc (normally 2, unless inhibited, in which case it's 0)
+     * @param {boolean} [fCheck]
+     * @param {function(...)} [done]
+     * @return {boolean|number} true if complete, false if queued (or if no done() is supplied, the error code, if any)
+     */
+    readData(drive, iCylinder, iHead, iSector, nWords, addr, inc, fCheck, done)
+    {
+        var nError = 0;
+        var disk = drive.disk;
+        var sector = null, ibSector;
+
+        if (!disk) {
+            nError = RK11.RKER.NXD;
+            nWords = 0;
+        }
+
+        var sWords = "";
+        while (nWords) {
+            if (!sector) {
+                if (iCylinder >= disk.nCylinders) {
+                    nError = RK11.RKER.NXC;
+                    break;
+                }
+                sector = disk.seek(iCylinder, iHead, iSector + 1);
+                if (!sector) {
+                    nError = RK11.RKER.SKE;
+                    break;
+                }
+                ibSector = 0;
+                if (++iSector >= disk.nSectors) {
+                    iSector = 0;
+                    if (++iHead >= disk.nHeads) {
+                        iHead = 0;
+                        ++iCylinder;
+                    }
+                }
+            }
+            var b0, b1;
+            if ((b0 = disk.read(sector, ibSector++)) < 0 || (b1 = disk.read(sector, ibSector++)) < 0) {
+                nError = RK11.RKER.NXS;
+                break;
+            }
+            if (!fCheck) {
+                var data = b0 | (b1 << 8);
+                this.bus.setWordDirect(this.cpu.mapUnibus(addr), data);
+                if (DEBUG && this.messageEnabled(MessagesPDP11.READ)) {
+                    if (!sWords) sWords = Str.toOct(addr) + ": ";
+                    sWords += Str.toOct(data) + ' ';
+                    if (sWords.length >= 64) {
+                        console.log(sWords);
+                        sWords = "";
+                    }
+                }
+                if (this.bus.checkFault()) {
+                    nError = RK11.RKER.NXM;
+                    break;
+                }
+            }
+            if (ibSector >= disk.cbSector) sector = null;
+            addr += inc;
+            nWords--;
+        }
+        return done? done(nError, iCylinder, iHead, iSector, nWords, addr) : nError;
+    }
+
+    /**
+     * writeData(drive, iCylinder, iHead, iSector, nWords, addr, inc, fCheck, done)
+     *
+     * @this {RK11}
+     * @param {Object} drive
+     * @param {number} iCylinder
+     * @param {number} iHead
+     * @param {number} iSector
+     * @param {number} nWords
+     * @param {number} addr
+     * @param {number} inc (normally 2, unless inhibited, in which case it's 0)
+     * @param {boolean} [fCheck]
+     * @param {function(...)} [done]
+     * @return {boolean|number} true if complete, false if queued (or if no done() is supplied, the error code, if any)
+     */
+    writeData(drive, iCylinder, iHead, iSector, nWords, addr, inc, fCheck, done)
+    {
+        var nError = 0;
+        var disk = drive.disk;
+        var sector = null, ibSector;
+
+        if (!disk) {
+            nError = RK11.RKER.NXD;
+            nWords = 0;
+        }
+
+        while (nWords) {
+            var data = this.bus.getWordDirect(this.cpu.mapUnibus(addr));
+            if (this.bus.checkFault()) {
+                nError = RK11.RKER.NXM;
+                break;
+            }
+            if (!sector) {
+                if (iCylinder >= disk.nCylinders) {
+                    nError = RK11.RKER.NXC;
+                    break;
+                }
+                sector = disk.seek(iCylinder, iHead, iSector + 1, true);
+                if (!sector) {
+                    nError = RK11.RKER.SKE;
+                    break;
+                }
+                ibSector = 0;
+                if (++iSector >= disk.nSectors) {
+                    iSector = 0;
+                    if (++iHead >= disk.nHeads) {
+                        iHead = 0;
+                        ++iCylinder;
+                    }
+                }
+            }
+            if (fCheck) {
+                var b0, b1;
+                if ((b0 = disk.read(sector, ibSector++)) < 0 || (b1 = disk.read(sector, ibSector++)) < 0) {
+                    nError = RK11.RKER.NXS;
+                    break;
+                }
+                /*
+                 * NOTE: During the 11/70 CPU EXERCISER diagnostic, a number of WCHK requests will fail
+                 * when the test starts reading/writing with physical addresses > 177777.  I'm pretty sure all
+                 * the UNIBUS address calculations are fine, and therefore those failures are expected.
+                 *
+                 * Originally, those failures were causing me some grief because I was treating a WCE error like
+                 * any other error; ie, as a HARD error.  That was wrong.  Two errors (WCE and CSE) are soft
+                 * errors, so while they should still trigger the general-purpose RKCS ERR bit, they should NOT
+                 * trigger the RKCS HE (Hard Error) bit.  This is all taken care of in updateErrors() now.
+                 */
+                if (data != (b0 | (b1 << 8))) {
+                    nError = RK11.RKER.WCE;
+                    break;
+                }
+            } else {
+                if (!disk.write(sector, ibSector++, data & 0xff) || !disk.write(sector, ibSector++, data >> 8)) {
+                    nError = RK11.RKER.NXS;
+                    break;
+                }
+            }
+            if (ibSector >= disk.cbSector) sector = null;
+            addr += inc;
+            nWords--;
+        }
+        return done? done(nError, iCylinder, iHead, iSector, nWords, addr) : nError;
+    }
+
+    /**
+     * doneReadWrite(nError, iCylinder, iHead, iSector, nWords, addr)
+     *
+     * @this {RK11}
+     * @param {number} nError
+     * @param {number} iCylinder
+     * @param {number} iHead
+     * @param {number} iSector
+     * @param {number} nWords
+     * @param {number} addr
+     * @return {boolean}
+     */
+    doneReadWrite(nError, iCylinder, iHead, iSector, nWords, addr)
+    {
+        this.regRKBA = addr & 0xffff;
+        this.regRKCS = (this.regRKCS & ~RK11.RKCS.MEX) | ((addr >> (16 - RK11.RKCS.SHIFT.MEX)) & RK11.RKCS.MEX);
+        this.regRKWC = (0x10000 - nWords) & 0xffff;
+        this.regRKDA = (this.regRKDA & ~RK11.RKDA.SA) | (iSector & RK11.RKDA.SA);
+        this.regRKER |= nError;
+        this.updateErrors();
+        return true;
+    }
+
+    /**
+     * updateErrors()
+     *
+     * @this {RK11}
+     */
+    updateErrors()
+    {
+        /*
+         * Reflect RKER bits to RKCS bits as appropriate.
+         *
+         * TODO: I'm not entirely sure about the handling of the DRE bit here.  DEC's RK11 documentation says:
+         *
+         *      Sets if one of the drives in the system senses a loss of either AC or DC power and a function is
+         *      either initiated or in process while the selected drive is not ready or in some error condition.
+         *
+         * I'm not sure how to parse all the "ands" and "ors" in that sentence.  For now, we're treating the DRE bit
+         * much like the high error bit found in other hardware registers: we always set it if any lower error bits
+         * are also set.
+         */
+        this.regRKCS &= ~RK11.RKCS.ERR;
+        if (this.regRKER) {
+            this.regRKER |= RK11.RKER.DRE;
+            this.regRKCS |= RK11.RKCS.ERR;
+            if (this.regRKER & RK11.RKER.HE) this.regRKCS |= RK11.RKCS.HE;
+            if (this.messageEnabled()) this.printMessage(this.type + ": ERROR: " + Str.toOct(this.regRKER));
+        }
+    }
+
+    /**
+     * readRKDS(addr)
+     *
+     * @this {RK11}
+     * @param {number} addr (eg, PDP11.UNIBUS.RKDS or 177400)
+     * @return {number}
+     */
+    readRKDS(addr)
+    {
+        return this.regRKDS;
+    }
+
+    /**
+     * writeRKDS(data, addr)
+     *
+     * @this {RK11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.RKDS or 177400)
+     */
+    writeRKDS(data, addr)
+    {
+        /*
+         * This is a read-only register
+         */
+    }
+
+    /**
+     * readRKER(addr)
+     *
+     * @this {RK11}
+     * @param {number} addr (eg, PDP11.UNIBUS.RKER or 177402)
+     * @return {number}
+     */
+    readRKER(addr)
+    {
+        return this.regRKER;
+    }
+
+    /**
+     * writeRKER(data, addr)
+     *
+     * @this {RK11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.RKER or 177402)
+     */
+    writeRKER(data, addr)
+    {
+        /*
+         * This is a read-only register
+         */
+    }
+
+    /**
+     * readRKCS(addr)
+     *
+     * @this {RK11}
+     * @param {number} addr (eg, PDP11.UNIBUS.RKCS or 177404)
+     * @return {number}
+     */
+    readRKCS(addr)
+    {
+        return this.regRKCS & RK11.RKCS.RMASK;
+    }
+
+    /**
+     * writeRKCS(data, addr)
+     *
+     * @this {RK11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.RKCS or 177404)
+     */
+    writeRKCS(data, addr)
+    {
+        this.regRKCS = (this.regRKCS & ~RK11.RKCS.WMASK) | (data & RK11.RKCS.WMASK);
+
+        if (this.regRKCS & RK11.RKCS.GO) this.processCommand();
+    }
+
+    /**
+     * readRKWC(addr)
+     *
+     * @this {RK11}
+     * @param {number} addr (eg, PDP11.UNIBUS.RKWC or 177406)
+     * @return {number}
+     */
+    readRKWC(addr)
+    {
+        return this.regRKWC;
+    }
+
+    /**
+     * writeRKWC(data, addr)
+     *
+     * @this {RK11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.RKWC or 177406)
+     */
+    writeRKWC(data, addr)
+    {
+        this.regRKWC = data;
+    }
+
+    /**
+     * readRKBA(addr)
+     *
+     * @this {RK11}
+     * @param {number} addr (eg, PDP11.UNIBUS.RKBA or 177410)
+     * @return {number}
+     */
+    readRKBA(addr)
+    {
+        return this.regRKBA;
+    }
+
+    /**
+     * writeRKBA(data, addr)
+     *
+     * @this {RK11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.RKBA or 177410)
+     */
+    writeRKBA(data, addr)
+    {
+        this.regRKBA = data;
+    }
+
+    /**
+     * readRKDA(addr)
+     *
+     * @this {RK11}
+     * @param {number} addr (eg, PDP11.UNIBUS.RKDA or 177412)
+     * @return {number}
+     */
+    readRKDA(addr)
+    {
+        return this.regRKDA;
+    }
+
+    /**
+     * writeRKDA(data, addr)
+     *
+     * @this {RK11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.RKDA or 177412)
+     */
+    writeRKDA(data, addr)
+    {
+        this.regRKDA = data;
+    }
+
+    /**
+     * readRKDB(addr)
+     *
+     * @this {RK11}
+     * @param {number} addr (eg, PDP11.UNIBUS.RKDB or 177416)
+     * @return {number}
+     */
+    readRKDB(addr)
+    {
+        return this.regRKDB;
+    }
+
+    /**
+     * writeRKDB(data, addr)
+     *
+     * @this {RK11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.RKDB or 177416)
+     */
+    writeRKDB(data, addr)
+    {
+        this.regRKDB = data;
+    }
+}
+
+/*
+ * Alias RK11 definitions as class constants
+ */
+RK11.RKDS   =   PDP11.RK11.RKDS;        // 177400: Drive Status Register
+RK11.RKER   =   PDP11.RK11.RKER;        // 177402: Error Register
+RK11.RKCS   =   PDP11.RK11.RKCS;        // 177404: Control Status Register
+RK11.RKDA   =   PDP11.RK11.RKDA;        // 177412: Disk Address Register
+RK11.FUNC   =   PDP11.RK11.FUNC;
+
+/*
+ * ES6 ALERT: As you can see below, I've finally started using computed property names.
+ */
+RK11.UNIBUS_IOTABLE = {
+    [PDP11.UNIBUS.RKDS]:     /* 177400 */    [null, null, RK11.prototype.readRKDS,  RK11.prototype.writeRKDS,   "RKDS"],
+    [PDP11.UNIBUS.RKER]:     /* 177402 */    [null, null, RK11.prototype.readRKER,  RK11.prototype.writeRKER,   "RKER"],
+    [PDP11.UNIBUS.RKCS]:     /* 177404 */    [null, null, RK11.prototype.readRKCS,  RK11.prototype.writeRKCS,   "RKCS"],
+    [PDP11.UNIBUS.RKWC]:     /* 177406 */    [null, null, RK11.prototype.readRKWC,  RK11.prototype.writeRKWC,   "RKWC"],
+    [PDP11.UNIBUS.RKBA]:     /* 177410 */    [null, null, RK11.prototype.readRKBA,  RK11.prototype.writeRKBA,   "RKBA"],
+    [PDP11.UNIBUS.RKDA]:     /* 177412 */    [null, null, RK11.prototype.readRKDA,  RK11.prototype.writeRKDA,   "RKDA"],
+    [PDP11.UNIBUS.RKDB]:     /* 177416 */    [null, null, RK11.prototype.readRKDB,  RK11.prototype.writeRKDB,   "RKDB"]
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/rl11.js (C) Jeff Parsons 2012-2017
+ */
+
+
+class RL11 extends DriveController {
+    /**
+     * RL11(parms)
+     *
+     * The RL11 component has the following component-specific (parms) properties:
+     *
+     *      autoMount: one or more JSON-encoded objects, each containing 'name' and 'path' properties
+     *
+     * The RL11 Disk Controller controls up to four RL01 or RL02 disk drives, which in turn read/write RL01K or
+     * RL02K disk cartridges.  See [RL11 Disk Controller Configuration Files](/devices/pdp11/rl11/).
+     *
+     * RL01K disks are single-platter cartridges with 256 tracks per side, 40 sectors per track, and a sector size
+     * of 256 bytes, for a total capacity of 5Mb (5,242,880 bytes).  See [RL01K Disk Images](/disks/dec/rl01k/).
+     *
+     * RL02K disks are single-platter cartridges with 512 tracks per side, 40 sectors per track, and a sector size
+     * of 256 bytes, for a total capacity of 10Mb (10,485,760 bytes).  See [RL02K Disk Images](/disks/dec/rl02k/).
+     *
+     * @param {Object} parms
+     */
+    constructor(parms)
+    {
+        super("RL11", parms, MessagesPDP11.RL11, PDP11.RL11, PDP11.RL11.RL02K, RL11.UNIBUS_IOTABLE);
+
+        /*
+         * Define all the registers required for this controller.
+         */
+        this.regRLCS = this.regRLBA = this.regRLDA = this.tmpRLDA = this.regRLMP = this.regRLBE = 0;
+    }
+
+    /**
+     * initController(aRegs)
+     *
+     * @this {RL11}
+     * @param {Array} [aRegs]
+     * @return {boolean} true if successful, false if failure
+     */
+    initController(aRegs)
+    {
+        if (!aRegs) {
+            aRegs = [(RL11.RLCS.DRDY | RL11.RLCS.CRDY), 0, 0, 0, 0, 0];
+        }
+
+        /*
+         * ES6 ALERT: A handy destructuring assignment, which makes it easy to perform the inverse
+         * of what saveController() does when it collects a bunch of object properties into an array.
+         */
+        [
+            this.regRLCS,
+            this.regRLBA,
+            this.regRLDA,
+            this.tmpRLDA,
+            this.regRLMP,
+            this.regRLBE
+        ] = aRegs;
+
+        return true;
+    }
+
+    /**
+     * saveController()
+     *
+     * Basically, the inverse of initController().
+     *
+     * @this {RL11}
+     * @return {Array}
+     */
+    saveController()
+    {
+        return [
+            this.regRLCS,
+            this.regRLBA,
+            this.regRLDA,
+            this.tmpRLDA,
+            this.regRLMP,
+            this.regRLBE
+        ];
+    }
+
+    /**
+     * processCommand()
+     *
+     * @this {RL11}
+     */
+    processCommand()
+    {
+        var fInterrupt = true;
+        var fnReadWrite, sFunc = "";
+        var iDrive = (this.regRLCS & RL11.RLCS.DS) >> RL11.RLCS.SHIFT.DS;
+        var drive = this.aDrives[iDrive];
+        var disk = drive.disk;
+        var iCylinder, iHead, iSector, nWords, addr;
+
+        /*
+         * The typical pattern of DRDY and CRDY:
+         *
+         *  1) Normally both set
+         *  2) CRDY is cleared to process a command
+         *  3) DRDY is cleared to indicate a command in process
+         */
+        this.regRLCS &= ~RL11.RLCS.DRDY;
+
+        switch(this.regRLCS & RL11.RLCS.FUNC) {
+
+        case RL11.FUNC.NOP:
+        case RL11.FUNC.WCHK:
+        case RL11.FUNC.RDNC:
+            break;
+
+        case RL11.FUNC.STATUS:
+            if (this.regRLMP & RL11.RLMP.GS_BH) {
+                this.regRLCS &= (RL11.RLCS.DRDY | RL11.RLCS.FUNC | RL11.RLCS.BAE);    // TODO: Review
+            }
+            /*
+             * The bit indicating whether or not the disk contains 256 or 512 cylinders is critical;
+             * for example, the first RSTS/E disk image we tried was an RL01K, which has only 256 cylinders,
+             * and the operating system would crash mysteriously if we didn't report the correct geometry.
+             */
+            this.regRLMP = drive.status | (this.tmpRLDA & RL11.RLDA.RW_HS) | (disk && disk.nCylinders == 512? RL11.RLMP.GS_DT : 0);
+            break;
+
+        case RL11.FUNC.SEEK:
+            if ((this.regRLDA & RL11.RLDA.GS_CMD) == RL11.RLDA.SEEK_CMD) {
+                var darCA = (this.regRLDA & RL11.RLDA.RW_CA);
+                var darHS = (this.regRLDA & RL11.RLDA.SEEK_HS) << 2;
+                if (this.regRLDA & RL11.RLDA.SEEK_DIR) {
+                    this.tmpRLDA += darCA;
+                } else {
+                    this.tmpRLDA -= darCA;
+                }
+                this.regRLDA = this.tmpRLDA = (this.tmpRLDA & RL11.RLDA.RW_CA) | darHS;
+            }
+            break;
+
+        case RL11.FUNC.RHDR:
+            this.regRLMP = this.tmpRLDA;
+            break;
+
+        case RL11.FUNC.RDATA:
+            sFunc = "READ";
+            fnReadWrite = this.readData;
+            /* falls through */
+
+        case RL11.FUNC.WDATA:
+            if (!sFunc) sFunc = "WRITE";
+            if (!fnReadWrite) fnReadWrite = this.writeData;
+
+            iCylinder = this.regRLDA >> RL11.RLDA.SHIFT.RW_CA;
+            iHead = (this.regRLDA & RL11.RLDA.RW_HS)? 1 : 0;
+            iSector = this.regRLDA & RL11.RLDA.RW_SA;
+            if (!disk || iCylinder >= disk.nCylinders || iSector >= disk.nSectors) {
+                this.regRLCS |= RL11.ERRC.HNF | RL11.RLCS.ERR;
+                break;
+            }
+            nWords = (0x10000 - this.regRLMP) & 0xffff;
+            addr = (((this.regRLBE & RL11.RLBE.MASK)) << 16) | this.regRLBA;   // 22 bit mode
+
+            if (this.messageEnabled()) this.printMessage(this.type + ": " + sFunc + "(" + iCylinder + ":" + iHead + ":" + iSector + ") " + Str.toOct(addr) + "--" + Str.toOct(addr + (nWords << 1)), true, true);
+
+            fInterrupt = fnReadWrite.call(this, drive, iCylinder, iHead, iSector, nWords, addr, 2, false, this.doneReadWrite.bind(this));
+            break;
+
+        default:
+            break;
+        }
+
+        if (fInterrupt) {
+            this.regRLCS |= RL11.RLCS.DRDY | RL11.RLCS.CRDY;
+            if (this.regRLCS & RL11.RLCS.IE) this.cpu.setIRQ(this.irq);
+        }
+    }
+
+    /**
+     * readData(drive, iCylinder, iHead, iSector, nWords, addr, inc, fCheck, done)
+     *
+     * @this {RL11}
+     * @param {Object} drive
+     * @param {number} iCylinder
+     * @param {number} iHead
+     * @param {number} iSector
+     * @param {number} nWords
+     * @param {number} addr
+     * @param {number} inc (normally 2, unless inhibited, in which case it's 0)
+     * @param {boolean} [fCheck]
+     * @param {function(...)} [done]
+     * @return {boolean|number} true if complete, false if queued (or if no done() is supplied, the error code, if any)
+     */
+    readData(drive, iCylinder, iHead, iSector, nWords, addr, inc, fCheck, done)
+    {
+        var nError = 0;
+        var checksum = 0;
+        var disk = drive.disk;
+        var sector = null, ibSector;
+
+        if (!disk) {
+            nError = RL11.ERRC.HNF;      // TODO: Review
+            nWords = 0;
+        }
+
+        var sWords = "";
+        while (nWords) {
+            if (!sector) {
+                sector = disk.seek(iCylinder, iHead, iSector + 1);
+                if (!sector) {
+                    nError = RL11.ERRC.HNF;
+                    break;
+                }
+                ibSector = 0;
+            }
+            var b0, b1, data;
+            if ((b0 = disk.read(sector, ibSector++)) < 0 || (b1 = disk.read(sector, ibSector++)) < 0) {
+                nError = RL11.ERRC.HNF;
+                break;
+            }
+            /*
+             * Apparently, this controller honors the UNIBUS Map registers, which means we must call mapUnibus()
+             * on the address REGARDLESS whether it is actually >= BusPDP11.UNIBUS_22BIT.  TODO: This is inherited
+             * code, so let's review the documentation on this.
+             */
+            this.bus.setWordDirect(this.cpu.mapUnibus(addr), data = b0 | (b1 << 8));
+            if (DEBUG && this.messageEnabled(MessagesPDP11.READ)) {
+                if (!sWords) sWords = Str.toOct(addr) + ": ";
+                sWords += Str.toOct(data) + ' ';
+                if (sWords.length >= 64) {
+                    console.log(sWords);
+                    sWords = "";
+                }
+            }
+            if (this.bus.checkFault()) {
+                nError = RL11.ERRC.NXM;
+                break;
+            }
+            addr += 2;
+            nWords--;
+            checksum += data;
+            if (ibSector >= disk.cbSector) {
+                sector = null;
+                if (++iSector >= disk.nSectors) {
+                    iSector = 0;
+                    if (++iHead >= disk.nHeads) {
+                        iHead = 0;
+                        if (++iCylinder >= disk.nCylinders) {
+                            nError = RL11.ERRC.HNF;
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+
+        if (DEBUG && this.messageEnabled(MessagesPDP11.READ)) {
+            console.log("checksum: " + (checksum|0));
+        }
+
+        return done? done(nError, iCylinder, iHead, iSector, nWords, addr) : nError;
+    }
+
+    /**
+     * writeData(drive, iCylinder, iHead, iSector, nWords, addr, inc, fCheck, done)
+     *
+     * @this {RL11}
+     * @param {Object} drive
+     * @param {number} iCylinder
+     * @param {number} iHead
+     * @param {number} iSector
+     * @param {number} nWords
+     * @param {number} addr
+     * @param {number} inc (normally 2, unless inhibited, in which case it's 0)
+     * @param {boolean} [fCheck]
+     * @param {function(...)} [done]
+     * @return {boolean|number} true if complete, false if queued (or if no done() is supplied, the error code, if any)
+     */
+    writeData(drive, iCylinder, iHead, iSector, nWords, addr, inc, fCheck, done)
+    {
+        var nError = 0;
+        var checksum = 0;
+        var disk = drive.disk;
+        var sector = null, ibSector;
+
+        if (!disk) {
+            nError = RL11.ERRC.HNF;      // TODO: Review
+            nWords = 0;
+        }
+
+        var sWords = "";
+        while (nWords) {
+            /*
+             * Apparently, this controller honors the UNIBUS Map registers, which means we must call mapUnibus()
+             * on the address REGARDLESS whether it is actually >= BusPDP11.UNIBUS_22BIT.  TODO: This is inherited
+             * code, so let's review the documentation on this.
+             */
+            var data = this.bus.getWordDirect(this.cpu.mapUnibus(addr));
+            if (this.bus.checkFault()) {
+                nError = RL11.ERRC.NXM;
+                break;
+            }
+            if (DEBUG && this.messageEnabled(MessagesPDP11.WRITE)) {
+                if (!sWords) sWords = Str.toOct(addr) + ": ";
+                sWords += Str.toOct(data) + ' ';
+                if (sWords.length >= 64) {
+                    console.log(sWords);
+                    sWords = "";
+                }
+            }
+            addr += 2;
+            nWords--;
+            checksum += data;
+            if (!sector) {
+                sector = disk.seek(iCylinder, iHead, iSector + 1, true);
+                if (!sector) {
+                    nError = RL11.ERRC.HNF;
+                    break;
+                }
+                ibSector = 0;
+            }
+            if (!disk.write(sector, ibSector++, data & 0xff) || !disk.write(sector, ibSector++, data >> 8)) {
+                nError = RL11.ERRC.HNF;
+                break;
+            }
+            if (ibSector >= disk.cbSector) {
+                sector = null;
+                if (++iSector >= disk.nSectors) {
+                    iSector = 0;
+                    if (++iHead >= disk.nHeads) {
+                        iHead = 0;
+                        if (++iCylinder >= disk.nCylinders) {
+                            nError = RL11.ERRC.HNF;
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+
+        if (DEBUG && this.messageEnabled(MessagesPDP11.WRITE)) {
+            console.log("checksum: " + (checksum|0));
+        }
+
+        return done? done(nError, iCylinder, iHead, iSector, nWords, addr) : nError;
+    }
+
+    /**
+     * doneReadWrite(nError, iCylinder, iHead, iSector, nWords, addr)
+     *
+     * @this {RL11}
+     * @param {number} nError
+     * @param {number} iCylinder
+     * @param {number} iHead
+     * @param {number} iSector
+     * @param {number} nWords
+     * @param {number} addr
+     * @return {boolean}
+     */
+    doneReadWrite(nError, iCylinder, iHead, iSector, nWords, addr)
+    {
+        this.regRLBA = addr & 0xffff;
+        this.regRLCS = (this.regRLCS & ~RL11.RLCS.BAE) | ((addr >> (16 - RL11.RLCS.SHIFT.BAE)) & RL11.RLCS.BAE);
+        this.regRLBE = (addr >> 16) & RL11.RLBE.MASK;         // 22 bit mode
+        this.regRLDA = (iCylinder << RL11.RLDA.SHIFT.RW_CA) | (iHead? RL11.RLDA.RW_HS : 0) | (iSector & RL11.RLDA.RW_SA);
+        this.tmpRLDA = this.regRLDA;
+        this.regRLMP = (0x10000 - nWords) & 0xffff;
+        if (nError) {
+            this.regRLCS |= nError | RL11.RLCS.ERR;
+        }
+        return true;
+    }
+
+    /**
+     * readRLCS(addr)
+     *
+     * @this {RL11}
+     * @param {number} addr (eg, PDP11.UNIBUS.RLCS or 174400)
+     * @return {number}
+     */
+    readRLCS(addr)
+    {
+        return this.regRLCS & RL11.RLCS.RMASK;
+    }
+
+    /**
+     * writeRLCS(data, addr)
+     *
+     * @this {RL11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.RLCS or 174400)
+     */
+    writeRLCS(data, addr)
+    {
+        this.regRLCS = (this.regRLCS & ~RL11.RLCS.WMASK) | (data & RL11.RLCS.WMASK);
+        this.regRLBE = (this.regRLBE & 0x3C) | ((data & RL11.RLCS.BAE) >> RL11.RLCS.SHIFT.BAE);
+        if (!(this.regRLCS & RL11.RLCS.CRDY)) this.processCommand();
+    }
+
+    /**
+     * readRLBA(addr)
+     *
+     * @this {RL11}
+     * @param {number} addr (eg, PDP11.UNIBUS.RLBA or 174402)
+     * @return {number}
+     */
+    readRLBA(addr)
+    {
+        return this.regRLBA;
+    }
+
+    /**
+     * writeRLBA(data, addr)
+     *
+     * @this {RL11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.RLBA or 174402)
+     */
+    writeRLBA(data, addr)
+    {
+        this.regRLBA = data & RL11.RLBA.WMASK;
+    }
+
+    /**
+     * readRLDA(addr)
+     *
+     * @this {RL11}
+     * @param {number} addr (eg, PDP11.UNIBUS.RLDA or 174404)
+     * @return {number}
+     */
+    readRLDA(addr)
+    {
+        return this.regRLDA;
+    }
+
+    /**
+     * writeRLDA(data, addr)
+     *
+     * @this {RL11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.RLDA or 174404)
+     */
+    writeRLDA(data, addr)
+    {
+        this.regRLDA = data;
+    }
+
+    /**
+     * readRLMP(addr)
+     *
+     * @this {RL11}
+     * @param {number} addr (eg, PDP11.UNIBUS.RLMP or 174406)
+     * @return {number}
+     */
+    readRLMP(addr)
+    {
+        return this.regRLMP;
+    }
+
+    /**
+     * writeRLMP(data, addr)
+     *
+     * @this {RL11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.RLMP or 174406)
+     */
+    writeRLMP(data, addr)
+    {
+        this.regRLMP = data;
+    }
+
+    /**
+     * readRLBE(addr)
+     *
+     * @this {RL11}
+     * @param {number} addr (eg, PDP11.UNIBUS.RLBE or 174410)
+     * @return {number}
+     */
+    readRLBE(addr)
+    {
+        return this.regRLBE;
+    }
+
+    /**
+     * writeRLBE(data, addr)
+     *
+     * Curiously, we see RSTS/E v7.0 writing RLBE bits that aren't documented:
+     *
+     *      R0=000000 R1=000000 R2=174410 R3=000000 R4=102076 R5=045166
+     *      SP=052662 PC=067624 PS=034344 IR=000000 SL=000377 T0 N0 Z1 V0 C0
+     *      067624: 012712 000300          MOV   #300,@R2
+     *
+     * @this {RL11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.RLBE or 174410)
+     */
+    writeRLBE(data, addr)
+    {
+        this.regRLBE = data & RL11.RLBE.MASK;
+        this.regRLCS = (this.regRLCS & ~RL11.RLCS.BAE) | ((this.regRLBE & 0x3) << RL11.RLCS.SHIFT.BAE);
+    }
+}
+
+/*
+ * Alias RL11 definitions as class constants
+ */
+RL11.RLCS   =   PDP11.RL11.RLCS;        // 174400: Control Status Register
+RL11.RLBA   =   PDP11.RL11.RLBA;        // 174402: Bus Address Register
+RL11.RLDA   =   PDP11.RL11.RLDA;        // 174404: Disk Address Register
+RL11.RLMP   =   PDP11.RL11.RLMP;        // 177406: Multi-Purpose Register
+RL11.RLBE   =   PDP11.RL11.RLBE;        // 174410: Bus (Address) Extension Register
+RL11.ERRC   =   PDP11.RL11.ERRC;        // NOTE: These error codes are pre-shifted to read/write directly from/to RLCS.ERRC
+RL11.FUNC   =   PDP11.RL11.FUNC;        // NOTE: These function codes are pre-shifted to read/write directly from/to RLCS.FUNC
+
+/*
+ * ES6 ALERT: As you can see below, I've finally started using computed property names.
+ */
+RL11.UNIBUS_IOTABLE = {
+    [PDP11.UNIBUS.RLCS]:     /* 174400 */    [null, null, RL11.prototype.readRLCS,  RL11.prototype.writeRLCS,   "RLCS"],
+    [PDP11.UNIBUS.RLBA]:     /* 174402 */    [null, null, RL11.prototype.readRLBA,  RL11.prototype.writeRLBA,   "RLBA"],
+    [PDP11.UNIBUS.RLDA]:     /* 174404 */    [null, null, RL11.prototype.readRLDA,  RL11.prototype.writeRLDA,   "RLDA"],
+    [PDP11.UNIBUS.RLMP]:     /* 174406 */    [null, null, RL11.prototype.readRLMP,  RL11.prototype.writeRLMP,   "RLMP"],
+    [PDP11.UNIBUS.RLBE]:     /* 174410 */    [null, null, RL11.prototype.readRLBE,  RL11.prototype.writeRLBE,   "RLBE"]
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/rx11.js (C) Jeff Parsons 2012-2017
+ */
+
+
+class RX11 extends DriveController {
+    /**
+     * RX11(parms)
+     *
+     * The RX11 component has the following component-specific (parms) properties:
+     *
+     *      autoMount: one or more JSON-encoded objects, each containing 'name' and 'path' properties
+     *
+     * The RX11 Disk Controller controls up to two RX01 disk drives, which in turn read/write
+     * disk cartridges.  See [RX11 Disk Controller Configuration Files](/devices/pdp11/rx11/).
+     *
+     * RX01 diskettes are single-sided, with 77 tracks per side, 26 sectors per track, and a sector size
+     * of 128 bytes, for a total capacity of 250Kb (256,256 bytes).  See [RX01 Disk Images](/disks/dec/rx01/).
+     *
+     * @param {Object} parms
+     */
+    constructor(parms)
+    {
+        super("RX11", parms, MessagesPDP11.RX11, PDP11.RX11, PDP11.RX11.RX01, RX11.UNIBUS_IOTABLE);
+
+        /*
+         * Define all the registers required for this controller.
+         */
+        this.regRXCS = this.regRXDB = 0;
+        this.regRXTA = this.regRXSA = this.regRXES = this.regError = 0;
+
+        /*
+         * Whenever a command is issued, we record the function code internally here, and when the command
+         * is completed, we set the internal function code back to UNUSED.
+         */
+        this.funCode = RX11.FUNC.UNUSED;        // no function in progress (device is idle)
+
+        this.iBuffer = 0;
+        /*
+         * We use the new ES6 fill() method to ensure that the buffer returns something reasonable if, for some
+         * strange reason, the first command we receive is an Empty Buffer command.
+         */
+        this.abBuffer = new Array(128).fill(0);
+    }
+
+    /**
+     * initController(aRegs)
+     *
+     * @this {RX11}
+     * @param {Array} [aRegs]
+     * @return {boolean} true if successful, false if failure
+     */
+    initController(aRegs)
+    {
+        if (!aRegs) {
+            this.regRXCS = 0;
+            this.regRXDB = 0;
+            this.regRXTA = 1;
+            this.regRXSA = 1;
+            this.regRXES = 0;
+            this.regError = 0;
+            this.funCode = RX11.FUNC.READ;
+            this.iBuffer = 0;
+            this.cpu.clearIRQ(this.irq);
+            this.readSector();
+        }
+        else {
+            /*
+             * ES6 ALERT: A handy destructuring assignment, which makes it easy to perform the inverse
+             * of what saveController() does when it collects a bunch of object properties into an array.
+             */
+            [
+                this.regRXCS,
+                this.regRXDB,
+                this.regRXTA,
+                this.regRXSA,
+                this.regRXES,
+                this.regError,
+                this.funCode,
+                this.iBuffer,
+                this.abBuffer
+            ] = aRegs;
+        }
+        return true;
+    }
+
+    /**
+     * saveController()
+     *
+     * Basically, the inverse of initController().
+     *
+     * @this {RX11}
+     * @return {Array}
+     */
+    saveController()
+    {
+        return [
+            this.regRXCS,
+            this.regRXDB,
+            this.regRXTA,
+            this.regRXSA,
+            this.regRXES,
+            this.regError,
+            this.funCode,
+            this.iBuffer,
+            this.abBuffer
+        ];
+    }
+
+    /**
+     * notifyLoad(iDrive)
+     *
+     * Called whenever DriveController has loaded a new disk into the specified drive.
+     *
+     * We're interested in this so that whenever a disk change occurs for drive 0, we can automatically
+     * refill the sector buffer with the data from sector 1 from track 1.
+     *
+     * @this {RX11}
+     * @param {number} iDrive
+     */
+    notifyLoad(iDrive)
+    {
+        if (iDrive == 0) this.initController();
+    }
+
+    /**
+     * notifyUnload(iDrive)
+     *
+     * Called whenever DriveController has unloaded a disk from the specified drive.
+     *
+     * @this {RX11}
+     * @param {number} iDrive
+     */
+    notifyUnload(iDrive)
+    {
+    }
+
+    /**
+     * processCommand()
+     *
+     * @this {RX11}
+     */
+    processCommand()
+    {
+        this.funCode = this.regRXCS & RX11.RXCS.FUNC;
+        this.regRXCS &= ~(RX11.RXCS.GO | RX11.RXCS.TR | RX11.RXCS.DONE | RX11.RXCS.ERR);
+        this.cpu.clearIRQ(this.irq);
+
+        if (this.messageEnabled()) this.printMessage(this.type + ".processCommand(" + RX11.FUNCS[this.funCode >> 1]+ ")", true, true);
+
+        switch(this.funCode) {
+
+        case RX11.FUNC.FILL:
+        case RX11.FUNC.EMPTY:
+        case RX11.FUNC.READ:
+        case RX11.FUNC.WRITE:
+        case RX11.FUNC.WRDEL:
+            this.initCommand();
+            break;
+
+        case RX11.FUNC.RDSTAT:
+            this.readStatus();
+            break;
+
+        case RX11.FUNC.RDERR:
+            this.readError();
+            break;
+
+        default:
+
+            break;
+        }
+    }
+
+    /**
+     * initCommand()
+     *
+     * @this {RX11}
+     */
+    initCommand()
+    {
+        this.iBuffer = 0;
+    }
+
+    /**
+     * doneCommand(nError)
+     *
+     * @this {RX11}
+     * @param {number} [nError]
+     */
+    doneCommand(nError)
+    {
+        if (nError) {
+            this.regError = nError;
+            this.regRXDB = this.regRXES;
+            this.regRXCS |= RX11.RXCS.ERR;
+        }
+        this.funCode = RX11.FUNC.UNUSED;
+        this.regRXCS |= RX11.RXCS.DONE;
+        if (this.regRXCS & RX11.RXCS.IE) this.cpu.setIRQ(this.irq);
+    }
+
+    /**
+     * readData(drive, iCylinder, iHead, iSector, nWords, addr, inc, fCheck, done)
+     *
+     * This function is required ONLY if we want to support DriveController's bootSelectedDisk() function (and we do).
+     *
+     * @this {RX11}
+     * @param {Object} drive
+     * @param {number} iCylinder
+     * @param {number} iHead
+     * @param {number} iSector
+     * @param {number} nWords
+     * @param {number} addr
+     * @param {number} inc (normally 2, unless inhibited, in which case it's 0)
+     * @param {boolean} [fCheck]
+     * @param {function(...)} [done]
+     * @return {boolean|number} true if complete, false if queued (or if no done() is supplied, the error code, if any)
+     */
+    readData(drive, iCylinder, iHead, iSector, nWords, addr, inc, fCheck, done)
+    {
+        var nError = 0;
+        var disk = drive.disk;
+        var sector = null, ibSector;
+
+        if (this.messageEnabled()) this.printMessage(this.type + ".readData(" + iCylinder + ":" + iHead + ":" + iSector + ") " + Str.toOct(addr) + "--" + Str.toOct(addr + (nWords << 1)), true, true);
+
+        if (!disk) {
+            nError = drive.iDrive?  RX11.ERROR.HOME1 : RX11.ERROR.HOME0;
+            nWords = 0;
+        }
+
+        var sWords = "";
+        while (nWords) {
+            if (!sector) {
+                if (iCylinder >= disk.nCylinders) {
+                    nError = RX11.ERROR.NO_TRACK;
+                    break;
+                }
+                sector = disk.seek(iCylinder, iHead, iSector + 1);
+                if (!sector) {
+                    nError = RX11.ERROR.NO_SECTOR;
+                    break;
+                }
+                ibSector = 0;
+                if (++iSector >= disk.nSectors) {
+                    iSector = 0;
+                    if (++iHead >= disk.nHeads) {
+                        iHead = 0;
+                        ++iCylinder;
+                    }
+                }
+            }
+            var b0, b1;
+            if ((b0 = disk.read(sector, ibSector++)) < 0 || (b1 = disk.read(sector, ibSector++)) < 0) {
+                nError = RX11.ERROR.NO_DATA;
+                break;
+            }
+            var data = b0 | (b1 << 8);
+            this.bus.setWordDirect(this.cpu.mapUnibus(addr), data);
+            if (DEBUG && this.messageEnabled(MessagesPDP11.READ)) {
+                if (!sWords) sWords = Str.toOct(addr) + ": ";
+                sWords += Str.toOct(data) + ' ';
+                if (sWords.length >= 64) {
+                    console.log(sWords);
+                    sWords = "";
+                }
+            }
+            if (ibSector >= disk.cbSector) sector = null;
+            addr += inc;
+            nWords--;
+        }
+
+        return done? done(nError, iCylinder, iHead, iSector, nWords, addr) : nError;
+    }
+
+    /**
+     * readSector()
+     *
+     * @this {RX11}
+     */
+    readSector()
+    {
+        var nError = 0;
+        var iDrive = (this.regRXCS & RX11.RXCS.UNIT)? 1 : 0;
+        var drive = this.aDrives[iDrive];
+        var disk = drive && drive.disk;
+        var iCylinder = this.regRXTA & RX11.RXTA.MASK, iHead = 0, nSector = this.regRXSA & RX11.RXSA.MASK;
+
+        this.regRXES &= ~(RX11.RXES.CRC | RX11.RXES.PARITY | RX11.RXES.DEL | RX11.RXES.DRDY);
+
+        if (disk) {
+            this.regRXES |= RX11.RXES.DRDY;
+            if (this.messageEnabled()) this.printMessage(this.type + ".readSector(" + iCylinder + ":" + iHead + ":" + nSector + ")", true, true);
+
+            var sector = disk.seek(iCylinder, iHead, nSector, true);
+            if (sector) {
+                var i = 0, nBytes = this.abBuffer.length;
+                while (i < nBytes) {
+                    var b = disk.read(sector, i);
+                    if (b < 0) {
+                        nError = RX11.ERROR.NO_DATA;
+                        break;
+                    }
+                    this.abBuffer[i++] = b;
+                }
+                if (sector.deleted) this.regRXES |= RX11.RXES.DEL;
+            } else {
+                nError = RX11.ERROR.NO_SECTOR;
+            }
+        } else {
+            nError = iDrive? RX11.ERROR.HOME1 : RX11.ERROR.HOME0;
+        }
+        this.doneCommand(nError);
+    }
+
+    /**
+     * writeSector(fDeleted)
+     *
+     * @this {RX11}
+     * @param {boolean} fDeleted
+     */
+    writeSector(fDeleted)
+    {
+        var nError = 0;
+        var iDrive = (this.regRXCS & RX11.RXCS.UNIT)? 1 : 0;
+        var drive = this.aDrives[iDrive];
+        var disk = drive && drive.disk;
+        var iCylinder = this.regRXTA & RX11.RXTA.MASK, iHead = 0, nSector = this.regRXSA & RX11.RXSA.MASK;
+
+        this.regRXES &= ~(RX11.RXES.CRC | RX11.RXES.PARITY | RX11.RXES.DEL | RX11.RXES.DRDY);
+
+        if (disk) {
+            this.regRXES |= RX11.RXES.DRDY;
+            if (this.messageEnabled()) this.printMessage(this.type + ".writeSector(" + iCylinder + ":" + iHead + ":" + nSector + ")", true, true);
+
+            var sector = disk.seek(iCylinder, iHead, nSector, true);
+            if (sector) {
+                if (fDeleted) sector.deleted = true;
+                var i = 0, nBytes = this.abBuffer.length;
+                while (i < nBytes) {
+                    var data = this.abBuffer[i];
+                    if (!disk.write(sector, i, data & 0xff)) {
+                        nError = RX11.ERROR.NO_DATA;
+                        break;
+                    }
+                    i++;
+                }
+            } else {
+                nError = RX11.ERROR.NO_SECTOR;
+            }
+        } else {
+            nError = iDrive? RX11.ERROR.HOME1 : RX11.ERROR.HOME0;
+        }
+        this.doneCommand(nError);
+    }
+
+    /**
+     * readStatus()
+     *
+     * @this {RX11}
+     */
+    readStatus()
+    {
+        var iDrive = (this.regRXCS & RX11.RXCS.UNIT)? 1 : 0;
+        var drive = this.aDrives[iDrive];
+
+        this.regRXES &= ~RX11.RXES.DRDY;
+        if (drive && drive.disk) this.regRXES |= RX11.RXES.DRDY;
+
+        this.regRXDB = this.regRXES;
+        this.doneCommand();
+    }
+
+    /**
+     * readError()
+     *
+     * @this {RX11}
+     */
+    readError()
+    {
+        this.regRXDB = this.regError;
+        this.doneCommand();
+    }
+
+    /**
+     * readRXCS(addr)
+     *
+     * @this {RX11}
+     * @param {number} addr (eg, PDP11.UNIBUS.RXCS or 177170)
+     * @param {boolean} [fPreWrite]
+     * @return {number}
+     */
+    readRXCS(addr, fPreWrite)
+    {
+        var w = this.regRXCS;
+
+        if (!fPreWrite) {
+            w &= RX11.RXCS.RMASK;
+
+            switch (this.funCode) {
+
+            case RX11.FUNC.FILL:
+            case RX11.FUNC.EMPTY:
+                if (this.iBuffer < this.abBuffer.length) {
+                    this.regRXCS |= RX11.RXCS.TR;
+                }
+                break;
+
+            case RX11.FUNC.READ:
+            case RX11.FUNC.WRITE:
+            case RX11.FUNC.WRDEL:
+                if (this.iBuffer < 2) {
+                    this.regRXCS |= RX11.RXCS.TR;
+                }
+                break;
+            }
+        }
+        return w;
+    }
+
+    /**
+     * writeRXCS(data, addr)
+     *
+     * @this {RX11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.RXCS or 177170)
+     */
+    writeRXCS(data, addr)
+    {
+        this.regRXCS = (this.regRXCS & ~RX11.RXCS.WMASK) | (data & RX11.RXCS.WMASK);
+
+        if (this.regRXCS & RX11.RXCS.INIT) {
+            this.initController();
+            return;
+        }
+
+        if ((this.regRXCS & RX11.RXCS.GO) && this.funCode == RX11.FUNC.UNUSED) {
+            this.processCommand();
+            return;
+        }
+
+        if (!(this.regRXCS & RX11.RXCS.IE)) {
+            this.cpu.clearIRQ(this.irq);
+        }
+        else if (this.regRXCS & RX11.RXCS.DONE) {
+            this.cpu.setIRQ(this.irq);
+        }
+    }
+
+    /**
+     * readRXDB(addr)
+     *
+     * @this {RX11}
+     * @param {number} addr (eg, PDP11.UNIBUS.RXDB or 177172)
+     * @param {boolean} [fPreWrite]
+     * @return {number}
+     */
+    readRXDB(addr, fPreWrite)
+    {
+        if (!fPreWrite) {
+            switch (this.funCode) {
+
+            case RX11.FUNC.EMPTY:
+                if (this.regRXCS & RX11.RXCS.TR) {
+                    this.regRXCS &= ~RX11.RXCS.TR;
+
+                    this.regRXDB = this.abBuffer[this.iBuffer] & 0xff;
+                    if (this.messageEnabled()) this.printMessage(this.type + ".readByte(" + this.iBuffer + "): " + Str.toHexByte(this.regRXDB), true, true);
+                    if (++this.iBuffer >= this.abBuffer.length) {
+                        this.doneCommand();
+                    }
+                }
+                break;
+            }
+        }
+        return this.regRXDB;
+    }
+
+    /**
+     * writeRXDB(data, addr)
+     *
+     * @this {RX11}
+     * @param {number} data
+     * @param {number} addr (eg, PDP11.UNIBUS.RXDB or 177172)
+     */
+    writeRXDB(data, addr)
+    {
+        switch(this.funCode) {
+
+        case RX11.FUNC.FILL:
+            if (this.regRXCS & RX11.RXCS.TR) {
+                this.regRXCS &= ~RX11.RXCS.TR;
+
+                this.abBuffer[this.iBuffer] = data & 0xff;
+                if (this.messageEnabled()) this.printMessage(this.type + ".writeByte(" + this.iBuffer + "," + Str.toHexByte(data) + ")", true, true);
+                if (++this.iBuffer >= this.abBuffer.length) {
+                    this.doneCommand();
+                }
+            }
+            break;
+
+        case RX11.FUNC.READ:
+        case RX11.FUNC.WRITE:
+        case RX11.FUNC.WRDEL:
+            if (this.regRXCS & RX11.RXCS.TR) {
+                this.regRXCS &= ~RX11.RXCS.TR;
+
+                switch(this.iBuffer++) {
+                case 0:
+                    this.regRXSA = data;
+                    break;
+
+                case 1:
+                    this.regRXTA = data;
+                    if (this.funCode == RX11.FUNC.READ) {
+                        this.readSector();
+                    } else {
+                        this.writeSector(this.funCode == RX11.FUNC.WRDEL);
+                    }
+                    break;
+
+                default:
+
+                    break;
+                }
+            }
+            break;
+        }
+        this.regRXDB = data;
+    }
+}
+
+/*
+ * Alias RX11 definitions as class constants
+ */
+RX11.RXCS   =   PDP11.RX11.RXCS;        // 177170: Command and Status Register
+RX11.RXDB   =   PDP11.RX11.RXDB;        // 177172: Data Buffer Register
+RX11.RXTA   =   PDP11.RX11.RXTA;
+RX11.RXSA   =   PDP11.RX11.RXSA;
+RX11.RXES   =   PDP11.RX11.RXES;
+RX11.FUNC   =   PDP11.RX11.FUNC;
+RX11.ERROR  =   PDP11.RX11.ERROR;
+
+RX11.FUNCS  = [
+    "FILL", "EMPTY", "WRITE", "READ", "UNUSED", "RDSTAT", "WRDEL", "RDERR"
+];
+
+/*
+ * ES6 ALERT: As you can see below, I've finally started using computed property names.
+ */
+RX11.UNIBUS_IOTABLE = {
+    [PDP11.UNIBUS.RXCS]:     /* 177170 */    [null, null, RX11.prototype.readRXCS,  RX11.prototype.writeRXCS,   "RXCS"],
+    [PDP11.UNIBUS.RXDB]:     /* 177172 */    [null, null, RX11.prototype.readRXDB,  RX11.prototype.writeRXDB,   "RXDB"]
+};
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/debugger.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * Debugger Address Object
+ *
+ * This is the basic structure; other debuggers may extend it.
+ *
+ *      addr            address
+ *      fTemporary      true if this is a temporary breakpoint address
+ *      sCmd            set for breakpoint addresses if there's an associated command string
+ *      aCmds           preprocessed commands (from sCmd)
+ *
+ * @typedef {{
+ *      addr:(number|undefined),
+ *      fTemporary:(boolean|undefined),
+ *      sCmd:(string|undefined),
+ *      aCmds:(Array.<string>|undefined)
+ * }}
+ */
+var DbgAddr;
+
+/**
+ * Since the Closure Compiler treats ES6 classes as @struct rather than @dict by default,
+ * it deters us from defining named properties on our components; eg:
+ *
+ *      this['exports'] = {...}
+ *
+ * results in an error:
+ *
+ *      Cannot do '[]' access on a struct
+ *
+ * So, in order to define 'exports', we must override the @struct assumption by annotating
+ * the class as @unrestricted (or @dict).  Note that this must be done both here and in the
+ * subclass (eg, SerialPort), because otherwise the Compiler won't allow us to *reference*
+ * the named property either.
+ *
+ * TODO: Consider marking ALL our classes unrestricted, because otherwise it forces us to
+ * define every single property the class uses in its constructor, which results in a fair
+ * bit of redundant initialization, since many properties aren't (and don't need to be) fully
+ * initialized until the appropriate init(), reset(), restore(), etc. function is called.
+ *
+ * The upside, however, may be that since the structure of the class is completely defined by
+ * the constructor, JavaScript engines may be able to optimize and run more efficiently.
+ *
+ * @unrestricted
+ */
+class Debugger extends Component
+{
+    /**
+     * Debugger(parmsDbg)
+     *
+     * The Debugger component supports the following optional (parmsDbg) properties:
+     *
+     *      base: the base to use for most numeric input/output (default is 16)
+     *
+     * The Debugger component is a shared component containing a subset of functionality used by
+     * the other CPU-specific Debuggers (eg, DebuggerX86).  Over time, the goal is to factor out as
+     * much common debugging support as possible from those components into this one.
+     *
+     * @param {Object} parmsDbg
+     */
+    constructor(parmsDbg)
+    {
+        if (DEBUGGER) {
+
+            super("Debugger", parmsDbg);
+
+            /*
+             * Default base used to display all values; modified with the "s base" command.
+             */
+            this.nBase = +parmsDbg['base'] || 16;
+
+            /*
+             * Default number of bits of integer precision; it can be overridden by the Debugger
+             * but there is no command to adjust it.
+             */
+            this.nBits = 32;
+
+            this.achGroup = ['{','}'];
+            this.achAddress = ['[',']'];
+
+            /*
+             * These keep track of instruction activity, but only when tracing or when Debugger checks
+             * have been enabled (eg, one or more breakpoints have been set).
+             *
+             * They are zeroed by the reset() notification handler.  cInstructions is advanced by
+             * stepCPU() and checkInstruction() calls.  nCycles is updated by every stepCPU() or stop()
+             * call and simply represents the number of cycles performed by the last run of instructions.
+             */
+            this.nCycles = 0;
+            this.cOpcodes = this.cOpcodesStart = 0;
+
+            /*
+             * fAssemble is true when "assemble mode" is active, false when not.
+             */
+            this.fAssemble = false;
+
+            /*
+             * This maintains command history.  New commands are inserted at index 0 of the array.
+             * When Enter is pressed on an empty input buffer, we default to the command at aPrevCmds[0].
+             */
+            this.iPrevCmd = -1;
+            this.aPrevCmds = [];
+
+            /*
+             * aVariables is an object with properties that grow as setVariable() assigns more variables;
+             * each property corresponds to one variable, where the property name is the variable name (ie,
+             * a string beginning with a non-digit, followed by zero or more symbol characters and/or digits)
+             * and the property value is the variable's numeric value.  See doVar() and setVariable() for
+             * details.
+             *
+             * Note that parseValue() parses variables before numbers, so any variable that looks like a
+             * unprefixed hex value (eg, "a5" as opposed to "0xa5") will trump the numeric value.  Unprefixed
+             * hex values are a convenience of parseValue(), which always calls Str.parseInt() with a default
+             * base of 16; however, that default be overridden with a variety of explicit prefixes or suffixes
+             * (eg, a leading "0o" to indicate octal, a trailing period to indicate decimal, etc.)
+             *
+             * See Str.parseInt() for more details about supported numbers.
+             */
+            this.aVariables = {};
+
+        }   // endif DEBUGGER
+    }
+
+    /**
+     * getRegIndex(sReg, off)
+     *
+     * NOTE: This must be implemented by the individual debuggers.
+     *
+     * @this {Debugger}
+     * @param {string} sReg
+     * @param {number} [off] optional offset into sReg
+     * @return {number} register index, or -1 if not found
+     */
+    getRegIndex(sReg, off)
+    {
+        return -1;
+    }
+
+    /**
+     * getRegValue(iReg)
+     *
+     * NOTE: This must be implemented by the individual debuggers.
+     *
+     * @this {Debugger}
+     * @param {number} iReg
+     * @return {number|undefined}
+     */
+    getRegValue(iReg)
+    {
+        return undefined;
+    }
+
+    /**
+     * parseAddrReference(s, sAddr)
+     *
+     * Returns the given string with the given address reference replaced with the contents of that address.
+     *
+     * NOTE: This must be implemented by the individual debuggers.
+     *
+     * @this {Debugger}
+     * @param {string} s
+     * @param {string} sAddr
+     * @return {string}
+     */
+    parseAddrReference(s, sAddr)
+    {
+        return s.replace('[' + sAddr + ']', "unimplemented");
+    }
+
+    /**
+     * getNextCommand()
+     *
+     * @this {Debugger}
+     * @return {string}
+     */
+    getNextCommand()
+    {
+        var sCmd;
+        if (this.iPrevCmd > 0) {
+            sCmd = this.aPrevCmds[--this.iPrevCmd];
+        } else {
+            sCmd = "";
+            this.iPrevCmd = -1;
+        }
+        return sCmd;
+    }
+
+    /**
+     * getPrevCommand()
+     *
+     * @this {Debugger}
+     * @return {string|null}
+     */
+    getPrevCommand()
+    {
+        var sCmd = null;
+        if (this.iPrevCmd < this.aPrevCmds.length - 1) {
+            sCmd = this.aPrevCmds[++this.iPrevCmd];
+        }
+        return sCmd;
+    }
+
+    /**
+     * parseCommand(sCmd, fSave, chSep)
+     *
+     * @this {Debugger}
+     * @param {string|undefined} sCmd
+     * @param {boolean} [fSave] is true to save the command, false if not
+     * @param {string} [chSep] is the command separator character (default is ';')
+     * @return {Array.<string>}
+     */
+    parseCommand(sCmd, fSave, chSep)
+    {
+        if (fSave) {
+            if (!sCmd) {
+                if (this.fAssemble) {
+                    sCmd = "end";
+                } else {
+                    sCmd = this.aPrevCmds[this.iPrevCmd+1];
+                }
+            } else {
+                if (this.iPrevCmd < 0 && this.aPrevCmds.length) {
+                    this.iPrevCmd = 0;
+                }
+                if (this.iPrevCmd < 0 || sCmd != this.aPrevCmds[this.iPrevCmd]) {
+                    this.aPrevCmds.splice(0, 0, sCmd);
+                    this.iPrevCmd = 0;
+                }
+                this.iPrevCmd--;
+            }
+        }
+        var a = [];
+        if (sCmd) {
+            /*
+             * With the introduction of breakpoint commands (ie, quoted command sequences
+             * associated with a breakpoint), we can no longer perform simplistic splitting.
+             *
+             *      a = sCmd.split(chSep || ';');
+             *      for (var i = 0; i < a.length; i++) a[i] = Str.trim(a[i]);
+             *
+             * We may now split on semi-colons ONLY if they are outside a quoted sequence.
+             *
+             * Also, to allow quoted strings *inside* breakpoint commands, we first replace all
+             * DOUBLE double-quotes with single quotes.
+             */
+            sCmd = sCmd.replace(/""/g, "'");
+
+            var iPrev = 0;
+            var chQuote = null;
+            chSep = chSep || ';';
+            /*
+             * NOTE: Processing charAt() up to and INCLUDING length is not a typo; we're taking
+             * advantage of the fact that charAt() with an invalid index returns an empty string,
+             * allowing us to use the same substring() call to capture the final portion of sCmd.
+             *
+             * In a sense, it allows us to pretend that the string ends with a zero terminator.
+             */
+            for (var i = 0; i <= sCmd.length; i++) {
+                var ch = sCmd.charAt(i);
+                if (ch == '"' || ch == "'") {
+                    if (!chQuote) {
+                        chQuote = ch;
+                    } else if (ch == chQuote) {
+                        chQuote = null;
+                    }
+                }
+                else if (ch == chSep && !chQuote || !ch) {
+                    /*
+                     * Recall that substring() accepts starting (inclusive) and ending (exclusive)
+                     * indexes, whereas substr() accepts a starting index and a length.  We need the former.
+                     */
+                    a.push(Str.trim(sCmd.substring(iPrev, i)));
+                    iPrev = i + 1;
+                }
+            }
+        }
+        return a;
+    }
+
+    /**
+     * evalAND(dst, src)
+     *
+     * Adapted from /modules/pdp10/lib/cpuops.js:PDP10.AND().
+     *
+     * Performs the bitwise "and" (AND) of two operands > 32 bits.
+     *
+     * @this {Debugger}
+     * @param {number} dst
+     * @param {number} src
+     * @return {number} (dst & src)
+     */
+    evalAND(dst, src)
+    {
+        /*
+         * We AND the low 32 bits separately from the higher bits, and then combine them with addition.
+         * Since all bits above 32 will be zero, and since 0 AND 0 is 0, no special masking for the higher
+         * bits is required.
+         *
+         * WARNING: When using JavaScript's 32-bit operators with values that could set bit 31 and produce a
+         * negative value, it's critical to perform a final right-shift of 0, ensuring that the final result is
+         * positive.
+         */
+        if (this.nBits <= 32) {
+            return dst & src;
+        }
+        /*
+         * Negative values don't yield correct results when dividing, so pass them through an unsigned truncate().
+         */
+        dst = this.truncate(dst, 0, true);
+        src = this.truncate(src, 0, true);
+        return ((((dst / Debugger.TWO_POW32)|0) & ((src / Debugger.TWO_POW32)|0)) * Debugger.TWO_POW32) + ((dst & src) >>> 0);
+    }
+
+    /**
+     * evalIOR(dst, src)
+     *
+     * Adapted from /modules/pdp10/lib/cpuops.js:PDP10.IOR().
+     *
+     * Performs the logical "inclusive-or" (OR) of two operands > 32 bits.
+     *
+     * @this {Debugger}
+     * @param {number} dst
+     * @param {number} src
+     * @return {number} (dst | src)
+     */
+    evalIOR(dst, src)
+    {
+        /*
+         * We OR the low 32 bits separately from the higher bits, and then combine them with addition.
+         * Since all bits above 32 will be zero, and since 0 OR 0 is 0, no special masking for the higher
+         * bits is required.
+         *
+         * WARNING: When using JavaScript's 32-bit operators with values that could set bit 31 and produce a
+         * negative value, it's critical to perform a final right-shift of 0, ensuring that the final result is
+         * positive.
+         */
+        if (this.nBits <= 32) {
+            return dst | src;
+        }
+        /*
+         * Negative values don't yield correct results when dividing, so pass them through an unsigned truncate().
+         */
+        dst = this.truncate(dst, 0, true);
+        src = this.truncate(src, 0, true);
+        return ((((dst / Debugger.TWO_POW32)|0) | ((src / Debugger.TWO_POW32)|0)) * Debugger.TWO_POW32) + ((dst | src) >>> 0);
+    }
+
+    /**
+     * evalXOR(dst, src)
+     *
+     * Adapted from /modules/pdp10/lib/cpuops.js:PDP10.XOR().
+     *
+     * Performs the logical "exclusive-or" (XOR) of two operands > 32 bits.
+     *
+     * @this {Debugger}
+     * @param {number} dst
+     * @param {number} src
+     * @return {number} (dst ^ src)
+     */
+    evalXOR(dst, src)
+    {
+        /*
+         * We XOR the low 32 bits separately from the higher bits, and then combine them with addition.
+         * Since all bits above 32 will be zero, and since 0 XOR 0 is 0, no special masking for the higher
+         * bits is required.
+         *
+         * WARNING: When using JavaScript's 32-bit operators with values that could set bit 31 and produce a
+         * negative value, it's critical to perform a final right-shift of 0, ensuring that the final result is
+         * positive.
+         */
+        if (this.nBits <= 32) {
+            return dst | src;
+        }
+        /*
+         * Negative values don't yield correct results when dividing, so pass them through an unsigned truncate().
+         */
+        dst = this.truncate(dst, 0, true);
+        src = this.truncate(src, 0, true);
+        return ((((dst / Debugger.TWO_POW32)|0) ^ ((src / Debugger.TWO_POW32)|0)) * Debugger.TWO_POW32) + ((dst ^ src) >>> 0);
+    }
+
+    /**
+     * evalMUL(dst, src)
+     *
+     * I could have adapted the code from /modules/pdp10/lib/cpuops.js:PDP10.doMUL(), but it was simpler to
+     * write this base method and let the PDP-10 Debugger override it with a call to the *actual* doMUL() method.
+     *
+     * @this {Debugger}
+     * @param {number} dst
+     * @param {number} src
+     * @return {number} (dst * src)
+     */
+    evalMUL(dst, src)
+    {
+        return dst * src;
+    }
+
+    /**
+     * truncate(v, nBits, fUnsigned)
+     *
+     * @this {Debugger}
+     * @param {number} v
+     * @param {number} [nBits]
+     * @param {boolean} [fUnsigned]
+     * @return {number}
+     */
+    truncate(v, nBits, fUnsigned)
+    {
+        var limit, vNew = v;
+        nBits = nBits || this.nBits;
+
+        if (fUnsigned) {
+            if (nBits == 32) {
+                vNew = v >>> 0;
+            }
+            else if (nBits < 32) {
+                vNew = v & ((1 << nBits) - 1);
+            }
+            else {
+                limit = Math.pow(2, nBits);
+                if (v < 0 || v >= limit) {
+                    vNew = v % limit;
+                    if (vNew < 0) vNew += limit;
+                }
+            }
+        }
+        else {
+            if (nBits <= 32) {
+                vNew = (v << (32 - nBits)) >> (32 - nBits);
+            }
+            else {
+                limit = Math.pow(2, nBits - 1);
+                if (v >= limit) {
+                    vNew = (v % limit);
+                    if (((v / limit)|0) & 1) vNew -= limit;
+                } else if (v < -limit) {
+                    vNew = (v % limit);
+                    if ((((-v - 1) / limit) | 0) & 1) {
+                        if (vNew) vNew += limit;
+                    }
+                    else {
+                        if (!vNew) vNew -= limit;
+                    }
+                }
+            }
+        }
+        if (v != vNew) {
+            if (MAXDEBUG) this.println("warning: value " + v + " truncated to " + vNew);
+            v = vNew;
+        }
+        return v;
+    }
+
+    /**
+     * evalOps(aVals, aOps, cOps)
+     *
+     * Some of our clients want a specific number of bits of integer precision.  If that precision is
+     * greater than 32, some of the operations below will fail; for example, JavaScript bitwise operators
+     * always truncate the result to 32 bits, so beware when using shift operations.  Similarly, it would
+     * be wrong to always "|0" the final result, which is why we rely on truncate() now.
+     *
+     * Note that JavaScript integer precision is limited to 52 bits.  For example, in Node, if you set a
+     * variable to 0x80000001:
+     *
+     *      foo=0x80000001|0
+     *
+     * then calculate foo*foo and display the result in binary using "(foo*foo).toString(2)":
+     *
+     *      '11111111111111111111111111111100000000000000000000000000000000'
+     *
+     * which is slightly incorrect because it has overflowed JavaScript's floating-point precision.
+     *
+     * 0x80000001 in decimal is -2147483647, so the product is 4611686014132420609, which is 0x3FFFFFFF00000001.
+     *
+     * @this {Debugger}
+     * @param {Array.<number>} aVals
+     * @param {Array.<string>} aOps
+     * @param {number} [cOps] (default is -1 for all)
+     * @return {boolean} true if successful, false if error
+     */
+    evalOps(aVals, aOps, cOps = -1)
+    {
+        while (cOps-- && aOps.length) {
+            var chOp = aOps.pop();
+            if (aVals.length < 2) return false;
+            var valNew;
+            var val2 = aVals.pop();
+            var val1 = aVals.pop();
+            switch(chOp) {
+            case '*':
+                valNew = this.evalMUL(val1, val2);
+                break;
+            case '/':
+                if (!val2) return false;
+                valNew = Math.trunc(val1 / val2);
+                break;
+            case '^/':
+                if (!val2) return false;
+                valNew = val1 % val2;
+                break;
+            case '+':
+                valNew = val1 + val2;
+                break;
+            case '-':
+                valNew = val1 - val2;
+                break;
+            case '<<':
+                valNew = val1 << val2;
+                break;
+            case '>>':
+                valNew = val1 >> val2;
+                break;
+            case '>>>':
+                valNew = val1 >>> val2;
+                break;
+            case '<':
+                valNew = (val1 < val2? 1 : 0);
+                break;
+            case '<=':
+                valNew = (val1 <= val2? 1 : 0);
+                break;
+            case '>':
+                valNew = (val1 > val2? 1 : 0);
+                break;
+            case '>=':
+                valNew = (val1 >= val2? 1 : 0);
+                break;
+            case '==':
+                valNew = (val1 == val2? 1 : 0);
+                break;
+            case '!=':
+                valNew = (val1 != val2? 1 : 0);
+                break;
+            case '&':
+                valNew = this.evalAND(val1, val2);
+                break;
+            case '!':           // alias for MACRO-10 to perform a bitwise inclusive-or (OR)
+            case '|':
+                valNew = this.evalIOR(val1, val2);
+                break;
+            case '^!':          // since MACRO-10 uses '^' for base overrides, '^!' is used for bitwise exclusive-or (XOR)
+                valNew = this.evalXOR(val1, val2);
+                break;
+            case '&&':
+                valNew = (val1 && val2? 1 : 0);
+                break;
+            case '||':
+                valNew = (val1 || val2? 1 : 0);
+                break;
+            case ',,':
+                valNew = this.truncate(val1, 18, true) * Math.pow(2, 18) + this.truncate(val2, 18, true);
+                break;
+            case '_':
+            case '^_':
+                valNew = val1;
+                /*
+                 * While we always try to avoid assuming any particular number of bits of precision, the 'B' shift
+                 * operator (which we've converted to '^_') is unique to the MACRO-10 environment, which imposes the
+                 * following restrictions on the shift count.
+                 */
+                if (chOp == '^_') val2 = 35 - (val2 & 0xff);
+                if (val2) {
+                    /*
+                     * Since binary shifting is a logical (not arithmetic) operation, and since shifting by division only
+                     * works properly with positive numbers, we call truncate() to produce an unsigned value.
+                     */
+                    valNew = this.truncate(valNew, 0, true);
+                    if (val2 > 0) {
+                        valNew *= Math.pow(2, val2);
+                    } else {
+                        valNew = Math.trunc(valNew / Math.pow(2, -val2));
+                    }
+                }
+                break;
+            default:
+                return false;
+            }
+            aVals.push(this.truncate(valNew));
+        }
+        return true;
+    }
+
+    /**
+     * parseArray(asValues, iValue, iLimit, nBase, aUndefined)
+     *
+     * parseExpression() takes a complete expression and divides it into array elements, where even elements
+     * are values (which may be empty if two or more operators appear consecutively) and odd elements are operators.
+     *
+     * For example, if the original expression was "2*{3+{4/2}}", parseExpression() would call parseArray() with:
+     *
+     *      0   1   2   3   4   5   6   7   8   9  10  11  12  13  14
+     *      -   -   -   -   -   -   -   -   -   -  --  --  --  --  --
+     *      2   *       {   3   +       {   4   /   2   }       }
+     *
+     * This function takes care of recursively processing grouped expressions, by processing subsets of the array,
+     * as well as handling certain base overrides (eg, temporarily switching to base-10 for binary shift suffixes).
+     *
+     * @param {Array.<string>} asValues
+     * @param {number} iValue
+     * @param {number} iLimit
+     * @param {number} nBase
+     * @param {Array|undefined} [aUndefined]
+     * @return {number|undefined}
+     */
+    parseArray(asValues, iValue, iLimit, nBase, aUndefined)
+    {
+        var value;
+        var sValue, sOp;
+        var fError = false;
+        var nUnary = 0;
+        var aVals = [], aOps = [];
+
+        var nBasePrev = this.nBase;
+        this.nBase = nBase;
+
+        while (iValue < iLimit) {
+            var v;
+            sValue = asValues[iValue++].trim();
+            sOp = (iValue < iLimit? asValues[iValue++] : "");
+
+            if (sValue) {
+                v = this.parseValue(sValue, null, aUndefined, nUnary);
+            } else {
+                if (sOp == '{') {
+                    var cOpen = 1;
+                    var iStart = iValue;
+                    while (iValue < iLimit) {
+                        sValue = asValues[iValue++].trim();
+                        sOp = (iValue < asValues.length? asValues[iValue++] : "");
+                        if (sOp == '{') {
+                            cOpen++;
+                        } else if (sOp == '}') {
+                            if (!--cOpen) break;
+                        }
+                    }
+                    v = this.parseArray(asValues, iStart, iValue-1, this.nBase, aUndefined);
+                    if (v != null && nUnary) {
+                        v = this.parseUnary(v, nUnary);
+                    }
+                    sValue = (iValue < iLimit? asValues[iValue++].trim() : "");
+                    sOp = (iValue < iLimit? asValues[iValue++] : "");
+                }
+                else {
+                    /*
+                     * When parseExpression() calls us, it has collapsed all runs of whitespace into single spaces,
+                     * and although it allows single spaces to divide the elements of the expression, a space is neither
+                     * a unary nor binary operator.  It's essentially a no-op.  If we encounter it here, then it followed
+                     * another operator and is easily ignored (although perhaps it should still trigger a reset of nBase
+                     * and nUnary -- TBD).
+                     */
+                    if (sOp == ' ') {
+                        continue;
+                    }
+                    if (sOp == '^B') {
+                        this.nBase = 2;
+                        continue;
+                    }
+                    if (sOp == '^O') {
+                        this.nBase = 8;
+                        continue;
+                    }
+                    if (sOp == '^D') {
+                        this.nBase = 10;
+                        continue;
+                    }
+                    if (!(nUnary & (0xC0000000|0))) {
+                        if (sOp == '+') {
+                            continue;
+                        }
+                        if (sOp == '-') {
+                            nUnary = (nUnary << 2) | 1;
+                            continue;
+                        }
+                        if (sOp == '~' || sOp == '^-') {
+                            nUnary = (nUnary << 2) | 2;
+                            continue;
+                        }
+                        if (sOp == '^L') {
+                            nUnary = (nUnary << 2) | 3;
+                            continue;
+                        }
+                    }
+                    fError = true;
+                    break;
+                }
+            }
+
+            if (v === undefined) {
+                if (aUndefined) {
+                    aUndefined.push(sValue);
+                    v = 0;
+                } else {
+                    fError = true;
+                    aUndefined = [];
+                    break;
+                }
+            }
+
+            aVals.push(this.truncate(v));
+
+            /*
+             * When parseExpression() calls us, it has collapsed all runs of whitespace into single spaces,
+             * and although it allows single spaces to divide the elements of the expression, a space is neither
+             * a unary nor binary operator.  It's essentially a no-op.  If we encounter it here, then it followed
+             * a value, and since we don't want to misinterpret the next operator as a unary operator, we look
+             * ahead and grab the next operator if it's not preceded by a value.
+             */
+            if (sOp == ' ') {
+                if (iValue < asValues.length - 1 && !asValues[iValue]) {
+                    iValue++;
+                    sOp = asValues[iValue++]
+                } else {
+                    fError = true;
+                    break;
+                }
+            }
+
+            if (!sOp) break;
+
+            var aBinOp = (this.achGroup[0] == '<'? Debugger.aDECOpPrecedence : Debugger.aBinOpPrecedence);
+            if (!aBinOp[sOp]) {
+                fError = true;
+                break;
+            }
+            if (aOps.length && aBinOp[sOp] <= aBinOp[aOps[aOps.length - 1]]) {
+                this.evalOps(aVals, aOps, 1);
+            }
+            aOps.push(sOp);
+
+            /*
+             * The MACRO-10 binary shifting operator assumes a base-10 shift count, regardless of the current
+             * base, so we must override the current base to ensure the count is parsed correctly.
+             */
+            this.nBase = (sOp == '^_')? 10 : nBase;
+            nUnary = 0;
+        }
+
+        if (fError || !this.evalOps(aVals, aOps) || aVals.length != 1) {
+            fError = true;
+        }
+
+        if (!fError) {
+            value = aVals.pop();
+
+        } else if (!aUndefined) {
+            this.println("parse error (" + (sValue || sOp) + ")");
+        }
+
+        this.nBase = nBasePrev;
+        return value;
+    }
+
+    /**
+     * parseASCII(sExp, chDelim, nBits, cchMax)
+     *
+     * @this {Debugger}
+     * @param {string} sExp
+     * @param {string} chDelim
+     * @param {number} nBits
+     * @param {number} cchMax
+     * @return {string|undefined}
+     */
+    parseASCII(sExp, chDelim, nBits, cchMax)
+    {
+        var i;
+        while ((i = sExp.indexOf(chDelim)) >= 0) {
+            var v = 0;
+            var j = i + 1;
+            var cch = cchMax;
+            while (j < sExp.length) {
+                var ch = sExp[j++];
+                if (ch == chDelim) {
+                    cch = -1;
+                    break;
+                }
+                if (!cch) break;
+                cch--;
+                var c = ch.charCodeAt(0);
+                if (nBits == 7) {
+                    c &= 0x7F;
+                } else {
+                    c = (c - 0x20) & 0x3F;
+                }
+                v = this.truncate(v * Math.pow(2, nBits) + c, nBits * cchMax, true);
+            }
+            if (cch >= 0) {
+                this.println("parse error (" + chDelim + sExp + chDelim + ")");
+                return undefined;
+            } else {
+                sExp = sExp.substr(0, i) + this.toStrBase(v, -1) + sExp.substr(j);
+            }
+        }
+        return sExp;
+    }
+
+    /**
+     * parseExpression(sExp, fQuiet)
+     *
+     * A quick-and-dirty expression parser.  It takes an expression like:
+     *
+     *      EDX+EDX*4+12345678
+     *
+     * and builds a value stack in aVals and a "binop" (binary operator) stack in aOps:
+     *
+     *      aVals       aOps
+     *      -----       ----
+     *      EDX         +
+     *      EDX         *
+     *      4           +
+     *      ...
+     *
+     * We pop 1 "binop" from aOps and 2 values from aVals whenever a "binop" of lower priority than its
+     * predecessor is encountered, evaluate, and push the result back onto aVals.  Only selected unary
+     * operators are supported (eg, negate and complement); no ternary operators like '?:' are supported.
+     *
+     * fQuiet can be used to pass an array that collects any undefined variables that parseExpression()
+     * encounters; the value of an undefined variable is zero.  This mode was added for components that need
+     * to support expressions containing "fixups" (ie, values that must be determined later).
+     *
+     * @this {Debugger}
+     * @param {string|undefined} sExp
+     * @param {Array|undefined|boolean} [fQuiet]
+     * @return {number|undefined} numeric value, or undefined if sExp contains any undefined or invalid values
+     */
+    parseExpression(sExp, fQuiet)
+    {
+        var value = undefined;
+        var fPrint = (fQuiet === false);
+        var aUndefined = Array.isArray(fQuiet)? fQuiet : undefined;
+
+        if (sExp) {
+
+            /*
+             * The default delimiting characters for grouped expressions are braces; they can be changed by altering
+             * achGroup, but when that happens, instead of changing our regular expressions and operator tables,
+             * we simply replace all achGroup characters with braces in the given expression.
+             *
+             * Why not use parentheses for grouped expressions?  Because some debuggers use parseReference() to perform
+             * parenthetical value replacements in message strings, and they don't want parentheses taking on a different
+             * meaning.  And for some machines, like the PDP-10, the convention is to use parentheses for other things,
+             * like indexed addressing, and to use angle brackets for grouped expressions.
+             */
+            if (this.achGroup[0] != '{') {
+                sExp = sExp.split(this.achGroup[0]).join('{').split(this.achGroup[1]).join('}');
+            }
+
+            /*
+             * Quoted ASCII characters can have a numeric value, too, which must be converted now, to avoid any
+             * conflicts with the operators below.
+             */
+            sExp = this.parseASCII(sExp, '"', 7, 5);    // MACRO-10 packs up to 5 7-bit ASCII codes into a value
+            if (!sExp) return value;
+            sExp = this.parseASCII(sExp, "'", 6, 6);    // MACRO-10 packs up to 6 6-bit ASCII (SIXBIT) codes into a value
+            if (!sExp) return value;
+
+            /*
+             * All browsers (including, I believe, IE9 and up) support the following idiosyncrasy of a RegExp split():
+             * when the RegExp uses a capturing pattern, the resulting array will include entries for all the pattern
+             * matches along with the non-matches.  This effectively means that, in the set of expressions that we
+             * support, all even entries in asValues will contain "values" and all odd entries will contain "operators".
+             *
+             * Although I started listing the operators in the RegExp in "precedential" order, that's not important;
+             * what IS important is listing operators than contain shorter operators first.  For example, bitwise
+             * shift operators must be listed BEFORE the logical less-than or greater-than operators.  The aBinOp tables
+             * (aBinOpPrecedence and aDECOpPrecedence) are what determine precedence, not the RegExp.
+             *
+             * Also, to better accommodate MACRO-10 syntax, I've replaced the single '^' for XOR with '^!', and I've
+             * added '!' as an alias for '|' (bitwise inclusive-or), '^-' as an alias for '~' (one's complement operator),
+             * and '_' as a shift operator (+/- values specify a left/right shift, and the count is not limited to 32).
+             *
+             * And to avoid conflicts with MACRO-10 syntax, I've replaced the original mod operator ('%') with '^/'.
+             *
+             * The MACRO-10 binary shifting suffix ('B') is a bit more problematic, since a capital B can also appear
+             * inside symbols, or inside hex values.  So if the default base is NOT 16, then I pre-scan for that suffix
+             * and replace all non-symbolic occurrences with an internal shift operator ('^_').
+             *
+             * Note that Str.parseInt(), which parseValue() relies on, supports both the MACRO-10 base prefix overrides
+             * and the binary shifting suffix ('B'), but since that suffix can also be a bracketed expression, we have to
+             * support it here as well.
+             *
+             * MACRO-10 supports only a subset of all the PCjs operators; for example, MACRO-10 doesn't support any of
+             * the boolean logical/compare operators.  But unless we run into conflicts, I prefer sticking with this
+             * common set of operators.
+             *
+             * All whitespace in the expression is collapsed to single spaces, and space has been added to the list
+             * of "operators", but its sole function is as a separator, not as an operator.  parseArray() will ignore
+             * single spaces as long as they are preceded and/or followed by a "real" operator.  It would be dangerous
+             * to remove spaces entirely, because if an operator-less expression like "A B" was passed in, we would want
+             * that to generate an error; if we converted it to "AB", evaluation might inadvertently succeed.
+             */
+            var regExp = /({|}|\|\||&&|\||\^!|\^B|\^O|\^D|\^L|\^-|~|\^_|_|&|!=|!|==|>=|>>>|>>|>|<=|<<|<|-|\+|\^\/|\/|\*|,,| )/;
+            if (this.nBase != 16) {
+                sExp = sExp.replace(/(^|[^A-Z0-9$%.])([0-9]+)B/, "$1$2^_").replace(/\s+/g, ' ');
+            }
+            var asValues = sExp.split(regExp);
+            value = this.parseArray(asValues, 0, asValues.length, this.nBase, aUndefined);
+            if (value !== undefined && fPrint) {
+                this.printValue(null, value);
+            }
+        }
+        return value;
+    }
+
+    /**
+     * parseReference(s)
+     *
+     * Returns the given string with any "{expression}" sequences replaced with the value of the expression,
+     * and any "[address]" references replaced with the contents of the address.  Expressions are parsed BEFORE
+     * addresses.
+     *
+     * @this {Debugger}
+     * @param {string} s
+     * @return {string|undefined}
+     */
+    parseReference(s)
+    {
+        var a;
+        var chOpen = this.achGroup[0];
+        var chClose = this.achGroup[1];
+        var chEscape = (chOpen == '(' || chOpen == '{' || chOpen == '[')? '\\' : '';
+        var chInnerEscape = (chOpen == '['? '\\' : '');
+        var reSubExp = new RegExp(chEscape + chOpen + "([^" + chInnerEscape + chOpen + chInnerEscape + chClose + "]+)" + chEscape + chClose);
+        while (a = s.match(reSubExp)) {
+            var value = this.parseExpression(a[1]);
+            if (value === undefined) return undefined;
+            var sSearch = chOpen + a[1] + chClose;
+            var sReplace = value != null? this.toStrBase(value) : "undefined";
+            /*
+             * Note that by default, the String replace() method only replaces the FIRST occurrence,
+             * and there MIGHT be more than one occurrence of the expression we just parsed, so we could
+             * do this instead:
+             *
+             *      s = s.split(sSearch).join(sReplace);
+             *
+             * However, that's knd of an expensive (slow) solution, and it's not strictly necessary, since
+             * any additional identical expressions will be picked up on a subsequent iteration through this loop.
+             */
+            s = s.replace(sSearch, sReplace);
+        }
+        if (this.achAddress.length) {
+            chOpen = this.achAddress[0];
+            chClose = this.achAddress[1];
+            chEscape = (chOpen == '(' || chOpen == '{' || chOpen == '[')? '\\' : '';
+            chInnerEscape = (chOpen == '['? '\\' : '');
+            reSubExp = new RegExp(chEscape + chOpen + "([^" + chInnerEscape + chOpen + chInnerEscape + chClose + "]+)" + chEscape + chClose);
+            while (a = s.match(reSubExp)) {
+                s = this.parseAddrReference(s, a[1]);
+            }
+        }
+        return this.parseSysVars(s);
+    }
+
+    /**
+     * parseSysVars(s)
+     *
+     * Returns the given string with any recognized "$var" replaced with its value; eg:
+     *
+     *      $ops: the number of opcodes executed since the last time it was displayed (or reset)
+     *
+     * @this {Debugger}
+     * @param {string} s
+     * @return {string}
+     */
+    parseSysVars(s)
+    {
+        var a;
+        while (a = s.match(/\$([a-z]+)/i)) {
+            var v = null;
+            switch(a[1].toLowerCase()) {
+            case "ops":
+                v = this.cOpcodes - this.cOpcodesStart;
+                break;
+            }
+            if (v == null) break;
+            s = s.replace(a[0], v.toString());
+        }
+        return s;
+    }
+
+    /**
+     * parseUnary(value, nUnary)
+     *
+     * nUnary is actually a small "stack" of unary operations encoded in successive pairs of bits.
+     * As parseExpression() encounters each unary operator, nUnary is shifted left 2 bits, and the
+     * new unary operator is encoded in bits 0 and 1 (0b00 is none, 0b01 is negate, 0b10 is complement,
+     * and 0b11 is reserved).  Here, we process the bits in reverse order (hence the stack-like nature),
+     * ensuring that we process the unary operators associated with this value right-to-left.
+     *
+     * Since bitwise operators see only 32 bits, more than 16 unary operators cannot be supported
+     * using this method.  We'll let parseExpression() worry about that; if it ever happens in practice,
+     * then we'll have to switch to a more "expensive" approach (eg, an actual array of unary operators).
+     *
+     * @this {Debugger}
+     * @param {number} value
+     * @param {number} nUnary
+     * @return {number}
+     */
+    parseUnary(value, nUnary)
+    {
+        while (nUnary) {
+            switch(nUnary & 0o3) {
+            case 1:
+                value = -this.truncate(value);
+                break;
+            case 2:
+                value = this.evalXOR(value, -1);        // this is easier than adding an evalNOT()...
+                break;
+            case 3:
+                var bit = 35;                           // simple left-to-right zero-bit-counting loop...
+                while (bit >= 0 && !this.evalAND(value, Math.pow(2, bit))) bit--;
+                value = 35 - bit;
+                break;
+            }
+            nUnary >>>= 2;
+        }
+        return value;
+    }
+
+    /**
+     * parseValue(sValue, sName, fQuiet, nUnary)
+     *
+     * @this {Debugger}
+     * @param {string|undefined} sValue
+     * @param {string|null} [sName] is the name of the value, if any
+     * @param {Array|undefined|boolean} [fQuiet]
+     * @param {number} [nUnary] (0 for none, 1 for negate, 2 for complement, 3 for leading zeros)
+     * @return {number|undefined} numeric value, or undefined if sValue is either undefined or invalid
+     */
+    parseValue(sValue, sName, fQuiet, nUnary = 0)
+    {
+        var value;
+        var aUndefined = Array.isArray(fQuiet)? fQuiet : undefined;
+
+        if (sValue != null) {
+            var iReg = this.getRegIndex(sValue);
+            if (iReg >= 0) {
+                value = this.getRegValue(iReg);
+            } else {
+                value = this.getVariable(sValue);
+                if (value != null) {
+                    var sUndefined = this.getVariableFixup(sValue);
+                    if (sUndefined) {
+                        if (aUndefined) {
+                            aUndefined.push(sUndefined);
+                        } else {
+                            var valueUndefined = this.parseExpression(sUndefined, fQuiet);
+                            if (valueUndefined !== undefined) {
+                                value += valueUndefined;
+                            } else {
+                                if (!fQuiet) {
+                                    this.println("undefined " + (sName || "value") + ": " + sValue + " (" + sUndefined + ")");
+                                }
+                                value = undefined;
+                            }
+                        }
+                    }
+                } else {
+                    /*
+                     * A feature of MACRO-10 is that any single-digit number is automatically interpreted as base-10.
+                     */
+                    value = Str.parseInt(sValue, sValue.length > 1 || this.nBase > 10? this.nBase : 10);
+                }
+            }
+            if (value != null) {
+                value = this.truncate(this.parseUnary(value, nUnary));
+            } else {
+                if (!fQuiet) {
+                    this.println("invalid " + (sName || "value") + ": " + sValue);
+                }
+            }
+        } else {
+            if (!fQuiet) {
+                this.println("missing " + (sName || "value"));
+            }
+        }
+        return value;
+    }
+
+    /**
+     * printValue(sVar, value)
+     *
+     * @this {Debugger}
+     * @param {string|null} sVar
+     * @param {number|undefined} value
+     * @return {boolean} true if value defined, false if not
+     */
+    printValue(sVar, value)
+    {
+        var sValue;
+        var fDefined = false;
+        if (value !== undefined) {
+            fDefined = true;
+            if (this.nBase == 8) {
+                sValue = this.toStrBase(value, this.nBits, 8, 1) + "  " + value + '.';
+            } else {
+                sValue = this.toStrBase(value, this.nBits, 16, 1) + "  " + this.toStrBase(value, this.nBits, 8, 1) + "  " + this.toStrBase(value, this.nBits, 2, this.nBits <= 32? 8 : 6) + "  " + value + '.';
+            }
+            if (value >= 0x20 && value < 0x7F) {
+                sValue += " '" + String.fromCharCode(value) + "'";
+            }
+        }
+        sVar = (sVar != null? (sVar + ": ") : "");
+        this.println(sVar + sValue);
+        return fDefined;
+    }
+
+    /**
+     * resetVariables()
+     *
+     * @this {Debugger}
+     * @return {Object}
+     */
+    resetVariables()
+    {
+        var a = this.aVariables;
+        this.aVariables = {};
+        return a;
+    }
+
+    /**
+     * restoreVariables(a)
+     *
+     * @this {Debugger}
+     * @param {Object} a (from previous resetVariables() call)
+     */
+    restoreVariables(a)
+    {
+        this.aVariables = a;
+    }
+
+    /**
+     * printVariable(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} [sVar]
+     * @return {boolean} true if all value(s) defined, false if not
+     */
+    printVariable(sVar)
+    {
+        var cVariables = 0;
+        if (this.aVariables) {
+            if (sVar) {
+                return this.printValue(sVar, this.aVariables[sVar] && this.aVariables[sVar].value);
+            }
+            var aVars = Object.keys(this.aVariables);
+            aVars.sort();
+            for (var i = 0; i < aVars.length; i++) {
+                this.printValue(aVars[i], this.aVariables[aVars[i]].value);
+                cVariables++;
+            }
+        }
+        return cVariables > 0;
+    }
+
+    /**
+     * delVariable(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     */
+    delVariable(sVar)
+    {
+        delete this.aVariables[sVar];
+    }
+
+    /**
+     * getVariable(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     * @return {number|undefined}
+     */
+    getVariable(sVar)
+    {
+        if (this.aVariables[sVar]) {
+            return this.aVariables[sVar].value;
+        }
+        sVar = sVar.substr(0, 6);
+        return this.aVariables[sVar] && this.aVariables[sVar].value;
+    }
+
+    /**
+     * getVariableFixup(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     * @return {string|undefined}
+     */
+    getVariableFixup(sVar)
+    {
+        return this.aVariables[sVar] && this.aVariables[sVar].sUndefined;
+    }
+
+    /**
+     * isVariable(sVar)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     * @return {boolean}
+     */
+    isVariable(sVar)
+    {
+        return this.aVariables[sVar] !== undefined;
+    }
+
+    /**
+     * setVariable(sVar, value, sUndefined)
+     *
+     * @this {Debugger}
+     * @param {string} sVar
+     * @param {number} value
+     * @param {string|undefined} [sUndefined]
+     */
+    setVariable(sVar, value, sUndefined)
+    {
+        this.aVariables[sVar] = {value, sUndefined};
+    }
+
+    /**
+     * toStrBase(n, nBits, nBase, nGrouping)
+     *
+     * Use this instead of Str's toOct()/toDec()/toHex() to convert numbers to the Debugger's default base.
+     *
+     * @this {Debugger}
+     * @param {number|null|undefined} n
+     * @param {number} [nBits] (-1 to strip leading zeros, 0 to allow a variable number of digits)
+     * @param {number} [nBase]
+     * @param {number} [nGrouping] (if nBase is 2, this is a grouping; otherwise, it's a prefix condition)
+     * @return {string}
+     */
+    toStrBase(n, nBits = 0, nBase = 0, nGrouping = 0)
+    {
+        var s;
+        switch(nBase || this.nBase) {
+        case 2:
+            s = Str.toBin(n, nBits > 0? nBits : 0, nGrouping);
+            break;
+        case 8:
+            s = Str.toOct(n, nBits > 0? ((nBits + 2)/3)|0 : 0, !!nGrouping);
+            break;
+        case 10:
+            /*
+             * The multiplier is actually Math.log(2)/Math.log(10), but an approximation is more than adequate.
+             */
+            s = Str.toDec(n, nBits > 0? Math.ceil(nBits * 0.3) : 0);
+            break;
+        case 16:
+        default:
+            s = Str.toHex(n, nBits > 0? ((nBits + 3) >> 2) : 0, !!nGrouping);
+            break;
+        }
+        return (nBits < 0? Str.stripLeadingZeros(s) : s);
+    }
+}
+
+if (DEBUGGER) {
+
+    /*
+     * These are our operator precedence tables.  Operators toward the bottom (with higher values) have
+     * higher precedence.  aBinOpPrecedence was our original table; we had to add aDECOpPrecedence because
+     * the precedence of operators in DEC's MACRO-10 expressions differ.  Having separate tables also allows
+     * us to remove operators that shouldn't be supported, but unless some operator creates a problem,
+     * I prefer to keep as much commonality between the tables as possible.
+     *
+     * Missing from these tables are the (limited) set of unary operators we support (negate and complement),
+     * since this is only a BINARY operator precedence, not a general-purpose precedence table.  Assume that
+     * all unary operators take precedence over all binary operators.
+     */
+    Debugger.aBinOpPrecedence = {
+        '||':   5,      // logical OR
+        '&&':   6,      // logical AND
+        '!':    7,      // bitwise OR (conflicts with logical NOT, but we never supported that)
+        '|':    7,      // bitwise OR
+        '^!':   8,      // bitwise XOR (added by MACRO-10 sometime between the 1972 and 1978 versions)
+        '&':    9,      // bitwise AND
+        '!=':   10,     // inequality
+        '==':   10,     // equality
+        '>=':   11,     // greater than or equal to
+        '>':    11,     // greater than
+        '<=':   11,     // less than or equal to
+        '<':    11,     // less than
+        '>>>':  12,     // unsigned bitwise right shift
+        '>>':   12,     // bitwise right shift
+        '<<':   12,     // bitwise left shift
+        '-':    13,     // subtraction
+        '+':    13,     // addition
+        '^/':   14,     // remainder
+        '/':    14,     // division
+        '*':    14,     // multiplication
+        '_':    19,     // MACRO-10 shift operator
+        '^_':   19,     // MACRO-10 internal shift operator (converted from 'B' suffix form that MACRO-10 uses)
+        '{':    20,     // open grouped expression (converted from achGroup[0])
+        '}':    20      // close grouped expression (converted from achGroup[1])
+    };
+    Debugger.aDECOpPrecedence = {
+        ',,':   1,      // high-word,,low-word
+        '||':   5,      // logical OR
+        '&&':   6,      // logical AND
+        '!=':   10,     // inequality
+        '==':   10,     // equality
+        '>=':   11,     // greater than or equal to
+        '>':    11,     // greater than
+        '<=':   11,     // less than or equal to
+        '<':    11,     // less than
+        '>>>':  12,     // unsigned bitwise right shift
+        '>>':   12,     // bitwise right shift
+        '<<':   12,     // bitwise left shift
+        '-':    13,     // subtraction
+        '+':    13,     // addition
+        '^/':   14,     // remainder
+        '/':    14,     // division
+        '*':    14,     // multiplication
+        '!':    15,     // bitwise OR (conflicts with logical NOT, but we never supported that)
+        '|':    15,     // bitwise OR
+        '^!':   15,     // bitwise XOR (added by MACRO-10 sometime between the 1972 and 1978 versions)
+        '&':    15,     // bitwise AND
+        '_':    19,     // MACRO-10 shift operator
+        '^_':   19,     // MACRO-10 internal shift operator (converted from 'B' suffix form that MACRO-10 uses)
+        '{':    20,     // open grouped expression (converted from achGroup[0])
+        '}':    20      // close grouped expression (converted from achGroup[1])
+    };
+
+    /*
+     * Assorted constants
+     */
+    Debugger.TWO_POW32 = Math.pow(2, 32);
+
+}   // endif DEBUGGER
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/debugger.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/**
+ * DebuggerPDP11 Address Object
+ *
+ *      addr            address
+ *      fPhysical       true if this is a physical address
+ *      fTemporary      true if this is a temporary breakpoint address
+ *      nBase           set if the address contained an explicit base (eg, 16, 10, 8, etc)
+ *      sCmd            set for breakpoint addresses if there's an associated command string
+ *      aCmds           preprocessed commands (from sCmd)
+ *
+ * @typedef {{
+ *      addr:(number|null),
+ *      fPhysical:(boolean),
+ *      fTemporary:(boolean),
+ *      nBase:(number|undefined),
+ *      sCmd:(string|undefined),
+ *      aCmds:(Array.<string>|undefined)
+ * }}
+ */
+var DbgAddrPDP11;
+
+class DebuggerPDP11 extends Debugger {
+    /**
+     * DebuggerPDP11(parmsDbg)
+     *
+     * The DebuggerPDP11 component supports the following optional (parmsDbg) properties:
+     *
+     *      commands: string containing zero or more commands, separated by ';'
+     *
+     *      messages: string containing zero or more message categories to enable;
+     *      multiple categories must be separated by '|' or ';'.  Parsed by messageInit().
+     *
+     * The DebuggerPDP11 component is an optional component that implements a variety of user
+     * commands for controlling the CPU, dumping and editing memory, etc.
+     *
+     * @param {Object} parmsDbg
+     */
+    constructor(parmsDbg)
+    {
+        if (DEBUGGER) {
+
+            super(parmsDbg);
+
+            /*
+             * Since this Debugger doesn't use replaceRegs(), we can use parentheses instead of braces.
+             */
+            this.fInit = false;
+
+            this.achGroup = ['(',')'];
+            this.achAddress = [];
+
+            /*
+             * Most commands that require an address call parseAddr(), which defaults to dbgAddrNextCode
+             * or dbgAddrNextData when no address has been given.  doDump() and doUnassemble(), in turn,
+             * update dbgAddrNextData and dbgAddrNextCode, respectively, when they're done.
+             *
+             * For TEMPORARY breakpoint addresses, we set fTemporary to true, so that they can be automatically
+             * cleared when they're hit.
+             */
+            this.dbgAddrNextCode = this.newAddr();
+            this.dbgAddrNextData = this.newAddr();
+            this.dbgAddrAssemble = this.newAddr();
+
+            /*
+             * aSymbolTable is an array of SymbolTable objects, one per ROM or other chunk of address space,
+             * where each object contains the following properties:
+             *
+             *      sModule
+             *      addr (physical address, if any; eg, symbols for a ROM)
+             *      len
+             *      aSymbols
+             *      aOffsets
+             *
+             * See addSymbols() for more details, since that's how callers add sets of symbols to the table.
+             */
+            this.aSymbolTable = [];
+
+            /*
+             * clearBreakpoints() initializes the breakpoints lists: aBreakExec is a list of addresses
+             * to halt on whenever attempting to execute an instruction at the corresponding address,
+             * and aBreakRead and aBreakWrite are lists of addresses to halt on whenever a read or write,
+             * respectively, occurs at the corresponding address.
+             *
+             * NOTE: Curiously, after upgrading the Google Closure Compiler from v20141215 to v20150609,
+             * the resulting compiled code would crash in clearBreakpoints(), because the (renamed) aBreakRead
+             * property was already defined.  To eliminate whatever was confusing the Closure Compiler, I've
+             * explicitly initialized all the properties that clearBreakpoints() (re)initializes.
+             */
+            this.aBreakExec = this.aBreakRead = this.aBreakWrite = [];
+            this.clearBreakpoints();
+
+            /*
+             * The new "bn" command allows you to specify a number of instructions to execute and then stop;
+             * "bn 0" disables any outstanding count.
+             */
+            this.nBreakInstructions = 0;
+
+            /*
+             * Execution history is allocated by historyInit() whenever checksEnabled() conditions change.
+             * Execution history is updated whenever the CPU calls checkInstruction(), which will happen
+             * only when checksEnabled() returns true (eg, whenever one or more breakpoints have been set).
+             * This ensures that, by default, the CPU runs as fast as possible.
+             */
+            this.iInstructionHistory = 0;
+            this.aInstructionHistory = [];
+            this.nextHistory = undefined;
+            this.historyInit();
+
+            /*
+             * Initialize DebuggerPDP11 message support.
+             */
+            this.dbg = this;
+            this.afnDumpers = {};
+            this.bitsMessage = this.bitsWarning = 0;
+            this.sMessagePrev = null;
+            this.aMessageBuffer = [];
+            this.messageInit(parmsDbg['messages']);
+            this.sInitCommands = parmsDbg['commands'];
+
+            /*
+             * Define remaining miscellaneous DebuggerPDP11 properties.
+             */
+            this.opTable = DebuggerPDP11.OPTABLE;
+            this.aOpReserved = [];
+            this.nStep = 0;
+            this.sCmdTracePrev = null;
+            this.sCmdDumpPrev = null;
+            this.fIgnoreNextCheckFault = false;     // TODO: Does this serve any purpose on a PDP-11?
+            this.nSuppressBreaks = 0;
+            this.cInstructions = this.cInstructionsStart = 0;
+            this.nCycles = this.nCyclesStart = this.msStart = 0;
+            this.controlDebug = null;
+            this.panel = null;
+
+            /*
+             * Make it easier to access DebuggerPDP11 commands from an external REPL (eg, the WebStorm
+             * "live" console window); eg:
+             *
+             *      pdp11('r')
+             *      pdp11('dw 0:0')
+             *      pdp11('h')
+             *      ...
+             */
+            var dbg = this;
+            if (window) {
+                if (window[PDP11.APPCLASS] === undefined) {
+                    window[PDP11.APPCLASS] = function(s) { return dbg.doCommands(s); };
+                }
+            } else {
+                if (global[PDP11.APPCLASS] === undefined) {
+                    global[PDP11.APPCLASS] = function(s) { return dbg.doCommands(s); };
+                }
+            }
+
+        }   // endif DEBUGGER
+    }
+
+    /**
+     * getAddr(dbgAddr, fWrite, nb)
+     *
+     * @this {DebuggerPDP11}
+     * @param {DbgAddrPDP11|null} [dbgAddr]
+     * @param {boolean} [fWrite]
+     * @param {number} [nb] number of bytes to check (1 or 2); default is 1
+     * @return {number} is the corresponding linear address, or PDP11.ADDR_INVALID
+     */
+    getAddr(dbgAddr, fWrite, nb)
+    {
+        var addr = dbgAddr && dbgAddr.addr;
+        if (addr == null) addr = PDP11.ADDR_INVALID;
+        return addr;
+    }
+
+    /**
+     * newAddr(addr, fPhysical, nBase)
+     *
+     * Returns a NEW DbgAddrPDP11 object, initialized with specified values and/or defaults.
+     *
+     * @this {DebuggerPDP11}
+     * @param {number|null} [addr]
+     * @param {boolean} [fPhysical]
+     * @param {number} [nBase]
+     * @return {DbgAddrPDP11}
+     */
+    newAddr(addr = null, fPhysical = false, nBase)
+    {
+        return {addr: addr, fPhysical: fPhysical, fTemporary: false, nBase: nBase};
+    }
+
+    /**
+     * setAddr(dbgAddr, addr)
+     *
+     * Updates an EXISTING DbgAddrPDP11 object, initialized with specified values and/or defaults.
+     *
+     * @this {DebuggerPDP11}
+     * @param {DbgAddrPDP11} dbgAddr
+     * @param {number} addr
+     * @return {DbgAddrPDP11}
+     */
+    setAddr(dbgAddr, addr)
+    {
+        dbgAddr.addr = addr;
+        dbgAddr.fTemporary = false;
+        dbgAddr.nBase = undefined;
+        return dbgAddr;
+    }
+
+    /**
+     * packAddr(dbgAddr)
+     *
+     * Packs a DbgAddrPDP11 object into an Array suitable for saving in a machine state object.
+     *
+     * @this {DebuggerPDP11}
+     * @param {DbgAddrPDP11} dbgAddr
+     * @return {Array}
+     */
+    packAddr(dbgAddr)
+    {
+        return [dbgAddr.addr, dbgAddr.fPhysical, dbgAddr.nBase, dbgAddr.fTemporary, dbgAddr.sCmd];
+    }
+
+    /**
+     * unpackAddr(aAddr)
+     *
+     * Unpacks a DbgAddrPDP11 object from an Array created by packAddr() and restored from a saved machine state.
+     *
+     * @this {DebuggerPDP11}
+     * @param {Array} aAddr
+     * @return {DbgAddrPDP11}
+     */
+    unpackAddr(aAddr)
+    {
+        var dbgAddr = this.newAddr(aAddr[0], aAddr[1], aAddr[2]);
+        dbgAddr.fTemporary = aAddr[3];
+        if (aAddr[4]) {
+            dbgAddr.aCmds = this.parseCommand(dbgAddr.sCmd = aAddr[4]);
+        }
+        return dbgAddr;
+    }
+
+    /**
+     * initBus(bus, cpu, dbg)
+     *
+     * @this {DebuggerPDP11}
+     * @param {ComputerPDP11} cmp
+     * @param {BusPDP11} bus
+     * @param {CPUStatePDP11} cpu
+     * @param {DebuggerPDP11} dbg
+     */
+    initBus(cmp, bus, cpu, dbg)
+    {
+        this.bus = bus;
+        this.cmp = cmp;
+        this.cpu = cpu;
+        this.panel = cmp.panel;
+
+        /*
+         * Re-initialize Debugger message support if necessary
+         */
+        var sMessages = /** @type {string|undefined} */ (cmp.getMachineParm('messages'));
+        if (sMessages) this.messageInit(sMessages);
+
+        if (this.cpu.model < PDP11.MODEL_1140) {
+            this.aOpReserved = this.aOpReserved.concat(DebuggerPDP11.OP1140);
+        }
+        if (this.cpu.model < PDP11.MODEL_1145) {
+            this.aOpReserved = this.aOpReserved.concat(DebuggerPDP11.OP1145);
+        }
+
+        this.messageDump(MessagesPDP11.BUS,  function onDumpBus(asArgs) { dbg.dumpBus(asArgs); });
+
+        this.setReady();
+    }
+
+    /**
+     * setBinding(sType, sBinding, control, sValue)
+     *
+     * @this {DebuggerPDP11}
+     * @param {string|null} sType is the type of the HTML control (eg, "button", "textarea", "register", "flag", "rled", etc)
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "debugInput")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sType, sBinding, control, sValue)
+    {
+        var dbg = this;
+        switch (sBinding) {
+
+        case "debugInput":
+            this.bindings[sBinding] = control;
+            this.controlDebug = control;
+            /*
+             * For halted machines, this is fine, but for auto-start machines, it can be annoying.
+             *
+             *      control.focus();
+             */
+            control.onkeydown = function onKeyDownDebugInput(event) {
+                var sCmd;
+                if (event.keyCode == Keys.KEYCODE.CR) {
+                    sCmd = control.value;
+                    control.value = "";
+                    dbg.doCommands(sCmd, true);
+                }
+                else if (event.keyCode == Keys.KEYCODE.ESC) {
+                    control.value = sCmd = "";
+                }
+                else {
+                    if (event.keyCode == Keys.KEYCODE.UP) {
+                        sCmd = dbg.getPrevCommand();
+                    }
+                    else if (event.keyCode == Keys.KEYCODE.DOWN) {
+                        sCmd = dbg.getNextCommand();
+                    }
+                    if (sCmd != null) {
+                        var cch = sCmd.length;
+                        control.value = sCmd;
+                        control.setSelectionRange(cch, cch);
+                    }
+                }
+                if (sCmd != null && event.preventDefault) event.preventDefault();
+            };
+            return true;
+
+        case "debugEnter":
+            this.bindings[sBinding] = control;
+            Web.onClickRepeat(
+                control,
+                500, 100,
+                function onClickDebugEnter(fRepeat) {
+                    if (dbg.controlDebug) {
+                        var sCmd = dbg.controlDebug.value;
+                        dbg.controlDebug.value = "";
+                        dbg.doCommands(sCmd, true);
+                        return true;
+                    }
+                    if (DEBUG) dbg.log("no debugger input buffer");
+                    return false;
+                }
+            );
+            return true;
+
+        case "step":
+            this.bindings[sBinding] = control;
+            Web.onClickRepeat(
+                control,
+                500, 100,
+                function onClickStep(fRepeat) {
+                    var fCompleted = false;
+                    if (!dbg.isBusy(true)) {
+                        dbg.setBusy(true);
+                        fCompleted = dbg.stepCPU(fRepeat? 1 : 0, null);
+                        dbg.setBusy(false);
+                    }
+                    return fCompleted;
+                }
+            );
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * setFocus(fScroll)
+     *
+     * @this {DebuggerPDP11}
+     * @param {boolean} [fScroll] (true if you really want the control scrolled into view)
+     */
+    setFocus(fScroll)
+    {
+        if (this.controlDebug) {
+            /*
+             * This is the recommended work-around to prevent the browser from scrolling the focused element
+             * into view.  The CPU is not a visual component, so when the CPU wants to set focus, the primary intent
+             * is to ensure that keyboard input is fielded properly.
+             */
+            var x = 0, y = 0;
+            if (!fScroll && window) {
+                x = window.scrollX;
+                y = window.scrollY;
+            }
+
+            this.controlDebug.focus();
+
+            if (!fScroll && window) {
+                window.scrollTo(x, y);
+            }
+        }
+    }
+
+    /**
+     * mapUnibus(addr)
+     *
+     * @this {DebuggerPDP11}
+     * @param {number} addr
+     * @return {number}
+     */
+    mapUnibus(addr)
+    {
+        return this.cpu.mapUnibus(addr);
+    }
+
+    /**
+     * getByte(dbgAddr, inc)
+     *
+     * We must route all our memory requests through the CPU now, in case paging is enabled.
+     *
+     * @this {DebuggerPDP11}
+     * @param {DbgAddrPDP11} dbgAddr
+     * @param {number} [inc]
+     * @return {number}
+     */
+    getByte(dbgAddr, inc)
+    {
+        var b = 0xff;
+        var addr = this.getAddr(dbgAddr, false, 1);
+        if (addr !== PDP11.ADDR_INVALID) {
+            b = (dbgAddr.fPhysical || addr > 0xffff)? this.bus.getByteDirect(this.mapUnibus(addr)) : this.cpu.getByteSafe(addr);
+            if (inc) this.incAddr(dbgAddr, inc);
+        }
+        return b;
+    }
+
+    /**
+     * getWord(dbgAddr, inc)
+     *
+     * @this {DebuggerPDP11}
+     * @param {DbgAddrPDP11} dbgAddr
+     * @param {number} [inc]
+     * @return {number}
+     */
+    getWord(dbgAddr, inc)
+    {
+        var w = 0xffff;
+        var addr = this.getAddr(dbgAddr, false, 2);
+        if (addr !== PDP11.ADDR_INVALID) {
+            w = (dbgAddr.fPhysical || addr > 0xffff)? this.bus.getWordDirect(this.mapUnibus(addr)) : this.cpu.getWordSafe(addr);
+            if (inc) this.incAddr(dbgAddr, inc);
+        }
+        return w;
+    }
+
+    /**
+     * setByte(dbgAddr, b, inc)
+     *
+     * @this {DebuggerPDP11}
+     * @param {DbgAddrPDP11} dbgAddr
+     * @param {number} b
+     * @param {number} [inc]
+     */
+    setByte(dbgAddr, b, inc)
+    {
+        var addr = this.getAddr(dbgAddr, true, 1);
+        if (addr !== PDP11.ADDR_INVALID) {
+            if (dbgAddr.fPhysical || addr > 0xffff) {
+                this.bus.setByteDirect(this.mapUnibus(addr), b);
+            } else {
+                this.cpu.setByteSafe(addr, b);
+            }
+            if (inc) this.incAddr(dbgAddr, inc);
+            this.cmp.updateDisplays(-1);
+        }
+    }
+
+    /**
+     * setWord(dbgAddr, w, inc)
+     *
+     * @this {DebuggerPDP11}
+     * @param {DbgAddrPDP11} dbgAddr
+     * @param {number} w
+     * @param {number} [inc]
+     */
+    setWord(dbgAddr, w, inc)
+    {
+        var addr = this.getAddr(dbgAddr, true, 2);
+        if (addr !== PDP11.ADDR_INVALID) {
+            if (dbgAddr.fPhysical || addr > 0xffff) {
+                this.bus.setWordDirect(this.mapUnibus(addr), w);
+            } else {
+                this.cpu.setWordSafe(addr, w);
+            }
+            if (inc) this.incAddr(dbgAddr, inc);
+            this.cmp.updateDisplays(-1);
+        }
+    }
+
+    /**
+     * parseAddr(sAddr, fCode, fNoChecks)
+     *
+     * Address evaluation and validation (eg, range checks) are no longer performed at this stage.  That's
+     * done later, by getAddr(), which returns PDP11.ADDR_INVALID for invalid segments, out-of-range offsets,
+     * etc.  The Debugger's low-level get/set memory functions verify all getAddr() results, but even if an
+     * invalid address is passed through to the Bus memory interfaces, the address will simply be masked with
+     * bus.nBusMask; in the case of PDP11.ADDR_INVALID, that will generally refer to the top of the physical
+     * address space.
+     *
+     * @this {DebuggerPDP11}
+     * @param {string|undefined} sAddr
+     * @param {boolean} [fCode] (true if target is code, false if target is data)
+     * @param {boolean} [fNoChecks] (true when setting breakpoints that may not be valid now, but will be later)
+     * @return {DbgAddrPDP11|null|undefined}
+     */
+    parseAddr(sAddr, fCode, fNoChecks)
+    {
+        var dbgAddr;
+        var dbgAddrNext = (fCode? this.dbgAddrNextCode : this.dbgAddrNextData);
+        var addr = dbgAddrNext.addr;
+        var fPhysical, nBase;
+        if (sAddr !== undefined) {
+            sAddr = this.parseReference(sAddr);
+            var ch = sAddr.charAt(0);
+            if (ch == '%') {
+                fPhysical = true;
+                sAddr = sAddr.substr(1);
+            }
+            dbgAddr = this.findSymbolAddr(sAddr);
+            if (dbgAddr) return dbgAddr;
+            if (sAddr.indexOf("0x") >= 0) {
+                nBase = 16
+            } else if (sAddr.indexOf("0o") >= 0) {
+                nBase = 8;
+            } else if (sAddr.indexOf('.') >= 0) {
+                nBase = 10;
+            }
+            addr = this.parseExpression(sAddr);
+        }
+        if (addr != null) {
+            dbgAddr = this.newAddr(addr, fPhysical, nBase);
+        }
+        return dbgAddr;
+    }
+
+    /**
+     * parseAddrOptions(dbdAddr, sOptions)
+     *
+     * @this {DebuggerPDP11}
+     * @param {DbgAddrPDP11} dbgAddr
+     * @param {string} [sOptions]
+     */
+    parseAddrOptions(dbgAddr, sOptions)
+    {
+        if (sOptions) {
+            var a = sOptions.match(/(['"])(.*?)\1/);
+            if (a) {
+                dbgAddr.aCmds = this.parseCommand(dbgAddr.sCmd = a[2]);
+            }
+        }
+    }
+
+    /**
+     * incAddr(dbgAddr, inc)
+     *
+     * @this {DebuggerPDP11}
+     * @param {DbgAddrPDP11} dbgAddr
+     * @param {number} [inc] contains value to increment dbgAddr by (default is 1)
+     */
+    incAddr(dbgAddr, inc)
+    {
+        if (dbgAddr.addr != null) {
+            dbgAddr.addr += (inc || 1);
+        }
+    }
+
+    /**
+     * toStrOffset(off)
+     *
+     * @this {DebuggerPDP11}
+     * @param {number|null|undefined} [off]
+     * @return {string} the hex representation of off
+     */
+    toStrOffset(off)
+    {
+        return this.toStrBase(off);
+    }
+
+    /**
+     * toStrAddr(dbgAddr)
+     *
+     * @this {DebuggerPDP11}
+     * @param {DbgAddrPDP11} dbgAddr
+     * @return {string} the hex representation of the address
+     */
+    toStrAddr(dbgAddr)
+    {
+        return (dbgAddr.fPhysical? '%' : '') + this.toStrOffset(dbgAddr.addr);
+    }
+
+    /**
+     * getSZ(dbgAddr, cchMax)
+     *
+     * Gets zero-terminated (aka "ASCIIZ") string from dbgAddr.  It also stops at the first '$', in case this is
+     * a '$'-terminated string -- mainly because I'm lazy and didn't feel like writing a separate get() function.
+     * Yes, a zero-terminated string containing a '$' will be prematurely terminated, and no, I don't care.
+     *
+     * @this {DebuggerPDP11}
+     * @param {DbgAddrPDP11} dbgAddr
+     * @param {number} [cchMax] (default is 256)
+     * @return {string} (and dbgAddr advanced past the terminating zero)
+     */
+    getSZ(dbgAddr, cchMax)
+    {
+        var s = "";
+        cchMax = cchMax || 256;
+        while (s.length < cchMax) {
+            var b = this.getByte(dbgAddr, 1);
+            if (!b || b == 0x24 || b >= 127) break;
+            s += (b >= 32? String.fromCharCode(b) : '.');
+        }
+        return s;
+    }
+
+    /**
+     * dumpBlocks(aBlocks, sAddr)
+     *
+     * @this {DebuggerPDP11}
+     * @param {Array} aBlocks
+     * @param {string} [sAddr] (optional block address)
+     */
+    dumpBlocks(aBlocks, sAddr)
+    {
+        var addr = 0, i = 0, n = aBlocks.length;
+
+        if (sAddr) {
+            addr = this.getAddr(this.parseAddr(sAddr));
+            if (addr === PDP11.ADDR_INVALID) {
+                this.println("invalid address: " + sAddr);
+                return;
+            }
+            i = addr >>> this.bus.nBlockShift;
+            n = 1;
+        }
+
+        this.println("blockid   physical   blockaddr  used    size    type");
+        this.println("--------  ---------  ---------  ------  ------  ----");
+
+        var typePrev = -1, cPrev = 0;
+        while (n--) {
+            var block = aBlocks[i];
+            if (block.type == typePrev) {
+                if (!cPrev++) this.println("...");
+            } else {
+                typePrev = block.type;
+                var sType = MemoryPDP11.TYPE_NAMES[typePrev];
+                if (block) {
+                    this.println(Str.toHex(block.id, 8) + "  %" + Str.toHex(i << this.bus.nBlockShift, 8) + "  %" + Str.toHex(block.addr, 8) + "  " + Str.toHexWord(block.used) + "  " + Str.toHexWord(block.size) + "  " + sType);
+                }
+                if (typePrev != MemoryPDP11.TYPE.NONE) typePrev = -1;
+                cPrev = 0;
+            }
+            addr += this.bus.nBlockSize;
+            i++;
+        }
+    }
+
+    /**
+     * dumpBus(asArgs)
+     *
+     * Dumps Bus allocations.
+     *
+     * @this {DebuggerPDP11}
+     * @param {Array.<string>} asArgs (asArgs[0] is an optional block address)
+     */
+    dumpBus(asArgs)
+    {
+        this.dumpBlocks(this.bus.aBusBlocks, asArgs[0]);
+    }
+
+    /**
+     * dumpHistory(sPrev, sLines)
+     *
+     * If sLines is not a number, it can be a instruction filter.  However, for the moment, the only
+     * supported filter is "call", which filters the history buffer for all CALL and RET instructions
+     * from the specified previous point forward.
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} [sPrev] is a (decimal) number of instructions to rewind to (default is 10)
+     * @param {string} [sLines] is a (decimal) number of instructions to print (default is, again, 10)
+     */
+    dumpHistory(sPrev, sLines)
+    {
+        var sMore = "";
+        var cHistory = 0;
+        var iHistory = this.iInstructionHistory;
+        var aHistory = this.aInstructionHistory;
+
+        if (aHistory.length) {
+            var nPrev = +sPrev || this.nextHistory;
+            var nLines = +sLines || 10;
+
+            if (isNaN(nPrev)) {
+                nPrev = nLines;
+            } else {
+                sMore = "more ";
+            }
+
+            if (nPrev > aHistory.length) {
+                this.println("note: only " + aHistory.length + " available");
+                nPrev = aHistory.length;
+            }
+
+            iHistory -= nPrev;
+            if (iHistory < 0) {
+                /*
+                 * If the dbgAddr of the last aHistory element contains a valid selector, wrap around.
+                 */
+                if (aHistory[aHistory.length - 1].addr == null) {
+                    nPrev = iHistory + nPrev;
+                    iHistory = 0;
+                } else {
+                    iHistory += aHistory.length;
+                }
+            }
+
+            var aFilters = [];
+            if (sLines == "call") {
+                nLines = 100000;
+                aFilters = ["CALL"];
+            }
+
+            if (sPrev !== undefined) {
+                this.println(nPrev + " instructions earlier:");
+            }
+
+            /*
+             * TODO: The following is necessary to prevent dumpHistory() from causing additional (or worse, recursive)
+             * faults due to segmented addresses that are no longer valid, but the only alternative is to dramatically
+             * increase the amount of memory used to store instruction history (eg, storing copies of all the instruction
+             * bytes alongside the execution addresses).
+             *
+             * For now, we're living dangerously, so that our history dumps actually work.
+             *
+             *      this.nSuppressBreaks++;
+             *
+             * If you re-enable this protection, be sure to re-enable the decrement below, too.
+             */
+            while (nLines > 0 && iHistory != this.iInstructionHistory) {
+
+                var dbgAddr = aHistory[iHistory++];
+                if (dbgAddr.addr == null) break;
+
+                /*
+                 * We must create a new dbgAddr from the address in aHistory, because dbgAddr was
+                 * a reference, not a copy, and we don't want getInstruction() modifying the original.
+                 */
+                var dbgAddrNew = this.newAddr(dbgAddr.addr);
+
+                var sComment = "history";
+                var nSequence = nPrev--;
+
+                /*
+                 * TODO: Need to some UI to control whether cycle counts are displayed as part of the history.
+                 * It's currently disabled in checkInstruction(), so it's disable here, too.
+                 *
+                if (DEBUG && dbgAddr.cycleCount != null) {
+                    sComment = "cycles";
+                    nSequence = dbgAddr.cycleCount;
+                }
+                 */
+
+                var sInstruction = this.getInstruction(dbgAddrNew, sComment, nSequence);
+
+                if (!aFilters.length || sInstruction.indexOf(aFilters[0]) >= 0) {
+                    this.println(sInstruction);
+                }
+
+                /*
+                 * If there were OPERAND or ADDRESS overrides on the previous instruction, getInstruction()
+                 * will have automatically disassembled additional bytes, so skip additional history entries.
+                 */
+                if (dbgAddrNew.cOverrides) {
+                    iHistory += dbgAddrNew.cOverrides; nLines -= dbgAddrNew.cOverrides; nPrev -= dbgAddrNew.cOverrides;
+                }
+
+                if (iHistory >= aHistory.length) iHistory = 0;
+                this.nextHistory = nPrev;
+                cHistory++;
+                nLines--;
+            }
+            /*
+             * See comments above.
+             *
+             *      this.nSuppressBreaks--;
+             */
+        }
+
+        if (!cHistory) {
+            this.println("no " + sMore + "history available");
+            this.nextHistory = undefined;
+        }
+    }
+
+    /**
+     * messageInit(sEnable)
+     *
+     * @this {DebuggerPDP11}
+     * @param {string|undefined} sEnable contains zero or more message categories to enable, separated by '|'
+     */
+    messageInit(sEnable)
+    {
+        this.dbg = this;
+        this.bitsMessage = this.bitsWarning = MessagesPDP11.WARN;
+        this.sMessagePrev = null;
+        this.aMessageBuffer = [];
+        /*
+         * Internally, we use "key" instead of "keys", since the latter is a method on JavasScript objects,
+         * but externally, we allow the user to specify "keys"; "kbd" is also allowed as shorthand for "keyboard".
+         */
+        var aEnable = this.parseCommand(sEnable.replace("keys","key").replace("kbd","keyboard"), false, '|');
+        if (aEnable.length) {
+            for (var m in MessagesPDP11.CATEGORIES) {
+                if (Usr.indexOf(aEnable, m) >= 0) {
+                    this.bitsMessage |= MessagesPDP11.CATEGORIES[m];
+                    this.println(m + " messages enabled");
+                }
+            }
+        }
+    }
+
+    /**
+     * messageDump(bitMessage, fnDumper)
+     *
+     * @this {DebuggerPDP11}
+     * @param {number} bitMessage is one Messages category flag
+     * @param {function(Array.<string>)} fnDumper is a function the Debugger can use to dump data for that category
+     * @return {boolean} true if successfully registered, false if not
+     */
+    messageDump(bitMessage, fnDumper)
+    {
+        for (var m in MessagesPDP11.CATEGORIES) {
+            if (bitMessage == MessagesPDP11.CATEGORIES[m]) {
+                this.afnDumpers[m] = fnDumper;
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * getRegIndex(sReg, off)
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} sReg
+     * @param {number} [off] optional offset into sReg
+     * @return {number} register index, or -1 if not found
+     */
+    getRegIndex(sReg, off)
+    {
+        sReg = sReg.toUpperCase();
+        var iReg = DebuggerPDP11.REGS[sReg];
+        if (iReg == null) {
+            iReg = -1;
+            if (sReg.charAt(0) == "R") {
+                iReg = +sReg.charAt(1);
+                if (iReg < 0 || iReg > 7) iReg = -1;
+            }
+        }
+        return iReg;
+    }
+
+    /**
+     * getRegName(iReg)
+     *
+     * @this {DebuggerPDP11}
+     * @param {number} iReg (0-7; not used for other registers)
+     * @return {string}
+     */
+    getRegName(iReg)
+    {
+        var sReg;
+        if (iReg < DebuggerPDP11.REG_AR || this.panel) sReg = DebuggerPDP11.REGNAMES[iReg];
+        return sReg || "";
+    }
+
+    /**
+     * getRegValue(iReg)
+     *
+     * Register numbers 0-7 are reserved for cpu.regsGen, 8-15 are reserved for cpu.regsAlt,
+     * 16-19 for cpu.regsAltStack, 20 for regPSW, etc.
+     *
+     * @this {DebuggerPDP11}
+     * @param {number} iReg
+     * @return {number|undefined}
+     */
+    getRegValue(iReg)
+    {
+        var value;
+        if (iReg >= 0) {
+            if (iReg < 8) {
+                value = this.cpu.regsGen[iReg];
+            }
+            else if (iReg < 16) {
+                value = this.cpu.regsAlt[iReg-8];
+            }
+            else if (iReg < 20) {
+                value = this.cpu.regsAltStack[iReg-16];
+            }
+            else {
+                var cpu = this.cpu;
+                var panel = this.panel;
+                switch(iReg) {
+                case DebuggerPDP11.REG_PS:
+                    value = this.cpu.getPSW();
+                    break;
+                case DebuggerPDP11.REG_PI:
+                    value = cpu.getPIR();
+                    break;
+                case DebuggerPDP11.REG_ER:
+                    value = cpu.regErr;
+                    break;
+                case DebuggerPDP11.REG_SL:
+                    value = cpu.getSLR();
+                    break;
+                case DebuggerPDP11.REG_M0:
+                    value = cpu.getMMR0();
+                    break;
+                case DebuggerPDP11.REG_M1:
+                    value = cpu.getMMR1();
+                    break;
+                case DebuggerPDP11.REG_M2:
+                    value = cpu.getMMR2();
+                    break;
+                case DebuggerPDP11.REG_M3:
+                    value = cpu.getMMR3();
+                    break;
+                case DebuggerPDP11.REG_AR:
+                    if (panel) value = panel.getAR();
+                    break;
+                case DebuggerPDP11.REG_DR:
+                    if (panel) value = panel.getDR();
+                    break;
+                case DebuggerPDP11.REG_SR:
+                    if (panel) value = panel.getSR();
+                    break;
+                }
+            }
+        }
+        return value;
+    }
+
+    /**
+     * replaceRegs(s)
+     *
+     * TODO: Implement or eliminate.
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} s
+     * @return {string}
+     */
+    replaceRegs(s)
+    {
+        return s;
+    }
+
+    /**
+     * message(sMessage, fAddress)
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} sMessage is any caller-defined message string
+     * @param {boolean} [fAddress] is true to display the current address
+     */
+    message(sMessage, fAddress)
+    {
+        if (fAddress) {
+            sMessage += " @" + this.toStrAddr(this.newAddr(this.cpu.getLastPC()));
+        }
+
+        if (this.sMessagePrev && sMessage == this.sMessagePrev) return;
+        this.sMessagePrev = sMessage;
+
+        if (this.bitsMessage & MessagesPDP11.BUFFER) {
+            this.aMessageBuffer.push(sMessage);
+            return;
+        }
+
+        var fRunning;
+        if ((this.bitsMessage & MessagesPDP11.HALT) && this.cpu && (fRunning = this.cpu.isRunning()) || this.isBusy(true)) {
+            this.stopCPU();
+            if (fRunning) sMessage += " (cpu halted)";
+        }
+
+        this.println(sMessage); // + " (" + this.cpu.getCycles() + " cycles)"
+
+        /*
+         * We have no idea what the frequency of println() calls might be; all we know is that they easily
+         * screw up the CPU's careful assumptions about cycles per burst.  So we call yieldCPU() after every
+         * message, to effectively end the current burst and start fresh.
+         *
+         * TODO: See CPUPDP11.calcStartTime() for a discussion of why we might want to call yieldCPU() *before*
+         * we display the message.
+         */
+        if (this.cpu) this.cpu.yieldCPU();
+    }
+
+    /**
+     * init()
+     *
+     * @this {DebuggerPDP11}
+     * @param {boolean} [fAutoStart]
+     */
+    init(fAutoStart)
+    {
+        this.fInit = true;
+        this.println("Type ? for help with PDPjs Debugger commands");
+        this.updateStatus();
+        if (!fAutoStart) this.setFocus();
+        if (this.sInitCommands) {
+            var sCmds = this.sInitCommands;
+            this.sInitCommands = null;
+            this.doCommands(sCmds);
+        }
+    }
+
+    /**
+     * historyInit(fQuiet)
+     *
+     * This function is intended to be called by the constructor, reset(), addBreakpoint(), findBreakpoint()
+     * and any other function that changes the checksEnabled() criteria used to decide whether checkInstruction()
+     * should be called.
+     *
+     * That is, if the history arrays need to be allocated and haven't already been allocated, then allocate them,
+     * and if the arrays are no longer needed, then deallocate them.
+     *
+     * @this {DebuggerPDP11}
+     * @param {boolean} [fQuiet]
+     */
+    historyInit(fQuiet)
+    {
+        var i;
+        if (!this.checksEnabled()) {
+            if (this.aInstructionHistory && this.aInstructionHistory.length && !fQuiet) {
+                this.println("instruction history buffer freed");
+            }
+            this.iInstructionHistory = 0;
+            this.aInstructionHistory = [];
+            return;
+        }
+        if (!this.aInstructionHistory || !this.aInstructionHistory.length) {
+            this.aInstructionHistory = new Array(DebuggerPDP11.HISTORY_LIMIT);
+            for (i = 0; i < this.aInstructionHistory.length; i++) {
+                /*
+                 * Preallocate dummy Addr (Array) objects in every history slot, so that
+                 * checkInstruction() doesn't need to call newAddr() on every slot update.
+                 */
+                this.aInstructionHistory[i] = this.newAddr();
+            }
+            this.iInstructionHistory = 0;
+            if (!fQuiet) {
+                this.println("instruction history buffer allocated");
+            }
+        }
+    }
+
+    /**
+     * startCPU(fUpdateFocus, fQuiet)
+     *
+     * @this {DebuggerPDP11}
+     * @param {boolean} [fUpdateFocus] is true to update focus
+     * @param {boolean} [fQuiet]
+     * @return {boolean} true if run request successful, false if not
+     */
+    startCPU(fUpdateFocus, fQuiet)
+    {
+        if (!this.checkCPU(fQuiet)) return false;
+        this.cpu.startCPU(fUpdateFocus);
+        return true;
+    }
+
+    /**
+     * stepCPU(nCycles, fRegs, fUpdateDisplays)
+     *
+     * @this {DebuggerPDP11}
+     * @param {number} nCycles (0 for one instruction without checking breakpoints)
+     * @param {boolean|null} [fRegs] is true to display registers after step (default is false; use null for previous setting)
+     * @param {boolean} [fUpdateDisplays] is false to disable Computer display updates (default is true)
+     * @return {boolean}
+     */
+    stepCPU(nCycles, fRegs, fUpdateDisplays)
+    {
+        if (!this.checkCPU()) return false;
+
+        var sCmd = "";
+        if (fRegs === null) {
+            fRegs = (!this.sCmdTracePrev || this.sCmdTracePrev == "tr");
+            sCmd = fRegs? "tr" : "t";
+        }
+
+        this.nCycles = 0;
+
+        if (!nCycles) {
+            /*
+             * When single-stepping, the CPU won't call checkInstruction(), which is good for
+             * avoiding breakpoints, but bad for instruction data collection if checks are enabled.
+             * So we call checkInstruction() ourselves.
+             */
+            if (this.checksEnabled()) this.checkInstruction(this.cpu.getPC(), 0);
+        }
+        /*
+         * For our typically tiny bursts (usually single instructions), mimic what runCPU() does.
+         */
+        try {
+            nCycles = this.cpu.getBurstCycles(nCycles);
+            var nCyclesStep = this.cpu.stepCPU(nCycles);
+            if (nCyclesStep > 0) {
+                this.cpu.updateTimers(nCyclesStep);
+                this.nCycles += nCyclesStep;
+                this.cpu.addCycles(nCyclesStep, true);
+                this.cpu.updateChecksum(nCyclesStep);
+                this.cInstructions++;
+            }
+        }
+        catch(exception) {
+            /*
+             * We assume that any numeric exception was explicitly thrown by the CPU to interrupt the
+             * current instruction.  For all other exceptions, we attempt a stack dump.
+             */
+            if (typeof exception != "number") {
+                var e = exception;
+                this.nCycles = 0;
+                this.cpu.setError(e.stack || e.message);
+            }
+        }
+
+        /*
+         * Because we called cpu.stepCPU() and not cpu.startCPU(), we must nudge the Computer's update code,
+         * and then update our own state.  Normally, the only time fUpdateDisplays will be false is when doTrace()
+         * is calling us in a loop, in which case it will perform its own updateDisplays() when it's done.
+         */
+        if (fUpdateDisplays !== false) {
+            if (this.panel) this.panel.stop();
+            this.cmp.updateDisplays(-1);
+        }
+
+        this.updateStatus(fRegs || false, sCmd);
+        return (this.nCycles > 0);
+    }
+
+    /**
+     * stopCPU()
+     *
+     * @this {DebuggerPDP11}
+     * @param {boolean} [fComplete]
+     */
+    stopCPU(fComplete)
+    {
+        if (this.cpu) this.cpu.stopCPU(fComplete);
+    }
+
+    /**
+     * updateStatus(fRegs, sCmd)
+     *
+     * @this {DebuggerPDP11}
+     * @param {boolean} [fRegs] (default is true)
+     * @param {string} [sCmd]
+     */
+    updateStatus(fRegs, sCmd)
+    {
+        if (!this.fInit) return;
+
+        if (fRegs === undefined) fRegs = true;
+
+        if (sCmd) {
+            this.println(DebuggerPDP11.PROMPT + sCmd);
+        }
+
+        var trapStatus = this.cpu.getTrapStatus();
+        if (trapStatus) {
+            var reason = trapStatus >> 8;
+            var sReason = reason < 0? PDP11.REASONS[-reason] : this.toStrBase(reason);
+            this.println("trapped to " + this.toStrBase(trapStatus & 0xff, 8) + " (" + sReason + ")");
+        }
+
+        this.dbgAddrNextCode = this.newAddr(this.cpu.getPC());
+        /*
+         * this.nStep used to be a simple boolean, but now it's 0 (or undefined)
+         * if inactive, 1 if stepping over an instruction without a register dump, or 2
+         * if stepping over an instruction with a register dump.
+         */
+        if (!fRegs || this.nStep == 1) {
+            this.doUnassemble();
+        } else {
+            this.doRegisters();
+        }
+    }
+
+    /**
+     * checkCPU(fQuiet)
+     *
+     * Make sure the CPU is ready (finished initializing), powered, not already running, and not in an error state.
+     *
+     * @this {DebuggerPDP11}
+     * @param {boolean} [fQuiet]
+     * @return {boolean}
+     */
+    checkCPU(fQuiet)
+    {
+        if (!this.cpu || !this.cpu.isReady() || !this.cpu.isPowered() || this.cpu.isRunning()) {
+            if (!fQuiet) this.println("cpu busy or unavailable, command ignored");
+            return false;
+        }
+        return !this.cpu.isError();
+    }
+
+    /**
+     * powerUp(data, fRepower)
+     *
+     * @this {DebuggerPDP11}
+     * @param {Object|null} data
+     * @param {boolean} [fRepower]
+     * @return {boolean} true if successful, false if failure
+     */
+    powerUp(data, fRepower)
+    {
+        if (!fRepower) {
+            /*
+             * Because Debugger save/restore support is somewhat limited (and didn't always exist),
+             * we deviate from the typical save/restore design pattern: instead of reset OR restore,
+             * we always reset and then perform a (potentially limited) restore.
+             */
+            this.reset(true);
+
+            // this.println(data? "resuming" : "powering up");
+
+            if (data) {
+                return this.restore(data);
+            }
+        }
+        return true;
+    }
+
+    /**
+     * powerDown(fSave, fShutdown)
+     *
+     * @this {DebuggerPDP11}
+     * @param {boolean} [fSave]
+     * @param {boolean} [fShutdown]
+     * @return {Object|boolean}
+     */
+    powerDown(fSave, fShutdown)
+    {
+        if (fShutdown) this.println(fSave? "suspending" : "shutting down");
+        return fSave? this.save() : true;
+    }
+
+    /**
+     * reset(fQuiet)
+     *
+     * This is a notification handler, called by the Computer, to inform us of a reset.
+     *
+     * @this {DebuggerPDP11}
+     * @param {boolean} fQuiet (true only when called from our own powerUp handler)
+     */
+    reset(fQuiet)
+    {
+        this.historyInit();
+        this.cInstructions = this.cInstructionsStart = 0;
+        this.sMessagePrev = null;
+        this.nCycles = 0;
+        this.dbgAddrNextCode = this.newAddr(this.cpu.getPC());
+        /*
+         * fRunning is set by start() and cleared by stop().  In addition, we clear
+         * it here, so that if the CPU is reset while running, we can prevent stop()
+         * from unnecessarily dumping the CPU state.
+         */
+        this.flags.running = false;
+        this.clearTempBreakpoint();
+        if (!fQuiet) this.updateStatus();
+    }
+
+    /**
+     * save()
+     *
+     * This implements (very rudimentary) save support for the Debugger component.
+     *
+     * @this {DebuggerPDP11}
+     * @return {Object}
+     */
+    save()
+    {
+        var state = new State(this);
+        state.set(0, this.packAddr(this.dbgAddrNextCode));
+        state.set(1, this.packAddr(this.dbgAddrAssemble));
+        state.set(2, [this.aPrevCmds, this.fAssemble, this.bitsMessage]);
+        state.set(3, this.aSymbolTable);
+        return state.data();
+    }
+
+    /**
+     * restore(data)
+     *
+     * This implements (very rudimentary) restore support for the Debugger component.
+     *
+     * @this {DebuggerPDP11}
+     * @param {Object} data
+     * @return {boolean} true if successful, false if failure
+     */
+    restore(data)
+    {
+        var i = 0;
+        if (data[2] !== undefined) {
+            this.dbgAddrNextCode = this.unpackAddr(data[i++]);
+            this.dbgAddrAssemble = this.unpackAddr(data[i++]);
+            this.aPrevCmds = data[i][0];
+            if (typeof this.aPrevCmds == "string") this.aPrevCmds = [this.aPrevCmds];
+            this.fAssemble = data[i][1];
+            this.bitsMessage |= data[i][2];     // keep our current message bits set, and simply "add" any extra bits defined by the saved state
+        }
+        if (data[3]) this.aSymbolTable = data[3];
+        return true;
+    }
+
+    /**
+     * start(ms, nCycles)
+     *
+     * This is a notification handler, called by the Computer, to inform us the CPU has started.
+     *
+     * @this {DebuggerPDP11}
+     * @param {number} ms
+     * @param {number} nCycles
+     */
+    start(ms, nCycles)
+    {
+        if (!this.nStep) this.println("running");
+        this.flags.running = true;
+        this.msStart = ms;
+        this.nCyclesStart = nCycles;
+    }
+
+    /**
+     * stop(ms, nCycles)
+     *
+     * This is a notification handler, called by the Computer, to inform us the CPU has now stopped.
+     *
+     * @this {DebuggerPDP11}
+     * @param {number} ms
+     * @param {number} nCycles
+     */
+    stop(ms, nCycles)
+    {
+        if (this.flags.running) {
+            this.flags.running = false;
+            this.nCycles = nCycles - this.nCyclesStart;
+            if (!this.nStep) {
+                var sStopped = "stopped";
+                if (this.nCycles) {
+                    var msTotal = ms - this.msStart;
+                    var nCyclesPerSecond = (msTotal > 0? Math.round(this.nCycles * 1000 / msTotal) : 0);
+                    sStopped += " (";
+                    if (this.checksEnabled()) {
+                        sStopped += this.cInstructions + " instructions, ";
+                        /*
+                         * $ops displays progress by calculating cInstructions - cInstructionsStart, so before
+                         * zeroing cInstructions, we should subtract cInstructions from cInstructionsStart (since
+                         * we're effectively subtracting cInstructions from cInstructions as well).
+                         */
+                        this.cInstructionsStart -= this.cInstructions;
+                        this.cInstructions = 0;
+                    }
+                    sStopped += this.nCycles + " cycles, " + msTotal + " ms, " + nCyclesPerSecond + " hz)";
+                } else {
+                    if (this.messageEnabled(MessagesPDP11.HALT)) {
+                        /*
+                         * It's possible the user is trying to 'g' past a fault that was blocked by helpCheckFault()
+                         * for the Debugger's benefit; if so, it will continue to be blocked, so try displaying a helpful
+                         * message (another helpful tip would be to simply turn off the "halt" message category).
+                         */
+                        sStopped += " (use the 't' command to execute blocked faults)";
+                    }
+                }
+                this.println(sStopped);
+            }
+            this.updateStatus(true);
+            this.setFocus();
+            this.clearTempBreakpoint(this.cpu.getPC());
+            this.sMessagePrev = null;
+        }
+    }
+
+    /**
+     * checksEnabled(fRelease)
+     *
+     * This "check" function is called by the CPU; we indicate whether or not every instruction needs to be checked.
+     *
+     * Originally, this returned true even when there were only read and/or write breakpoints, but those breakpoints
+     * no longer require the intervention of checkInstruction(); the Bus component automatically swaps in/out appropriate
+     * "checked" Memory access functions to deal with those breakpoints in the corresponding Memory blocks.  So I've
+     * simplified the test below.
+     *
+     * @this {DebuggerPDP11}
+     * @param {boolean} [fRelease] is true for release criteria only; default is false (any criteria)
+     * @return {boolean} true if every instruction needs to pass through checkInstruction(), false if not
+     */
+    checksEnabled(fRelease)
+    {
+        return ((DEBUG && !fRelease)? true : (this.aBreakExec.length > 1 || !!this.nBreakInstructions));
+    }
+
+    /**
+     * checkInstruction(addr, nState)
+     *
+     * This "check" function is called by the CPU to inform us about the next instruction to be executed,
+     * giving us an opportunity to look for "exec" breakpoints and update opcode instruction history.
+     *
+     * @this {DebuggerPDP11}
+     * @param {number} addr
+     * @param {number} nState is < 0 if stepping, 0 if starting, or > 0 if running
+     * @return {boolean} true if breakpoint hit, false if not
+     */
+    checkInstruction(addr, nState)
+    {
+        var opCode = -1;
+        var cpu = this.cpu;
+
+        /*
+         * If opHalt() calls our stopInstruction() function, it will effectively rewind the PC back to the HALT,
+         * purely for our debugging benefit, so we must compensate for that here by advancing the PC past the HALT
+         * when the machine starts up again.
+         */
+        if (!nState) {
+            opCode = this.cpu.getWordSafe(addr);
+            /*
+             * We have to be careful about this HALT-skipping code, because as fate would have it, I inadvertently
+             * stopped the following diagnostic with a breakpoint *on* a HALT instruction:
+             *
+             *      .R EKBEE1
+             *      EKBEE1.BIC
+             *
+             *      CEKBEE0 11/70 MEM MGMT
+             *
+             *      CPU UNDER TEST FOUND TO BE A KB11-CM
+             *      bp 033330 hit
+             *      stopped (28339757 instructions, 123994176 cycles, 19177 ms, 6465775 hz)
+             *      R0=140000 R1=033330 R2=100143 R3=133260 R4=000000 R5=177700
+             *      SP=000600 PC=033330 PS=140000 IR=000000 SL=000377 T0 N0 Z0 V0 C0
+             *      033330: 000000                 HALT
+             *
+             * Since we haven't executed the HALT yet, it would be wrong (and would cause a diagnostic failure) to
+             * skip over it.  In this particular case, the PDR for the address of the HALT instruction was invalid,
+             * so the HALT gets fetched but not executed.
+             *
+             * My first thought was that maybe we need to probe the address more thoroughly (getWordSafe() does
+             * not), but it should be sufficient to simply confirm that the PC of the last opcode executed matches
+             * the addr of this HALT.
+             *
+             * Yes, I could save myself this grief by eliminating these PC hacks, both here and in stopInstruction(),
+             * but I still think it's a useful debugging aid.
+             */
+            if (opCode == PDP11.OPCODE.HALT && this.cpu.getLastPC() == addr) {
+                addr = this.cpu.advancePC(2);
+            }
+        }
+
+        /*
+         * If the CPU stopped on a breakpoint, we're not interested in stopping again if the machine is starting.
+         */
+        if (nState > 0) {
+            if (this.nBreakInstructions) {
+                if (!--this.nBreakInstructions) return true;
+            }
+            if (this.checkBreakpoint(addr, 1, this.aBreakExec)) {
+                return true;
+            }
+        }
+
+        /*
+         * The rest of the instruction tracking logic can only be performed if historyInit() has allocated the
+         * necessary data structures.  Note that there is no explicit UI for enabling/disabling history, other than
+         * adding/removing breakpoints, simply because it's breakpoints that trigger the call to checkInstruction();
+         * well, OK, and a few other things now, like enabling MessagesPDP11.INT messages.
+         */
+        if (nState >= 0 && this.aInstructionHistory.length) {
+            this.cInstructions++;
+            if (opCode < 0) {
+                opCode = this.cpu.getWordSafe(addr);
+            }
+            if ((opCode & 0xffff) != PDP11.OPCODE.INVALID) {
+                var dbgAddr = this.aInstructionHistory[this.iInstructionHistory];
+                this.setAddr(dbgAddr, addr);
+                // if (DEBUG) dbgAddr.cycleCount = cpu.getCycles();
+                if (++this.iInstructionHistory == this.aInstructionHistory.length) this.iInstructionHistory = 0;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * stopInstruction(sMessage)
+     *
+     * TODO: Currently, the only way to prevent this call from stopping the CPU is when you're single-stepping.
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} [sMessage]
+     * @return {boolean} true if stopping is enabled, false if not
+     */
+    stopInstruction(sMessage)
+    {
+        var cpu = this.cpu;
+        if (cpu.isRunning()) {
+            cpu.setPC(this.cpu.getLastPC());
+            if (sMessage) this.println(sMessage);
+            this.stopCPU();
+            /*
+             * TODO: Review the appropriate-ness of throwing a bogus vector number in order to immediately stop
+             * the instruction.  It's handy, but it also means that we no longer actually return true, so callers
+             * of either stopInstruction() or undefinedInstruction() may have unreachable code paths.
+             */
+            throw -1;
+        }
+        return false;
+    }
+
+    /**
+     * undefinedInstruction(opCode)
+     *
+     * @this {DebuggerPDP11}
+     * @param {number} opCode
+     * @return {boolean} true if stopping is enabled, false if not
+     */
+    undefinedInstruction(opCode)
+    {
+        if (this.messageEnabled(MessagesPDP11.CPU)) {
+            this.printMessage("undefined opcode " + this.toStrBase(opCode), true, true);
+            return this.stopInstruction();  // allow the caller to step over it if they really want a trap generated
+        }
+        return false;
+    }
+
+    /**
+     * checkMemoryRead(addr, nb)
+     *
+     * This "check" function is called by a Memory block to inform us that a memory read occurred, giving us an
+     * opportunity to track the read if we want, and look for a matching "read" breakpoint, if any.
+     *
+     * In the "old days", it would be an error for this call to fail to find a matching Debugger breakpoint, but now
+     * Memory blocks have no idea whether the Debugger or the machine's Debug register(s) triggered this "checked" read.
+     *
+     * If we return true, we "trump" the machine's Debug register(s); false allows normal Debug register processing.
+     *
+     * @this {DebuggerPDP11}
+     * @param {number} addr
+     * @param {number} [nb] (# of bytes; default is 1)
+     * @return {boolean} true if breakpoint hit, false if not
+     */
+    checkMemoryRead(addr, nb)
+    {
+        if (this.checkBreakpoint(addr, nb || 1, this.aBreakRead)) {
+            this.stopCPU(false);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * checkMemoryWrite(addr, nb)
+     *
+     * This "check" function is called by a Memory block to inform us that a memory write occurred, giving us an
+     * opportunity to track the write if we want, and look for a matching "write" breakpoint, if any.
+     *
+     * In the "old days", it would be an error for this call to fail to find a matching Debugger breakpoint, but now
+     * Memory blocks have no idea whether the Debugger or the machine's Debug register(s) triggered this "checked" write.
+     *
+     * If we return true, we "trump" the machine's Debug register(s); false allows normal Debug register processing.
+     *
+     * @this {DebuggerPDP11}
+     * @param {number} addr
+     * @param {number} [nb] (# of bytes; default is 1)
+     * @return {boolean} true if breakpoint hit, false if not
+     */
+    checkMemoryWrite(addr, nb)
+    {
+        if (this.checkBreakpoint(addr, nb || 1, this.aBreakWrite)) {
+            this.stopCPU(false);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * clearBreakpoints()
+     *
+     * @this {DebuggerPDP11}
+     */
+    clearBreakpoints()
+    {
+        var i, dbgAddr, addr;
+        this.aBreakExec = ["bp"];
+        if (this.aBreakRead !== undefined) {
+            for (i = 1; i < this.aBreakRead.length; i++) {
+                dbgAddr = this.aBreakRead[i];
+                addr = this.getAddr(dbgAddr);
+                if (!dbgAddr.fPhysical) {
+                    this.cpu.removeMemBreak(addr, false);
+                } else {
+                    this.bus.removeMemBreak(addr, false);
+                }
+            }
+        }
+        this.aBreakRead = ["br"];
+        if (this.aBreakWrite !== undefined) {
+            for (i = 1; i < this.aBreakWrite.length; i++) {
+                dbgAddr = this.aBreakWrite[i];
+                addr = this.getAddr(dbgAddr);
+                if (!dbgAddr.fPhysical) {
+                    this.cpu.removeMemBreak(addr, true);
+                } else {
+                    this.bus.removeMemBreak(addr, true);
+                }
+            }
+        }
+        this.aBreakWrite = ["bw"];
+        /*
+         * nSuppressBreaks ensures we can't get into an infinite loop where a breakpoint lookup
+         * requires reading memory that triggers more memory reads, which triggers more breakpoint checks.
+         */
+        this.nSuppressBreaks = 0;
+        this.nBreakInstructions = 0;
+    }
+
+    /**
+     * addBreakpoint(aBreak, dbgAddr, fTemporary)
+     *
+     * In case you haven't already figured this out, all our breakpoint commands use the address
+     * to identify a breakpoint, not an incrementally assigned breakpoint index like other debuggers;
+     * see doBreak() for details.
+     *
+     * This has a few implications, one being that you CANNOT set more than one kind of breakpoint
+     * on a single address.  In practice, that's rarely a problem, because you can almost always set
+     * a different breakpoint on a neighboring address.
+     *
+     * Also, there is one exception to the "one address, one breakpoint" rule, and that involves
+     * temporary breakpoints (ie, one-time execution breakpoints that either a "p" or "g" command
+     * may create to step over a chunk of code).  Those breakpoints automatically clear themselves,
+     * so there usually isn't any need to refer to them using breakpoint commands.
+     *
+     * TODO: Consider supporting the more "traditional" breakpoint index syntax; the current
+     * address-based syntax was implemented solely for expediency and consistency.  At the same time,
+     * also consider a more WDEB386-like syntax, where "br" is used to set a variety of access-specific
+     * breakpoints, using modifiers like "r1", "r2", "w1", "w2, etc.
+     *
+     * @this {DebuggerPDP11}
+     * @param {Array} aBreak
+     * @param {DbgAddrPDP11} dbgAddr
+     * @param {boolean} [fTemporary]
+     * @return {boolean} true if breakpoint added, false if already exists
+     */
+    addBreakpoint(aBreak, dbgAddr, fTemporary)
+    {
+        var fSuccess = true;
+
+        // this.nSuppressBreaks++;
+
+        /*
+         * Instead of complaining that a breakpoint already exists (as we used to do), we now
+         * allow breakpoints to be re-set; this makes it easier to update any commands that may
+         * be associated with the breakpoint.
+         *
+         * The only exception: we DO allow a temporary breakpoint at an address where there may
+         * already be a breakpoint, so that you can easily step ("p" or "g") over such addresses.
+         */
+        if (!fTemporary) {
+            this.findBreakpoint(aBreak, dbgAddr, true, false, true);
+        }
+
+        if (aBreak != this.aBreakExec) {
+            var addr = this.getAddr(dbgAddr);
+            if (addr === PDP11.ADDR_INVALID) {
+                this.println("invalid address: " + this.toStrAddr(dbgAddr));
+                fSuccess = false;
+            } else {
+                var fWrite = (aBreak == this.aBreakWrite);
+                /*
+                 * We automatically promote any read/write breakpoint address to fPhysical if it's
+                 * outside the 16-bit virtual address range.
+                 */
+                if (addr > 0xffff) dbgAddr.fPhysical = true;
+                if (!dbgAddr.fPhysical) {
+                    this.cpu.addMemBreak(addr, fWrite);
+                } else {
+                    this.bus.addMemBreak(addr, fWrite);
+                }
+            }
+        }
+
+        if (fSuccess) {
+            aBreak.push(dbgAddr);
+            if (fTemporary) {
+                dbgAddr.fTemporary = true;
+            }
+            else {
+                this.printBreakpoint(aBreak, aBreak.length-1, "set");
+                this.historyInit();
+            }
+        }
+
+        // this.nSuppressBreaks--;
+
+        return fSuccess;
+    }
+
+    /**
+     * findBreakpoint(aBreak, dbgAddr, fRemove, fTemporary, fQuiet)
+     *
+     * @this {DebuggerPDP11}
+     * @param {Array} aBreak
+     * @param {DbgAddrPDP11} dbgAddr
+     * @param {boolean} [fRemove]
+     * @param {boolean} [fTemporary]
+     * @param {boolean} [fQuiet]
+     * @return {boolean} true if found, false if not
+     */
+    findBreakpoint(aBreak, dbgAddr, fRemove, fTemporary, fQuiet)
+    {
+        var fFound = false;
+        var addr = this.getAddr(dbgAddr);
+        for (var i = 1; i < aBreak.length; i++) {
+            var dbgAddrBreak = aBreak[i];
+            if (addr == this.getAddr(dbgAddrBreak)) {
+                if (!fTemporary || dbgAddrBreak.fTemporary) {
+                    fFound = true;
+                    if (fRemove) {
+                        if (!dbgAddrBreak.fTemporary && !fQuiet) {
+                            this.printBreakpoint(aBreak, i, "cleared");
+                        }
+                        aBreak.splice(i, 1);
+                        if (aBreak != this.aBreakExec) {
+                            var fWrite = (aBreak == this.aBreakWrite);
+                            if (!dbgAddrBreak.fPhysical) {
+                                this.cpu.removeMemBreak(addr, fWrite);
+                            } else {
+                                this.bus.removeMemBreak(addr, fWrite);
+                            }
+                        }
+                        /*
+                         * We'll mirror the logic in addBreakpoint() and leave the history buffer alone if this
+                         * was a temporary breakpoint.
+                         */
+                        if (!dbgAddrBreak.fTemporary) {
+                            this.historyInit();
+                        }
+                        break;
+                    }
+                    if (!fQuiet) this.printBreakpoint(aBreak, i, "exists");
+                    break;
+                }
+            }
+        }
+        return fFound;
+    }
+
+    /**
+     * listBreakpoints(aBreak)
+     *
+     * @this {DebuggerPDP11}
+     * @param {Array} aBreak
+     * @return {number} of breakpoints listed, 0 if none
+     */
+    listBreakpoints(aBreak)
+    {
+        for (var i = 1; i < aBreak.length; i++) {
+            this.printBreakpoint(aBreak, i);
+        }
+        return aBreak.length - 1;
+    }
+
+    /**
+     * printBreakpoint(aBreak, i, sAction)
+     *
+     * @this {DebuggerPDP11}
+     * @param {Array} aBreak
+     * @param {number} i
+     * @param {string} [sAction]
+     */
+    printBreakpoint(aBreak, i, sAction)
+    {
+        var dbgAddr = aBreak[i];
+        this.println(aBreak[0] + ' ' + this.toStrAddr(dbgAddr) + (sAction? (' ' + sAction) : (dbgAddr.sCmd? (' "' + dbgAddr.sCmd + '"') : '')));
+    }
+
+    /**
+     * setTempBreakpoint(dbgAddr)
+     *
+     * @this {DebuggerPDP11}
+     * @param {DbgAddrPDP11} dbgAddr of new temp breakpoint
+     */
+    setTempBreakpoint(dbgAddr)
+    {
+        this.addBreakpoint(this.aBreakExec, dbgAddr, true);
+    }
+
+    /**
+     * clearTempBreakpoint(addr)
+     *
+     * @this {DebuggerPDP11}
+     * @param {number|undefined} [addr] clear all temp breakpoints if no address specified
+     */
+    clearTempBreakpoint(addr)
+    {
+        if (addr !== undefined) {
+            this.checkBreakpoint(addr, 1, this.aBreakExec, true);
+            this.nStep = 0;
+        } else {
+            for (var i = 1; i < this.aBreakExec.length; i++) {
+                var dbgAddrBreak = this.aBreakExec[i];
+                if (dbgAddrBreak.fTemporary) {
+                    if (!this.findBreakpoint(this.aBreakExec, dbgAddrBreak, true, true)) break;
+                    i = 0;
+                }
+            }
+        }
+    }
+
+    /**
+     * checkBreakpoint(addr, nb, aBreak, fTemporary)
+     *
+     * @this {DebuggerPDP11}
+     * @param {number} addr
+     * @param {number} nb (# of bytes)
+     * @param {Array} aBreak
+     * @param {boolean} [fTemporary]
+     * @return {boolean} true if breakpoint has been hit, false if not
+     */
+    checkBreakpoint(addr, nb, aBreak, fTemporary)
+    {
+        /*
+         * Time to check for breakpoints; note that this should be done BEFORE updating history data
+         * (see checkInstruction), since we might not actually execute the current instruction.
+         */
+        var fBreak = false;
+
+        if (!this.nSuppressBreaks++) {
+
+            for (var i = 1; !fBreak && i < aBreak.length; i++) {
+
+                var dbgAddrBreak = aBreak[i];
+
+                if (fTemporary && !dbgAddrBreak.fTemporary) continue;
+
+                /*
+                 * If we're checking an execution address, which is always virtual, and virtual
+                 * addresses are always restricted to 16 bits, let's mask the breakpoint address to match
+                 * (the user should know better, but we'll be nice).
+                 */
+                var addrBreak = this.getAddr(dbgAddrBreak) & (aBreak == this.aBreakExec? 0xffff : -1);
+                for (var n = 0; n < nb; n++) {
+
+                    if ((addr + n) != addrBreak) continue;
+
+                    var a;
+                    fBreak = true;
+                    if (dbgAddrBreak.fTemporary) {
+                        this.findBreakpoint(aBreak, dbgAddrBreak, true, true);
+                        fTemporary = true;
+                    }
+                    if (a = dbgAddrBreak.aCmds) {
+                        /*
+                         * When one or more commands are attached to a breakpoint, we don't halt by default.
+                         * Instead, we set fBreak to true only if, at the completion of all the commands, the
+                         * CPU is halted; in other words, you should include "h" as one of the breakpoint commands
+                         * if you want the breakpoint to stop execution.
+                         *
+                         * Another useful command is "if", which will return false if the expression is false,
+                         * at which point we'll jump ahead to the next "else" command, and if there isn't an "else",
+                         * we abort.
+                         */
+                        fBreak = false;
+                        for (var j = 0; j < a.length; j++) {
+                            if (!this.doCommand(a[j], true)) {
+                                if (a[j].indexOf("if")) {
+                                    fBreak = true;          // the failed command wasn't "if", so abort
+                                    break;
+                                }
+                                var k = j + 1;
+                                for (; k < a.length; k++) {
+                                    if (!a[k].indexOf("else")) break;
+                                    j++;
+                                }
+                                if (k == a.length) {        // couldn't find an "else" after the "if", so abort
+                                    fBreak = true;
+                                    break;
+                                }
+                                /*
+                                 * If we're still here, we'll execute the "else" command (which is just a no-op),
+                                 * followed by any remaining commands.
+                                 */
+                            }
+                        }
+                        if (!this.cpu.isRunning()) fBreak = true;
+                    }
+                    if (fBreak) {
+                        if (!fTemporary) this.printBreakpoint(aBreak, i, "hit");
+                        break;
+                    }
+                }
+            }
+        }
+
+        this.nSuppressBreaks--;
+
+        return fBreak;
+    }
+
+    /**
+     * getInstruction(dbgAddr, sComment, nSequence)
+     *
+     * Get the next instruction, by decoding the opcode and any operands.
+     *
+     * @this {DebuggerPDP11}
+     * @param {DbgAddrPDP11} dbgAddr
+     * @param {string} [sComment] is an associated comment
+     * @param {number|null} [nSequence] is an associated sequence number, undefined if none
+     * @return {string} (and dbgAddr is updated to the next instruction)
+     */
+    getInstruction(dbgAddr, sComment, nSequence)
+    {
+        var opNames = DebuggerPDP11.OPNAMES;
+        var dbgAddrOp = this.newAddr(dbgAddr.addr);
+        var opCode = this.getWord(dbgAddr, 2);
+
+        var opDesc;
+        for (var mask in this.opTable) {
+            var opMasks = this.opTable[mask];
+            opDesc = opMasks[opCode & mask];
+            if (opDesc) break;
+        }
+
+        if (!opDesc) {
+            opDesc = DebuggerPDP11.OPNONE;
+        }
+
+        var opNum = opDesc[0];
+        if (this.aOpReserved.indexOf(opNum) >= 0) {
+            opDesc = DebuggerPDP11.OPNONE;
+            opNum = opDesc[0];
+        }
+
+        var sOperands = "", sTarget = "";
+        var sOpName = opNames[opNum];
+        var cOperands = opDesc.length - 1;
+
+        if (!opNum && !cOperands) {
+            sOperands = this.toStrBase(opCode);
+        }
+
+        for (var iOperand = 1; iOperand <= cOperands; iOperand++) {
+
+            var opType = opDesc[iOperand];
+            if (opType === undefined) continue;
+
+            var sOperand = this.getOperand(opCode, opType, dbgAddr);
+
+            if (!sOperand || !sOperand.length) {
+                sOperands = "INVALID";
+                break;
+            }
+
+            /*
+             * If getOperand() returns an Array rather than a string, then the first element is the original
+             * operand, and the second element contains additional information (eg, the target) of the operand.
+             */
+            if (typeof sOperand != "string") {
+                sTarget = sOperand[1];
+                sOperand = sOperand[0];
+            }
+
+            if (sOperands.length > 0) sOperands += ',';
+            sOperands += (sOperand || "???");
+        }
+
+        var sOpCodes = "";
+        var sLine = this.toStrAddr(dbgAddrOp) + ":";
+        if (dbgAddrOp.addr !== PDP11.ADDR_INVALID && dbgAddr.addr !== PDP11.ADDR_INVALID) {
+            do {
+                sOpCodes += ' ' + this.toStrBase(this.getWord(dbgAddrOp, 2));
+                if (dbgAddrOp.addr == null) break;
+            } while (dbgAddrOp.addr != dbgAddr.addr);
+        }
+
+        sLine += Str.pad(sOpCodes, 24);
+        sLine += Str.pad(sOpName, 5);
+        if (sOperands) sLine += ' ' + sOperands;
+
+        if (sComment || sTarget) {
+            sLine = Str.pad(sLine, 60) + ';' + (sComment || "");
+            if (!this.cpu.flags.checksum) {
+                sLine += (nSequence != null? '=' + nSequence.toString() : "");
+            } else {
+                var nCycles = this.cpu.getCycles();
+                sLine += "cycles=" + nCycles.toString() + " cs=" + Str.toHex(this.cpu.nChecksum);
+            }
+            if (sTarget) {
+                if (sLine.slice(-1) != ';') sLine += ' ';
+                sLine += sTarget;
+            }
+        }
+        return sLine;
+    }
+
+    /**
+     * getOperand(opCode, opType, dbgAddr)
+     *
+     * If getOperand() returns an Array rather than a string, then the first element is the original
+     * operand, and the second element is a comment containing additional information (eg, the target)
+     * of the operand.
+     *
+     * @this {DebuggerPDP11}
+     * @param {number} opCode
+     * @param {number} opType
+     * @param {DbgAddrPDP11} dbgAddr
+     * @return {string|Array.<string>}
+     */
+    getOperand(opCode, opType, dbgAddr)
+    {
+        var sOperand = "", disp, addr;
+        /*
+         * Take care of OP_OTHER opcodes first; then all we'll have to worry about
+         * next are OP_SRC or OP_DST opcodes.
+         */
+        var opTypeOther = opType & DebuggerPDP11.OP_OTHER;
+        if (opTypeOther == DebuggerPDP11.OP_BRANCH) {
+            disp = ((opCode & 0xff) << 24) >> 23;
+            addr = (dbgAddr.addr + disp) & 0xffff;
+            sOperand = this.toStrBase(addr);
+        }
+        else if (opTypeOther == DebuggerPDP11.OP_DSTOFF) {
+            disp = (opCode & 0x3f) << 1;
+            addr = (dbgAddr.addr - disp) & 0xffff;
+            sOperand = this.toStrBase(addr);
+        }
+        else if (opTypeOther == DebuggerPDP11.OP_DSTNUM3) {
+            disp = (opCode & 0x07);
+            sOperand = this.toStrBase(disp, 3);
+        }
+        else if (opTypeOther == DebuggerPDP11.OP_DSTNUM6) {
+            disp = (opCode & 0x3f);
+            sOperand = this.toStrBase(disp, 6);
+        }
+        else if (opTypeOther == DebuggerPDP11.OP_DSTNUM8) {
+            disp = (opCode & 0xff);
+            sOperand = this.toStrBase(disp, 8);
+        }
+        else {
+            /*
+             * Isolate all OP_SRC or OP_DST bits from opcode in the opMode variable.
+             */
+            var opMode = opCode & opType;
+
+            /*
+             * Convert OP_SRC bits into OP_DST bits, since they use the same format.
+             */
+            if (opType & DebuggerPDP11.OP_SRC) {
+                opMode >>= 6;
+                opType >>= 6;
+            }
+            if (opType & DebuggerPDP11.OP_DST) {
+                var wIndex;
+                var sTarget = null;
+                var reg = opMode & DebuggerPDP11.OP_DSTREG;
+                /*
+                 * Note that opcodes that specify only REG bits in the opType mask (ie, no MOD bits)
+                 * will automatically default to OPMODE_REG below.
+                 */
+                switch((opMode & DebuggerPDP11.OP_DSTMODE)) {
+
+                case PDP11.OPMODE.REG:                  // 0x0: REGISTER
+                    sOperand = this.getRegName(reg);
+                    break;
+
+                case PDP11.OPMODE.REGD:                 // 0x1: REGISTER DEFERRED
+                    sOperand = '@' + this.getRegName(reg);
+                    sTarget = this.getTarget(this.cpu.regsGen[reg]);
+                    break;
+
+                case PDP11.OPMODE.POSTINC:              // 0x2: POST-INCREMENT
+                    if (reg < 7) {
+                        sOperand = '(' + this.getRegName(reg) + ")+";
+                    } else {
+                        /*
+                         * When using R7 (aka PC), POST-INCREMENT is known as IMMEDIATE
+                         */
+                        wIndex = this.getWord(dbgAddr, 2);
+                        sOperand = '#' + this.toStrBase(wIndex, -1);
+                    }
+                    break;
+
+                case PDP11.OPMODE.POSTINCD:             // 0x3: POST-INCREMENT DEFERRED
+                    if (reg < 7) {
+                        sOperand = "@(" + this.getRegName(reg) + ")+";
+                    } else {
+                        /*
+                         * When using R7 (aka PC), POST-INCREMENT DEFERRED is known as ABSOLUTE
+                         */
+                        wIndex = this.getWord(dbgAddr, 2);
+                        sOperand = "@#" + this.toStrBase(wIndex, -1);
+                        sTarget = this.getTarget(wIndex);
+                    }
+                    break;
+
+                case PDP11.OPMODE.PREDEC:               // 0x4: PRE-DECREMENT
+                    sOperand = "-(" + this.getRegName(reg) + ")";
+                    break;
+
+                case PDP11.OPMODE.PREDECD:              // 0x5: PRE-DECREMENT DEFERRED
+                    sOperand = "@-(" + this.getRegName(reg) + ")";
+                    break;
+
+                case PDP11.OPMODE.INDEX:                // 0x6: INDEX
+                    wIndex = this.getWord(dbgAddr, 2);
+                    sOperand = this.toStrBase(wIndex, -1) + '(' + this.getRegName(reg) + ')';
+                    if (reg == 7) {
+                        /*
+                         * When using R7 (aka PC), INDEX is known as RELATIVE.  However, instead of displaying
+                         * such an instruction like this:
+                         *
+                         *  016156: 010167 001300          MOV   R1,1300(PC)            ; @017462
+                         *
+                         * with the effective address display to the far right, let's display it like this instead:
+                         *
+                         *  016156: 010167 001300          MOV   R1,017462
+                         *
+                         * because you can still clearly see PC-relative offset (eg, 001300) as part of the disassembly.
+                         *
+                         *      sOperand = [sOperand, this.toStrBase((wIndex + dbgAddr.addr) & 0xffff)];
+                         */
+                        sOperand = this.toStrBase(wIndex = (wIndex + dbgAddr.addr) & 0xffff);
+                        sTarget = this.getTarget(wIndex);
+                    }
+                    break;
+
+                case PDP11.OPMODE.INDEXD:               // 0x7: INDEX DEFERRED
+                    wIndex = this.getWord(dbgAddr, 2);
+                    sOperand = '@' + this.toStrBase(wIndex) + '(' + this.getRegName(reg) + ')';
+                    if (reg == 7) {
+                        /*
+                         * When using R7 (aka PC), INDEX DEFERRED is known as RELATIVE DEFERRED.  And for the same
+                         * reasons articulated above, we now display the effective address inline.
+                         *
+                         *      sOperand = [sOperand, this.toStrBase((wIndex + dbgAddr.addr) & 0xffff)];
+                         */
+                        sOperand = '@' + this.toStrBase(wIndex = (wIndex + dbgAddr.addr) & 0xffff);
+                        sTarget = this.getTarget(this.cpu.getWordSafe(wIndex));
+                    }
+                    break;
+
+                default:
+
+                    break;
+                }
+
+                if (sTarget) sOperand = [sOperand, sTarget];
+            }
+            else {
+
+            }
+        }
+        return sOperand;
+    }
+
+    /**
+     * getTarget(addr)
+     *
+     * @this {DebuggerPDP11}
+     * @param {number} addr
+     * @return {string|null}
+     */
+    getTarget(addr)
+    {
+        var sTarget = null;
+        var a = this.cpu.getAddrInfo(addr);
+        var addrPhysical = a[0];
+        if (addrPhysical >= this.cpu.addrIOPage && addrPhysical < this.bus.addrIOPage) {
+            addrPhysical = (addrPhysical - this.cpu.addrIOPage) + this.bus.addrIOPage;
+        }
+        return this.bus.getAddrInfo(addrPhysical);
+    }
+
+    /**
+     * parseInstruction(sOp, sOperand, addr)
+     *
+     * TODO: Unimplemented.  See parseInstruction() in modules/c1pjs/lib/debugger.js for a sample implementation.
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} sOp
+     * @param {string|undefined} sOperand
+     * @param {DbgAddrPDP11} dbgAddr of memory where this instruction is being assembled
+     * @return {Array.<number>} of opcode bytes; if the instruction can't be parsed, the array will be empty
+     */
+    parseInstruction(sOp, sOperand, dbgAddr)
+    {
+        var aOpBytes = [];
+        this.println("not supported yet");
+        return aOpBytes;
+    }
+
+    /**
+     * getFlagOutput(sFlag)
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} sFlag
+     * @return {string} value of flag
+     */
+    getFlagOutput(sFlag)
+    {
+        var b;
+        switch (sFlag) {
+        case 'N':
+            b = this.cpu.getNF();
+            break;
+        case 'Z':
+            b = this.cpu.getZF();
+            break;
+        case 'V':
+            b = this.cpu.getVF();
+            break;
+        case 'C':
+            b = this.cpu.getCF();
+            break;
+        default:
+            b = 0;
+            break;
+        }
+        return sFlag.charAt(0) + (b? '1' : '0') + ' ';
+    }
+
+    /**
+     * getRegOutput(iReg)
+     *
+     * @this {DebuggerPDP11}
+     * @param {number} iReg
+     * @return {string}
+     */
+    getRegOutput(iReg)
+    {
+        var sReg = this.getRegName(iReg);
+        if (sReg) {
+            sReg += '=' + this.toStrBase(this.getRegValue(iReg)) + ' ';
+        }
+        return sReg;
+    }
+
+    /**
+     * getMiscDump()
+     *
+     * Sample register dump:
+     *
+     *      M0=xxxxxx M1=xxxxxx M2=xxxxxx M3=xxxxxx ER=xxxxxx
+     *
+     * @this {DebuggerPDP11}
+     * @return {string}
+     */
+    getMiscDump()
+    {
+        var sDump = "";
+        sDump += this.getRegOutput(DebuggerPDP11.REG_M0) + this.getRegOutput(DebuggerPDP11.REG_M1);
+        sDump += this.getRegOutput(DebuggerPDP11.REG_M2) + this.getRegOutput(DebuggerPDP11.REG_M3) + this.getRegOutput(DebuggerPDP11.REG_ER);
+        sDump += '\n';
+        sDump += this.getRegOutput(DebuggerPDP11.REG_SR) + this.getRegOutput(DebuggerPDP11.REG_AR) + this.getRegOutput(DebuggerPDP11.REG_DR);
+        return sDump;
+    }
+
+    /**
+     * getRegDump(fMisc)
+     *
+     * Sample register dump:
+     *
+     *      R0=xxxxxx R1=xxxxxx R2=xxxxxx R3=xxxxxx R4=xxxxxx R5=xxxxxx
+     *      SP=xxxxxx PC=xxxxxx PS=xxxxxx PI=xxxxxx SL=xxxxxx T0 N0 Z0 V0 C0
+     *
+     * @this {DebuggerPDP11}
+     * @param {boolean} [fMisc] (true to include misc registers)
+     * @return {string}
+     */
+    getRegDump(fMisc)
+    {
+        var i;
+        var sDump = "";
+        for (i = 0; i < PDP11.REG.SP; i++) {
+            sDump += this.getRegOutput(i);
+        }
+        sDump += '\n';
+        sDump += this.getRegOutput(PDP11.REG.SP) + this.getRegOutput(PDP11.REG.PC);
+        sDump += this.getRegOutput(DebuggerPDP11.REG_PS) + this.getRegOutput(DebuggerPDP11.REG_PI) + this.getRegOutput(DebuggerPDP11.REG_SL);
+        sDump += this.getFlagOutput('T') + this.getFlagOutput('N') + this.getFlagOutput('Z') + this.getFlagOutput('V') + this.getFlagOutput('C');
+        if (fMisc) sDump += '\n' + this.getMiscDump();
+        return sDump;
+    }
+
+    /**
+     * comparePairs(p1, p2)
+     *
+     * @this {DebuggerPDP11}
+     * @param {number|string|Array|Object} p1
+     * @param {number|string|Array|Object} p2
+     * @return {number}
+     */
+    comparePairs(p1, p2)
+    {
+        return p1[0] > p2[0]? 1 : p1[0] < p2[0]? -1 : 0;
+    }
+
+    /**
+     * addSymbols(sModule, addr, len, aSymbols)
+     *
+     * As filedump.js (formerly convrom.php) explains, aSymbols is a JSON-encoded object whose properties consist
+     * of all the symbols (in upper-case), and the values of those properties are objects containing any or all of
+     * the following properties:
+     *
+     *      'v': the value of an absolute (unsized) value
+     *      'b': either 1, 2, 4 or undefined if an unsized value
+     *      's': either a hard-coded segment or undefined
+     *      'o': the offset of the symbol within the associated address space
+     *      'l': the original-case version of the symbol, present only if it wasn't originally upper-case
+     *      'a': annotation for the specified offset; eg, the original assembly language, with optional comment
+     *
+     * To that list of properties, we also add:
+     *
+     *      'p': the physical address (calculated whenever both 's' and 'o' properties are defined)
+     *
+     * Note that values for any 'v', 'b', 's' and 'o' properties are unquoted decimal values, and the values
+     * for any 'l' or 'a' properties are quoted strings. Also, if double-quotes were used in any of the original
+     * annotation ('a') values, they will have been converted to two single-quotes, so we're responsible for
+     * converting them back to individual double-quotes.
+     *
+     * For example:
+     *      {
+     *          'HF_PORT': {
+     *              'v':800
+     *          },
+     *          'HDISK_INT': {
+     *              'b':4, 's':0, 'o':52
+     *          },
+     *          'ORG_VECTOR': {
+     *              'b':4, 's':0, 'o':76
+     *          },
+     *          'CMD_BLOCK': {
+     *              'b':1, 's':64, 'o':66
+     *          },
+     *          'DISK_SETUP': {
+     *              'o':3
+     *          },
+     *          '.40': {
+     *              'o':40, 'a':"MOV AX,WORD PTR ORG_VECTOR ;GET DISKETTE VECTOR"
+     *          }
+     *      }
+     *
+     * If a symbol only has an offset, then that offset value can be assigned to the symbol property directly:
+     *
+     *          'DISK_SETUP': 3
+     *
+     * The last property is an example of an "anonymous" entry, for offsets where there is no associated symbol.
+     * Such entries are identified by a period followed by a unique number (usually the offset of the entry), and
+     * they usually only contain offset ('o') and annotation ('a') properties.  I could eliminate the leading
+     * period, but it offers a very convenient way of quickly discriminating among genuine vs. anonymous symbols.
+     *
+     * We add all these entries to our internal symbol table, which is an array of 4-element arrays, each of which
+     * look like:
+     *
+     *      [addr, len, aSymbols, aOffsets]
+     *
+     * There are two basic symbol operations: findSymbol(), which takes an address and finds the symbol, if any,
+     * at that address, and findSymbolAddr(), which takes a string and attempts to match it to a non-anonymous
+     * symbol with a matching offset ('o') property.
+     *
+     * To implement findSymbol() efficiently, addSymbols() creates an array of [offset, sSymbol] pairs
+     * (aOffsets), one pair for each symbol that corresponds to an offset within the specified address space.
+     *
+     * We guarantee the elements of aOffsets are in offset order, because we build it using binaryInsert();
+     * it's quite likely that the MAP file already ordered all its symbols in offset order, but since they're
+     * hand-edited files, we can't assume that, and we need to ensure that findSymbol()'s binarySearch() operates
+     * properly.
+     *
+     * @this {DebuggerPDP11}
+     * @param {string|null} sModule
+     * @param {number|null} addr (physical address where the symbols are located, if the memory is physical; eg, ROM)
+     * @param {number} len (the size of the region, in bytes)
+     * @param {Object} aSymbols (collection of symbols in this group; the format of this collection is described below)
+     */
+    addSymbols(sModule, addr, len, aSymbols)
+    {
+        var dbgAddr = {};
+        var aOffsets = [];
+        for (var sSymbol in aSymbols) {
+            var symbol = aSymbols[sSymbol];
+            if (typeof symbol == "number") {
+                aSymbols[sSymbol] = symbol = {'o': symbol};
+            }
+            var offSymbol = symbol['o'];
+            var sAnnotation = symbol['a'];
+            if (offSymbol !== undefined) {
+                Usr.binaryInsert(aOffsets, [offSymbol >>> 0, sSymbol], this.comparePairs);
+            }
+            if (sAnnotation) symbol['a'] = sAnnotation.replace(/''/g, "\"");
+        }
+        var symbolTable = {
+            sModule: sModule,
+            addr: addr,
+            len: len,
+            aSymbols: aSymbols,
+            aOffsets: aOffsets
+        };
+        this.aSymbolTable.push(symbolTable);
+    }
+
+    /**
+     * dumpSymbols()
+     *
+     * TODO: Add "numerical" and "alphabetical" dump options. This is simply dumping them in whatever
+     * order they appeared in the original MAP file.
+     *
+     * @this {DebuggerPDP11}
+     */
+    dumpSymbols()
+    {
+        for (var iTable = 0; iTable < this.aSymbolTable.length; iTable++) {
+            var symbolTable = this.aSymbolTable[iTable];
+            for (var sSymbol in symbolTable.aSymbols) {
+                if (sSymbol.charAt(0) == '.') continue;
+                var symbol = symbolTable.aSymbols[sSymbol];
+                var offSymbol = symbol['o'];
+                if (offSymbol === undefined) continue;
+                var sSymbolOrig = symbolTable.aSymbols[sSymbol]['l'];
+                if (sSymbolOrig) sSymbol = sSymbolOrig;
+                this.println(this.toStrOffset(offSymbol) + ' ' + sSymbol);
+            }
+        }
+    }
+
+    /**
+     * findSymbol(dbgAddr, fNearest)
+     *
+     * Search aSymbolTable for dbgAddr, and return an Array for the corresponding symbol (empty if not found).
+     *
+     * If fNearest is true, and no exact match was found, then the Array returned will contain TWO sets of
+     * entries: [0]-[3] will refer to closest preceding symbol, and [4]-[7] will refer to the closest subsequent symbol.
+     *
+     * @this {DebuggerPDP11}
+     * @param {DbgAddrPDP11} dbgAddr
+     * @param {boolean} [fNearest]
+     * @return {Array} where [0] == symbol name, [1] == symbol value, [2] == any annotation, and [3] == any associated comment
+     */
+    findSymbol(dbgAddr, fNearest)
+    {
+        var aSymbol = [];
+        var addrSymbol = this.getAddr(dbgAddr) >>> 0;
+        for (var iTable = 0; iTable < this.aSymbolTable.length; iTable++) {
+            var symbolTable = this.aSymbolTable[iTable];
+            var addr = symbolTable.addr >>> 0;
+            var len = symbolTable.len;
+            if (addrSymbol >= addr && addrSymbol < addr + len) {
+                var offSymbol = addrSymbol - addr;
+                var result = Usr.binarySearch(symbolTable.aOffsets, [offSymbol], this.comparePairs);
+                if (result >= 0) {
+                    this.returnSymbol(iTable, result, aSymbol);
+                }
+                else if (fNearest) {
+                    result = ~result;
+                    this.returnSymbol(iTable, result-1, aSymbol);
+                    this.returnSymbol(iTable, result, aSymbol);
+                }
+                break;
+            }
+        }
+        return aSymbol;
+    }
+
+    /**
+     * findSymbolAddr(sSymbol)
+     *
+     * Search our symbol tables for sSymbol, and if found, return a dbgAddr (same as parseAddr()).
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} sSymbol
+     * @return {DbgAddrPDP11|undefined}
+     */
+    findSymbolAddr(sSymbol)
+    {
+        var dbgAddr;
+        var offSymbol = this.bus.getAddrByName(sSymbol);
+
+        if (offSymbol == null && sSymbol.match(/^[a-z_][a-z0-9_]*$/i)) {
+            var sUpperCase = sSymbol.toUpperCase();
+            for (var iTable = 0; iTable < this.aSymbolTable.length; iTable++) {
+                var symbolTable = this.aSymbolTable[iTable];
+                var symbol = symbolTable.aSymbols[sUpperCase];
+                if (symbol != null) {
+                    offSymbol = symbol['o'];
+                    /*
+                     * If the symbol matched but there's no 'o' offset (ie, it wasn't for an address), there's
+                     * no point looking any farther, since each symbol appears only once.
+                     *
+                     * NOTE: We assume that every ROM is ORG'ed at 0x0000, and therefore unless the symbol has an
+                     * explicitly-defined segment, we return the segment associated with the entire group; for a ROM,
+                     * that segment is normally "addrROM >>> 4".  Down the road, we may want/need to support a special
+                     * symbol entry (eg, ".ORG") that defines an alternate origin.
+                     */
+                    break;
+                }
+            }
+        }
+        if (offSymbol != null) {
+            dbgAddr = this.newAddr(offSymbol);
+        }
+        return dbgAddr;
+    }
+
+    /**
+     * returnSymbol(iTable, iOffset, aSymbol)
+     *
+     * Helper function for findSymbol().
+     *
+     * @param {number} iTable
+     * @param {number} iOffset
+     * @param {Array} aSymbol is updated with the specified symbol, if it exists
+     */
+    returnSymbol(iTable, iOffset, aSymbol)
+    {
+        var symbol = {};
+        var aOffsets = this.aSymbolTable[iTable].aOffsets;
+        var offset = 0, sSymbol = null;
+        if (iOffset >= 0 && iOffset < aOffsets.length) {
+            offset = aOffsets[iOffset][0];
+            sSymbol = aOffsets[iOffset][1];
+        }
+        if (sSymbol) {
+            symbol = this.aSymbolTable[iTable].aSymbols[sSymbol];
+            sSymbol = (sSymbol.charAt(0) == '.'? null : (symbol['l'] || sSymbol));
+        }
+        aSymbol.push(sSymbol);
+        aSymbol.push(offset);
+        aSymbol.push(symbol['a']);
+        aSymbol.push(symbol['c']);
+    }
+
+    /**
+     * doHelp()
+     *
+     * @this {DebuggerPDP11}
+     */
+    doHelp()
+    {
+        var s = "commands:";
+        for (var sCommand in DebuggerPDP11.COMMANDS) {
+            s += '\n' + Str.pad(sCommand, 9) + DebuggerPDP11.COMMANDS[sCommand];
+        }
+        if (!this.checksEnabled()) s += "\nnote: history disabled if no exec breakpoints";
+        this.println(s);
+    }
+
+    /**
+     * doAssemble(asArgs)
+     *
+     * This always receives the complete argument array, where the order of the arguments is:
+     *
+     *      [0]: the assemble command (assumed to be "a")
+     *      [1]: the target address (eg, "200")
+     *      [2]: the operation code, aka instruction name (eg, "adc")
+     *      [3]: the operation mode operand, if any (eg, "14", "[1234]", etc)
+     *
+     * The Debugger enters "assemble mode" whenever only the first (or first and second) arguments are present.
+     * As long as "assemble mode is active, the user can omit the first two arguments on all later assemble commands
+     * until "assemble mode" is cancelled with an empty command line; the command processor automatically prepends "a"
+     * and the next available target address to the argument array.
+     *
+     * Entering "assemble mode" is optional; one could enter a series of fully-qualified assemble commands; eg:
+     *
+     *      a ff00 cld
+     *      a ff01 ldx 28
+     *      ...
+     *
+     * without ever entering "assemble mode", but of course, that requires more typing and doesn't take advantage
+     * of automatic target address advancement (see dbgAddrAssemble).
+     *
+     * NOTE: As the previous example implies, you can even assemble new instructions into ROM address space;
+     * as our setByte() function explains, the ROM write-notification handlers only refuse writes from the CPU.
+     *
+     * @this {DebuggerPDP11}
+     * @param {Array.<string>} asArgs is the complete argument array, beginning with the "a" command in asArgs[0]
+     */
+    doAssemble(asArgs)
+    {
+        var dbgAddr = this.parseAddr(asArgs[1], true);
+        if (!dbgAddr) return;
+
+        this.dbgAddrAssemble = dbgAddr;
+        if (asArgs[2] === undefined) {
+            this.println("begin assemble at " + this.toStrAddr(dbgAddr));
+            this.fAssemble = true;
+            this.cmp.updateDisplays();
+            return;
+        }
+
+        var aOpBytes = this.parseInstruction(asArgs[2], asArgs[3], dbgAddr);
+        if (aOpBytes.length) {
+            for (var i = 0; i < aOpBytes.length; i++) {
+                this.setByte(dbgAddr, aOpBytes[i], 1);
+            }
+            /*
+             * Since getInstruction() also updates the specified address, dbgAddrAssemble is automatically advanced.
+             */
+            this.println(this.getInstruction(this.dbgAddrAssemble));
+        }
+    }
+
+    /**
+     * doBreak(sCmd, sAddr, sOptions)
+     *
+     * As the "help" output below indicates, the following breakpoint commands are supported:
+     *
+     *      bp #    set exec breakpoint
+     *      br #    set read breakpoint
+     *      bw #    set write breakpoint
+     *      bc #    clear breakpoint (* to clear all)
+     *      bl      list all breakpoints
+     *      bn [#]  break after # instruction(s)
+     *
+     * The "bn" command, like the "dh" command and all other commands that use an instruction count,
+     * assumes a decimal value, regardless of the current base.  Use "bn" without an argument to display
+     * the break count, and use "bn 0" to clear the break count.
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} sCmd
+     * @param {string|undefined} [sAddr]
+     * @param {string} [sOptions] (the rest of the breakpoint command-line)
+     */
+    doBreak(sCmd, sAddr, sOptions)
+    {
+        if (sAddr == '?') {
+            this.println("breakpoint commands:");
+            this.println("\tbp #\tset exec breakpoint");
+            this.println("\tbr #\tset read breakpoint");
+            this.println("\tbw #\tset write breakpoint");
+            this.println("\tbc #\tclear breakpoint (* to clear all)");
+            this.println("\tbl\tlist all breakpoints");
+            this.println("\tbn [#]\tbreak after # instruction(s)");
+            return;
+        }
+
+        var sParm = sCmd.charAt(1);
+        if (sParm == 'l') {
+            var cBreaks = 0;
+            cBreaks += this.listBreakpoints(this.aBreakExec);
+            cBreaks += this.listBreakpoints(this.aBreakRead);
+            cBreaks += this.listBreakpoints(this.aBreakWrite);
+            if (!cBreaks) this.println("no breakpoints");
+            return;
+        }
+
+        if (sParm == 'n') {
+            var n = +sAddr || 0;
+            if (sAddr) this.nBreakInstructions = n;
+            this.println("break after " + n + " instruction(s)");
+            return;
+        }
+
+        if (sAddr === undefined) {
+            this.println("missing breakpoint address");
+            return;
+        }
+
+        var dbgAddr = this.newAddr();
+        if (sAddr != '*') {
+            dbgAddr = this.parseAddr(sAddr, true, true);
+            if (!dbgAddr) return;
+        }
+
+        if (sParm == 'c') {
+            if (dbgAddr.addr == null) {
+                this.clearBreakpoints();
+                this.println("all breakpoints cleared");
+                return;
+            }
+            if (this.findBreakpoint(this.aBreakExec, dbgAddr, true))
+                return;
+            if (this.findBreakpoint(this.aBreakRead, dbgAddr, true))
+                return;
+            if (this.findBreakpoint(this.aBreakWrite, dbgAddr, true))
+                return;
+            this.println("breakpoint missing: " + this.toStrAddr(dbgAddr));
+            return;
+        }
+
+        if (dbgAddr.addr == null) return;
+
+        this.parseAddrOptions(dbgAddr, sOptions);
+
+        if (sParm == 'p') {
+            this.addBreakpoint(this.aBreakExec, dbgAddr);
+            return;
+        }
+        if (sParm == 'r') {
+            this.addBreakpoint(this.aBreakRead, dbgAddr);
+            return;
+        }
+        if (sParm == 'w') {
+            this.addBreakpoint(this.aBreakWrite, dbgAddr);
+            return;
+        }
+        this.println("unknown breakpoint command: " + sParm);
+    }
+
+    /**
+     * doClear(sCmd)
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} [sCmd] (eg, "cls" or "clear")
+     */
+    doClear(sCmd)
+    {
+        /*
+         * TODO: There should be a clear() component method that the Control Panel overrides to perform this function.
+         */
+        if (this.controlPrint) this.controlPrint.value = "";
+    }
+
+    /**
+     * doDump(asArgs)
+     *
+     * The length parameter is interpreted as a number of bytes (or words, or dwords) to dump,
+     * and it is interpreted using the current base.
+     *
+     * @this {DebuggerPDP11}
+     * @param {Array.<string>} asArgs (formerly sCmd, [sAddr], [sLen] and [sBytes])
+     */
+    doDump(asArgs)
+    {
+        var m;
+        var sCmd = asArgs[0];
+        var sAddr = asArgs[1];
+        var sLen = asArgs[2];
+        var sBytes = asArgs[3];
+
+        if (sAddr == '?') {
+            var sDumpers = "";
+            for (m in MessagesPDP11.CATEGORIES) {
+                if (this.afnDumpers[m]) {
+                    if (sDumpers) sDumpers += ',';
+                    sDumpers = sDumpers + m;
+                }
+            }
+            sDumpers += ",state,symbols";
+            this.println("dump memory commands:");
+            this.println("\tda [a]        dump info for address a");
+            this.println("\tdb [a] [n]    dump n bytes at address a");
+            this.println("\tdw [a] [n]    dump n words at address a");
+            this.println("\tdd [a] [n]    dump n dwords at address a");
+            this.println("\tds [a] [n]    dump n words at address a as JSON");
+            this.println("\tdh [p] [n]    dump n instructions from history position p");
+            if (sDumpers.length) this.println("dump extension commands:\n\t" + sDumpers);
+            return;
+        }
+
+        if (sAddr == "state") {
+            var sState = this.cmp.powerOff(true);
+            if (sLen == "console") {
+                /*
+                 * Console buffers are notoriously small, and even the following code, which breaks the
+                 * data into parts (eg, "d state console 1", "d state console 2", etc) just isn't that helpful.
+                 *
+                 *      var nPart = +sBytes;
+                 *      if (nPart) sState = sState.substr(1000000 * (nPart-1), 1000000);
+                 *
+                 * So, the best way to capture a large machine state is to use the new "Save Machine" link
+                 * that downloads a machine's entire state.  Alternatively, run your own local server and use
+                 * server-side storage.  Take a look at the "Save" binding in computer.js, which binds an HTML
+                 * control to the computer.powerOff() and computer.saveServerState() functions.
+                 */
+                console.log(sState);
+            } else {
+                this.doClear();
+                if (sState) this.println(sState);
+            }
+            return;
+        }
+
+        if (sAddr == "symbols") {
+            this.dumpSymbols();
+            return;
+        }
+
+        if (sCmd == "d") {
+            for (m in MessagesPDP11.CATEGORIES) {
+                if (asArgs[1] == m) {
+                    var fnDumper = this.afnDumpers[m];
+                    if (fnDumper) {
+                        asArgs.shift();
+                        asArgs.shift();
+                        fnDumper(asArgs);
+                    } else {
+                        this.println("no dump registered for " + sAddr);
+                    }
+                    return;
+                }
+            }
+            if (!sAddr) sCmd = this.sCmdDumpPrev || "dw";
+        } else {
+            this.sCmdDumpPrev = sCmd;
+        }
+
+        if (sCmd == "dh") {
+            this.dumpHistory(sAddr, sLen);
+            return;
+        }
+
+        var dbgAddr = this.parseAddr(sAddr);
+        if (!dbgAddr) return;
+
+        if (sCmd == "da") {
+            /*
+             * Sample output for a virtual address ("da 23042"):
+             *
+             *                      00,010,011,000,100,010  00023042
+             *       OFFSET:             0,011,000,100,010  00003042
+             *   +   KIPAR1: 0,000,001,101,111,010,000,000  00157200
+             *   &  MMUMASK: 1,111,111,111,111,111,111,111  17777777
+             *   = PHYSICAL: 0,000,001,110,010,010,100,010  00162242
+             *
+             * and sample output for a physical address (eg, "da %37772"; note the % prefix):
+             *
+             *               0,000,000,011,111,111,111,010  00037772
+             *       OFFSET:             1,111,111,111,010  00017772
+             *   UNIMAP[01]: 1,111,100,001,110,111,000,000  17416700
+             *     PHYSICAL: 1,111,100,011,110,110,111,010  17436672
+             *
+             * TODO: Tweak this output to accommodate 18-bit machines as well as 22-bit machines.
+             */
+            var fPhysical = (dbgAddr.fPhysical || dbgAddr.addr > 0xffff);
+            var a = this.cpu.getAddrInfo(dbgAddr.addr || 0, fPhysical);
+            this.println(Str.pad("", fPhysical? 12: 19) + Str.toBin(dbgAddr.addr, fPhysical? 22 : 17, 3) + "  " + Str.toOct(dbgAddr.addr, 8));
+            if (a.length < 6) {
+                if (a.length > 2) {
+                    this.println("    OFFSET:             " + Str.toBin(a[3], 13, 3) + "  " + Str.toOct(a[3], 8));
+                    this.println("UNIMAP[" + Str.toDec(a[1], 2) + "]: " + Str.toBin(a[2], 22, 3) + "  " + Str.toOct(a[2], 8));
+                }
+                this.println("  PHYSICAL: " + Str.toBin(a[0], 22, 3) + "  " + Str.toOct(a[0], 8))
+            } else {
+                this.println("    OFFSET:             " + Str.toBin(a[1], 13, 3) + "  " + Str.toOct(a[1], 8));
+                this.println("+   " + DebuggerPDP11.MODES[a[2]] + "PAR" + a[3] + ": " + Str.toBin(a[4], 22, 3) + "  " + Str.toOct(a[4], 8));
+                this.println("&  MMUMASK: " + Str.toBin(a[5], 22, 3) + "  " + Str.toOct(a[5], 8));
+                this.println("= PHYSICAL: " + Str.toBin(a[0], 22, 3) + "  " + Str.toOct(a[0], 8))
+            }
+            return;
+        }
+
+        var len = 0;
+        var fJSON = (sCmd == "ds");
+
+        if (sLen) {
+            if (sLen.charAt(0) == 'l') {
+                sLen = sLen.substr(1) || sBytes;
+                len = this.parseValue(sLen);
+            }
+            else {
+                var dbgAddrEnd = this.parseAddr(sLen);
+                if (dbgAddrEnd) len = dbgAddrEnd.addr - dbgAddr.addr;
+            }
+            if (len < 0) len = 0;
+            if (len > 0x10000) len = 0x10000;
+        }
+
+        var nBase = this.nBase;
+        if (dbgAddr.nBase) this.nBase = dbgAddr.nBase;
+
+        /*
+         * I've changed the code below to effectively make "dw" the default if only "d" is specified,
+         * since this is primarily a word-oriented machine.
+         */
+        var size = (sCmd == "dd"? 4 : (sCmd == "db"? 1 : 2));
+        var nBytes = (size * len) || 128;
+        var nBytesPerLine = fJSON? 16 : this.nBase;
+        var nLines = (((nBytes + nBytesPerLine - 1) / nBytesPerLine)|0) || 1;
+
+        var sDump = "";
+        while (nLines-- && nBytes > 0) {
+            var sData = "", sChars = "";
+            sAddr = this.toStrAddr(dbgAddr);
+            /*
+             * Dump 8 bytes per line when using base 8, and dump 16 bytes when using base 16.
+             *
+             * And while we used to always call getByte() and assemble them into words or dwords as appropriate, I've
+             * changed the logic below to honor "dw" by calling getWord(), since the Bus interfaces have been updated
+             * to prevent generating traps due to to Debugger access of unaligned memory and/or undefined IOPAGE addresses.
+             *
+             * Besides, it's nice for "db" and "dw" to generate the same Bus activity that typical byte and word reads do.
+             */
+            var i = nBytesPerLine;
+            var data = 0, shift = 0;
+            while (i > 0 && nBytes > 0) {
+                var n = 1;
+                var v = size == 1? this.getByte(dbgAddr, n) : this.getWord(dbgAddr, (n = 2));
+                data |= (v << (shift << 3));
+                shift += n;
+                if (shift == size) {
+                    if (fJSON) {
+                        if (sData) sData += ",";
+                        sData += "0x"+ Str.toHex(data, size << 1);
+                    } else {
+                        sData += this.toStrBase(data, size << 3);
+                        sData += (size == 1? (i == 9? '-' : ' ') : "  ");
+                    }
+                    data = shift = 0;
+                }
+                i -= n; nBytes -= n;
+                while (size == 1 && n--) {
+                    var c = v & 0xff;
+                    sChars += (c >= 32 && c < 128? String.fromCharCode(c) : '.');
+                    v >>= 8;
+                }
+            }
+            if (sDump) sDump += "\n";
+            if (fJSON) {
+                sDump += sData + ",";
+            } else {
+                sDump += sAddr + ":  " + sData + ((i == 0)? (' ' + sChars) : "");
+            }
+        }
+
+        if (sDump) this.println(sDump);
+
+        this.dbgAddrNextData = dbgAddr;
+        this.nBase = nBase;
+    }
+
+    /**
+     * doEdit(asArgs)
+     *
+     * @this {DebuggerPDP11}
+     * @param {Array.<string>} asArgs
+     */
+    doEdit(asArgs)
+    {
+        var size, mask;
+        var fnGet, fnSet;
+        var sCmd = asArgs[0];
+        var sAddr = asArgs[1];
+        if (sCmd == "eb") {
+            size = 1;
+            mask = 0xff;
+            fnGet = this.getByte;
+            fnSet = this.setByte;
+        }
+        else if (sCmd == "e" || sCmd == "ew") {
+            size = 2;
+            mask = 0xffff;
+            fnGet = this.getWord;
+            fnSet = this.setWord;
+        } else {
+            sAddr = null;
+        }
+        if (sAddr == null) {
+            this.println("edit memory commands:");
+            this.println("\teb [a] [...]  edit bytes at address a");
+            this.println("\tew [a] [...]  edit words at address a");
+            return;
+        }
+        var dbgAddr = this.parseAddr(sAddr);
+        if (!dbgAddr) return;
+        for (var i = 2; i < asArgs.length; i++) {
+            var vNew = this.parseExpression(asArgs[i]);
+            if (vNew === undefined) {
+                this.println("unrecognized value: " + asArgs[i]);
+                break;
+            }
+            if (vNew & ~mask) {
+                this.println("warning: " + Str.toHex(vNew) + " exceeds " + size + "-byte value");
+            }
+            this.println("changing " + this.toStrAddr(dbgAddr) + (this.messageEnabled(MessagesPDP11.BUS)? "" : (" from " + this.toStrBase(fnGet.call(this, dbgAddr), size << 3))) + " to " + this.toStrBase(vNew, size << 3));
+            fnSet.call(this, dbgAddr, vNew, size);
+        }
+    }
+
+    /**
+     * doHalt(fQuiet)
+     *
+     * @this {DebuggerPDP11}
+     * @param {boolean} [fQuiet]
+     */
+    doHalt(fQuiet)
+    {
+        var sMsg;
+        if (this.flags.running) {
+            if (!fQuiet) this.println("halting");
+            this.stopCPU();
+        } else {
+            if (this.isBusy(true)) return;
+            if (!fQuiet) this.println("already halted");
+        }
+    }
+
+    /**
+     * doIf(sCmd, fQuiet)
+     *
+     * NOTE: Don't forget that the default base for all numeric constants is 16 (hex), so when you evaluate
+     * an expression like "a==10", it will compare the value of the variable "a" to 0x10; use a trailing period
+     * (eg, "10.") if you really intend decimal.
+     *
+     * Also, if no variable named "a" exists, "a" will evaluate to 0x0A, so the expression "a==10" becomes
+     * "0x0A==0x10" (false), whereas the expression "a==10." becomes "0x0A==0x0A" (true).
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} sCmd
+     * @param {boolean} [fQuiet]
+     * @return {boolean} true if expression is non-zero, false if zero (or undefined due to a parse error)
+     */
+    doIf(sCmd, fQuiet)
+    {
+        sCmd = Str.trim(sCmd);
+        if (!this.parseExpression(sCmd)) {
+            if (!fQuiet) this.println("false: " + sCmd);
+            return false;
+        }
+        if (!fQuiet) this.println("true: " + sCmd);
+        return true;
+    }
+
+    /**
+     * doInfo(asArgs)
+     *
+     * @this {DebuggerPDP11}
+     * @param {Array.<string>} asArgs
+     * @return {boolean} true only if the instruction info command ("n") is supported
+     */
+    doInfo(asArgs)
+    {
+        if (DEBUG) {
+            this.println("msPerYield: " + this.cpu.msPerYield);
+            this.println("nCyclesPerYield: " + this.cpu.nCyclesPerYield);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * doVar(sCmd)
+     *
+     * The command must be of the form "{variable} = [{expression}]", where expression may contain constants,
+     * operators, registers, symbols, other variables, or nothing at all; in the latter case, the variable, if
+     * any, is deleted.
+     *
+     * Other supported shorthand: "var" with no parameters prints the values of all variables, and "var {variable}"
+     * prints the value of the specified variable.
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} sCmd
+     * @return {boolean} true if valid "var" assignment, false if not
+     */
+    doVar(sCmd)
+    {
+        var a = sCmd.match(/^\s*([A-Z_]?[A-Z0-9_]*)\s*(=?)\s*(.*)$/i);
+        if (a) {
+            if (!a[1]) {
+                if (!this.printVariable()) this.println("no variables");
+                return true;    // it's not considered an error to print an empty list of variables
+            }
+            if (!a[2]) {
+                return this.printVariable(a[1]);
+            }
+            if (!a[3]) {
+                this.delVariable(a[1]);
+                return true;    // it's not considered an error to delete a variable that didn't exist
+            }
+            var v = this.parseExpression(a[3]);
+            if (v !== undefined) {
+                this.setVariable(a[1], v);
+                return true;
+            }
+            return false;
+        }
+        this.println("invalid assignment:" + sCmd);
+        return false;
+    }
+
+    /**
+     * doList(sAddr, fPrint)
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} sAddr
+     * @param {boolean} [fPrint]
+     * @return {string|null}
+     */
+    doList(sAddr, fPrint)
+    {
+        var sSymbol = null;
+
+        var dbgAddr = this.parseAddr(sAddr, true);
+        if (dbgAddr) {
+            var addr = this.getAddr(dbgAddr);
+            var aSymbol = this.findSymbol(dbgAddr, true);
+            if (aSymbol.length) {
+                var nDelta, sDelta, s;
+                if (aSymbol[0]) {
+                    sDelta = "";
+                    nDelta = dbgAddr.addr - aSymbol[1];
+                    if (nDelta) sDelta = " + " + Str.toHexWord(nDelta);
+                    s = aSymbol[0] + " (" + this.toStrOffset(aSymbol[1]) + ')' + sDelta;
+                    if (fPrint) this.println(s);
+                    sSymbol = s;
+                }
+                if (aSymbol.length > 4 && aSymbol[4]) {
+                    sDelta = "";
+                    nDelta = aSymbol[5] - dbgAddr.addr;
+                    if (nDelta) sDelta = " - " + Str.toHexWord(nDelta);
+                    s = aSymbol[4] + " (" + this.toStrOffset(aSymbol[5]) + ')' + sDelta;
+                    if (fPrint) this.println(s);
+                    if (!sSymbol) sSymbol = s;
+                }
+            } else {
+                if (fPrint) this.println("no symbols");
+            }
+        }
+        return sSymbol;
+    }
+
+    /**
+     * doMessages(asArgs)
+     *
+     * @this {DebuggerPDP11}
+     * @param {Array.<string>} asArgs
+     */
+    doMessages(asArgs)
+    {
+        var m;
+        var fCriteria = null;
+        var sCategory = asArgs[1];
+        if (sCategory == '?') sCategory = undefined;
+
+        if (sCategory !== undefined) {
+            var bitsMessage = 0;
+            if (sCategory == "all") {
+                bitsMessage = (0xffffffff|0) & ~(MessagesPDP11.HALT | MessagesPDP11.KEYS | MessagesPDP11.LOG);
+                sCategory = null;
+            } else if (sCategory == "on") {
+                fCriteria = true;
+                sCategory = null;
+            } else if (sCategory == "off") {
+                fCriteria = false;
+                sCategory = null;
+            } else {
+                /*
+                 * Internally, we use "key" instead of "keys", since the latter is a method on JavasScript objects,
+                 * but externally, we allow the user to specify "keys"; "kbd" is also allowed as shorthand for "keyboard".
+                 */
+                if (sCategory == "keys") sCategory = "key";
+                if (sCategory == "kbd") sCategory = "keyboard";
+                for (m in MessagesPDP11.CATEGORIES) {
+                    if (sCategory == m) {
+                        bitsMessage = MessagesPDP11.CATEGORIES[m];
+                        fCriteria = !!(this.bitsMessage & bitsMessage);
+                        break;
+                    }
+                }
+                if (!bitsMessage) {
+                    this.println("unknown message category: " + sCategory);
+                    return;
+                }
+            }
+            if (bitsMessage) {
+                if (asArgs[2] == "on") {
+                    this.bitsMessage |= bitsMessage;
+                    fCriteria = true;
+                }
+                else if (asArgs[2] == "off") {
+                    this.bitsMessage &= ~bitsMessage;
+                    fCriteria = false;
+                    if (bitsMessage == MessagesPDP11.BUFFER) {
+                        var i = this.aMessageBuffer.length >= 1000? this.aMessageBuffer.length - 1000 : 0;
+                        while (i < this.aMessageBuffer.length) {
+                            this.println(this.aMessageBuffer[i++]);
+                        }
+                        this.aMessageBuffer = [];
+                    }
+                }
+            }
+        }
+
+        /*
+         * Display those message categories that match the current criteria (on or off)
+         */
+        var n = 0;
+        var sCategories = "";
+        for (m in MessagesPDP11.CATEGORIES) {
+            if (!sCategory || sCategory == m) {
+                var bitMessage = MessagesPDP11.CATEGORIES[m];
+                var fEnabled = !!(this.bitsMessage & bitMessage);
+                if (fCriteria !== null && fCriteria != fEnabled) continue;
+                if (sCategories) sCategories += ',';
+                if (!(++n % 10)) sCategories += "\n\t";     // jshint ignore:line
+                /*
+                 * Internally, we use "key" instead of "keys", since the latter is a method on JavasScript objects,
+                 * but externally, we allow the user to specify "keys".
+                 */
+                if (m == "key") m = "keys";
+                sCategories += m;
+            }
+        }
+
+        if (sCategory === undefined) {
+            this.println("message commands:\n\tm [category] [on|off]\tturn categories on/off");
+        }
+
+        this.println((fCriteria !== null? (fCriteria? "messages on:  " : "messages off: ") : "message categories:\n\t") + (sCategories || "none"));
+
+        this.historyInit();     // call this just in case MessagesPDP11.INT was turned on
+    }
+
+    /**
+     * doOptions(asArgs)
+     *
+     * @this {DebuggerPDP11}
+     * @param {Array.<string>} asArgs
+     */
+    doOptions(asArgs)
+    {
+        switch (asArgs[1]) {
+
+        case "base":
+            if (asArgs[2]) {
+                var nBase = +asArgs[2];
+                if (nBase == 8 || nBase == 10 || nBase == 16) {
+                    this.nBase = nBase;
+                } else {
+                    this.println("invalid base: " + nBase);
+                    break;
+                }
+            }
+            this.println("default base: " + this.nBase);
+            break;
+
+        case "cs":
+            var nCycles;
+            if (asArgs[3] !== undefined) nCycles = +asArgs[3];          // warning: decimal instead of hex conversion
+            switch (asArgs[2]) {
+                case "int":
+                    this.cpu.nCyclesChecksumInterval = nCycles;
+                    break;
+                case "start":
+                    this.cpu.nCyclesChecksumStart = nCycles;
+                    break;
+                case "stop":
+                    this.cpu.nCyclesChecksumStop = nCycles;
+                    break;
+                default:
+                    this.println("unknown cs option");
+                    return;
+            }
+            if (nCycles !== undefined) {
+                this.cpu.resetChecksum();
+            }
+            this.println("checksums " + (this.cpu.flags.checksum? "enabled" : "disabled"));
+            return;
+
+        case "sp":
+            if (asArgs[2] !== undefined) {
+                if (!this.cpu.setSpeed(+asArgs[2])) {
+                    this.println("warning: using 1x multiplier, previous target not reached");
+                }
+            }
+            this.println("target speed: " + this.cpu.getSpeedTarget() + " (" + this.cpu.getSpeed() + "x)");
+            return;
+
+        default:
+            if (asArgs[1]) {
+                this.println("unknown option: " + asArgs[1]);
+                return;
+            }
+            /* falls through */
+
+        case "?":
+            this.println("debugger options:");
+            this.println("\tbase #\t\tset default base to #");
+            this.println("\tcs int #\tset checksum cycle interval to #");
+            this.println("\tcs start #\tset checksum cycle start count to #");
+            this.println("\tcs stop #\tset checksum cycle stop count to #");
+            this.println("\tsp #\t\tset speed multiplier to #");
+            break;
+        }
+    }
+
+    /**
+     * doRegisters(asArgs, fInstruction)
+     *
+     * @this {DebuggerPDP11}
+     * @param {Array.<string>} [asArgs]
+     * @param {boolean} [fInstruction] (true to include the current instruction; default is true)
+     */
+    doRegisters(asArgs, fInstruction)
+    {
+        if (asArgs && asArgs[1] == '?') {
+            this.println("register commands:");
+            this.println("\tr\tdump registers");
+            this.println("\trm\tdump misc registers");
+            this.println("\trx [#]\tset flag or register x to [#]");
+            return;
+        }
+
+        var fMisc = false;
+        var cpu = this.cpu;
+        if (fInstruction == null) fInstruction = true;
+
+        if (asArgs != null && asArgs.length > 1) {
+            var sReg = asArgs[1];
+
+            if (sReg == 'm') {
+                fMisc = true;
+            }
+            else {
+                var sValue = null;
+                var i = sReg.indexOf('=');
+                if (i > 0) {
+                    sValue = sReg.substr(i + 1);
+                    sReg = sReg.substr(0, i);
+                }
+                else if (asArgs.length > 2) {
+                    sValue = asArgs[2];
+                }
+                else {
+                    this.println("missing value for " + asArgs[1]);
+                    return;
+                }
+
+                var w = this.parseExpression(sValue);
+                if (w === undefined) return;
+
+                var sRegMatch = sReg.toUpperCase();
+                switch (sRegMatch) {
+                case "SP":
+                case "R6":
+                    cpu.setSP(w);
+                    break;
+                case "PC":
+                case "R7":
+                    cpu.setPC(w);
+                    this.dbgAddrNextCode = this.newAddr(cpu.getPC());
+                    break;
+                case "N":
+                    if (w) cpu.setNF(); else cpu.clearNF();
+                    break;
+                case "Z":
+                    if (w) cpu.setZF(); else cpu.clearZF();
+                    break;
+                case "V":
+                    if (w) cpu.setVF(); else cpu.clearVF();
+                    break;
+                case "C":
+                    if (w) cpu.setCF(); else cpu.clearCF();
+                    break;
+                case "PS":
+                    cpu.setPSW(w);
+                    break;
+                case "PI":
+                    cpu.setPIR(w);
+                    break;
+                case "ER":
+                    cpu.regErr = w;
+                    fMisc = true;
+                    break;
+                case "SL":
+                    cpu.setSLR(w);
+                    break;
+                case "M0":
+                    cpu.setMMR0(w);
+                    fMisc = true;
+                    break;
+                case "M3":
+                    cpu.setMMR3(w);
+                    fMisc = true;
+                    break;
+                case "AR":
+                    if (this.panel) this.panel.setAR(w);
+                    fMisc = true;
+                    break;
+                case "DR":
+                    if (this.panel) this.panel.setDR(w);
+                    fMisc = true;
+                    break;
+                case "SR":
+                    if (this.panel) this.panel.setSR(w);
+                    fMisc = true;
+                    break;
+                default:
+                    if (sRegMatch.charAt(0) == 'R') {
+                        var iReg = +sRegMatch.charAt(1);
+                        if (iReg >= 0 && iReg < 6) {
+                            cpu.regsGen[iReg] = w & 0xffff;
+                            break;
+                        }
+                    }
+                    this.println("unknown register: " + sReg);
+                    return;
+                }
+                this.cmp.updateDisplays();
+                this.println("updated registers:");
+            }
+        }
+
+        this.println(this.getRegDump(fMisc));
+
+        if (fInstruction) {
+            this.dbgAddrNextCode = this.newAddr(cpu.getPC());
+            this.doUnassemble(this.toStrAddr(this.dbgAddrNextCode));
+        }
+    }
+
+    /**
+     * doRun(sCmd, sAddr, sOptions, fQuiet)
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} sCmd
+     * @param {string|undefined} [sAddr]
+     * @param {string} [sOptions] (the rest of the breakpoint command-line)
+     * @param {boolean} [fQuiet]
+     */
+    doRun(sCmd, sAddr, sOptions, fQuiet)
+    {
+        if (sCmd == "gt") {
+            this.fIgnoreNextCheckFault = true;
+        }
+        if (sAddr !== undefined) {
+            var dbgAddr = this.parseAddr(sAddr, true);
+            if (!dbgAddr) return;
+            this.parseAddrOptions(dbgAddr, sOptions);
+            this.setTempBreakpoint(dbgAddr);
+        }
+        this.startCPU(true, fQuiet);
+    }
+
+    /**
+     * doPrint(sCmd)
+     *
+     * NOTE: If the string to print is a quoted string, then we run it through replaceRegs(), so that
+     * you can take advantage of all the special replacement options used for software interrupt logging.
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} sCmd
+     */
+    doPrint(sCmd)
+    {
+        sCmd = Str.trim(sCmd);
+        var a = sCmd.match(/^(['"])(.*?)\1$/);
+        if (!a) {
+            this.parseExpression(sCmd, false);
+        } else {
+            if (a[2].length > 1) {
+                this.println(this.replaceRegs(a[2]));
+            } else {
+                this.printValue(null, a[2].charCodeAt(0));
+            }
+        }
+    }
+
+    /**
+     * doStep(sCmd, sOption)
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} [sCmd] "p" or "pr"
+     * @param {string} [sOption]
+     */
+    doStep(sCmd, sOption)
+    {
+        if (sOption == '?') {
+            this.println("step commands:");
+            this.println("\tp\tstep over instruction");
+            this.println("\tpr\tstep over instruction with register update");
+            return;
+        }
+
+        var fCallStep = true;
+        var nRegs = (sCmd == "pr"? 1 : 0);
+        /*
+         * Set up the value for this.nStep (ie, 1 or 2) depending on whether the user wants
+         * a subsequent register dump ("pr") or not ("p").
+         */
+        var nStep = 1 + nRegs;
+
+        if (!this.nStep) {
+            var dbgAddr = this.newAddr(this.cpu.getPC());
+            var opCode = this.getWord(dbgAddr);
+
+            if (opCode == PDP11.OPCODE.BPT || opCode == PDP11.OPCODE.IOT ||
+                (opCode & PDP11.OPCODE.EMT_MASK) == PDP11.OPCODE.EMT_OP ||
+                (opCode & PDP11.OPCODE.SOB_MASK) == PDP11.OPCODE.SOB_OP ||
+                (opCode & PDP11.OPCODE.TRAP_MASK) == PDP11.OPCODE.TRAP_OP) {
+                if (fCallStep) {
+                    this.nStep = nStep;
+                    this.incAddr(dbgAddr, 2);
+                }
+            } else if ((opCode & PDP11.OPCODE.JSR_MASK) == PDP11.OPCODE.JSR_OP) {
+                var s = this.getInstruction(dbgAddr);
+
+                if (fCallStep) {
+                    this.nStep = nStep;
+                }
+            }
+
+            if (this.nStep) {
+                this.setTempBreakpoint(dbgAddr);
+                if (!this.startCPU()) {
+                    if (this.cmp) this.cmp.setFocus();
+                    this.nStep = 0;
+                }
+                /*
+                 * A successful run will ultimately call stop(), which will in turn call clearTempBreakpoint(),
+                 * which will clear nStep, so there's your assurance that nStep will be reset.  Now we may have
+                 * stopped for reasons unrelated to the temporary breakpoint, but that's OK.
+                 */
+            } else {
+                this.doTrace(nRegs? "tr" : "t");
+            }
+        } else {
+            this.println("step in progress");
+        }
+    }
+
+    /**
+     * getCall(dbgAddr)
+     *
+     * Given a possible return address (typically from the stack), look for a matching CALL (or INT) that
+     * immediately precedes that address.
+     *
+     * @this {DebuggerPDP11}
+     * @param {DbgAddrPDP11} dbgAddr
+     * @return {string|null} CALL instruction at or near dbgAddr, or null if none
+     */
+    getCall(dbgAddr)
+    {
+        var sCall = null;
+        var addr = dbgAddr.addr;
+        var addrOrig = addr;
+        for (var n = 1; n <= 6 && !!addr; n++) {
+            if (n > 2) {
+                dbgAddr.addr = addr;
+                var s = this.getInstruction(dbgAddr);
+                if (s.indexOf("JSR") >= 0) {
+                    /*
+                     * Verify that the length of this call, when added to the address of the call, matches
+                     * the original return address.  We do this by getting the string index of the opcode bytes,
+                     * subtracting that from the string index of the next space, and dividing that difference
+                     * by two, to yield the length of the CALL (or INT) instruction, in bytes.
+                     */
+                    var i = s.indexOf(' ');
+                    var j = s.indexOf(' ', i+1);
+                    if (addr + (j - i - 1)/2 == addrOrig) {
+                        sCall = s;
+                        break;
+                    }
+                }
+            }
+            addr -= 2;
+        }
+        dbgAddr.addr = addrOrig;
+        return sCall;
+    }
+
+    /**
+     * doStackTrace(sCmd, sAddr)
+     *
+     * Use "k" for a normal stack trace and "ks" for a stack trace with symbolic info.
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} [sCmd]
+     * @param {string} [sAddr] (not used yet)
+     */
+    doStackTrace(sCmd, sAddr)
+    {
+        if (sAddr == '?') {
+            this.println("stack trace commands:");
+            this.println("\tk\tshow frame addresses");
+            this.println("\tks\tshow symbol information");
+            return;
+        }
+
+        var nFrames = 10, cFrames = 0;
+        var dbgAddrCall = this.newAddr();
+        var dbgAddrStack = this.newAddr(this.cpu.getSP());
+        this.println("stack trace for " + this.toStrAddr(dbgAddrStack));
+
+        while (cFrames < nFrames) {
+            var sCall = null, sCallPrev = null, cTests = 256;
+            while ((dbgAddrStack.addr >>> 0) < 0x10000) {
+                dbgAddrCall.addr = this.getWord(dbgAddrStack, 2);
+                /*
+                 * Because we're using the auto-increment feature of getWord(), and because that will automatically
+                 * wrap the offset around the end of the segment, we must also check the addr property to detect the wrap.
+                 */
+                if (dbgAddrStack.addr == null || !cTests--) break;
+                if (dbgAddrCall.addr & 0x1) continue;           // an odd address on the PDP-11 is not a valid instruction boundary
+                sCall = this.getCall(dbgAddrCall);
+                if (sCall) break;
+            }
+            /*
+             * The sCallPrev check eliminates duplicate sequential calls, which are usually (but not always)
+             * indicative of a false positive, in which case the previous call is probably bogus as well, but
+             * at least we won't duplicate that mistake.  Of course, there are always exceptions, recursion
+             * being one of them, but it's rare that we're debugging recursive code.
+             */
+            if (!sCall || sCall == sCallPrev) break;
+            var sSymbol = null;
+            if (sCmd == "ks") {
+                var a = sCall.match(/[0-9A-F]+$/);
+                if (a) sSymbol = this.doList(a[0]);
+            }
+            sCall = Str.pad(sCall, 50) + "  ;" + (sSymbol || "stack=" + this.toStrAddr(dbgAddrStack)); // + " return=" + this.toStrAddr(dbgAddrCall));
+            this.println(sCall);
+            sCallPrev = sCall;
+            cFrames++;
+        }
+        if (!cFrames) this.println("no return addresses found");
+    }
+
+    /**
+     * doTrace(sCmd, sCount)
+     *
+     * The "t" and "tr" commands interpret the count as a number of instructions, and since
+     * we call the Debugger's stepCPU() for each iteration, a single instruction includes
+     * any/all prefixes; the CPU's stepCPU() treats prefixes as discrete operations.  The only
+     * difference between "t" and "tr": the former displays only the next instruction, while
+     * the latter also displays the (updated) registers.
+     *
+     * The "tc" command interprets the count as a number of cycles rather than instructions,
+     * allowing you to quickly execute large chunks of instructions with a single command; it
+     * doesn't display anything until the the chunk has finished.  "tc 1" is also a useful
+     * command in that it doesn't inhibit interrupts like "t" or "tr" does.
+     *
+     * However, generally a more useful command is "bn", which allows you to break after some
+     * number of instructions have been executed (as opposed to some number of cycles).
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} [sCmd] ("t", "tc", or "tr")
+     * @param {string} [sCount] # of instructions to step
+     */
+    doTrace(sCmd, sCount)
+    {
+        if (sCount == '?') {
+            this.println("trace commands:");
+            this.println("\tt  [#]\ttrace # instructions");
+            this.println("\ttr [#]\ttrace # instructions with register updates");
+            this.println("\ttc [#]\ttrace # cycles");
+            this.println("note: bn [#] breaks after # instructions without updates");
+            return;
+        }
+
+        var dbg = this;
+        var fRegs = (sCmd != "t");
+        var nCount = this.parseValue(sCount, null, true) || 1;
+
+        /*
+         * We used to set nCycles to 1 when a count > 1 was specified, because nCycles set
+         * to 0 used to mean "execute the next instruction without checking for interrupts".
+         * Well, this machine's stepCPU() doesn't do that; it ALWAYS checks for interrupts,
+         * so we should leave nCycles set to 0, so that if an interrupt is dispatched, we will
+         * get to see the first instruction of the interrupt handler.
+         */
+        var nCycles = 0;    // (nCount == 1? 0 : 1);
+
+        if (sCmd == "tc") {
+            nCycles = nCount;
+            nCount = 1;
+        }
+        this.sCmdTracePrev = sCmd;
+
+        Web.onCountRepeat(
+            nCount,
+            function onCountStep() {
+                return dbg.setBusy(true) && dbg.stepCPU(nCycles, fRegs, false);
+            },
+            function onCountStepComplete() {
+                /*
+                 * We explicitly called stepCPU() with fUpdateDisplays set to false, because repeatedly
+                 * calling updateDisplays() can be very slow, especially if a Control Panel is present with
+                 * displayLiveRegs enabled, so once the repeat count has been exhausted, we must perform
+                 * a final updateDisplays().
+                 */
+                if (dbg.panel) dbg.panel.stop();
+                dbg.cmp.updateDisplays(-1);
+                dbg.setBusy(false);
+            }
+        );
+    }
+
+    /**
+     * doUnassemble(sAddr, sAddrEnd, nLines)
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} [sAddr]
+     * @param {string} [sAddrEnd]
+     * @param {number} [nLines]
+     */
+    doUnassemble(sAddr, sAddrEnd, nLines)
+    {
+        var dbgAddr = this.parseAddr(sAddr, true);
+        if (!dbgAddr) return;
+
+        if (nLines === undefined) nLines = 1;
+
+        var nBytes = 0x100;
+        if (sAddrEnd !== undefined) {
+
+            if (sAddrEnd.charAt(0) == 'l') {
+                var n = this.parseValue(sAddrEnd.substr(1));
+                if (n != null) nLines = n;
+            }
+            else {
+                var dbgAddrEnd = this.parseAddr(sAddrEnd, true);
+                if (!dbgAddrEnd || dbgAddrEnd.addr < dbgAddr.addr) return;
+
+                nBytes = dbgAddrEnd.addr - dbgAddr.addr;
+                if (!DEBUG && nBytes > 0x100) {
+                    /*
+                     * Limiting the amount of disassembled code to 256 bytes in non-DEBUG builds is partly to
+                     * prevent the user from wedging the browser by dumping too many lines, but also a recognition
+                     * that, in non-DEBUG builds, this.println() keeps print output buffer truncated to 8Kb anyway.
+                     */
+                    this.println("range too large");
+                    return;
+                }
+                nLines = -1;
+            }
+        }
+
+        var nPrinted = 0;
+        var sInstruction;
+
+        while (nBytes > 0 && nLines--) {
+
+            var nSequence = (this.isBusy(false) || this.nStep)? this.nCycles : null;
+            var sComment = (nSequence != null? "cycles" : null);
+            var aSymbol = this.findSymbol(dbgAddr);
+
+            var addr = dbgAddr.addr;    // we snap dbgAddr.addr *after* calling findSymbol(), which re-evaluates it
+
+            if (aSymbol[0] && nLines) {
+                if (!nPrinted && nLines || aSymbol[0].indexOf('+') < 0) {
+                    var sLabel = aSymbol[0] + ':';
+                    if (aSymbol[2]) sLabel += ' ' + aSymbol[2];
+                    this.println(sLabel);
+                }
+            }
+
+            if (aSymbol[3]) {
+                sComment = aSymbol[3];
+                nSequence = null;
+            }
+
+            sInstruction = this.getInstruction(dbgAddr, sComment, nSequence);
+
+            this.println(sInstruction);
+            this.dbgAddrNextCode = dbgAddr;
+            nBytes -= dbgAddr.addr - addr;
+            nPrinted++;
+        }
+    }
+
+    /**
+     * splitArgs(sCmd)
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} sCmd
+     * @return {Array.<string>}
+     */
+    splitArgs(sCmd)
+    {
+        var asArgs = sCmd.replace(/ +/g, ' ').split(' ');
+        asArgs[0] = asArgs[0].toLowerCase();
+        if (asArgs && asArgs.length) {
+            var s0 = asArgs[0];
+            var ch0 = s0.charAt(0);
+            for (var i = 1; i < s0.length; i++) {
+                var ch = s0.charAt(i);
+                if (ch0 == '?' || ch0 == 'r' || ch < 'a' || ch > 'z') {
+                    asArgs[0] = s0.substr(i);
+                    asArgs.unshift(s0.substr(0, i));
+                    break;
+                }
+            }
+        }
+        return asArgs;
+    }
+
+    /**
+     * doCommand(sCmd, fQuiet)
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} sCmd
+     * @param {boolean} [fQuiet]
+     * @return {boolean} true if command processed, false if unrecognized
+     */
+    doCommand(sCmd, fQuiet)
+    {
+        var result = true;
+
+        try {
+            if (!sCmd.length || sCmd == "end") {
+                if (this.fAssemble) {
+                    this.println("ended assemble at " + this.toStrAddr(this.dbgAddrAssemble));
+                    this.dbgAddrNextCode = this.dbgAddrAssemble;
+                    this.fAssemble = false;
+                }
+                sCmd = "";
+            }
+            else if (!fQuiet) {
+                this.println(DebuggerPDP11.PROMPT + sCmd);
+            }
+
+            var ch = sCmd.charAt(0);
+            if (ch == '"' || ch == "'") return true;
+
+            /*
+             * Zap the previous message buffer to ensure the new command's output is not tossed out as a repeat.
+             */
+            this.sMessagePrev = null;
+
+            /*
+             * I've relaxed the !isBusy() requirement, to maximize our ability to issue Debugger commands externally.
+             */
+            if (this.isReady() /* && !this.isBusy(true) */ && sCmd.length > 0) {
+
+                if (this.fAssemble) {
+                    sCmd = "a " + this.toStrAddr(this.dbgAddrAssemble) + ' ' + sCmd;
+                }
+
+                var fError = false;
+                var asArgs = this.splitArgs(sCmd);
+
+                switch (asArgs[0].charAt(0)) {
+                case 'a':
+                    this.doAssemble(asArgs);
+                    break;
+                case 'b':
+                    this.doBreak(asArgs[0], asArgs[1], sCmd);
+                    break;
+                case 'c':
+                    this.doClear(asArgs[0]);
+                    break;
+                case 'd':
+                    if (!COMPILED && sCmd == "debug") {
+                        window.DEBUG = true;
+                        this.println("DEBUG checks on");
+                        break;
+                    }
+                    this.doDump(asArgs);
+                    break;
+                case 'e':
+                    if (asArgs[0] == "else") break;
+                    this.doEdit(asArgs);
+                    break;
+                case 'g':
+                    this.doRun(asArgs[0], asArgs[1], sCmd, fQuiet);
+                    break;
+                case 'h':
+                    this.doHalt(fQuiet);
+                    break;
+                case 'i':
+                    if (asArgs[0] == "if") {
+                        if (!this.doIf(sCmd.substr(2), fQuiet)) {
+                            result = false;
+                        }
+                        break;
+                    }
+                    fError = true;
+                    break;
+                case 'k':
+                    this.doStackTrace(asArgs[0], asArgs[1]);
+                    break;
+                case 'l':
+                    if (asArgs[0] == "ln") {
+                        this.doList(asArgs[1], true);
+                        break;
+                    }
+                    fError = true;
+                    break;
+                case 'm':
+                    this.doMessages(asArgs);
+                    break;
+                case 'p':
+                    if (asArgs[0] == "print") {
+                        this.doPrint(sCmd.substr(5));
+                        break;
+                    }
+                    this.doStep(asArgs[0], asArgs[1]);
+                    break;
+                case 'r':
+                    if (sCmd == "reset") {
+                        if (this.cmp) this.cmp.reset();
+                        break;
+                    }
+                    this.doRegisters(asArgs);
+                    break;
+                case 's':
+                    this.doOptions(asArgs);
+                    break;
+                case 't':
+                    this.doTrace(asArgs[0], asArgs[1]);
+                    break;
+                case 'u':
+                    this.doUnassemble(asArgs[1], asArgs[2], 8);
+                    break;
+                case 'v':
+                    if (asArgs[0] == "var") {
+                        if (!this.doVar(sCmd.substr(3))) {
+                            result = false;
+                        }
+                        break;
+                    }
+                    if (asArgs[0] == "ver") {
+                        this.println((PDP11.APPNAME || "PDP11") + " version " + (XMLVERSION || PDP11.APPVERSION) + " (" + this.cpu.model + (PDP11.COMPILED? ",RELEASE" : (PDP11.DEBUG? ",DEBUG" : ",NODEBUG")) + (PDP11.TYPEDARRAYS? ",TYPEDARRAYS" : (PDP11.BYTEARRAYS? ",BYTEARRAYS" : ",LONGARRAYS")) + ')');
+                        this.println(Web.getUserAgent());
+                        break;
+                    }
+                    fError = true;
+                    break;
+                case '?':
+                    if (asArgs[1]) {
+                        this.doPrint(sCmd.substr(1));
+                        break;
+                    }
+                    this.doHelp();
+                    break;
+                case 'n':
+                    if (!COMPILED && sCmd == "nodebug") {
+                        window.DEBUG = false;
+                        this.println("DEBUG checks off");
+                        break;
+                    }
+                    if (this.doInfo(asArgs)) break;
+                    /* falls through */
+                default:
+                    fError = true;
+                    break;
+                }
+                if (fError) {
+                    this.println("unknown command: " + sCmd);
+                    result = false;
+                }
+            }
+        } catch(e) {
+            this.println("debugger error: " + (e.stack || e.message));
+            result = false;
+        }
+        return result;
+    }
+
+    /**
+     * doCommands(sCmds, fSave)
+     *
+     * @this {DebuggerPDP11}
+     * @param {string} sCmds
+     * @param {boolean} [fSave]
+     * @return {boolean} true if all commands processed, false if not
+     */
+    doCommands(sCmds, fSave)
+    {
+        var a = this.parseCommand(sCmds, fSave);
+        for (var s in a) {
+            if (!this.doCommand(a[+s])) return false;
+        }
+        return true;
+    }
+
+    /**
+     * DebuggerPDP11.init()
+     *
+     * This function operates on every HTML element of class "debugger", extracting the
+     * JSON-encoded parameters for the Debugger constructor from the element's "data-value"
+     * attribute, invoking the constructor to create a Debugger component, and then binding
+     * any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        var aeDbg = Component.getElementsByClass(document, PDP11.APPCLASS, "debugger");
+        for (var iDbg = 0; iDbg < aeDbg.length; iDbg++) {
+            var eDbg = aeDbg[iDbg];
+            var parmsDbg = Component.getComponentParms(eDbg);
+            var dbg = new DebuggerPDP11(parmsDbg);
+            Component.bindComponentControls(dbg, eDbg, PDP11.APPCLASS);
+        }
+    }
+}
+
+if (DEBUGGER) {
+
+    /*
+     * NOTE: Every DebuggerPDP11 property from here to the first prototype function definition (initBus()) is
+     * considered a "class constant"; most of them use our "all-caps" convention (and all of them SHOULD, but
+     * that wouldn't help us catch any bugs).
+     *
+     * Technically, all of them should ALSO be preceded by a "@const" annotation, but that's a lot of work and it
+     * really clutters the code.  I wish the Closure Compiler had a way to annotate every definition with a given
+     * section with a single annotation....
+     */
+
+    DebuggerPDP11.COMMANDS = {
+        '?':        "help/print",
+        'a [#]':    "assemble",             // TODO: Implement this command someday
+        'b [#]':    "breakpoint",           // multiple variations (use b? to list them)
+        'c':        "clear output",
+        'd [#]':    "dump memory",          // additional syntax: d [#] [l#], where l# is a number of bytes to dump
+        'e [#]':    "edit memory",
+        'g [#]':    "go [to #]",
+        'h':        "halt",
+        'if':       "eval expression",
+        'int [#]':  "request interrupt",
+        'k':        "stack trace",
+        "ln":       "list nearest symbol(s)",
+        'm':        "messages",
+        'p':        "step over",            // other variations: pr (step and dump registers)
+        'print':    "print expression",
+        'r':        "dump/set registers",
+        'reset':    "reset machine",
+        's':        "set options",
+        't [#]':    "trace",                // other variations: tr (trace and dump registers)
+        'u [#]':    "unassemble",
+        'var':      "assign variable",
+        'ver':      "print version"
+    };
+
+    /*
+     * CPU opcode IDs
+     *
+     * Not listed: BLO (same as BCS) and BHIS (same as BCC).
+     */
+    DebuggerPDP11.OPS = {
+        NONE:   0,      ADC:    1,      ADCB:   2,      ADD:    3,      ASL:    4,      ASLB:   5,      ASR:    6,      ASRB:   7,
+        BCC:    8,      BCS:    9,      BEQ:    10,     BGE:    11,     BGT:    12,     BHI:    13,     BIC:    14,     BICB:   15,
+        BIS:    16,     BISB:   17,     BIT:    18,     BITB:   19,     BLE:    20,     BLOS:   21,     BLT:    22,     BMI:    23,
+        BNE:    24,     BPL:    25,     BPT:    26,     BR:     27,     BVC:    28,     BVS:    29,     CCC:    30,     CLC:    31,
+        CLCN:   32,     CLCV:   33,     CLCVN:  34,     CLCVZ:  35,     CLCZ:   36,     CLCZN:  37,     CLN:    38,     CLR:    39,
+        CLRB:   40,     CLV:    41,     CLVN:   42,     CLVZ:   43,     CLVZN:  44,     CLZ:    45,     CLZN:   46,     CMP:    47,
+        CMPB:   48,     COM:    49,     COMB:   50,     DEC:    51,     DECB:   52,     INC:    53,     INCB:   54,     HALT:   55,
+        JMP:    56,     JSR:    57,     MARK:   58,     MFPD:   59,     MFPI:   60,     MFPS:   61,     MOV:    62,     MOVB:   63,
+        MTPD:   64,     MTPI:   65,     MTPS:   66,     NEG:    67,     NEGB:   68,     NOP:    69,     RESET:  70,     ROL:    71,
+        ROLB:   72,     ROR:    73,     RORB:   74,     RTI:    75,     RTS:    76,     SBC:    77,     SBCB:   78,     SCC:    79,
+        SEC:    80,     SECN:   81,     SECV:   82,     SECVN:  83,     SECVZ:  84,     SECZ:   85,     SECZN:  86,     SEN:    87,
+        SEV:    88,     SEVN:   89,     SEVZ:   90,     SEVZN:  91,     SEZ:    92,     SEZN:   93,     SUB:    94,     SWAB:   95,
+        SXT:    96,     TST:    97,     TSTB:   98,     WAIT:   99,     MUL:    100,    DIV:    101,    ASH:    102,    ASHC:   103,
+        XOR:    104,    SOB:    105,    EMT:    106,    TRAP:   107,    SPL:    108,    IOT:    109,    RTT:    110,    MFPT:   111
+    };
+
+    /*
+     * CPU opcode names, indexed by CPU opcode ordinal (above)
+     */
+    DebuggerPDP11.OPNAMES = [
+        ".WORD",        "ADC",          "ADCB",         "ADD",          "ASL",          "ASLB",         "ASR",          "ASRB",
+        "BCC",          "BCS",          "BEQ",          "BGE",          "BGT",          "BHI",          "BIC",          "BICB",
+        "BIS",          "BISB",         "BIT",          "BITB",         "BLE",          "BLOS",         "BLT",          "BMI",
+        "BNE",          "BPL",          "BPT",          "BR",           "BVC",          "BVS",          "CCC",          "CLC",
+        "CLCN",         "CLCV",         "CLCVN",        "CLCVZ",        "CLCZ",         "CLCZN",        "CLN",          "CLR",
+        "CLRB",         "CLV",          "CLVN",         "CLVZ",         "CLVZN",        "CLZ",          "CLZN",         "CMP",
+        "CMPB",         "COM",          "COMB",         "DEC",          "DECB",         "INC",          "INCB",         "HALT",
+        "JMP",          "JSR",          "MARK",         "MFPD",         "MFPI",         "MFPS",         "MOV",          "MOVB",
+        "MTPD",         "MTPI",         "MTPS",         "NEG",          "NEGB",         "NOP",          "RESET",        "ROL",
+        "ROLB",         "ROR",          "RORB",         "RTI",          "RTS",          "SBC",          "SBCB",         "SCC",
+        "SEC",          "SECN",         "SECV",         "SECVN",        "SECVZ",        "SECZ",         "SECZN",        "SEN",
+        "SEV",          "SEVN",         "SEVZ",         "SEVZN",        "SEZ",          "SEZN",         "SUB",          "SWAB",
+        "SXT",          "TST",          "TSTB",         "WAIT",         "MUL",          "DIV",          "ASH",          "ASHC",
+        "XOR",          "SOB",          "EMT",          "TRAP",         "SPL",          "IOT",          "RTT",          "MFPT"
+    ];
+
+    /*
+     * Register numbers 0-7 are reserved for cpu.regsGen, 8-15 are reserved for cpu.regsAlt, and 16-19 for cpu.regsStack.
+     */
+    DebuggerPDP11.REG_PS        = 20;
+    DebuggerPDP11.REG_PI        = 21;
+    DebuggerPDP11.REG_ER        = 22;
+    DebuggerPDP11.REG_SL        = 23;
+    DebuggerPDP11.REG_M0        = 24;
+    DebuggerPDP11.REG_M1        = 25;
+    DebuggerPDP11.REG_M2        = 26;
+    DebuggerPDP11.REG_M3        = 27;
+    DebuggerPDP11.REG_AR        = 28;           // ADDRESS register; see Panel's getAR() and setAR()
+    DebuggerPDP11.REG_DR        = 29;           // DISPLAY/DATA register; see Panel's getDR() and setDR()
+    DebuggerPDP11.REG_SR        = 30;           // SWITCH register; see Panel's getSR() and setSR()
+
+    DebuggerPDP11.REGS = {
+        "SP":   6,
+        "PC":   7,
+        "PS":   DebuggerPDP11.REG_PS,
+        "PI":   DebuggerPDP11.REG_PI,
+        "ER":   DebuggerPDP11.REG_ER,
+        "SL":   DebuggerPDP11.REG_SL,
+        "M0":   DebuggerPDP11.REG_M0,
+        "M1":   DebuggerPDP11.REG_M1,
+        "M2":   DebuggerPDP11.REG_M2,
+        "M3":   DebuggerPDP11.REG_M3,
+        "AR":   DebuggerPDP11.REG_AR,
+        "DR":   DebuggerPDP11.REG_DR,
+        "SR":   DebuggerPDP11.REG_SR
+    };
+
+    DebuggerPDP11.REGNAMES = [
+        "R0", "R1", "R2", "R3", "R4", "R5", "SP", "PC",
+        "A0", "A1", "A2", "A3", "A4", "A5", "A6", "A7",
+        "S0", "S1", "S2", "S3",
+        "PS", "PI", "ER", "SL", "M0", "M1", "M2", "M3",
+        "AR", "DR", "SR"
+    ];
+
+    DebuggerPDP11.MODES = ["KI","KD","SI","SD","??","??","UI","UD"];
+
+    /*
+     * Operand type masks; anything that's not covered by OP_SRC or OP_DST must be a OP_OTHER value.
+     */
+    DebuggerPDP11.OP_DSTREG   = PDP11.OPREG.MASK;
+    DebuggerPDP11.OP_DSTMODE  = PDP11.OPMODE.MASK;
+    DebuggerPDP11.OP_DST      = (DebuggerPDP11.OP_DSTMODE | DebuggerPDP11.OP_DSTREG);
+    DebuggerPDP11.OP_SRCREG   = PDP11.OPREG.MASK << 6;
+    DebuggerPDP11.OP_SRCMODE  = PDP11.OPMODE.MASK << 6;
+    DebuggerPDP11.OP_SRC      = (DebuggerPDP11.OP_SRCMODE | DebuggerPDP11.OP_SRCREG);
+    DebuggerPDP11.OP_BRANCH   = 0x1000;
+    DebuggerPDP11.OP_DSTOFF   = 0x2000;
+    DebuggerPDP11.OP_DSTNUM3  = 0x3000;       // DST 3-bit number (ie, just the DSTREG field)
+    DebuggerPDP11.OP_DSTNUM6  = 0x6000;       // DST 6-bit number (ie, both the DSTREG and DSTMODE fields)
+    DebuggerPDP11.OP_DSTNUM8  = 0x8000;       // DST 8-bit number
+    DebuggerPDP11.OP_OTHER    = 0xF000;
+
+    /*
+     * The OPTABLE contains opcode masks, and each mask refers to table of possible values, and each
+     * value refers to an array that contains:
+     *
+     *      [0]: {number} of the opcode name (see OP.*)
+     *      [1]: {number} containing the first operand type bit(s), if any
+     *      [2]: {number} containing the second operand type bit(s), if any
+     *
+     * Note that, by convention, opcodes that require two operands list the SRC operand first and DST operand
+     * second (ie, the OPPOSITE of the Intel convention).
+     *
+     * Also note that, for some of the newer PDP-11 opcodes (eg, MUL, DIV, ASH, ASHC), the location of the
+     * opcode's SRC and DST bits are reversed.  This is why, for example, you'll see the MUL instruction defined
+     * below as having OP_DST for the first operand and OP_SRCREG for the second operand.  This does NOT mean
+     * that the opcode's destination operand is being listed first, but rather that the bits describing the source
+     * operand are in the opcode's OP_DST field.
+     */
+    DebuggerPDP11.OPTABLE = {
+        0xF000: {
+            0x1000: [DebuggerPDP11.OPS.MOV,     DebuggerPDP11.OP_SRC,         DebuggerPDP11.OP_DST],        // 01SSDD
+            0x2000: [DebuggerPDP11.OPS.CMP,     DebuggerPDP11.OP_SRC,         DebuggerPDP11.OP_DST],        // 02SSDD
+            0x3000: [DebuggerPDP11.OPS.BIT,     DebuggerPDP11.OP_SRC,         DebuggerPDP11.OP_DST],        // 03SSDD
+            0x4000: [DebuggerPDP11.OPS.BIC,     DebuggerPDP11.OP_SRC,         DebuggerPDP11.OP_DST],        // 04SSDD
+            0x5000: [DebuggerPDP11.OPS.BIS,     DebuggerPDP11.OP_SRC,         DebuggerPDP11.OP_DST],        // 05SSDD
+            0x6000: [DebuggerPDP11.OPS.ADD,     DebuggerPDP11.OP_SRC,         DebuggerPDP11.OP_DST],        // 06SSDD
+            0x9000: [DebuggerPDP11.OPS.MOVB,    DebuggerPDP11.OP_SRC,         DebuggerPDP11.OP_DST],        // 11SSDD
+            0xA000: [DebuggerPDP11.OPS.CMPB,    DebuggerPDP11.OP_SRC,         DebuggerPDP11.OP_DST],        // 12SSDD
+            0xB000: [DebuggerPDP11.OPS.BITB,    DebuggerPDP11.OP_SRC,         DebuggerPDP11.OP_DST],        // 13SSDD
+            0xC000: [DebuggerPDP11.OPS.BICB,    DebuggerPDP11.OP_SRC,         DebuggerPDP11.OP_DST],        // 14SSDD
+            0xD000: [DebuggerPDP11.OPS.BISB,    DebuggerPDP11.OP_SRC,         DebuggerPDP11.OP_DST],        // 15SSDD
+            0xE000: [DebuggerPDP11.OPS.SUB,     DebuggerPDP11.OP_SRC,         DebuggerPDP11.OP_DST]         // 16SSDD
+        },
+        0xFE00: {
+            0x0800: [DebuggerPDP11.OPS.JSR,     DebuggerPDP11.OP_SRCREG,      DebuggerPDP11.OP_DST],        // 004RDD
+            0x7000: [DebuggerPDP11.OPS.MUL,     DebuggerPDP11.OP_DST,         DebuggerPDP11.OP_SRCREG],     // 070RSS
+            0x7200: [DebuggerPDP11.OPS.DIV,     DebuggerPDP11.OP_DST,         DebuggerPDP11.OP_SRCREG],     // 071RSS
+            0x7400: [DebuggerPDP11.OPS.ASH,     DebuggerPDP11.OP_DST,         DebuggerPDP11.OP_SRCREG],     // 072RSS
+            0x7600: [DebuggerPDP11.OPS.ASHC,    DebuggerPDP11.OP_DST,         DebuggerPDP11.OP_SRCREG],     // 073RSS
+            0x7800: [DebuggerPDP11.OPS.XOR,     DebuggerPDP11.OP_SRCREG,      DebuggerPDP11.OP_DST],        // 074RDD
+            0x7E00: [DebuggerPDP11.OPS.SOB,     DebuggerPDP11.OP_SRCREG,      DebuggerPDP11.OP_DSTOFF]      // 077Rnn
+        },
+        0xFF00: {
+            0x0100: [DebuggerPDP11.OPS.BR,      DebuggerPDP11.OP_BRANCH],
+            0x0200: [DebuggerPDP11.OPS.BNE,     DebuggerPDP11.OP_BRANCH],
+            0x0300: [DebuggerPDP11.OPS.BEQ,     DebuggerPDP11.OP_BRANCH],
+            0x0400: [DebuggerPDP11.OPS.BGE,     DebuggerPDP11.OP_BRANCH],
+            0x0500: [DebuggerPDP11.OPS.BLT,     DebuggerPDP11.OP_BRANCH],
+            0x0600: [DebuggerPDP11.OPS.BGT,     DebuggerPDP11.OP_BRANCH],
+            0x0700: [DebuggerPDP11.OPS.BLE,     DebuggerPDP11.OP_BRANCH],
+            0x8000: [DebuggerPDP11.OPS.BPL,     DebuggerPDP11.OP_BRANCH],
+            0x8100: [DebuggerPDP11.OPS.BMI,     DebuggerPDP11.OP_BRANCH],
+            0x8200: [DebuggerPDP11.OPS.BHI,     DebuggerPDP11.OP_BRANCH],
+            0x8300: [DebuggerPDP11.OPS.BLOS,    DebuggerPDP11.OP_BRANCH],
+            0x8400: [DebuggerPDP11.OPS.BVC,     DebuggerPDP11.OP_BRANCH],
+            0x8500: [DebuggerPDP11.OPS.BVS,     DebuggerPDP11.OP_BRANCH],
+            0x8600: [DebuggerPDP11.OPS.BCC,     DebuggerPDP11.OP_BRANCH],
+            0x8700: [DebuggerPDP11.OPS.BCS,     DebuggerPDP11.OP_BRANCH],
+            0x8800: [DebuggerPDP11.OPS.EMT,     DebuggerPDP11.OP_DSTNUM8],      // 104000..104377
+            0x8900: [DebuggerPDP11.OPS.TRAP,    DebuggerPDP11.OP_DSTNUM8]       // 104400..104777
+        },
+        0xFFC0: {
+            0x0040: [DebuggerPDP11.OPS.JMP,     DebuggerPDP11.OP_DST],          // 0001DD
+            0x00C0: [DebuggerPDP11.OPS.SWAB,    DebuggerPDP11.OP_DST],          // 0003DD
+            0x0A00: [DebuggerPDP11.OPS.CLR,     DebuggerPDP11.OP_DST],          // 0050DD
+            0x0A40: [DebuggerPDP11.OPS.COM,     DebuggerPDP11.OP_DST],          // 0051DD
+            0x0A80: [DebuggerPDP11.OPS.INC,     DebuggerPDP11.OP_DST],          // 0052DD
+            0x0AC0: [DebuggerPDP11.OPS.DEC,     DebuggerPDP11.OP_DST],          // 0053DD
+            0x0B00: [DebuggerPDP11.OPS.NEG,     DebuggerPDP11.OP_DST],          // 0054DD
+            0x0B40: [DebuggerPDP11.OPS.ADC,     DebuggerPDP11.OP_DST],          // 0055DD
+            0x0B80: [DebuggerPDP11.OPS.SBC,     DebuggerPDP11.OP_DST],          // 0056DD
+            0x0BC0: [DebuggerPDP11.OPS.TST,     DebuggerPDP11.OP_DST],          // 0057DD
+            0x0C00: [DebuggerPDP11.OPS.ROR,     DebuggerPDP11.OP_DST],          // 0060DD
+            0x0C40: [DebuggerPDP11.OPS.ROL,     DebuggerPDP11.OP_DST],          // 0061DD
+            0x0C80: [DebuggerPDP11.OPS.ASR,     DebuggerPDP11.OP_DST],          // 0062DD
+            0x0CC0: [DebuggerPDP11.OPS.ASL,     DebuggerPDP11.OP_DST],          // 0063DD
+            0x0D00: [DebuggerPDP11.OPS.MARK,    DebuggerPDP11.OP_DSTNUM6],      // 0064nn
+            0x0D40: [DebuggerPDP11.OPS.MFPI,    DebuggerPDP11.OP_DST],          // 0065SS
+            0x0D80: [DebuggerPDP11.OPS.MTPI,    DebuggerPDP11.OP_DST],          // 0066DD
+            0x0DC0: [DebuggerPDP11.OPS.SXT,     DebuggerPDP11.OP_DST],          // 0067DD
+            0x8A00: [DebuggerPDP11.OPS.CLRB,    DebuggerPDP11.OP_DST],          // 1050DD
+            0x8A40: [DebuggerPDP11.OPS.COMB,    DebuggerPDP11.OP_DST],          // 1051DD
+            0x8A80: [DebuggerPDP11.OPS.INCB,    DebuggerPDP11.OP_DST],          // 1052DD
+            0x8AC0: [DebuggerPDP11.OPS.DECB,    DebuggerPDP11.OP_DST],          // 1053DD
+            0x8B00: [DebuggerPDP11.OPS.NEGB,    DebuggerPDP11.OP_DST],          // 1054DD
+            0x8B40: [DebuggerPDP11.OPS.ADCB,    DebuggerPDP11.OP_DST],          // 1055DD
+            0x8B80: [DebuggerPDP11.OPS.SBCB,    DebuggerPDP11.OP_DST],          // 1056DD
+            0x8BC0: [DebuggerPDP11.OPS.TSTB,    DebuggerPDP11.OP_DST],          // 1057DD
+            0x8C00: [DebuggerPDP11.OPS.RORB,    DebuggerPDP11.OP_DST],          // 1060DD
+            0x8C40: [DebuggerPDP11.OPS.ROLB,    DebuggerPDP11.OP_DST],          // 1061DD
+            0x8C80: [DebuggerPDP11.OPS.ASRB,    DebuggerPDP11.OP_DST],          // 1062DD
+            0x8CC0: [DebuggerPDP11.OPS.ASLB,    DebuggerPDP11.OP_DST],          // 1063DD
+            0x8D00: [DebuggerPDP11.OPS.MTPS,    DebuggerPDP11.OP_DST],          // 1064SS (only on LSI-11)
+            0x8D40: [DebuggerPDP11.OPS.MFPD,    DebuggerPDP11.OP_DST],          // 1065DD (same as MFPI if no separate instruction/data spaces)
+            0x8D80: [DebuggerPDP11.OPS.MTPD,    DebuggerPDP11.OP_DST],          // 1066DD (same as MTPI if no separate instruction/data spaces)
+            0x8DC0: [DebuggerPDP11.OPS.MFPS,    DebuggerPDP11.OP_DST]           // 1067SS (only on LSI-11)
+        },
+        0xFFF8: {
+            0x0080: [DebuggerPDP11.OPS.RTS,     DebuggerPDP11.OP_DSTREG],       // 00020R
+            0x0098: [DebuggerPDP11.OPS.SPL,     DebuggerPDP11.OP_DSTNUM3]       // 00023N
+        },
+        0xFFFF: {
+            0x0000: [DebuggerPDP11.OPS.HALT],                                   // 000000
+            0x0001: [DebuggerPDP11.OPS.WAIT],                                   // 000001
+            0x0002: [DebuggerPDP11.OPS.RTI],                                    // 000002
+            0x0003: [DebuggerPDP11.OPS.BPT],                                    // 000003
+            0x0004: [DebuggerPDP11.OPS.IOT],                                    // 000004
+            0x0005: [DebuggerPDP11.OPS.RESET],                                  // 000005
+            0x0006: [DebuggerPDP11.OPS.RTT],                                    // 000006
+            0x0007: [DebuggerPDP11.OPS.MFPT],                                   // 000007 (only on PDP-11/44 & KB11-EM?)
+            0x00A0: [DebuggerPDP11.OPS.NOP],
+            0x00A1: [DebuggerPDP11.OPS.CLC],
+            0x00A2: [DebuggerPDP11.OPS.CLV],
+            0x00A3: [DebuggerPDP11.OPS.CLCV],
+            0x00A4: [DebuggerPDP11.OPS.CLZ],
+            0x00A5: [DebuggerPDP11.OPS.CLCZ],
+            0x00A6: [DebuggerPDP11.OPS.CLVZ],
+            0x00A7: [DebuggerPDP11.OPS.CLCVZ],
+            0x00A8: [DebuggerPDP11.OPS.CLN],
+            0x00A9: [DebuggerPDP11.OPS.CLCN],
+            0x00AA: [DebuggerPDP11.OPS.CLVN],
+            0x00AB: [DebuggerPDP11.OPS.CLCVN],
+            0x00AC: [DebuggerPDP11.OPS.CLZN],
+            0x00AD: [DebuggerPDP11.OPS.CLCZN],
+            0x00AE: [DebuggerPDP11.OPS.CLVZN],
+            0x00AF: [DebuggerPDP11.OPS.CCC],                                    // aka CLCVZN
+            0x00B0: [DebuggerPDP11.OPS.NOP],
+            0x00B1: [DebuggerPDP11.OPS.SEC],
+            0x00B2: [DebuggerPDP11.OPS.SEV],
+            0x00B3: [DebuggerPDP11.OPS.SECV],
+            0x00B4: [DebuggerPDP11.OPS.SEZ],
+            0x00B5: [DebuggerPDP11.OPS.SECZ],
+            0x00B6: [DebuggerPDP11.OPS.SEVZ],
+            0x00B7: [DebuggerPDP11.OPS.SECVZ],
+            0x00B8: [DebuggerPDP11.OPS.SEN],
+            0x00B9: [DebuggerPDP11.OPS.SECN],
+            0x00BA: [DebuggerPDP11.OPS.SEVN],
+            0x00BB: [DebuggerPDP11.OPS.SECVN],
+            0x00BC: [DebuggerPDP11.OPS.SEZN],
+            0x00BD: [DebuggerPDP11.OPS.SECZN],
+            0x00BE: [DebuggerPDP11.OPS.SEVZN],
+            0x00BF: [DebuggerPDP11.OPS.SCC]                                     // aka SECVZN
+        }
+    };
+
+    DebuggerPDP11.OPNONE = [DebuggerPDP11.OPS.NONE];
+
+    /*
+     * Table of opcodes added to the 11/40 and newer
+     */
+    DebuggerPDP11.OP1140 = [
+        DebuggerPDP11.OPS.MARK,
+        DebuggerPDP11.OPS.MFPI,
+        DebuggerPDP11.OPS.MTPI,
+        DebuggerPDP11.OPS.SXT,
+        DebuggerPDP11.OPS.RTT,
+        DebuggerPDP11.OPS.MUL,
+        DebuggerPDP11.OPS.DIV,
+        DebuggerPDP11.OPS.ASH,
+        DebuggerPDP11.OPS.ASHC,
+        DebuggerPDP11.OPS.XOR,
+        DebuggerPDP11.OPS.SOB
+    ];
+
+    /*
+     * Table of opcodes added to the 11/45 and newer
+     */
+    DebuggerPDP11.OP1145 = [
+        DebuggerPDP11.OPS.SPL,
+        DebuggerPDP11.OPS.MFPD,
+        DebuggerPDP11.OPS.MTPD
+    ];
+
+    DebuggerPDP11.HISTORY_LIMIT = DEBUG? 100000 : 1000;
+
+    DebuggerPDP11.PROMPT = ">> ";
+
+    /*
+     * Initialize every Debugger module on the page (as IF there's ever going to be more than one ;-))
+     */
+    Web.onInit(DebuggerPDP11.init);
+
+}   // endif DEBUGGER
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/pdp11/lib/computer.js (C) Jeff Parsons 2012-2017
+ */
+
+
+class ComputerPDP11 extends Component {
+    /**
+     * ComputerPDP11(parmsComputer, parmsMachine, fSuspended)
+     *
+     * The ComputerPDP11 component has no required (parmsComputer) properties, but it does
+     * support the following:
+     *
+     *      autoPower: true to automatically power the computer (default), false to wait;
+     *      false is honored only if a "power" button binding exists.
+     *
+     *      busWidth: number of memory address lines (address bits) on the computer's "bus";
+     *      20 is the minimum (and the default), which implies 8086/8088 real-mode addressing,
+     *      while 24 is required for 80286 protected-mode addressing.  This value is passed
+     *      directly through to the Bus component; see that component for more details.
+     *
+     *      resume: one of the ComputerPDP11.RESUME constants, which are as follows:
+     *          '0' if resume disabled (default)
+     *          '1' if enabled without prompting
+     *          '2' if enabled with prompting
+     *          '3' if enabled with prompting and auto-delete
+     *          or a string containing the path of a predefined JSON-encoded state
+     *
+     *      state: the path to JSON-encoded state file (see details regarding 'state' below)
+     *
+     * The parmsMachine object, if provided, may contain any of:
+     *
+     *      autoMount: if set, this should override any 'autoMount' property in the FDC's
+     *      parmsFDC object.
+     *
+     *      autoPower: if set, this should override any 'autoPower' property in the ComputerPDP11's
+     *      parmsComputer object.
+     *
+     *      messages: if set, this should override any 'messages' property in the Debugger's
+     *      parmsDbg object.
+     *
+     *      state: if set, this should override any 'state' property in the ComputerPDP11's
+     *      parmsComputer object.
+     *
+     *      url: the location of the machine XML file
+     *
+     * If a predefined state is supplied AND it's successfully loaded, then resume behavior
+     * defaults to '1' (ie, resume enabled without prompting).
+     *
+     * This component insures that all components are ready before "powering" them.
+     *
+     * Different components become ready at different times, and initialization order (ie,
+     * the order the scripts are combined on the page) only partially determines readiness.
+     * This is because components like ROM and Video must finish loading their resource files
+     * before they are ready.  Other components become ready after we call their initBus()
+     * function, because they have a Bus or CPU dependency, such as access to memory management
+     * functions.  And other components, like CPU and Panel, are ready as soon as their
+     * constructor finishes.
+     *
+     * Once a component has indicated it's ready, we call its powerUp() notification
+     * function (if it has one--it's optional).  We call the CPU's powerUp() function last,
+     * so that the CPU is assured that all other components are ready and "powered".
+     *
+     * @param {Object} parmsComputer
+     * @param {Object} [parmsMachine]
+     * @param {boolean} [fSuspended]
+     */
+    constructor(parmsComputer, parmsMachine, fSuspended)
+    {
+        super("Computer", parmsComputer, MessagesPDP11.COMPUTER);
+
+        this.flags.powered = false;
+
+        this.parmsMachine = null;
+        this.setMachineParms(parmsMachine);
+
+        this.fAutoPower = this.getMachineParm('autoPower', parmsComputer, Str.TYPES.BOOLEAN);
+
+        /*
+         * nPowerChange is 0 while the power state is stable, 1 while power is transitioning
+         * to "on", and -1 while power is transitioning to "off".
+         */
+        this.nPowerChange = 0;
+
+        /*
+         * TODO: Deprecate 'buswidth' (it should have always used camelCase)
+         */
+        this.nBusWidth = +parmsComputer['busWidth'] || +parmsComputer['buswidth'];
+
+        this.sResumePath = this.sStatePath = null;
+        this.sStateData = null;
+        this.fStateData = false;            // remembers if sStateData was loaded
+        this.fServerState = false;
+        this.stateComputer = this.stateFailSafe = null;
+        this.fInitialized = this.fReload = this.fRestoreError = false;
+
+        this.url = /** @type {string} */ (this.getMachineParm('url') || "");
+
+        /*
+         * Generate a random number x (where 0 <= x < 1), add 0.1 so that it's guaranteed to be
+         * non-zero, convert to base 36, and chop off the leading digit and "decimal" point.
+         */
+        this.sMachineID = (Math.random() + 0.1).toString(36).substr(2,12);
+        this.sUserID = this.queryUserID();
+
+        /*
+         * Find the appropriate CPU (and Debugger and Control Panel, if any).
+         *
+         * CLOSURE COMPILER TIP: To override the type of a right-hand expression (as we need to do here,
+         * where we know getComponentByType() will only return an CPUState object or null), wrap the expression
+         * in parentheses.  I never knew this until I stumbled across it in "Closure: The Definitive Guide".
+         */
+        this.cpu = /** @type {CPUStatePDP11} */ (Component.getComponentByType("CPU", this.id));
+        if (!this.cpu) {
+            Component.error("Unable to find CPU component");
+            return;
+        }
+        this.dbg = /** @type {DebuggerPDP11} */ (Component.getComponentByType("Debugger", this.id));
+
+        /*
+         * Initialize the Bus component
+         */
+        this.bus = new BusPDP11({'id': this.idMachine + '.bus', 'busWidth': this.nBusWidth}, this.cpu, this.dbg);
+
+        /*
+         * Iterate through all the components and connect them to the Control Panel, if any
+         */
+        var iComponent, component;
+        var aComponents = Component.getComponents(this.id);
+        this.panel = /** @type {PanelPDP11} */ (Component.getComponentByType("Panel", this.id));
+
+        if (this.panel && this.panel.controlPrint) {
+            for (iComponent = 0; iComponent < aComponents.length; iComponent++) {
+                component = aComponents[iComponent];
+                /*
+                 * I can think of many "cleaner" ways for the Control Panel component to pass its
+                 * notice(), println(), etc, overrides on to all the other components, but it's just
+                 * too darn convenient to slam those overrides into the components directly.
+                 */
+                component.notice = this.panel.notice;
+                component.println = this.panel.println;
+                component.controlPrint = this.panel.controlPrint;
+            }
+        }
+
+        this.println(PDP11.APPNAME + " v" + PDP11.APPVERSION + "\n" + COPYRIGHT + "\n" + LICENSE);
+
+        this.println("Portions adapted from the PDP-11/70 Emulator by Paul Nankervis <http://skn.noip.me/pdp11/pdp11.html>");
+
+        if (DEBUG && this.messageEnabled()) this.printMessage("TYPEDARRAYS: " + TYPEDARRAYS);
+
+        /*
+         * Iterate through all the components again and call their initBus() handler, if any
+         */
+        for (iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            component = aComponents[iComponent];
+            if (component.initBus) component.initBus(this, this.bus, this.cpu, this.dbg);
+        }
+
+        var sStatePath = null;
+        var sResume = /** @type {string} */ (this.getMachineParm('resume', parmsComputer));
+        if (sResume !== undefined) {
+            /*
+             * Decide whether the 'resume' property is a number or the path of a state file to resume.
+             */
+            if (sResume.length > 1) {
+                sStatePath = this.sResumePath = sResume;
+            } else {
+                this.resume = parseInt(sResume, 10);
+            }
+        }
+
+        /*
+         * The Computer 'state' property allows a state file to be specified independent of the 'resume' feature;
+         * previously, you could only use 'resume' to load a state file -- which we still support, but loading a state
+         * file that way prevents the machine's state from being saved, since we always resume from the 'resume' file.
+         *
+         * The other wrinkle is on the restore side: we need to IGNORE the 'state' property if a saved state now exists.
+         * So we have to peek at localStorage, and unfortunately, the only way to "peek" is to actually load the data,
+         * but we're not ready to use it yet, so powerUp() has been changed to use any existing stateComputer that we've
+         * already loaded.
+         *
+         * However, there's now a wrinkle to the wrinkle: if a 'state' parameter has been passed via the URL, then that
+         * OVERRIDES everything; it overrides any 'state' Computer parameter AND it disables resume of any saved state in
+         * localStorage (in other words, it prevents fAllowResume from being true, and forcing resume off).
+         */
+        var fAllowResume;
+        var sState = this.getMachineParm('state') || (fAllowResume = true) && parmsComputer['state'];
+
+        if (sState) {
+            this.sStatePath = sStatePath = sState;
+            if (!fAllowResume) {
+                this.fServerState = true;
+                this.resume = ComputerPDP11.RESUME_NONE;
+            }
+            if (this.resume) {
+                this.stateComputer = new State(this, PDP11.APPVERSION);
+                if (this.stateComputer.load()) {
+                    sStatePath = null;
+                } else {
+                    delete this.stateComputer;
+                }
+            }
+        }
+
+        /*
+         * If sStatePath is set, we must use it.  But if there's no sStatePath AND resume is set,
+         * then we have the option of resuming from a server-side state, assuming a valid USERID.
+         */
+        if (!sStatePath && this.resume) {
+            sStatePath = this.getServerStatePath();
+            if (sStatePath) this.fServerState = true;
+        }
+
+        if (!sStatePath) {
+            this.setReady();
+        } else {
+            var cmp = this;
+            Web.getResource(sStatePath, null, true, function doneStateLoad(sURL, sResource, nErrorCode) {
+                cmp.finishStateLoad(sURL, sResource, nErrorCode);
+            });
+        }
+
+        if (!this.bindings["power"]) this.fAutoPower = true;
+
+        /*
+         * Power on the computer, giving every component the opportunity to reset or restore itself.
+         */
+        if (!fSuspended && this.fAutoPower) this.wait(this.powerOn);
+    }
+
+    /**
+     * getMachineID()
+     *
+     * @return {string}
+     */
+    getMachineID()
+    {
+        return this.sMachineID;
+    }
+
+    /**
+     * setMachineParms(parmsMachine)
+     *
+     * If no explicit machine parms were provided, then we check for 'parms' in the bundled resources (if any).
+     *
+     * @param {Object} [parmsMachine]
+     */
+    setMachineParms(parmsMachine)
+    {
+        if (!parmsMachine) {
+            var sParms;
+            if (typeof resources == 'object' && (sParms = resources['parms'])) {
+                try {
+                    parmsMachine = /** @type {Object} */ (eval("(" + sParms + ")"));
+                } catch(e) {
+                    Component.error(e.message + " (" + sParms + ")");
+                }
+            }
+        }
+        this.parmsMachine = parmsMachine;
+    }
+
+    /**
+     * getMachineParm(sParm, parmsComponent, type, defaultValue)
+     *
+     * If the machine parameter doesn't exist, we check for a matching component parameter
+     * (if parmsComponent is provided), and failing that, we check the bundled resources (if any).
+     *
+     * At the moment, the only bundled resource request we expect to encounter is 'state'; if it exists,
+     * then we return 'state' back to the caller (ie, the name of the resource), so that the caller will
+     * then attempt to load the 'state' resource to obtain the actual state.
+     *
+     * TODO: It would be nice if we could tell the Closure Compiler that when a specific type parameter
+     * (eg, Str.TYPES.NUMBER) is used, the return value will be that type; unfortunately, every caller
+     * must coerce their own return value.
+     *
+     * @param {string} sParm
+     * @param {Object|null} [parmsComponent]
+     * @param {number} [type] (from Str.TYPES)
+     * @param {*} [defaultValue]
+     * @return {*}
+     */
+    getMachineParm(sParm, parmsComponent, type, defaultValue)
+    {
+        /*
+         * When checking parmsURL, the check is allowed be a bit looser, because URL parameters are
+         * user-supplied, whereas most other parameters are developer-supplied.  Granted, a developer
+         * may also be sloppy and neglect to use correct case (eg, 'automount' instead of 'autoMount'),
+         * but there are limits to my paranoia.
+         */
+        var sParmLC = sParm.toLowerCase();
+        var value = Web.getURLParm(sParm) || Web.getURLParm(sParmLC);
+        if (value === undefined && this.parmsMachine) value = this.parmsMachine[sParm];
+        if (value === undefined && parmsComponent) value = parmsComponent[sParm];
+        if (value === undefined && typeof resources == 'object' && resources[sParm]) value = sParm;
+        if (value === undefined) value = defaultValue;
+        if (typeof value == "string" && type) {
+            switch(type) {
+            case Str.TYPES.NUMBER:
+                value = +value;
+                if (isNaN(/** @type {number} */(value))) value = defaultValue || 0;
+                break;
+            case Str.TYPES.BOOLEAN:
+                value = (value == "true");
+                break;
+            }
+        }
+        return value;
+    }
+
+    /**
+     * saveMachineParms()
+     *
+     * @return {string|null}
+     */
+    saveMachineParms()
+    {
+        return this.parmsMachine? JSON.stringify(this.parmsMachine) : null;
+    }
+
+    /**
+     * getUserID()
+     *
+     * @return {string}
+     */
+    getUserID()
+    {
+        return this.sUserID || "";
+    }
+
+    /**
+     * finishStateLoad(sURL, sStateData, nErrorCode)
+     *
+     * @this {ComputerPDP11}
+     * @param {string} sURL
+     * @param {string} sStateData
+     * @param {number} nErrorCode
+     */
+    finishStateLoad(sURL, sStateData, nErrorCode)
+    {
+        if (!nErrorCode) {
+            this.sStateData = sStateData;
+            this.fStateData = true;
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage("loaded state file " + sURL.replace(this.sUserID || "xxx", "xxx"));
+            }
+        } else {
+            this.sResumePath = null;
+            this.fServerState = false;
+            this.notice('Unable to load machine state from server (error ' + nErrorCode + (sStateData? ': ' + Str.trim(sStateData) : '') + ')');
+        }
+        this.setReady();
+    }
+
+    /**
+     * wait(fn, parms)
+     *
+     * wait() waits until every component is ready (including ourselves, the last component we check), then calls the
+     * specified Computer method.
+     *
+     * TODO: The Closure Compiler makes it difficult for us to define a function type for "fn" that works in all cases;
+     * sometimes we want to pass a function that takes only a "number", and other times we want to pass a function that
+     * takes only an "Array" (the type will mirror that of the "parms" parameter).  However, the Closure Compiler insists
+     * that both functions must be declared as accepting both types of parameters.  So once again, we must use an untyped
+     * function declaration, instead of something stricter like:
+     *
+     *      param {function(this:Computer, (number|Array|undefined)): undefined} fn
+     *
+     * @this {ComputerPDP11}
+     * @param {function(...)} fn
+     * @param {number|Array} [parms] optional parameters
+     */
+    wait(fn, parms)
+    {
+        var computer = this;
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent <= aComponents.length; iComponent++) {
+            var component = (iComponent < aComponents.length ? aComponents[iComponent] : this);
+            if (!component.isReady()) {
+                component.isReady(function onComponentReady() {
+                    computer.wait(fn, parms);
+                });
+                return;
+            }
+        }
+        if (DEBUG && this.messageEnabled()) this.printMessage("ComputerPDP11.wait(ready)");
+        fn.call(this, parms);
+    }
+
+    /**
+     * validateState(stateComputer)
+     *
+     * NOTE: We clear() stateValidate only when there's no stateComputer.
+     *
+     * @this {ComputerPDP11}
+     * @param {State|null} [stateComputer]
+     * @return {boolean} true if state passes validation, false if not
+     */
+    validateState(stateComputer)
+    {
+        var fValid = true;
+        var stateValidate = new State(this, PDP11.APPVERSION, ComputerPDP11.STATE_VALIDATE);
+        if (stateValidate.load() && stateValidate.parse()) {
+            var sTimestampValidate = stateValidate.get(ComputerPDP11.STATE_TIMESTAMP);
+            var sTimestampComputer = stateComputer? stateComputer.get(ComputerPDP11.STATE_TIMESTAMP) : "unknown";
+            if (sTimestampValidate != sTimestampComputer) {
+                this.notice("Machine state may be out-of-date\n(" + sTimestampValidate + " vs. " + sTimestampComputer + ")\nCheck your browser's local storage limits");
+                fValid = false;
+                if (!stateComputer) stateValidate.clear();
+            } else {
+                if (DEBUG && this.messageEnabled()) {
+                    this.printMessage("Last state: " + sTimestampComputer + " (validate: " + sTimestampValidate + ")");
+                }
+            }
+        }
+        return fValid;
+    }
+
+    /**
+     * powerOn(resume)
+     *
+     * Power every component "up", applying any previously available state information.
+     *
+     * @this {ComputerPDP11}
+     * @param {number} [resume] is a valid RESUME value; default is this.resume
+     */
+    powerOn(resume)
+    {
+        if (resume === undefined) {
+            resume = this.resume || (this.sStateData? ComputerPDP11.RESUME_AUTO : ComputerPDP11.RESUME_NONE);
+        }
+
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("ComputerPDP11.powerOn(" + (resume == ComputerPDP11.RESUME_REPOWER ? "repower" : (resume ? "resume" : "")) + ")");
+        }
+
+        if (this.nPowerChange) {
+            return;
+        }
+        this.nPowerChange++;
+
+        var fRepower = false;
+        var fRestore = false;
+        this.fRestoreError = false;
+        var stateComputer = this.stateComputer || new State(this, PDP11.APPVERSION);
+
+        if (resume == ComputerPDP11.RESUME_REPOWER) {
+            fRepower = true;
+        }
+        else if (resume > ComputerPDP11.RESUME_NONE) {
+            if (stateComputer.load(this.sStateData)) {
+                /*
+                 * Since we're resuming something (either a predefined state or a state from localStorage), let's
+                 * create a "failsafe" checkpoint in localStorage, and destroy it at the end of a successful powerOn().
+                 * Which means, of course, that if a previous "failsafe" checkpoint already exists, something bad
+                 * may have happened the last time around.
+                 */
+                this.stateFailSafe = new State(this, PDP11.APPVERSION, ComputerPDP11.STATE_FAILSAFE);
+                if (this.stateFailSafe.load()) {
+                    this.powerReport(stateComputer);
+                    /*
+                     * We already know resume is something other than RESUME_NONE, so we'll go ahead and bump it
+                     * all the way to RESUME_PROMPT, so that the user will be prompted, and if the user declines to
+                     * restore, the state will be removed.
+                     */
+                    resume = ComputerPDP11.RESUME_PROMPT;
+                    /*
+                     * To ensure that the set() below succeeds, we need to call unload(), otherwise it may fail
+                     * with a "read only" error (eg, "TypeError: Cannot assign to read only property 'timestamp'").
+                     */
+                    this.stateFailSafe.unload();
+                }
+
+                this.stateFailSafe.set(ComputerPDP11.STATE_TIMESTAMP, Usr.getTimestamp());
+                this.stateFailSafe.store();
+
+                var fValidate = this.resume && !this.fServerState;
+                if (resume == ComputerPDP11.RESUME_AUTO || Component.confirmUser("Click OK to restore the previous " + PDP11.APPNAME + " machine state, or CANCEL to reset the machine.")) {
+                    fRestore = stateComputer.parse();
+                    if (fRestore) {
+                        var sCode = /** @type {string} */ (stateComputer.get(UserAPI.RES.CODE));
+                        var sData = /** @type {string} */ (stateComputer.get(UserAPI.RES.DATA));
+                        if (sCode) {
+                            if (sCode == UserAPI.CODE.OK) {
+                                stateComputer.load(sData);
+                            } else {
+                                /*
+                                 * A missing (or not yet created) state file is no cause for alarm, but other errors might be
+                                 */
+                                if (sCode == UserAPI.CODE.FAIL && sData != UserAPI.FAIL.NOSTATE) {
+                                    this.notice("Error: " + sData);
+                                    if (sData == UserAPI.FAIL.VERIFY) this.resetUserID();
+                                } else {
+                                    this.println(sCode + ": " + sData);
+                                }
+                                /*
+                                 * Try falling back to the state that we should have saved in localStorage, as a backup to the
+                                 * server-side state.
+                                 */
+                                stateComputer.unload();     // discard the invalid server-side state first
+                                if (stateComputer.load()) {
+                                    fRestore = stateComputer.parse();
+                                    fValidate = true;
+                                } else {
+                                    fRestore = false;       // hmmm, there was nothing in localStorage either
+                                }
+                            }
+                        }
+                    }
+                    /*
+                     * If the load/parse was successful, and it was from localStorage (not sStateData),
+                     * then we should to try verify that localStorage snapshot is current.  One reason it may
+                     * NOT be current is if localStorage was full and we got a quota error during the last
+                     * powerOff().
+                     */
+                    if (fValidate) this.validateState(fRestore? stateComputer : null);
+                } else {
+                    /*
+                     * RESUME_PROMPT indicates we should delete the state if they clicked Cancel to confirm() above.
+                     */
+                    if (resume == ComputerPDP11.RESUME_PROMPT) stateComputer.clear();
+                }
+            } else {
+                /*
+                 * If there's no state, then there should also be no validation timestamp; if there is, then once again,
+                 * we're probably dealing with a quota error.
+                 */
+                this.validateState();
+            }
+            delete this.sStateData;
+            delete this.stateComputer;
+        }
+
+        /*
+         * Start powering all components, including any data they may need to restore their state;
+         * we restore power to the CPU last.
+         */
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component !== this && component != this.cpu) {
+                fRestore = this.powerRestore(component, stateComputer, fRepower, fRestore);
+            }
+        }
+
+        /*
+         * Assuming this is not a repower, we must perform another wait, because some components may
+         * have marked themselves as "not ready" again (eg, the FDC component, if the restore forced it
+         * to mount one or more additional disk images).
+         */
+        var aParms = [stateComputer, resume, fRestore];
+
+        if (resume != ComputerPDP11.RESUME_REPOWER) {
+            this.wait(this.donePowerOn, aParms);
+            return;
+        }
+        this.donePowerOn(aParms);
+    }
+
+    /**
+     * powerRestore(component, stateComputer, fRepower, fRestore)
+     *
+     * @this {ComputerPDP11}
+     * @param {Component} component
+     * @param {State} stateComputer
+     * @param {boolean} fRepower
+     * @param {boolean} fRestore
+     * @return {boolean} true if restore should continue, false if not
+     */
+    powerRestore(component, stateComputer, fRepower, fRestore)
+    {
+        if (!component.flags.powered) {
+
+            /*
+             * TODO: If all components called super.powerUp(), the powered flag would be set automatically.
+             */
+
+            component.flags.powered = true;
+
+            var data = null;
+
+            try {
+                if (fRestore) {
+                    data = stateComputer.get(component.id);
+                    if (!data) {
+                        /*
+                         * This is a hack that makes it possible for a machine whose ID has been
+                         * supplemented with a suffix (a single letter or digit) to find object IDs
+                         * in states created from a machine without the suffix.
+                         *
+                         * For example, if a state file was created from a machine with ID "ibm5160"
+                         * but the current machine is "ibm5160a", this attempts a second lookup with
+                         * "ibm5160", enabling us to find objects that match the original machine ID
+                         * (eg, "ibm5160.romEGA").
+                         */
+                        data = stateComputer.get(component.id.replace(/[a-z0-9]\./i, '.'));
+                    }
+                }
+
+                /*
+                 * State.get() will return whatever was originally passed to State.set() (eg, an
+                 * Object or a string), but components are supposed to store only Objects, so if a
+                 * string comes back, something went wrong.  By explicitly eliminating "string" data,
+                 * the Closure Compiler stops complaining that we might be passing strings to our
+                 * powerUp() functions (even though we know we're not).
+                 *
+                 * TODO: Determine if there's some way to coerce the Closure Compiler into treating
+                 * data as Object or null, without having to include this runtime check.  An assert
+                 * would be a good idea, but this is overkill.
+                 */
+                if (typeof data === "string") data = null;
+
+                /*
+                 * If computer is null, this is simply a repower notification, which most components
+                 * don't do anything with.  Exceptions include: CPU (since it may be halted) and Video
+                 * (since its screen may be "turned off").
+                 */
+                if (!component.powerUp(data, fRepower) && data) {
+
+                    Component.error("Unable to restore state for " + component.type);
+                    /*
+                     * If this is a resume error for a machine that also has a predefined state
+                     * AND we're not restoring from that state, then throw away the current state,
+                     * prevent any new state from being created, and then force a reload, which will
+                     * hopefully restore us to the functioning predefined state.
+                     *
+                     * TODO: Considering doing this in ALL cases, not just in situations where a
+                     * 'state' exists but we're not actually resuming from it.
+                     */
+                    if (this.sStatePath && !this.fStateData) {
+                        stateComputer.clear();
+                        this.resume = ComputerPDP11.RESUME_NONE;
+                        Web.reloadPage();
+                    } else {
+                        /*
+                         * In all other cases, we set fRestoreError, which should trigger a call to
+                         * powerReport() and then delete the offending state.
+                         */
+                        this.fRestoreError = true;
+                    }
+                    /*
+                     * Any failure triggers an automatic to call powerUp() again, without any state,
+                     * in the hopes that the component can recover by performing a reset.
+                     */
+                    component.powerUp(null);
+                    /*
+                     * We also disable the rest of the restore operation, because it's not clear
+                     * the remaining state information can be trusted;  the machine is already in an
+                     * inconsistent state, so we're not likely to make things worse, and the only
+                     * alternative (starting over and performing a state-less reset) isn't likely to make
+                     * the user any happier.  But, we'll see... we need some experience with the code.
+                     */
+                    fRestore = false;
+                }
+
+                if (!fRepower && component.comment) {
+                    var asComments = component.comment.split("|");
+                    for (var i = 0; i < asComments.length; i++) {
+                        component.status(asComments[i]);
+                    }
+                }
+            }
+            catch (err) {
+                Component.error("Error restoring state for " + component.type + " (" + err.message + ")");
+            }
+        }
+        return fRestore;
+    }
+
+    /**
+     * donePowerOn(aParms)
+     *
+     * This is nothing more than a continuation of powerOn(), giving us the option of calling wait() one more time.
+     *
+     * @this {ComputerPDP11}
+     * @param {Array} aParms containing [stateComputer, resume, fRestore]
+     */
+    donePowerOn(aParms)
+    {
+        var stateComputer = aParms[0];
+        var fRepower = (aParms[1] < 0);
+        var fRestore = aParms[2];
+
+        if (DEBUG && this.flags.powered && this.messageEnabled()) {
+            this.printMessage("ComputerPDP11.donePowerOn(): redundant");
+        }
+
+        this.fInitialized = true;
+        this.flags.powered = true;
+        var controlPower = this.bindings["power"];
+        if (controlPower) controlPower.textContent = "Shutdown";
+
+        /*
+         * Once we get to this point, we're guaranteed that all components are ready, so it's safe to power the CPU;
+         * the CPU should begin executing immediately, unless a debugger is attached.
+         */
+        if (this.cpu) {
+            /*
+             * TODO: Do we not care about the return value here? (ie, is checking fRestoreError sufficient)?
+             */
+            this.powerRestore(this.cpu, stateComputer, fRepower, fRestore);
+            this.updateDisplays(-2);
+            this.cpu.autoStart();
+        }
+
+        /*
+         * If the state was bad, offer to report it and then delete it.  Deleting may be moot, since invariably a new
+         * state will be created on powerOff() before the next powerOn(), but it seems like good paranoia all the same.
+         */
+        if (this.fRestoreError) {
+            this.powerReport(stateComputer);
+            stateComputer.clear();
+        }
+
+        if (!fRepower && this.stateFailSafe) {
+            this.stateFailSafe.clear();
+            delete this.stateFailSafe;
+        }
+
+        this.nPowerChange = 0;
+    }
+
+    /**
+     * checkPower()
+     *
+     * @this {ComputerPDP11}
+     * @return {boolean} true if the computer is fully powered, false otherwise
+     */
+    checkPower()
+    {
+        if (this.flags.powered) return true;
+
+        var component = null, iComponent;
+        var aComponents = Component.getComponents(this.id);
+        for (iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            component = aComponents[iComponent];
+            if (component !== this && !component.flags.ready) break;
+        }
+        if (iComponent == aComponents.length) {
+            for (iComponent = 0; iComponent < aComponents.length; iComponent++) {
+                component = aComponents[iComponent];
+                if (component !== this && !component.flags.powered) break;
+            }
+        }
+        if (iComponent == aComponents.length) component = this;
+        var s = "The " + component.type + " component (" + component.id + ") is not " + (!component.flags.ready? "ready yet" + (component.fnReady? " (waiting for notification)" : "") : "powered yet") + ".";
+        Component.alertUser(s);
+        return false;
+    }
+
+    /**
+     * powerReport(stateComputer)
+     *
+     * @this {ComputerPDP11}
+     * @param {State} stateComputer
+     */
+    powerReport(stateComputer)
+    {
+        if (Component.confirmUser("There may be a problem with your " + PDP11.APPNAME + " machine.\n\nTo help us diagnose it, click OK to send this " + PDP11.APPNAME + " machine state to http://" + SITEHOST + ".")) {
+            Web.sendReport(PDP11.APPNAME, PDP11.APPVERSION, this.url, this.getUserID(), ReportAPI.TYPE.BUG, stateComputer.toString());
+        }
+    }
+
+    /**
+     * powerOff(fSave, fShutdown)
+     *
+     * Power every component "down" and optionally save the machine state.
+     *
+     * There's one scenario that powerOff() isn't currently able to deal with very effectively: what to do when
+     * the user switches away while it's still being restored, causing Disk getResource() calls to fail.  The
+     * Disk component calls notify() when that happens -- see Disk.mount() -- but the FDC and HDC controllers don't
+     * notify *us* of those problems, so Computer assumes that the restore was completely successful, when in fact
+     * it was only partially successful.
+     *
+     * Then we immediately arrive here to perform a save, following that incomplete restore.  It would be wrong to
+     * deal with that incomplete restore by setting fRestoreError, because we don't want to trigger a powerReport()
+     * and the deletion of the previous state, because the state itself was presumably OK.  Unfortunately, the new
+     * state we now save will no longer include manually mounted disk images whose remounts were interrupted, so future
+     * restores won't remount them either.
+     *
+     * We could perhaps solve this by having the Disk component notify us in those situations, set a new flag
+     * (fRestoreIncomplete?), and set fSave to false if that's ever set.  Be careful though: when fSave is false,
+     * that means MORE than not saving; it also means deleting any previous state, which is NOT what you'd want to
+     * do in a "fRestoreIncomplete" situation.  Also, we have to worry about Disk operations that fail for other reasons,
+     * making sure those failures don't interfere with the save process in the same way.
+     *
+     * As it stands, the worst that happens is any manually mounted disk images might have to be manually remounted,
+     * which doesn't seem like a huge problem.
+     *
+     * @this {ComputerPDP11}
+     * @param {boolean} [fSave] is true to request a saved state
+     * @param {boolean} [fShutdown] is true if the machine is being shut down
+     * @return {string|null} string representing the saved state (or null if error)
+     */
+    powerOff(fSave, fShutdown)
+    {
+        var data;
+        var sState = "none";
+
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage("ComputerPDP11.powerOff(" + (fSave ? "save" : "nosave") + (fShutdown ? ",shutdown" : "") + ")");
+        }
+
+        if (this.nPowerChange) {
+            return null;
+        }
+        this.nPowerChange--;
+
+        var stateComputer = new State(this, PDP11.APPVERSION);
+        var stateValidate = new State(this, PDP11.APPVERSION, ComputerPDP11.STATE_VALIDATE);
+
+        var sTimestamp = Usr.getTimestamp();
+        stateValidate.set(ComputerPDP11.STATE_TIMESTAMP, sTimestamp);
+        stateComputer.set(ComputerPDP11.STATE_TIMESTAMP, sTimestamp);
+        stateComputer.set(ComputerPDP11.STATE_VERSION, APPVERSION);
+        stateComputer.set(ComputerPDP11.STATE_HOSTURL, Web.getHostURL());
+        stateComputer.set(ComputerPDP11.STATE_BROWSER, Web.getUserAgent());
+
+        /*
+         * Always power the CPU "down" first, just to help insure it doesn't ask other components to do anything
+         * after they're no longer ready.
+         */
+        if (this.cpu && this.cpu.powerDown) {
+            if (fShutdown) {
+                if (fSave) this.cpu.flags.autoStart = this.cpu.flags.running;
+                this.cpu.stopCPU();
+            }
+            data = this.cpu.powerDown(fSave, fShutdown);
+            if (typeof data === "object") stateComputer.set(this.cpu.id, data);
+            if (fShutdown) {
+                this.cpu.flags.powered = false;
+                if (data === false) sState = null;
+            }
+        }
+
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component.flags.powered) {
+                if (component.powerDown) {
+                    data = component.powerDown(fSave, fShutdown);
+                    if (typeof data === "object") stateComputer.set(component.id, data);
+                }
+                if (fShutdown) {
+                    component.flags.powered = false;
+                    if (data === false) sState = null;
+                }
+            }
+        }
+
+        if (sState) {
+            if (fShutdown) {
+                var fClear = false;
+                var fClearAll = false;
+                if (fSave) {
+                    if (this.sUserID) {
+                        this.saveServerState(this.sUserID, stateComputer.toString());
+                    }
+                    if (!stateValidate.store() || !stateComputer.store()) {
+                        sState = null;
+                        /*
+                         * New behavior as of v1.13.2:  if it appears that localStorage is full, we blow it ALL away.
+                         * Dedicated server-side storage is the only way we'll ever be able to reliably preserve a
+                         * particular machine's state.  Historically, attempting to limp along with whatever localStorage
+                         * is left just generates the same useless and annoying warnings over and over.
+                         */
+                        fClear = fClearAll = true;
+                    }
+                }
+                else {
+                    /*
+                     * I used to ALWAYS clear (ie, delete) any associated computer state, but now I do this only if the
+                     * current machine is "resumable", because there are situations where I have two configurations
+                     * for the same machine -- one resumable and one not -- and I don't want the latter throwing away the
+                     * state of the former.
+                     *
+                     * So this code is here now strictly for callers to delete the state of a "resumable" machine, not as
+                     * some paranoid clean-up operation.
+                     *
+                     * An undocumented feature of this operation is that if your configuration uses the special 'resume="3"'
+                     * value, and you click the "Reset" button, and then you click OK to reset the everything, this will
+                     * actually reset EVERYTHING (ie, all localStorage for ALL configs will be reclaimed).
+                     */
+                    if (this.resume) {
+                        fClear = true;
+                        fClearAll = (this.resume == ComputerPDP11.RESUME_DELETE);
+                    }
+                }
+                if (fClear) {
+                    stateComputer.clear(fClearAll);
+                }
+            } else {
+                sState = stateComputer.toString();
+            }
+        }
+
+        if (fShutdown) {
+            this.flags.powered = false;
+            var controlPower = this.bindings["power"];
+            if (controlPower) controlPower.textContent = "Power";
+        }
+
+        this.nPowerChange = 0;
+
+        return sState;
+    }
+
+    /**
+     * reset()
+     *
+     * Notify all (other) components with a reset() method that the Computer is being reset.
+     *
+     * NOTE: We'd like to reset the Bus first (due to the importance of the A20 line), but since we
+     * allocated the Bus object ourselves, after all the other components were allocated, it ends
+     * up near the end of Component's list of components.  Hence the special case for this.bus below.
+     *
+     * Ditto for the CPU, in part because if the Front Panel resets before the CPU, it will end up
+     * snapping/displaying the PC as of the last instruction executed, before the CPU resets the PC,
+     * causing the Front Panel to display a stale address when we call updateDisplays() at the end.
+     *
+     * @this {ComputerPDP11}
+     */
+    reset()
+    {
+        this.flags.reset = true;
+        if (this.bus && this.bus.reset) {
+            this.printMessage("Resetting " + this.bus.type);
+            this.bus.reset();
+        }
+        if (this.cpu && this.cpu.reset) {
+            this.printMessage("Resetting " + this.cpu.type);
+            this.cpu.reset();
+        }
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component !== this && component !== this.bus && component !== this.cpu && component.reset) {
+                this.printMessage("Resetting " + component.type);
+                component.reset();
+            }
+        }
+        this.flags.reset = false;
+        this.updateDisplays(-1);
+    }
+
+    /**
+     * start(ms, nCycles)
+     *
+     * Notify all (other) components with a start() method that the CPU has started.
+     *
+     * Note that we're called by startCPU(), which is why we exclude the CPU component,
+     * as well as ourselves.
+     *
+     * @this {ComputerPDP11}
+     * @param {number} ms
+     * @param {number} nCycles
+     */
+    start(ms, nCycles)
+    {
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component.type == "CPU" || component === this) continue;
+            if (component.start) {
+                component.start(ms, nCycles);
+            }
+        }
+        this.updateDisplays(-1);
+    }
+
+    /**
+     * stop(ms, nCycles)
+     *
+     * Notify all (other) components with a stop() method that the CPU has stopped.
+     *
+     * Note that we're called by stopCPU(), which is why we exclude the CPU component,
+     * as well as ourselves.
+     *
+     * @this {ComputerPDP11}
+     * @param {number} ms
+     * @param {number} nCycles
+     */
+    stop(ms, nCycles)
+    {
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (component.type == "CPU" || component === this) continue;
+            if (component.stop) {
+                component.stop(ms, nCycles);
+            }
+        }
+        this.updateDisplays(-1);
+    }
+
+    /**
+     * updateDisplays(nUpdate)
+     *
+     * TODO: Notify all components with an updateDisplay() method that the computer's state has changed (not
+     * just the hard-coded ones below).
+     *
+     * If any DOM controls were bound to the CPU, then we need to call its updateDisplay() handler; if there are no
+     * such bindings, then cpu.updateDisplay() does nothing.
+     *
+     * Similarly, if there's a Panel, then we need to call its updateDisplay() handler, in case it created its own canvas
+     * and implemented its own register display (eg, dumpRegisters()); if not, then panel.updateDisplay() also does nothing.
+     *
+     * In practice, there will *either* be a Panel with a custom canvas *or* a set of DOM controls bound to the CPU *or*
+     * neither.  In theory, there could be BOTH, but that would be unusual.
+     *
+     * TODO: Consider alternate approaches to these largely register-oriented display updates.  Ordinarily, we like to
+     * separate logic from presentation, and currently the CPUState contains both, since it's the component that intimately
+     * knows the names, number, sizes, etc, of all the active registers.  The Panel component is the logical candidate,
+     * but Panel is an optional component; it's often the case that only machines that include the Debugger also include
+     * Panel.
+     *
+     * @this {ComputerPDP11}
+     * @param {number} [nUpdate] (1 for periodic, -1 for forced, 0 or undefined otherwise)
+     */
+    updateDisplays(nUpdate)
+    {
+        /*
+         * nUpdate is generally set to -1 whenever the CPU is transitioning to/from a running state, in which case
+         * cpu.updateDisplay() will definitely want to hide/show register contents; however, at other times, when the
+         * CPU is running, constantly updating the DOM controls too frequently can adversely impact overall performance.
+         *
+         * nUpdate will also be -1 whenever the Debugger has modified the state of the machine, implying that we're
+         * not sure what, if anything, actually changed.
+         */
+        if (this.cpu) this.cpu.updateDisplay(nUpdate || 0);
+        if (this.panel) this.panel.updateDisplay(nUpdate || 0);
+    }
+
+    /**
+     * setBinding(sType, sBinding, control, sValue)
+     *
+     * @this {ComputerPDP11}
+     * @param {string|null} sType is the type of the HTML control (eg, "button", "textarea", "register", "flag", "rled", etc)
+     * @param {string} sBinding is the value of the 'binding' parameter stored in the HTML control's "data-value" attribute (eg, "reset")
+     * @param {Object} control is the HTML control DOM object (eg, HTMLButtonElement)
+     * @param {string} [sValue] optional data value
+     * @return {boolean} true if binding was successful, false if unrecognized binding request
+     */
+    setBinding(sType, sBinding, control, sValue)
+    {
+        var computer = this;
+
+        switch (sBinding) {
+        case "power":
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickPower() {
+                computer.onPower();
+            };
+            return true;
+
+        case "reset":
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickReset() {
+                computer.onReset();
+            };
+            return true;
+
+        /*
+         * Technically, this binding should now be called "saveState", to clearly distinguish it from
+         * the "Save Machine" control that's normally bound to the savePC() function in save.js.  Saving
+         * an entire machine includes everything needed to start/restore the machine; eg, the machine
+         * XML configuration file(s) *and* the JSON-encoded machine state.
+         */
+        case "save":
+            /*
+             * Since this feature depends on the server supporting the PCjs User API (see userapi.js),
+             * and since pcjs.org is no longer running a Node web server, we disable the feature for that
+             * particular host.
+             */
+            if (Str.endsWith(Web.getHost(), "pcjs.org")) {
+                if (DEBUG) this.log("Remote user API not available");
+                /*
+                 * We could also simply hide the control; eg:
+                 *
+                 *      control.style.display = "none";
+                 *
+                 * but removing the control altogether seems better.
+                 */
+                control.parentNode.removeChild(/** @type {Node} */ (control));
+                return false;
+            }
+            this.bindings[sBinding] = control;
+            control.onclick = function onClickSave() {
+                var sUserID = computer.queryUserID(true);
+                if (sUserID) {
+                    /*
+                     * I modified the test to include a check for sStatePath so that I could save new states
+                     * for machines with existing states; otherwise, I'd have no (easy) way of capturing and
+                     * updating their state.  Making the machine (even temporarily) resumable would have been
+                     * one work-around, but it's not appropriate for some machines, as their state is simply
+                     * too large (for localStorage anyway, which is the default storage solution).
+                     */
+                    var fSave = !!(computer.resume && !computer.sResumePath || computer.sStatePath);
+                    var sState = computer.powerOff(fSave);
+                    if (fSave) {
+                        computer.saveServerState(sUserID, sState);
+                    } else {
+                        computer.notice("Resume disabled, machine state not saved");
+                    }
+                }
+                /*
+                 * This seemed like a handy alternative, but it turned out to be a no-go, at least for large states:
+                 *
+                 *      var sState = computer.powerOff(true);
+                 *      if (sState) {
+                 *          sState = "data:text/json;charset=utf-8," + encodeURIComponent(sState);
+                 *          window.open(sState);
+                 *      }
+                 *
+                 * Perhaps if I embedded the data in a link on the current page instead; eg:
+                 *
+                 *      $('<a href="' + sState + '" download="state.json">Download</a>').appendTo('#container');
+                 */
+            };
+            return true;
+
+        default:
+            break;
+        }
+        return false;
+    }
+
+    /**
+     * resetUserID()
+     */
+    resetUserID()
+    {
+        Web.setLocalStorageItem(ComputerPDP11.STATE_USERID, "");
+        this.sUserID = null;
+    }
+
+    /**
+     * queryUserID(fPrompt)
+     *
+     * @param {boolean} [fPrompt]
+     * @returns {string|null|undefined}
+     */
+    queryUserID(fPrompt)
+    {
+        var sUserID = this.sUserID;
+        if (!sUserID) {
+            sUserID = Web.getLocalStorageItem(ComputerPDP11.STATE_USERID);
+            if (sUserID !== undefined) {
+                if (!sUserID && fPrompt) {
+                    /*
+                     * NOTE: Warning the user here that "Save" operations are not currently supported by pcjs.org is
+                     * merely a precaution, because ordinarily, setBinding() should have already determined if we are
+                     * running from pcjs.org and disabled any "Save" button.
+                     */
+                    sUserID = Component.promptUser("Saving machine states on the pcjs.org server is currently unsupported.\n\nIf you're running your own server, enter your user ID below.");
+                    if (sUserID) {
+                        sUserID = this.verifyUserID(sUserID);
+                        if (!sUserID) this.notice("The user ID is invalid.");
+                    }
+                }
+            } else if (fPrompt) {
+                this.notice("Browser local storage is not available");
+            }
+        }
+        return sUserID;
+    }
+
+    /**
+     * verifyUserID(sUserID)
+     *
+     * @this {ComputerPDP11}
+     * @param {string} sUserID
+     * @return {string} validated user ID, or null if error
+     */
+    verifyUserID(sUserID)
+    {
+        this.sUserID = null;
+        var fMessages = DEBUG && this.messageEnabled();
+        if (fMessages) this.printMessage("verifyUserID(" + sUserID + ")");
+        var sRequest = Web.getHost() + UserAPI.ENDPOINT + '?' + UserAPI.QUERY.REQ + '=' + UserAPI.REQ.VERIFY + '&' + UserAPI.QUERY.USER + '=' + sUserID;
+        var response = Web.getResource(sRequest);
+        var nErrorCode = response[0];
+        var sResponse = response[1];
+        if (!nErrorCode && sResponse) {
+            try {
+                response = eval("(" + sResponse + ")");
+                if (response.code && response.code == UserAPI.CODE.OK) {
+                    Web.setLocalStorageItem(ComputerPDP11.STATE_USERID, response.data);
+                    if (fMessages) this.printMessage(ComputerPDP11.STATE_USERID + " updated: " + response.data);
+                    this.sUserID = response.data;
+                } else {
+                    if (fMessages) this.printMessage(response.code + ": " + response.data);
+                }
+            } catch (e) {
+                Component.error(e.message + " (" + sResponse + ")");
+            }
+        } else {
+            if (fMessages) this.printMessage("invalid response (error " + nErrorCode + ")");
+        }
+        return this.sUserID;
+    }
+
+    /**
+     * getServerStatePath()
+     *
+     * @this {ComputerPDP11}
+     * @return {string|null} sStatePath (null if no localStorage or no USERID stored in localStorage)
+     */
+    getServerStatePath()
+    {
+        var sStatePath = null;
+        if (this.sUserID) {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage(ComputerPDP11.STATE_USERID + " for load: " + this.sUserID);
+            }
+            sStatePath = Web.getHost() + UserAPI.ENDPOINT + '?' + UserAPI.QUERY.REQ + '=' + UserAPI.REQ.LOAD + '&' + UserAPI.QUERY.USER + '=' + this.sUserID + '&' + UserAPI.QUERY.STATE + '=' + State.key(this, PDP11.APPVERSION);
+        } else {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage(ComputerPDP11.STATE_USERID + " unavailable");
+            }
+        }
+        return sStatePath;
+    }
+
+    /**
+     * saveServerState(sUserID, sState)
+     *
+     * @param {string} sUserID
+     * @param {string|null} sState
+     */
+    saveServerState(sUserID, sState)
+    {
+        /*
+         * We must pass fSync == true, because (as I understand it) browsers will blow off any async
+         * requests when a page is being closed.  Since our request is synchronous, storeServerState()
+         * should also return a result, but there's not much we can do with it, since browsers ALSO
+         * tend to blow off alerts() and the like when closing down.
+         */
+        if (sState) {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage("size of server state: " + sState.length + " bytes");
+            }
+            var response = this.storeServerState(sUserID, sState, true);
+            if (response && response[UserAPI.RES.CODE] == UserAPI.CODE.OK) {
+                this.notice("Machine state saved to server");
+            } else if (sState) {
+                var sError = (response && response[UserAPI.RES.DATA]) || UserAPI.FAIL.BADSTORE;
+                if (response[UserAPI.RES.CODE] == UserAPI.CODE.FAIL) {
+                    sError = "Error: " + sError;
+                } else {
+                    sError = "Error " + response[UserAPI.RES.CODE] + ": " + sError;
+                }
+                this.notice(sError);
+                this.resetUserID();
+            }
+        } else {
+            if (DEBUG && this.messageEnabled()) {
+                this.printMessage("no state to store");
+            }
+        }
+    }
+
+    /**
+     * storeServerState(sUserID, sState, fSync)
+     *
+     * @this {ComputerPDP11}
+     * @param {string} sUserID
+     * @param {string} sState
+     * @param {boolean} [fSync] is true if we're powering down and should perform a synchronous request (default is async)
+     * @return {*} server response if fSync is true and a response was received; otherwise null
+     */
+    storeServerState(sUserID, sState, fSync)
+    {
+        if (DEBUG && this.messageEnabled()) {
+            this.printMessage(ComputerPDP11.STATE_USERID + " for store: " + sUserID);
+        }
+        /*
+         * TODO: Determine whether or not any browsers cancel our request if we're called during a browser "shutdown" event,
+         * and whether or not it matters if we do an async request (currently, we're not, to try to ensure the request goes through).
+         */
+        var dataPost = {};
+        dataPost[UserAPI.QUERY.REQ] = UserAPI.REQ.STORE;
+        dataPost[UserAPI.QUERY.USER] = sUserID;
+        dataPost[UserAPI.QUERY.STATE] = State.key(this, PDP11.APPVERSION);
+        dataPost[UserAPI.QUERY.DATA] = sState;
+        var sRequest = Web.getHost() + UserAPI.ENDPOINT;
+        if (!fSync) {
+            Web.getResource(sRequest, dataPost, true);
+        } else {
+            var response = Web.getResource(sRequest, dataPost);
+            var sResponse = response[0];
+            if (response[1]) {
+                if (sResponse) {
+                    var i = sResponse.indexOf('\n');
+                    if (i > 0) sResponse = sResponse.substr(0, i);
+                    if (!sResponse.indexOf("Error: ")) sResponse = sResponse.substr(7);
+                }
+                sResponse = '{"' + UserAPI.RES.CODE + '":' + response[1] + ',"' + UserAPI.RES.DATA + '":"' + sResponse + '"}';
+            }
+            if (DEBUG && this.messageEnabled()) this.printMessage(sResponse);
+            return JSON.parse(sResponse);
+        }
+        return null;
+    }
+
+    /**
+     * onPower()
+     *
+     * This handles UI requests to toggle the computer's power (eg, see the "power" button binding).
+     *
+     * @this {ComputerPDP11}
+     */
+    onPower()
+    {
+        if (!this.nPowerChange) {
+            if (!this.flags.powered) {
+                this.wait(this.powerOn);
+            } else {
+                this.powerOff(false, true);
+            }
+        }
+    }
+
+    /**
+     * onReset()
+     *
+     * This handles UI requests to reset the computer's state (eg, see the "reset" button binding).
+     *
+     * @this {ComputerPDP11}
+     */
+    onReset()
+    {
+        /*
+         * I'm going to start with the presumption that it makes little sense for an "unpowered" computer to be "reset";
+         * ditto if the power state is currently being changed.
+         */
+        if (!this.flags.powered || this.nPowerChange) return;
+
+        /*
+         * If this is a "resumable" machine (and it's not using a predefined state), then we overload the reset
+         * operation to offer an explicit "save or discard" option first.  This is currently the only UI we offer to
+         * discard a machine's state, including any disk changes.  The traditional "reset" operation is still available
+         * for non-resumable machines.
+         *
+         * TODO: Break this behavior out into a separate "discard" operation, in case the designer of the machine really
+         * wants to clutter the UI with confusing options. ;-)
+         */
+        if (this.resume && !this.sResumePath) {
+            /*
+             * I used to bypass the prompt if this.resume == ComputerPDP11.RESUME_AUTO, setting fSave to true automatically,
+             * but that gives the user no means of resetting a resumable machine that contains errors in its resume state.
+             */
+            var fSave = (/* this.resume == ComputerPDP11.RESUME_AUTO || */ Component.confirmUser("Click OK to save changes to this " + PDP11.APPNAME + " machine.\n\nWARNING: If you CANCEL, all disk changes will be discarded."));
+            this.powerOff(fSave, true);
+            /*
+             * Forcing the page to reload is an expedient option, but ugly. It's preferable to call powerOn()
+             * and rely on all the components to reset themselves to their default state.  The components with
+             * the greatest burden here are FDC and HDC, which must rely on the fReload flag to determine whether
+             * or not to unload/reload all their original auto-mounted disk images.
+             *
+             * However, if we started with a predefined state (ie, sStatePath is set), we take this shortcut, because
+             * we don't (yet) have code in place to gracefully reload the initial state (requires calling getResource()
+             * again); alternatively, we could avoid throwing that state away, but it seems better to save the memory.
+             *
+             * TODO: Make this more graceful, so that we can stop using the reloadPage() sledgehammer.
+             */
+            if (!fSave && this.sStatePath) {
+                Web.reloadPage();
+                return;
+            }
+            if (!fSave) this.fReload = true;
+            this.powerOn(ComputerPDP11.RESUME_NONE);
+            this.fReload = false;
+        } else {
+            this.reset();
+            if (this.cpu && !this.dbg) this.cpu.autoStart();
+        }
+    }
+
+    /**
+     * getMachineComponent(sType, componentPrev)
+     *
+     * @this {ComputerPDP11}
+     * @param {string} sType
+     * @param {Component|null} [componentPrev] of previously returned component, if any
+     * @return {Component|null}
+     */
+    getMachineComponent(sType, componentPrev)
+    {
+        var componentLast = componentPrev;
+        var aComponents = Component.getComponents(this.id);
+        for (var iComponent = 0; iComponent < aComponents.length; iComponent++) {
+            var component = aComponents[iComponent];
+            if (componentPrev) {
+                if (componentPrev == component) componentPrev = null;
+                continue;
+            }
+            if (component.type == sType) return component;
+        }
+        if (!componentLast) Component.log("Machine component type '" + sType + "' not found", "warning");
+        return null;
+    }
+
+    /**
+     * setFocus(fScroll)
+     *
+     * NOTE: When soft keyboard buttons call us to return focus to the machine (and away from the button),
+     * the browser's default behavior is to scroll the element into view, which can be annoying, especially on iOS,
+     * where the display is more constrained, so we no longer do it by default (fScroll must be true).
+     *
+     * @this {ComputerPDP11}
+     * @param {boolean} [fScroll] (true if you really want the control scrolled into view)
+     */
+    setFocus(fScroll)
+    {
+        if (this.controlPrint) {
+            /*
+             * This seems to be recommended work-around to prevent the browser from scrolling the focused element
+             * into view.  The CPU is not a visual component, so when the CPU wants to set focus, the primary intent
+             * is to ensure that keyboard input is fielded properly.
+             */
+            var x = 0, y = 0;
+            if (!fScroll && window) {
+                x = window.scrollX;
+                y = window.scrollY;
+            }
+
+            this.controlPrint.focus();
+
+            if (!fScroll && window) {
+                window.scrollTo(x, y);
+            }
+        }
+    }
+
+    /**
+     * ComputerPDP11.init()
+     *
+     * For every machine represented by an HTML element of class "pdp11-machine", this function
+     * locates the HTML element of class "computer", extracting the JSON-encoded parameters for the
+     * Computer constructor from the element's "data-value" attribute, invoking the constructor to
+     * create a Computer component, and then binding any associated HTML controls to the new component.
+     */
+    static init()
+    {
+        /*
+         * In non-COMPILED builds, embedMachine() may have set XMLVERSION.
+         */
+        if (!COMPILED && XMLVERSION) PDP11.APPVERSION = XMLVERSION;
+
+        var aeMachines = Component.getElementsByClass(document, PDP11.APPCLASS + "-machine");
+
+        for (var iMachine = 0; iMachine < aeMachines.length; iMachine++) {
+
+            var eMachine = aeMachines[iMachine];
+            var parmsMachine = Component.getComponentParms(eMachine);
+
+            var aeComputers = Component.getElementsByClass(eMachine, PDP11.APPCLASS, "computer");
+
+            for (var iComputer = 0; iComputer < aeComputers.length; iComputer++) {
+
+                var eComputer = aeComputers[iComputer];
+                var parmsComputer = Component.getComponentParms(eComputer);
+
+                /*
+                 * We set fSuspended in the Computer constructor because we want to "power up" the
+                 * computer ourselves, after any/all bindings are in place.
+                 */
+                var computer = new ComputerPDP11(parmsComputer, parmsMachine, true);
+
+                if (DEBUG && computer.messageEnabled()) {
+                    computer.printMessage("onInit(" + computer.flags.powered + ")");
+                }
+
+                /*
+                 * Bind any "power", "reset" and "save" buttons.  An "erase" button was also considered,
+                 * but "reset" now provides a way to force the machine to start from scratch again, so "erase"
+                 * may be redundant now.
+                 */
+                Component.bindComponentControls(computer, eComputer, PDP11.APPCLASS);
+
+                /*
+                 * Power on the computer, giving every component the opportunity to reset or restore itself.
+                 */
+                if (computer.fAutoPower) computer.wait(computer.powerOn);
+            }
+        }
+    }
+
+    /**
+     * ComputerPDP11.show()
+     *
+     * When exit() is using an "onbeforeunload" handler, this "onpageshow" handler allows us to repower everything,
+     * without either resetting or restoring.  We call powerOn() with a special resume value (RESUME_REPOWER) if the
+     * computer is already marked as "ready", meaning the browser didn't change anything.  This "repower" process
+     * should be very quick, essentially just marking all components as powered again (so that, for example, the Video
+     * component will start drawing again) and firing the CPU up again.
+     */
+    static show()
+    {
+        var aeComputers = Component.getElementsByClass(document, PDP11.APPCLASS, "computer");
+        for (var iComputer = 0; iComputer < aeComputers.length; iComputer++) {
+            var eComputer = aeComputers[iComputer];
+            var parmsComputer = Component.getComponentParms(eComputer);
+            var computer = /** @type {ComputerPDP11} */ (Component.getComponentByType("Computer", parmsComputer['id']));
+            if (computer) {
+
+                if (DEBUG && computer.messageEnabled()) {
+                    computer.printMessage("onShow(" + computer.fInitialized + "," + computer.flags.powered + ")");
+                }
+
+                /*
+                 * Note that the FIRST 'onpageshow' event, and therefore the first show() callback, occurs
+                 * AFTER the the initial 'onload' event, and at that point in time, fInitialized will not be set yet.
+                 * So, practically speaking, the first show() callback isn't all that useful.
+                 */
+                if (computer.fInitialized && !computer.flags.powered) {
+                    /**
+                     * Repower the computer, notifying every component to continue running as-is.
+                     */
+                    computer.powerOn(ComputerPDP11.RESUME_REPOWER);
+                }
+            }
+        }
+    }
+
+    /**
+     * ComputerPDP11.exit()
+     *
+     * The Computer is currently the only component that uses an "exit" handler, which Web.onExit() defines as
+     * either an "unload" or "onbeforeunload" handler.  This gives us the opportunity to save the machine state,
+     * using our powerOff() function, before the page goes away.
+     *
+     * It's worth noting that "onbeforeunload" offers one nice feature when used instead of "onload": the entire
+     * page (and therefore this entire application) is retained in its current state by the browser (well, some
+     * browsers), so that if you go to a new URL, either by entering a new URL in the same window/tab, or by pressing
+     * the FORWARD button, and then you press the BACK button, the page is immediately restored to its previous state.
+     *
+     * In fact, that's how some browsers operate whether you have an "onbeforeunload" handler or not; in other words,
+     * an "onbeforeunload" handler doesn't change the page retention behavior of the browser.  By contrast, the mere
+     * presence of an "onunload" handler generally causes a browser to throw the page away once the handler returns.
+     *
+     * However, in order to safely use "onbeforeunload", we must add yet another handler ("onpageshow") to repower
+     * everything, without either resetting or restoring.  Hence, the ComputerPDP11.show() function, which calls powerOn()
+     * with a special resume value (RESUME_REPOWER) if the computer is already marked as "ready", meaning the browser
+     * didn't change anything.  This "repower" process should be very quick, essentially just marking all components as
+     * powered again (so that, for example, the Video component will start drawing again) and firing the CPU up again.
+     *
+     * Reportedly, some browsers (eg, Opera) don't support "onbeforeunload", in which case Component will have to use
+     * "unload" instead.  But even when the page must be rebuilt from scratch, the combination of browser cache and
+     * localStorage means the simulation should be restored and become operational almost immediately.
+     */
+    static exit()
+    {
+        var aeComputers = Component.getElementsByClass(document, PDP11.APPCLASS, "computer");
+        for (var iComputer = 0; iComputer < aeComputers.length; iComputer++) {
+            var eComputer = aeComputers[iComputer];
+            var parmsComputer = Component.getComponentParms(eComputer);
+            var computer = /** @type {ComputerPDP11} */ (Component.getComponentByType("Computer", parmsComputer['id']));
+            if (computer) {
+
+                if (DEBUG && computer.messageEnabled()) {
+                    computer.printMessage("onExit(" + computer.flags.powered + ")");
+                }
+
+                if (computer.flags.powered) {
+                    /**
+                     * Power off the computer, giving every component an opportunity to save its state,
+                     * but only if 'resume' has been set AND there is no valid resume path (because if a valid resume
+                     * path exists, we'll always load our state from there, and not from whatever we save here).
+                     */
+                    computer.powerOff(!!(computer.resume && !computer.sResumePath), true);
+                }
+            }
+        }
+    }
+}
+
+ComputerPDP11.STATE_FAILSAFE  = "failsafe";
+ComputerPDP11.STATE_VALIDATE  = "validate";
+ComputerPDP11.STATE_TIMESTAMP = "timestamp";
+ComputerPDP11.STATE_VERSION   = "version";
+ComputerPDP11.STATE_HOSTURL   = "url";
+ComputerPDP11.STATE_BROWSER   = "browser";
+ComputerPDP11.STATE_USERID    = "user";
+
+/*
+ * The following constants define all the resume options.  Negative values (eg, RESUME_REPOWER) are for
+ * internal use only, and RESUME_DELETE is not documented (it provides a way of deleting ALL saved states
+ * whenever a resume is declined).  As a result, the only "end-user" values are 0, 1 and 2.
+ */
+ComputerPDP11.RESUME_REPOWER  = -1;  // resume without changing any state (for internal use only)
+ComputerPDP11.RESUME_NONE     =  0;  // default (no resume)
+ComputerPDP11.RESUME_AUTO     =  1;  // automatically save/restore state
+ComputerPDP11.RESUME_PROMPT   =  2;  // automatically save but conditionally restore (WARNING: if restore is declined, any state is discarded)
+ComputerPDP11.RESUME_DELETE   =  3;  // same as RESUME_PROMPT but discards ALL machines states whenever ANY machine restore is declined (undocumented)
+
+/*
+ * Initialize every Computer on the page.
+ */
+Web.onInit(ComputerPDP11.init);
+Web.onShow(ComputerPDP11.show);
+Web.onExit(ComputerPDP11.exit);
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/state.js (C) Jeff Parsons 2012-2017
+ */
+
+
+class State {
+    /**
+     * State(component, sVersion, sSuffix)
+     *
+     * State objects are used by components to save/restore their state.
+     *
+     * During a save operation, components add data to a State object via set(), and then return
+     * the resulting data using data().
+     *
+     * During a restore operation, the Computer component passes the results of each data() call
+     * back to the originating component.
+     *
+     * WARNING: Since State objects are low-level objects that have no UI requirements, they do not
+     * inherit from the Component class, so you should only use class methods of Component, such as
+     * Component.assert() (or Debugger methods if the Debugger is available).
+     *
+     * NOTE: 1.01 is the first version to provide limited save/restore support using localStorage.
+     * From that point on, care must be taken to insure that any new version that's incompatible with
+     * previous localStorage data be released with a version number that is at least 1 greater,
+     * since we're tagging the localStorage data with the integer portion of the version string.
+     *
+     * @param {Component} component
+     * @param {string} [sVersion] is used to append a major version number to the key
+     * @param {string} [sSuffix] is used to append any additional suffixes to the key
+     */
+    constructor(component, sVersion, sSuffix)
+    {
+        this.id = component.id;
+        this.dbg = component.dbg;
+        this.json = "";
+        this.state = {};
+        this.fLoaded = this.fParsed = false;
+        this.key = State.key(component, sVersion, sSuffix);
+        this.unload(component.parms);
+    }
+
+    /**
+     * set(id, data)
+     *
+     * @this {State}
+     * @param {number|string} id
+     * @param {Object|string} data
+     */
+    set(id, data)
+    {
+        try {
+            this.state[id] = data;
+        } catch(e) {
+            Component.log(e.message);
+        }
+    }
+
+    /**
+     * get(id)
+     *
+     * @this {State}
+     * @param {number|string} id
+     * @return {Object|string|null}
+     */
+    get(id)
+    {
+        return this.state[id] || null;
+    }
+
+    /**
+     * data()
+     *
+     * @this {State}
+     * @return {Object}
+     */
+    data()
+    {
+        return this.state;
+    }
+
+    /**
+     * load(json)
+     *
+     * WARNING: Make sure you follow this call with either a call to parse() or unload(),
+     * because any stringified data that we've loaded isn't usable until it's been parsed.
+     *
+     * @this {State}
+     * @param {string|null} [json]
+     * @return {boolean} true if state exists in localStorage, false if not
+     */
+    load(json)
+    {
+        if (json) {
+            this.json = json;
+            this.fLoaded = true;
+            this.fParsed = false;
+            return true;
+        }
+        if (this.fLoaded) {
+            /*
+             * This is assumed to be a redundant load().
+             */
+            return true;
+        }
+        if (Web.hasLocalStorage()) {
+            var s = Web.getLocalStorageItem(this.key);
+            if (s) {
+                this.json = s;
+                this.fLoaded = true;
+                if (DEBUG) Component.log("localStorage(" + this.key + "): " + s.length + " bytes loaded");
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * parse()
+     *
+     * This completes the load() operation, by parsing what was loaded, on the assumption there
+     * might be some benefit to deferring parsing until we've given the user a chance to confirm.
+     * Otherwise, load() could have just as easily done this, too.
+     *
+     * @this {State}
+     * @return {boolean} true if successful, false if error
+     */
+    parse()
+    {
+        var fSuccess = true;
+        if (!this.fParsed) {
+            try {
+                this.state = JSON.parse(this.json);
+                this.fParsed = true;
+            } catch (e) {
+                Component.error(e.message || e);
+                fSuccess = false;
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * store()
+     *
+     * @this {State}
+     * @return {boolean} true if successful, false if error
+     */
+    store()
+    {
+        var fSuccess = true;
+        if (Web.hasLocalStorage()) {
+            var s = JSON.stringify(this.state);
+            if (Web.setLocalStorageItem(this.key, s)) {
+                if (DEBUG) Component.log("localStorage(" + this.key + "): " + s.length + " bytes stored");
+            } else {
+                /*
+                 * WARNING: Because browsers tend to disable all alerts() during an "unload" operation,
+                 * it's unlikely anyone will ever see the "quota" errors that occur at this point.  Need to
+                 * think of some way to notify the user that there's a problem, and offer a way of cleaning
+                 * up old states.
+                 */
+                Component.error("Unable to store " + s.length + " bytes in browser local storage");
+                fSuccess = false;
+            }
+        }
+        return fSuccess;
+    }
+
+    /**
+     * toString()
+     *
+     * @this {State}
+     * @return {string} JSON-encoded state
+     */
+    toString()
+    {
+        return this.state? JSON.stringify(this.state) : this.json;
+    }
+
+    /**
+     * unload(parms)
+     *
+     * This discards any data saved via set() or loaded via load(), creating an empty State object.
+     * Note that you have to follow this call with an explicit call to store() if you want to remove
+     * the state from localStorage as well.
+     *
+     * @this {State}
+     * @param {Object} [parms]
+     */
+    unload(parms)
+    {
+        this.json = "";
+        this.state = {};
+        this.fLoaded = this.fParsed = false;
+        if (parms) this.set("parms", parms);
+    }
+
+    /**
+     * clear(fAll)
+     *
+     * This unloads the current state, and then clears ALL localStorage for the current machine,
+     * independent of version, to reduce the chance of orphaned states wasting part of our limited allocation.
+     *
+     * @this {State}
+     * @param {boolean} [fAll] true to unconditionally clear ALL localStorage for the current domain
+     */
+    clear(fAll)
+    {
+        this.unload();
+        var aKeys = Web.getLocalStorageKeys();
+        for (var i = 0; i < aKeys.length; i++) {
+            var sKey = aKeys[i];
+            if (sKey && (fAll || sKey.substr(0, this.key.length) == this.key)) {
+                Web.removeLocalStorageItem(sKey);
+                if (DEBUG) Component.log("localStorage(" + sKey + ") removed");
+                aKeys.splice(i, 1);
+                i = 0;
+            }
+        }
+    }
+
+    /**
+     * State.key(component, sVersion, sSuffix)
+     *
+     * This encapsulates the key generation code.
+     *
+     * @param {Component} component
+     * @param {string} [sVersion] is used to append a major version number to the key
+     * @param {string} [sSuffix] is used to append any additional suffixes to the key
+     * @return {string} key
+     */
+    static key(component, sVersion, sSuffix)
+    {
+        var key = component.id;
+        if (sVersion) {
+            var i = sVersion.indexOf('.');
+            if (i > 0) key += ".v" + sVersion.substr(0, i);
+        }
+        if (sSuffix) {
+            key += "." + sSuffix;
+        }
+        return key;
+    }
+
+    /**
+     * State.compress(aSrc)
+     *
+     * @param {Array.<number>|null} aSrc
+     * @return {Array.<number>|null} is either the original array (aSrc), or a smaller array of "count, value" pairs (aComp)
+     */
+    static compress(aSrc)
+    {
+        if (aSrc) {
+            var iSrc = 0;
+            var iComp = 0;
+            var aComp = [];
+            while (iSrc < aSrc.length) {
+                var n = aSrc[iSrc];
+
+                var iCompare = iSrc + 1;
+                while (iCompare < aSrc.length && aSrc[iCompare] === n) iCompare++;
+                aComp[iComp++] = iCompare - iSrc;
+                aComp[iComp++] = n;
+                iSrc = iCompare;
+            }
+            if (aComp.length < aSrc.length) return aComp;
+        }
+        return aSrc;
+    }
+
+    /**
+     * State.decompress(aComp)
+     *
+     * @param {Array.<number>} aComp
+     * @param {number} nLength is expected length of decompressed data
+     * @return {Array.<number>}
+     */
+    static decompress(aComp, nLength)
+    {
+        var iDst = 0;
+        var aDst = new Array(nLength);
+        var iComp = 0;
+        while (iComp < aComp.length - 1) {
+            var c = aComp[iComp++];
+            var n = aComp[iComp++];
+            while (c--) {
+                aDst[iDst++] = n;
+            }
+        }
+
+        return aDst;
+    }
+
+    /**
+     * State.compressEvenOdd(aSrc)
+     *
+     * This is a very simple variation on compress() that compresses all the EVEN elements of aSrc first,
+     * followed by all the ODD elements.  This tends to work better on EGA video memory, because when odd/even
+     * addressing is enabled (eg, for text modes), the DWORD values tend to alternate, which is the worst case
+     * for compress(), but the best case for compressEvenOdd().
+     *
+     * One wrinkle we support: if the first element is uninitialized, then we assume the entire array is undefined,
+     * and return an empty compressed array.  Conversely, decompressEvenOdd() will take an empty compressed array
+     * and return an uninitialized array.
+     *
+     * @param {Array.<number>|null} aSrc
+     * @return {Array.<number>|null} is either the original array (aSrc), or a smaller array of "count, value" pairs (aComp)
+     */
+    static compressEvenOdd(aSrc)
+    {
+        if (aSrc) {
+            var iComp = 0, aComp = [];
+            if (aSrc[0] !== undefined) {
+                for (var off = 0; off < 2; off++) {
+                    var iSrc = off;
+                    while (iSrc < aSrc.length) {
+                        var n = aSrc[iSrc];
+                        var iCompare = iSrc + 2;
+                        while (iCompare < aSrc.length && aSrc[iCompare] === n) iCompare += 2;
+                        aComp[iComp++] = (iCompare - iSrc) >> 1;
+                        aComp[iComp++] = n;
+                        iSrc = iCompare;
+                    }
+                }
+            }
+            if (aComp.length < aSrc.length) return aComp;
+        }
+        return aSrc;
+    }
+
+    /**
+     * State.decompressEvenOdd(aComp, nLength)
+     *
+     * This is the counterpart to compressEvenOdd().  Note that because there's nothing in the compressed sequence
+     * that differentiates a compress() sequence from a compressEvenOdd() sequence, you simply have to be consistent:
+     * if you used even/odd compression, then you must use even/odd decompression.
+     *
+     * @param {Array.<number>} aComp
+     * @param {number} nLength is expected length of decompressed data
+     * @return {Array.<number>}
+     */
+    static decompressEvenOdd(aComp, nLength)
+    {
+        var iDst = 0;
+        var aDst = new Array(nLength);
+        var iComp = 0;
+        while (iComp < aComp.length - 1) {
+            var c = aComp[iComp++];
+            var n = aComp[iComp++];
+            while (c--) {
+                aDst[iDst] = n;
+                iDst += 2;
+            }
+            /*
+             * The output of a "count,value" pair will never exceed the end of the output array, so as soon as we reach it
+             * the first time, we know it's time to switch to ODD elements, and as soon as we reach it again, we should be
+             * done.
+             */
+
+            if (iDst == nLength) iDst = 1;
+        }
+
+        return aDst;
+    }
+}
+
+
+
+/**
+ * @copyright http://pcjs.org/modules/shared/lib/embed.js (C) Jeff Parsons 2012-2017
+ */
+
+
+/*
+ * We now support asynchronous XML and XSL file loads; simply set fAsync (below) to true.
+ *
+ * NOTE: For that support to work, we have to keep track of the number of machines on the page
+ * (ie, how many embedMachine() calls were issued), reduce the count as each machine XML file
+ * is fully transformed into HTML, and when the count finally returns to zero, notify all the
+ * machine component init() handlers.
+ *
+ * Also, to prevent those init() handlers from running prematurely, we must disable all page
+ * notification events at the start of the embedding process (Web.enablePageEvents(false)) and
+ * re-enable them at the end (Web.enablePageEvents(true)).
+ */
+var fAsync = true;
+var cAsyncMachines = 0;
+
+/**
+ * loadXML(sFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+ *
+ * This is the preferred way to load all XML and XSL files. It uses getResource()
+ * to load them as strings, which parseXML() can massage before parsing/transforming them.
+ *
+ * For example, since I've been unable to get the XSLT document() function to work inside any
+ * XSL document loaded by JavaScript's XSLT processor, that has prevented me from dynamically
+ * loading any XML machine file that uses the "ref" attribute to refer to and incorporate
+ * another XML document.
+ *
+ * To solve that, I've added an fResolve parameter that tells parseXML() to fetch any
+ * referenced documents ITSELF and insert them into the XML string prior to parsing, instead
+ * of relying on the XSLT template to pull them in.  That fetching is handled by resolveXML(),
+ * which iterates over the XML until all "refs" have been resolved (including any nested
+ * references).
+ *
+ * Also, XSL files with a <!DOCTYPE [...]> cause MSIE's Microsoft.XMLDOM.loadXML() function
+ * to choke, so I strip that out prior to parsing as well.
+ *
+ * TODO: Figure out why the XSLT document() function works great when the web browser loads an
+ * XML file (and the associated XSL file) itself, but does not work when loading documents via
+ * JavaScript XSLT support. Is it broken, is it a security issue, or am I just calling it wrong?
+ *
+ * @param {string} sXMLFile
+ * @param {string|null|undefined} idMachine
+ * @param {string|null|undefined} sAppName
+ * @param {string|null|undefined} sAppClass
+ * @param {string|null|undefined} sParms
+ * @param {boolean} fResolve is true to resolve any "ref" attributes
+ * @param {function(string)} display
+ * @param {function(string,Object)} done (string contains the unparsed XML string data, and Object contains a parsed XML object)
+ */
+function loadXML(sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+{
+    var doneLoadXML = function(sURLName, sXML, nErrorCode) {
+        if (nErrorCode) {
+            if (!sXML) sXML = "unable to load " + sXMLFile + " (" + nErrorCode + ")";
+            done(sXML, null);
+            return;
+        }
+        parseXML(sXML, sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done);
+    };
+    display("Loading " + sXMLFile + "...");
+    Web.getResource(sXMLFile, null, fAsync, doneLoadXML);
+}
+
+/**
+ * parseXML(sXML, sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+ *
+ * Generates an XML document from an XML string. This function also provides a work-around for XSLT's
+ * lack of support for the document() function (at least on some browsers), by replacing every reference
+ * tag (ie, a tag with a "ref" attribute) with the contents of the referenced file.
+ *
+ * @param {string} sXML
+ * @param {string|null} sXMLFile
+ * @param {string|null|undefined} idMachine
+ * @param {string|null|undefined} sAppName
+ * @param {string|null|undefined} sAppClass
+ * @param {string|null|undefined} sParms
+ * @param {boolean} fResolve is true to resolve any "ref" attributes; default is false
+ * @param {function(string)} display
+ * @param {function(string,Object)} done (string contains the unparsed XML string data, and Object contains a parsed XML object)
+ */
+function parseXML(sXML, sXMLFile, idMachine, sAppName, sAppClass, sParms, fResolve, display, done)
+{
+    var buildXML = function(sXML, sError) {
+        if (sError) {
+            done(sError, null);
+            return;
+        }
+        if (idMachine) {
+
+            /*
+             * A more sensible place to record the machine XML would be embedMachine(), like we do for the
+             * XSL file, but since we're about to modify the original machine XML, it's best to record it now.
+             */
+            Component.addMachineResource(idMachine, sXMLFile, sXML);
+
+            var sURL = sXMLFile;
+            if (sURL && sURL.indexOf('/') < 0 && window.location.pathname.slice(-1) == '/') {
+                sURL = window.location.pathname + sURL;
+            }
+            /*
+             * We embed the URL of the XML file both as a separate "xml" attribute for easy access from the
+             * XSL file, and as part of the "parms" attribute for easy access from machines (see getMachineParm()).
+             */
+            if (!sParms) {
+                sParms = '{';
+            } else if (sParms.slice(-1) == '}') {
+                sParms = sParms.slice(0, -1);
+                if (sParms.length > 1) sParms += ',';
+            } else {            // sParms must just be a "state" file, so encode it as a "state" property
+                sParms = '{state:"' + sParms + '",';
+            }
+            sParms += 'url:"' + sURL + '"}';
+            /*
+             * Note that while we no longer generate a machine XML file with a "state" attribute (because it's
+             * encoded inside the "parms" attribute), the XSL file must still cope with "state" attributes inside
+             * other XML files; for example, manifest XML files like /apps/pc/1981/visicalc/manifest.xml contain
+             * machine elements with "state" attributes that must still be passed down to the computer element
+             * "the old fashioned way".
+             *
+             * Until/unless that changes, components.xsl cannot be simplified as much as I might have hoped.
+             */
+            if (typeof resources == 'object') sURL = null;      // turn off URL inclusion if we have embedded resources
+            sXML = sXML.replace(/(<machine[^>]*\sid=)(['"]).*?\2/, "$1$2" + idMachine + "$2" + (sParms? " parms='" + sParms + "'" : "") + (sURL? ' url="' + sURL + '"' : ''));
+        }
+
+        if (!fResolve) {
+            /*
+             * I'm trying to switch to a shared components.xsl (at least for all PC-class machines),
+             * but in the interim, that means hacking the XSL file on the fly to reflect the actual class.
+             */
+            sXML = sXML.replace(/(<xsl:variable name="APPNAME">).*?(<\/xsl:variable>)/, "$1" + sAppName + "$2");
+            sXML = sXML.replace(/(<xsl:variable name="APPCLASS">).*?(<\/xsl:variable>)/, "$1" + sAppClass + "$2");
+
+            /*
+             * Non-COMPILED kludge to replace the version number template in the XSL file (which we assume we're reading,
+             * since fResolve is false) with whatever XMLVERSION we extracted from the XML file (see corresponding kludge below).
+             *
+             * ES6 ALERT: Template strings.
+             */
+            if (!COMPILED && XMLVERSION) {
+                sXML = sXML.replace(/<xsl:variable name="APPVERSION">1.x.x<\/xsl:variable>/, `<xsl:variable name="APPVERSION">${XMLVERSION}</xsl:variable>`);
+            }
+        }
+
+        /*
+         * If the resource we requested is not really an XML file (or the file didn't exist and the server simply returned
+         * a message like "Cannot GET /devices/pc/machine/5150/cga/64kb/donkey/machine.xml"), we'd like to display a more
+         * meaningful message, because the XML DOM parsers will blithely return a document that contains nothing useful; eg:
+         *
+         *      This page contains the following errors:error on line 1 at column 1:
+         *      Document is empty Below is a rendering of the page up to the first error.
+         *
+         * Supposedly, the IE XML DOM parser will throw an exception, but I haven't tested that, and unless all other
+         * browsers do that, that's not helpful.
+         *
+         * The best I can do at this stage (assuming Web.getResource() didn't drop any error information on the floor)
+         * is verify that the requested resource "looks like" valid XML (in other words, it begins with a '<').
+         */
+        var xmlDoc = null;
+        if (sXML.charAt(0) == '<') {
+            try {
+                /*
+                 * Another hack for MSIE, which fails to load XSL documents containing a <!DOCTYPE [...]> tag.
+                 *
+                 * This is also why the XSLTProcessor 'transformToFragment' method in Microsoft Edge silently failed,
+                 * so I had pull this hack out of the "ActiveXObject" code.  And rather than add yet-another Microsoft
+                 * browser check, I'm going to try doing this across the board, and hope that none of the other XSLT
+                 * processors fail *without* the DOCTYPE tag.
+                 */
+                if (!fResolve) {
+                    sXML = sXML.replace(/<!DOCTYPE(.|[\r\n])*]>\s*/g, "");
+                }
+                /*
+                 * Beginning with Microsoft Edge and the corresponding release of Windows 10, all the
+                 * 'ActiveXObject' crud has gone away; but of course, this code must remain in place if
+                 * we want to continue supporting older Internet Explorer browsers (ie, back to IE9).
+                 */
+                /** @namespace window.ActiveXObject */
+                if (window.ActiveXObject || 'ActiveXObject' in window) {        // second test is required for IE11 on Windows 8.1
+                    xmlDoc = new window.ActiveXObject("Microsoft.XMLDOM");
+                    xmlDoc.async = false;
+                    xmlDoc['loadXML'](sXML);
+                } else {
+                    /** @namespace window.DOMParser */
+                    xmlDoc = (new window.DOMParser()).parseFromString(sXML, "text/xml");
+                }
+            } catch(e) {
+                xmlDoc = null;
+                sXML = e.message;
+            }
+        } else {
+            sXML = "unrecognized XML: " + (sXML.length > 255? sXML.substr(0, 255) + "..." : sXML);
+        }
+        done(sXML, xmlDoc);
+    };
+    if (sXML) {
+        if (PRIVATE) sXML = sXML.replace(/\/library.xml/, "/private/library.xml");
+        if (fResolve) {
+            resolveXML(sXML, display, buildXML);
+            return;
+        }
+        buildXML(sXML, null);
+        return;
+    }
+    done("no data" + (sXMLFile? " for file: " + sXMLFile : ""), null);
+}
+
+/**
+ * resolveXML(sXML, display, done)
+ *
+ * Replaces every tag with a "ref" attribute with the contents of the corresponding file.
+ *
+ * TODO: Fix some of the limitations of this code, such as: 1) requiring the "ref" attribute
+ * to appear as the tag's first attribute, 2) requiring the "ref" attribute to be double-quoted,
+ * and 3) requiring the "ref" tag to be self-closing.
+ *
+ * @param {string} sXML
+ * @param {function(string)} display
+ * @param {function(string,(string|null))} done (the first string contains the resolved XML data, the second is for any error message)
+ */
+function resolveXML(sXML, display, done)
+{
+    var matchRef;
+    var reRef = /<([a-z]+)\s+ref="(.*?)"(.*?)\/>/g;
+
+    if ((matchRef = reRef.exec(sXML))) {
+
+        var sRefFile = matchRef[2];
+
+        var doneReadXML = function(sURLName, sXMLRef, nErrorCode) {
+            if (nErrorCode || !sXMLRef) {
+                done(sXML, "unable to resolve XML reference: " + matchRef[0] + " (" + nErrorCode + ")");
+                return;
+            }
+            /*
+             * If there are additional attributes in the "referring" XML tag, we want to insert them
+             * into the "referred" XML tag; attributes that don't exist in the referred tag should be
+             * appended, and attributes that DO exist should be overwritten.
+             */
+            var sRefAttrs = matchRef[3];
+            if (sRefAttrs) {
+                var aXMLRefTag = sXMLRef.match(new RegExp("<" + matchRef[1] + "[^>]*>"));
+                if (aXMLRefTag) {
+                    var sXMLNewTag = aXMLRefTag[0];
+                    /*
+                     * Iterate over all the attributes in the "referring" XML tag (sRefAttrs)
+                     */
+                    var matchAttr;
+                    var reAttr = /( [a-z]+=)(['"])(.*?)\2/g;
+                    while ((matchAttr = reAttr.exec(sRefAttrs))) {
+                        if (sXMLNewTag.indexOf(matchAttr[1]) < 0) {
+                            /*
+                             * This is the append case
+                             */
+                            sXMLNewTag = sXMLNewTag.replace(">", matchAttr[0] + ">");
+                        } else {
+                            /*
+                             * This is the overwrite case
+                             */
+                            sXMLNewTag = sXMLNewTag.replace(new RegExp(matchAttr[1] + "(['\"])(.*?)\\1"), matchAttr[0]);
+                        }
+                    }
+                    if (aXMLRefTag[0] != sXMLNewTag) {
+                        sXMLRef = sXMLRef.replace(aXMLRefTag[0], sXMLNewTag);
+                    }
+                } else {
+                    done(sXML, "missing <" + matchRef[1] + "> in " + sRefFile);
+                    return;
+                }
+            }
+
+            /*
+             * Apparently when a Windows Azure server delivers one of my XML files, it may modify the first line:
+             *
+             *      <?xml version="1.0" encoding="UTF-8"?>\n
+             *
+             * I didn't determine exactly what it was doing at this point (probably just changing the \n to \r\n),
+             * but in any case, relaxing the following replace() solved it.
+             */
+            sXMLRef = sXMLRef.replace(/<\?xml[^>]*>[\r\n]*/, "");
+
+            sXML = sXML.replace(matchRef[0], sXMLRef);
+
+            resolveXML(sXML, display, done);
+        };
+
+        display("Loading " + sRefFile + "...");
+        Web.getResource(sRefFile, null, fAsync, doneReadXML);
+        return;
+    }
+    done(sXML, null);
+}
+
+/**
+ * embedMachine(sAppName, sAppClass, sVersion, idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * This allows to you embed a machine on a web page, by transforming the machine XML into HTML.
+ *
+ * @param {string} sAppName is the app name (eg, "PCx86")
+ * @param {string} sAppClass is the app class (eg, "pcx86"); also known as the machine class
+ * @param {string} sVersion is the app version (eg, "1.15.7")
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedMachine(sAppName, sAppClass, sVersion, idMachine, sXMLFile, sXSLFile, sParms)
+{
+    var eMachine, eWarning, fSuccess = true;
+
+    cAsyncMachines++;
+    Component.addMachine(idMachine);
+
+    var doneMachine = function() {
+
+        if (!--cAsyncMachines) {
+            if (fAsync) Web.enablePageEvents(true);
+        }
+    };
+
+    var displayError = function(sError) {
+        Component.log(sError);
+        displayMessage("Error: " + sError);
+        if (fSuccess) doneMachine();
+        fSuccess = false;
+    };
+
+    var displayMessage = function(sMessage) {
+        if (eWarning === undefined) {
+            /*
+             * Our MarkOut module (in convertMDMachineLinks()) creates machine containers that look like:
+             *
+             *      <div id="' + sMachineID + '" class="machine-placeholder"><p>Embedded PC</p><p class="machine-warning">...</p></div>
+             *
+             * with the "machine-warning" paragraph pre-populated with a warning message that the user will
+             * see if nothing at all happens.  But hopefully, in the normal case (and especially the error case),
+             * *something* will have happened.
+             *
+             * Note that it is the HTMLOut module (in processMachines()) that ultimately decides which scripts to
+             * include and then generates the embedXXX() call.
+             */
+            var aeWarning = (eMachine && Component.getElementsByClass(eMachine, "machine-warning"));
+            eWarning = (aeWarning && aeWarning[0]) || eMachine;
+        }
+        if (eWarning) eWarning.innerHTML = Str.escapeHTML(sMessage);
+    };
+
+    try {
+        eMachine = document.getElementById(idMachine);
+        if (eMachine) {
+
+            /*
+             * If we have a 'css' resource, add it to the page first.
+             */
+            var css;
+            if (typeof resources == "object" && (css = resources['css'])) {
+                var head = document.head || document.getElementsByTagName('head')[0];
+                var style = document.createElement('style');
+                style.type = 'text/css';
+                if (style.styleSheet) {
+                    style.styleSheet.cssText = css;
+                } else {
+                    style.appendChild(document.createTextNode(css));
+                }
+                head.appendChild(style);
+            }
+
+            if (!sXSLFile) {
+                /*
+                 * Now that PCjs is an open-source project, we can make the following test more flexible,
+                 * and revert to the internal template if DEBUG *or* internal version (instead of *and*).
+                 *
+                 * Third-party sites that don't use the PCjs server will ALWAYS want to specify a fully-qualified
+                 * path to the XSL file, unless they choose to mirror our folder structure.
+                 */
+                var sAppFolder = sAppClass;
+                if (DEBUG || sVersion == "1.x.x") {
+                    sXSLFile = "/modules/" + sAppFolder + "/templates/components.xsl";
+                } else {
+                    if (sAppClass.substr(0, 3) == "pdp") sAppFolder = "pdpjs";
+                    sXSLFile = "/versions/" + sAppFolder + "/" + sVersion + "/components.xsl";
+                }
+            }
+
+            var processXML = function(sXML, xml) {
+                if (!xml) {
+                    displayError(sXML);
+                    return;
+                }
+
+                /*
+                 * Non-COMPILED kludge to extract the version number from the stylesheet path in the machine XML file;
+                 * we don't need this code in COMPILED (non-DEBUG) releases, because APPVERSION is hard-coded into them.
+                 */
+                if (!COMPILED) {
+                    var aMatch = sXML.match(/<\?xml-stylesheet[^>]* href=(['"])[^'"]*?\/([0-9.]*)\/([^'"]*)\1/);
+                    if (aMatch) XMLVERSION = aMatch[2];
+                }
+
+                var transformXML = function(sXSL, xsl) {
+                    if (!xsl) {
+                        displayError(sXSL);
+                        return;
+                    }
+
+                    /*
+                     * Record the XSL file, in case someone wants to save the entire machine later.
+                     */
+                    Component.addMachineResource(idMachine, sXSLFile, sXSL);
+
+                    /*
+                     * The <machine> template in components.xsl now generates a "machine div" that makes
+                     * the div we required the caller of embedMachine() to provide redundant, so instead
+                     * of appending this fragment to the caller's node, we REPLACE the caller's node.
+                     * This works only because because we ALSO inject the caller's "machine div" ID into
+                     * the fragment's ID during parseXML().
+                     *
+                     *      eMachine.innerHTML = sFragment;
+                     *
+                     * Also, if the transform function fails, make sure you're using the appropriate
+                     * "components.xsl" and not a "machine.xsl", because the latter will not produce valid
+                     * embeddable HTML (and is the most common cause of failure at this final stage).
+                     */
+                    displayMessage("Processing " + sXMLFile + "...");
+
+                    /*
+                     * Beginning with Microsoft Edge and the corresponding release of Windows 10, all the
+                     * 'ActiveXObject' crud has gone away; but of course, this code must remain in place if
+                     * we want to continue supporting older Internet Explorer browsers (ie, back to IE9).
+                     */
+                    if (window.ActiveXObject || 'ActiveXObject' in window) {        // second test is required for IE11 on Windows 8.1
+                        var sFragment = xml['transformNode'](xsl);
+                        if (sFragment) {
+                            eMachine.outerHTML = sFragment;
+                            doneMachine();
+                        } else {
+                            displayError("transformNodeToObject failed");
+                        }
+                    }
+                    else if (document.implementation && document.implementation.createDocument) {
+                        var xsltProcessor = new XSLTProcessor();
+                        xsltProcessor['importStylesheet'](xsl);
+                        var eFragment = xsltProcessor['transformToFragment'](xml, document);
+                        if (eFragment) {
+                            /*
+                             * This fails in Microsoft Edge...
+                             *
+                            var machine = eFragment.getElementById(idMachine);
+                            if (!machine) {
+                                displayError("machine generation failed: " + idMachine);
+                            } else
+                            */
+                            if (eMachine.parentNode) {
+                                eMachine.parentNode.replaceChild(eFragment, eMachine);
+                                doneMachine();
+                            } else {
+                                /*
+                                 * NOTE: This error can occur if our Node web server, when processing a folder with
+                                 * both a manifest.xml with a machine.xml reference AND a README.md containing a
+                                 * machine link, generates duplicate embedXXX() calls for the same machine; if the
+                                 * first embedXXX() call finds its target, subsequent calls for the same target will
+                                 * fail.
+                                 *
+                                 * Technically, such a folder is in a misconfigured state, but it happens, in part
+                                 * because when we switched to the Jekyll web server, we had to add machine links to
+                                 * all README.md files where we had previously relied on manifest.xml or machine.xml
+                                 * processing.  This is because the Jekyll web server currently doesn't process XML
+                                 * files, nor is support for that likely to be added any time soon; it was a nice
+                                 * feature of the Node web server, but it's not clear that it's worth doing for Jekyll.
+                                 */
+                                displayError("invalid machine element: " + idMachine);
+                            }
+                        } else {
+                            displayError("transformToFragment failed");
+                        }
+                    } else {
+                        /*
+                         * Perhaps I should have performed this test at the outset; on the other hand, I'm
+                         * not aware of any browsers don't support one or both of the above XSLT transformation
+                         * methods, so treat this as a bug.
+                         */
+                        displayError("unable to transform XML: unsupported browser");
+                    }
+                };
+                loadXML(sXSLFile, null, sAppName, sAppClass, null, false, displayMessage, transformXML);
+            };
+
+            if (sXMLFile.charAt(0) != '<') {
+                loadXML(sXMLFile, idMachine, sAppName, sAppClass, sParms, true, displayMessage, processXML);
+            } else {
+                parseXML(sXMLFile, null, idMachine, sAppName, sAppClass, sParms, false, displayMessage, processXML);
+            }
+        } else {
+            displayError("missing machine element: " + idMachine);
+        }
+    } catch(e) {
+        displayError(e.message);
+    }
+    return fSuccess;
+}
+
+/**
+ * embedC1P(idMachine, sXMLFile, sXSLFile)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @return {boolean} true if successful, false if error
+ */
+function embedC1P(idMachine, sXMLFile, sXSLFile)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("C1Pjs", "c1pjs", APPVERSION, idMachine, sXMLFile, sXSLFile);
+}
+
+/**
+ * embedPCx86(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPCx86(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PCx86", "pcx86", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * embedPC8080(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPC8080(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PC8080", "pc8080", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * embedPDP10(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPDP10(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PDPjs", "pdp10", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * embedPDP11(idMachine, sXMLFile, sXSLFile, sParms)
+ *
+ * @param {string} idMachine
+ * @param {string} sXMLFile
+ * @param {string} sXSLFile
+ * @param {string} [sParms]
+ * @return {boolean} true if successful, false if error
+ */
+function embedPDP11(idMachine, sXMLFile, sXSLFile, sParms)
+{
+    if (fAsync) Web.enablePageEvents(false);
+    return embedMachine("PDPjs", "pdp11", APPVERSION, idMachine, sXMLFile, sXSLFile, sParms);
+}
+
+/**
+ * findMachineComponent(idMachine, sType)
+ *
+ * @param {string} idMachine
+ * @param {string} sType
+ * @return {Component|null}
+ */
+function findMachineComponent(idMachine, sType)
+{
+    return Component.getComponentByType(sType, idMachine + ".machine");
+}
+
+/**
+ * processMachineScript(idMachine, sScript)
+ *
+ * @param {string} idMachine
+ * @param {string} sScript
+ * @return {boolean}
+ */
+function processMachineScript(idMachine, sScript)
+{
+    return Component.processScript(idMachine, sScript);
+}
+
+/**
+ * Prevent the Closure Compiler from renaming functions we want to export, by adding them as global properties.
+ *
+ * TODO: Consider making all these functions properties on a single global object (eg, 'PCjs'), to minimize global
+ * pollution and risk of name collision.
+ */
+if (APPNAME == "C1Pjs") {
+    window['embedC1P']    = embedC1P;
+}
+if (APPNAME == "PCx86") {
+    window['embedPC']     = embedPCx86;         // WARNING: embedPC() deprecated as of v1.23.0
+    window['embedPCx86']  = embedPCx86;
+}
+if (APPNAME == "PC8080") {
+    window['embedPC8080'] = embedPC8080;
+}
+if (APPNAME == "PDPjs") {
+    window['embedPDP10']  = embedPDP10;
+    window['embedPDP11']  = embedPDP11;
+}
+
+window['findMachineComponent'] = findMachineComponent;
+window['processMachineScript'] = processMachineScript;
+
+window['enableEvents'] = Web.enablePageEvents;
+window['sendEvent']    = Web.sendPageEvent;
diff --git a/versions/pdpjs/1.35.0/pdp11.js b/versions/pdpjs/1.35.0/pdp11.js
index c121562e6..b3f0c11f7 100644
--- a/versions/pdpjs/1.35.0/pdp11.js
+++ b/versions/pdpjs/1.35.0/pdp11.js
@@ -302,4 +302,4 @@ function Jh(a,b,c){var d;if(d=/<([a-z]+)\s+ref="(.*?)"(.*?)\/>/g.exec(a)){var e=
 function Kh(a,b,c,d,e){function f(a){if(void 0===l){var b=k&&A(k,"machine-warning");l=b&&b[0]||k}l&&(l.innerHTML=ua(a))}function g(a){f("Error: "+a);m&&(--Gh||Oa(!0));m=!1}var k,l,m=!0;Gh++;Ua[b]={};try{if(k=document.getElementById(b)){var p;if("object"==typeof resources&&(p=resources.css)){var q=document.head||document.getElementsByTagName("head")[0],v=document.createElement("style");v.type="text/css";v.styleSheet?v.styleSheet.cssText=p:v.appendChild(document.createTextNode(p));q.appendChild(v)}d||
 (p=a,"pdp"==a.substr(0,3)&&(p="pdpjs"),d="/versions/"+p+"/1.35.0/components.xsl");p=function(e,l){l?Hh(d,null,a,null,!1,f,function(a,e){e?(Sa(b,d,a),f("Processing "+c+"..."),window.ActiveXObject||"ActiveXObject"in window?(e=l.transformNode(e))?(k.outerHTML=e,--Gh||Oa(!0)):g("transformNodeToObject failed"):document.implementation&&document.implementation.createDocument?(a=new XSLTProcessor,a.importStylesheet(e),(e=a.transformToFragment(l,document))?k.parentNode?(k.parentNode.replaceChild(e,k),--Gh||
 Oa(!0)):g("invalid machine element: "+b):g("transformToFragment failed")):g("unable to transform XML: unsupported browser")):g(a)}):g(e)};"<"!=c.charAt(0)?Hh(c,b,a,e,!0,f,p):Ih(c,null,b,a,e,!1,f,p)}else g("missing machine element: "+b)}catch(y){g(y.message)}return m}window.embedPDP10=function(a,b,c,d){Oa(!1);return Kh("pdp10",a,b,c,d)};window.embedPDP11=function(a,b,c,d){Oa(!1);return Kh("pdp11",a,b,c,d)};window.findMachineComponent=function(a,b){return Za(b,a+".machine")};
-window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==typeof b&&!ab[a]){for(var c=!0,d=ab,e=a,f=b.length,g=[],k=[],l="",m=null,p=0;p<f;p++){var q=b[p];if('"'==q||"'"==q)m&&q!=m?l+=q:(m?m=null:m=q,l&&(k.push(l),l=""));else{if(!m){if("\r"==q||"\n"==q)q=";";if(" "==q||"\t"==q||";"==q){l&&(k.push(l),l="");";"==q&&k.length&&(g.push(k),k=[]);continue}}l+=q}}l&&k.push(l);k.length&&g.push(k);d[e]=g;$a(a)||(c=!1)}return c};window.enableEvents=Oa;window.sendEvent=Qa;})();//# sourceMappingURL=/tmp/pdpjs/1.35.0/pdp11.map
+window.processMachineScript=function(a,b){var c=!1;a+=".machine";if("string"==typeof b&&!ab[a]){for(var c=!0,d=ab,e=a,f=b.length,g=[],k=[],l="",m=null,p=0;p<f;p++){var q=b[p];if('"'==q||"'"==q)m&&q!=m?l+=q:(m?m=null:m=q,l&&(k.push(l),l=""));else{if(!m){if("\r"==q||"\n"==q)q=";";if(" "==q||"\t"==q||";"==q){l&&(k.push(l),l="");";"==q&&k.length&&(g.push(k),k=[]);continue}}l+=q}}l&&k.push(l);k.length&&g.push(k);d[e]=g;$a(a)||(c=!1)}return c};window.enableEvents=Oa;window.sendEvent=Qa;})();//# sourceMappingURL=/versions/pdpjs/1.35.0/pdp11.map